===================================================================== SESSION-CLOSE SWEEP -- transcript-only content, Stage-5 grounding audit Date: 2026-07-27 Branch: dc-dc-stage5-grounding-audit Precedent: docs/audit/queued-findings-20260726.txt and -20260727.txt Operator direction: "complete a session sweep for anything missed that should be committed that would be lost on session end". ===================================================================== PART A -- STALE SURFACES THIS SESSION ITSELF CREATED (all fixed in the same commit as this file; recorded because they are the exact defect class the audit was convened to find, committed by the audit) A1. `docs/audit/stage5-readiness-20260727.md` carried THIRTEEN `NEEDS-RULING` markers after every one of R1-R15 had been ruled or withdrawn. It is the "read this first" artifact, so it was the single most misleading surface in the repo at that moment. FIXED: a supersession banner at the top states that every `NEEDS-RULING` marker is historical, names the three authorities in order, and says what in the document is STILL true and worth reading (the ordered precondition sequence, the evidence column, the what-breaks column). The row-level markers were deliberately NOT rewritten -- they are the record of what was owed at the time, and rewriting them would destroy that. A2. `docs/audit/queued-rulings-20260727.md` still opened with "**Nothing here is adopted.**" after fourteen adoptions. FIXED: a STATUS block now states all questions are closed and names `design-decisions.md` / `CURRENT-STATE.md` as the ruling authorities rather than that file. The original sentence is struck through, not deleted. A3. SIX sections of that file had BLANK `OPERATOR UTTERANCE:` lines -- R8, R9, R10, R12, R13, R15 -- for rulings that WERE properly recorded in design-decisions.md and CURRENT-STATE.md. GA-R5 was satisfied; the question sheet was not. A future session reading only that file would have believed six questions were still open. FIXED: all six filled with the exact utterance plus where the ruling lives. NOTE: `R14-ORIGINAL` still has a blank line and that is CORRECT -- it is the superseded original question text kept for the audit trail, and its outcome is recorded in the `R14 WITHDRAWN` section immediately above it. PART B -- OPERATIONAL FACTS THAT LIVED ONLY IN THE TRANSCRIPT B1. **repo-lint L5 will reject a heading that LEADS with a D-number.** The rule (`scripts/repo_lint.py:355`) is `^##+\s+(D-\d{3,})\b(?!.*AMENDMENT|.*RESOLVED)` -- ANY heading level leading with `D-NNN` counts as a second DEFINITION of that decision unless the same line also contains `AMENDMENT` or `RESOLVED`. This bit this session TWICE (the R5 note, then the R13 sub-ruling) and cost two fix-forward cycles. The safe forms, both already used in-repo: `### RULING NOTE -- D-NNN: ...` (number AFTER the words) `## D-NNN -- AMENDMENT (): ...` (contains AMENDMENT) NOT recorded on any author-facing surface today. Worth a line in the decision-record conventions wherever those live -- this is a trap that only fires at commit time, after the writing is done. B2. **Gate your commits on lint, do not merely run lint near them.** Early in this session a red-lint commit was pushed because lint ran in the same compound command as the commit but the commit did not DEPEND on its result. Every later commit used `if bash scripts/repo-lint.sh >/dev/null 2>&1 || [ $? -eq 2 ]; then ... fi` (exit 2 = WARN-only, which is the expected steady state here). That guard then caught B1's second occurrence BEFORE it landed. B3. **Polling the live NetBox apex, read-only, without exposing the token.** `set -a; . ~/vr1-office1-creds/vr1-netbox-sandbox.env; set +a` `python3 netbox/office1-record-dump.py --out ` The script reads `NETBOX_URL` + `NETBOX_TOKEN` from the environment and prints neither; it states "NOTHING was written to NetBox". This is the correct way to answer an apex question and it is what should have been done BEFORE putting R2a to the operator. B4. **Probe path determines the answer -- the office1 VMs are reachable from vcloud, NOT from voffice1.** A clone check run via `ssh voffice1 'ssh office1-netbox ...'` returned "unreachable"; run directly from vcloud it returned a real NO-CLONE. "Unreachable" is not "absent", and the first result must never be recorded as a negative finding. Same rule that turned `/root/maas-secrets` from "does not exist" into UNREADABLE on 2026-07-26. B5. **`creds-matrix.tsv` is SPACE-ALIGNED, not tab-separated** despite the extension. Parsing it with `awk -F'\t'` returns ZERO rows and looks like a real result. The repo's own tooling splits on default whitespace. This nearly produced a published figure contradicting a correct earlier finding. PART C -- THE META-FINDING, recorded because it should shape the NEXT committee C1. **The lenses' OBSERVATIONS were reliable; their CONCLUSIONS were not.** Three of this audit's own premises had to be corrected by measurement, each time in the direction of LESS work or a DIFFERENT problem: - R2a: the v6 literals were already assigned under D-111. The question should never have been asked; lens 2 had explicitly warned the apex was UNMEASURED and that warning was not acted on. - R9: there is ONE failure mode, not two, and the Stage-5 blast radius is TWO scripts, not twenty. - R14: the register already attributed AND explained the findings, and the notes file already warned against the exact suppression the question contemplated. Additionally R3 shrank to two lagging segments, R1 narrowed from 18 volumes to 8, and R8's entire evidence base collapsed on reading the cited bugs. **Standing lesson for the next committee: a lens finding is an OBSERVATION, not a conclusion. Measure before putting it to the operator as a question.** The operator's own instruction is the sharpest statement of it: "Research is cheap, guesswork is expensive." C2. **A citation is an existence claim; only its CONTENT is evidence.** The v4-only lb-mgmt draft rested on two Launchpad numbers in a comment block. Read: one was a different installer's bug, Fix Released in 2021; the other was not an IPv6 defect at all but an OVN/LXD/MAAS FQDN binding bug whose fix shipped in OVS 2.15 (our nodes install 2.17.9). Nothing in the repo could catch this, because no gate reads prose. Same family as the two ruled-but-never-built decisions this audit found (D-134's bands, D-020's vault VIP): a plausible in-repo statement that nothing verifies. PART D -- NOT DONE, and deliberately so - The skill (`.claude/skills/openstack-cloud-ops/`) was NOT swept this session. Stage-close discipline normally folds new invariants in and regenerates the dated Chat snapshot. This session closed no STAGE -- it produced rulings and findings against an open one -- so the skill sweep is not owed yet. B1, C1 and C2 above are the candidates when Stage 5 does close. - The 21-item DOCFIX batch and every ruling's execution remain LOGGED NOT EXECUTED. No D-/DOCFIX-/BUNDLEFIX- number was consumed this session.