QUEUED FINDINGS -- Stage-5 open + per-DC region session (2026-07-30) ==================================================================== Swept at session close. Items are LOGGED, NOT EXECUTED (hard rule 1). Each says where it already lives, or that this file is its first surface. Precedent: queued-findings-20260727, -20260729, -20260730. F1. THE `openstack` CLI DOES NOT EXIST ON THE DC CLIENT HOST -- blocks Stage 5 Step 7+. FIRST SURFACE: this file (was transcript + task list only). D-138 moved cloud-facing tools INTO the DC, but `python3-openstackclient 6.6.0` was installed on voffice1 on 2026-07-27 (CURRENT-STATE section 7) and is NOT on the dc0 rack or the region VM. Ten scripts invoke it -- phase-03-admin-openrc.sh, phase-04-network-{create,verify}.sh, phase-04-internal-cert-san-verify.sh, phase-05-{amphora-pipeline,octavia-verify}.sh, phase-06-{bootstrap,capi-stack,mgmt-vm, net-setup}.sh -- all against keystone's VIP 10.12.4.50 on provider-public, which voffice1 cannot reach. MEASURED PIN, do not re-derive: the snap is REFUTED (no Caracal channel; newest stable `zed` 2023-03), and noble's native OpenStack release IS Caracal 2024.1, so the deb is correct and needs no UCA. Install on the DC client host before Step 7 and add the host to CURRENT-STATE section 7. F2. metal-admin v6 HAS NODE ADDRESSES BUT NO RACK-SIDE LEG. FIRST SURFACE: this file (was transcript + task list only). MEASURED on the dc0 rack: `ip -6 -o addr show dev virbr2` returns EMPTY and ping6 to the controller gives "Network is unreachable", while v4 10.12.8.5 answers 0% loss. The 2026-07-27 IPv6 carve assigned v6 statics to NODES in MAAS but `dc-rack-net.sh` adds v4 legs only (10.12.8.2/.3/.4). NOT BLOCKING: juju fell back to v4 unaided, and node-to-node / agent-to-controller v6 on the same L2 needs no rack leg because every node holds a v6 static on the same /64. CONSEQUENCE TO CHECK LATER: anything RACK-ORIGINATED toward a node over v6 fails, and D-101 makes metal-admin dual-stack. Verify per plane per DC before concluding scope -- likely true on dc1 and on the other five planes. F3. PLANE FABRICS READ mtu=1500 WHILE THE LIBVIRT NETWORKS ARE mtu 9000. FIRST SURFACE: this file. From docs/audit/dc0-maas-carve-premigration-20260730.txt: all five named dc0 plane fabrics report `mtu=1500`. `virsh net-dumpxml vr1-dc0-metal-admin` reports ``. PRE-EXISTING -- not introduced by this session's work, and not chased here (hard rule 1). Why it matters: Ceph and geneve are the classic jumbo-frame consumers, phase-4 Step 12 carries a jumbo gate, and CURRENT-STATE already records "two lagging MTU segments" from the 2026-07-27 audit. Establish which layer is authoritative before the Stage-5 storage/network gates run. F4. `ceph-osd` CARRIES THE STALE VR0 CONSTRAINT `tags=openstack` (bundle.yaml:592). ALREADY ON SURFACE: docs/CURRENT-STATE.md section 1 + changelog item 2. Repeated here only so the sweep is complete. Decision is owed at Step 4.2's dry-run, where its impact is first observable. Measured absent from the VR1 region; only app of 56 with a tag constraint. F5. DOCFIX OWED (next-free 206; assign at delivery, never write the token above the high-water mark in prose first). TWO corrections, one DOCFIX: (a) `runbooks/dc-dc-phase4-juju-bundle-per-dc.md` Step 1's RUN LOCATION banner says every juju and maas command runs on voffice1. D-138 amends that for CLOUD-FACING tools; maas/NetBox/inner-tofu stay on voffice1. Steps 2, 3.5, 4, 4b and 5-12 all carry run-location text now wrong for the juju half. (b) Step 2's bootstrap command reads `--constraints` only; juju 3.6.27 assigns machine-targeting to `--bootstrap-constraints`. Operator ruled "Use both flags". D-104's amendment bullet carries the same single-flag wording. ALREADY ON SURFACE: changelog item 3 (the flag half). The run-location half is NEW here. NO GATE READS PROSE, so nothing in this repo catches either. F6. THE AS-EXECUTED LOG FOR THIS SESSION IS PARTIAL, AND THAT IS RECORDED NOT HIDDEN. FIRST SURFACE: this file (+ the index row added this session). The DOCFIX-097 Claude-Code lane wraps each live command as `script -aqe ~/as-executed/-.log -c ''`. MEASURED: the harness classifier REFUSED several wrapped forms (`script ... | tail`, `script ... | python3`, and two bare `script -aqe ... -c 'ssh voffice1 ...'` MAAS calls), while the plain `ssh voffice1 'maas admin ...'` form passed. Those calls therefore ran UNWRAPPED and are NOT in the log. Everything they did is in the changelog and CURRENT-STATE with read-backs, but a future session reading the as-executed log must not treat it as a complete record of this window. Candidate fix: a targeted permission rule for the wrapped form, so discipline and tooling stop fighting. F7. THE dc0 MANIFEST CARRIES A LITERAL `` PLACEHOLDER THAT CAN NEVER MATCH. PRE-EXISTING (from the 2026-07-30 part-2 reissue work), surfaced by this session's `creds-audit vr1-dc0` run: 2 problems -- MISSING `vr1-dc0-octavia-pki-.tar.gz` and UNDECLARED `vr1-dc0-octavia-pki-20260730T070146Z-1520866.tar.gz`. The manifest declares a placeholder filename rather than a glob, so the real timestamped backup is permanently both missing and undeclared. NOT this session's defect and NOT fixed here. F8. D-104's AMENDMENT PROSE SAYS "1 add / 0 change / 0 destroy"; MEASURED IT IS 2. ALREADY ON SURFACE: CURRENT-STATE + changelog item 7. `modules/node-vm` creates a `libvirt_domain` AND a `libvirt_volume` per node. The half that protects you -- `0 change / 0 destroy` -- is correct. D-104's own text is wrong at resource level for the same reason; flagged, not edited (not this item's surface). F9. TOOL TRAPS MEASURED THIS SESSION -- candidates for `references/platform-traps.md`. FIRST SURFACE for most: this file. (a) `ssh -n` REDIRECTS STDIN FROM /dev/null, so `ssh -n host bash -s <<'EOF'` silently runs NOTHING. Cost this session: a credential shred that never executed and a DB step that never ran. Conversely, an inner `ssh` WITHOUT `-n` EATS the remaining heredoc from the outer script -- which is what made that shred silently skip. Both directions bite; pick per call and verify by reading state back. (b) `printf ... | grep -q` UNDER `set -o pipefail` RETURNS FAILURE. grep short-circuits, printf takes SIGPIPE. Already recorded once this repo-day; it false-FAILED the G17 mirror assertion. Use a here-string: `grep -q PATTERN <<<"$BODY"`. (c) SNAP CONFINEMENT: the juju snap cannot read `/tmp` (private mount), so `juju add-cloud -f /tmp/x.yaml` fails with "no such file". Use `$HOME`. The repo already records the sibling trap for `openstackclients`. (d) A MAAS WRITE CAN RETURN A FULL 200-SHAPED JSON OBJECT AND CHANGE NOTHING. `interface update vlan=` on a `Deployed` machine returned the whole interface object while leaving the VLAN untouched; the refusal only surfaced later and indirectly as `{"subnet": ["None found with id=7."]}`. ALWAYS read the interface back. MAAS accepts interface changes only in New/Ready/Allocated/Broken. (e) `creds-matrix.tsv` IS SPACE-ALIGNED, NOT TAB-SEPARATED. `awk -F'\t'` returns zero rows and looks exactly like a real result. Already a standing lesson; it recurred. (f) `boot-resources import` RACES a just-created selection: the first import returned noble-only with `is-importing=false`. Assert on `Synced` ROWS, never on the import call returning. (g) PINNING MACs BOUNCES THE GUEST AND INTERRUPTS THE AUTO-COMMISSION THE FIRST APPLY TRIGGERED. Already promoted to CURRENT-STATE as a standing DC-standup rule. F10. THE D-135/D-107 EGRESS NARROWING WOULD BREAK IMAGE SYNC AND JUJU BOOTSTRAP OUTRIGHT. ALREADY ON SURFACE: CURRENT-STATE (this session). Repeated here because it is the highest-consequence unruled item left. MEASURED: three artifact classes, ONE local -- apt packages from 10.12.8.4 (local); MAAS boot images from images.maas.io (the mirror 404s on every simplestreams path); juju agent stream + juju/juju-db snaps from streams.canonical.com / api.snapcraft.io. The narrowing is described as "the closing mutation" and NOTHING currently sequences it after these. Needs either a ruling that sequences it explicitly, or D-135 items 2-3 built first. F11. THE JUJU CONTROLLER'S v6 GUA LEG ON provider-public WAS DELIBERATELY NOT APPLIED. ALREADY ON SURFACE: CURRENT-STATE. Role nodes carry `2602:f3e2:f02:10::NNN` on br-ex; the controller has v4 `10.12.4.5` only. A default route needs only the v4 leg, and handing a controller a public GUA is an operator call. Recorded so a later session does not silently "fix" the asymmetry. F12. TWO RULINGS TODAY REST ON WORK THAT IS AUTHORED BUT NOT APPLIED AT dc1. `vr1-dc1-maas-01` is in the substrate root and NOT applied; dc1's three region credentials are EXPECTED by the matrix and correctly FAIL S2. Both are deliberate -- one DC proves the sequence first -- but neither should be read as an oversight.