diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 500d62e..69df189 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -31,8 +31,8 @@
 - **OPEN security rows:** SEC-001 (rotate at v1 close, re-ruled 2026-07-06),
   SEC-003 (custodians + second-person unseal -- DEFERRED; keeps d011-06 MANUAL),
   SEC-004 (flip repo to private at v1 close -- deferral reaffirmed).
-- **Next-free numbers:** D = 075, DOCFIX = 111, BUNDLEFIX = 012.
-  (Scan and the addendum-31 changelog next-free pointer agree.)
+- **Next-free numbers:** D = 075, DOCFIX = 112, BUNDLEFIX = 012.
+  (Scan and the addendum-32 changelog next-free pointer agree.)
 
 ---
 
diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md
index 2f60c5c..a9d1846 100644
--- a/docs/v1-redeploy-changelog.md
+++ b/docs/v1-redeploy-changelog.md
@@ -2582,3 +2582,30 @@
   bash scripts/repo-lint.sh --record-clientdocs-sweep.
 
 Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-111, BUNDLEFIX-012.
+
+### 2026-07-07 (addendum 32, jumphost stream) -- DOCFIX-111 lint excludes .claude/; orphan-sweep first live audit
+
+- **DOCFIX-111 -- repo_lint all_text() excludes .claude/.** Session-local
+  agent worktrees are full repo copies whose docs/design-decisions.md
+  mirrors trip the L1 legacy carve-out (it keys on the exact repo-relative
+  path) -- every concurrent-agent session produced spurious L1 FAILs until
+  its worktrees were pruned (observed repeatedly 2026-07-06/07). Lint the
+  repo, not the session. Harness 22->23 (planted non-ASCII under
+  .claude/worktrees/ must NOT fail lint). REVERT: git checkout HEAD~ --
+  scripts/repo_lint.py tests/repo-lint/run-tests.sh.
+- **Orphan-trustee sweep (DOCFIX-099) FIRST LIVE AUDIT (read-only, rc 0):**
+  magnum domain resolved dynamically; 3 trustees classified: ORPHAN=0,
+  PROTECTED=3 (magnum_domain_admin service identity; beta-cluster trustee
+  alive; capi-test-1 trustee alive -- CREATE_FAILED clusters still EXIST as
+  records, so their trustees are correctly NOT orphans until the cluster
+  record is deleted). VERIFY-LIVE items cleared on the OK paths: admin-scope
+  coe cluster show succeeds for alive tenant clusters (no policy-denial
+  noise -> no spurious UNPROVEN); dynamic domain/user resolution correct.
+  HONEST GAP: the orphan-classification path (exact keystone not-found
+  proof) remains harness-proven only -- no real orphan exists to exercise
+  it live; first exercised the day a cluster record is deleted out from
+  under a trustee. capi-test-1 cleanup (coe cluster delete of the
+  CREATE_FAILED record, capi project) = operator-gated candidate; after it,
+  a re-audit would classify that trustee for reaping.
+
+Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-112, BUNDLEFIX-012.
diff --git a/scripts/repo_lint.py b/scripts/repo_lint.py
index c7fe029..cabf00c 100644
--- a/scripts/repo_lint.py
+++ b/scripts/repo_lint.py
@@ -125,7 +125,12 @@
         skip_names = {"overrides.zip"}
         out = []
         for p in R.rglob("*"):
-            if not p.is_file() or ".git" in p.parts or "__pycache__" in p.parts:
+            # .claude/ holds session-local agent worktrees (full repo copies:
+            # their design-decisions.md mirror trips the L1 carve-out, which
+            # keys on the exact repo-relative path) plus hooks config -- all
+            # non-repo-content; lint the repo, not the session (DOCFIX-111)
+            if not p.is_file() or ".git" in p.parts or "__pycache__" in p.parts \
+               or ".claude" in p.parts:
                 continue
             if p.suffix.lower() == ".zip" or p.name in skip_names:
                 continue
diff --git a/tests/repo-lint/run-tests.sh b/tests/repo-lint/run-tests.sh
index 124dd41..2e08229 100644
--- a/tests/repo-lint/run-tests.sh
+++ b/tests/repo-lint/run-tests.sh
@@ -97,6 +97,10 @@
 D=$(mkcd l7m); mkdir -p "$D/clientdocs/tenant-skill/references"
 printf '# skill ref\n' > "$D/clientdocs/tenant-skill/references/ops.md"; rec "$D"
                               run 0 'PASS: repo lint' "T22 L7 recorded subdir .md PASSES" "$D"
+# .claude/ (agent worktrees, hooks) is session-local, never linted
+D=$(mkcd l1c); rec "$D"; mkdir -p "$D/.claude/worktrees/agent-x/docs"
+printf '# em\xe2\x80\x94dash noise\n' > "$D/.claude/worktrees/agent-x/docs/design-decisions.md"
+                              run 0 'PASS: repo lint' "T23 .claude/ contents excluded from lint" "$D"
 
 echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
 [[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1