diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index ec8f138..fbfd645 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -449,14 +449,17 @@
   them (tenant-onboard/offboard/acceptance) do NOT source lib-net.sh -- so
   centralizing means adding `. lib-net.sh` sourcing into client-critical scripts I
   just modified (DOCFIX-131 + S4), which stacks risk. Breakdown:
-  - S8a (FIP pool FIP_START/END -> lib-net.sh): LOW risk, both phase-04 consumers
-    already source lib-net. Safe to do.
-  - S8b (KEYSTONE_VIP -> lib-net.sh): needs sourcing plumbing into 6 scripts incl.
-    the 3 tenant scripts. Medium; HOLD recommended.
-  - S8c (provider-bundle-check.py restates plane CIDRs): genuine design change
-    (python can't source bash -- needs a generated/parsed form). Separate item.
-  Recommendation logged for operator: do S8a now, hold S8b/S8c. lib-validate
-  adoption (S1/S2/S3/S5) still HELD until DOCFIX-126/127 live-verify.
+  - S8a (FIP pool FIP_START/END -> lib-net.sh): DONE (DOCFIX-134). FIP_POOL_START/END
+    added to lib-net.sh; phase-04 create/verify reference them. Gauntlet 39/39.
+  - S8b (KEYSTONE_VIP -> lib-net.sh): DEFERRED -- needs sourcing plumbing into 6
+    scripts incl. the 3 tenant scripts (onboard/offboard/acceptance) that do NOT
+    source lib-net. Operator decision needed before wiring client-critical scripts.
+  - S8c (provider-bundle-check.py restates plane CIDRs): DEFERRED -- design change
+    (python can't source bash -- needs a generated/parsed form).
+- **S-CLASS BATCH STATUS:** DONE = S7, S4, S8a (DOCFIX-132/133/134). HELD/DEFERRED =
+  S8b, S8c, and S1/S2/S3/S5 (lib-validate adoption -- until DOCFIX-126/127
+  live-verify). S6 was ruled no-action earlier. Next operator decision: S8b/S8c
+  scope, and whether to schedule the lib-validate adoption.
 
 ## REMAINING OPEN WORK (single list for session resume; 2026-07-07, updated post-devteam-window)
 
diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md
index 237e718..1475413 100644
--- a/docs/v1-redeploy-changelog.md
+++ b/docs/v1-redeploy-changelog.md
@@ -3316,4 +3316,24 @@
 - Numbers consumed: DOCFIX-133.
 REVERT: git checkout HEAD~ -- scripts/trust_filter.py tests/trust_filter/run-tests.sh scripts/tenant-offboard.sh scripts/tenant-acceptance.sh clientdocs/sweep-receipt.txt docs/v1-redeploy-changelog.md docs/session-ledger.md.
 
-Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-134, BUNDLEFIX-012.
+### 2026-07-08 (addendum 50, jumphost stream) -- DOCFIX-134: S8a FIP pool literals to lib-net.sh (single source of truth)
+
+Operator-greenlit S-class item S8, SCOPED to its low-risk slice (S8a). The D-003
+provider FIP allocation pool (10.12.5.0-10.12.7.254) was hardcoded in
+phase-04-network-create.sh (env-overridable default) and phase-04-network-verify.sh
+(pinned literal). Both already source lib-net.sh, so:
+- Added FIP_POOL_START / FIP_POOL_END to lib-net.sh (D-003-tagged; hard-rule #3
+  centralized constant keyed by role, under the existing SC2034 carve-out).
+- create: FIP_START/FIP_END defaults reference the constants (still env-overridable);
+  verify: pins to the constants.
+- Gauntlet 39/39 (phase-04 + phase-04-create harnesses green); constants resolve
+  when sourced.
+- Numbers consumed: DOCFIX-134.
+- DEFERRED (bigger than the "S" estimate; operator decision in the session ledger):
+  S8b (KEYSTONE_VIP to lib-net.sh across 6 files incl. 3 tenant scripts that do NOT
+  currently source lib-net -- sourcing plumbing into client-critical scripts) and
+  S8c (provider-bundle-check.py restates plane CIDRs -- needs a generated/parsed
+  form since python cannot source bash).
+REVERT: git checkout HEAD~ -- scripts/lib-net.sh scripts/phase-04-network-create.sh scripts/phase-04-network-verify.sh docs/v1-redeploy-changelog.md docs/session-ledger.md.
+
+Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-135, BUNDLEFIX-012.
diff --git a/scripts/lib-net.sh b/scripts/lib-net.sh
index 76b0c58..6213fa7 100644
--- a/scripts/lib-net.sh
+++ b/scripts/lib-net.sh
@@ -58,6 +58,13 @@
 VIP_OCTET_MAX=60
 VIP_COUNT_EXPECT=11
 
+# D-003 provider FIP allocation pool: a RESERVED iprange on the provider-ext subnet
+# so neutron owns it without colliding with a MAAS auto-static primary (KI-P3-001).
+# Single source of truth for phase-04-network-{create,verify} (create stays
+# env-overridable via FIP_START/FIP_END; verify pins to these).
+FIP_POOL_START="10.12.5.0"
+FIP_POOL_END="10.12.7.254"
+
 # --- tiny read-only helpers ---
 
 # need_jq: jq is required (present on the jumphost). Returns non-zero if absent.
diff --git a/scripts/phase-04-network-create.sh b/scripts/phase-04-network-create.sh
index b1c6255..b92e654 100644
--- a/scripts/phase-04-network-create.sh
+++ b/scripts/phase-04-network-create.sh
@@ -29,8 +29,8 @@
 EXT_SUBNET="${EXT_SUBNET:-provider-ext-fip}"
 PHYSNET="${PHYSNET:-physnet1}"
 EXT_CIDR="${EXT_CIDR:-$PROVIDER_CIDR}"
-FIP_START="${FIP_START:-10.12.5.0}"
-FIP_END="${FIP_END:-10.12.7.254}"
+FIP_START="${FIP_START:-$FIP_POOL_START}"
+FIP_END="${FIP_END:-$FIP_POOL_END}"
 
 need_jq || exit 2
 command -v openstack >/dev/null 2>&1 || { echo "FAIL: openstack client not found" >&2; exit 2; }
diff --git a/scripts/phase-04-network-verify.sh b/scripts/phase-04-network-verify.sh
index 98e25d7..d5e8952 100644
--- a/scripts/phase-04-network-verify.sh
+++ b/scripts/phase-04-network-verify.sh
@@ -37,8 +37,8 @@
 # --- phase-04 design literals (D-003; TAG: confirm per site on rebuild) --------------
 PROVIDER_CIDR="10.12.4.0/22"                  # provider-public plane (lib-net PLANE_CIDRS[0])
 GW_EXPECT="${PLANE_GW[$PROVIDER_CIDR]}"        # 10.12.4.1 -- pinned; asserted against live MAAS
-FIP_START="10.12.5.0"
-FIP_END="10.12.7.254"
+FIP_START="$FIP_POOL_START"
+FIP_END="$FIP_POOL_END"
 EXT_NET="provider-ext"
 EXT_SUBNET="provider-ext-fip"
 PHYSNET="physnet1"