diff --git a/.claude/hooks/guard-destructive.py b/.claude/hooks/guard-destructive.py
index 4b66798..400fef1 100644
--- a/.claude/hooks/guard-destructive.py
+++ b/.claude/hooks/guard-destructive.py
@@ -24,8 +24,22 @@
      "prints the MAAS API key (DOCFIX-016); use 'maas admin ...' directly"),
     (r"git\s+push\s+(--force|-f)\b",
      "force-push is banned on this repo"),
-    (r"(cat|less|more|head|tail|cp|scp|base64|xxd|od|strings)\b[^|;&]*"
-     r"(vault-init/|as-executed/|-cred\.txt|appcred)",
+    # strong readers: match through quotes (a quoted path is still a file read).
+    # Paths: secret dirs, home-anchored tenant handover dirs, cred/appcred
+    # files, and private-key .pem files.
+    (r"(cat|less|more|head|tail|cp|scp|base64|xxd|od|strings|python3|openssl)\b[^|;&]*"
+     r"(vault-init/|as-executed/"
+     r"|(?:~|\$HOME|\$\{HOME\}|/home/[\w.-]+)/tenant-[\w.-]+/"
+     r"|-cred\.txt|appcred|\.pem\b)",
+     "secret-adjacent file: never read key/cred material into context (whitelist-print rule)"),
+    # text tools (grep/awk/sed): block BARE-path reads of the same secret set,
+    # but not quoted mentions -- searching source/prose for a string that merely
+    # names a .pem or secret dir must stay allowed (the token must start at a
+    # word boundary after whitespace/=, which a quote character breaks).
+    (r"(grep|awk|sed)\b[^|;&]*(^|[\s=])[\w./~${}-]*"
+     r"(vault-init/|as-executed/"
+     r"|(?:~|\$HOME|\$\{HOME\}|/home/[\w.-]+)/tenant-[\w.-]+/"
+     r"|-cred\.txt|appcred|\.pem\b)",
      "secret-adjacent file: never read key/cred material into context (whitelist-print rule)"),
     (r"rm\s+-rf\s+(/|~)\s*$",
      "catastrophic rm"),
diff --git a/clientdocs/sweep-receipt.txt b/clientdocs/sweep-receipt.txt
index 15d3985..6363c45 100644
--- a/clientdocs/sweep-receipt.txt
+++ b/clientdocs/sweep-receipt.txt
@@ -34,7 +34,7 @@
 30919b61b2b79b33a853a29bc814558d7e0e940a3040b2f7710ea9a14333b71a  runbooks/appendix-C-identity-rbac.md
 8510402e5375a6d42cc47f28eec9698a23d88e04b22ef70ef6e129e1179f3d32  runbooks/appendix-D-magnum-trust-model.md
 927aa7261aa2d9fabe2cb7342499e6c0d0840a93ffbb323ee7003ac8eefe14a7  runbooks/tenant-onboarding-v2-DRAFT.md
-a6080e4d4207a0a47d0ce9e9f54f5b7b3235e0dbf96b00eb2fbc2238df9895ff  scripts/tenant-acceptance.sh
+b8ad0768a1cad3e9a3e329f3cda39e6a151b80c0df5f0402efb65cb290b6b0b3  scripts/tenant-acceptance.sh
 ad00be489480069d52df1b978be0360d7fb04dbf954a8cf487162872f2da0593  scripts/tenant-assert.sh
-0b09bbc3de1927e299eb8650ea901c9f1939abc097e717aa70a049079b409edd  scripts/tenant-offboard.sh
-3f5a3656ef8ebfc0ef9370b1ffd416ee98e40640c803b8bad8492e80ee289051  scripts/tenant-onboard.sh
+45f338d88c816d01a4f0b33f2e3ede1f4b081e701efad1508e9d8e3d102e0485  scripts/tenant-offboard.sh
+08f9540cc57d325ebe9d62a44eab3aaf27fb327e06008a1edb28505a14961af7  scripts/tenant-onboard.sh
diff --git a/docs/script-quality-findings-20260707.md b/docs/script-quality-findings-20260707.md
new file mode 100644
index 0000000..bcbc347
--- /dev/null
+++ b/docs/script-quality-findings-20260707.md
@@ -0,0 +1,141 @@
+# Script-quality findings register -- read-only sweep, 2026-07-07
+
+**What this is.** The deferred-findings register from the 2026-07-07 read-only
+script-quality sweep, recorded so the items survive session compaction. Nothing
+in this file has been executed; every fix listed here is a DOCFIX **candidate**
+to be delivered later under the standard change-delivery loop (harness green,
+repo-lint clean, changelog entry with revert). No identifier numbers are
+assigned in this register -- the batch that fixes an item assigns its number
+via the next-free rule at delivery time.
+
+**Sweep coverage.** 110 files reviewed (scripts/, tests/, .claude/hooks/).
+Tools available on the review host: bash and python3 only; shellcheck and
+pyflakes were absent, so findings come from manual read plus targeted fixture
+probes, not static analysis.
+
+**Batch note.** The sweep's E/R-class items approved for immediate fix were
+implemented in the fix batch of this date and are NOT listed here, except the
+two previously-known items marked FIXED-THIS-BATCH below.
+
+## Deferred findings (R-class; fixes are DOCFIX candidates)
+
+### R5 -- lib-validate.sh: vr_json tempfile leak
+`vr_json` (scripts/lib-validate.sh, ~line 52) creates `_VR_ERR="$(mktemp)"` on
+every call and never removes it. `vr_err_tail` legitimately needs the file
+after return, but nothing cleans it up afterwards: one leaked tempfile per
+`vr_json` call, per check, per validation run. Fix shape: a single per-process
+stderr file reused across calls, or an EXIT trap in the library's sourcing
+contract.
+
+### R6 -- `| head -1` SIGPIPE / extract-then-check class in phase-05/06
+Live-pipe `openstack ... | head -1` captures that use the fragment without
+whole-output validation:
+- scripts/phase-05-amphora-pipeline.sh:62 (`image list --tag ... | head -1`)
+- scripts/phase-05-amphora-pipeline.sh:66 (`image list --name ... | head -1`)
+- scripts/phase-06-mgmt-vm.sh:106 (`port list --server ... | head -1`)
+- scripts/phase-06-mgmt-vm.sh:108 (`floating ip list --port ... | head -1`)
+Same class the house style forbids (SIGPIPE race on the producer; a partial
+failure yields a plausible-looking fragment). Fix shape: capture whole output,
+validate shape (uuid regex), then select the first row.
+
+### R7 -- phase-07-conductor-graft.sh: remote tempdir leak
+The helm-install payload run on the conductor (~line 153) does
+`D=$(mktemp -d); cd "$D"` and never removes the directory: one leaked tempdir
+(plus tarball) on the remote unit per graft run. Fix shape: trap cleanup inside
+the remote payload.
+
+### R9 -- cloud-assert.sh --capture: `--long` + silent empty images.json
+Line ~184: `openstack image list --long -f json </dev/null > "$DIR/images.json"
+2>/dev/null || true`. Two defects: (a) the deprecated `--long` flag only adds
+stderr noise (and `2>/dev/null` then masks REAL errors, against the
+stderr-separation rule); (b) a failed list silently commits an empty/missing
+images.json into the captured BOM. Fix shape: drop `--long`, stderr to a
+tempfile surfaced on failure, fail the capture loudly if the JSON is empty or
+unparseable.
+
+### R11 -- harness tempfile leaks
+Harnesses that mktemp without a trap cleanup (leak per run):
+- tests/carve-host-interfaces/run-tests.sh
+- tests/lib-validate/run-tests.sh (also amplifies R5: every vr_json case leaks)
+- tests/phase-00-maas-standup/run-tests.sh
+Fix shape: the standard `W=$(mktemp -d); trap 'rm -rf "$W"' EXIT` pattern the
+other 34 harnesses already use.
+
+## Previously-known items -- FIXED-THIS-BATCH
+
+- **tenant-offboard.sh Phase B counter (FIXED-THIS-BATCH).** Logged in the
+  changelog (2026-07-06 addendum 28) as FOUND-NOT-FIXED: the residual-trust
+  sweep incremented SWEEP_FAIL inside a `printf | while` pipeline subshell, so
+  failed trust deletes could never raise exit 22. Fixed in this date's batch
+  (here-string loop; regression case in tests/tenant-offboard).
+- **tenant-offboard.sh hardcoded auth URL (FIXED-THIS-BATCH).** The known
+  hardcoded-OS_AUTH_URL class (house rule 3): tenant_env now reads `auth_url=`
+  from the cred file with the literal demoted to a KEYSTONE_VIP-overridable
+  fallback. NOTE: the tenant-acceptance.sh foil_env sibling of this class
+  (addendum 28 FOUND-NOT-FIXED list) remains OPEN and is NOT covered by this
+  batch.
+
+## Consolidation proposals (S-class; S1-S8)
+
+Transferred verbatim from the sweep report at integration (2026-07-07);
+effort estimates are the sweep's (S/M/L). Operator has NOT ruled on S1-S5/
+S7/S8 -- proposals only.
+
+- **S1 (M)** The unset-OS_*/source-env dance is hand-rolled ~15x across
+  tenant-onboard (8 subshells), tenant-offboard (2), tenant-acceptance (3),
+  d063-apply (1), tenant-assert (2) -- while scripts/lib-validate.sh already
+  ships tested vr_scrub_os / vr_admin_env / vr_tenant_env. Proposal: source
+  lib-validate.sh from the tenant-* family + d063-apply; add one
+  `vr_appcred_env <file>` for the app-cred variant. (The offboard tenant_env
+  auth-url bug was fixed narrowly in this batch; this proposal remains the
+  wider consolidation.)
+- **S2 (S)** run() capture-then-test helper duplicated with eval-counter
+  variants in tenant-offboard.sh and d063-apply.sh vs the rc-returning
+  lib-validate run(). Consolidate; count failures at call sites.
+- **S3 (S)** is_id() defined in 4 scripts (tenant-onboard, tenant-offboard,
+  d063-apply, tenant-assert); lib-validate already has vr_is_hex32. Ride
+  along with S1.
+- **S4 (M)** The trust-list stdout-only capture + inline-python filter block
+  is near-identical 3x (tenant-offboard x2, tenant-acceptance x1) and is
+  inline python-in-bash beyond one-liner scale (house rule: .py files). One
+  fixture-tested scripts/trust_filter.py would serve all three.
+- **S5 (S)** Kube-image UUID resolution block (json capture + jq kube filter
+  + tempfile + 36-hex validation) appears 3x inside tenant-onboard.sh. One
+  local function.
+- **S6 (no action)** cap()/oerr() triplicated across clientdocs/scripts/
+  {smoke-test,acceptance-run,ci-cleanup-sweep} -- CORRECT as-is: handover
+  artifacts must be standalone off-jumphost. Worth a header comment noting
+  the duplication is deliberate.
+- **S7 (S)** Dead code: checks/d011-04 CF assigned never used; checks/d011-03
+  vr_is_ipv4-or-VHOST first test subsumed by second. (The other two S7 items
+  -- offboard no-op is_id, validate.sh lost line-rewrite -- were FIXED in
+  this batch.)
+- **S8 (S)** Move the KEYSTONE_VIP default and the D-003 FIP pool bounds into
+  lib-net.sh as tagged constants (the literal is duplicated in 4 files:
+  tenant-onboard, phase-03-admin-openrc, phase-06-kubeconfig-gate,
+  phase-06-k8s-bootstrap; FIP pool literals duplicated across the two
+  phase-04-network scripts; provider-bundle-check.py re-states plane CIDRs
+  as a second source of truth -- python cannot source bash, needs a
+  generated or parsed form).
+
+## Found during the fix batch (this date; logged, NOT fixed -- out of scope)
+
+- **tenant-offboard.sh Phase A cluster captures merge stderr.** The
+  tenant-scope `coe cluster list` captures (inventory ~line 160; delete loop
+  and wait loop in Phase A) still use `2>&1`: a stderr warning line would
+  word-split into `coe cluster delete` argv and keep the wait loop from ever
+  seeing empty (budget exit 21). Same class as the Phase C fix; was not in the
+  approved batch scope. The offboard harness deliberately excludes coe
+  commands from its stderr-noise scenario until this is fixed.
+- **Merged-stderr `domain show`/`token issue` captures (fail-closed class).**
+  tenant-offboard.sh (~line 133, sweep-mode preamble) and tenant-onboard.sh
+  stage subshells validate `$(... 2>&1)` captures by shape/equality. Failure
+  direction is CLOSED (safe), but a benign stderr warning on a noisy CLI would
+  abort with a false precondition/auth failure. Cosmetic-risk cleanup
+  candidate, same stdout-only pattern.
+- **tenant-offboard.sh Phase E0 app-cred inventory merges stderr.** Line ~267
+  tests rc (failures route correctly), but a success-with-warning would
+  word-split the warning into the display-only cascade-inventory lines.
+  Display pollution only; no delete argv exposure.
+
+ASCII + LF.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 69df189..0224291 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -21,7 +21,7 @@
 <!-- SECTION: machine-derived | OWNER: ledger-scan (regenerate; never hand-edit) -->
 ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)
 
-_As of 2026-07-06 (post-addendum-27, d011-batch3 window close; re-run the scan to refresh):_
+_As of 2026-07-07 (post-addendum-33; re-run the scan to refresh):_
 
 - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt -- 1.16
   ruled out per amendment; off-EOL path OPEN), D-071 (routine update cadence +
@@ -31,8 +31,8 @@
 - **OPEN security rows:** SEC-001 (rotate at v1 close, re-ruled 2026-07-06),
   SEC-003 (custodians + second-person unseal -- DEFERRED; keeps d011-06 MANUAL),
   SEC-004 (flip repo to private at v1 close -- deferral reaffirmed).
-- **Next-free numbers:** D = 075, DOCFIX = 112, BUNDLEFIX = 012.
-  (Scan and the addendum-32 changelog next-free pointer agree.)
+- **Next-free numbers:** D = 075, DOCFIX = 118, BUNDLEFIX = 012.
+  (Scan and the addendum-33 changelog next-free pointer agree.)
 
 ---
 
@@ -271,6 +271,42 @@
 - **Open (small):** Horizon manual checks on foil1 (operator, browser,
   non-blocking); capi-test-1 CREATE_FAILED leftover (orphan-sweep candidate);
   beta-cluster lbtest leftover; repo-lint worktree-exclusion DOCFIX candidate.
+- **SCRIPT-QUALITY BATCH LANDED (addendum 33, 2026-07-07):** repo-wide sweep
+  (110 scripts) -> operator-ruled fix scope shipped as DOCFIX-112..117:
+  stage2 anti-escalation guard fail-closed (SECURITY -- was fail-open both
+  ways); tenant-offboard hardening cluster (stderr-as-argv, Phase B counter
+  CLOSED after 2 days logged, LB-wait fails loud, cred-file auth_url);
+  validate.sh nonstd-exit HOLD; juju-spaces-check macaroon-vs-absent; pipefail
+  sweep + vault-kv-health rc-test; guard-hook blocklist extension. Gauntlet
+  38/38. Deferred S-class + minor R items in
+  docs/script-quality-findings-20260707.md (operator has NOT ruled S1-S5/S7/S8).
+
+## REMAINING OPEN WORK (single list for session resume; 2026-07-07)
+
+1. **Devteam onboarding window (PRIMARY NEXT TASK, operator-gated, own
+   session):** name devteam (pinned); TENANT_CIDR = dev team's choice or
+   10.100.0.0/24 fallback (ruled); guard is the D-074 rewrite; snapshot +
+   1.1GB controller backup gates SATISFIED (asbuilt/20260706-224851).
+   Sequence: run-logged window -> stages 0-4 -> tenant-assert -> stage7
+   canary -> instantiate the RELEASED clientdocs pack ({{PLACEHOLDER}} fill,
+   strip TEMPLATE NOTE) -> collect the 7 Jenkins intake answers (DOCFIX-101
+   entry) -> deliver. Doubles as first client-facing workflow execution.
+2. **Operator manual item:** foil1 Horizon checks (contract 5.1/5.3) --
+   domain-admin login + GUI probe-user create/delete; non-blocking.
+3. **Operator ruling available anytime:** capi-test-1 CREATE_FAILED cluster
+   record delete (one gated command; next orphan-audit then reaps its
+   trustee).
+4. **S-class consolidation + minor R items:** proposals in
+   docs/script-quality-findings-20260707.md -- present options to operator
+   before building (S1-S5/S7/S8 unruled; S6 ruled no-action).
+5. **Pinned decisions (do NOT re-ask):** D-071 ratification (pre-DC-DC HA/
+   backup session); D-068 off-EOL path (Roosevelt-scale); SEC-001/003/004
+   at v1 close; d011-06 stays MANUAL until SEC-003 rehearsal (gates D-011
+   FULL close; v1-close checklist QUEUED per handoff section 6).
+6. **Cross-stream:** main-chat to reconcile its ledger section against
+   addenda 27-33 (its backlog items 6/7/8 delivered here; its Verify-live
+   queue fully cleared; D-050/D-073/D-074 all resolved).
+
 - **CLIENT PACKAGE RELEASED (addendum 31, 2026-07-07):** operator-requested
   polish sweep integrated (DOCFIX-110) + banner ruling applied (DRAFT
   removed; the three per-client templates keep TEMPLATE; README says
diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md
index a9d1846..37511c8 100644
--- a/docs/v1-redeploy-changelog.md
+++ b/docs/v1-redeploy-changelog.md
@@ -2609,3 +2609,81 @@
   a re-audit would classify that trustee for reaping.
 
 Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-112, BUNDLEFIX-012.
+
+### 2026-07-07 (addendum 33, jumphost stream) -- script-quality fix batch: DOCFIX-112..117 (sweep E/R findings, operator-ruled scope)
+
+A read-only repo-wide quality sweep (110 scripts; bash -n and py_compile
+all-clean; shellcheck/pyflakes absent on the jumphost, manual passes for
+their high-value classes) surfaced 4 runtime errors + robustness items.
+Operator ruled the fix scope: errors + coupled robustness now; S-class
+consolidation deferred. All fixes harness-proven with discriminating
+regression cases (each proven failing against the pre-fix code where a
+deterministic mock can express it).
+
+- **DOCFIX-112 -- tenant-onboard.sh stage2 anti-escalation guard fail-closed
+  (SECURITY).** The `role assignment list | grep -qw admin` live pipe under
+  pipefail failed OPEN both ways: SIGPIPE on the very match it exists to
+  catch, or a failed list, both printed "anti-escalation OK". Now
+  capture-then-test, stdout-only, STOP on unverifiable (the same form the
+  file already used 30 lines up). Harness +3 stage2 cases; fail-closed case
+  proven discriminating vs pre-fix. REVERT: git checkout HEAD~ --
+  scripts/tenant-onboard.sh tests/tenant-onboard/run-tests.sh.
+- **DOCFIX-113 -- tenant-offboard.sh hardening cluster.** (a) stdout-only
+  inventory captures via new inv() helper (stderr to tempfile, surfaced as
+  NOTE); (b) every Phase C/D/E row shape-validated (row_ok/is_id) before
+  becoming delete argv -- a merged deprecation warning previously word-split
+  into deletes (mock replay: 70 bogus delete calls pre-fix); invalid rows
+  SKIP + count; (c) Phase B residual-trust loop printf|while subshell ->
+  here-string, so SWEEP_FAIL survives (failed trust delete now exits 22;
+  found-not-fixed since addendum 28, now CLOSED); (d) LB-gone wait counts
+  stdout only and fails LOUDLY on budget exhaustion or list error (was a
+  silent fall-through into FIP/server deletes); (e) discarded is_id no-op
+  enforced; (f) tenant_env reads auth_url= from the cred file, hardcoded VIP
+  demoted to KEYSTONE_VIP-overridable fallback. Harness 14->20, mock made
+  CLI-truthful (UUID rows, stderr warnings); all six new cases fail pre-fix.
+  REVERT: git checkout HEAD~ -- scripts/tenant-offboard.sh
+  tests/tenant-offboard/run-tests.sh.
+- **DOCFIX-114 -- validate.sh non-contract exit codes count as HOLD.** A
+  check dying 127/141/139 previously yielded OVERALL PASS exit 0 (note_worst
+  matched nothing; the nonstd annotation was dead code ordered after
+  REPORT+=). Default arm now annotates then forces HOLD. Proven: old rc=0,
+  new rc=2. REVERT: git checkout HEAD~ -- scripts/validate.sh
+  tests/validate/run-tests.sh.
+- **DOCFIX-115 -- juju-spaces-check.sh model gate capture-then-test.** The
+  live `juju models | jq | grep -qx` pipe masked juju auth failure (and the
+  SIGPIPE race) as "model not present"; auth failure now exits 1 with the
+  existing macaroon hint. NEW harness tests/juju-spaces-check (5 cases;
+  script previously had none). REVERT: git checkout HEAD~ --
+  scripts/juju-spaces-check.sh; git rm -r tests/juju-spaces-check.
+- **DOCFIX-116 -- pipefail upgrades + vault-kv-health rc-test.**
+  tenant-acceptance.sh and vault-kv-health.sh set -u -> set -uo pipefail
+  (pipelines audited); 7 harnesses upgraded likewise;
+  vault-kv-inner-probe.sh stays set -u with the paste-block exemption
+  documented in-line; vault-kv-health C2 no longer misreports a juju
+  show-unit failure as "no vault_url" FAIL -- rc tested first, juju failure
+  warns UNVERIFIED on the HOLD path. Harness 8->10. REVERT: git checkout
+  HEAD~ -- scripts/tenant-acceptance.sh scripts/vault-kv-health.sh
+  scripts/vault-kv-inner-probe.sh tests/checks/run-tests.sh
+  tests/d063-apply/run-tests.sh tests/ledger-scan/run-tests.sh
+  tests/lib-validate/run-tests.sh tests/validate/run-tests.sh
+  tests/vault-kv-health/run-tests.sh.
+- **DOCFIX-117 -- guard-destructive.py secret-read blocklist extension.**
+  Reader set gains python3/openssl (quote-blind) and grep/awk/sed
+  (quote-sensitive: bare-path reads block, quoted prose mentions pass);
+  path set gains home-anchored tenant-*/ and .pem (repo tests/tenant-*/
+  stays readable). Precision-tested; harness 13->25. REVERT: git checkout
+  HEAD~ -- .claude/hooks/guard-destructive.py tests/claude-guard/run-tests.sh.
+- **docs/script-quality-findings-20260707.md (rides the batch):**
+  deferred-findings register -- R5/R6/R7/R9/R11 verified with locations,
+  S1-S8 consolidation proposals transferred VERBATIM at integration (the
+  fix agent flagged it could not see the sweep session's text and refused
+  to fabricate -- correct call), fixed-this-batch markers, plus new
+  found-while-fixing items (tenant-offboard Phase A coe-capture stderr
+  class; benign-warning aborts on fail-closed preamble captures; Phase E0
+  display pollution). Sweep clean bill recorded: DOCFIX-094 stderr class
+  fully closed repo-wide, no /tmp-to-snap bugs, libs correctly set -e-free.
+- **Gates:** gauntlet ALL GREEN (38 harnesses, 1 new); repo-lint 0 fail /
+  1 legacy warn; L7 receipt re-recorded (tenant scripts changed; clientdocs
+  reviewed -- client-visible contract unchanged by this batch).
+
+Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-118, BUNDLEFIX-012.
diff --git a/scripts/juju-spaces-check.sh b/scripts/juju-spaces-check.sh
index a820f4d..1a32281 100644
--- a/scripts/juju-spaces-check.sh
+++ b/scripts/juju-spaces-check.sh
@@ -34,7 +34,12 @@
 echo
 
 # Is MODEL present? Strip any owner/ prefix; match the bare model name.
-if ! juju models --format json 2>/dev/null | jq -r '.models[]?.name' 2>/dev/null | sed 's#.*/##' | grep -qx "$MODEL"; then
+# Capture-then-test (DOCFIX-115): the live-pipe form (juju | jq | grep -qx)
+# raced SIGPIPE under pipefail and masked a juju auth failure as "model not
+# present". A failed 'juju models' now takes the macaroon-hint path instead.
+MJSON="$(juju models --format json)" || { fail "juju models failed (auth/macaroon? re-login or append </dev/tty)"; echo; echo "Summary: 1 fatal"; exit 1; }
+MNAMES="$(jq -r '.models[]?.name' <<<"$MJSON" 2>/dev/null | sed 's#.*/##')" || true
+if ! grep -qx "$MODEL" <<<"$MNAMES"; then
   note "model '$MODEL' not present yet -- run 'juju add-model $MODEL' first (spaces are per-model)"
   echo
   echo "Summary: model-absent (run add-model, then re-run this check)"
diff --git a/scripts/tenant-acceptance.sh b/scripts/tenant-acceptance.sh
index b9b9eaf..34eb557 100644
--- a/scripts/tenant-acceptance.sh
+++ b/scripts/tenant-acceptance.sh
@@ -13,7 +13,7 @@
 # NOTE: P2 leaves the lbtest deployment + LB in place for inspection (cleanup is a separate gate).
 # Provenance: gate t3-01 of the 2026-07-02 session (D-066/D-067 acceptance); mock-tested 4-branch.
 # Harness: tests/tenant-acceptance/run-tests.sh (offline; covers the DOCFIX-094 stdout-only trust capture).
-set -u
+set -uo pipefail
 CLIENT="${1:-}"
 [ -n "$CLIENT" ] || { echo "usage: tenant-acceptance.sh <client> [foil-appcred-file]"; exit 14; }
 CF="$HOME/tenant-${CLIENT}/${CLIENT}-cluster-cred.txt"
diff --git a/scripts/tenant-offboard.sh b/scripts/tenant-offboard.sh
index bd199e4..75eb550 100644
--- a/scripts/tenant-offboard.sh
+++ b/scripts/tenant-offboard.sh
@@ -38,6 +38,21 @@
 
 admin_env(){ for v in $(env|awk -F= '/^OS_/{print $1}'); do unset "$v"; done; source "$HOME/admin-openrc"; }
 is_id(){ [[ "${1:-}" =~ ^[0-9a-f]{32}$ ]]; }
+row_ok(){ is_id "${1//-/}"; }   # keystone 32-hex OR dashed uuid row
+# inv <var> <label> <cmd...> (DOCFIX-113): stdout-only inventory capture.
+# Merged-stderr captures (2>&1) used to word-split warning text into the
+# destructive loops -- a deprecation notice became delete argv. stderr goes to
+# a tempfile and is SURFACED (first line), never merged or discarded.
+# Returns the command's exit status; <var> receives stdout only.
+inv(){
+  local __v="$1" __label="$2"; shift 2
+  local __e __o __rc; __e=$(mktemp)
+  __o=$("$@" </dev/null 2>"$__e"); __rc=$?
+  [ -s "$__e" ] && echo "  NOTE: $__label stderr: $(head -1 "$__e")"
+  rm -f "$__e"
+  printf -v "$__v" '%s' "$__o"
+  return $__rc
+}
 
 # ==== DOCFIX-099: orphaned per-cluster trustee sweep (magnum trustee domain) ====
 # Magnum mints one trustee user per cluster in the 'magnum' trustee domain (D-046),
@@ -141,16 +156,21 @@
          "$HOME/${CLIENT}-svc-cred.txt"; do
   [ -s "$c" ] && grep -qE '^password=' "$c" && { TCF="$c"; break; }
 done
+# DOCFIX-113: auth URL comes from the cred file's auth_url= line (same rule as
+# tenant-acceptance.sh tenant_env); the literal is only a KEYSTONE_VIP-overridable
+# fallback, consistent with tenant-onboard.sh.
+KEYSTONE_VIP="${KEYSTONE_VIP:-10.12.4.50}"
 tenant_env(){ for v in $(env|awk -F= '/^OS_/{print $1}'); do unset "$v"; done
-  export OS_AUTH_URL="https://10.12.4.50:5000/v3" OS_IDENTITY_API_VERSION=3
+  local AU; AU="$(awk -F= '/^auth_url=/{print $2}' "$TCF")"
+  export OS_AUTH_URL="${AU:-https://${KEYSTONE_VIP}:5000/v3}" OS_IDENTITY_API_VERSION=3
   export OS_CACERT="${OS_CACERT:-$HOME/vault-init/vault-ca-root.pem}"
   export OS_USERNAME="$(awk -F= '/^username=/{print $2}' "$TCF")" OS_USER_DOMAIN_ID="$DOM"
   export OS_PROJECT_ID="$(awk -F= '/^project_id=/{print $2}' "$TCF")"
   export OS_PASSWORD="$(awk -F= '/^password=/{print $2}' "$TCF")"; }
 
-# ---- inventory ----
-USERS=$(openstack user list --domain "$DOM" -f value -c ID -c Name </dev/null 2>&1) || true
-PROJS=$(openstack project list --domain "$DOM" -f value -c ID -c Name </dev/null 2>&1) || true
+# ---- inventory (DOCFIX-113: stdout-only; rows are shape-validated at each destructive use) ----
+inv USERS "user list" openstack user list --domain "$DOM" -f value -c ID -c Name || true
+inv PROJS "project list" openstack project list --domain "$DOM" -f value -c ID -c Name || true
 echo "--- users in domain ---";    printf '%s\n' "${USERS:-<none>}" | sed 's/^/  /'
 echo "--- projects in domain ---"; printf '%s\n' "${PROJS:-<none>}" | sed 's/^/  /'
 
@@ -222,35 +242,81 @@
 
 admin_env
 # ---- Phase B: residual trusts ----
-printf '%s\n' "${TRUSTS:-}" | while read -r TID REST; do
+# NOT a pipeline loop (DOCFIX-113): the printf|while form ran the body in a
+# subshell and ATE the run SWEEP_FAIL increments -- a failed trust delete
+# exited 0. Here-string form, same as the sweep-mode loop above.
+while read -r TID REST; do
   [ -n "$TID" ] && [ "$TID" != "<none>" ] || continue
   T2=$(openstack trust show "$TID" -f value -c id </dev/null 2>&1) || true
   [ "$T2" = "$TID" ] && { echo "  deleting residual trust $TID"; run SWEEP_FAIL openstack trust delete "$TID"; }
-done
+done <<<"${TRUSTS:-}"
 
 # ---- Phase C+D: per-project resource sweep + L3 unwind ----
+# DOCFIX-113 hardening: every inventory is a stdout-only capture (inv) and every
+# row is shape-validated (row_ok) BEFORE it becomes delete argv, mirroring the
+# sweep-mode fail-closed style. Invalid rows are SKIPPED and counted, never deleted.
 for P in $(printf '%s\n' "$PROJS" | awk '{print $1}'); do
-  for LB in $(openstack loadbalancer list --project "$P" -f value -c id </dev/null 2>&1); do
-    is_id "${LB//-/}" 2>/dev/null || true
+  inv LBS "loadbalancer list ($P)" openstack loadbalancer list --project "$P" -f value -c id \
+    || { echo "    ^ FAILED: loadbalancer inventory ($P)"; SWEEP_FAIL=$((SWEEP_FAIL+1)); }
+  while read -r LB; do
+    [ -n "$LB" ] || continue
+    row_ok "$LB" || { echo "  SKIP non-id LB row (listing suspect): $LB"; SWEEP_FAIL=$((SWEEP_FAIL+1)); continue; }
     echo "  LB delete --cascade $LB"; run SWEEP_FAIL openstack loadbalancer delete --cascade "$LB"
-  done
+  done <<<"$LBS"
+  # LB-gone wait (DOCFIX-113): stdout-only count (merged stderr used to count as
+  # live LBs); a failed list or an exhausted budget FAILS the phase loudly instead
+  # of falling through silently into the FIP/server deletes.
+  LBWAIT=fail
   for i in $(seq 1 20); do
-    N=$(openstack loadbalancer list --project "$P" -f value -c id </dev/null 2>&1 | grep -c . || true)
-    [ "$N" = 0 ] && break; echo "  waiting LBs gone ($N left)"; sleep 15
+    if ! inv WLB "loadbalancer wait ($P)" openstack loadbalancer list --project "$P" -f value -c id; then
+      echo "  waiting: LB list errored; retrying"; sleep 15; continue
+    fi
+    N=$(grep -c . <<<"$WLB" || true)
+    [ "$N" = 0 ] && { LBWAIT=ok; break; }
+    echo "  waiting LBs gone ($N left)"; sleep 15
   done
-  for F in $(openstack floating ip list --project "$P" -f value -c ID </dev/null 2>&1); do
-    echo "  FIP delete $F"; run SWEEP_FAIL openstack floating ip delete "$F"; done
-  for S in $(openstack server list --project "$P" -f value -c ID </dev/null 2>&1); do
-    echo "  server delete $S"; run SWEEP_FAIL openstack server delete "$S"; done
-  for R in $(openstack router list --project "$P" -f value -c ID </dev/null 2>&1); do
-    for SN in $(openstack subnet list --project "$P" -f value -c ID </dev/null 2>&1); do
-      openstack router remove subnet "$R" "$SN" </dev/null 2>&1 || true; done
+  [ "$LBWAIT" = ok ] || { echo "    ^ FAILED: LBs not confirmed gone in budget ($P) -- dependent sweeps may strand"; SWEEP_FAIL=$((SWEEP_FAIL+1)); }
+  inv FIPS "floating ip list ($P)" openstack floating ip list --project "$P" -f value -c ID \
+    || { echo "    ^ FAILED: floating ip inventory ($P)"; SWEEP_FAIL=$((SWEEP_FAIL+1)); }
+  while read -r F; do
+    [ -n "$F" ] || continue
+    row_ok "$F" || { echo "  SKIP non-id FIP row (listing suspect): $F"; SWEEP_FAIL=$((SWEEP_FAIL+1)); continue; }
+    echo "  FIP delete $F"; run SWEEP_FAIL openstack floating ip delete "$F"
+  done <<<"$FIPS"
+  inv SRVS "server list ($P)" openstack server list --project "$P" -f value -c ID \
+    || { echo "    ^ FAILED: server inventory ($P)"; SWEEP_FAIL=$((SWEEP_FAIL+1)); }
+  while read -r S; do
+    [ -n "$S" ] || continue
+    row_ok "$S" || { echo "  SKIP non-id server row (listing suspect): $S"; SWEEP_FAIL=$((SWEEP_FAIL+1)); continue; }
+    echo "  server delete $S"; run SWEEP_FAIL openstack server delete "$S"
+  done <<<"$SRVS"
+  inv RTRS "router list ($P)" openstack router list --project "$P" -f value -c ID \
+    || { echo "    ^ FAILED: router inventory ($P)"; SWEEP_FAIL=$((SWEEP_FAIL+1)); }
+  inv SNS "subnet list ($P)" openstack subnet list --project "$P" -f value -c ID \
+    || { echo "    ^ FAILED: subnet inventory ($P)"; SWEEP_FAIL=$((SWEEP_FAIL+1)); }
+  while read -r R; do
+    [ -n "$R" ] || continue
+    row_ok "$R" || { echo "  SKIP non-id router row (listing suspect): $R"; SWEEP_FAIL=$((SWEEP_FAIL+1)); continue; }
+    while read -r SN; do
+      [ -n "$SN" ] || continue
+      row_ok "$SN" || continue   # invalid subnet rows are counted once, in the delete loop below
+      openstack router remove subnet "$R" "$SN" </dev/null 2>&1 || true
+    done <<<"$SNS"
     openstack router unset --external-gateway "$R" </dev/null 2>&1 || true
-    echo "  router delete $R"; run SWEEP_FAIL openstack router delete "$R"; done
-  for SN in $(openstack subnet list --project "$P" -f value -c ID </dev/null 2>&1); do
-    echo "  subnet delete $SN"; run SWEEP_FAIL openstack subnet delete "$SN"; done
-  for NW in $(openstack network list --project "$P" -f value -c ID </dev/null 2>&1); do
-    echo "  network delete $NW"; run SWEEP_FAIL openstack network delete "$NW"; done
+    echo "  router delete $R"; run SWEEP_FAIL openstack router delete "$R"
+  done <<<"$RTRS"
+  while read -r SN; do
+    [ -n "$SN" ] || continue
+    row_ok "$SN" || { echo "  SKIP non-id subnet row (listing suspect): $SN"; SWEEP_FAIL=$((SWEEP_FAIL+1)); continue; }
+    echo "  subnet delete $SN"; run SWEEP_FAIL openstack subnet delete "$SN"
+  done <<<"$SNS"
+  inv NWS "network list ($P)" openstack network list --project "$P" -f value -c ID \
+    || { echo "    ^ FAILED: network inventory ($P)"; SWEEP_FAIL=$((SWEEP_FAIL+1)); }
+  while read -r NW; do
+    [ -n "$NW" ] || continue
+    row_ok "$NW" || { echo "  SKIP non-id network row (listing suspect): $NW"; SWEEP_FAIL=$((SWEEP_FAIL+1)); continue; }
+    echo "  network delete $NW"; run SWEEP_FAIL openstack network delete "$NW"
+  done <<<"$NWS"
 done
 
 # ---- Phase E0: tenant app creds (explicit + idempotent; H2-style guard, DOCFIX-100) ----
@@ -283,11 +349,17 @@
   done
 fi
 
-# ---- Phase E: identities ----
-for U in $(printf '%s\n' "$USERS" | awk '{print $1}'); do
-  echo "  user delete $U"; run ID_FAIL openstack user delete "$U"; done
-for P in $(printf '%s\n' "$PROJS" | awk '{print $1}'); do
-  echo "  project delete $P"; run ID_FAIL openstack project delete "$P"; done
+# ---- Phase E: identities (rows shape-validated before delete; DOCFIX-113) ----
+while read -r U UNAME; do
+  [ -n "$U" ] || continue
+  is_id "$U" || { echo "  SKIP non-id user row (listing suspect): $U $UNAME"; ID_FAIL=$((ID_FAIL+1)); continue; }
+  echo "  user delete $U"; run ID_FAIL openstack user delete "$U"
+done <<<"${USERS:-}"
+while read -r PJ PJNAME; do
+  [ -n "$PJ" ] || continue
+  is_id "$PJ" || { echo "  SKIP non-id project row (listing suspect): $PJ $PJNAME"; ID_FAIL=$((ID_FAIL+1)); continue; }
+  echo "  project delete $PJ"; run ID_FAIL openstack project delete "$PJ"
+done <<<"${PROJS:-}"
 run ID_FAIL openstack domain set --disable "$DOM"
 echo "  domain delete $DOM"; run ID_FAIL openstack domain delete "$DOM"
 D2=$(openstack domain show "$CLIENT" -f value -c id </dev/null 2>&1) || true
diff --git a/scripts/tenant-onboard.sh b/scripts/tenant-onboard.sh
index 1359bc0..99a6b4b 100644
--- a/scripts/tenant-onboard.sh
+++ b/scripts/tenant-onboard.sh
@@ -93,7 +93,16 @@
     # anti-escalation self-check (must be DENIED)
     local SU; SU=$(openstack user show "${CLIENT}-svc" --domain "$DOM" -f value -c id </dev/null 2>&1)
     openstack role add --project "$PID" --user "$SU" admin </dev/null >/dev/null 2>&1 || true
-    if openstack role assignment list --project "$PID" --user "$SU" --names -f value -c Role </dev/null 2>&1 | grep -qw admin; then echo "  *** ESCALATION: manager granted admin -- STOP ***"; exit 1; else echo "  anti-escalation OK (admin grant denied)"; fi
+    # capture-then-test, stdout-only (DOCFIX-112): the raced live-pipe form
+    # (list | grep -qw admin) failed OPEN under pipefail -- SIGPIPE on a match,
+    # or a failed list, both printed "anti-escalation OK". FAIL CLOSED instead.
+    local ESERR ESRA; ESERR=$(mktemp)
+    if ! ESRA=$(openstack role assignment list --project "$PID" --user "$SU" --names -f value -c Role </dev/null 2>"$ESERR"); then
+      echo "  *** anti-escalation check UNVERIFIABLE (role assignment list failed: $(head -1 "$ESERR")) -- STOP ***"
+      rm -f "$ESERR"; exit 1
+    fi
+    rm -f "$ESERR"
+    if grep -qw admin <<<"$ESRA"; then echo "  *** ESCALATION: manager granted admin -- STOP ***"; exit 1; else echo "  anti-escalation OK (admin grant denied)"; fi
   ) || die "stage2 failed"
 }
 
diff --git a/scripts/validate.sh b/scripts/validate.sh
index a31c7b6..aad9236 100644
--- a/scripts/validate.sh
+++ b/scripts/validate.sh
@@ -100,15 +100,19 @@
     # print the check's human output above its result line
     printf '%s\n' "$out" | grep -vE '^RESULT ' | sed 's/^/  /'
   fi
-  REPORT+=("$line")
   case "$rc" in
     "$VR_PASS")   n_pass+=1 ;;
     "$VR_FAIL")   n_fail+=1 ;;
     "$VR_HOLD")   n_hold+=1 ;;
     "$VR_MANUAL") n_manual+=1 ;;
     "$VR_SKIP")   n_skip+=1 ;;
-    *) n_hold+=1; line="${line/ $rc / $rc(nonstd) }" ;;
+    *) # non-contract exit (127 tool-missing, 141 SIGPIPE, 139 crash, ...):
+       # annotate the line BEFORE appending and force the verdict to HOLD --
+       # pre-fix (DOCFIX-114) the rewrite was dead code after REPORT+= and
+       # note_worst matched nothing, so a crashed check yielded OVERALL PASS.
+       n_hold+=1; line="${line/ $rc / $rc(nonstd) }"; rc=$VR_HOLD ;;
   esac
+  REPORT+=("$line")
   note_worst "$rc"
   if [ "$STOP" = 1 ] && { [ "$rc" = "$VR_FAIL" ] || [ "$rc" = "$VR_HOLD" ]; }; then
     echo "  [stop-on-fail: halting after $id]"; break
diff --git a/scripts/vault-kv-health.sh b/scripts/vault-kv-health.sh
index 139a0e0..40f5923 100644
--- a/scripts/vault-kv-health.sh
+++ b/scripts/vault-kv-health.sh
@@ -7,7 +7,7 @@
 # Consumer discovery is DYNAMIC (juju relations of vault:secrets). Consumers without a conf-path
 # mapping are a COVERAGE GAP: reported loudly, exit 2. Update CONSUMER_MAP when adding consumers.
 # Exit: 0 all pass | 1 any check failed | 2 warnings only (coverage gap / unparsed)
-set -u
+set -uo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=scripts/lib-net.sh
 . "$SCRIPT_DIR/lib-net.sh"   # provides METAL_INTERNAL_CIDR (single source of truth)
@@ -52,8 +52,17 @@
   MAPV="${CONSUMER_MAP[$APP]:-}"
   if [ -z "$MAPV" ]; then warn "$APP: no conf mapping -- COVERAGE GAP, update CONSUMER_MAP"; continue; fi
   PUNIT="${MAPV%%:*}"; CPATH="${MAPV#*:}"
+  # Capture-then-test (DOCFIX-116): the old extract-then-check pipeline merged
+  # stderr and misreported a juju failure as "no vault_url" (C2 FAIL). A juju
+  # failure is a HOLD (cannot verify), never a verdict on the relation data.
+  SUERR=$(mktemp)
+  if ! SUOUT=$(juju show-unit "$APP/0" -m "$M" --format yaml 2>"$SUERR"); then
+    warn "$APP: juju show-unit failed -- relation data UNVERIFIED (not a C2 verdict): $(head -1 "$SUERR")"
+    rm -f "$SUERR"; continue
+  fi
+  rm -f "$SUERR"
   # URL class is IPv4-only (v1); extend for bracketed IPv6 at v2
-  RURL=$(juju show-unit "$APP/0" -m "$M" --format yaml 2>&1 | grep -E 'vault_url' | head -1 | grep -oE 'https?://[0-9A-Za-z.:]+' || true)
+  RURL=$(printf '%s\n' "$SUOUT" | grep -E 'vault_url' | head -1 | grep -oE 'https?://[0-9A-Za-z.:]+' || true)
   echo "  relation vault_url: ${RURL:-<none>}"
   RHOST=${RURL#*//}; RHOST=${RHOST%%:*}
   if [ -z "$RURL" ]; then fail "$APP: no vault_url in relation data"
diff --git a/scripts/vault-kv-inner-probe.sh b/scripts/vault-kv-inner-probe.sh
index 9e297e7..859cd74 100644
--- a/scripts/vault-kv-inner-probe.sh
+++ b/scripts/vault-kv-inner-probe.sh
@@ -4,7 +4,7 @@
 # AppRole login from the unit's authentic source. Secrets never printed: values read into
 # vars; login response body deleted unread on 200 (it carries a client token); .errors only
 # on non-200. Side effect: one real 60s-TTL Vault token per run (charm sets token_ttl=60s).
-set -u
+set -u   # deliberately NOT pipefail: delivered as a piped paste block (base64 -d | sudo bash -s) -- documented exemption
 umask 077
 CONF="${1:-}"
 [ -n "$CONF" ] && [ -r "$CONF" ] || { echo "PROBE-FAIL: conf unreadable: ${CONF:-<unset>}"; exit 1; }
diff --git a/tests/checks/run-tests.sh b/tests/checks/run-tests.sh
index c66d461..4fe5813 100644
--- a/tests/checks/run-tests.sh
+++ b/tests/checks/run-tests.sh
@@ -2,7 +2,7 @@
 # tests/checks/run-tests.sh -- unit tests for scripts/checks/d011-*.sh (grows per batch).
 # Batch 1: d011-01-charms (mock juju), d011-06-vault-unseal (mock ledger).
 # Also an INTEGRATION assertion: run both via the real orchestrator against mocks.
-set -u
+set -uo pipefail
 SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; REPO="$(cd "$SD/../.." && pwd)"
 CHK="$REPO/scripts/checks"; VAL="$REPO/scripts/validate.sh"
 P=0; F=0; ok(){ echo "PASS: $1"; P=$((P+1)); }; no(){ echo "FAIL: $1"; F=$((F+1)); }
diff --git a/tests/claude-guard/run-tests.sh b/tests/claude-guard/run-tests.sh
index 31f8bcf..70b3ff8 100644
--- a/tests/claude-guard/run-tests.sh
+++ b/tests/claude-guard/run-tests.sh
@@ -23,10 +23,24 @@
 run 2 "secret read blocked (vault-init)"       "$(cmd 'cat ~/vault-init/unseal-keys.txt')"
 run 2 "secret read blocked (appcred)"          "$(cmd 'head -1 /home/j/tenant-acme/acme-svc-appcred.txt')"
 run 2 "catastrophic rm blocked"                "$(cmd 'rm -rf /')"
+# extended reader set: text tools + python3/openssl on secret paths
+run 2 "grep on tenant cred blocked"            "$(cmd 'grep password= /home/j/tenant-acme/acme-svc-cred.txt')"
+run 2 "awk on tenant cred blocked"             "$(cmd "awk -F= '/^password=/{print \$2}' \$HOME/tenant-acme/acme-svc-cred.txt")"
+run 2 "sed on vault-init blocked"              "$(cmd 'sed -n 1p ~/vault-init/unseal-keys.txt')"
+run 2 "openssl on tenant key .pem blocked"     "$(cmd 'openssl rsa -in ~/tenant-acme/acme-key.pem -check')"
+run 2 "python3 on as-executed blocked"         "$(cmd "python3 -c \\\"print(open('/home/j/as-executed/log.txt').read())\\\"")"
+run 2 "cat on bare .pem blocked"               "$(cmd 'cat ./testco-key.pem')"
+run 2 "tail on home tenant dir blocked"        "$(cmd 'tail -5 /home/jessea123/tenant-acme/notes.txt')"
 run 0 "juju status passes"                     "$(cmd 'juju status -m openstack --format=json')"
 run 0 "cloud-assert passes"                    "$(cmd 'bash scripts/cloud-assert.sh')"
 run 0 "vault status (non-one-shot) passes"     "$(cmd 'juju ssh vault/0 -- vault status')"
 run 0 "maas admin read passes (not maas list)" "$(cmd 'maas admin machines read')"
+# precision: quoted PROSE mentions and non-secret files stay allowed
+run 0 "grep for quoted .pem string passes"     "$(cmd 'grep -rn \"vault-ca-root.pem\" scripts/')"
+run 0 "awk on non-secret file passes"          "$(cmd "awk '{print \$1}' /tmp/inventory.txt")"
+run 0 "cat on repo tests/tenant-* dir passes"  "$(cmd 'cat tests/tenant-offboard/run-tests.sh')"
+run 0 "grep in repo tenant script passes"      "$(cmd 'grep -n auth_url scripts/tenant-onboard.sh')"
+run 0 "openssl on non-pem cert passes"         "$(cmd 'openssl x509 -in /tmp/test-ca.crt -noout -dates')"
 run 0 "malformed input -> no opinion (rc 0)"   'not-json-at-all'
 
 echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
diff --git a/tests/d063-apply/run-tests.sh b/tests/d063-apply/run-tests.sh
index 1254fca..a163c39 100644
--- a/tests/d063-apply/run-tests.sh
+++ b/tests/d063-apply/run-tests.sh
@@ -3,7 +3,7 @@
 # Branches: audit=0 (zero mutations) | apply-happy=0 (adds strictly BEFORE removes; 2-unit
 # derivation) | duplicate-add=0 | confirm-mismatch=24 | derive-fail=21 (zero mutations) |
 # readback-miss=27 (zero removes) | missing-sg=20
-set -u
+set -uo pipefail
 SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; SCRIPT="$SD/../../scripts/d063-apply.sh"
 W=$(mktemp -d); trap 'rm -rf "$W"' EXIT
 mkdir -p "$W/bin"; touch "$W/admin-openrc"
diff --git a/tests/juju-spaces-check/run-tests.sh b/tests/juju-spaces-check/run-tests.sh
new file mode 100644
index 0000000..1e82599
--- /dev/null
+++ b/tests/juju-spaces-check/run-tests.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# tests/juju-spaces-check/run-tests.sh -- mock harness for scripts/juju-spaces-check.sh
+# Covers the model gate (DOCFIX-115 capture-then-test fix): model present -> spaces
+# asserted (0); model absent -> exit 2 "not present"; 'juju models' FAILS (expired
+# macaroon) -> exit 1 with the macaroon hint, NEVER misreported as "model not
+# present" (the pre-fix live pipe masked auth failure as absence). Plus: missing
+# space -> exit 1; stale space present -> exit 1. Requires jq (real; skips if absent).
+# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
+set -uo pipefail
+SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; SCRIPT="$SD/../../scripts/juju-spaces-check.sh"
+command -v jq >/dev/null || { echo "SKIP: jq absent"; exit 0; }
+W=$(mktemp -d); trap 'rm -rf "$W"' EXIT
+mkdir -p "$W/bin"
+cat > "$W/bin/juju" <<'JM'
+#!/usr/bin/env bash
+S="${MOCK_SCEN:-present}"
+case "$*" in
+  "whoami") echo "Controller: maas-controller"; echo "User: admin";;
+  "models")
+    if [ "$S" = authfail ]; then echo "ERROR cannot list models: macaroon discharge required" >&2; exit 1; fi
+    echo "Model  Cloud  Status"; echo "controller  maas  available";;
+  "models --format json")
+    if [ "$S" = authfail ]; then echo "ERROR cannot list models: macaroon discharge required" >&2; exit 1; fi
+    if [ "$S" = absent ]; then echo '{"models":[{"name":"admin/controller"}]}'
+    else echo '{"models":[{"name":"admin/controller"},{"name":"admin/openstack"}]}'; fi;;
+  "spaces -m openstack --format json")
+    case "$S" in
+      missingspace) echo '{"spaces":[{"name":"provider-public"},{"name":"metal-admin"},{"name":"metal-internal"},{"name":"data-tenant"},{"name":"storage"}]}';;
+      stalespace)   echo '{"spaces":[{"name":"provider-public"},{"name":"metal-admin"},{"name":"metal-internal"},{"name":"data-tenant"},{"name":"storage"},{"name":"replication"},{"name":"lbaas"}]}';;
+      *)            echo '{"spaces":[{"name":"provider-public"},{"name":"metal-admin"},{"name":"metal-internal"},{"name":"data-tenant"},{"name":"storage"},{"name":"replication"}]}';;
+    esac;;
+  *) echo "fake-juju: unmatched: $*" >&2; exit 1;;
+esac
+JM
+chmod +x "$W/bin/juju"
+P=0; F=0
+runcase(){ # runcase <scen> <want_rc> <want_regex> <mustnot_regex|-> <label>
+  local OUT RC
+  OUT=$(MOCK_SCEN="$1" PATH="$W/bin:$PATH" bash "$SCRIPT" 2>&1); RC=$?
+  if [ "$RC" = "$2" ] && grep -qE "$3" <<<"$OUT" && { [ "$4" = "-" ] || ! grep -qE "$4" <<<"$OUT"; }; then
+    echo "  PASS  $5"; P=$((P+1))
+  else echo "  FAIL  $5 (rc=$RC want=$2)"; echo "$OUT" | tail -4 | sed 's/^/        /'; F=$((F+1)); fi
+}
+runcase present      0 'Summary: 0 fatal'                        'FAIL:' "model present, six spaces, none stale -> 0"
+runcase absent       2 "model 'openstack' not present yet"       '-'     "model absent -> 2 with add-model hint"
+# the DOCFIX-115 regression: an auth failure must take the macaroon-hint path,
+# never be classified as "model not present"
+runcase authfail     1 'juju models failed \(auth/macaroon'      'not present yet' "juju models failure -> 1 + macaroon hint (not 'absent')"
+runcase missingspace 1 'MISSING: replication'                    '-'     "missing space -> 1"
+runcase stalespace   1 'STALE STILL PRESENT: lbaas'              '-'     "stale space -> 1"
+echo; T=$((P+F)); [ "$F" = 0 ] && { echo "ALL PASS ($P/$T)"; exit 0; } || { echo "FAILURES: $F ($P/$T)"; exit 1; }
diff --git a/tests/ledger-scan/run-tests.sh b/tests/ledger-scan/run-tests.sh
index a9c7c2c..ec45d01 100644
--- a/tests/ledger-scan/run-tests.sh
+++ b/tests/ledger-scan/run-tests.sh
@@ -2,7 +2,7 @@
 # tests/ledger-scan/run-tests.sh -- ledger-scan.sh against fixture docs.
 # Verifies: PROPOSED/OPEN decisions surfaced (ADOPTED not), OPEN security rows
 # surfaced (CLOSED not), next-free computed from highest, missing-ledger notice.
-set -u
+set -uo pipefail
 SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; SCRIPT="$SD/../../scripts/ledger-scan.sh"
 P=0; F=0; ok(){ echo "PASS: $1"; P=$((P+1)); }; no(){ echo "FAIL: $1"; F=$((F+1)); }
 W="$(mktemp -d)"; trap 'rm -rf "$W"' EXIT; mkdir -p "$W/docs" "$W/runbooks"
diff --git a/tests/lib-validate/run-tests.sh b/tests/lib-validate/run-tests.sh
index a752041..d783cc1 100644
--- a/tests/lib-validate/run-tests.sh
+++ b/tests/lib-validate/run-tests.sh
@@ -3,7 +3,7 @@
 # Exercises: exit-contract constants, emit() line format + timing, vr_json
 # stdout/stderr separation (the DOCFIX-085 invariant), run() capture-then-test,
 # env scrub/scope (incl. missing-field HOLD), validators, disruptive gate.
-set -u
+set -uo pipefail
 SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; LIB="$SD/../../scripts/lib-validate.sh"
 P=0; F=0
 ok(){ echo "PASS: $1"; P=$((P+1)); }
diff --git a/tests/tenant-offboard/run-tests.sh b/tests/tenant-offboard/run-tests.sh
index e964aa6..455bfc1 100644
--- a/tests/tenant-offboard/run-tests.sh
+++ b/tests/tenant-offboard/run-tests.sh
@@ -9,18 +9,30 @@
 #            + cluster-show 404 is NOT an orphan), confirmation-mismatch=24 with zero
 #            mutations, gated apply deletes ONLY the proven orphan (+its trust), and an
 #            idempotent re-run is a clean no-op (rc 0). Requires no cloud access.
-set -u
+set -uo pipefail
 SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; SCRIPT="$SD/../../scripts/tenant-offboard.sh"
 W=$(mktemp -d); trap 'rm -rf "$W"' EXIT
 mkdir -p "$W/bin" "$W/vault-init"; touch "$W/admin-openrc" "$W/vault-init/vault-ca-root.pem"
-printf 'username=acme-svc\nproject_id=%s\npassword=pw\n' "$(python3 -c "print('a'*32)")" > "$W/acme-svc-cred.txt"
+printf 'username=acme-svc\nproject_id=%s\npassword=pw\nauth_url=https://10.77.77.77:5000/v3\n' "$(python3 -c "print('a'*32)")" > "$W/acme-svc-cred.txt"
 printf '#!/usr/bin/env bash\nexit 0\n' > "$W/bin/sleep"
 cat > "$W/bin/openstack" <<'OSMOCK'
 #!/usr/bin/env bash
 S="${MOCK_SCEN:-happy}"; ST="${MOCK_STATE:-/home/claude/mock6/state}"; mkdir -p "$ST"
 mut(){ echo "$*" >> "$ST/mutations"; }
+# R10 observability: record the auth URL every tenant-scoped (coe) call runs under
+case "$*" in "coe cluster"*) echo "${OS_AUTH_URL:-unset}" >> "$ST/authurl";; esac
+# warnstderr scenario: truthful CLI -- list commands emit a deprecation-style
+# notice ON STDERR (exercises the stdout-only inventory captures). coe excluded:
+# the Phase A cluster capture still merges stderr (known, out of this batch).
+if [ "$S" = warnstderr ]; then case "$*" in "coe "*) : ;; *" list"*) echo "WARNING: a deprecated-option notice (fake, stderr)" >&2 ;; esac; fi
 DOM=$(python3 -c "print('d'*32)"); U1=$(python3 -c "print('1'*32)"); U2=$(python3 -c "print('2'*32)")
 P1=$(python3 -c "print('a'*32)")
+# neutron/octavia/nova resources are dashed-uuid shaped (truthful to the real CLI)
+LBU="aaaa1111-1111-4111-8111-111111111111"
+FIPU="bbbb2222-2222-4222-8222-222222222222"
+RTU="cccc3333-3333-4333-8333-333333333333"
+SNU="dddd4444-4444-4444-8444-444444444444"
+NWU="eeee5555-5555-4555-8555-555555555555"
 # sweep-mode fixtures: magnum trustee domain population
 MDOM=$(python3 -c "print('e'*32)"); MADM=$(python3 -c "print('9'*32)")
 UO=$(python3 -c "print('4'*32)"); UP=$(python3 -c "print('5'*32)")
@@ -71,20 +83,30 @@
     else printf '[{"ID":"tr1","Trustor User ID":"%s","Trustee User ID":"tee"}]\n' "$U1"; fi;;
   "trust show tr1"*) [ -f "$ST/tdel" ] && exit 1; echo "tr1";;
   "trust delete str1"*) mut "$*"; touch "$ST/strdel";;
-  "trust delete"*) mut "$*"; touch "$ST/tdel";;
+  "trust delete"*)
+    if [ "$S" = trustdelfail ]; then echo "Unable to delete trust (HTTP 500)"; exit 1; fi
+    mut "$*"; touch "$ST/tdel";;
   "application credential list --user $U1"*) python3 -c "print('c'*32)";;
   "application credential list --user"*) : ;;
-  "loadbalancer list"*) [ -f "$ST/lbdel" ] || echo "lb1 old-lb ERROR";;
+  "loadbalancer list --project "*"-c provisioning_status") [ -f "$ST/lbdel" ] || echo "$LBU old-lb ERROR";;
+  "loadbalancer list --project "*"-c id")
+    if [ "$S" = lbstuck ]; then echo "$LBU"; else [ -f "$ST/lbdel" ] || echo "$LBU"; fi;;
   "loadbalancer delete"*) mut "$*"; touch "$ST/lbdel";;
-  "floating ip list"*) [ -f "$ST/fipdel" ] || echo "f1 10.12.5.99";;
+  "floating ip list --project "*"Floating IP Address") [ -f "$ST/fipdel" ] || echo "$FIPU 10.12.5.99";;
+  "floating ip list --project "*"-c ID") [ -f "$ST/fipdel" ] || echo "$FIPU";;
   "floating ip delete"*) mut "$*"; touch "$ST/fipdel";;
   "server list"*) : ;;
-  "router list"*) [ -f "$ST/rdel" ] || echo "r1 acme-router";;
+  "router list --project "*"-c Name") [ -f "$ST/rdel" ] || echo "$RTU acme-router";;
+  "router list --project "*"-c ID") [ -f "$ST/rdel" ] || echo "$RTU";;
   "router remove subnet"*|"router unset"*) mut "$*";;
   "router delete"*) mut "$*"; touch "$ST/rdel";;
-  "subnet list"*) [ -f "$ST/sndel" ] || echo "sn1 acme-subnet";;
+  "subnet list --project "*"-c Name") [ -f "$ST/sndel" ] || echo "$SNU acme-subnet";;
+  "subnet list --project "*"-c ID") [ -f "$ST/sndel" ] || echo "$SNU";;
   "subnet delete"*) mut "$*"; touch "$ST/sndel";;
-  "network list"*) [ -f "$ST/nwdel" ] || echo "nw1 acme-net";;
+  "network list --project "*"-c Name") [ -f "$ST/nwdel" ] || echo "$NWU acme-net";;
+  "network list --project "*"-c ID")
+    if [ "$S" = garbagerow ]; then echo "please retry later"
+    else [ -f "$ST/nwdel" ] || echo "$NWU"; fi;;
   "network delete"*)
     if [ "${MOCK_SCEN:-}" = sweepfail ]; then echo "Conflict: one or more ports still in use (HTTP 409)"; exit 1; fi
     mut "$*"; touch "$ST/nwdel";;
@@ -124,6 +146,18 @@
 rm -rf "$W/state"; HOME="$W" PATH="$W/bin:$PATH" bash "$SCRIPT" acme --audit >/dev/null 2>&1; RC=$?
 MUT=$(cat "$W/state/mutations" 2>/dev/null | wc -l)
 if [ "$RC" = 0 ] && [ "$MUT" = 0 ]; then echo "PASS: audit (exit 0, 0 mutations)"; P=$((P+1)); else echo "FAIL: audit (exit $RC, mutations $MUT)"; F=$((F+1)); fi
+# R10: tenant_env must take OS_AUTH_URL from the cred file's auth_url= line
+if grep -q 'https://10.77.77.77:5000/v3' "$W/state/authurl" 2>/dev/null; then
+  echo "PASS: auth-url-from-cred (tenant calls used cred auth_url)"; P=$((P+1))
+else echo "FAIL: auth-url-from-cred (authurl: $(cat "$W/state/authurl" 2>/dev/null | sort -u | tr '\n' ';'))"; F=$((F+1)); fi
+# R10 fallback: cred without auth_url= -> KEYSTONE_VIP-derived URL
+W2=$(mktemp -d); mkdir -p "$W2/vault-init"; touch "$W2/admin-openrc" "$W2/vault-init/vault-ca-root.pem"
+printf 'username=acme-svc\nproject_id=%s\npassword=pw\n' "$(python3 -c "print('a'*32)")" > "$W2/acme-svc-cred.txt"
+rm -rf "$W/state"; HOME="$W2" KEYSTONE_VIP=10.55.55.55 PATH="$W/bin:$PATH" bash "$SCRIPT" acme --audit >/dev/null 2>&1; RC=$?
+if [ "$RC" = 0 ] && grep -q 'https://10.55.55.55:5000/v3' "$W/state/authurl" 2>/dev/null; then
+  echo "PASS: auth-url-fallback (KEYSTONE_VIP override honored)"; P=$((P+1))
+else echo "FAIL: auth-url-fallback (exit $RC, authurl: $(cat "$W/state/authurl" 2>/dev/null | sort -u | tr '\n' ';'))"; F=$((F+1)); fi
+rm -rf "$W2"
 rm -rf "$W/state"; HOME="$W" PATH="$W/bin:$PATH" python3 "$W/ptyrun.py" bash "$SCRIPT" acme --apply WRONG >/dev/null 2>&1; chk tty-mismatch $? 24
 rm -rf "$W/state"; HOME="$W" PATH="$W/bin:$PATH" python3 "$W/ptyrun.py" bash "$SCRIPT" acme --apply acme > "$W/happy.out" 2>&1; chk apply-happy $? 0
 # DOCFIX-100 Phase E0: apply must EXPLICITLY inventory the app cred it removes via cascade
@@ -144,6 +178,30 @@
 if [ "$RC" = 0 ] && grep -q "app-cred stage: no users remain in domain -- SKIP (idempotent re-run)" "$W/e0.out"; then
   echo "PASS: e0-skip-idempotent (exit 0, SKIP line)"; P=$((P+1))
 else echo "FAIL: e0-skip-idempotent (exit $RC; want 0 + SKIP line)"; F=$((F+1)); fi
+# ---- stderr-separation + row-validation hardening ----
+# stderr warnings on list commands must be SURFACED as NOTEs, never become
+# delete argv (pre-fix: merged 2>&1 word-split "WARNING: ..." into the loops).
+rm -rf "$W/state"; HOME="$W" MOCK_SCEN=warnstderr PATH="$W/bin:$PATH" python3 "$W/ptyrun.py" bash "$SCRIPT" acme --apply acme > "$W/warn.out" 2>&1; RC=$?
+if [ "$RC" = 0 ] && ! grep -qiE 'delete.*(WARNING|deprecated)' "$W/state/mutations" 2>/dev/null \
+   && grep -q 'NOTE: .*stderr: WARNING' "$W/warn.out"; then
+  echo "PASS: stderr-not-argv (exit 0, warnings surfaced as NOTE, none deleted)"; P=$((P+1))
+else echo "FAIL: stderr-not-argv (exit $RC; muts: $(grep -icE 'WARNING|deprecated' "$W/state/mutations" 2>/dev/null))"; F=$((F+1)); fi
+# a non-id stdout row (API error prose) must be SKIPped and counted -> exit 22
+rm -rf "$W/state"; HOME="$W" MOCK_SCEN=garbagerow PATH="$W/bin:$PATH" python3 "$W/ptyrun.py" bash "$SCRIPT" acme --apply acme > "$W/garb.out" 2>&1; RC=$?
+if [ "$RC" = 22 ] && grep -q 'SKIP non-id network row' "$W/garb.out" && ! grep -q 'network delete please' "$W/state/mutations" 2>/dev/null; then
+  echo "PASS: non-id-row-skipped (exit 22, row never deleted)"; P=$((P+1))
+else echo "FAIL: non-id-row-skipped (exit $RC)"; F=$((F+1)); fi
+# LB wait-budget exhaustion must FAIL the phase loudly (exit 22), not fall through silently
+rm -rf "$W/state"; HOME="$W" MOCK_SCEN=lbstuck PATH="$W/bin:$PATH" python3 "$W/ptyrun.py" bash "$SCRIPT" acme --apply acme > "$W/lbstuck.out" 2>&1; RC=$?
+if [ "$RC" = 22 ] && grep -q 'LBs not confirmed gone in budget' "$W/lbstuck.out"; then
+  echo "PASS: lb-wait-budget-fails-loud (exit 22)"; P=$((P+1))
+else echo "FAIL: lb-wait-budget-fails-loud (exit $RC)"; F=$((F+1)); fi
+# Phase B counter: a failed residual-trust delete must surface as exit 22
+# (pre-fix: the printf|while subshell ate the SWEEP_FAIL increment -> exit 0)
+rm -rf "$W/state"; HOME="$W" MOCK_SCEN=trustdelfail PATH="$W/bin:$PATH" python3 "$W/ptyrun.py" bash "$SCRIPT" acme --apply acme > "$W/tdf.out" 2>&1; RC=$?
+if [ "$RC" = 22 ] && grep -q '\^ FAILED: openstack trust delete' "$W/tdf.out"; then
+  echo "PASS: phaseB-counter-survives (exit 22, failed trust delete counted)"; P=$((P+1))
+else echo "FAIL: phaseB-counter-survives (exit $RC, want 22)"; F=$((F+1)); fi
 # ---- DOCFIX-099 --sweep-magnum-orphans ----
 # audit: read-only classification -- exactly 1 ORPHAN, 2 PROTECTED (domain admin +
 # alive cluster), 3 UNPROVEN (ambiguous project, alive-project/404-cluster, odd name);
diff --git a/tests/tenant-onboard/run-tests.sh b/tests/tenant-onboard/run-tests.sh
index aa56a26..6abafda 100644
--- a/tests/tenant-onboard/run-tests.sh
+++ b/tests/tenant-onboard/run-tests.sh
@@ -24,11 +24,24 @@
 DOMID="d0000000000000000000000000000001"
 PID="b0000000000000000000000000000001"
 ACID="e0000000000000000000000000000001"
+CLUID="c0000000000000000000000000000002"
+SVCID="c0000000000000000000000000000003"
 
 cat > "$BIN/openstack" <<FB
 #!/usr/bin/env bash
 case "\$*" in
   *"subnet list"*)                                          cat "\$FIXDIR/subnets.txt" ;;
+  "token issue -f value -c domain_id")                      echo "$DOMID" ;;
+  "project create --domain $DOMID"*)                        : ;;
+  "project show testco-prod --domain $DOMID -f value -c id") echo "$PID" ;;
+  "user create --domain $DOMID"*)                           : ;;
+  "user show testco-cluster --domain $DOMID -f value -c id") echo "$CLUID" ;;
+  "user show testco-svc --domain $DOMID -f value -c id")    echo "$SVCID" ;;
+  "role add --project $PID"*)                               : ;;
+  "role assignment list --project $PID --user $SVCID --names -f value -c Role")
+      RARC=\$(cat "\$FIXDIR/roleassign-rc" 2>/dev/null || echo 0)
+      if [ "\$RARC" != 0 ]; then echo "An unexpected error prevented the server from fulfilling your request. (HTTP 500)" >&2; exit "\$RARC"; fi
+      cat "\$FIXDIR/roleassign.txt" ;;
   "subnet show capi-mgmt-subnet -f value -c cidr")          cat "\$FIXDIR/capi-cidr.txt" ;;
   "domain show testco -f value -c id")                      echo "$DOMID" ;;
   "token issue -f value -c project_id")                     echo "$PID" ;;
@@ -65,6 +78,7 @@
   local d="$h/tenant-testco"; mkdir -p "$d"; chmod 700 "$d"
   printf 'username=testco-svc\nproject_id=%s\npassword=x\n' "$PID" > "$d/testco-svc-cred.txt"
   printf 'username=testco-cluster\nproject_id=%s\npassword=x\n' "$PID" > "$d/testco-cluster-cred.txt"
+  printf 'domain=testco\ndomain_id=%s\nusername=testco-domain-admin\npassword=x\n' "$DOMID" > "$d/testco-domain-admin-cred.txt"
   if [ "$seed" = "full" ] || [ "$seed" = "nokey" ]; then
     printf 'id="%s"\nsecret="fake-secret-value"\n' "$ACID" > "$d/testco-svc-appcred.txt"
   fi
@@ -146,6 +160,24 @@
 run_stage "$TMP/h5" "$TMP/fx5" stage3
 check 1 'OPERATOR DECISION required \(breaks existing node access\)' '-' "T5 lost-private-key re-run STOPs with guidance"
 
+# ---- stage2 anti-escalation guard (capture-then-test; was a raced live pipe) ----
+# T8a happy: no admin row -> anti-escalation OK, stage2 completes rc0
+mk_case_home "$TMP/h8a" full; mkdir -p "$TMP/fx8a"
+printf 'member\nload-balancer_member\n' > "$TMP/fx8a/roleassign.txt"
+run_stage "$TMP/h8a" "$TMP/fx8a" stage2
+check 0 'anti-escalation OK \(admin grant denied\)' '\*\*\* ESCALATION' "T8a stage2 happy: anti-escalation OK"
+# T8b admin row present -> ESCALATION-STOP rc1 (pre-fix: SIGPIPE on the match
+# could kill the pipe and print OK -- the guard failed OPEN)
+mk_case_home "$TMP/h8b" full; mkdir -p "$TMP/fx8b"
+printf 'admin\nmember\nload-balancer_member\n' > "$TMP/fx8b/roleassign.txt"
+run_stage "$TMP/h8b" "$TMP/fx8b" stage2
+check 1 '\*\*\* ESCALATION: manager granted admin -- STOP \*\*\*' 'anti-escalation OK' "T8b admin row triggers ESCALATION-STOP"
+# T8c role-assignment list FAILS -> guard fails CLOSED (never prints OK)
+mk_case_home "$TMP/h8c" full; mkdir -p "$TMP/fx8c"
+printf 'member\n' > "$TMP/fx8c/roleassign.txt"; echo 1 > "$TMP/fx8c/roleassign-rc"
+run_stage "$TMP/h8c" "$TMP/fx8c" stage2
+check 1 'anti-escalation check UNVERIFIABLE .*HTTP 500' 'anti-escalation OK|\*\*\* ESCALATION: manager granted' "T8c failed list fails CLOSED, no OK"
+
 # ---- stage7 H3 canary ----
 mk_fix7(){ local d="$1"; mkdir -p "$d"
   printf '[{"Name":"fedora-coreos-kube-1.28","ID":"11111111-2222-3333-4444-555555555555"}]\n' > "$d/images.json"
diff --git a/tests/validate/run-tests.sh b/tests/validate/run-tests.sh
index 059a117..7c9a0b9 100644
--- a/tests/validate/run-tests.sh
+++ b/tests/validate/run-tests.sh
@@ -4,7 +4,7 @@
 # full contract (PASS/FAIL/HOLD/MANUAL/SKIP), worst-wins precedence
 # (FAIL>HOLD>MANUAL>PASS), --stop-on-fail, --include-disruptive pass-through,
 # missing-check -> HOLD, and a check that emits NO RESULT line (rc trusted).
-set -u
+set -uo pipefail
 SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; VAL="$SD/../../scripts/validate.sh"
 P=0; F=0; ok(){ echo "PASS: $1"; P=$((P+1)); }; no(){ echo "FAIL: $1"; F=$((F+1)); }
 chk(){ [ "$2" = "$3" ] && ok "$1" || no "$1 (got '$2' want '$3')"; }
@@ -84,6 +84,14 @@
 # 12. unknown profile -> HOLD(2)
 OUT="$(run_val --profile nope 2>&1)"; chk "unknown-profile" "$?" 2
 
+# 12b. NON-CONTRACT exit (127 tool-missing / 141 SIGPIPE class) -> OVERALL HOLD(2)
+#      with the (nonstd) annotation VISIBLE in the report (pre-fix: counted n_hold
+#      but note_worst matched nothing -> OVERALL PASS 0; annotation was dead code).
+mkcheck crash 127 no
+OUT="$(run_val --checks a,crash)"; chk "nonstd-exit overall HOLD" "$?" 2
+grep -q '127(nonstd)' <<<"$OUT" && ok "nonstd annotation in report" || no "nonstd annotation in report"
+grep -q 'HOLD=1' <<<"$OUT" && ok "nonstd counted as hold" || no "nonstd counted as hold"
+
 # 13. --list exits 0 and shows profiles
 OUT="$(run_val --list)"; chk "list rc" "$?" 0
 grep -q 'full-d011' <<<"$OUT" && ok "list shows profile" || no "list shows profile"
diff --git a/tests/vault-kv-health/run-tests.sh b/tests/vault-kv-health/run-tests.sh
index 963325d..583617e 100644
--- a/tests/vault-kv-health/run-tests.sh
+++ b/tests/vault-kv-health/run-tests.sh
@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # tests/vault-kv-health/run-tests.sh -- mock harness for scripts/vault-kv-health.sh
 # Scenarios: happy=0, sealed=1, binding-drift=1 (D-067 clobber), plane-wrong=1,
-#            conf-mismatch=1, login-403=1, unknown-consumer=2 (coverage gap).
-set -u
+#            conf-mismatch=1, login-403=1, unknown-consumer=2 (coverage gap),
+#            show-unit-fails=2 (juju failure is a HOLD/warn, never a C2 FAIL).
+set -uo pipefail
 SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 W=$(mktemp -d); trap 'rm -rf "$W"' EXIT
 mkdir -p "$W/bin" "$W/scripts"
@@ -20,6 +21,7 @@
     if [ "$S" = unknowncons ]; then R='[{"related-application":"barbican-vault"},{"related-application":"mystery-vault"}]'; else R='[{"related-application":"barbican-vault"}]'; fi
     printf '{"applications":{"vault":{"relations":{"secrets":%s}}}}\n' "$R";;
   *"show-unit barbican-vault/0"*)
+    if [ "$S" = showunitfail ]; then echo "ERROR cannot get unit barbican-vault/0: macaroon discharge required" >&2; exit 1; fi
     if [ "$S" = planewrong ]; then echo "          vault_url: '\"http://10.12.8.190:8200\"'"; else echo "          vault_url: '\"http://10.12.12.117:8200\"'"; fi;;
   *"ssh"*barbican/0*)
     cat >/dev/null
@@ -30,11 +32,16 @@
 JMOCK
 chmod +x "$W/bin/juju"
 P=0; F=0
-for t in happy:0 sealed:1 binddrift:1 planewrong:1 confmismatch:1 login403:1 unknowncons:2; do
+for t in happy:0 sealed:1 binddrift:1 planewrong:1 confmismatch:1 login403:1 unknowncons:2 showunitfail:2; do
   s="${t%%:*}"; e="${t##*:}"
   MOCK_SCEN="$s" PATH="$W/bin:$PATH" bash "$W/scripts/vault-kv-health.sh" >/dev/null 2>&1; RC=$?
   if [ "$RC" = "$e" ]; then echo "PASS: $s (exit $RC)"; P=$((P+1)); else echo "FAIL: $s (exit $RC, want $e)"; F=$((F+1)); fi
 done
+# juju-fails path detail: must WARN "UNVERIFIED", never emit the C2 no-vault_url FAIL
+SUOUT=$(MOCK_SCEN=showunitfail PATH="$W/bin:$PATH" bash "$W/scripts/vault-kv-health.sh" 2>&1 || true)
+if grep -q 'relation data UNVERIFIED' <<<"$SUOUT" && ! grep -q 'no vault_url in relation data' <<<"$SUOUT"; then
+  echo "PASS: showunitfail-warns-not-fails (UNVERIFIED warn, no C2 FAIL)"; P=$((P+1))
+else echo "FAIL: showunitfail-warns-not-fails"; F=$((F+1)); fi
 # DOCFIX-083 argv hygiene: the probe's curl invocation must read the body from stdin
 # (--data @-) and must not carry the secret-bearing var or -d on its argv.
 LOGIN_LINE=$(grep 'HTTP=' "$W/scripts/vault-kv-inner-probe.sh" | head -1)
@@ -43,4 +50,4 @@
    && ! grep -qE 'BODY|[[:space:]]-d[[:space:]]' <<<"$CURLPART"; then
   echo "PASS: argv-hygiene (curl reads body from stdin, no secret var on argv)"; P=$((P+1))
 else echo "FAIL: argv-hygiene (curl part: $CURLPART)"; F=$((F+1)); fi
-echo; [ "$F" = 0 ] && { echo "ALL PASS ($P/8)"; exit 0; } || { echo "FAILURES: $F"; exit 1; }
+echo; T=$((P+F)); [ "$F" = 0 ] && { echo "ALL PASS ($P/$T)"; exit 0; } || { echo "FAILURES: $F ($P/$T)"; exit 1; }