diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index 0fe1d05..133cb13 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -6,9 +6,11 @@
 # openstack-cloud-ops
 
 Operating skill for the Omega Cloud: a commercial, multi-tenant, tenant
-self-administered OpenStack cloud. Current phase: single-DC virtual rehearsal
-("testcloud", VR0 DC0) on four KVM hosts, rehearsing a future bare-metal
-multi-datacenter deployment ("Roosevelt"). The governing design constraint is
+self-administered OpenStack cloud, built as virtual rehearsals (VR0 single-DC
+"testcloud"; VR1 two-DC + Office1 headend) for a future bare-metal
+multi-datacenter deployment ("Roosevelt"). The CURRENT phase/stage lives in
+repo `docs/CURRENT-STATE.md` ONLY (GA-R1) -- never trust a phase claim from
+this file or memory. The governing design constraint is
 MINIMIZE DELTA TO ROOSEVELT: the runbooks and scripts are primary deliverables
 alongside the running cloud, so transferable answers beat quick fixes.
 
@@ -36,11 +38,14 @@
 The repo is a living draft; this skill's invariants (discipline, hardening)
 change slowly, its facts (IPs, versions, phase status) go stale fast.
 
-**Long sessions get compacted.** At session start (and after any compaction), read
-`docs/session-ledger.md` and run `bash scripts/ledger-scan.sh` to recover what is in flight and
-reconcile it against repo ground truth (open decisions, open security rows, next-free numbers).
-Update the ledger at every deliverable -- it is standing, like the changelog. See
-`references/operating-discipline.md` (Session continuity).
+**Session bookends (GA-R1/GA-R4).** OPEN: read `docs/CURRENT-STATE.md` in full
+BEFORE any other doc (it is the only status authority), then `docs/session-ledger.md`
++ `bash scripts/ledger-scan.sh` to recover what is in flight and reconcile it against
+repo ground truth (open decisions, open SEC count, next-free numbers). Re-do this
+after any compaction. CLOSE: a bounded ledger summary (15-line hard cap, GA-R4 rule
+1); the full session body goes to `docs/archive/` in the same close commit; commit
+and push -- a session ending without its bookend is treated as NOT durable by the
+next session. See `references/operating-discipline.md` (Session continuity).
 ## Step 1 - detect the environment
 
 - **Live shell to the jumphost / infra** (Claude Code on `vcloud` or
@@ -79,7 +84,7 @@
 |---|---|
 | Any command block, script, or paste block you are about to write | `references/script-authoring.md` |
 | Deploy / redeploy / teardown (VR0, single-DC testcloud) | repo `runbooks/README.md`, then the phase-NN runbook; conventions in `references/operating-discipline.md` |
-| VR1 DC-DC buildout (two-DC + Office1 headend -- the current live mission) | repo `docs/dc-dc-deployment-workflow.md` FIRST (stage status + tooling gap register), then `runbooks/README.md`'s "VR1 DC-DC track" section for the `dc-dc-phase0..6` runbooks + `dc-dc-teardown-rollback.md`. SEPARATE track from VR0's phase-NN above -- do not conflate stage numbers between the two. |
+| VR1 DC-DC buildout (two-DC + Office1 headend -- the current live mission) | repo `docs/CURRENT-STATE.md` FIRST (stage/gate STATUS lives there only), then `docs/dc-dc-deployment-workflow.md` (stage identity, links, gap register), then `runbooks/README.md`'s "VR1 DC-DC track" section for the `dc-dc-phase0..6` runbooks + `dc-dc-teardown-rollback.md`. SEPARATE track from VR0's phase-NN above -- do not conflate stage numbers between the two. |
 | Something is broken (triage, incidents) | `references/troubleshooting.md`, then repo `runbooks/appendix-A-troubleshooting.md` |
 | CAPI / Magnum / mgmt-VM recovery | repo `runbooks/ops-capi-recovery.md` |
 | Deliver ANY repo change (script, runbook, doc) | run `bash scripts/repo-lint.sh` + the touched script's `tests/<name>/run-tests.sh` BEFORE handing it over |
@@ -89,12 +94,12 @@
 | VR1 site unreachable after a vcloud reboot (`ssh voffice1` / `office1-*` time out) | `bash scripts/site-baseleg.sh check office1` -- `office1-local` is an ISOLATED libvirt net, so the host's base L3 leg (`10.10.0.10/24` + compose route `10.10.1.0/24 via 10.10.0.20`) is dropped every reboot; the `After=libvirtd` unit re-adds it (D-126 amendment / D-128). If MISS and the unit is not yet installed: `sudo bash scripts/site-baseleg.sh apply office1`. This is the vcloud path; the workstation reaches the same over the tailnet (D-107). |
 | Starting any consequential live session | `bash scripts/run-logged.sh <label>` first (as-executed log; docs/as-executed-log-convention.md) |
 | Credential exposures / security TODOs | repo `docs/security-ledger.md` -- add a row, never only a script comment |
-| Resuming work / what is still in flight (esp. after compaction) | repo `docs/session-ledger.md`, then `bash scripts/ledger-scan.sh` to reconcile against repo ground truth |
+| Resuming work / what is still in flight (esp. after compaction) | repo `docs/CURRENT-STATE.md` first, then `docs/session-ledger.md` + `bash scripts/ledger-scan.sh` to reconcile against repo ground truth |
 | Tenant onboarding / tenant self-service | repo `scripts/tenant-onboard.sh` + `runbooks/tenant-onboarding-v2-DRAFT.md` + `appendix-C/D` |
 | Network / plane / IPAM questions | `references/environment.md`, repo `scripts/lib-net.sh`, NetBox (the IPAM apex -- but during VR1 the WORKING apex is `office1-netbox`, 10.10.1.10, per DOCFIX-195; `netbox.baldurkeep.com` is a READ-ONLY v1 reference, write-back deferred to end-of-deployment) |
 | ANY change request to a built surface | grep repo `docs/design-decisions.md` for the governing D-NNN FIRST - PROPOSED/OPEN means the operator has not ruled: present options, do not implement |
 | Why is it built this way? / proposing changes | repo `docs/design-decisions.md` (D-NNN); grep before assigning a new number |
-| Versions, channels, pins | repo `runbooks/appendix-B-asbuilt-version-lock.md` |
+| Versions, channels, pins | repo `docs/CURRENT-STATE.md` section 7 (VR1 substrate -- measured pin authority); `runbooks/appendix-B-asbuilt-version-lock.md` (VR0 charm channels) |
 | Environment facts (hosts, repo, planes) | `references/environment.md` |
 | OpenTofu / libvirt / MAAS / OPNsense IaC work (repo `opentofu/`) | `references/opentofu-provider-docs.md` FIRST (sources + fetch method), then repo `opentofu/README.md` (per-module ground truth, schema notes, audit findings -- but its OPNsense section is SUPERSEDED by D-112/D-113) |
 | Creating/changing a `libvirt_domain`; anything about nested KVM, a libvirt storage pool, LXD versions, an OPNsense edge, or a VM that boots wrong | `references/platform-traps.md` -- per-tool traps + version pins + a verbatim-error index (KiB-vs-MiB memory, `acpi=off`, missing `cpu` block = no `svm`, "in-place" bounces the guest, AppArmor on non-default pools, MAAS-vs-LXD 6.7, lxdbr0's dnsmasq, tcsh on the edge) |
@@ -132,9 +137,12 @@
 **Change-delivery loop:** grep for prior art (zeroth decision) -> grep
 design-decisions for the governing D-NNN -> edit -> `bash scripts/repo-lint.sh`
 -> run the touched script's harness (create one if missing -- no script change
-ships without its harness) -> deliver as repo-relative ZIP + a changelog entry
-with a per-item revert. Under blanket approval, the changelog IS the review
-surface: every item states what, why (evidence), and how to revert.
+ships without its harness) -> deliver with an entry in the SESSION changelog
+(ONE changelog per session, GA-R2/D1 -- never per-topic files) carrying a
+per-item revert. Under blanket approval, the changelog IS the review surface:
+every item states what, why (evidence), and how to revert. Changelogs are
+session-scoped scratch: consolidated per-stage at stage close, NEVER citable
+as status or decision authority.
 
 **Deploy loop (VR0, single-DC testcloud):** phase-00 runbook (D-061 destroy
 path) -> `bash scripts/preflight.sh` PASS -> phase-01..08 gated -> `bash
@@ -146,16 +154,20 @@
 (`dc-dc-phase0-vcloud-prep.md`) gated -> Stage 2..7 gated in order, per
 `runbooks/README.md`'s "VR1 DC-DC track" table -> if a stage's `tofu apply`
 fails partway, read `runbooks/dc-dc-teardown-rollback.md`'s rollback decision
-tree BEFORE reaching for a teardown (fix-forward is usually correct). Every
-`opentofu/` command is UNVALIDATED (no `tofu` binary has run in any session
-that authored this tree) -- run `bash scripts/opentofu-validate.sh` first if
-available, and treat every OpenTofu step as reviewed-but-unexercised. **At STAGE
-CLOSE** (every close-out gate MET, gauntlet ALL GREEN, repo-lint 0-fail): MERGE the
-stage branch to `main` (merge commit, NOT squash; operator-gated) as PART of the
-stage's definition-of-done, then RETIRE the branch (local + remote). **ALSO sweep THIS
-skill in the same close:** fold in any new INVARIANT the stage established and reconcile
-any divergence from repo HEAD (facts delegate to the repo and go stale; invariants live
-here and must be kept current). The next stage branches off post-merge `main`. `main` is
+tree BEFORE reaching for a teardown (fix-forward is usually correct). Run
+`bash scripts/opentofu-validate.sh` before any tofu step; whether a given
+root/step has been exercised for real is a STATUS question -- check
+CURRENT-STATE, never this file's memory of it. **At STAGE
+CLOSE** (GA-R6): a stage or verification-type gate CLOSES only on a NAMED executable
+check whose captured output the closing commit cites -- prose cannot close a stage,
+and there is NO conditional close (a remainder splits into its own gate row or the
+stage stays open, E3). Ruling-type gates close per GA-R5 (recorded, pushed ruling).
+The close-out set is executable: gauntlet ALL GREEN, repo-lint 0-fail, the stage's
+GA-R2 consolidation commit landed, the GA-R7 memory review run, MERGE the stage
+branch to `main` (merge commit, NOT squash; operator-gated), then RETIRE the branch
+(local + remote). **ALSO sweep THIS skill in the same close:** fold in any new
+INVARIANT the stage established and reconcile any divergence from repo HEAD (facts
+delegate to the repo and go stale; invariants live here and must be kept current). The next stage branches off post-merge `main`. `main` is
 trunk-of-record only for stages that have merged (precedent: Stage 2 -> PR #1 `e468d2e`,
 2026-07-15). See `docs/dc-dc-deployment-workflow.md` "Cross-cutting discipline".
 
@@ -164,6 +176,42 @@
 message -> recorded fix, gated -> log the finding (new root causes become
 appendix-A/DOCFIX material).
 
+## Record authority and session discipline (GA-R1..R7, ratified 2026-07-18)
+
+Ratified text: repo `docs/audit/ga-rulings.md` -- this is the operating summary.
+
+- **`docs/CURRENT-STATE.md` is the ONLY status authority (GA-R1).** Stage,
+  gates, plan counts, version pins, decision-queue state live THERE and nowhere
+  else; other surfaces point or are history. Any commit that changes a status it
+  carries updates it in the SAME commit (C1; repo-lint L10 enforces). It is
+  authoritative over documents, never over measurement -- a fresh capture wins
+  and corrects it in the capture's commit (C2).
+- **Plan counts and versions are quoted only from captured command output** --
+  a dated capture file or a quoted command + output; never from memory or
+  another document's prose (GA-R1 rule 2). Legal stage/gate status tokens are
+  OPEN / BLOCKED / HELD / CLOSED, used only in CURRENT-STATE (vocabulary ruling,
+  Option A: readiness is not a state; event words are history, never states).
+- **Rulings are gated like mutations (GA-R5).** ONE decision per operator
+  exchange -- batch adoptions are invalid. A ruling exists only when its Status
+  line quotes the question AND the operator's exact utterance, dated, committed
+  and pushed before dependent work. Ambiguous/template answers rule NOTHING:
+  stop and ask. Never adopt from an inferred or reconstructed ruling -- an
+  operator ruling is a value under hard rule 2.
+- **D-number admission (GA-R3):** a new D-number needs architectural consequence
+  beyond the stage, a Roosevelt-delta (the A1 test: a Roosevelt build session
+  would grep it before touching a built surface), or supersession. Everything
+  else is OPERATIONAL: runbook edit / session-changelog line / as-built row,
+  never a D-number. Entries carry [ARCH]/[OPS] tags; doubt resolves DOWN to OPS.
+- **Memory governance (GA-R7):** auto-memory records observations and
+  conventions ONLY -- never operator policy, priorities, or postures. Any
+  memory claiming operator intent is PROPOSED until confirmed verbatim; remove
+  on discovery. Durable observations GRADUATE to their repo surface; memory is
+  never the only copy. Stage close includes a full memory review (rules 1-4).
+- **Reconciliation circuit-breaker.** If you have been fixing records to match
+  records for more than one cycle without touching the actual deliverable,
+  STOP and report to the operator. Record-churn presenting as progress is this
+  project's measured failure mode (GA-F06); escalating is the correct move.
+
 ## Posture
 
 - This is a commercial multi-tenant cloud with HARD tenant isolation (SCS
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index a62e838..9ecafb2 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -202,7 +202,7 @@
 |---|------|----------------|-------|---------------------------|
 | G1 | Audit Phase 3: fresh-agent grounding test | [V] 3 clean-context probes score the 7-question set against this doc; holes map made | session | CLOSED 2026-07-18: 3 probes, 21/21 PASS, holes H1 (amended into G9) + H2 (no action) -- `docs/audit/phase3-grounding-test-20260718.md` |
 | G2 | Audit Phase 4: GA-R1..R7 structural rulings + the stage-status vocabulary A/B | [R] ruling-type gate (GA-R6 rule 6): closes when every item carries a GA-R5 Status block | operator | CLOSED 2026-07-18: all seven GA-R + vocabulary (Option A + H1) RATIFIED, utterances quoted (`docs/audit/ga-rulings.md`, through commit `fe4f1c4` + this one) |
-| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | [R] operator-gated fix batches, each commit naming its GA-F | operator + session | Batch 0 OPENED by operator 2026-07-19; items 0.1 (repo-lint L10, GA-R1/C1), 0.2 (SEC repoint, GA-R4/F3), 0.3 (counter hardening, GA-F15), 0.4 (extractor vocab scan, GA-F10/H1) landed; Batch 0 CLOSED (verification passed 2026-07-19); Batches 0-4 CLOSED 2026-07-19 (Batch 4: GA-R4 ledger rotation 1187->131 lines, F1 cap now enforceable; 96 changelogs + 24 history docs consolidated to docs/archive/ with 4 stage records + per-stage manifest commits; top-level docs/ = 16 files < 25; live-surface refs rewritten); Batches 5-6 await gates; Batches 2-6 await gates; FREEZE holds for un-gated surfaces |
+| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | [R] operator-gated fix batches, each commit naming its GA-F | operator + session | Batch 0 OPENED by operator 2026-07-19; items 0.1 (repo-lint L10, GA-R1/C1), 0.2 (SEC repoint, GA-R4/F3), 0.3 (counter hardening, GA-F15), 0.4 (extractor vocab scan, GA-F10/H1) landed; Batch 0 CLOSED (verification passed 2026-07-19); Batches 0-4 CLOSED 2026-07-19 (Batch 4: GA-R4 ledger rotation 1187->131 lines, F1 cap now enforceable; 96 changelogs + 24 history docs consolidated to docs/archive/ with 4 stage records + per-stage manifest commits; top-level docs/ = 16 files < 25; live-surface refs rewritten); Batch 5 CLOSED 2026-07-19 (skill sweep: GA section added reconciled against ratified text, stale phase/UNVALIDATED claims demoted, bookends + stage-close rewritten; checklist docs/audit/skill-sweep-checklist-20260719.md); Batch 6 awaits its gate; Batches 2-6 await gates; FREEZE holds for un-gated surfaces |
 | G4 | The two D-130 verifications | [V] run them, capture output | session | CLOSED 2026-07-19: v8 suppression CONFIRMED (7/2/7 -> 6/2/6, zero forces-replacement; `docs/audit/outer-plan-20260719-v8-ignorechanges.txt` + `-baseline.txt`); v7 no-bounce under running domain, zero residue (`docs/audit/throwaway-v7-20260719.txt`) |
 | G5 | D-130 mechanism ruling (seed-volume durable fix) | [R] operator rules in Phase 5, quoting G4's captured output | operator | CLOSED 2026-07-19: D-130 ADOPTED (a) ignore_changes (`docs/design-decisions.md` D-130, GA-R5 utterance quoted); implemented in `modules/cloudinit-vm` + `tests/cloudinit-vm` |
 | G6 | State reconcile of autostart + seed WITHOUT bouncing guests | [R] gated mechanism, operator-ruled (S3) | operator | CLOSED 2026-07-19: ruled (ii) state surgery (GA-R5); pull -> inject autostart:true on both domains -> push (serial 22->23, backup `terraform.tfstate.pre-G6-20260719`); guests never touched (ids 1/2 unchanged, running) |
diff --git a/docs/audit/skill-sweep-checklist-20260719.md b/docs/audit/skill-sweep-checklist-20260719.md
new file mode 100644
index 0000000..e5d7a2d
--- /dev/null
+++ b/docs/audit/skill-sweep-checklist-20260719.md
@@ -0,0 +1,37 @@
+# Skill-sweep read-through checklist (Batch 5, 2026-07-19)
+
+Line-by-line reconciliation of the openstack-cloud-ops skill against
+`docs/audit/ga-rulings.md` (every ratified rule -> where the skill now
+implements, delegates, or is correctly silent). The skill's own draft
+additions (`skill-additions-proposed.md`) were reconciled against the
+RATIFIED text, not applied verbatim.
+
+| Ruling / rule | Skill disposition |
+|---|---|
+| GA-R1 r1 (only status authority; C2 measurement-wins) | New GA section bullet 1; header phase claim DEMOTED to a CURRENT-STATE pointer; routing rows (VR1 track, versions, resume) re-pointed |
+| GA-R1 r2 (claims cite captures) | GA section bullet 2 |
+| GA-R1 r3 (demotions incl. skill drops pins) | Done in Batch 2 (GA-F03/F04 skill rows -> pointers); versions routing row now names the two pin authorities |
+| GA-R1 r4-r5 (360 cap, rotation) | CURRENT-STATE-internal rules; skill correctly silent |
+| GA-R1 r6 (status vs as-built division) | Versions routing row splits CURRENT-STATE section 7 vs appendix-B |
+| GA-R1 r7 (signature replacement) | Document-internal; skill silent |
+| GA-R1 r8/C1 (same-commit coupling) | GA section bullet 1 names L10 as the enforcing check |
+| GA-R2 r1-4 + D2 (consolidation, under-25) | Executed in Batch 4; skill's stage-close loop now names the consolidation commit as close-out item |
+| GA-R2 r5/D1 (one changelog per session; never citable) | Change-delivery loop rewritten; "session-scoped scratch, never citable" line added |
+| GA-R3 r1-5 + A1/A2 (admission, tags, doubt-down) | GA section bullet 4; register itself carries the convention block (Batch 2 item 2.7) |
+| GA-R4 r1-3 + F1 (bookends, 15-line cap, 300 cap) | Session-bookends block rewritten (OPEN = CURRENT-STATE first; CLOSE = bounded summary + archived body + push) |
+| GA-R4 r5/F3 (ledger = narrative; SEC pointer+count) | Implemented in Batch 0.2 (ledger-scan); skill bookends block carries the narrative-only shape |
+| GA-R4 r6-7 (one-time rotation; orphan closes) | Rotation executed Batch 4 C1; orphan-close (F2) is ledger-procedural -- skill silent by design (the ledger header carries it) |
+| GA-R5 r1-5 + B1/B2 (one ruling/exchange, utterance quoted, committed, ambiguity stops) | GA section bullet 3; ties to hard rule 2 per the proposed draft |
+| GA-R6 r1-3 + E1-E3 (named-check closes, no conditional close, [V]/[R] types) | Stage-close loop rewritten with the full close-out set |
+| GA-R6 r4 (close-out set incl. memory review + consolidation) | Same rewrite |
+| GA-R7 r1-5 + G1/G3 (memory observations-only, graduate, review) | GA section bullet 5; repo-root launch line added in Batch 3 (rule 6) |
+| GA-R7 r8/G2 (auto-memory posture) | Session-type posture; skill silent (probe/audit sessions get it from the charter) |
+| Vocabulary (Option A + H1) | GA section bullet 2 names the legal set + readiness-is-not-a-state |
+| Proposed "reconciliation circuit-breaker" (draft-only, no ruling) | Kept -- consistent with the audit's measured churn finding (GA-F06); marked as discipline, not a ruling quote |
+
+Stale facts removed from the skill this sweep: the header's "current phase =
+VR0 DC0 testcloud" claim; the deploy loop's "every opentofu/ command is
+UNVALIDATED / no tofu binary has ever run" claim (false since 2026-07-13);
+the workflow-doc-as-status-source routing. Facts now delegate; invariants
+stay. Skill length 176 -> 224 lines (the GA section costs ~35 lines per the
+draft's own budget; the bookends/close rewrites are net-neutral).
diff --git a/docs/changelog-20260719-phase5-sweep.md b/docs/changelog-20260719-phase5-sweep.md
index 4b85f91..98b0e82 100644
--- a/docs/changelog-20260719-phase5-sweep.md
+++ b/docs/changelog-20260719-phase5-sweep.md
@@ -249,3 +249,18 @@
   D-068 analysis (open-decision evidence), live session changelog.
   Live-surface references to every moved file rewritten to archive paths
   (18 files touched); history-internal refs left verbatim.
+
+## Batch 5 -- skill sweep (OPENED by operator 2026-07-19; single commit)
+
+SKILL.md reconciled against the RATIFIED GA-R texts (not the draft): new
+"Record authority and session discipline" section (~35 lines per the
+draft's budget); header phase claim + the false "opentofu UNVALIDATED /
+no tofu binary" claim DEMOTED to CURRENT-STATE delegation; session
+bookends rewritten (OPEN = CURRENT-STATE first; CLOSE = 15-line summary
++ archived body + push); stage-close loop gains the GA-R6 close-out set
+(named-check closes, no conditional close, consolidation commit, memory
+review); change-delivery loop gains D1 (one session changelog, never
+citable); routing rows re-pointed (VR1 status, versions, resume). The
+draft's reconciliation circuit-breaker KEPT as discipline (no ruling
+quote -- marked as such). Line-by-line checklist:
+docs/audit/skill-sweep-checklist-20260719.md. 176 -> 224 lines.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index e968e17..90c9a87 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -134,3 +134,8 @@
   96 changelogs + 24 history docs consolidated to docs/archive/ (4 stage records, manifest commits
   C2-C5); top-level docs/ = 16 (< 25); live refs rewritten. Verification in the close commit.
 - Next gate: operator opens Batch 5 (skill sweep) then Batch 6 (exit runs).
+
+- BATCH 5 COMPLETE (2026-07-19, same session): skill swept against ratified GA-R1..R7 + vocabulary;
+  checklist committed (docs/audit/skill-sweep-checklist-20260719.md); repo-lint 0-fail. Single commit.
+- Next gate: operator opens Batch 6 (exit runs) -- NOTE the flagged extractor-semantics decision
+  (docs/archive/ exclusion) wants ruling at Batch 6 open.