diff --git a/docs/as-executed-log-convention.md b/docs/as-executed-log-convention.md
index e9e0cff..155271b 100644
--- a/docs/as-executed-log-convention.md
+++ b/docs/as-executed-log-convention.md
@@ -15,6 +15,14 @@
 script(1); exit to close. Labels: `phase-NN-<topic>` for deploy work,
 `ops-<topic>` for operations, `incident-<date>-<topic>` for incidents.
 
+CLAUDE CODE LANE (operator-ruled 2026-07-06, DOCFIX-097): the interactive
+subshell does not map to the harness's one-shot shells. The sanctioned
+adaptation is a per-command wrap to the SAME log file:
+`script -aqe ~/as-executed/<UTC date>-<label>.log -c '<command>'`
+(create dir/file first under umask 077). Same location, perms, and verbatim
+capture; every live-window command runs wrapped; the index entry rule is
+unchanged.
+
 INDEX (this IS committed): `logs/as-executed-index.md` -- one line per session:
 date, label, operator, one-phrase scope. No content, no hostnames beyond the
 jumphost, no secrets. The index is what makes a two-year-old one-shot command
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index ec61b40..4fb4318 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -1787,3 +1787,26 @@
 in-repo for history; the addendum-18 OPERATOR ACTION item is withdrawn. The Roosevelt
 invariant from D-072 ("cluster binding space == default binding space for TLS-fronted
 charms") is UNCHANGED and remains the carry-forward.
+
+## D-073 -- AMENDMENT (2026-07-06): APPLIED live (d011-batch3 window)
+
+The staged 39-rule overrides.zip was attached to keystone in the logged
+d011-batch3 window (addendum 27). Settled "PO: Unit is ready". Behavioral
+verify per the amendment's block: tenant app-cred context 403 on
+identity:list_trusts (verbatim deny); admin trust list OK; magnum trust
+machinery re-proven by d011-05 PASS. Independent proof: first live run of the
+H4 drift detector (staged) reported live overlay == repo, 39 rules. Status:
+ADOPTED -> APPLIED. Rollback stays as recorded (re-attach the HEAD~ zip).
+
+## D-011 -- AMENDMENT (2026-07-06): batch-3 CLOSE -- all acceptance items stand
+
+With the d011-batch3 window (addendum 27): item 4 octavia PASS live (RR +
+member failover + amphora failover with N+1 headroom evidence, A2 conditional
+pre-approval honored); item 5 magnum e2e PASS live (health + OCCM + P3
+isolation via the foil1 tenant). Items 1-3 stood from batches 1-2; item 6
+remains MANUAL by design (SEC-003 second-person unseal rehearsal pending --
+gates D-011 FULL close); items 7-8 DROPPED per the amended bar. D-011 is
+therefore CLOSED-except-item-6. The v1-close checklist (handoff section 6)
+is now QUEUED per the do-doc's close-out clause. Checker corrections made
+in-window: DOCFIX-095 (tenant-assert owner-context probe), DOCFIX-096
+(amphora_headroom live CLI shapes).
diff --git a/docs/handoff-20260705-open-items.md b/docs/handoff-20260705-open-items.md
index 995881d..6ac9f74 100644
--- a/docs/handoff-20260705-open-items.md
+++ b/docs/handoff-20260705-open-items.md
@@ -40,15 +40,17 @@
 
 ## 2. Verify-live queue (read-only/gated CHECKs; run on the real cloud before trusting)
 
-- **d011-04** `amphora_headroom()` field parsing (`server show` .flavor; `hypervisor list --long`
-  vcpu/ram). Safe default HOLDs on any parse miss -- confirm the OK path live.
-- **d011-04** OCCM LB-name-contains-service-name assumption; agnhost `/hostname` round-robin behavior.
-- **d011-04** sequence: run non-disruptively first (RR + member failover), THEN `--include-disruptive`
-  once N+1 amphora headroom is confirmed (a cloud at its scheduler ceiling cannot heal its own LBs).
-  OPERATOR RULING 2026-07-06 (A2): the disruptive half is PRE-APPROVED conditional on the live
-  headroom check passing -- proceed in the same window, no second ask.
-- **d011-05** needs a FOIL (2nd) tenant for the P3 isolation check -- onboard one or set
-  `VR_FOIL_APPCRED` (acme, the former foil, was offboarded).
+ALL CLEARED 2026-07-06 (d011-batch3 window, addendum 27):
+- **d011-04** headroom parsing: fixed live (DOCFIX-096: --long for compute_id;
+  display-name hypervisor keys); OK path confirmed, disruptive half PASS under
+  the A2 conditional pre-approval. OCCM LB-name + agnhost RR assumptions held.
+- **d011-05** foil satisfied by the foil1 tenant (onboarded in-window); PASS
+  incl. P3 isolation.
+- tenant-assert `keypair list --user` confirmed under admin; admin-side
+  app-cred list measured always-403 -> check reworked (DOCFIX-095).
+- H3 CANARY_SSH_USER confirmed (ubuntu).
+STILL OPEN here: Horizon manual checks (onboarding contract 5.1/5.3) on a
+live tenant -- operator, browser; non-blocking.
 
 ## 3. Operator rulings pending (nothing proceeds without these)
 
@@ -60,8 +62,9 @@
   gain tls-certificates V1 support, evaluate OpenBao (MPL fork), or explicit EOL risk-acceptance for
   VR0 with a production remediation deadline. Plus D-068 items 2 (Vault listener TLS for Roosevelt --
   vault_url is cleartext http today) and 3 (AppRole secret_id TTL audit + proactive auth health probe).
-- **D-050** keystone `use-policyd-override=true` with no policy zip (FINDING-1) -- and the
-  D-063-adjacent `identity:list_trusts=""` hardening -- remain PROPOSED/OPEN, not actioned.
+- ~~D-050 / list_trusts hardening~~ RESOLVED: D-050 CLOSED via D-051 (ruling
+  2026-07-06); the list_trusts hardening was adopted as D-073 and APPLIED live
+  2026-07-06 (addendum 27; behavioral verify green).
 
 ## 4. Open security-ledger rows
 
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index f4bdda9..4f66a22 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -21,18 +21,18 @@
 <!-- SECTION: machine-derived | OWNER: ledger-scan (regenerate; never hand-edit) -->
 ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)
 
-_As of 2026-07-06 (addendum-20 ruling sweep; re-run the scan to refresh):_
+_As of 2026-07-06 (post-addendum-27, d011-batch3 window close; re-run the scan to refresh):_
 
 - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt -- 1.16
   ruled out per amendment; off-EOL path OPEN), D-071 (routine update cadence +
   controller patch policy -- operator to rule; gated on the pre-DC-DC HA/backup
-  session). _(D-050 RESOLVED/CLOSED 2026-07-06 via D-051; D-073 filed ADOPTED,
-  implementation pending -- not scan-tracked as open.)_
+  session). _(D-050 RESOLVED/CLOSED 2026-07-06 via D-051; D-073 APPLIED live
+  2026-07-06 -- not scan-tracked as open.)_
 - **OPEN security rows:** SEC-001 (rotate at v1 close, re-ruled 2026-07-06),
   SEC-003 (custodians + second-person unseal -- DEFERRED; keeps d011-06 MANUAL),
   SEC-004 (flip repo to private at v1 close -- deferral reaffirmed).
-- **Next-free numbers:** D = 074, DOCFIX = 095, BUNDLEFIX = 012.
-  (Scan and the addendum-26 changelog next-free pointer agree.)
+- **Next-free numbers:** D = 074, DOCFIX = 098, BUNDLEFIX = 012.
+  (Scan and the addendum-27 changelog next-free pointer agree.)
 
 ---
 
@@ -235,6 +235,42 @@
   prompt for password. OPERATOR: `juju login -u jessea123` at next presence.
   Blocked reads queued: keystone policy.json PENDING-LIVE-READ trio; barbican
   host_href look. (Vault reads above completed BEFORE expiry.)
+  CLEARED later 2026-07-06: auth verified working; both queued reads DONE
+  (see addendum 27 closures).
+
+## Jumphost stream -- session 2026-07-06 (cont.): d011-batch3 WINDOW EXECUTED (addendum 27)
+
+- **WINDOW COMPLETE, all gates green** (logged d011-batch3, per-command wrap --
+  operator-ruled Claude Code lane, now in the convention doc as DOCFIX-097):
+  D-073 APPLIED live (verify pair + H4-live PASS proof); foil1 onboarded
+  10.20.29.0/24 (stages 0-4 first-try, tenant-assert PASS 15/15 after fix,
+  H2 double-SKIP, H3 canary PASS FIP 10.12.7.177/ubuntu); d011-04 PASS both
+  halves (A2 conditional honored; headroom OK on all 3 hypervisors); d011-05
+  PASS (P1/P2/P3 with foil1); baseline + close-out cloud-assert PASS.
+- **In-window checker fixes (each harness-proven then re-run live):**
+  DOCFIX-095 tenant-assert owner-context app-cred probe (admin-side list is
+  always-403 by base policy admin_or_owner -- measured, NOT a D-073 effect);
+  DOCFIX-096 d011-04 amphora_headroom --long + display-name hypervisor keys.
+- **D-011: batch-3 CLOSED; D-011 CLOSED-except-item-6** (SEC-003 manual unseal
+  rehearsal). v1-close checklist (handoff section 6) now QUEUED.
+- **Queued-read closures:** keystone trio CONFIRMED (D-064 values explicit in
+  live base policy; overlay comment tags dischargeable -- DOCFIX candidate);
+  barbican host_href CLOSED benign-with-corrected-mechanism (charm renders
+  literal https://None:9312, suppressing the upstream request-derived
+  fallback; catalog unaffected; charm-level fix = future item needing D-NNN).
+- **Operator rulings this session:** devteam pinned as next tenant, onboarding
+  HELD until a cloud snapshot exists (item-7 cloud-snapshot.sh draft launched);
+  orphan-sweep audit stays rc 0 report-only; clientdocs L7 receipt keeps all
+  14 files; H4 design defaults accepted as delivered.
+- **Worktree drafts DELIVERED (uncommitted, integration queued):** orphan-trustee
+  sweep (14/14), clientdocs L7 (17/17), tenant-acceptance harness (16 checks;
+  closes the last stderr-inventory site), H4 keystone-policy-drift (10/10 +
+  first live PASS), clientdocs handover pack (lint clean), cloud-snapshot.sh
+  (in flight). Integration order: after this window commit; tenant-acceptance
+  + L7 receipt last (receipt must hash post-integration file states).
+- **Open (small):** Horizon manual checks on foil1 (operator, browser,
+  non-blocking); capi-test-1 CREATE_FAILED leftover (orphan-sweep candidate);
+  beta-cluster lbtest leftover; repo-lint worktree-exclusion DOCFIX candidate.
 
 <!-- END: jumphost -->
 
diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md
index 969692c..87f680e 100644
--- a/docs/v1-redeploy-changelog.md
+++ b/docs/v1-redeploy-changelog.md
@@ -2226,3 +2226,104 @@
 REVERT: git checkout HEAD~ -- scripts/cloud-assert.sh scripts/tenant-onboard.sh scripts/tenant-offboard.sh tests/cloud-assert/run-tests.sh runbooks/tenant-onboarding-v2-DRAFT.md docs/D-068-openbao-assessment-DRAFT.md docs/session-ledger.md docs/v1-redeploy-changelog.md
 
 Next-free after this push (per scan, keep this line unwrapped): D-074, DOCFIX-095, BUNDLEFIX-012.
+
+### 2026-07-06 (addendum 27, jumphost stream) -- d011 batch-3 window EXECUTED: D-073 live, foil1 onboarded, d011-04/05 PASS; DOCFIX-095/096/097
+
+The d011-batch3 window (runbooks/d011-batch3-window-DRAFT.md, DOCFIX-093) ran
+end-to-end this session, logged per-command to the as-executed log (label
+d011-batch3; see logs/as-executed-index.md). All gates green; two checker
+defects found live and fixed in-window (each harness-proven before re-run).
+
+- **D-073 LIVE APPLY (gated mutation, operator-present):** policies/overrides.zip
+  (39 rules) attached to keystone via policyd-override resource; settled
+  active/idle "PO: Unit is ready". Behavioral verify: (a) beta -svc app-cred
+  context DENIED trust enumeration (403 identity:list_trusts, verbatim); (b)
+  admin trust list OK (1 trust); (c) magnum trust machinery re-proven by
+  d011-05 PASS below. Bonus proof: first live run of the (worktree-staged) H4
+  drift detector reported PASS -- live overlay parsed IDENTICAL to repo (39
+  rules), base trio + trust family at recorded values. D-073 status:
+  ADOPTED -> APPLIED. REVERT (cloud): git show <pre-D073>:policies/overrides.zip
+  > ~/overrides-prev.zip; juju attach-resource -m openstack keystone
+  policyd-override=~/overrides-prev.zip.
+- **foil1 ONBOARDED (stages 0-4 + H2 + H3, live workflow validation):**
+  10.20.29.0/24; stage0 preflight PASS; stages 1-4 clean first-try (domain,
+  triad, anti-escalation OK, app cred secret len 86, keypair, full L3).
+  H2 guard live: stage3 re-run = double SKIP rc 0. H3 canary live: CANARY PASS
+  (booted foil1-net, SSH OK via FIP 10.12.7.177 as 'ubuntu' with foil1-key,
+  teardown verified server/FIP/SG removed). CANARY_SSH_USER verify-live item
+  CLEARED. Horizon manual checks (contract 5.1/5.3) still pending operator --
+  logged as open, non-blocking per the do-doc.
+- **DOCFIX-095 -- tenant-assert.sh app-cred check reworked to owner-context
+  probe.** First live run HELD on the queued VERIFY-LIVE item: admin-side
+  `application credential list --user` is ALWAYS 403 on this cloud -- the
+  legacy base-policy `admin_or_owner` rule keys on target.token attrs the
+  app-cred API never populates (live policy.json line 7, measured), so it
+  degrades to owner-only cross-domain. NOT a D-073 regression (overlay has no
+  application_credential rules -- verified both sides). Fix (operator-ruled):
+  the check now authenticates AS the handover app cred (id/secret exported
+  from the 0600 file, never printed; identity public endpoint discovered from
+  the catalog) and lists own creds -- stronger (proves the cred works). Harness
+  7->11 checks (owner-context PASS/auth-fail/wrong-name/double-skip; truthful
+  mock answers ONLY under owner context). Re-run: TENANT-ASSERT foil1 PASS
+  15/15. Also clears the keypair-list VERIFY-LIVE item (confirmed under admin).
+  REVERT: git checkout HEAD~ -- scripts/tenant-assert.sh tests/tenant-assert/run-tests.sh
+- **DOCFIX-096 -- d011-04 amphora_headroom() live-shape fixes.** Disruptive
+  half correctly self-HELD (headroom UNKNOWN, fail-closed as designed) on the
+  queued VERIFY-LIVE item. Two live-vs-assumed CLI shape misses, measured then
+  fixed: (1) `loadbalancer amphora list` omits compute_id WITHOUT --long
+  (default columns id/lb/status/role/ips only) -- --long added; (2)
+  `hypervisor list --long -f json` emits DISPLAY-NAME keys ("vCPUs",
+  "vCPUs Used", "Memory MB", "Memory MB Used"), not snake_case -- jq now
+  accepts both shapes. Mocks made truthful to both measurements (compute_id
+  only with --long; display-name keys; live flavor-string shape
+  "charm-octavia (uuid)"). Harness: checks suite ALL PASS (62).
+  REVERT: git checkout HEAD~ -- scripts/checks/d011-04-octavia-lb.sh tests/checks/run-tests.sh
+- **d011-04 PASS (both halves).** Non-disruptive: RR 2 distinct backends;
+  member-loss continuity 6/6 200s; recovery to 2 backends. Clears the OCCM
+  LB-name and agnhost round-robin verify-live items. Disruptive (A2
+  pre-approval, conditional gate honored): headroom OK -- evidence: flavor
+  charm-octavia 1 vcpu/1024MB; hypervisors (vCPUs used/total | free MB):
+  4/8|11610, 4/8|17754, 4/8|7514 -- all three N+1 capable; amphora failover
+  triggered, recovered ACTIVE + 6/6 200s. RESULT PASS 255s.
+- **d011-05 PASS.** Against beta with foil1 as isolation foil
+  (VR_FOIL_APPCRED): P1 kube >=2 Ready nodes, kubeconfig fetched by TENANT;
+  P2 OCCM->Octavia->FIP 10.12.6.97->pod; P3 foil sees NOTHING of beta
+  (cluster list empty, cluster show 404, beta-net not found, server/LB lists
+  empty). RESULT PASS 33s. Full-d011 batch-3 set now stands live.
+- **DOCFIX-097 -- as-executed corrections to the do-doc + logging convention.**
+  (1) run-logged.sh's interactive script(1) subshell does not map to the
+  Claude Code one-shot-shell lane; operator-ruled adaptation: per-command wrap
+  `script -aqe ~/as-executed/<date>-<label>.log -c '<cmd>'` (same location,
+  0600/0700, verbatim capture). Recorded in
+  docs/as-executed-log-convention.md (Claude Code lane paragraph) and the
+  do-doc. (2) do-doc corrected: tenant-assert HOLD/fix loop and d011-04
+  headroom HOLD/fix loop appended as executed; headroom evidence + canary FIP
+  recorded; DRAFT banner updated to as-executed-once (2026-07-06).
+  REVERT: git checkout HEAD~ -- docs/as-executed-log-convention.md runbooks/d011-batch3-window-DRAFT.md
+- **Queued-read closures (both agents' evidence in-session):** (1) keystone
+  policy.json PENDING-LIVE-READ trio CONFIRMED explicit in live base policy as
+  "rule:cloud_admin or rule:admin_and_matching_domain_id" (D-064 correct; the
+  2026-06-24 oslopolicy dump was what lacked them). The [PENDING-LIVE-READ]
+  comment tags in policies/domain-manager-policy.yaml are now dischargeable --
+  DOCFIX candidate, not actioned. (2) barbican host_href observation CLOSED
+  with corrected mechanism: charm template renders literal "https://None:9312"
+  from unset os-admin-hostname under use-internal-endpoints=true, which
+  SUPPRESSES barbican 18.0.0's request-derived href fallback (utils.py
+  measured on-unit); functionally benign for all catalog-dialing consumers
+  (stage-6 proven), only literal href dereference breaks; os-*-hostname
+  "fix" rejected (re-registers keystone endpoints; wrong plane for tenants);
+  charm-level fix = future BUNDLEFIX/upstream item needing a D-NNN. D-067
+  entry phrasing ("host_href unset/None") correction = DOCFIX candidate.
+- **Findings LOGGED, not actioned:** capi-test-1 cluster CREATE_FAILED
+  (capi project) -- candidate first target for the orphan-trustee sweep audit;
+  leftover lbtest deployment/service in beta-cluster (AlreadyExists reused by
+  acceptance P2) -- cleanup candidate; repo-lint L1 walks .claude/worktrees/
+  (5 spurious FAILs while session worktrees exist; exclusion = DOCFIX
+  candidate); tenant-acceptance foil_env hardcoded OS_AUTH_URL (house rule 3)
+  -- already logged by the harness draft, rides its integration.
+- **Close-out gates:** baseline cloud-assert PASS (pre-mutation) and close-out
+  cloud-assert PASS; tenant landscape: beta healthy (cluster UPDATE_COMPLETE,
+  node_count=2 deliberate), foil1 complete/verified, acme absent (offboarded),
+  devteam PINNED next (onboarding HELD on operator snapshot ruling).
+
+Next-free after this push (per scan, keep this line unwrapped): D-074, DOCFIX-098, BUNDLEFIX-012.
diff --git a/logs/as-executed-index.md b/logs/as-executed-index.md
index 32fe4e2..6eb7093 100644
--- a/logs/as-executed-index.md
+++ b/logs/as-executed-index.md
@@ -7,3 +7,4 @@
 | date | label | operator | scope |
 |---|---|---|---|
 | 2026-07-05 | ops-update-20260705 | jesse.austin | routine update window: controller patch + model agents + in-channel charm refreshes (ops-update-procedure first execution) |
+| 2026-07-06 | d011-batch3 | jesse.austin (Claude Code lane, per-command wrap) | batch-3 window: D-073 policy apply + foil1 onboarding + d011-04/05 validation + close-out |
diff --git a/runbooks/d011-batch3-window-DRAFT.md b/runbooks/d011-batch3-window-DRAFT.md
index 003060b..5373468 100644
--- a/runbooks/d011-batch3-window-DRAFT.md
+++ b/runbooks/d011-batch3-window-DRAFT.md
@@ -1,4 +1,18 @@
-# d011 batch-3 window -- combined do-document (DRAFT, not yet executed)
+# d011 batch-3 window -- combined do-document (AS-EXECUTED ONCE 2026-07-06; addendum 27)
+
+AS-EXECUTED CORRECTIONS (2026-07-06, first execution -- all gates green):
+- Logging ran in the Claude Code lane: per-command `script -aqe` wrap
+  (operator-ruled; see docs/as-executed-log-convention.md CLAUDE CODE LANE).
+- Section 2: first tenant-assert run HOLDs on the admin-side app-cred list
+  (always-403 by base policy) -- FIXED in-window as DOCFIX-095 (owner-context
+  probe); re-run PASS 15/15. Expect PASS first-try on future onboardings.
+- Section 3: first --include-disruptive run self-HELD (headroom UNKNOWN) on
+  two CLI-shape parse misses -- FIXED in-window as DOCFIX-096 (--long for
+  compute_id; display-name hypervisor keys); re-run PASS. Evidence 2026-07-06:
+  amphora flavor charm-octavia 1vcpu/1024MB; all 3 hypervisors N+1 capable.
+- Canary evidence: FIP 10.12.7.177, sshuser=ubuntu (CANARY_SSH_USER confirmed).
+- Horizon manual checks (section 2 tail) were NOT done in-window -- carried
+  open, non-blocking per this doc's own clause.
 
 One logged operator window that closes out the D-011 batch-3 queue AND live-validates
 the onboarding workflow, in the operator-ruled interleave order (2026-07-06):
diff --git a/scripts/checks/d011-04-octavia-lb.sh b/scripts/checks/d011-04-octavia-lb.sh
index ded64b1..68c84ac 100644
--- a/scripts/checks/d011-04-octavia-lb.sh
+++ b/scripts/checks/d011-04-octavia-lb.sh
@@ -97,7 +97,9 @@
 # --- TIER 3: amphora failover (disruptive only, headroom-guarded) ---
 amphora_headroom(){ # echo OK|NO|UNKNOWN for +1 amphora of the LB's amphora flavor
   local lb="$1" aj cid sj fl fv fr hj free_ok=0
-  aj="$(openstack loadbalancer amphora list --loadbalancer "$lb" -f json </dev/null 2>/dev/null || true)"
+  # --long is REQUIRED: without it the amphora list omits compute_id entirely
+  # (measured 2026-07-06; default columns are id/lb/status/role/ips only)
+  aj="$(openstack loadbalancer amphora list --loadbalancer "$lb" --long -f json </dev/null 2>/dev/null || true)"
   cid="$(jq -r '.[0].compute_id // empty' <<<"$aj" 2>/dev/null || true)"
   [ -n "$cid" ] || { echo UNKNOWN; return; }
   sj="$(openstack server show "$cid" -f json </dev/null 2>/dev/null || true)"
@@ -109,8 +111,13 @@
   hj="$(openstack hypervisor list --long -f json </dev/null 2>/dev/null || true)"
   [ -n "$hj" ] || { echo UNKNOWN; return; }
   # any hypervisor with free vcpu and ram for +1 amphora flavor?
+  # live `hypervisor list --long -f json` emits DISPLAY-NAME keys ("vCPUs",
+  # "vCPUs Used", "Memory MB", "Memory MB Used"), not snake_case (measured
+  # 2026-07-06); accept both shapes
   free_ok="$(jq -r --argjson v "$fv" --argjson r "$fr" '
-    [ .[] | select(((.vcpus // 0)-(.vcpus_used // 0)) >= $v and ((.memory_mb // 0)-(.memory_mb_used // 0)) >= $r) ] | length' <<<"$hj" 2>/dev/null || echo 0)"
+    [ .[] | select((((.vcpus // ."vCPUs" // 0)-(.vcpus_used // ."vCPUs Used" // 0)) >= $v)
+                and (((.memory_mb // ."Memory MB" // 0)-(.memory_mb_used // ."Memory MB Used" // 0)) >= $r)) ]
+    | length' <<<"$hj" 2>/dev/null || echo 0)"
   case "$free_ok" in ''|0) echo NO;; *) echo OK;; esac
 }
 
diff --git a/scripts/tenant-assert.sh b/scripts/tenant-assert.sh
index d720a5e..04c508b 100644
--- a/scripts/tenant-assert.sh
+++ b/scripts/tenant-assert.sh
@@ -10,13 +10,17 @@
 #     on <c>-prod and NOTHING else
 #   - the admin role appears NOWHERE on the triad (explicit check)
 #   - keypair <c>-key is owned by <c>-cluster (the stage-6 trustor requirement)
-#   - app cred <c>-svc-cred is owned by <c>-svc
+#   - app cred <c>-svc-cred exists and AUTHENTICATES (owner-context probe via
+#     the local handover file; admin-side list is always 403 -- see below)
 #   - local handover files (if the handover dir exists here) are present, 0600
 # Mutates NOTHING. Evidence only; remediation stays a gated human step.
 # Also serves as: offboard preflight; periodic all-tenants drift sweep member.
-# VERIFY-LIVE (first real run): `keypair list --user` (nova microversion) and
-# `application credential list --user` under the admin identity are mocked in
-# the harness -- confirm both on the real cloud before trusting their PASS.
+# VERIFY-LIVE: cleared 2026-07-06 (first real run, foil1). `keypair list
+# --user` confirmed under admin. Admin-side `application credential list
+# --user` measured ALWAYS-403: the legacy base-policy admin_or_owner rule
+# keys on target.token attrs the app-cred API never populates, so it degrades
+# to owner-only cross-domain -- the check now authenticates AS the handover
+# app cred instead (stronger: proves the cred exists AND works).
 # Usage: bash scripts/tenant-assert.sh <client>
 # Exit: 0 PASS | 1 HOLD (>=1 assert failed) | 2 precondition missing.
 # ASCII + LF.
@@ -128,13 +132,38 @@
     fi
   fi
 fi
+# owner-context probe: extract id/secret into env only (never printed), auth
+# as the app cred, list own creds. Endpoint discovered from the live catalog.
+ACF="$HOME/tenant-${CLIENT}/${CLIENT}-svc-appcred.txt"
 if is_id "$SUID"; then
-  if jcap "$TMPD/ac.json" application credential list --user "$SUID"; then
-    if jq -e --arg n "${CLIENT}-svc-cred" '[.[] | select(.Name == $n)] | length == 1' "$TMPD/ac.json" >/dev/null; then
-      ok "app cred ${CLIENT}-svc-cred owned by ${CLIENT}-svc"
+  if [ -s "$ACF" ]; then
+    AURL="$(vcap endpoint list --service identity --interface public -c URL | head -n1)"
+    if [[ "$AURL" =~ ^https?:// ]]; then
+      (
+        CAC="${OS_CACERT:-$HOME/vault-init/vault-ca-root.pem}"
+        for v in $(env | awk -F= '/^OS_/{print $1}'); do unset "$v"; done
+        export OS_AUTH_TYPE=v3applicationcredential OS_AUTH_URL="$AURL" \
+               OS_IDENTITY_API_VERSION=3 OS_CACERT="$CAC"
+        OS_APPLICATION_CREDENTIAL_ID="$(awk -F'"' '/^id=/{print $2}' "$ACF")"
+        OS_APPLICATION_CREDENTIAL_SECRET="$(awk -F'"' '/^secret=/{print $2}' "$ACF")"
+        export OS_APPLICATION_CREDENTIAL_ID OS_APPLICATION_CREDENTIAL_SECRET
+        openstack application credential list -f json </dev/null 2>"$TMPD/err"
+      ) >"$TMPD/ac.json"
+      if jq -e . "$TMPD/ac.json" >/dev/null 2>&1; then
+        if jq -e --arg n "${CLIENT}-svc-cred" '[.[] | select(.Name == $n)] | length == 1' "$TMPD/ac.json" >/dev/null; then
+          ok "app cred ${CLIENT}-svc-cred live (owner-context auth OK)"
+        else
+          bad "app cred ${CLIENT}-svc-cred missing on ${CLIENT}-svc (owner-context list)"
+        fi
+      else
+        bad "owner-context app cred probe failed (auth or list); stderr was:"
+        sed 's/^/        /' "$TMPD/err"
+      fi
     else
-      bad "app cred ${CLIENT}-svc-cred missing on ${CLIENT}-svc"
+      bad "identity public endpoint unresolved -- cannot run owner-context app cred probe"
     fi
+  else
+    echo "  skip: no local appcred file $ACF (owner-context check skipped; SKIP does not lower the verdict)"
   fi
 fi
 
diff --git a/tests/checks/run-tests.sh b/tests/checks/run-tests.sh
index aef0d16..c66d461 100644
--- a/tests/checks/run-tests.sh
+++ b/tests/checks/run-tests.sh
@@ -206,14 +206,18 @@
   "loadbalancer list"*)
     [ "${OCTAVIA_READY:-1}" = 1 ] || { echo "octavia down" >&2; exit 1; }
     printf '[{"id":"lb-1","name":"kube_service_beta_default_%s","vip_address":"10.12.6.50"}]\n' "$SVC";;
-  "loadbalancer amphora list"*) echo '[{"compute_id":"cmp-1","role":"STANDALONE"}]';;
+  "loadbalancer amphora list"*)
+    # truthful mock (measured 2026-07-06): compute_id appears ONLY with --long
+    case "$*" in *" --long"*) echo '[{"compute_id":"cmp-1","role":"STANDALONE"}]';;
+                 *) echo '[{"id":"amp-1","role":"STANDALONE"}]';; esac;;
   "loadbalancer show"*) echo "${MOCK_LB_STATUS:-ACTIVE}";;
   "loadbalancer failover"*) echo "failover accepted";;
-  "server show"*) echo '{"flavor":"m1.amphora","id":"cmp-1"}';;
+  "server show"*) echo '{"flavor":"charm-octavia (95acab44-d762-4d8f-a3eb-6c3340eee5fa)","id":"cmp-1"}';;
   "flavor show"*) echo '{"vcpus":1,"ram":1024}';;
   "hypervisor list"*)
-    if [ "${MOCK_HEADROOM:-ok}" = ok ]; then echo '[{"vcpus":16,"vcpus_used":4,"memory_mb":32768,"memory_mb_used":8192}]';
-    else echo '[{"vcpus":4,"vcpus_used":4,"memory_mb":8192,"memory_mb_used":8192}]'; fi;;
+    # truthful mock (measured 2026-07-06): --long -f json emits DISPLAY-NAME keys
+    if [ "${MOCK_HEADROOM:-ok}" = ok ]; then echo '[{"vCPUs":16,"vCPUs Used":4,"Memory MB":32768,"Memory MB Used":8192}]';
+    else echo '[{"vCPUs":4,"vCPUs Used":4,"Memory MB":8192,"Memory MB Used":8192}]'; fi;;
 esac
 OM
 cat > "$B4/bin/curl" <<'CM'
diff --git a/tests/tenant-assert/run-tests.sh b/tests/tenant-assert/run-tests.sh
index f3a93a8..b263b32 100644
--- a/tests/tenant-assert/run-tests.sh
+++ b/tests/tenant-assert/run-tests.sh
@@ -2,9 +2,12 @@
 # tests/tenant-assert/run-tests.sh -- offline harness for scripts/tenant-assert.sh (H1).
 # Fake openstack replays per-case fixtures keyed by FIXDIR; fake HOME provides a stub
 # admin-openrc and (per case) a handover dir. The app-cred list fake emits a realistic
-# deprecation notice ON STDERR to exercise the stdout-only JSON capture rule.
-# Cases: happy PASS; escalation HOLD; keypair-trap HOLD; missing-user HOLD;
-# bad handover mode HOLD; no-args precondition (exit 2).
+# deprecation notice ON STDERR to exercise the stdout-only JSON capture rule, and
+# answers ONLY under owner context (OS_AUTH_TYPE=v3applicationcredential + non-empty
+# cred id) -- the admin-side form is always 403 on the real cloud (measured 2026-07-06).
+# Cases: happy PASS (incl. owner-context probe); escalation HOLD; keypair-trap HOLD;
+# missing-user HOLD; bad handover mode HOLD; no-args precondition (exit 2); absent
+# handover dir/appcred double-skip PASS; probe auth-fail HOLD; wrong cred name HOLD.
 # Exit: 0 all pass | 1 any case failed.  ASCII + LF.
 set -uo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -40,7 +43,13 @@
   "role assignment list --user $ID_CLU -f json")    cat "\$FIXDIR/assign-cluster.json" ;;
   "role assignment list --user $ID_SVC -f json")    cat "\$FIXDIR/assign-svc.json" ;;
   "keypair list --user $ID_CLU -f json")            cat "\$FIXDIR/keypairs.json" ;;
-  "application credential list --user $ID_SVC -f json")
+  "endpoint list --service identity --interface public -c URL -f value")
+      echo "https://fake:5000/v3" ;;
+  "application credential list -f json")
+      # truthful mock: owner-context list only answers when the app-cred env
+      # is actually set (the admin-side form is 403 on the real cloud)
+      [ "\${OS_AUTH_TYPE:-}" = "v3applicationcredential" ] || { echo "fake: appcred list without owner context" >&2; exit 1; }
+      [ -n "\${OS_APPLICATION_CREDENTIAL_ID:-}" ] || { echo "fake: empty OS_APPLICATION_CREDENTIAL_ID" >&2; exit 1; }
       echo "WARNING: this fake emits a deprecation-style notice on stderr" >&2
       cat "\$FIXDIR/appcreds.json" ;;
   *) echo "fake-openstack: unmatched: \$*" >&2; exit 1 ;;
@@ -55,9 +64,11 @@
   if [ "$hv" != "none" ]; then
     local d="$h/tenant-testco"; mkdir -p "$d"
     for f in testco-domain-admin-cred.txt testco-cluster-cred.txt \
-             testco-svc-cred.txt testco-svc-appcred.txt testco-key.pem; do
+             testco-svc-cred.txt testco-key.pem; do
       printf 'x\n' > "$d/$f"; chmod 600 "$d/$f"
     done
+    printf 'id="e0000000000000000000000000000001"\nname="testco-svc-cred"\nsecret="fake-secret-not-real"\n' \
+      > "$d/testco-svc-appcred.txt"; chmod 600 "$d/testco-svc-appcred.txt"
     [ "$hv" = "badmode" ] && chmod 644 "$d/testco-svc-cred.txt"
   fi
 }
@@ -102,10 +113,12 @@
   else echo "  FAIL  $3 (rc=$RC want=$1)"; echo "$OUT" | tail -6 | sed 's/^/        /'; FAIL=$((FAIL+1)); fi
 }
 
-# T1 happy path -> PASS, exit 0 (also proves stderr noise on appcred list is not merged)
+# T1 happy path -> PASS, exit 0 (also proves stderr noise on appcred list is not
+# merged, and that the owner-context probe path is the one exercised)
 mk_home "$TMP/h1" good; mk_fix "$TMP/f1" happy
 run_case "$TMP/h1" "$TMP/f1" testco
 check 0 'TENANT-ASSERT testco: PASS' "T1 happy topology passes"
+check 0 'owner-context auth OK' "T1b app cred verified via owner-context probe"
 
 # T2 escalation: svc holds admin -> HOLD, incident wording
 mk_home "$TMP/h2" good; mk_fix "$TMP/f2" escalated
@@ -132,10 +145,23 @@
 run_case "$TMP/h6" "$TMP/f6" testco
 check 1 'mode 644 \(want 600\)' "T6 bad handover mode detected"
 
-# T7 no handover dir -> skip note, still PASS
+# T7 no handover dir -> both skips (files + owner-context probe), still PASS
 mk_home "$TMP/h7" none; mk_fix "$TMP/f7" happy
 run_case "$TMP/h7" "$TMP/f7" testco
 check 0 'skip: no local handover dir' "T7 absent handover dir skips without lowering verdict"
+check 0 'skip: no local appcred file' "T7b absent appcred file skips probe without lowering verdict"
+
+# T8 owner-context probe auth failure (non-JSON + stderr) -> HOLD with stderr shown
+mk_home "$TMP/h8" good; mk_fix "$TMP/f8" happy
+printf 'The request you have made requires authentication. (HTTP 401)\n' > "$TMP/f8/appcreds.json"
+run_case "$TMP/h8" "$TMP/f8" testco
+check 1 'owner-context app cred probe failed' "T8 probe auth failure is a HOLD"
+
+# T9 wrong app cred name in owner-context list -> HOLD
+mk_home "$TMP/h9" good; mk_fix "$TMP/f9" happy
+echo '[{"ID":"e0000000000000000000000000000002","Name":"not-the-svc-cred","Expires At":null}]' > "$TMP/f9/appcreds.json"
+run_case "$TMP/h9" "$TMP/f9" testco
+check 1 'missing on testco-svc \(owner-context list\)' "T9 wrong cred name detected"
 
 echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
 [[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1