diff --git a/.claude/worktrees/agent-a5205968d7cc88ec9 b/.claude/worktrees/agent-a5205968d7cc88ec9
new file mode 160000
index 0000000..0efbcb0
--- /dev/null
+++ b/.claude/worktrees/agent-a5205968d7cc88ec9
@@ -0,0 +1 @@
+Subproject commit 0efbcb0049a1d2969712b8820969d1183e0e1978
diff --git a/.claude/worktrees/agent-a73ec798b0885034a b/.claude/worktrees/agent-a73ec798b0885034a
new file mode 160000
index 0000000..0efbcb0
--- /dev/null
+++ b/.claude/worktrees/agent-a73ec798b0885034a
@@ -0,0 +1 @@
+Subproject commit 0efbcb0049a1d2969712b8820969d1183e0e1978
diff --git a/clientdocs/sweep-receipt.txt b/clientdocs/sweep-receipt.txt
index 0f82357..a439312 100644
--- a/clientdocs/sweep-receipt.txt
+++ b/clientdocs/sweep-receipt.txt
@@ -37,5 +37,5 @@
 927aa7261aa2d9fabe2cb7342499e6c0d0840a93ffbb323ee7003ac8eefe14a7  runbooks/tenant-onboarding-v2-DRAFT.md
 b8ad0768a1cad3e9a3e329f3cda39e6a151b80c0df5f0402efb65cb290b6b0b3  scripts/tenant-acceptance.sh
 ad00be489480069d52df1b978be0360d7fb04dbf954a8cf487162872f2da0593  scripts/tenant-assert.sh
-014099679916bb8fe51d8c78f0377440bf5c1039d1590c181aba89d48345ce6d  scripts/tenant-offboard.sh
+b7022866fc0fac036716c1a45e575279558593992d47631a00d3509d2cb4fdcd  scripts/tenant-offboard.sh
 d221f6ed0aabaf7faab12e16ccbc655a324d3ea873c8ed183cbcd9353e24973a  scripts/tenant-onboard.sh
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index af38c5e..f05efc0 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -428,6 +428,23 @@
     -- trim testcloud quotas or document the capacity ceiling in clientdocs
     (unruled, operator). Everything else in that audit is closed.
 
+## Jumphost stream -- session 2026-07-08 (cont.): S-class script-quality batch (operator-greenlit)
+
+Operator greenlit the recommended sequence: (1) Phase A stderr fix, (2) S7+S4,
+(3) S8; HOLD S1/S2/S3/S5 (lib-validate adoption on tenant-onboard/offboard) until
+the DOCFIX-126/127 live-verify lands. Source: docs/script-quality-findings-20260707.md.
+
+- **DONE -- DOCFIX-131 (addendum 49): tenant-offboard.sh Phase A stdout-only.**
+  New `tinv()` (tenant-scoped `inv()` twin) for the 3 Phase A `coe cluster list`
+  captures; wait loop retries on list-error, final check fails closed. Latent bug:
+  merged stderr could false-trip exit 21 on an already-clean tenant. Harness un-
+  excludes coe from warnstderr + new coe-stderr-not-argv assertion (22/22).
+  Gauntlet 38/38, lint 0 fail, L7 re-recorded. Committed + pushed.
+- **NEXT in batch (pure DRY, low-risk):** S7 (dead code d011-03/04), S4
+  (trust_filter.py extraction x3), S8 (lib-net.sh literal centralization). Plan:
+  one combined commit DOCFIX-132..134. Then batch complete except the HELD
+  lib-validate adoption (S1/S2/S3/S5).
+
 ## REMAINING OPEN WORK (single list for session resume; 2026-07-07, updated post-devteam-window)
 
 1. **Devteam delivery -- last two steps are OPERATOR-MANUAL (everything
diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md
index 5089629..e2f0995 100644
--- a/docs/v1-redeploy-changelog.md
+++ b/docs/v1-redeploy-changelog.md
@@ -3256,4 +3256,32 @@
 - Numbers consumed: DOCFIX-130.
 REVERT: git checkout HEAD~ -- clientdocs/jenkins-kubernetes-guide.md clientdocs/sweep-receipt.txt docs/v1-redeploy-changelog.md docs/session-ledger.md; then bash scripts/repo-lint.sh --record-clientdocs-sweep.
 
-Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-131, BUNDLEFIX-012.
+### 2026-07-08 (addendum 49, jumphost stream) -- DOCFIX-131: tenant-offboard.sh Phase A cluster captures stdout-only (latent false-exit-21 bug)
+
+The Phase A cluster captures still merged stderr (`2>&1`) -- the last such sites in
+the offboard (Phase C/D were fixed in DOCFIX-113). A benign CLI deprecation warning
+on `coe cluster list` would word-split into the delete loop and, worse, keep the
+wait loop from ever seeing "empty" -- a FALSE "clusters not gone in budget" FATAL
+exit 21 on a tenant whose clusters WERE gone. Client-facing offboard; latent
+correctness/safety bug, not cosmetics. Operator-greenlit from the S-class batch.
+
+- **Fix:** new `tinv()` -- the tenant-scoped twin of the DOCFIX-113 `inv()`: runs
+  the command under `tenant_env` in the capture subshell, stdout-only, stderr to a
+  tempfile SURFACED as a NOTE. The three Phase A `coe cluster list` captures
+  (inventory ~line 180, wait loop, final check) route through it. The wait loop
+  gains retry-on-list-error and the final check fails closed if the list errors
+  (mirrors the Phase C LB-wait pattern) -- an empty stdout on a genuinely failed
+  list no longer reads as "gone".
+- **Harness:** the mock's `warnstderr` scenario no longer EXCLUDES coe (the
+  exclusion existed precisely because this was unfixed); the existing
+  stderr-not-argv test now exercises the Phase A path, plus a new explicit
+  `coe-stderr-not-argv` assertion (NOTE surfaced + no false exit 21). 22/22 (was
+  21/21). Gauntlet 38/38; repo-lint 0 fail; L7 receipt re-recorded (tenant-offboard.sh
+  is a pinned tenant-facing file; internal change, no clientdocs staleness).
+- Closes the addendum-25 inventory's last Phase-A stderr-merge item; the other two
+  (domain-show/token-issue fail-closed cosmetics; Phase E0 display-only pollution)
+  remain lower-priority candidates.
+- Numbers consumed: DOCFIX-131.
+REVERT: git checkout HEAD~ -- scripts/tenant-offboard.sh tests/tenant-offboard/run-tests.sh clientdocs/sweep-receipt.txt docs/v1-redeploy-changelog.md docs/session-ledger.md; then bash scripts/repo-lint.sh --record-clientdocs-sweep.
+
+Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-132, BUNDLEFIX-012.
diff --git a/scripts/tenant-offboard.sh b/scripts/tenant-offboard.sh
index 12900b5..9be710e 100644
--- a/scripts/tenant-offboard.sh
+++ b/scripts/tenant-offboard.sh
@@ -53,6 +53,20 @@
   printf -v "$__v" '%s' "$__o"
   return $__rc
 }
+# tinv <var> <label> <cmd...>: tenant-scoped variant of inv() -- runs the command
+# under tenant_env in the capture subshell so magnum (tenant-scoped) calls carry
+# tenant creds, while keeping the stdout-only discipline (Phase A cluster captures
+# used to merge stderr 2>&1 -- a deprecation warning word-split into the delete
+# loop / kept the wait loop from ever seeing empty -> false "not gone" exit 21).
+tinv(){
+  local __v="$1" __label="$2"; shift 2
+  local __e __o __rc; __e=$(mktemp)
+  __o=$( (tenant_env; "$@" </dev/null) 2>"$__e" ); __rc=$?
+  [ -s "$__e" ] && echo "  NOTE: $__label stderr: $(head -1 "$__e")"
+  rm -f "$__e"
+  printf -v "$__v" '%s' "$__o"
+  return $__rc
+}
 
 # ==== DOCFIX-099: orphaned per-cluster trustee sweep (magnum trustee domain) ====
 # Magnum mints one trustee user per cluster in the 'magnum' trustee domain (D-046),
@@ -177,7 +191,7 @@
 CLUSTERS=""
 if [ -n "$TCF" ]; then
   echo "--- clusters (tenant scope via $(basename "$TCF")) ---"
-  CLUSTERS=$( (tenant_env; openstack coe cluster list -f value -c uuid -c name -c status </dev/null 2>&1) || true )
+  tinv CLUSTERS "cluster list ($CLIENT)" openstack coe cluster list -f value -c uuid -c name -c status || true
   printf '%s\n' "${CLUSTERS:-<none>}" | sed 's/^/  /'
 else
   echo "--- clusters: NO tenant password cred file found -- cannot enumerate (magnum is tenant-scoped) ---"
@@ -230,13 +244,16 @@
     (tenant_env; openstack coe cluster delete "$CU" </dev/null 2>&1) | sed 's/^/  /'
   done
   for i in $(seq 1 40); do
-    LEFT=$( (tenant_env; openstack coe cluster list -f value -c name -c status </dev/null 2>&1) || true )
+    if ! tinv LEFT "cluster wait ($CLIENT)" openstack coe cluster list -f value -c name -c status; then
+      echo "  waiting: cluster list errored; retrying"; sleep 20; continue
+    fi
     printf '%s [%02d] remaining: %s\n' "$(date +%T)" "$i" "${LEFT:-<none>}"
     [ -z "$LEFT" ] && break
     grep -q 'DELETE_FAILED' <<<"$LEFT" && { echo "FATAL: DELETE_FAILED -- see appendix-A stuck-delete"; exit 21; }
     sleep 20
   done
-  LEFT=$( (tenant_env; openstack coe cluster list -f value -c name </dev/null 2>&1) || true )
+  tinv LEFT "cluster final ($CLIENT)" openstack coe cluster list -f value -c name \
+    || { echo "FATAL: final cluster list failed -- cannot confirm clusters gone"; exit 21; }
   [ -z "$LEFT" ] || { echo "FATAL: clusters not gone in budget"; exit 21; }
 fi
 
diff --git a/tests/tenant-offboard/run-tests.sh b/tests/tenant-offboard/run-tests.sh
index b36f48b..76a58fa 100644
--- a/tests/tenant-offboard/run-tests.sh
+++ b/tests/tenant-offboard/run-tests.sh
@@ -21,10 +21,10 @@
 mut(){ echo "$*" >> "$ST/mutations"; }
 # R10 observability: record the auth URL every tenant-scoped (coe) call runs under
 case "$*" in "coe cluster"*) echo "${OS_AUTH_URL:-unset}" >> "$ST/authurl";; esac
-# warnstderr scenario: truthful CLI -- list commands emit a deprecation-style
-# notice ON STDERR (exercises the stdout-only inventory captures). coe excluded:
-# the Phase A cluster capture still merges stderr (known, out of this batch).
-if [ "$S" = warnstderr ]; then case "$*" in "coe "*) : ;; *" list"*) echo "WARNING: a deprecated-option notice (fake, stderr)" >&2 ;; esac; fi
+# warnstderr scenario: truthful CLI -- list commands (INCLUDING coe cluster list,
+# now that Phase A routes through the tenant-scoped stdout-only tinv) emit a
+# deprecation-style notice ON STDERR, exercising the stdout-only captures.
+if [ "$S" = warnstderr ]; then case "$*" in *" list"*) echo "WARNING: a deprecated-option notice (fake, stderr)" >&2 ;; esac; fi
 DOM=$(python3 -c "print('d'*32)"); U1=$(python3 -c "print('1'*32)"); U2=$(python3 -c "print('2'*32)")
 P1=$(python3 -c "print('a'*32)")
 # neutron/octavia/nova resources are dashed-uuid shaped (truthful to the real CLI)
@@ -198,6 +198,12 @@
    && grep -q 'NOTE: .*stderr: WARNING' "$W/warn.out"; then
   echo "PASS: stderr-not-argv (exit 0, warnings surfaced as NOTE, none deleted)"; P=$((P+1))
 else echo "FAIL: stderr-not-argv (exit $RC; muts: $(grep -icE 'WARNING|deprecated' "$W/state/mutations" 2>/dev/null))"; F=$((F+1)); fi
+# coe/Phase-A specifically: the tenant-scoped cluster captures (tinv) must surface
+# stderr as a NOTE and must NOT false-trip the wait budget (pre-fix: merged stderr
+# kept the wait loop from ever seeing empty -> false "not gone" exit 21).
+if [ "$RC" = 0 ] && grep -q 'NOTE: cluster .*stderr: WARNING' "$W/warn.out"; then
+  echo "PASS: coe-stderr-not-argv (Phase A tinv surfaces NOTE, no false exit 21)"; P=$((P+1))
+else echo "FAIL: coe-stderr-not-argv (exit $RC; cluster NOTE present? $(grep -c 'NOTE: cluster' "$W/warn.out" 2>/dev/null))"; F=$((F+1)); fi
 # a non-id stdout row (API error prose) must be SKIPped and counted -> exit 22
 rm -rf "$W/state"; HOME="$W" MOCK_SCEN=garbagerow PATH="$W/bin:$PATH" python3 "$W/ptyrun.py" bash "$SCRIPT" acme --apply acme > "$W/garb.out" 2>&1; RC=$?
 if [ "$RC" = 22 ] && grep -q 'SKIP non-id network row' "$W/garb.out" && ! grep -q 'network delete please' "$W/state/mutations" 2>/dev/null; then