diff --git a/.gitattributes b/.gitattributes
index ffcc340..eb7a120 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -6,3 +6,6 @@
 # Shell scripts MUST be LF -- a CRLF shebang or command line breaks execution.
 *.sh text eol=lf
 *.py text eol=lf
+
+# Binary artifacts must never be EOL-normalized (DOCFIX-071 ships a committed zip).
+*.zip binary
diff --git a/.gitignore b/.gitignore
index 9400355..2709393 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
-# Local artifacts / secrets — must never be committed
+# Local artifacts / secrets -- must never be committed
 *-openrc
 *.tar.gz
 *.tar.zst
diff --git a/bundle.yaml b/bundle.yaml
index c6bd4b4..cee28e1 100644
--- a/bundle.yaml
+++ b/bundle.yaml
@@ -18,7 +18,7 @@
 #                   REMOVED -- the etcd backend was never used (live storage = mysql) and is moot at
 #                   1 unit; HA backend (Raft vs etcd) is a Roosevelt rehearsal item. (C1; revises D-006)
 # Ceph networks:    FULL separation via network-space BINDINGS -- ceph-mon/ceph-osd public->storage
-#                   (10.12.16.0/22), ceph-osd cluster->replication (10.12.20.0/22). Bindings, NOT
+#                   (10.12.32.0/22), ceph-osd cluster->replication (10.12.36.0/22). Bindings, NOT
 #                   ceph-*-network config, so the LXD-contained mon actually gets a storage NIC.
 #                   Clients bind ceph->storage; container principals carry it too (subset rule). (C2)
 # Magnum:           Layer A only -- CAPI driver graft is Layer B (runbooks/phase-06..08)
@@ -157,6 +157,12 @@
   # =====================================================================
 
   keystone:
+    # DOCFIX-071: the D-051/D-064 SCS Domain Manager policy ships WITH the deploy --
+    # a manual post-deploy attach-resource proved unreachable from the schedule.
+    # Keep policies/overrides.zip in sync with domain-manager-policy.yaml
+    # (provider-bundle-check.py enforces the content match).
+    resources:
+      policyd-override: ./policies/overrides.zip
     charm: keystone
     channel: 2024.1/stable
     num_units: 1                       # 3 on Roosevelt (D-009)
diff --git a/docs/as-executed-log-convention.md b/docs/as-executed-log-convention.md
new file mode 100644
index 0000000..e9e0cff
--- /dev/null
+++ b/docs/as-executed-log-convention.md
@@ -0,0 +1,30 @@
+# As-executed log convention (DOCFIX-076)
+
+The verbatim-retrieval rule -- "for irreversible / one-shot / secret steps,
+retrieve the exact prior working command verbatim, never improvise" (the
+DOCFIX-006 vault-init loss is the cautionary tale) -- is only as strong as the
+artifact it retrieves from. Until now "the as-executed log" was a habit with no
+defined location, format, or retention. This defines it.
+
+WHERE: jumphost, `~/as-executed/<UTC date>-<label>.log` (dir 0700, files 0600).
+NEVER in the repo: sessions are secret-adjacent (tokens print, paths leak,
+hidden-prompt secrets do NOT echo but everything around them does).
+
+HOW: start every consequential session (any RUN/CAUTION work) with
+`bash scripts/run-logged.sh <label>` -- it opens a logged subshell via
+script(1); exit to close. Labels: `phase-NN-<topic>` for deploy work,
+`ops-<topic>` for operations, `incident-<date>-<topic>` for incidents.
+
+INDEX (this IS committed): `logs/as-executed-index.md` -- one line per session:
+date, label, operator, one-phrase scope. No content, no hostnames beyond the
+jumphost, no secrets. The index is what makes a two-year-old one-shot command
+findable by a Roosevelt operator who knows only "vault was initialized around
+June 2026".
+
+RETENTION: keep indefinitely on the jumphost; include ~/as-executed in the
+jumphost backup set. A log that would age out is exactly the one the verbatim
+rule will someday need.
+
+WHAT STILL GOES IN RUNBOOKS: the PROCEDURE. Logs capture what actually ran
+(with its warts); runbooks capture what SHOULD run. When they diverge, that
+divergence is a DOCFIX.
diff --git a/docs/changelog-20260703-process-hardening.md b/docs/changelog-20260703-process-hardening.md
new file mode 100644
index 0000000..15a6782
--- /dev/null
+++ b/docs/changelog-20260703-process-hardening.md
@@ -0,0 +1,267 @@
+# Change log -- 2026-07-02/03 redeploy-readiness + process-hardening patchset
+
+CUMULATIVE: this covers BOTH work blocks (the DOCFIX-066..072 sweep patches and
+the process-improvement build). One ZIP, extract over repo root. Every item
+lists its revert. Executed under blanket approval; nothing here touched live
+infrastructure -- all changes are repo content. Validation state at packaging:
+merged-tree repo lint PASS (1 documented WARN), bundle gate PASS, four test
+harnesses 33/33 cases, all python compiles. Identifier numbering verified
+next-free at HEAD 690779a; RE-GREP at commit (per discipline).
+
+================================================================================
+## Block 1 -- redeploy-readiness fixes (DOCFIX-066..072)
+================================================================================
+
+### 1. DOCFIX-066 -- teardown runbook rebuilt around the D-061 fork
+FILE: runbooks/phase-00-teardown-maas-reset.md (REWRITE)
+WHY: old spine drove the DEPRECATED phase-00-teardown.sh ("releases to Ready"
+  -- the premise that decomposed machines 3x). New spine: destroy path as the
+  validated redeploy route (with the previously MISSING reenroll step), release
+  path documented with the honest re-acquisition caveat, all invocations
+  bash-prefixed.
+REVERT: git checkout HEAD~ -- runbooks/phase-00-teardown-maas-reset.md
+  (reverting re-arms the decompose trap; recommend not).
+
+### 2. DOCFIX-067 -- octavia PKI SAN derived, not baked
+FILE: runbooks/phase-01-bundle-deploy.md (CNF block + one prose line)
+WHY: IP.1 was the pre-R14 literal 10.12.4.233; current VIP is .57. Now derived
+  from the bundle at generation time, echoed, regex-gated. VERIFY-LIVE still
+  queued: read the DEPLOYED cert SAN before deciding whether any live action
+  is ever needed (none recommended -- regenerates next redeploy).
+REVERT: restore the literal block from git history.
+
+### 3. DOCFIX-068 -- phase-01 constants de-staled
+FILE: runbooks/phase-01-bundle-deploy.md ("Constants and env-literals")
+WHY: carried the pre-D-052 plane map (incl. retired lbaas), hardcoded MAAS
+  subnet ids (violates PATTERN-1) and system_ids (violates DOCFIX-040). Now
+  points at lib-net.sh / lib-hosts.sh; only verified-current literals remain.
+REVERT: git history (not recommended; values were wrong).
+
+### 4. DOCFIX-069 -- exec-bit reality encoded
+FILES: phase-00 runbook (folded into #1); apply-notes optional
+  `git update-index --chmod=+x scripts/*.sh`.
+WHY: all 37 scripts are mode 100644 (Windows commit path); bare invocation
+  fails on a fresh clone. bash-prefix is the durable invariant; repo-lint L6
+  now guards regressions.
+REVERT: n/a (wording only) -- to reject the rule, remove lint check L6.
+
+### 5. DOCFIX-070 -- one bundle gate instead of two disagreeing ones
+FILES: scripts/provider-bundle-check.py (checks 4-7 added);
+  scripts/review-bundle.py (git rm -- manual action, see apply notes);
+  tests/provider-bundle-check/ (NEW: 8-case harness).
+WHY: review-bundle.py was pre-D-052; FAIL=71 pure noise against HEAD (alarm
+  fatigue). Its still-valid checks (relation syntax/existence) are absorbed;
+  added: D-062 unit count, VIP-octet uniqueness, DOCFIX-071 policy wiring +
+  zip/source content drift guard.
+REVERT: git checkout the old provider-bundle-check.py; git restore
+  review-bundle.py. (Harness T-cases will then fail -- delete tests/ dir too.)
+
+### 6. DOCFIX-071 -- keystone policy ships IN the bundle
+FILES: bundle.yaml (keystone resources: stanza, +6 lines);
+  policies/overrides.zip (NEW, binary; built from committed source);
+  .gitattributes (+ *.zip binary); runbooks/phase-03-core-verify.md
+  (NEW Step 3.4: PO: gate + behavioral G3 gate);
+  runbooks/appendix-C-identity-rbac.md (attach block: subshell-wrapped,
+  /tmp -> repo path [snap trap], reframed as live-update path).
+WHY: the D-064 attach was unreachable from the schedule -- a clean redeploy
+  shipped WITHOUT the SCS Domain Manager RBAC; the only written procedure used
+  the snap-blocked /tmp form.
+REVERT: remove the 6 bundle lines + the zip; restore appendix-C block from
+  history. (Reverting re-opens the blocker; the phase-03 gate would then FAIL
+  by design -- that is the guard working.)
+
+### 7. DOCFIX-072 / D-043 -- decision brought level with the bundle
+FILE: docs/design-decisions.md (D-043 RESOLVED -> ADOPTED option (a)).
+WHY: bundle set resume-guests-state-on-host-boot=True while D-043 was still
+  PROPOSED. Adopted: auto-resume is the tenant-VM norm; D-041 unchanged for
+  control-plane. JUDGMENT CALL FLAGGED EARLIER: capi-mgmt-v2 WILL auto-resume;
+  manual-start policy now governs deliberate stops only. If you want a real
+  exclusion, that needs a mechanism -- say so and I will draft options.
+REVERT: append a reversal entry (append-only doc) + remove the bundle option.
+
+### 8. D-doc alignment amendments (appended, append-only discipline)
+FILE: docs/design-decisions.md -- D-002 (channel matrix reconciled: etcd/easyrsa
+  dead, memcached latest-only, vault 1.16 per D-068), D-009 (rabbitmq
+  min-cluster-size Roosevelt delta), D-011 (item 6 = manual unseal, matching
+  phase-08), D-051 (bundle-native delivery), D-061 (validation scope:
+  survival vs re-acquisition; destroy = validated spine).
+REVERT: each is a discrete appended section -- delete the section.
+
+================================================================================
+## Block 2 -- process improvements (DOCFIX-073..078, D-069, D-070)
+================================================================================
+
+### 9. DOCFIX-073 -- preflight.sh: THE single pre-deploy gate
+FILES: scripts/preflight.sh (NEW), scripts/channel_assert.py (NEW),
+  tests/preflight/ (NEW, 7 cases), runbooks/phase-01-bundle-deploy.md
+  (prerequisites GATE added -- pre-flight was previously invoked by NO runbook).
+WHY: gate surface was six artifacts remembered independently. Orchestrates
+  repo-lint -> bundle gate -> channel assert -> live pre-flight, worst-exit
+  aggregation, stage-2 reminders. channel_assert fulfils D-002's "verify
+  against Charmhub each deploy" claim (previously unimplemented): every pinned
+  channel must exist on Charmhub; typo/retired-track = FAIL; offline = WARN.
+REVERT: delete the three new paths + the phase-01 GATE paragraph.
+
+### 10. DOCFIX-074 -- repo-lint: the drift sweep, productized
+FILES: scripts/repo_lint.py + scripts/repo-lint.sh (NEW),
+  tests/repo-lint/ (NEW, 9 cases). Plus SANITIZE remediation of every ASCII-rule
+  violation it found: docs/v1-pre-deploy-fixes.md, docs/netbox-vip-queue.md,
+  .gitignore, netbox/README.md, netbox/ipv4-prefixes-import.py,
+  netbox/ipv6-mark-reserved.py (punctuation transliteration only; python files
+  re-compiled OK). Plus two catches it made against MY OWN morning patch and
+  bundle HEAD, both fixed: a missed .233 prose line in phase-01; a stale
+  storage/replication CIDR comment in bundle.yaml.
+CHECKS: L1 encoding, L2 stale tokens (with explicit per-file opt-out marker for
+  guard scripts), L3 ghost script refs, L4 deprecated refs, L5 numbering
+  collisions + next-free report, L6 bare invocations.
+REVERT: delete scripts + tests; restore pre-sanitize files from history.
+
+### 11. DOCFIX-075 -- cloud-assert.sh: the behavioral verifier + BOM capture
+FILES: scripts/cloud-assert.sh (NEW), tests/cloud-assert/ (NEW, 9 fakebin
+  cases), runbooks/ops-restart-procedure.md (NEW -- the restart procedure,
+  previously operator-local, adapted to current references with [REVALIDATE]
+  markers and committed).
+WHY: the D-045/D-046/D-051/D-042 family = "juju green, service broken". One
+  idempotent read-only sweep of every service-own-verdict gate (vault seal,
+  mysql 1xR/W, OVN unity, chassis, hypervisors, LBs, PO:, trustee domain, coe
+  403, conductor LIVE args). Missing admin scope = HELD exit 2, never a silent
+  pass. --capture writes a committed asbuilt/<date>/ BOM (Roosevelt drift
+  baseline). Replaces the never-committed post-maintenance-health-check.sh.
+REVERT: delete the three paths.
+
+### 12. DOCFIX-076 -- as-executed log convention
+FILES: scripts/run-logged.sh (NEW), docs/as-executed-log-convention.md (NEW),
+  logs/as-executed-index.md (NEW, committed index; content stays jumphost-only).
+WHY: the verbatim-retrieval rule for one-shot steps depended on an artifact
+  with no defined location/format (DOCFIX-006 is the cautionary tale).
+REVERT: delete the three paths.
+
+### 13. DOCFIX-077 -- appendix-A completions
+FILE: runbooks/appendix-A-troubleshooting.md (two appended sections):
+  mysql-innodb-cluster recovery (D-062 signatures + the destructive-action
+  guard) and the point-of-use identifier index (DOCFIX-027/028/029/034/037,
+  BUNDLEFIX-001..006) closing the dangling-reference gap.
+REVERT: delete the two appended sections.
+
+### 14. DOCFIX-078 -- security exposure ledger
+FILE: docs/security-ledger.md (NEW). Seeded: SEC-001 libvirt credential
+  exposure (was living only in a script header), SEC-002 juju action-log
+  token rule, SEC-003 vault custody, SEC-004 repo-public flag.
+REVERT: delete the file.
+
+### 15. D-069 -- vault unseal-key custody (ADOPTED, policy)
+FILE: docs/design-decisions.md (appended).
+WHAT: split custody (no individual holds threshold), second-person unseal
+  rehearsal as an acceptance item, custody re-cut review at every re-init.
+  Custodian ASSIGNMENT deliberately left as operator input (SEC-003).
+REVERT: append a reversal entry.
+
+### 16. D-070 -- supersedes D-012 (no KVM snapshot restore path)
+FILE: docs/design-decisions.md (appended).
+WHAT: D-012 was never exercised (no virsh snapshot step exists anywhere);
+  rebuild-from-runbooks (D-017/D-018) is THE restore path; baseline-capture
+  role moves to cloud-assert --capture. Counter-argument recorded in the entry
+  (mid-rehearsal rollback convenience) with the revisit condition.
+REVERT: append a reversal entry (this one is the most opinion-weighted item
+  in the set -- if you disagree anywhere, it is probably here).
+
+================================================================================
+## Manual git actions (cannot ship in a zip)
+================================================================================
+  git rm scripts/review-bundle.py          # DOCFIX-070
+  git rm scripts/phase-00-teardown.sh      # deprecated; runbook no longer
+                                           # references it by path (repo-lint
+                                           # L3/L4 assume it gone)
+  # optional: git update-index --chmod=+x scripts/*.sh
+
+## Pre-commit verify (jumphost or Windows+python3)
+  python3 scripts/repo_lint.py .                       # expect: 0 fail, 1 legacy WARN
+  python3 scripts/provider-bundle-check.py bundle.yaml # expect: PASS, 6 [ok]
+  for t in tests/*/run-tests.sh; do bash "$t"; done    # expect: 4x ALL PASS (33 cases)
+
+## Still queued (unchanged by this patchset)
+  Verify-live: octavia deployed-cert SAN read; `juju info` channel probe on the
+  jumphost (channel_assert now automates it at preflight); second-person unseal
+  rehearsal (D-069). Operator inputs: vault custodian assignment (SEC-003);
+  ruling if a real capi-mgmt auto-resume exclusion is wanted (item 7).
+
+================================================================================
+## Block 3 -- code hardening sweep (all repo scripts + harness estate)
+================================================================================
+Method: automated audit of every script and runbook paste block against the
+house hardening rules (SIGPIPE, capture-die, inner-ssh stdin, /tmp-snap, gawk,
+sed -i, column-order, juju-run capture, bare-exit-in-paste), then MANUAL
+verification of every hit before any change. Audit honesty notes: H3 (inner
+ssh) and H7 (paste-block exit) closed at ZERO true positives -- the rc/rcap/J
+wrapper convention and the subshell/remote-quote discipline held everywhere;
+H2/H4/H6/H8 clean.
+
+### 17. DOCFIX-079 -- seven SIGPIPE (H1) fixes: capture-then-test conversions
+FILES: scripts/phase-02-vault-preflight.sh, phase-03-core-verify.sh (model-
+  presence gate: race read a PRESENT model as absent -> false HOLD);
+  phase-06-bootstrap.sh (role verify-first: race re-ran grants);
+  phase-06-net-setup.sh (SG-rule verify-first: race -> duplicate create -> 409
+  aborts the run under set -e); phase-07-conductor-graft.sh + its runbook twin
+  (helm version check: converted to substring param-expansion, no pipe at all);
+  tenant-onboard.sh x2 -- the serious pair: the manager-grant verify could
+  FALSE-DIE on a successful grant, and the duplicate-CIDR guard FAILED OPEN
+  (match -> SIGPIPE 141 -> '&& die' skipped -> colliding subnet proceeds).
+NEW TEST: tests/tenant-onboard/run-tests.sh proves the CIDR guard fires on a
+  collision and stays quiet on a clear CIDR.
+REVERT: each is a commented, anchored block -- git history per file.
+
+### 18. DOCFIX-080 -- tenant-onboard image-ID resolution off column-order luck
+FILE: scripts/tenant-onboard.sh (2 sites) + a jq presence gate added.
+WHY: `-f value -c ID -c Name | awk '{print $1}'` rode alphabetical column
+  ordering (ID<Name today). Converted to `-f json | jq` per the house rule.
+  Display-only multi-column -f value uses elsewhere (phase-05/06 confirms,
+  tenant-acceptance echo) were left as-is deliberately -- output is read by
+  eyes, not parsed; converting them changes operator-facing format for no
+  robustness gain. ADVISORY: do not parse those lines positionally later.
+
+### 19. DOCFIX-081 -- cert-san verifier: dead SKIP branch / silent non-TLS drop
+FILE: scripts/phase-04-internal-cert-san-verify.sh.
+WHY: a jq https-only pre-filter made the non-TLS SKIP branch unreachable --
+  an unexpectedly plain-HTTP internal endpoint was silently hidden, which is
+  precisely a finding the operator must see. Feed now carries ALL internal
+  endpoints; the existing SKIP line reports non-TLS visibly. This also un-
+  breaks tests/phase-04-internal-cert-san (the harness encoded the correct
+  behavior; the script had regressed under it).
+REVERT: restore the jq select() -- not recommended.
+
+### 20. NEW -- tests/phase-00-teardown-d061: harness for the D-061 pair
+The most destructive scripts in the repo (teardown-release/-destroy) shipped
+with NO tests despite a --no-prompt flag documented "tested automation only".
+Stateful fakebin (maas machine state advances on remove/destroy; instant
+sleep): 8 cases incl. canary-stops-after-one, DECOMPOSE-detection fails loud
+and blocks destroy-model, substrate-sid collision aborts pre-mutation,
+--release-storage vs --destroy-storage flag assertions, orphan deletion.
+REVERT: delete the test dir (coverage loss only).
+
+### 21. Harness-estate findings (pre-existing at HEAD; verified against pristine)
+RETIRE (manual git actions -- harnesses for retired scripts test nothing):
+  git rm -r tests/phase-00-teardown        # script git rm'd this patchset;
+                                           # replaced by tests/phase-00-teardown-d061
+  git rm -r tests/provider-vip-standup     # script already gone at HEAD
+  git rm -r tests/phase-00-maas-recidr     # script already gone at HEAD
+REPAIR SPECS (stale-but-live; harnesses still test the D-058 world their
+scripts left at D-060 -- red-at-HEAD today, which trains ignoring red):
+  - tests/phase-00-maas-standup: regenerate make_fixtures.py fixtures and the
+    WOULD/SKIP/DRIFT expectation strings for the D-052/D-053 six-plane table
+    (source of truth: scripts/lib-net.sh) -- drop provider-vip/VID-104/
+    10.12.20.0/22 expectations; fresh-cloud case expects the six-plane create
+    plan + current reserved ranges; drift cases keyed to the current wording
+    ("occupied by the wrong plane", "re-CIDR/migration").
+  - tests/carve-host-interfaces: rebuild fix/*.json interface trees and
+    expectations to Pattern A (br-ex OVS on enp1s0, br-metal/.103/br-internal,
+    raw data/storage/replication statics; metal-internal fixtures must carry
+    VID 103) -- drop enp1s0.104 / br-prov-api expectations.
+  Process lesson encoded for the future: a script migration commit MUST carry
+  its harness (these went stale in the D-060 revert commit).
+
+### 22. Audit-clean attestations (for the record)
+Runbook paste blocks: every `exit` verified nested in a subshell or a remote-
+quoted command -- zero operator-shell-killing exits. Inner ssh/juju-ssh: all
+argv-style invocations route through </dev/null-appending wrappers or terminate
+with </dev/null; heredoc-payload ssh (bash -s) correctly exempt. No /tmp-snap,
+gawk-ism, unasserted sed -i, or capture-die instances anywhere.
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index c4a63e7..2aa225a 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -1383,3 +1383,131 @@
    via a tenant's failed cluster-create.
 
 **Related:** D-067 (surfaced these), D-052/D-053.
+
+<!-- patchset-20260702-redeploy-readiness : DOCFIX-066..072 sweep -->
+
+---
+
+## D-002 -- AMENDMENT (2026-07-02): channel matrix reconciled to as-built
+
+The D-002 table is historical (append-only); as-built corrections: (1) the `etcd, easyrsa`
+row is DEAD -- etcd/easyrsa were dropped when vault moved to the mysql storage backend
+(phase-02 R3: "HA Enabled false" is correct for vault-on-mysql); (2) `memcached` (absent
+from the table) is pinned `latest/stable` -- the only track that charm publishes; the
+project-wide "never latest/stable" guidance targets OpenStack-project charms, which
+memcached is not (verify at deploy: `juju info memcached`); (3) the vault row (`1.8/stable`)
+is superseded by the **1.16/stable** pin (D-068 / BUNDLEFIX-007). Channel-staleness review
+2026-07-02: every other pin confirmed current for Caracal/jammy; rabbitmq-server `3.9` is
+that charm's TERMINAL track (no newer exists), not a stale pin. The upstream charm-guide
+delivery page is frozen (2023-12) -- `juju info <charm>` is the only live authority; the
+pre-deploy channel assert belongs in `scripts/pre-flight-checks.sh`.
+
+## D-009 -- AMENDMENT (2026-07-02): rabbitmq scale-up is NOT mechanical without min-cluster-size
+
+D-009 promises Roosevelt scale-up is "change num_units 1 -> 3 and rerun". For
+`rabbitmq-server` that is insufficient: without `min-cluster-size: 3` the charm accepts
+client relations BEFORE the cluster forms (same failure class as the D-062 mysql formation
+race; upstream charm docs call min-cluster-size best practice for multi-unit deploys).
+Roosevelt bundle delta: set `min-cluster-size: 3` alongside `num_units: 3`. No testcloud
+change (single unit is correct here).
+
+## D-011 -- AMENDMENT (2026-07-02): acceptance item 6 is MANUAL unseal (matches phase-08)
+
+D-011 item 6 read "Vault unseal + auto-unseal-after-reboot pattern verified". The v1
+standard, as ruled in phase-08 D-011.6, is MANUAL unseal (3-of-5 key shares at a hidden
+prompt) after any vault restart; auto-unseal is an available option adopted case-by-case
+and NOT configured in v1. Item 6 is therefore read as: "Vault manual unseal after reboot
+verified (sealed-on-restart is BY DESIGN, not a fault)". The acceptance bar and the
+acceptance runbook now agree.
+
+## D-043 -- RESOLVED (2026-07-02): ADOPTED, option (a) -- tenant-VM auto-resume ON
+
+**Decision:** adopt option (a): `nova-compute resume-guests-state-on-host-boot=true`,
+cloud-wide, as charm config (already present in bundle HEAD -- this resolution brings the
+decision record level with the implementation, closing the bundle-ahead-of-record drift
+flagged as DOCFIX-072). Rationale: tenant VMs are a different class from control-plane
+services -- auto-resume is the industry norm and the Roosevelt customer expectation; the
+restart procedure already builds on it (guests resume per pre-shutdown state, so a
+deliberately stopped guest STAYS stopped). D-041's "down is a signal" discipline is
+UNCHANGED for control-plane services, which this option does not touch; the D-035 mgmt VM
+remains manual-start by policy (it is a control-plane component that happens to be a VM --
+if auto-resume masks a mgmt-VM incident class in practice, revisit with an explicit
+exclusion). Roosevelt item: VM-state monitoring/alerting so "down" stays visible.
+**Resolves:** D-043 (was PROPOSED). **Related:** D-040, D-041, restart procedure.
+
+## D-051 -- AMENDMENT (2026-07-02): policy delivery is bundle-native (DOCFIX-071)
+
+The D-051 mechanism ("zip -> juju attach-resource") was never folded into the deploy
+schedule: the bundle set `use-policyd-override=true` with no resource, phase-01 knowingly
+deployed into `PO (broken)`, and no phase attached the zip -- the live policy existed only
+as a session action (D-064). A clean redeploy would have shipped WITHOUT the tenant-
+isolation RBAC. **Amendment:** the policy ships IN the bundle -- keystone
+`resources: {policyd-override: ./policies/overrides.zip}`, with the zip committed beside
+its source. `attach-resource` (appendix-C C.3, now $HOME-pathed -- the /tmp form was
+snap-blocked) remains the LIVE-UPDATE path only. Drift between zip and yaml is a
+FAIL-CLOSED deploy-gate check in `provider-bundle-check.py` (content compare). Acceptance
+remains BEHAVIORAL (phase-03 Step 3.4: `PO:` is stage 1; the C.4 G3 probe is the gate) --
+unchanged from D-051's own warning that the charm validates YAML only.
+
+## D-061 -- AMENDMENT (2026-07-02): validation scope + the runbook fork (DOCFIX-066)
+
+Two clarifications for an error-free redeploy: (1) the canary in
+`phase-00-teardown-release.sh` validates machine SURVIVAL only; machine RE-ACQUISITION by
+a next model (juju's MAAS provider allocates Ready machines; a kept host stays Deployed)
+is the still-unvalidated half. Until BOTH halves pass, the release path is NOT a route
+into phase-01 -- it serves model-only teardown/surgery. (2) The VALIDATED full-redeploy
+spine is therefore the DESTROY path: `phase-00-teardown-destroy.sh` -> 8_lbaas/OSD ops ->
+`reenroll-hosts.sh` -> carve -> standup -> phase-01. The phase-00 runbook (DOCFIX-066)
+now encodes this fork explicitly; it previously drove the deprecated
+`phase-00-teardown.sh`, whose "releases to Ready" premise D-061 disproved.
+
+
+## D-069: Vault unseal-key custody -- split custody, rehearsed second-person unseal
+
+**Status:** ADOPTED 2026-07-03 (policy; custodian ASSIGNMENT pending operator input --
+tracked as SEC-003 in docs/security-ledger.md).
+
+**Problem:** the 5 Shamir shares (threshold 3) are held by a single operator. The restart
+procedure names missing keys a hard recovery BLOCKER, and vault re-init wipes the TLS
+plane -- so single-person custody is a bus-factor risk no commercial cloud should carry.
+
+**Decision (standard Vault operational guidance):**
+1. Distribute shares so NO individual holds threshold (3+): e.g. 2/2/1 across three
+   custodians, or 1 per person plus sealed escrow. Custodian names + storage media are
+   recorded OFF-REPO (custody detail is itself sensitive); the ledger row tracks status.
+2. A SECOND-PERSON unseal rehearsal is an acceptance item: someone other than the
+   initializing operator must successfully unseal (restart-procedure Stage 3) before
+   the deployment is declared operational. "The keys work" and "a second human can use
+   them" are different facts; only the second one survives the bus.
+3. Key custody is reviewed at every re-init (re-init re-cuts the shares).
+
+**Roosevelt:** evaluate auto-unseal (transit/cloud KMS) as a separate decision; split
+custody remains the floor either way (recovery keys still exist under auto-unseal).
+
+**Related:** D-011 (amended: manual unseal is the v1 standard), DOCFIX-006 (the
+lost-init cautionary tale), docs/security-ledger.md SEC-003.
+
+## D-070: KVM baseline snapshots -- SUPERSEDES D-012 (no snapshot restore path)
+
+**Status:** ADOPTED 2026-07-03. Supersedes D-012.
+
+**Finding:** D-012 (two KVM baseline snapshots per cycle) was never exercised -- no
+`virsh snapshot` step exists in any phase runbook or script; the only "snapshot"
+mentions in the repo are dated as-built value captures. An adopted-but-unexercised
+decision is documentation debt pretending to be a safety net.
+
+**Decision:** retire the KVM-snapshot restore path. D-017/D-018 already made
+rebuild-from-runbooks THE restore path, and snapshots quietly compete with that
+discipline: a team that restores a snapshot skips exactly the rehearsal this testcloud
+exists to force, and snapshot restore does not transfer to Roosevelt bare metal.
+The pre/post-maintenance BASELINE CAPTURES (juju export + inventories) are retained and
+strengthened -- that role moves to `bash scripts/cloud-assert.sh --capture`, whose
+committed asbuilt/<date>/ BOM is also the Roosevelt multi-DC drift baseline.
+
+**Recorded counter-argument:** cheap mid-rehearsal rollback (e.g. tight phase-08
+iteration loops) is a real convenience. If that pain materializes, revisit as an
+explicitly-labeled DEV CONVENIENCE with a rule that a snapshot restore invalidates the
+run for acceptance purposes -- never as a restore path.
+
+**Related:** D-012 (superseded), D-017/D-018 (the actual restore path), DOCFIX-075
+(cloud-assert --capture).
diff --git a/docs/docfix-draft-20260702.md b/docs/docfix-draft-20260702.md
new file mode 100644
index 0000000..c5c65ff
--- /dev/null
+++ b/docs/docfix-draft-20260702.md
@@ -0,0 +1,215 @@
+# DOCFIX draft -- redeploy-readiness review (bundle + channels + runbooks)
+
+STATUS: DRAFT / OPEN -- accreting during the 2026-07-02 review session.
+Numbers are PROVISIONAL from next-free DOCFIX-066 (verified against HEAD
+690779a: DOCFIX-065 / D-068 / BUNDLEFIX-008 consumed). Renumber-check again
+at commit time. ASCII + LF.
+
+Scope of this review:
+  1. bundle.yaml -- YAML validity, structural consistency, known anti-patterns.
+  2. Charm channel pins -- staleness review against current Charmhub guidance.
+  3. Runbook sweep -- cross-reference integrity, stale values, anything that
+     would break the next redeploy.
+
+Severity key: BLOCKER (breaks redeploy) / RISK (may break or mislead) /
+NIT (consistency only).
+
+--------------------------------------------------------------------------------
+## Findings
+--------------------------------------------------------------------------------
+
+(appended as found)
+### DOCFIX-066 (BLOCKER) -- teardown runbook drives the DEPRECATED teardown script
+File: runbooks/phase-00-teardown-maas-reset.md (steps 2, plan table, lines 22/30/67/74/85).
+The runbook's execution spine is `scripts/phase-00-teardown.sh --apply` with the narrative
+"hosts release to MAAS Ready" -- the exact premise DOCFIX-057/D-061 proved WRONG on this
+virsh-pod MAAS (destroy-model DECOMPOSES pod-composed machines; observed 3x). The script
+itself carries a DO-NOT-USE banner, so the runbook and script now contradict each other;
+an operator following the runbook on the next redeploy either hits the deprecation mid-
+teardown or, if they push past it, triggers a fourth decompose + full reenroll/recarve.
+The D-061 replacements (phase-00-teardown-release.sh --keep-instance + canary;
+phase-00-teardown-destroy.sh) exist but are never mentioned in the runbook.
+FIX: rewrite the runbook spine as the D-061 fork -- (a) machine-preserving path:
+teardown-release.sh with the MANDATORY first-run canary (--apply --canary, verify
+openstack0 survives in MAAS, then all-four); (b) from-scratch path: teardown-destroy.sh
++ reenroll + recarve. State which path the standard redeploy uses. Step-5 "hosts Ready"
+premise and the OSD-wipe/8_lbaas step ordering must be revalidated per path (release path
+leaves hosts Deployed, not Ready -- the wipe/carve preconditions differ).
+
+### DOCFIX-067 (RISK -- verify live before ruling) -- octavia PKI cert SAN carries the pre-R14 VIP
+File: runbooks/phase-01-bundle-deploy.md 1.0-GEN.c (lines ~292, ~318).
+The controller-cert CNF sets `IP.1 = 10.12.4.233` -- the OLD octavia VIP. R14 relocated
+all VIPs to .50-.60; bundle HEAD has octavia at 10.12.4.57. The octavia-pki overlay is
+regenerated every phase-01, so the LIVE cloud's controller cert most likely carries .233
+today; octavia passed phase-05 validation regardless, so the amphora side evidently does
+not verify that SAN IP -- functional impact UNPROVEN, inconsistency CERTAIN, and it is a
+latent break if SAN verification ever tightens (or when Roosevelt re-uses this block).
+The DNS.1/DNS.2 SANs also reference the D-019-dropped FQDN scheme (harmless, same sweep).
+FIX: derive the SAN IP dynamically (lib-net VIP_PREFIX_PROVIDER + octavia's octet from
+bundle/juju -- rule 3), not a literal. VERIFY-LIVE first (gated CHECK, jumphost):
+read the overlay/live cert SAN and confirm what is actually deployed:
+  openssl x509 -in <controller cert path per phase-01> -noout -text | grep -A2 'Subject Alternative Name'
+Rule on severity after the read: if the live cert has .233 and octavia is green, keep RISK
+(doc fix + regenerate at next redeploy); do not hot-rotate certs mid-cloud for this.
+
+### DOCFIX-068 (RISK) -- phase-01 "Constants and env-literals" block is pre-D-052 stale
+File: runbooks/phase-01-bundle-deploy.md lines ~23-26. The block states the RETIRED plane
+map (2=metal .8, 6=data .12, 7=storage .16, 8=replication .20, 9=lbaas .32 -- wrong
+plane->CIDR pairs under D-052/D-053, incl. the retired `lbaas` space), plus hardcoded MAAS
+subnet IDs (violates lib-net PATTERN-1: IDs drift, resolve by CIDR) and hardcoded
+system_ids (violates DOCFIX-040: re-minted per enrollment; lib-hosts resolves). Mixed
+freshness: the "50 apps, 97 relations" expectation in the same block MATCHES bundle HEAD.
+Misleading at the worst moment (mid-deploy reference values).
+FIX: replace the stale lines with pointers to scripts/lib-net.sh (planes) and
+scripts/lib-hosts.sh (host identity); retain only verified-current literals.
+
+### DOCFIX-069 (RISK) -- zero exec bits + bare script invocations
+git index: ALL 37 files under scripts/ are mode 100644 (GitHub Desktop workflow strips
++x). Fresh clone on the jumphost -> every BARE invocation fails "Permission denied".
+runbooks/phase-00-teardown-maas-reset.md invokes bare in ~10 places (teardown, carve,
+standup); other runbooks appear bash-prefixed (sweep found no other bare hits).
+FIX (durable, matches the Windows commit constraint): bash-prefix every script invocation
+in runbooks (`bash scripts/x.sh ...`). Optional belt: `git update-index --chmod=+x
+scripts/*.sh` -- but Windows-side recommits can strip again, so the bash prefix is the
+invariant; do both if desired.
+
+### DOCFIX-070 (RISK) -- scripts/review-bundle.py is pre-D-052 stale; NOT CLEAN is noise
+Against bundle HEAD it reports FAIL=71: expects space `metal` (retired), DUAL VIPs (D-020
+form; D-052 moved to triples), no per-endpoint bindings (D-052 introduced them), vault
+1.8 (D-068 pinned 1.16), baselines 51 apps/98 rels (now 50/97: VIP set changed -- vault
+dropped its VIP, ceph-radosgw gained one -- blessed by provider-bundle-check.py, which
+PASSES clean). Hazard: a pre-deploy NOT CLEAN verdict that must be ignored trains alarm
+fatigue and will eventually mask a real defect.
+OPTIONS: (a) update review-bundle.py expectations to the D-052/D-060/D-062/D-068 model;
+(b) retire it (git rm) and fold any still-unique checks (relation-endpoint syntax,
+phantom-key detection reworked for the per-endpoint model) into provider-bundle-check.py;
+(c) banner it historical. RECOMMEND (b): one authoritative gate beats two disagreeing
+ones -- same reasoning as the D-060 d057-bundle-check retirement.
+
+### NIT-A -- D-002 channel matrix drift (design-decisions)
+The D-002 table still lists `etcd, easyrsa -> latest/stable` (etcd/easyrsa dropped; R3 /
+phase-02 record vault-on-mysql), omits memcached (bundle: latest/stable -- apparently the
+only track that charm publishes; upstream's "never latest/stable" applies to OpenStack-
+project charms, which memcached is not), and its vault row (1.8) is superseded by D-068
+(1.16). Append-only fix: a dated amendment note under D-002, not an edit.
+VERIFY-LIVE (gated CHECK, jumphost) before finalizing:
+  for c in memcached rabbitmq-server vault hacluster; do juju info "$c" 2>/dev/null | sed -n '/channels:/,$p' | head -12; done
+Expected: memcached publishes only latest/*; rabbitmq-server tops out at 3.9; vault
+carries 1.16/stable; hacluster 2.4/stable.
+
+### NIT-B -- channel-pin review conclusion (informational; no change)
+All bundle pins judged CURRENT for Caracal/jammy: 2024.1/stable core (18), OVN
+24.03/stable, ceph squid/stable, mysql 8.0/stable (12), hacluster 2.4/stable (11),
+rabbitmq-server 3.9/stable (terminal track for this charm), vault 1.16/stable (D-068),
+memcached latest/stable (sole track; see NIT-A). Upstream charm-guide delivery page is
+frozen (last updated 2023-12) -- Charmhub/juju info is the only live authority; the
+NIT-A verify block doubles as the pre-deploy channel assert. Candidate: fold that assert
+into scripts/pre-flight-checks.sh (D-002 claims pre-flight verifies channels -- confirm
+it actually does; not yet audited).
+
+### NIT-C -- ASCII-rule violations in docs/
+docs/v1-pre-deploy-fixes.md (277 non-ASCII bytes), docs/netbox-vip-queue.md (81). The
+repo rule is ASCII-only for all committed files (mod_wsgi lesson). Low functional risk
+(docs, not conf), but the rule is stated absolute -- sanitize or record a carve-out.
+
+### NIT-D -- identifier index gaps
+DOCFIX-027/028/029/034/037 and BUNDLEFIX-001..006 are defined only at point of use
+(runbook/bundle comments) and absent from appendix-A / the changelog index -- appendix-A
+claims to be the index "keyed by the same identifiers used inline". Add one-line index
+entries (or mark point-of-use-only identifiers as such).
+
+### NIT-E -- appendix-A lacks a mysql-innodb-cluster recovery entry
+D-062 material (blocked 'Instance not yet configured' = single-unit seed; half-join
+instanceErrors = mid-life rescan; reboot-cluster-from-complete-outage ONLY on confirmed
+outage -- destructive against a healthy cluster) exists in design-decisions + the restart
+procedure but has no appendix-A symptom entry. Add one; also consider committing the
+restart-procedure doc to the repo (it currently lives outside it).
+
+--------------------------------------------------------------------------------
+## Verify-live queue (gated CHECKs for the jumphost before findings finalize)
+1. Octavia controller cert SAN (DOCFIX-067) -- read the deployed overlay/cert.
+2. juju info channel probe (NIT-A/B) -- memcached / rabbitmq-server / vault / hacluster.
+3. pre-flight-checks.sh -- confirm whether it performs the D-002 channel assert.
+
+--------------------------------------------------------------------------------
+## Deployment-flow parity findings (decision vs bundle vs schedule)
+--------------------------------------------------------------------------------
+
+### DOCFIX-071 (BLOCKER) -- D-064 keystone policy attach is not reachable from the deploy schedule
+Evidence: bundle.yaml keystone has use-policyd-override=True but NO resources: stanza;
+`attach-resource keystone` appears in NO phase runbook or script -- only appendix-C:73-74.
+phase-01:183 knowingly deploys into "PO (broken)" and phase-02:167 re-notes it as
+FINDING-1 "not a regression"; no phase ever resolves it. The live cloud got the policy
+via a session action (D-064), never folded into the schedule. NEXT REDEPLOY as written:
+keystone stays PO (broken), the SCS Domain Manager RBAC (the commercial tenant-isolation
+core, D-051) is ABSENT, and tenant onboarding fails at G3.
+Compounding defect: the appendix-C block zips to and attaches FROM /tmp -- the
+documented snap-confinement trap (attach-resource cannot read /tmp on this jumphost;
+use $HOME). The only written procedure is the known-broken form.
+FIX OPTIONS (debate):
+ (a) Bundle-native resource: add to keystone `resources: {policyd-override:
+     ./policies/overrides.zip}` and commit the zip beside its source yaml. Deploy-time
+     attach becomes automatic -- the bundle describes the WHOLE desired state, zero
+     manual step, zero Roosevelt delta. Sync risk (zip vs yaml drift) is closed by a
+     pre-flight assert: rebuild the zip from policies/, byte-compare against committed,
+     HOLD on mismatch.
+ (b) Schedule step: a gated attach block in phase-03 (post-TLS-settle), $HOME-pathed,
+     gating on `PO:` in juju status.
+ EITHER WAY: the G3 BEHAVIORAL gate (manager can self-service own domain; admin-grant
+ and cross-domain DENIED; cloud-admin unaffected) must be a phase step -- D-051's own
+ warning: the charm validates YAML only, `PO:` proves parse, not policy. RECOMMEND
+ (a) + G3 gate in phase-03: post-deploy manual steps are exactly the class D-046
+ proved unreliable ("reports ready regardless").
+
+### DOCFIX-072 (RISK) -- bundle implements the still-PROPOSED D-043
+bundle.yaml nova-compute sets resume-guests-state-on-host-boot: True while D-043
+(tenant-VM auto-resume) remains PROPOSED / decision-pending. The bundle is ahead of the
+decision record -- the exact drift the discipline forbids (and the restart-procedure doc
+already assumes the option is in force). FIX: rule on D-043 -- RECOMMEND adopting its
+option (a) (auto-resume + monitoring; industry norm for tenant VMs; customers at
+Roosevelt expect VMs back after host maintenance; D-041's down-is-a-signal stance is
+preserved for CONTROL-PLANE services, which auto-resume does not touch) -- and mark the
+decision ADOPTED with the bundle line as its implementation. Alternative: strip the
+option until ruled; NOT recommended (regresses the validated restart procedure).
+
+### NIT-F -- D-011.6 text not amended to the phase-08 ruling
+design-decisions D-011 item 6 still reads "Vault unseal + auto-unseal-after-reboot
+pattern verified"; phase-08 D-011.6 rules MANUAL unseal is the v1 standard (auto-unseal
+NOT configured). Append an amendment note to D-011 so the acceptance bar and the
+acceptance runbook agree.
+
+### NIT-G (Roosevelt-forward) -- rabbitmq-server scale-up will race without min-cluster-size
+Testcloud: num_units=1, no min-cluster-size -- correct per D-009 (decorative HA). But the
+D-009 promise is "Roosevelt scale-up is mechanical: 1 -> 3 and rerun". For rabbitmq that
+is NOT sufficient: without `min-cluster-size: 3` the charm accepts client relations
+before the cluster forms (same failure CLASS as D-062's mysql formation race; upstream
+charm docs call min-cluster-size best practice). Record now as a Roosevelt bundle-delta
+note on D-009 so the mechanical scale-up story stays true.
+
+--------------------------------------------------------------------------------
+## Patchset status (2026-07-02, patchset-20260702-redeploy-readiness)
+--------------------------------------------------------------------------------
+IMPLEMENTED in the delivered ZIP (numbers verified next-free at HEAD 690779a;
+re-grep at commit): DOCFIX-066 (teardown runbook rewritten around the D-061 fork,
+destroy path = validated spine, reenroll step added, all invocations bash-prefixed),
+DOCFIX-067 (octavia SAN IP derived from bundle at generation time; verify-live of the
+deployed cert still queued), DOCFIX-068 (phase-01 constants -> lib-net/lib-hosts),
+DOCFIX-069 (bash-prefix; optional chmod noted in apply-notes), DOCFIX-070 (checks
+absorbed into provider-bundle-check.py + 8-case harness; review-bundle.py to git rm),
+DOCFIX-071 (bundle-native keystone policy resource + committed zip + drift guard +
+phase-03 Step 3.4 two-stage gate + appendix-C /tmp fix + subshell wrap), DOCFIX-072
+(D-043 RESOLVED->ADOPTED(a)). D-doc amendments appended: D-002, D-009, D-011, D-043,
+D-051, D-061. STILL OPEN: NIT-C (docs/ ASCII sanitize), NIT-D (identifier index),
+NIT-E (appendix-A mysql entry), verify-live queue items 1-3.
+
+
+## Patchset status addendum (2026-07-03, Block 2)
+IMPLEMENTED: DOCFIX-073 (preflight + channel assert + phase-01 gate), DOCFIX-074
+(repo-lint + full ASCII sanitize incl. .gitignore/netbox; closed NIT-C), DOCFIX-075
+(cloud-assert + committed ops-restart-procedure; closed the health-check gap),
+DOCFIX-076 (as-executed convention + run-logged + index), DOCFIX-077 (appendix-A
+mysql entry + identifier index; closed NIT-D/E), DOCFIX-078 (security ledger),
+D-069 (vault custody policy), D-070 (supersedes D-012). Verify-live queue item 2
+(channel probe) is now AUTOMATED by preflight P3. Remaining operator inputs:
+SEC-003 custodian assignment; capi-mgmt auto-resume exclusion ruling; octavia
+deployed-cert SAN read. See docs/changelog-20260703-process-hardening.md.
diff --git a/docs/netbox-vip-queue.md b/docs/netbox-vip-queue.md
index 13f47ed..5017bd1 100644
--- a/docs/netbox-vip-queue.md
+++ b/docs/netbox-vip-queue.md
@@ -14,7 +14,7 @@
 
 ---
 
-## Provider prefix (parent — gating)
+## Provider prefix (parent -- gating)
 
 Before any IPAddress entries can be created, the parent prefix must exist:
 
@@ -33,46 +33,46 @@
 
 | IP | Status | DNS name | Description |
 |---|---|---|---|
-| `10.12.4.224/22` | Active | `barbican.omega.dc0.vr0.cloud.neumatrix.local` | barbican API VIP — Charmed OpenStack hacluster |
-| `10.12.4.225/22` | Reserved | — | RESERVED for ceph-radosgw HA VIP in v2 (workstream-2 decision; ceph-radosgw HA deferred to v2) |
-| `10.12.4.226/22` | Active | `cinder.omega.dc0.vr0.cloud.neumatrix.local` | cinder API VIP — Charmed OpenStack hacluster |
-| `10.12.4.227/22` | Reserved | —                                               | RESERVED for designate VIP in v2 (per D-019; Designate deferred to v2)                         |
-| `10.12.4.228/22` | Active | `glance.omega.dc0.vr0.cloud.neumatrix.local` | glance API VIP — Charmed OpenStack hacluster |
-| `10.12.4.229/22` | Active | `keystone.omega.dc0.vr0.cloud.neumatrix.local` | keystone API VIP — Charmed OpenStack hacluster |
-| `10.12.4.230/22` | Active | `magnum.omega.dc0.vr0.cloud.neumatrix.local` | magnum API VIP — Charmed OpenStack hacluster |
-| `10.12.4.231/22` | Active | `neutron.omega.dc0.vr0.cloud.neumatrix.local` | neutron-api API VIP — Charmed OpenStack hacluster |
-| `10.12.4.232/22` | Active | `nova.omega.dc0.vr0.cloud.neumatrix.local` | nova-cloud-controller API VIP — Charmed OpenStack hacluster |
-| `10.12.4.233/22` | Active | `octavia.omega.dc0.vr0.cloud.neumatrix.local` | octavia API VIP — Charmed OpenStack hacluster |
-| `10.12.4.234/22` | Active | `horizon.omega.dc0.vr0.cloud.neumatrix.local` | openstack-dashboard (Horizon) VIP — Charmed OpenStack hacluster |
-| `10.12.4.235/22` | Active | `placement.omega.dc0.vr0.cloud.neumatrix.local` | placement API VIP — Charmed OpenStack hacluster |
-| `10.12.4.236/22` | Active | `vault.omega.dc0.vr0.cloud.neumatrix.local` | vault VIP — Charmed Vault hacluster (D-006) |
+| `10.12.4.224/22` | Active | `barbican.omega.dc0.vr0.cloud.neumatrix.local` | barbican API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.225/22` | Reserved | -- | RESERVED for ceph-radosgw HA VIP in v2 (workstream-2 decision; ceph-radosgw HA deferred to v2) |
+| `10.12.4.226/22` | Active | `cinder.omega.dc0.vr0.cloud.neumatrix.local` | cinder API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.227/22` | Reserved | --                                               | RESERVED for designate VIP in v2 (per D-019; Designate deferred to v2)                         |
+| `10.12.4.228/22` | Active | `glance.omega.dc0.vr0.cloud.neumatrix.local` | glance API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.229/22` | Active | `keystone.omega.dc0.vr0.cloud.neumatrix.local` | keystone API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.230/22` | Active | `magnum.omega.dc0.vr0.cloud.neumatrix.local` | magnum API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.231/22` | Active | `neutron.omega.dc0.vr0.cloud.neumatrix.local` | neutron-api API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.232/22` | Active | `nova.omega.dc0.vr0.cloud.neumatrix.local` | nova-cloud-controller API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.233/22` | Active | `octavia.omega.dc0.vr0.cloud.neumatrix.local` | octavia API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.234/22` | Active | `horizon.omega.dc0.vr0.cloud.neumatrix.local` | openstack-dashboard (Horizon) VIP -- Charmed OpenStack hacluster |
+| `10.12.4.235/22` | Active | `placement.omega.dc0.vr0.cloud.neumatrix.local` | placement API VIP -- Charmed OpenStack hacluster |
+| `10.12.4.236/22` | Active | `vault.omega.dc0.vr0.cloud.neumatrix.local` | vault VIP -- Charmed Vault hacluster (D-006) |
 
 **Notes:**
 
-- Mask is `/22` (the parent prefix mask), not `/32` — NetBox convention for
+- Mask is `/22` (the parent prefix mask), not `/32` -- NetBox convention for
   endpoint IP addresses within a prefix.
 - The Reserved slots at `.225` and `.227` document v2 intent without consuming
   active allocations. When v2 work brings ceph-radosgw HA and Designate online,
-  those entries' Status flips Reserved → Active and the bundle's `# v2-deferred:`
+  those entries' Status flips Reserved -> Active and the bundle's `# v2-deferred:`
   markers are uncommented.
-- `nova-cloud-controller` charm → DNS short name `nova` (catalog service name,
+- `nova-cloud-controller` charm -> DNS short name `nova` (catalog service name,
   not charm name).
-- `openstack-dashboard` charm → DNS short name `horizon` (project name).
-- `neutron-api` charm → DNS short name `neutron`.
+- `openstack-dashboard` charm -> DNS short name `horizon` (project name).
+- `neutron-api` charm -> DNS short name `neutron`.
 
 ---
 
-## FIP pool — for completeness (not part of workstream 2)
+## FIP pool -- for completeness (not part of workstream 2)
 
 Per D-003, the Provider /22 also carries the Neutron FIP pool. These are NOT
 individual IPAddress entries; they're modeled as an IP Range under the prefix:
 
 | Range | Purpose |
 |---|---|
-| `10.12.4.10 – 10.12.4.223` | Neutron FIP pool (created by `ipv4-prefixes-import.py`) |
-| `10.12.4.224 – 10.12.4.254` | API VIP pool (the 13 entries above + future) |
+| `10.12.4.10 - 10.12.4.223` | Neutron FIP pool (created by `ipv4-prefixes-import.py`) |
+| `10.12.4.224 - 10.12.4.254` | API VIP pool (the 13 entries above + future) |
 
-Neutron `allocation_pools` for the provider subnet MUST exclude `.224–.254` —
+Neutron `allocation_pools` for the provider subnet MUST exclude `.224-.254` --
 this is enforced in `runbooks/06-tenant-setup.md` (or wherever the provider
 subnet is created).
 
@@ -81,7 +81,7 @@
 ## Execution path (when unblocked)
 
 1. Confirm engineer review of `netbox/ipv4-prefixes-import.py` has signed off.
-2. Run `netbox/ipv4-prefixes-import.py` — creates the Provider /22 prefix + FIP
+2. Run `netbox/ipv4-prefixes-import.py` -- creates the Provider /22 prefix + FIP
    IP Range + API VIP IP Range.
 3. Add the 13 IPAddress entries from the table above. Two paths:
    - **Web UI:** Per-entry manual creation. Tedious but reviewable.
@@ -99,8 +99,8 @@
 
 | Date | Change | Reference |
 |---|---|---|
-| 2026-05-22 | Document created. 12 active VIP allocations queued + 1 v2-reserved slot. | Workstream 2 — VIP allocation + hacluster activation |
-| 2026-05-27 | Designate VIP at `.227` flipped Active → Reserved per D-019 (Designate deferred to v2). Active count: 11; Reserved count: 2. | D-019 |
+| 2026-05-22 | Document created. 12 active VIP allocations queued + 1 v2-reserved slot. | Workstream 2 -- VIP allocation + hacluster activation |
+| 2026-05-27 | Designate VIP at `.227` flipped Active -> Reserved per D-019 (Designate deferred to v2). Active count: 11; Reserved count: 2. | D-019 |
 
 ---
 
diff --git a/docs/security-ledger.md b/docs/security-ledger.md
new file mode 100644
index 0000000..8740e3a
--- /dev/null
+++ b/docs/security-ledger.md
@@ -0,0 +1,15 @@
+# Security exposure / obligation ledger (DOCFIX-078)
+
+Commercial posture: every credential exposure, rotation obligation, and
+security TODO gets a ROW here with an owner and status -- never only a comment
+in a script header (where the libvirt item below lived for a week). Review this
+ledger at every phase-00 (teardown) and before any handoff. Locations of key
+material are deliberately NOT recorded here -- custody detail lives off-repo
+per D-069.
+
+| id | date | item | source / evidence | owner | status |
+|---|---|---|---|---|---|
+| SEC-001 | 2026-06-26 | libvirt SSH credential printed in plaintext by `maas machine power-parameters` during reenroll work | scripts/reenroll-hosts.sh header note | operator | OPEN -- rotate after the current rebuild completes |
+| SEC-002 | 2026-06-17 | juju action params persist in the operation log -- charm authorization must use short-lived child tokens | DOCFIX-011 | operator | STANDING RULE (verify each vault authorize) |
+| SEC-003 | 2026-07-03 | Vault unseal-key custody is single-operator (bus factor) | D-069 | operator | OPEN -- assign custodians + rehearse second-person unseal |
+| SEC-004 | 2026-05-27 | repo temporarily PUBLIC for v1 web_fetch workflow | project completion list | operator | OPEN -- flip to private at v1 close |
diff --git a/docs/v1-pre-deploy-fixes.md b/docs/v1-pre-deploy-fixes.md
index b870716..8bd5206 100644
--- a/docs/v1-pre-deploy-fixes.md
+++ b/docs/v1-pre-deploy-fixes.md
@@ -1,4 +1,4 @@
-# v1 Pre-Deploy Fixes (v2 — includes Designate deferral)
+# v1 Pre-Deploy Fixes (v2 -- includes Designate deferral)
 
 **Purpose:** Single-pass repo hygiene before v1 deployment execution begins. Apply these fixes as one logical commit per group (nine commits total) before any execution document runs.
 
@@ -9,21 +9,21 @@
 **What changed in v2 of this change list (2026-05-27):**
 
 - Added commits 7-9 implementing the Designate-deferral decision (D-019).
-- Amended commit 5 (deprecated runbook moves) — `07-dns-zones.md` is now permanently deprecated per D-019, not "replaced by v1-do-doc-10-dns."
-- Amended commit 6 (deprecated README content) — same.
-- Updated commit 4 (README.md refresh) — adds language reflecting Designate deferral to the v1 scope section.
-- Updated §10 verification commands to expect 11 VIPs, not 12.
+- Amended commit 5 (deprecated runbook moves) -- `07-dns-zones.md` is now permanently deprecated per D-019, not "replaced by v1-do-doc-10-dns."
+- Amended commit 6 (deprecated README content) -- same.
+- Updated commit 4 (README.md refresh) -- adds language reflecting Designate deferral to the v1 scope section.
+- Updated sect.10 verification commands to expect 11 VIPs, not 12.
 
 ## Cross-references
 
-- D-002 (channel matrix) — Vault row cleanup
+- D-002 (channel matrix) -- Vault row cleanup
 - D-005 (Ceph Squid release)
-- D-008 (DNS architecture) — superseded by D-019; v2-scope
-- D-011 (validation bar) — amended by D-019 (Designate criterion dropped)
-- D-014 (repo path) — stale path correction
-- D-017 (CAPI bootstrap cluster lifecycle) — supersedes runbook 00 Phase 5
-- D-018 (teardown strategy) — supersedes runbook 00 Phase 4
-- **D-019 (NEW) — Designate deferral to v2; tenant resolvers use public DNS**
+- D-008 (DNS architecture) -- superseded by D-019; v2-scope
+- D-011 (validation bar) -- amended by D-019 (Designate criterion dropped)
+- D-014 (repo path) -- stale path correction
+- D-017 (CAPI bootstrap cluster lifecycle) -- supersedes runbook 00 Phase 5
+- D-018 (teardown strategy) -- supersedes runbook 00 Phase 4
+- **D-019 (NEW) -- Designate deferral to v2; tenant resolvers use public DNS**
 - Charmed Ceph `charm-ceph-osd` `config.yaml` and `metadata.yaml` (osd-devices semantics)
 - Ceph BlueStore configuration reference (single-device co-located OSD pattern)
 
@@ -42,12 +42,12 @@
 
 Concretely, with the current bundle:
 
-- `options.osd-devices: /dev/vdb` → one OSD per unit using the 512 GB libvirt-attached disk
-- `storage.osd-devices: loop,1024M` → an *additional* 1 GB loopback OSD per unit
+- `options.osd-devices: /dev/vdb` -> one OSD per unit using the 512 GB libvirt-attached disk
+- `storage.osd-devices: loop,1024M` -> an *additional* 1 GB loopback OSD per unit
 
-Total: 2 OSDs per unit × 4 units = 8 OSDs, against `expected-osd-count: 4` on `ceph-mon`. The 1 GB OSDs are below practical minimums, asymmetric with the 512 GB primaries (CRUSH-weighting anti-pattern), and provide no operational value.
+Total: 2 OSDs per unit x 4 units = 8 OSDs, against `expected-osd-count: 4` on `ceph-mon`. The 1 GB OSDs are below practical minimums, asymmetric with the 512 GB primaries (CRUSH-weighting anti-pattern), and provide no operational value.
 
-The remaining `bluestore-db`, `bluestore-wal`, `cache-devices`, and `osd-journals` loopback entries are also being removed — not because they break anything, but because:
+The remaining `bluestore-db`, `bluestore-wal`, `cache-devices`, and `osd-journals` loopback entries are also being removed -- not because they break anything, but because:
 
 1. BlueStore co-locates DB and WAL on the data device when no separate volume is supplied (Ceph Reef BlueStore reference).
 2. Loopback files on the same backing storage as `/dev/vdb` are not "faster than the primary device," so the standard rationale for separate DB/WAL devices doesn't apply.
@@ -95,7 +95,7 @@
 The storage: block declared a second osd-devices entry (loop,1024M) which
 is additive to options.osd-devices per the charm config. That produced
 8 OSDs against expected-osd-count: 4 on ceph-mon, with 1 GB loopback
-OSDs as the asymmetric secondaries — a CRUSH-weighting anti-pattern.
+OSDs as the asymmetric secondaries -- a CRUSH-weighting anti-pattern.
 
 Real production storage (DB/WAL on actual SSDs) will be declared on
 Roosevelt. For the testcloud, BlueStore co-locates DB/WAL on the data
@@ -107,7 +107,7 @@
 ---
 
 
-## 2. design-decisions.md: D-002 — remove Vault from OpenStack-core row
+## 2. design-decisions.md: D-002 -- remove Vault from OpenStack-core row
 
 ### What
 
@@ -115,7 +115,7 @@
 
 ### Why
 
-Vault has its own track per Canonical's charm delivery table — it runs on `1.8/stable`, not `2024.1/stable`. The D-002 table elsewhere (and the actual bundle.yaml) already reflects this; the OpenStack-core row description was a leftover from earlier drafting.
+Vault has its own track per Canonical's charm delivery table -- it runs on `1.8/stable`, not `2024.1/stable`. The D-002 table elsewhere (and the actual bundle.yaml) already reflects this; the OpenStack-core row description was a leftover from earlier drafting.
 
 ### Diff
 
@@ -127,7 +127,7 @@
 ### Commit message
 
 ```
-docs/design-decisions: D-002 — drop vault from OpenStack-core channel row
+docs/design-decisions: D-002 -- drop vault from OpenStack-core channel row
 
 Vault uses 1.8/stable per the Canonical charm delivery table, not the
 2024.1/stable OpenStack-core track. The bundle.yaml already reflects
@@ -139,7 +139,7 @@
 ---
 
 
-## 3. design-decisions.md: D-014 — update repo path
+## 3. design-decisions.md: D-014 -- update repo path
 
 ### What
 
@@ -167,7 +167,7 @@
 ### Commit message
 
 ```
-docs/design-decisions: D-014 — update repo path after move to OpenStack group
+docs/design-decisions: D-014 -- update repo path after move to OpenStack group
 
 Repository moved from jesse.austin/openstack-caracal-ipv4 to the
 OpenStack group on 2026-05-27. GitBucket does not redirect, so the
@@ -184,7 +184,7 @@
 Three hunks in `README.md`:
 
 1. Update the design-decisions reference range from "D-001 through D-016" to "D-001 through D-019" (post-D-017/D-018/D-019 additions).
-2. Replace the inline runbook 00 description (which still mentions backups + capi-mgmt graceful teardown — both invalidated by D-017/D-018).
+2. Replace the inline runbook 00 description (which still mentions backups + capi-mgmt graceful teardown -- both invalidated by D-017/D-018).
 3. Replace the 12-step deploy order with a pointer to the do-document set.
 4. Add a v1 scope reduction note for Designate (per D-019).
 
@@ -196,31 +196,31 @@
 
 ### Diff (four hunks)
 
-**Hunk A — D-range:**
+**Hunk A -- D-range:**
 
 ```diff
--└── docs/
--    └── design-decisions.md          # architectural record (D-001 through D-016)
-+└── docs/
-+    ├── design-decisions.md          # architectural record (D-001 through D-019)
-+    └── netbox-vip-queue.md          # post-deploy NetBox imports (workstream 2)
+-`--- docs/
+-    `--- design-decisions.md          # architectural record (D-001 through D-016)
++`--- docs/
++    |--- design-decisions.md          # architectural record (D-001 through D-019)
++    `--- netbox-vip-queue.md          # post-deploy NetBox imports (workstream 2)
 ```
 
-**Hunk B — runbook 00 description (in the layout block):**
+**Hunk B -- runbook 00 description (in the layout block):**
 
 ```diff
--│   ├── 00-pre-deploy.md             # backups, capi-mgmt graceful teardown
-+│   # (deprecated; see runbooks/deprecated/ — superseded by D-017 + D-018 + v1-do-doc-NN set)
+-|   |--- 00-pre-deploy.md             # backups, capi-mgmt graceful teardown
++|   # (deprecated; see runbooks/deprecated/ -- superseded by D-017 + D-018 + v1-do-doc-NN set)
 ```
 
-**Hunk C — replace the deploy-order block:**
+**Hunk C -- replace the deploy-order block:**
 
 ```diff
 -## v1 deployment order
 -
--1. Verify NetBox state — run NetBox imports if not already applied
--  - `netbox/ipv4-prefixes-import.py` — required
--  - `netbox/ipv6-mark-reserved.py` — required (Q3: tag existing IPv6 entries)
+-1. Verify NetBox state -- run NetBox imports if not already applied
+-  - `netbox/ipv4-prefixes-import.py` -- required
+-  - `netbox/ipv6-mark-reserved.py` -- required (Q3: tag existing IPv6 entries)
 -2. Run pre-flight checks (`scripts/pre-flight-checks.sh`)
 -3. Backup current cloud state (`runbooks/00-pre-deploy.md`)
 -4. Destroy existing OpenStack model (`runbooks/01-destroy-model.md`)
@@ -252,21 +252,21 @@
 +NetBox imports are run separately (gated on external NetBox engineer review; see `netbox/README.md`).
 ```
 
-**Hunk D — v1 scope note about Designate deferral:**
+**Hunk D -- v1 scope note about Designate deferral:**
 
 ```diff
  ## v1-specific design decisions (summary; see docs/design-decisions.md for full record)
 
- - **D-015 v1/v2 fork** — IPv4-only v1; IPv6/dual-stack v2 deferred
- - **D-016 IPv4 tenant pool hybrid model** — NetBox owns upstream `/16` pool; Neutron owns per-project subnets within it
- - **D-003 Option B network architecture** — Provider `/22` carries both ext_net FIPs (`10.12.4.10–.223`) and OpenStack public API VIPs (`10.12.4.224–.254`) on the same L2 segment; fixes the tenant→API unreachability that caused Magnum OCCM crashloop on Bobcat testcloud
- - **D-005 Ceph Squid** — matches Caracal default; rehearses Roosevelt
+ - **D-015 v1/v2 fork** -- IPv4-only v1; IPv6/dual-stack v2 deferred
+ - **D-016 IPv4 tenant pool hybrid model** -- NetBox owns upstream `/16` pool; Neutron owns per-project subnets within it
+ - **D-003 Option B network architecture** -- Provider `/22` carries both ext_net FIPs (`10.12.4.10-.223`) and OpenStack public API VIPs (`10.12.4.224-.254`) on the same L2 segment; fixes the tenant->API unreachability that caused Magnum OCCM crashloop on Bobcat testcloud
+ - **D-005 Ceph Squid** -- matches Caracal default; rehearses Roosevelt
  - **D-006 Vault HA backend = etcd + easyrsa**
- - **D-007 Magnum from day one** — charm in bundle + CAPI Helm driver graft
--- **D-008 DNS via Designate from day one** — static /etc/hosts for bootstrap; Designate handles tenant-level resolution (A records only for v1)
-+- **D-019 (supersedes D-008) DNS scope reduction for v1** — Designate deferred to v2 alongside corporate DNS / NS-delegation work. Tenant subnets use public DNS (`1.1.1.1` / `1.0.0.1`) directly via `--dns-nameserver`. `*.cloud.neumatrix.local` FQDN tree remains internal-only, resolved via static `/etc/hosts` on bootstrap-relevant hosts.
- - **D-009 Hacluster relations included at num_units=1** — decorative on testcloud; documents the relation pattern for Roosevelt scale-up
- - **No OVN pinning on testcloud** — Roosevelt bare-metal will pin via `ovn-source`
+ - **D-007 Magnum from day one** -- charm in bundle + CAPI Helm driver graft
+-- **D-008 DNS via Designate from day one** -- static /etc/hosts for bootstrap; Designate handles tenant-level resolution (A records only for v1)
++- **D-019 (supersedes D-008) DNS scope reduction for v1** -- Designate deferred to v2 alongside corporate DNS / NS-delegation work. Tenant subnets use public DNS (`1.1.1.1` / `1.0.0.1`) directly via `--dns-nameserver`. `*.cloud.neumatrix.local` FQDN tree remains internal-only, resolved via static `/etc/hosts` on bootstrap-relevant hosts.
+ - **D-009 Hacluster relations included at num_units=1** -- decorative on testcloud; documents the relation pattern for Roosevelt scale-up
+ - **No OVN pinning on testcloud** -- Roosevelt bare-metal will pin via `ovn-source`
 ```
 
 ### Commit message
@@ -345,7 +345,7 @@
 runbooks: move superseded files to runbooks/deprecated/
 
 These are replaced by v1-do-doc-NN-*.md execution documents (added in
-follow-up commits). The 01-destroy-model.md runbook stays in place — it's
+follow-up commits). The 01-destroy-model.md runbook stays in place -- it's
 referenced by v1-do-doc-03 as a conditional sub-procedure.
 
 07-dns-zones.md is deferred to v2 per D-019 with no v1 replacement
@@ -391,7 +391,7 @@
 | `07-dns-zones.md` | **deferred to v2 per D-019** (no v1 replacement) |
 | `08-validate.md` | `v1-do-doc-10-validate.md` |
 
-`01-destroy-model.md` is **not** in this directory — it remains active in
+`01-destroy-model.md` is **not** in this directory -- it remains active in
 `runbooks/` and is referenced as a conditional sub-procedure by
 `v1-do-doc-03-destroy.md`.
 ```
@@ -401,7 +401,7 @@
 ```
 runbooks/deprecated: add README explaining the deprecation scope
 
-Includes the deprecated → replacement mapping for operators who arrive
+Includes the deprecated -> replacement mapping for operators who arrive
 via git log searches or stale internal references.
 ```
 
@@ -418,8 +418,8 @@
 
 Per D-019 (added by commit 8 of this change list): Designate is deferred to v2 alongside corporate-DNS / NS-delegation work. v1 testcloud topology investigation (2026-05-27 session) confirmed:
 
-1. **Outside-in DNS** isn't needed for v1 — corporate clients reach the cloud through the existing `openstack.baldurkeep.com → 10.17.4.20 → 10.12.x` HTTPS proxy chain, not via the `*.cloud.neumatrix.local` FQDN tree. The edge nginx (`neumatrix-nginx` at `10.17.8.7`) cannot route to `10.12.x` directly anyway.
-2. **Inside-out DNS** doesn't require Designate — tenant subnets can specify public DNS (`1.1.1.1`, `1.0.0.1`) directly via `--dns-nameserver` at subnet-create time.
+1. **Outside-in DNS** isn't needed for v1 -- corporate clients reach the cloud through the existing `openstack.baldurkeep.com -> 10.17.4.20 -> 10.12.x` HTTPS proxy chain, not via the `*.cloud.neumatrix.local` FQDN tree. The edge nginx (`neumatrix-nginx` at `10.17.8.7`) cannot route to `10.12.x` directly anyway.
+2. **Inside-out DNS** doesn't require Designate -- tenant subnets can specify public DNS (`1.1.1.1`, `1.0.0.1`) directly via `--dns-nameserver` at subnet-create time.
 3. **FIP DNS auto-registration** (the remaining v1 use case for Designate) is nice-to-have, not load-bearing for any v1 acceptance criterion.
 
 Removing Designate now removes one charm, four applications (with subordinate routers), seven relations, and one VIP from the v1 deploy surface, reducing first-deploy troubleshooting scope.
@@ -484,7 +484,7 @@
 **Remove seven relations** from the `relations:` block:
 
 ```yaml
-  # ---- Designate (DNS) — NEW for Caracal v1 per D-008
+  # ---- Designate (DNS) -- NEW for Caracal v1 per D-008
   - [designate-mysql-router:db-router, mysql-innodb-cluster:db-router]
   - [designate-mysql-router:shared-db, designate:shared-db]
   - [designate:identity-service, keystone:identity-service]
@@ -568,25 +568,25 @@
 Three coordinated edits in `docs/design-decisions.md`:
 
 1. Add a new D-019 entry with the full deferral rationale and v2 deltas
-2. Mark D-008 as "superseded by D-019 — v2-scope"
+2. Mark D-008 as "superseded by D-019 -- v2-scope"
 3. Amend D-011 (validation bar) to remove the "Designate resolves" criterion
 
 ### Why
 
 Captures the decision in the authoritative design-decisions record. Preserves the audit trail (D-008 stays with its original content but with the superseded status flag).
 
-### Diff — Hunk A: amend D-008 status
+### Diff -- Hunk A: amend D-008 status
 
 ```diff
  ## D-008: DNS architecture
 
--**Decision:** Layered — static /etc/hosts for bootstrap + Designate (in bundle from day one) for tenant-level resolution.
+-**Decision:** Layered -- static /etc/hosts for bootstrap + Designate (in bundle from day one) for tenant-level resolution.
 +**Status:** Superseded by D-019 (2026-05-27). v2-scope. Original decision text preserved below for audit.
 +
-+**Decision (original; superseded):** Layered — static /etc/hosts for bootstrap + Designate (in bundle from day one) for tenant-level resolution.
++**Decision (original; superseded):** Layered -- static /etc/hosts for bootstrap + Designate (in bundle from day one) for tenant-level resolution.
 ```
 
-### Diff — Hunk B: amend D-011 validation bar
+### Diff -- Hunk B: amend D-011 validation bar
 
 In the D-011 section, the testcloud validation criteria currently list (among others) a Designate resolution check. Remove the relevant bullet.
 
@@ -596,7 +596,7 @@
  **Decision:** v1 testcloud must pass these criteria before being declared "deploy-equivalent" to Roosevelt:
 
  - All charms `active/idle` (per `juju status`)
- - Tenant subnet → OpenStack API reachability (Bobcat Magnum OCCM crashloop regression test)
+ - Tenant subnet -> OpenStack API reachability (Bobcat Magnum OCCM crashloop regression test)
  - Octavia LBaaS end-to-end (LB create + member health + failover + recovery)
  - Magnum CAPI end-to-end (cluster template + cluster create + CREATE_COMPLETE)
  - Vault unseal-after-reboot survives a power cycle
@@ -606,25 +606,25 @@
 +**Amendment (2026-05-27):** Per D-019, the "Designate resolves" criterion is removed for v1. Designate is deferred to v2; tenant subnets resolve via public DNS. v2 will reinstate a DNS-resolution validation criterion calibrated to whatever DNS mechanism is in place (NS delegation from corporate DNS, or otherwise).
 ```
 
-### Diff — Hunk C: add D-019 (new entry, append to end of design-decisions.md)
+### Diff -- Hunk C: add D-019 (new entry, append to end of design-decisions.md)
 
 ```markdown
 ---
 
 
-## D-019: DNS scope reduction for v1 — Designate deferred to v2
+## D-019: DNS scope reduction for v1 -- Designate deferred to v2
 
 **Decision (2026-05-27):** Designate is removed from the v1 testcloud bundle and deferred to v2 alongside corporate DNS / NS delegation work. v1 tenant subnets resolve via public DNS (`1.1.1.1`, `1.0.0.1`) directly via the `--dns-nameserver` option at subnet-create time.
 
 **Supersedes:** D-008 (DNS architecture).
 
-**Amends:** D-011 (validation bar — removes "Designate resolves" criterion).
+**Amends:** D-011 (validation bar -- removes "Designate resolves" criterion).
 
 ### Rationale
 
 Three findings from the 2026-05-27 testcloud topology investigation:
 
-1. **Outside-in DNS** (corporate clients resolving `*.cloud.neumatrix.local`) is not needed for v1. Corporate access to the cloud already flows through the existing `openstack.baldurkeep.com → 10.17.4.20 → 10.12.x` HTTPS proxy chain (handled by the edge nginx at `10.17.8.7`), which does not depend on corporate-side resolution of cloud-internal FQDNs.
+1. **Outside-in DNS** (corporate clients resolving `*.cloud.neumatrix.local`) is not needed for v1. Corporate access to the cloud already flows through the existing `openstack.baldurkeep.com -> 10.17.4.20 -> 10.12.x` HTTPS proxy chain (handled by the edge nginx at `10.17.8.7`), which does not depend on corporate-side resolution of cloud-internal FQDNs.
 
 2. **The edge nginx cannot route to `10.12.x` directly.** Inspection confirmed the edge has only `10.17.8.7/22` plus a tailscale interface; reaching `10.12.4.x` requires the libvirt-host NAT path. Adding DNS to the testcloud would require parallel UDP/53 NAT/proxy plumbing across three hosts (edge nginx, libvirt host, internal nginx) for a feature that has no v1 consumer.
 
@@ -632,14 +632,14 @@
    - Tenant VMs don't need to resolve cloud-internal FQDNs (their API access goes through documented IPs / `--cloud` configs in cloud.conf)
    - Cross-tenant DNS visibility is not a v1 requirement
 
-The remaining v1 use case for Designate (FIP DNS auto-registration via the `neutron-api ↔ designate` integration) is informational only — nothing in v1 consumes those records.
+The remaining v1 use case for Designate (FIP DNS auto-registration via the `neutron-api <-> designate` integration) is informational only -- nothing in v1 consumes those records.
 
 ### v1 implementation
 
 - Tenant subnets created with `--dns-nameserver 1.1.1.1 --dns-nameserver 1.0.0.1` (or via the openrc `OS_DNS_NAMESERVERS` env)
-- CAPI workload cluster template variable `OPENSTACK_DNS_NAMESERVERS` set to `1.1.1.1,1.0.0.1` (per `v1-do-doc-07-capi-bootstrap.md` §13)
-- Cloud-internal `*.cloud.neumatrix.local` FQDN tree resolved via static `/etc/hosts` on bootstrap-relevant hosts (jumphost, openstack0-3, LXD containers per charm bootstrap, capi-mgmt — staged in `v1-do-doc-05-vault-init.md` §11 and `v1-do-doc-07-capi-bootstrap.md` §6)
-- Charms continue to use FQDN-based `os-public-hostname` (cert SANs depend on it) — internal resolution via `/etc/hosts` is sufficient
+- CAPI workload cluster template variable `OPENSTACK_DNS_NAMESERVERS` set to `1.1.1.1,1.0.0.1` (per `v1-do-doc-07-capi-bootstrap.md` sect.13)
+- Cloud-internal `*.cloud.neumatrix.local` FQDN tree resolved via static `/etc/hosts` on bootstrap-relevant hosts (jumphost, openstack0-3, LXD containers per charm bootstrap, capi-mgmt -- staged in `v1-do-doc-05-vault-init.md` sect.11 and `v1-do-doc-07-capi-bootstrap.md` sect.6)
+- Charms continue to use FQDN-based `os-public-hostname` (cert SANs depend on it) -- internal resolution via `/etc/hosts` is sufficient
 
 ### v2 plan
 
@@ -651,7 +651,7 @@
 
 ### v2-residency note
 
-The IPv6 prefixes already imported into NetBox (and marked Reservation status) include allocations that would be appropriate for Designate's VIPs in a v2 design — these stay in NetBox as Reservation until v2 work begins.
+The IPv6 prefixes already imported into NetBox (and marked Reservation status) include allocations that would be appropriate for Designate's VIPs in a v2 design -- these stay in NetBox as Reservation until v2 work begins.
 ```
 
 ### Commit message
@@ -683,7 +683,7 @@
 
 ### Why
 
-Per D-019, Designate has no VIP in v1. `10.12.4.227` becomes unused space within the `10.12.4.224-.254` range — same status as `10.12.4.225` (reserved for v2 ceph-radosgw HA).
+Per D-019, Designate has no VIP in v1. `10.12.4.227` becomes unused space within the `10.12.4.224-.254` range -- same status as `10.12.4.225` (reserved for v2 ceph-radosgw HA).
 
 ### Diff
 
@@ -728,11 +728,11 @@
 +
 +**Reserved (unused in v1):**
 +
-+- `10.12.4.225` — reserved for v2 ceph-radosgw HA (workstream-2 decision)
-+- `10.12.4.227` — reserved for v2 designate (D-019 deferral)
++- `10.12.4.225` -- reserved for v2 ceph-radosgw HA (workstream-2 decision)
++- `10.12.4.227` -- reserved for v2 designate (D-019 deferral)
 ```
 
-(The exact line counts may differ if the existing file has more preamble — adjust to the actual structure when editing.)
+(The exact line counts may differ if the existing file has more preamble -- adjust to the actual structure when editing.)
 
 ### Commit message
 
diff --git a/logs/as-executed-index.md b/logs/as-executed-index.md
new file mode 100644
index 0000000..5b3bddb
--- /dev/null
+++ b/logs/as-executed-index.md
@@ -0,0 +1,9 @@
+# As-executed session index (committed; content stays on the jumphost)
+
+Format: `YYYY-MM-DD | label | operator | scope (one phrase)`
+See docs/as-executed-log-convention.md. Backfill known prior sessions as they
+are referenced; do not reconstruct speculatively.
+
+| date | label | operator | scope |
+|---|---|---|---|
+| (none yet under this convention) | | | |
diff --git a/netbox/README.md b/netbox/README.md
index dea1732..855fd80 100644
--- a/netbox/README.md
+++ b/netbox/README.md
@@ -1,4 +1,4 @@
-# NetBox imports — v1 scope
+# NetBox imports -- v1 scope
 
 This directory contains the NetBox import scripts required for v1 (IPv4-only)
 deployment. Each script is idempotent; re-running is safe.
@@ -26,7 +26,7 @@
 
 Marks existing IPv6 prefixes scoped to VR0 DC0 as **reservation status** per
 **D-015** (v1/v2 fork). The IPv6 entries from earlier session work are NOT
-deleted — they're preserved to document v2 design intent without implying
+deleted -- they're preserved to document v2 design intent without implying
 they are active during v1.
 
 Run order: second (after IPv4 prefixes are in place).
@@ -41,7 +41,7 @@
 
 ## Deferred to v2
 
-### VLAN imports (`vlans-import.py` — removed)
+### VLAN imports (`vlans-import.py` -- removed)
 
 Per the v1/v2 fork session Q2, additional VR0 DC0-VLANs group entries
 (VIDs 50, 200, 220, 221, 222, 230, 260, 270) are **not imported in v1**.
@@ -60,7 +60,7 @@
 The IPv6 prefix entries previously imported (Provider /60 + sub-/64s, Metal
 /60, Data /60, Storage /60, Replication /60, LBaaS Mgmt /60, OOB /60) are
 **reserved** in NetBox via `ipv6-mark-reserved.py`. They become active
-again under the planned `/60 → /64` refactor and full re-import when v2
+again under the planned `/60 -> /64` refactor and full re-import when v2
 work begins.
 
 ## NetBox version
@@ -75,6 +75,6 @@
 
 ## Sequence for v1 deploy gate
 
-1. `python3 ipv4-prefixes-import.py` — succeeds; verification block clean
-2. `python3 ipv6-mark-reserved.py` — succeeds; all IPv6 prefixes now reserved
+1. `python3 ipv4-prefixes-import.py` -- succeeds; verification block clean
+2. `python3 ipv6-mark-reserved.py` -- succeeds; all IPv6 prefixes now reserved
 3. Bundle drafting can proceed; values traced to NetBox are now authoritative
diff --git a/netbox/ipv4-prefixes-import.py b/netbox/ipv4-prefixes-import.py
index 08566b1..20fc694 100644
--- a/netbox/ipv4-prefixes-import.py
+++ b/netbox/ipv4-prefixes-import.py
@@ -9,8 +9,8 @@
   - Tenant pool     10.20.0.0/16       (v1 IPv4 hybrid per D-016; configurable)
 
 Within the Provider /22, two IP Ranges are created:
-  - 10.12.4.10  - 10.12.4.223          (FIP pool — Neutron allocates from here)
-  - 10.12.4.224 - 10.12.4.254          (API VIPs — exclude from Neutron pools)
+  - 10.12.4.10  - 10.12.4.223          (FIP pool -- Neutron allocates from here)
+  - 10.12.4.224 - 10.12.4.254          (API VIPs -- exclude from Neutron pools)
 
 Per D-015 (v1/v2 fork), this script is v1-scope only and adds NO IPv6 prefixes.
 Existing IPv6 entries (Provider /60 carve-outs, etc.) are handled separately
@@ -49,7 +49,7 @@
     sys.exit(1)
 
 # -----------------------------------------------------------------------------
-# Configuration — values traced to NetBox via docs/design-decisions.md (D-003, D-004)
+# Configuration -- values traced to NetBox via docs/design-decisions.md (D-003, D-004)
 # -----------------------------------------------------------------------------
 
 SITE_SLUG = "vr0-dc0"  # VR0 DC0 site
@@ -66,7 +66,7 @@
 PROVIDER_VLAN_GROUP_SLUG = "vr0-dc0-vlans"
 
 # Default IPv4 tenant pool (per D-016). Configurable via TENANT_POOL_CIDR env var.
-# Default 10.20.0.0/16 — 256 /24s available for per-project Neutron-managed tenant subnets.
+# Default 10.20.0.0/16 -- 256 /24s available for per-project Neutron-managed tenant subnets.
 DEFAULT_TENANT_POOL_CIDR = "10.20.0.0/16"
 TENANT_POOL_CIDR = os.environ.get("TENANT_POOL_CIDR", DEFAULT_TENANT_POOL_CIDR)
 
@@ -99,7 +99,7 @@
         "prefix": TENANT_POOL_CIDR,
         "role_slug": ROLE_OPENSTACK_TENANT,
         "description": (
-            "VR0 DC0 OpenStack Tenant pool (v1 IPv4 hybrid per D-016) — "
+            "VR0 DC0 OpenStack Tenant pool (v1 IPv4 hybrid per D-016) -- "
             "Neutron-managed per-project /24 carve-outs within this pool"
         ),
         "vlan_vid": None,
@@ -113,13 +113,13 @@
         "start": "10.12.4.10/22",
         "end": "10.12.4.223/22",
         "role_slug": ROLE_PROVIDER,
-        "description": "FIP pool — Neutron allocates floating IPs from this range",
+        "description": "FIP pool -- Neutron allocates floating IPs from this range",
     },
     {
         "start": "10.12.4.224/22",
         "end": "10.12.4.254/22",
         "role_slug": ROLE_PROVIDER,
-        "description": "API VIPs — charm hacluster VIPs (exclude from Neutron allocation_pools)",
+        "description": "API VIPs -- charm hacluster VIPs (exclude from Neutron allocation_pools)",
     },
 ]
 
@@ -199,7 +199,7 @@
             existing.update(payload)
             print(f"  UPDATED prefix {cidr} (id={existing.id}) role={cfg['role_slug']}")
         else:
-            print(f"  EXISTS  prefix {cidr} (id={existing.id}) — skipped (use --update to overwrite)")
+            print(f"  EXISTS  prefix {cidr} (id={existing.id}) -- skipped (use --update to overwrite)")
 
 
 def create_or_report_iprange(nb, cfg: dict, update: bool = False) -> None:
@@ -225,13 +225,13 @@
             existing.update(payload)
             print(f"  UPDATED IP Range {start} - {end} (id={existing.id})")
         else:
-            print(f"  EXISTS  IP Range {start} - {end} (id={existing.id}) — skipped")
+            print(f"  EXISTS  IP Range {start} - {end} (id={existing.id}) -- skipped")
 
 
 def verify(nb, site) -> None:
     print()
     print("=" * 72)
-    print(f"Verification — final state for site {SITE_NAME} (id={site.id})")
+    print(f"Verification -- final state for site {SITE_NAME} (id={site.id})")
     print("=" * 72)
 
     print("\nIPv4 Prefixes:")
diff --git a/netbox/ipv6-mark-reserved.py b/netbox/ipv6-mark-reserved.py
index 10477e1..7446f4e 100644
--- a/netbox/ipv6-mark-reserved.py
+++ b/netbox/ipv6-mark-reserved.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-NetBox IPv6 entries — mark as Reservation status (v1/v2 fork support).
+NetBox IPv6 entries -- mark as Reservation status (v1/v2 fork support).
 
 Per D-015 (v1/v2 fork) and Q3 from the v1/v2 fork session: existing IPv6
 prefixes scoped to VR0 DC0 are NOT decommissioned. They remain in NetBox to
@@ -86,7 +86,7 @@
 
 
 def is_ipv6(prefix_str: str) -> bool:
-    """Cheap and safe check — IPv6 prefixes contain ':' in the CIDR."""
+    """Cheap and safe check -- IPv6 prefixes contain ':' in the CIDR."""
     return ":" in prefix_str
 
 
@@ -181,7 +181,7 @@
     # Verification block
     print()
     print("=" * 72)
-    print(f"Verification — IPv6 prefixes at site {SITE_NAME}")
+    print(f"Verification -- IPv6 prefixes at site {SITE_NAME}")
     print("=" * 72)
     final = find_ipv6_prefixes_at_site(nb, site)
     for p in final:
diff --git a/policies/overrides.zip b/policies/overrides.zip
new file mode 100644
index 0000000..93b6070
--- /dev/null
+++ b/policies/overrides.zip
Binary files differ
diff --git a/runbooks/appendix-A-troubleshooting.md b/runbooks/appendix-A-troubleshooting.md
index 9e8fb9e..dabda22 100644
--- a/runbooks/appendix-A-troubleshooting.md
+++ b/runbooks/appendix-A-troubleshooting.md
@@ -557,3 +557,37 @@
          real address conflict; stop and investigate.
 NOW AUTOMATED: scripts/carve-host-interfaces.sh release_self_discovered() does
          this, gated to self-owned records only.
+
+
+--------------------------------------------------------------------------------
+## mysql-innodb-cluster recovery (D-062 material)  [added DOCFIX-077]
+--------------------------------------------------------------------------------
+SYMPTOM: unit blocked "'cluster' missing, Instance not yet configured for clustering"
+CAUSE:   single-unit deploy -- the reactive charm bootstraps ONLY from the peer-
+         relation handler; num_units=1 never fires it (D-062).
+FIX:     deploy at 3 from cold. Do NOT wait it out; add the peers.
+
+SYMPTOM: instanceErrors ["...not managed by InnoDB cluster. Use cluster.rescan()..."]
+CAUSE:   metadata half-join -- artifact of MID-LIFE instance addition, not cold boot.
+FIX:     cluster.rescan({addInstances:"auto"}) via mysqlsh as clusteruser. The
+         charm's bare `cluster-rescan` action REPORTS but does not adopt.
+
+SYMPTOM: after full-cloud outage, units report Cluster is OFFLINE / complete outage
+FIX:     `juju run mysql-innodb-cluster/leader reboot-cluster-from-complete-outage`
+         -- ONLY on a CONFIRMED complete outage. Against an already-reformed
+         cluster this action is DESTRUCTIVE (rewrites topology from the unit it
+         runs on). Always read cluster state first (ops-restart-procedure Stage 2).
+GATE:    3x "Cluster is ONLINE", exactly one "Mode: R/W".
+
+--------------------------------------------------------------------------------
+## Point-of-use identifier index  [added DOCFIX-077]
+--------------------------------------------------------------------------------
+These identifiers are DEFINED where they are used (runbook/bundle comments), not
+in the decision docs; indexed here so no reference dangles:
+  DOCFIX-027/028/029  phase-00/01-era MAAS + libvirt fixes -- defined inline in
+                      the phase-00/phase-01 runbooks at their step of use.
+  DOCFIX-034/037      phase-04/05-era network/amphora fixes -- inline at use.
+  BUNDLEFIX-001..006  bundle-comment fixes predating the changelog convention --
+                      defined in bundle.yaml comments beside the lines they fix.
+Rule going forward: new identifiers get EITHER a changelog/decision entry OR an
+index line here at introduction time (repo-lint L5 guards duplicates).
diff --git a/runbooks/appendix-C-identity-rbac.md b/runbooks/appendix-C-identity-rbac.md
index 3988239..c60f07a 100644
--- a/runbooks/appendix-C-identity-rbac.md
+++ b/runbooks/appendix-C-identity-rbac.md
@@ -63,15 +63,26 @@
 
 Pre-attach re-check on the jumphost (from the repo working copy), then attach:
 
-```
-# 1) validate the file before attaching (YAML + ASCII + connector lint)
-python3 -c 'import yaml,sys; d=yaml.safe_load(open("policies/domain-manager-policy.yaml")); print("YAML OK:",len(d),"rules")'
-LC_ALL=C grep -nP "[^\x00-\x7F]" policies/domain-manager-policy.yaml && { echo "NON-ASCII -- STOP"; exit 1; } || echo "ASCII clean"
-grep -nE "\)\s+(rule:|role:|token|project_id|domain_id|user_id|None:)" policies/domain-manager-policy.yaml && { echo "MALFORMED connector -- STOP"; exit 1; } || echo "connector lint clean"
+NOTE (DOCFIX-071): deploy-time delivery is now BUNDLE-NATIVE -- keystone carries
+`resources: policyd-override: ./policies/overrides.zip`, so a fresh deploy applies the
+policy with no manual attach. THIS block is the LIVE-UPDATE path (changing the policy on
+a running cloud), and the drift guard: `provider-bundle-check.py` verifies the committed
+zip's content matches `policies/domain-manager-policy.yaml`, so rebuild + recommit the
+zip whenever the yaml changes.
 
-# 2) package and attach (the zip's top-level file name is what keystone reads)
-cd policies && zip -j /tmp/overrides.zip domain-manager-policy.yaml && cd -
-juju attach-resource -m openstack keystone policyd-override=/tmp/overrides.zip
+```
+( {
+  # 1) validate the file before attaching (YAML + ASCII + connector lint)
+  python3 -c 'import yaml,sys; d=yaml.safe_load(open("policies/domain-manager-policy.yaml")); print("YAML OK:",len(d),"rules")' || exit 1
+  LC_ALL=C grep -nP "[^\x00-\x7F]" policies/domain-manager-policy.yaml && { echo "NON-ASCII -- STOP"; exit 1; } || echo "ASCII clean"
+  grep -nE "\)\s+(rule:|role:|token|project_id|domain_id|user_id|None:)" policies/domain-manager-policy.yaml && { echo "MALFORMED connector -- STOP"; exit 1; } || echo "connector lint clean"
+
+  # 2) package (repo copy, so the committed artifact and the attached one are the SAME
+  #    bytes) and attach. $HOME-adjacent path -- attach-resource CANNOT read /tmp on this
+  #    jumphost (snap confinement; the previous /tmp form here was the known-broken shape).
+  ( cd policies && zip -X -j overrides.zip domain-manager-policy.yaml ) || exit 1
+  juju attach-resource -m openstack keystone policyd-override="$PWD/policies/overrides.zip"
+} )
 ```
 
 Gate: `juju status -m openstack keystone` must move from `PO (broken)` to `PO:` and settle
diff --git a/runbooks/ops-restart-procedure.md b/runbooks/ops-restart-procedure.md
new file mode 100644
index 0000000..6688018
--- /dev/null
+++ b/runbooks/ops-restart-procedure.md
@@ -0,0 +1,151 @@
+# Ops -- Full-Cloud Restart / Recovery Procedure
+
+STATUS: committed to the repo per DOCFIX-075 (previously lived only as an
+operator-local document + a jumphost-local health script -- unreachable by a
+Roosevelt team and by any fresh clone). Procedure lineage: authored and
+validated 2026-05-20 on the prior build; adapted 2026-07-03 to current repo
+references (appendix-A, cloud-assert, D-043). Stages whose mechanics depend on
+build state carry [REVALIDATE] markers -- clear them on the first executed
+restart of the current build and record the as-executed date here.
+
+Scope: PLANNED maintenance windows taking all four hosts down, or UNPLANNED
+recovery from full power/network loss that took MySQL or Vault offline
+together. For single-host partial failures, use the targeted entries in
+`runbooks/appendix-A-troubleshooting.md` instead.
+
+Conventions: RUN/CHECK/GATE labels per runbooks/README.md. One gated step at a
+time. Invoke scripts as `bash scripts/<name>.sh` (no exec bits in the repo).
+
+---
+
+## Pre-shutdown (planned only)
+
+**RUN -- jumphost** -- baseline capture (reference, not a restore path)
+```bash
+( {
+  juju switch | grep -q 'openstack' || { echo "FAIL: switch to the openstack model first"; exit 1; }
+  BAK=~/openstack-baseline/$(date -u +%Y%m%d-%H%M%S)-pre-maintenance
+  mkdir -p "$BAK"
+  juju export-bundle --filename "$BAK/bundle.yaml"
+  juju status --format=yaml > "$BAK/juju-status.yaml"
+  for v in $(env | awk -F= '/^OS_/{print $1}'); do unset "$v"; done
+  # shellcheck source=/dev/null
+  source ~/admin-openrc
+  openstack server list --all-projects     </dev/null > "$BAK/servers.txt"
+  openstack loadbalancer list              </dev/null > "$BAK/loadbalancers.txt"
+  openstack loadbalancer amphora list      </dev/null > "$BAK/amphorae.txt"
+  echo "Pre-maintenance snapshot at $BAK"
+} )
+```
+
+**Guest auto-resume policy (D-043, ADOPTED):** `nova-compute
+resume-guests-state-on-host-boot=true` is charm config in the bundle. Running
+guests resume automatically on host boot, honoring per-guest pre-shutdown
+state -- so a guest you want to stay down for forensics must be
+`openstack server stop`ped BEFORE the window. NOTE the D-043 caveat: the
+in-cloud CAPI mgmt VM (capi-mgmt-v2) is a control-plane component riding a
+tenant VM; it WILL auto-resume with the rest. Its manual-start policy (D-041)
+now governs deliberate stops only.
+
+## Shutdown sequence
+
+1. (Optional) stop guests you want held down post-maintenance.
+2. Power down hosts via MAAS/IPMI/virsh. Order not significant among
+   openstack0-3 (functional peers).
+
+## Power-on / recovery
+
+### Stage 1 -- foundation
+**GATE:** every juju machine agent reports `started` (typically 2-5 min).
+```bash
+juju machines --format=json | jq -r '.machines | to_entries[]
+  | "\(.key)  agent=\(.value."juju-status".current)"' | grep -v 'agent=started' \
+  || echo "all machines started"
+```
+
+### Stage 2 -- MySQL InnoDB cluster
+Check FIRST; act only on a confirmed outage. `reboot-cluster-from-complete-outage`
+is DESTRUCTIVE against an already-reformed cluster (it rewrites topology from
+the unit it runs on). See appendix-A "mysql-innodb-cluster recovery" for the
+signature table (D-062 material).
+
+**CHECK (read-only) -- jumphost**
+```bash
+juju status mysql-innodb-cluster --format=json | jq -r \
+  '.applications."mysql-innodb-cluster".units | to_entries[]
+   | "\(.key)  \(.value."workload-status".message // "")"'
+```
+**GATE:** three units `Cluster is ONLINE`, exactly one `Mode: R/W`. If ALL
+units report a complete outage (and only then):
+```bash
+juju run mysql-innodb-cluster/leader reboot-cluster-from-complete-outage
+```
+
+### Stage 3 -- Vault unseal (sealed-after-restart is BY DESIGN)
+Vault stores in MySQL and always restarts sealed; manual 3-of-5 unseal is the
+v1 standard (D-011 amendment). Keys are NOT in version control -- custody per
+D-069 / docs/security-ledger.md. Missing keys = recovery BLOCKER: escalate,
+never improvise (re-init wipes the TLS plane).
+
+**RUN -- jumphost** (hidden prompts; keys never in argv/history)
+```bash
+( {
+  for i in 1 2 3; do
+    read -s -p "Unseal key $i: " K; echo
+    juju ssh vault/0 -- "VAULT_ADDR=http://127.0.0.1:8200 vault operator unseal $K" </dev/null >/dev/null
+    unset K
+  done
+  juju ssh vault/0 -- 'VAULT_ADDR=http://127.0.0.1:8200 vault status 2>&1 | grep -E "Sealed|Initialized"' </dev/null
+} )
+```
+**GATE:** `Sealed=false`.
+
+### Stage 4 -- OVN chassis
+**CHECK:** `connection-status` on every chassis (cloud-assert A4 runs this).
+If any is not `connected`, run the post-vault TLS restart sweep (appendix-A;
+restart ovn-controller / ovs-vswitchd / neutron-server on affected units),
+then re-probe. [REVALIDATE: sweep unit list against current topology]
+
+### Stage 5 -- guests
+With D-043 in force, pre-shutdown-running guests should be ACTIVE.
+```bash
+openstack server list --all-projects -c Name -c Status </dev/null
+```
+Unexpectedly SHUTOFF guests: `openstack server start <name>`; if MANY are
+down, verify `juju config nova-compute resume-guests-state-on-host-boot`
+(a regressed flag takes effect only on the NEXT boot -- start manually now).
+
+### Stage 6 -- Octavia LBs
+Expect auto-recovery once amphora VMs resume. Any LB stuck
+`provisioning_status=ERROR` after ~5 min: `openstack loadbalancer failover
+<lb>` and poll to ACTIVE (VIP + FIP are preserved). [REVALIDATE: timing
+budget on current build]
+
+### Stage 7 -- end-to-end behavioral gate
+```bash
+source ~/admin-openrc
+bash scripts/cloud-assert.sh
+```
+**GATE:** `CLOUD-ASSERT: PASS`. Any FAIL routes to appendix-A by its message.
+This replaces the old jumphost-local `post-maintenance-health-check.sh`.
+
+---
+
+## Quick reference (symptom -> fix)
+
+| Symptom | Fix |
+|---|---|
+| Units in `error` (stuck relation-broken hook) | `juju resolved --no-retry <unit>` |
+| MySQL will not reform | Stage 2 -- action ONLY on confirmed complete outage |
+| Vault sealed | Expected; Stage 3 manual unseal |
+| Chassis `not connected` | Stage 4 TLS sweep |
+| Hypervisor `down`, juju green | restart nova-compute on the host; recheck in 60s |
+| LB `provisioning_status=ERROR` | `loadbalancer failover`; appendix-A LB entries |
+| Horizon login cookie failure | restore `_99_internal_http_cookies.py` (D-044) |
+
+## Open question (carried for Roosevelt)
+Amphora cert validity across long outages: a resumed amphora keeps pre-shutdown
+cert material; if the amphora-control-plane CA rotated during the window it
+will fail to health-manager and be failed-over. Theoretical under default TTLs
+for short outages; validate explicitly on bare metal (rotate CA, hard-stop an
+amphora host, observe resume vs ERROR->failover) before relying on resume.
diff --git a/runbooks/phase-00-teardown-maas-reset.md b/runbooks/phase-00-teardown-maas-reset.md
index 3ef3e6a..39a7800 100644
--- a/runbooks/phase-00-teardown-maas-reset.md
+++ b/runbooks/phase-00-teardown-maas-reset.md
@@ -1,43 +1,69 @@
-# Phase 00 -- Teardown + Pattern A Reset (D-060)
+# Phase 00 -- Teardown + Pattern A Reset (D-060 / D-061)
 
-Destroy the `openstack` Juju model, delete the orphaned `capi-mgmt` MAAS machine, and reset
-the four hosts (openstack0-3) to a clean, **Pattern A**, deploy-ready state on the EXISTING
-**D-052/D-053** plane scheme. This is the rebuild-prep window -- it runs BEFORE phase-01.
+Remove the `openstack` Juju model, delete the orphaned `capi-mgmt` MAAS machine, and bring
+the four hosts (openstack0-3) back to a deploy-ready state on the EXISTING **D-052/D-053**
+plane scheme. This is the rebuild-prep window -- it runs BEFORE phase-01.
 
 The deterministic, repeatable work is owned by SCRIPTS (each resolves every id live and is
 dry-run by default); the destructive juju + libvirt steps stay human-gated here. Run from
 jumphost `vopenstack-jesse` (user `jessea123`, sudo; also the libvirt hypervisor); MAAS CLI
-logged in as profile `admin`.
+logged in as profile `admin`. Invoke every script as `bash scripts/<name>.sh` -- the repo
+does not carry exec bits (DOCFIX-069: the Windows commit path strips them; a bare
+invocation fails "Permission denied" on a fresh clone).
 
-Decisions: **D-060** (Pattern A revert; supersedes D-057/D-058), D-018 (MAAS-release-direct
-teardown), D-017 (full rebuild every cycle, nothing preserved). The live MAAS is already on
-D-052/D-053, so there is **NO re-CIDR** -- the carve re-establishes Pattern A interfaces on
-the existing subnets.
+Decisions: **D-061** (teardown fork: machine-preserving vs full-destroy; supersedes D-055),
+**D-060** (Pattern A revert; supersedes D-057/D-058), D-018 (teardown intent), D-017 (full
+rebuild every cycle, nothing preserved). The live MAAS is already on D-052/D-053, so there
+is **NO re-CIDR** -- the carve re-establishes Pattern A interfaces on the existing subnets.
 
-!!! DESTRUCTIVE. The model destroy + host release (Step 2) and the OSD wipe (Step 4) are
-    irreversible. There is NO model-state rollback (D-017): the repo runbooks ARE the tested
-    restore path. Each destructive step is DISCRETE and individually gated -- do not batch.
+!!! DESTRUCTIVE. The teardown (Step 2) and the OSD wipe (Step 4) are irreversible. There is
+    NO model-state rollback (D-017): the repo runbooks ARE the tested restore path. Each
+    destructive step is DISCRETE and individually gated -- do not batch.
+
+!!! DO NOT USE the old `phase-00-teardown.sh`. It is DEPRECATED (DOCFIX-057 / D-061): its
+    "destroy-model releases hosts to Ready" premise is WRONG on this virsh-pod MAAS --
+    destroy-model DECOMPOSES the pod-composed machines (observed 3x). Use the D-061 pair
+    below. (DOCFIX-066 replaced the old spine of this runbook, which still drove it.)
 
 CAPI-MGMT: the orphaned `capi-mgmt` MAAS machine (retired D-033 out-of-cloud node) is
-**DELETED** by `scripts/phase-00-teardown.sh` -- it is no longer left Ready. The in-cloud
-`capi-mgmt-v2` tenant VM (phase-06) dies with the model.
+**DELETED** by BOTH D-061 teardown scripts. The in-cloud `capi-mgmt-v2` tenant VM (phase-06)
+dies with the model.
 
 ---
 
-## Sequence (this phase)
+## Step 2 has two paths -- choose deliberately (D-061)
+
+| | Path B -- DESTROY (default redeploy spine) | Path A -- RELEASE (machine-preserving) |
+|---|---|---|
+| Script | `bash scripts/phase-00-teardown-destroy.sh` | `bash scripts/phase-00-teardown-release.sh` |
+| Machines after | DECOMPOSED (gone from MAAS; libvirt domains survive) | kept in MAAS, Deployed, carve intact |
+| Then | reenroll (Step 2b) + wipe + carve + standup -> phase-01 | model gone; hosts untouched |
+| Status | VALIDATED end-to-end (this is the rehearsed full-redeploy path) | UNVALIDATED on this virsh-pod MAAS -- canary first |
+| Use when | standard full redeploy (fresh Ceph/MySQL/identity) | model-only teardown / surgery where hosts must survive |
+
+**Path A honesty note (D-061 amendment):** the release script's canary validates machine
+SURVIVAL (host not decomposed after `remove-machine --keep-instance`). It does NOT yet
+validate RE-ACQUISITION -- juju's MAAS provider allocates Ready machines, and a kept host
+stays Deployed, so how a NEXT model re-adopts it is the open half. Until both halves pass,
+Path A is NOT a route into phase-01; the standard redeploy is Path B. First Path A use:
+`bash scripts/phase-00-teardown-release.sh --apply --canary` (openstack0 only, verify, STOP).
+
+## Sequence (this phase, Path B)
 ```
-1. Pre-flight            (read-only; baseline)
-2. Teardown              scripts/phase-00-teardown.sh --apply   [DESTRUCTIVE: model + capi-mgmt]
-   -- hosts release to MAAS Ready, powered off --
-3. 8_lbaas net removal   one-off jumphost op                    [hosts off]
-4. OSD secondary wipe    vdb -> blank 512G                      [DESTRUCTIVE; hosts off]
-5. Pattern A re-carve    scripts/carve-host-interfaces.sh <host> --apply   [hosts Ready]
-6. Standup + bundle gate scripts/phase-00-maas-standup.sh ; provider-bundle-check.py  [read-only]
-   -> EXIT GATE -> phase-01 deploy
+1.  Pre-flight            (read-only; baseline)
+2.  Teardown (destroy)    bash scripts/phase-00-teardown-destroy.sh --apply  [DESTRUCTIVE: model + machines + capi-mgmt]
+    -- machines decomposed from MAAS; libvirt domains remain, shut off --
+3.  8_lbaas net removal   one-off jumphost op                                [domains off]
+4.  OSD secondary wipe    vdb -> blank 512G                                  [DESTRUCTIVE; domains off]
+5.  Reenroll              bash scripts/reenroll-hosts.sh                     [creates MAAS objects; auto-commission -> Ready]
+6.  Pattern A re-carve    bash scripts/carve-host-interfaces.sh <host> --apply   [hosts Ready]
+7.  Standup + bundle gate bash scripts/phase-00-maas-standup.sh ; provider-bundle-check.py  [read-only]
+    -> EXIT GATE -> phase-01 deploy
 ```
-Steps 3-6 all run with the hosts Ready and powered off (the carve edits MAAS interface
-metadata; 8_lbaas + OSD operate on libvirt). The phase-01 deploy powers the hosts on and
-applies the carved netplan.
+Steps 3-4 operate on libvirt only (valid while the hosts are absent from MAAS). Step 5
+requires the libvirt domains to EXIST (reenroll re-creates MAAS machine objects, not VMs)
+and leaves all four Ready. Step 6 requires Ready (`link-subnet` is REJECTED on a Deployed
+machine). The phase-01 deploy powers the hosts on and applies the carved netplan.
 
 ## Step 1 -- Pre-flight (READ-ONLY)
 
@@ -62,39 +88,46 @@
 } )
 ```
 
-## Step 2 -- Teardown (D-018 / D-060)  DISCRETE / DESTRUCTIVE
+## Step 2 -- Teardown, Path B: DESTROY (D-061)  DISCRETE / DESTRUCTIVE
 
-`scripts/phase-00-teardown.sh` is the authority: it resolves the four host system_ids live
-(no hardcoded ids), HARD-EXCLUDES the management substrate (juju, lxd, tailscale), destroys
-the `openstack` model, and deletes the orphaned `capi-mgmt` machine. A pre-destroy juju
-export/status capture runs first (reference only; NOT a restore path).
+`scripts/phase-00-teardown-destroy.sh` is the authority: it resolves the four host
+system_ids live (no hardcoded ids), HARD-EXCLUDES the management substrate (juju, lxd,
+tailscale), destroys the `openstack` model (machines decompose -- the destroy path
+EMBRACES the pod behavior that D-061 documents), and deletes the orphaned `capi-mgmt`
+machine. A pre-destroy juju export/status capture runs first (reference only; NOT a
+restore path).
 
 **CHECK (read-only) -- jumphost** -- dry-run first (default; changes nothing)
 ```bash
-scripts/phase-00-teardown.sh
+bash scripts/phase-00-teardown-destroy.sh
 ```
-**Expect:** the four openstack hosts listed as release targets + `capi-mgmt` as the delete
-target; PROTECTED juju / lxd / tailscale shown as excluded. Confirm the resolved system_ids
-look right before applying.
+**Expect:** the four openstack hosts listed as decompose targets + `capi-mgmt` as the
+delete target; PROTECTED juju / lxd / tailscale shown as excluded. Confirm the resolved
+system_ids look right before applying.
 
-> CAUTION: destroys the entire `openstack` Juju model and DELETES the `capi-mgmt` MAAS
-> machine -- irreversible. Confirm you are on the test cloud, not Roosevelt.
+> CAUTION: destroys the entire `openstack` Juju model, DECOMPOSES openstack0-3 out of
+> MAAS, and DELETES the `capi-mgmt` MAAS machine -- irreversible. Confirm you are on the
+> test cloud, not Roosevelt. The script requires the model name typed at a gate.
 
 **RUN -- jumphost**
 ```bash
-scripts/phase-00-teardown.sh --apply
+bash scripts/phase-00-teardown-destroy.sh --apply
 ```
-**GATE:** `juju models` shows no `openstack`; `maas admin machines read` shows openstack0-3
-all `Ready` and `capi-mgmt` gone. (`link-subnet` is REJECTED on a Deployed machine -- the
-carve in Step 5 REQUIRES Ready.) If the model is still `destroying` after ~10 min:
+**GATE:** `juju models` shows no `openstack`; `maas admin machines read` shows NO
+openstack0-3 and NO `capi-mgmt`; `sudo virsh list --all` still shows the four domains
+(shut off). If the model is still `destroying` after ~10 min:
 `juju remove-machine -m openstack --force <id>` for each lingering id, then re-run --apply.
 
-## Step 3 -- Remove the idle 8_lbaas libvirt network (hosts off)  one-off
+*(Path A -- RELEASE -- is NOT part of this sequence. If a machine-preserving teardown is
+what you need, stop here and run `bash scripts/phase-00-teardown-release.sh` per its
+header: canary first, and note the re-acquisition caveat above.)*
+
+## Step 3 -- Remove the idle 8_lbaas libvirt network (domains off)  one-off
 
 Each host still carries an idle `virtio` NIC on the isolated `8_lbaas` libvirt network
 (bridge `virbr6`, no L3, ex-lbaas). MAAS has no `lbaas` space; the NIC is unused. Remove it
-now while the hosts are shut off. This is a one-off jumphost op (Roosevelt is bare metal, no
-libvirt nets) -- it is NOT part of any phase-00 script; log it to the as-executed log.
+now while the domains are shut off. This is a one-off jumphost op (Roosevelt is bare metal,
+no libvirt nets) -- it is NOT part of any phase-00 script; log it to the as-executed log.
 
 > CAUTION: detaches a NIC from each host's persistent domain config and undefines a libvirt
 > network. Reversible (XML backed up first); the detach uses `--config` only (no live change).
@@ -110,11 +143,12 @@
 
 ## Step 4 -- OSD secondary-disk wipe (clean-slate Ceph)  DISCRETE / DESTRUCTIVE
 
-Only after Step 2 GATE is green (hosts Ready, shut off) AND explicit go. `vda` (the OS disk)
-is NOT touched -- MAAS reinstalls it on deploy; only `vdb` (the OSD target) is recreated blank.
+Only after Step 2 GATE is green (model gone, domains shut off) AND explicit go. `vda` (the
+OS disk) is NOT touched -- MAAS reinstalls it on deploy; only `vdb` (the OSD target) is
+recreated blank.
 
 > CAUTION: deletes and recreates each host's vdb OSD disk (512G blank) -- destroys all Ceph
-> OSD data. vda is untouched. Hosts must be shut off (post-release). (R7: sudo for qemu-img.)
+> OSD data. vda is untouched. Domains must be shut off. (R7: sudo for qemu-img.)
 
 **RUN -- jumphost**
 ```bash
@@ -133,7 +167,27 @@
 ```
 **GATE:** 4 files, ~200 KiB actual / 512 GiB virtual, root:root mode 600.
 
-## Step 5 -- Pattern A interface re-carve (per host; machines Ready)
+## Step 5 -- Reenroll the hosts into MAAS (post-decompose)
+
+`scripts/reenroll-hosts.sh` re-creates the MAAS machine objects for the four still-existing
+libvirt domains (it does NOT create VMs) and polls them through auto-commissioning to Ready.
+It is discover-assert-pin idempotent (only creates the missing) and reads the libvirt SSH
+password interactively -- never as an argument. NOTE the script header's standing item: the
+libvirt SSH credential was exposed by `power-parameters` on 2026-06-26 -- rotate it after
+the rebuild.
+
+**CHECK (read-only) -- jumphost**
+```bash
+bash scripts/reenroll-hosts.sh --check
+```
+**RUN -- jumphost**
+```bash
+bash scripts/reenroll-hosts.sh
+```
+**GATE:** all four openstack0-3 report `Ready` (script exit 0). System_ids are NEWLY MINTED
+this enrollment (DOCFIX-040) -- never reuse ids from a previous cycle or a document.
+
+## Step 6 -- Pattern A interface re-carve (per host; machines Ready)
 
 `scripts/carve-host-interfaces.sh` rebuilds each host's interface tree to **Pattern A** on
 the EXISTING D-052/D-053 subnets:
@@ -148,7 +202,7 @@
 
 **CHECK (read-only) -- jumphost** -- dry-run each host first (default)
 ```bash
-for h in openstack0 openstack1 openstack2 openstack3; do scripts/carve-host-interfaces.sh "$h"; done
+for h in openstack0 openstack1 openstack2 openstack3; do bash scripts/carve-host-interfaces.sh "$h"; done
 ```
 **Expect:** each plan ends `Summary: 0 fatal`; the provider plane shows
 `create br-ex (OVS) parent=enp1s0` and `br-ex -> STATIC 10.12.4.N`; metal / internal / data /
@@ -159,17 +213,17 @@
 
 **RUN -- jumphost** (per host)
 ```bash
-scripts/carve-host-interfaces.sh openstack0 --apply
+bash scripts/carve-host-interfaces.sh openstack0 --apply
 # then openstack1, openstack2, openstack3 (one at a time)
 ```
 **GATE:** each host shows `br-ex` (type ovs) STATIC `10.12.4.N`; `br-metal` `10.12.8.N`;
 `br-internal` `10.12.12.N`; `enp8s0`/`enp9s0`/`enp10s0` STATIC on `10.12.16/32/36.N`.
 
-## Step 6 -- Standup + bundle gate (READ-ONLY; before deploy)
+## Step 7 -- Standup + bundle gate (READ-ONLY; before deploy)
 
 **CHECK (read-only) -- jumphost** -- MAAS topology
 ```bash
-scripts/phase-00-maas-standup.sh
+bash scripts/phase-00-maas-standup.sh
 ```
 **Expect:** `no drift` and `OK (dryrun) -- topology consistent with D-052/D-053`. Any DRIFT
 line is a hard stop (do not deploy onto a mis-bound plane).
@@ -179,12 +233,13 @@
 python3 scripts/provider-bundle-check.py bundle.yaml
 ```
 **Expect:** `PASS` -- 11 charms `public->provider-public`, `.4/.8/.12` VIP triples, all 4
-chassis MACs present (incl openstack0).
+chassis MACs present (incl openstack0), relations well-formed, mysql at 3 units (D-062),
+keystone policyd resource wired (DOCFIX-071).
 
 ---
 
 ## EXIT GATE (phase-00 complete)
-- `juju models` shows no `openstack`; openstack0-3 all Ready; `capi-mgmt` DELETED.
+- `juju models` shows no `openstack`; openstack0-3 all Ready (fresh system_ids); `capi-mgmt` DELETED.
 - `8_lbaas` libvirt network gone; no host domain references it.
 - OSD vdb files 512 GiB blank (root:root, 600) on all four hosts.
 - Pattern A interfaces on all four: `br-ex` (OVS) STATIC `.4.N`; `br-metal` `.8.N`;
diff --git a/runbooks/phase-01-bundle-deploy.md b/runbooks/phase-01-bundle-deploy.md
index b323278..84c36f1 100644
--- a/runbooks/phase-01-bundle-deploy.md
+++ b/runbooks/phase-01-bundle-deploy.md
@@ -19,10 +19,23 @@
 - Hardened `bundle.yaml` in the working dir (channels pinned; VIPs `.50-.60`;
   reserved-host-memory 8192; image-conversion; use-policyd-override).
 
+**GATE (DOCFIX-073) -- run THE pre-deploy gate before add-model:**
+```bash
+bash scripts/preflight.sh
+```
+Expect `PREFLIGHT: PASS` (repo lint + bundle invariants + Charmhub channel
+assert + live MAAS pre-flight, aggregated). WARN = review then decide; FAIL =
+do not deploy. This is the single entry point that replaced the six separate
+gate artifacts an operator previously had to remember.
+
 ## Constants and env-literals
-- MAAS system_ids: openstack0=`4na83t`, openstack1=`qdbqd6`, openstack2=`h8frng`, openstack3=`tmsafc`.
-- MAAS subnet ids: 1=provider 10.12.4.0/22, 2=metal 10.12.8.0/22, 6=data 10.12.12.0/22,
-  7=storage 10.12.16.0/22, 8=replication 10.12.20.0/22, 9=lbaas 10.12.32.0/22.
+- Host identity / system_ids: resolve LIVE via `scripts/lib-hosts.sh` (DOCFIX-040:
+  system_ids are re-minted on every reenrollment -- a documented id is stale by
+  definition; never paste one into a command).
+- Planes / CIDRs / VIP bands: `scripts/lib-net.sh` is the single authority
+  (D-052/D-053). Resolve MAAS subnets BY CIDR (PATTERN-1), never by numeric
+  subnet id -- ids drift across MAAS lifecycles. (DOCFIX-068 removed a stale
+  pre-D-052 literal map that sat here.)
 - expected plan: 50 apps, 97 relations, 4 machines (bundle 8/9/10/11 -> juju 0/1/2/3), 24 LXD.
 
 ## Run-location legend
@@ -289,7 +302,7 @@
 
 ### 1.0-GEN.c -- Controller cert (EC P-256 UNENCRYPTED, SAN, signed by Controller CA, 2y)
 The P-256 key is unencrypted -- Octavia reads it at startup. SAN carries the controller
-FQDN, the octavia API FQDN, and the Octavia API VIP 10.12.4.233.
+FQDN, the octavia API FQDN, and the Octavia API VIP (derived from the bundle at generation time -- DOCFIX-067; never a baked literal).
 
 **RUN -- jumphost**
 ```bash
@@ -315,8 +328,17 @@
 [alt_names]
 DNS.1 = octavia-controller.omega.dc0.vr0.cloud.neumatrix.local
 DNS.2 = octavia.omega.dc0.vr0.cloud.neumatrix.local
-IP.1 = 10.12.4.233
 CNF
+  # DOCFIX-067: the SAN IP is DERIVED from the bundle (provider leg of octavia's
+  # vip triple), never a literal -- the old baked 10.12.4.233 went stale when R14
+  # relocated the VIPs to .50-.60. Measured value is echoed; confirm it before
+  # the sign. BUNDLE may be overridden if the hardened bundle lives elsewhere.
+  BUNDLE="${BUNDLE:-$HOME/openstack-caracal-ipv4/bundle.yaml}"
+  [ -r "$BUNDLE" ] || { echo "FAIL: bundle not readable at $BUNDLE (set BUNDLE=)"; exit 1; }
+  OCTAVIA_VIP=$(python3 -c "import yaml;print(yaml.safe_load(open('$BUNDLE'))['applications']['octavia']['options']['vip'].split()[0])" 2>/dev/null || true)
+  echo "measured octavia provider VIP: ${OCTAVIA_VIP:-<none>}"
+  echo "$OCTAVIA_VIP" | grep -qE '^10\.12\.4\.[0-9]{1,3}$' || { echo "FAIL: implausible VIP -- stop"; exit 1; }
+  printf 'IP.1 = %s\n' "$OCTAVIA_VIP" >> controller.cnf
   openssl req -new -sha256 -key controller.key -config controller.cnf -out controller.csr
   openssl x509 -req -sha256 -in controller.csr \
     -CA ../controller-ca/controller-ca.cert.pem \
diff --git a/runbooks/phase-03-core-verify.md b/runbooks/phase-03-core-verify.md
index be02c2e..0144997 100644
--- a/runbooks/phase-03-core-verify.md
+++ b/runbooks/phase-03-core-verify.md
@@ -261,6 +261,33 @@
 
 ---
 
+## Step 3.4 -- Keystone domain-manager policy gate (D-051 / D-064 / DOCFIX-071)
+
+The SCS Domain Manager policy now ships IN THE BUNDLE (keystone `resources:
+policyd-override: ./policies/overrides.zip` -- DOCFIX-071), so a clean deploy must
+arrive with it applied. `PO:` in juju status proves the zip PARSED, not that the
+policy WORKS (the charm validates YAML only -- D-051); the gate is therefore
+two-stage: status, then behavior.
+
+**CHECK (read-only) -- jumphost** -- stage 1: override loaded
+```bash
+( {
+  ST=$(juju status -m openstack keystone --format=line 2>/dev/null || true)
+  echo "$ST" | grep -q 'PO:' && echo "OK: policy override loaded (PO:)"     || { echo "FAIL: keystone does not show PO: -- override missing or broken"; echo "$ST"; }
+} )
+```
+**GATE:** `PO:` present (NOT `PO (broken)`). If FAIL on a fresh deploy, the bundle
+resource did not land -- check `policies/overrides.zip` exists in the deploy clone and
+re-attach per appendix-C C.3 ($HOME-pathed; /tmp is snap-blocked for attach-resource).
+
+**CHECK (read-only) -- jumphost** -- stage 2: behavioral G3 (the policy WORKS)
+Run the appendix-C **C.4 G3 probe** end-to-end: as a domain-scoped `manager`,
+create user + project and grant member/load-balancer_member within the OWN domain
+(PASS); attempt an `admin` grant and a cross-domain read (both DENIED); confirm a
+cloud-admin operation is unaffected (PASS).
+**GATE:** all three G3 outcomes exactly as stated. Do NOT proceed to phase-04 on a
+`PO:`-only pass -- D-046 taught that "reports ready" is not "works".
+
 ## EXIT GATE (phase-03 complete)
 - Cloud settled: acceptance walk shows only the expected block(s) (octavia; maybe gss).
 - Every haproxy backend UP/L7OK by the functional sweep (DOCFIX-031), not merely juju active/idle.
diff --git a/runbooks/phase-07-conductor-graft.md b/runbooks/phase-07-conductor-graft.md
index b0ef98e..ad81133 100644
--- a/runbooks/phase-07-conductor-graft.md
+++ b/runbooks/phase-07-conductor-graft.md
@@ -246,7 +246,8 @@
 # AND symlink /usr/bin/helm -> it (/usr/bin IS on the restricted init PATH). Checksum-verified.
 juju ssh -m openstack magnum/0 'set -e
   WANT=v3.17.3
-  if [ -x /usr/bin/helm ] && /usr/bin/helm version --short 2>/dev/null | grep -q "$WANT"; then
+  HV=$(/usr/bin/helm version --short 2>/dev/null || true)
+  if [ -x /usr/bin/helm ] && [ -n "$HV" ] && [ "${HV#*$WANT}" != "$HV" ]; then
     echo "[SKIP] /usr/bin/helm already $WANT"
   else
     T=helm-$WANT-linux-amd64.tar.gz
diff --git a/scripts/channel_assert.py b/scripts/channel_assert.py
new file mode 100644
index 0000000..7310520
--- /dev/null
+++ b/scripts/channel_assert.py
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""
+channel_assert.py -- assert every charm channel pinned in the bundle EXISTS on
+Charmhub (DOCFIX-073; fulfils the D-002 "verify against Charmhub before each
+deploy" claim, which pre-flight never actually implemented).
+
+For each unique charm->channel in bundle.yaml, runs `juju info <charm>` and
+checks the pinned channel appears in the published channel map. Catches: typo'd
+channels, tracks retired upstream, and pins drifting from what Charmhub serves.
+
+Exit: 0 all pins exist | 1 a pinned channel is absent (do NOT deploy)
+    | 2 charmhub/juju unreachable for one or more charms (verify manually).
+Read-only. ASCII + LF. Usage: python3 scripts/channel_assert.py [bundle.yaml]
+"""
+import sys, subprocess, re
+try:
+    import yaml
+except ImportError:
+    sys.stderr.write("ERROR: PyYAML required\n"); sys.exit(2)
+
+def main():
+    path = sys.argv[1] if len(sys.argv) > 1 else "bundle.yaml"
+    try:
+        apps = (yaml.safe_load(open(path)) or {}).get("applications", {}) or {}
+    except Exception as e:
+        print("  [FAIL] cannot parse %s: %s" % (path, e)); return 1
+    pins = {}
+    for name, a in apps.items():
+        ch = (a or {}).get("channel"); charm = (a or {}).get("charm")
+        if ch and charm:
+            pins.setdefault((str(charm), str(ch)), []).append(name)
+    fails, warns = [], []
+    for (charm, channel), users in sorted(pins.items()):
+        # capture-then-test (house SIGPIPE rule); juju info output lists channels
+        # as '  <track>/<risk>: <rev> ...' lines
+        try:
+            r = subprocess.run(["juju", "info", charm], capture_output=True,
+                               text=True, timeout=60)
+            out = r.stdout + r.stderr
+        except Exception as e:
+            warns.append("%s: juju info failed (%s) -- verify %s manually" % (charm, e, channel))
+            continue
+        if r.returncode != 0 or "channels:" not in out:
+            warns.append("%s: no channel map returned -- verify %s manually (offline?)" % (charm, channel))
+            continue
+        if re.search(r"(?m)^\s+%s:\s" % re.escape(channel), out):
+            print("  [ok]   %-22s %-16s (%s)" % (charm, channel, ", ".join(users)))
+        else:
+            fails.append("%s pinned to %s but Charmhub does not publish it (apps: %s)"
+                         % (charm, channel, ", ".join(users)))
+    for w in warns: print("  [WARN] %s" % w)
+    for f in fails: print("  [FAIL] %s" % f)
+    v = "FAIL" if fails else ("WARN" if warns else "PASS")
+    print("\n%s: channel assert (%d pins, %d fail, %d warn)" % (v, len(pins), len(fails), len(warns)))
+    return 1 if fails else (2 if warns else 0)
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/cloud-assert.sh b/scripts/cloud-assert.sh
new file mode 100644
index 0000000..205f212
--- /dev/null
+++ b/scripts/cloud-assert.sh
@@ -0,0 +1,180 @@
+#!/usr/bin/env bash
+# scripts/cloud-assert.sh [--capture] [MODEL]
+#
+# Behavioral cloud verifier (DOCFIX-075). Runs EVERY "the service's own verdict"
+# gate learned from the D-045/D-046/D-051/D-042 incident family -- the checks
+# juju status is BLIND to -- as one idempotent, read-only sweep. Run it:
+# post-deploy (phase-08 acceptance), post-restart (ops-restart-procedure Stage 7),
+# pre-change baseline, and post-incident. Absorbs the jumphost-local
+# post-maintenance-health-check.sh (which was never version-controlled).
+#
+# Sections (each independent; worst exit wins):
+#   A0 juju reachable; no units in error/blocked (carried gss 'unknown' tolerated)
+#   A1 vault: Initialized=true, Sealed=false (sealed-after-reboot is BY DESIGN --
+#      the FIX is manual unseal per ops-restart-procedure, not a redeploy)
+#   A2 mysql: 3 units 'Cluster is ONLINE', exactly one R/W (D-062 world)
+#   A3 OVN central: Cluster ID uniform across the 3 units, both NB + SB DBs
+#   A4 OVN chassis: ovn-controller 'connected' on every nova-compute + octavia
+#   A5 compute plane: hypervisors up, compute services enabled+up   [needs OS_*]
+#   A6 octavia: every LB provisioning=ACTIVE + operating=ONLINE (skip if none) [OS_*]
+#   A7 identity/magnum behavior: keystone shows 'PO:' (D-051/DOCFIX-071);
+#      trustee domain 'magnum' + magnum_domain_admin exist (D-046);
+#      'openstack coe service list' returns the conductor row (no 403)  [OS_*]
+#   A8 conductor graft: magnum-conductor LIVE process args carry --config-dir
+#      (D-037: verify the launched cmdline, never the config text)
+#
+# --capture: additionally writes a deploy BOM (bill of materials) to
+#   asbuilt/<UTC timestamp>/ : exported bundle, juju status yaml, driver pip
+#   version, image list. Commit the directory -- it is the drift baseline for
+#   Roosevelt multi-DC comparison. Capture is the ONLY write this script does,
+#   and only under asbuilt/.
+#
+# Requirements: jumphost with juju; sections A5-A7 need an admin scope
+# (source ~/admin-openrc first) -- absent scope is a HOLD (exit 2), not a skip,
+# so a half-run is never mistaken for a pass.
+# Exit: 0 all pass | 1 any FAIL | 2 warnings/holds only.  ASCII + LF.
+
+set -uo pipefail
+shopt -s inherit_errexit 2>/dev/null || true
+
+MODEL="openstack"; CAPTURE=0
+for a in "$@"; do
+  case "$a" in
+    --capture) CAPTURE=1 ;;
+    -*) echo "FAIL: unknown flag $a"; exit 1 ;;
+    *) MODEL="$a" ;;
+  esac
+done
+J() { juju "$@" </dev/null 2>&1; }   # capture-then-test everywhere (SIGPIPE rule)
+WORST=0
+fail() { echo "  [FAIL] $*"; WORST=1; }
+warn() { echo "  [WARN] $*"; [ "$WORST" -ne 1 ] && WORST=2; }
+ok()   { echo "  [ok]   $*"; }
+
+command -v juju >/dev/null 2>&1 || { echo "FAIL: juju not found"; exit 1; }
+command -v jq   >/dev/null 2>&1 || { echo "FAIL: jq required"; exit 1; }
+
+echo "================ A0: juju model + unit states ================"
+ST=$(J status -m "$MODEL" --format=json || true)
+if ! jq -e .applications >/dev/null 2>&1 <<<"$ST"; then
+  fail "cannot read juju status for model '$MODEL'"; echo "$ST" | head -3
+  echo; echo "CLOUD-ASSERT: FAIL (model unreachable)"; exit 1
+fi
+BAD=$(jq -r '.applications | to_entries[] as $app | ($app.value.units // {}) | to_entries[]
+      | select(.value["workload-status"].current | IN("error","blocked"))
+      | "\(.key) \(.value["workload-status"].current): \(.value["workload-status"].message // "")"' <<<"$ST" || true)
+UNK=$(jq -r '.applications | to_entries[] as $app | ($app.value.units // {}) | to_entries[]
+      | select(.value["workload-status"].current == "unknown") | .key' <<<"$ST" || true)
+if [ -n "$BAD" ]; then while IFS= read -r l; do fail "unit $l"; done <<<"$BAD"
+else ok "no units in error/blocked"; fi
+if [ -n "$UNK" ]; then
+  if grep -qv 'glance-simplestreams-sync' <<<"$UNK"; then warn "units 'unknown' beyond parked gss: $(tr '\n' ' ' <<<"$UNK")"
+  else ok "only parked gss reports 'unknown' (documented carry)"; fi
+fi
+
+echo "================ A1: vault unsealed ================"
+V=$(J ssh -m "$MODEL" vault/0 -- 'VAULT_ADDR=http://127.0.0.1:8200 vault status 2>&1' || true)
+grep -q 'Initialized *true'  <<<"$V" || fail "vault not initialized"
+if grep -q 'Sealed *false' <<<"$V"; then ok "vault Initialized=true Sealed=false"
+else fail "vault SEALED -- manual 3-of-5 unseal (ops-restart-procedure Stage 3); sealed-after-restart is by design"; fi
+
+echo "================ A2: mysql innodb cluster ================"
+M=$(jq -r '.applications["mysql-innodb-cluster"].units // {} | to_entries[]
+     | "\(.key) \(.value["workload-status"].message // "")"' <<<"$ST" || true)
+N=$(grep -c 'Cluster is ONLINE' <<<"$M" || true)
+RW=$(grep -c 'Mode: R/W' <<<"$M" || true)
+[ "${N:-0}" -eq 3 ] || fail "mysql ONLINE units=$N (want 3): $(tr '\n' ' | ' <<<"$M")"
+[ "${RW:-0}" -eq 1 ] || fail "mysql R/W count=$RW (want exactly 1)"
+[ "${N:-0}" -eq 3 ] && [ "${RW:-0}" -eq 1 ] && ok "mysql 3x ONLINE, exactly one R/W"
+
+echo "================ A3: OVN central cluster unity ================"
+UNITS=$(jq -r '.applications["ovn-central"].units // {} | keys[]' <<<"$ST" || true)
+if [ -z "$UNITS" ]; then warn "ovn-central units not found -- skipped"
+else
+  for spec in 'OVN_Northbound:ovnnb_db.ctl' 'OVN_Southbound:ovnsb_db.ctl'; do
+    db=${spec%%:*}; sock=${spec##*:}; IDS=""
+    while IFS= read -r u; do
+      O=$(J ssh -m "$MODEL" "$u" -- "sudo ovs-appctl -t /var/run/ovn/${sock} cluster/status ${db} 2>&1" || true)
+      CID=$(awk '/^Cluster ID/{print $3; exit}' <<<"$O")
+      [ -n "$CID" ] && IDS="$IDS $CID" || fail "$u: no Cluster ID for $db"
+    done <<<"$UNITS"
+    U=$(tr ' ' '\n' <<<"$IDS" | sed '/^$/d' | sort -u | wc -l)
+    [ "$U" -eq 1 ] && ok "$db Cluster ID uniform across units" || fail "$db Cluster IDs differ:$IDS"
+  done
+fi
+
+echo "================ A4: OVN chassis connectivity ================"
+CH=$(jq -r '.applications | to_entries[] | select(.key=="nova-compute" or .key=="octavia")
+     | .value.units // {} | keys[]' <<<"$ST" || true)
+if [ -z "$CH" ]; then warn "no chassis principals found -- skipped"
+else while IFS= read -r u; do
+  C=$(J ssh -m "$MODEL" "$u" -- 'sudo ovn-appctl -t ovn-controller connection-status 2>&1' | tr -d '\r' || true)
+  grep -q '^connected' <<<"$C" && ok "$u chassis connected" \
+    || fail "$u chassis NOT connected ($C) -- post-vault TLS sweep (appendix-A / restart Stage 4)"
+done <<<"$CH"; fi
+
+if [ -z "${OS_AUTH_URL:-}" ]; then
+  warn "A5-A7 HELD: no admin scope in env (source ~/admin-openrc, then re-run)"
+else
+  echo "================ A5: compute plane ================"
+  H=$(openstack hypervisor list -f json </dev/null 2>&1 || true)
+  if jq -e . >/dev/null 2>&1 <<<"$H"; then
+    DOWN=$(jq -r '.[] | select((.State // ."state") != "up") | (."Hypervisor Hostname" // .hypervisor_hostname)' <<<"$H" || true)
+    [ -z "$DOWN" ] && ok "all hypervisors up" || fail "hypervisors down: $(tr '\n' ' ' <<<"$DOWN") (restart nova-compute; see appendix-A)"
+  else fail "hypervisor list unreadable: $(head -1 <<<"$H")"; fi
+  S=$(openstack compute service list -f json </dev/null 2>&1 || true)
+  BADS=$(jq -r '.[] | select(.Status=="enabled" and .State!="up") | "\(.Binary)@\(.Host)"' <<<"$S" 2>/dev/null || true)
+  [ -z "$BADS" ] && ok "all enabled compute services up" || fail "compute services down: $(tr '\n' ' ' <<<"$BADS")"
+
+  echo "================ A6: octavia load balancers ================"
+  L=$(openstack loadbalancer list -f json </dev/null 2>&1 || true)
+  if jq -e . >/dev/null 2>&1 <<<"$L"; then
+    CNT=$(jq 'length' <<<"$L")
+    if [ "$CNT" -eq 0 ]; then ok "no LBs present (nothing to assert)"
+    else
+      BADL=$(jq -r '.[] | select(.provisioning_status!="ACTIVE" or .operating_status!="ONLINE")
+             | "\(.name) prov=\(.provisioning_status) op=\(.operating_status)"' <<<"$L" || true)
+      [ -z "$BADL" ] && ok "$CNT LB(s) ACTIVE/ONLINE" \
+        || fail "LBs unhealthy: $(tr '\n' ' | ' <<<"$BADL") (failover pattern: ops-restart-procedure Stage 6)"
+    fi
+  else warn "octavia not answering (absent?): $(head -1 <<<"$L")"; fi
+
+  echo "================ A7: identity + magnum behavior ================"
+  KS=$(J status -m "$MODEL" keystone --format=line || true)
+  if grep -q 'PO (broken)' <<<"$KS"; then fail "keystone PO (broken) -- policy zip attached but unparsed"
+  elif grep -q 'PO:' <<<"$KS"; then ok "keystone policy override loaded (PO:) -- run G3 (appendix-C C.4) for the behavioral gate"
+  else fail "keystone shows NO policy override (DOCFIX-071: redeploy shipped without domain-manager RBAC?)"; fi
+  D=$(openstack domain show magnum -f value -c enabled </dev/null 2>&1 || true)
+  grep -q '^True$' <<<"$D" && ok "trustee domain 'magnum' exists (D-046)" \
+    || fail "trustee domain 'magnum' missing -- run 'juju run magnum/leader domain-setup' (D-046)"
+  U=$(openstack user show magnum_domain_admin --domain magnum -f value -c name </dev/null 2>&1 || true)
+  grep -q '^magnum_domain_admin$' <<<"$U" && ok "magnum_domain_admin exists" || fail "magnum_domain_admin missing (D-046)"
+  C=$(openstack coe service list -f value -c binary </dev/null 2>&1 || true)
+  grep -q 'magnum-conductor' <<<"$C" && ok "coe service list returns conductor (no 403)" \
+    || fail "coe service list has no conductor row: $(head -1 <<<"$C")"
+fi
+
+echo "================ A8: conductor graft (launched args, D-037) ================"
+P=$(J ssh -m "$MODEL" magnum/0 -- 'ps -ww -C magnum-conductor -o args= 2>&1' || true)
+if grep -q -- '--config-dir /etc/magnum/magnum.conf.d' <<<"$P"; then ok "conductor runs with --config-dir (graft live)"
+elif grep -qi 'no such\|not found\|cannot' <<<"$P"; then warn "magnum/0 unreachable for A8: $(head -1 <<<"$P")"
+else fail "conductor LIVE args lack --config-dir (graft not in effect; config-file presence proves nothing): $(head -1 <<<"$P")"; fi
+
+if [ "$CAPTURE" -eq 1 ]; then
+  echo "================ CAPTURE: as-built BOM ================"
+  DIR="asbuilt/$(date -u +%Y%m%d-%H%M%S)"; mkdir -p "$DIR"
+  J export-bundle -m "$MODEL" > "$DIR/bundle-exported.yaml" || warn "export-bundle failed"
+  printf '%s\n' "$ST" > "$DIR/juju-status.json"
+  J ssh -m "$MODEL" magnum/0 -- 'pip show magnum-capi-helm 2>/dev/null | egrep "Version|Location"' > "$DIR/driver-version.txt" || true
+  if [ -n "${OS_AUTH_URL:-}" ]; then
+    openstack image list --long -f json </dev/null > "$DIR/images.json" 2>/dev/null || true
+  fi
+  ok "BOM written to $DIR -- commit it (Roosevelt drift baseline)"
+fi
+
+case "$WORST" in
+  0) echo; echo "CLOUD-ASSERT: PASS" ;;
+  2) echo; echo "CLOUD-ASSERT: WARN/HELD -- review before trusting" ;;
+  *) echo; echo "CLOUD-ASSERT: FAIL" ;;
+esac
+exit "$WORST"
diff --git a/scripts/phase-00-teardown.sh b/scripts/phase-00-teardown.sh
deleted file mode 100644
index 2b6064e..0000000
--- a/scripts/phase-00-teardown.sh
+++ /dev/null
@@ -1,165 +0,0 @@
-#!/usr/bin/env bash
-# scripts/phase-00-teardown.sh [--apply] [--no-prompt]
-#
-# !!! DEPRECATED (DOCFIX-057 / D-061). DO NOT USE. Superseded by:
-#   scripts/phase-00-teardown-destroy.sh  -- full destroy + decompose (reenroll path)
-#   scripts/phase-00-teardown-release.sh  -- machine-preserving (remove-machine --keep-instance)
-# This script's premise is WRONG: the header + PLAN below claim "destroy-model releases
-# openstack0-3 to Ready". On this virsh-pod MAAS, destroy-model DECOMPOSES the pod-composed
-# machines regardless of --destroy-storage (D-061, observed 3x). It does NOT release to Ready.
-# Retained only for history; the two scripts above replace it. See docs/design-decisions.md D-061.
-#
-# Gated teardown for the Pattern A revert (D-060). Destroys the `openstack` Juju model and
-# deletes the orphaned `capi-mgmt` MAAS machine, so the hosts release to Ready for the
-# Pattern A re-carve/standup-verify/rebuild. HARD-EXCLUDES the management substrate (juju, lxd, tailscale):
-# those system_ids are resolved and asserted OUT of every target set -- the script
-# refuses to run if a target ever resolves to a protected machine.
-#
-# Machine roster (measured from `maas admin machines read`, 2026-06-29):
-#   PROTECTED (never touched): juju, lxd, tailscale         -- management substrate
-#   HOSTS (released to Ready):  openstack0, openstack1, openstack2, openstack3
-#   ORPHAN (deleted):           capi-mgmt                   -- retired CAPI mgmt machine
-# The in-cloud capi-mgmt-v2 Nova VM is NOT a MAAS machine; it dies with the model destroy.
-#
-# DEFAULT = DRY-RUN AUDIT: resolves every system_id, prints the plan (what is destroyed,
-# what is protected), changes nothing. `--apply` executes; the irreversible destroy-model
-# requires typing the model name at a /dev/tty prompt first (skip with --no-prompt for
-# tested automation). destroy-model releases openstack0-3 to Ready; this script does NOT
-# run a blind machine-release loop (avoids racing Juju's own release).
-#
-# Storage: destroy-model uses --destroy-storage (full teardown; data is discarded -- intended).
-# If destroy hangs on stuck units, re-run with FORCE=1 (adds --force --no-wait).
-#
-# Exit: 0 ok | 1 fatal / unsafe (target intersects substrate, host missing) | 2 aborted by operator
-# ASCII + LF.
-
-set -euo pipefail
-shopt -s inherit_errexit 2>/dev/null || true
-
-MAAS_PROFILE="${MAAS_PROFILE:-admin}"
-MODEL="${OPENSTACK_MODEL:-openstack}"
-HOSTS=(openstack0 openstack1 openstack2 openstack3)
-ORPHANS=(capi-mgmt)
-PROTECTED=(juju lxd tailscale)
-
-MODE="dryrun"; PROMPT=1
-for a in "$@"; do
-  case "$a" in
-    --apply) MODE="apply" ;;
-    --no-prompt) PROMPT=0 ;;
-    *) echo "unknown arg: $a" >&2; exit 1 ;;
-  esac
-done
-FATAL=0
-
-hdr()  { echo; echo "=== $* ==="; }
-note() { echo "  - $*"; }
-fail() { echo "FAIL: $*" >&2; FATAL=$((FATAL+1)); }
-command -v jq >/dev/null || { echo "FATAL: jq required" >&2; exit 1; }
-command -v juju >/dev/null || { echo "FATAL: juju not on PATH" >&2; exit 1; }
-
-maas_json() { local o; o="$(maas "$MAAS_PROFILE" "$@" 2>/dev/null || true)"; printf '%s' "$o" | jq empty 2>/dev/null && printf '%s' "$o" || printf '[]'; }
-
-# one read of the machine roster; resolve everything from it
-MACHINES_JSON="$(maas_json machines read)"
-sid_of()    { printf '%s' "$MACHINES_JSON" | jq -r --arg h "$1" '.[]|select(.hostname==$h)|.system_id' | head -1; }
-status_of() { printf '%s' "$MACHINES_JSON" | jq -r --arg h "$1" '.[]|select(.hostname==$h)|.status_name' | head -1; }
-
-emit() {  # <desc> <cmd...>
-  local desc="$1"; shift
-  if [ "$MODE" = apply ]; then
-    echo "  DO: $desc"
-    local out
-    if ! out="$("$@" 2>&1)"; then
-      fail "$desc"; echo "       said: $(printf '%s' "$out" | head -3 | tr '\n' ' ')" >&2; return 1
-    fi
-  else
-    echo "  WOULD: $desc"; echo "         $*"
-  fi
-}
-
-hdr "teardown audit  mode=$MODE  model=$MODEL"
-
-# --- resolve protected substrate (must exist; will NOT be touched) ---
-declare -A PROT_SID
-hdr "PROTECTED substrate (never touched)"
-for p in "${PROTECTED[@]}"; do
-  s="$(sid_of "$p")"
-  if [ -z "$s" ]; then note "$p: not in MAAS (already absent) -- nothing to protect"; continue; fi
-  PROT_SID["$s"]="$p"; note "$p = $s  (status $(status_of "$p")) -- PROTECTED"
-done
-
-# --- resolve hosts (must exist; released to Ready via destroy-model) ---
-HSID=()
-hdr "HOSTS (released to Ready by destroy-model)"
-for h in "${HOSTS[@]}"; do
-  s="$(sid_of "$h")"
-  if [ -z "$s" ]; then fail "$h: not found in MAAS -- cannot proceed (roster mismatch)"; continue; fi
-  if [ -n "${PROT_SID[$s]:-}" ]; then fail "$h resolves to PROTECTED sid $s (${PROT_SID[$s]}) -- ABORT"; continue; fi
-  HSID+=("$s"); note "$h = $s  (status $(status_of "$h"))"
-done
-
-# --- resolve orphans (deleted; absent is fine) ---
-declare -A OSID
-hdr "ORPHANS (deleted from MAAS)"
-for o in "${ORPHANS[@]}"; do
-  s="$(sid_of "$o")"
-  if [ -z "$s" ]; then note "$o: absent -- SKIP (nothing to delete)"; continue; fi
-  if [ -n "${PROT_SID[$s]:-}" ]; then fail "$o resolves to PROTECTED sid $s (${PROT_SID[$s]}) -- ABORT"; continue; fi
-  OSID["$s"]="$o"; note "$o = $s  (status $(status_of "$o")) -- DELETE"
-done
-
-# --- model presence ---
-MODEL_PRESENT=0
-if juju models --format=json 2>/dev/null | jq -e --arg m "$MODEL" '.models[]?|select(.name==$m or (.name|endswith("/"+$m)))' >/dev/null 2>&1; then
-  MODEL_PRESENT=1; note "juju model '$MODEL' is PRESENT -- will destroy"
-else
-  note "juju model '$MODEL' not present -- destroy will be skipped"
-fi
-
-[ "$FATAL" -eq 0 ] || { echo; echo "ABORT: $FATAL safety failure(s) above -- nothing was changed"; exit 1; }
-
-hdr "PLAN"
-echo "  1) destroy juju model '$MODEL'  (--destroy-storage${FORCE:+ --force --no-wait}; releases openstack0-3 to Ready)"
-echo "       [$([ "$MODEL_PRESENT" = 1 ] && echo 'present -> will run' || echo 'absent -> skip')]"
-echo "  2) delete orphan MAAS machine(s): ${ORPHANS[*]}"
-echo "  3) verify openstack0-3 reach Ready; confirm substrate untouched"
-echo "  PROTECTED (asserted out of all targets): ${PROTECTED[*]}"
-
-if [ "$MODE" = dryrun ]; then
-  echo; echo "  re-run with --apply to execute (you will be asked to type the model name)."
-  echo "OK (dryrun)"; exit 0
-fi
-
-# ---- apply: irreversible-destroy confirmation ----
-if [ "$PROMPT" -eq 1 ] && [ "$MODEL_PRESENT" = 1 ]; then
-  printf 'Type the model name "%s" to confirm IRREVERSIBLE destroy: ' "$MODEL" > /dev/tty
-  read -r ans < /dev/tty
-  [ "$ans" = "$MODEL" ] || { echo "aborted (got '$ans', expected '$MODEL') -- nothing changed"; exit 2; }
-fi
-
-hdr "MUTATE 1/3: destroy model"
-if [ "$MODEL_PRESENT" = 1 ]; then
-  if [ -n "${FORCE:-}" ]; then
-    emit "destroy model $MODEL (FORCE)" juju destroy-model "$MODEL" --destroy-storage --force --no-wait --no-prompt
-  else
-    emit "destroy model $MODEL" juju destroy-model "$MODEL" --destroy-storage --no-prompt
-  fi
-else note "model absent -- skip"; fi
-[ "$FATAL" -eq 0 ] || { echo; echo "STOP: destroy-model failed -- not deleting orphans. Investigate (FORCE=1 if units are stuck)."; exit 1; }
-
-hdr "MUTATE 2/3: delete orphan machines"
-for s in "${!OSID[@]}"; do emit "delete orphan ${OSID[$s]} ($s)" maas "$MAAS_PROFILE" machine delete "$s" || true; done
-[ "$FATAL" -eq 0 ] || { echo; echo "completed with $FATAL failure(s)"; exit 1; }
-
-hdr "VERIFY 3/3 (read-only): host status + substrate intact"
-MACHINES_JSON="$(maas_json machines read)"
-for h in "${HOSTS[@]}"; do
-  st="$(status_of "$h")"
-  if [ "$st" = "Ready" ]; then note "$h -> $st"
-  else note "$h -> $st (Juju release may still be in progress; re-check, or release manually if it stalls)"; fi
-done
-for p in "${PROTECTED[@]}"; do note "PROTECTED $p -> $(status_of "$p") (unchanged)"; done
-
-echo; echo "next (hosts Ready): 8_lbaas libvirt-net removal -> carve-host-interfaces.sh <host> (Pattern A) -> phase-00-maas-standup.sh (verify D-052/D-053)"
-echo "OK (apply)"
diff --git a/scripts/phase-02-vault-preflight.sh b/scripts/phase-02-vault-preflight.sh
index 8789d85..afe5ade 100644
--- a/scripts/phase-02-vault-preflight.sh
+++ b/scripts/phase-02-vault-preflight.sh
@@ -57,8 +57,8 @@
 
 # MODEL present? Spaces and units are per-model; a model typo would otherwise
 # read as a healthy empty model. Strip any owner/ prefix; match the bare name.
-if ! juju models --format json 2>/dev/null | jq -r '.models[]?.name' 2>/dev/null \
-     | sed 's#.*/##' | grep -qx "$MODEL"; then
+MODELS=$(juju models --format json 2>/dev/null | jq -r '.models[]?.name' 2>/dev/null | sed 's#.*/##' || true)
+if ! grep -qx "$MODEL" <<<"$MODELS"; then   # capture-then-test (SIGPIPE rule; grep -q on a live pipe races pipefail)
   note "model '$MODEL' not present -- run 'juju add-model $MODEL' first"
   echo "Summary: precondition (model absent)"
   exit 2
diff --git a/scripts/phase-03-core-verify.sh b/scripts/phase-03-core-verify.sh
index 19b1723..33ee909 100644
--- a/scripts/phase-03-core-verify.sh
+++ b/scripts/phase-03-core-verify.sh
@@ -44,8 +44,8 @@
 juju whoami || { fail "juju whoami failed (auth/macaroon)"; echo "Summary: HOLD (auth)"; exit 1; }
 echo
 
-if ! juju models --format json 2>/dev/null | jq -r '.models[]?.name' 2>/dev/null \
-     | sed 's#.*/##' | grep -qx "$MODEL"; then
+MODELS=$(juju models --format json 2>/dev/null | jq -r '.models[]?.name' 2>/dev/null | sed 's#.*/##' || true)
+if ! grep -qx "$MODEL" <<<"$MODELS"; then   # capture-then-test (SIGPIPE rule; grep -q on a live pipe races pipefail)
   echo "NOTE: model '$MODEL' not present -- run 'juju add-model $MODEL' first"
   echo "Summary: precondition (model absent)"
   exit 2
diff --git a/scripts/phase-04-internal-cert-san-verify.sh b/scripts/phase-04-internal-cert-san-verify.sh
index a77dedc..dfbbc71 100644
--- a/scripts/phase-04-internal-cert-san-verify.sh
+++ b/scripts/phase-04-internal-cert-san-verify.sh
@@ -71,7 +71,10 @@
     printf 'NO-SAN   %-12s %s  (cert present, missing %s)\n' "$svc" "$hp" "$host"; FATAL=$((FATAL + 1))
     printf '         SAN: %s\n' "$(printf '%s' "$san" | tr '\n' ' ' | sed 's/  */ /g')"
   fi
-done < <(printf '%s' "$EPS_JSON" | jq -r '.[] | select(.URL|startswith("https://")) | "\(.["Service Name"])\t\(.URL)"')
+done < <(printf '%s' "$EPS_JSON" | jq -r '.[] | "\(.["Service Name"])\t\(.URL)"')
+# (feed ALL internal endpoints: the https filter above made the SKIP branch dead
+#  code and silently hid non-TLS endpoints -- an unexpectedly-http internal
+#  endpoint is a finding the operator must SEE, not a row to drop. 2026-07-03)
 
 echo
 if [ "$FATAL" -ne 0 ]; then
diff --git a/scripts/phase-06-bootstrap.sh b/scripts/phase-06-bootstrap.sh
index 0faf91a..b742766 100644
--- a/scripts/phase-06-bootstrap.sh
+++ b/scripts/phase-06-bootstrap.sh
@@ -62,8 +62,9 @@
 
 # 3. roles (D-039: trustor must hold load-balancer_member or CAPO 403s on Octavia at LB provisioning)
 for ROLE in $ROLES; do
-  if openstack role assignment list --user "$OS_USERNAME" --user-domain "$OS_USER_DOMAIN_NAME" \
-       --project "$PROJECT" --project-domain "$PROJ_DOMAIN" --role "$ROLE" -f value 2>/dev/null | grep -q .; then
+  RA=$(openstack role assignment list --user "$OS_USERNAME" --user-domain "$OS_USER_DOMAIN_NAME" \
+       --project "$PROJECT" --project-domain "$PROJ_DOMAIN" --role "$ROLE" -f value 2>/dev/null || true)
+  if [ -n "$RA" ]; then   # capture-then-test (SIGPIPE rule): a raced grep -q read as 'absent' and re-ran the grant
     echo "[SKIP] role $ROLE on $PROJECT"
   else
     openstack role add --user "$OS_USERNAME" --user-domain "$OS_USER_DOMAIN_NAME" \
diff --git a/scripts/phase-06-net-setup.sh b/scripts/phase-06-net-setup.sh
index 08dc46c..46b3f55 100644
--- a/scripts/phase-06-net-setup.sh
+++ b/scripts/phase-06-net-setup.sh
@@ -59,7 +59,8 @@
 SGID=$(openstack security group show "$SG" -f value -c id)
 [ -n "$SGID" ] || { echo "FAIL: could not resolve $SG id" >&2; exit 1; }
 for port in 22 6443; do
-  if openstack security group rule list "$SGID" -f value -c "Port Range" 2>/dev/null | grep -qx "${port}:${port}"; then
+  PR=$(openstack security group rule list "$SGID" -f value -c "Port Range" 2>/dev/null || true)
+  if grep -qx "${port}:${port}" <<<"$PR"; then   # capture-then-test: the raced form mis-read 'present' as 'absent' -> duplicate create -> 409 aborts under set -e
     echo "[SKIP] sg rule tcp/$port"
   else
     openstack security group rule create --proto tcp --dst-port "$port" "$SGID" >/dev/null
diff --git a/scripts/phase-07-conductor-graft.sh b/scripts/phase-07-conductor-graft.sh
index 781817c..7698ca7 100644
--- a/scripts/phase-07-conductor-graft.sh
+++ b/scripts/phase-07-conductor-graft.sh
@@ -146,7 +146,8 @@
     curl -s -o /dev/null -w 'helm:%{http_code}\n' https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum"
 # (b) helm -- checksum-verified; /usr/local/bin + /usr/bin symlink (DOCFIX-035). WANT injected from the local tunable.
 juju ssh -m "$MODEL" "$CONDUCTOR" "WANT='$HELM_VERSION'; "'set -e
-  if [ -x /usr/bin/helm ] && /usr/bin/helm version --short 2>/dev/null | grep -q "$WANT"; then
+  HV=$(/usr/bin/helm version --short 2>/dev/null || true)
+  if [ -x /usr/bin/helm ] && [ -n "$HV" ] && [ "${HV#*$WANT}" != "$HV" ]; then
     echo "[SKIP] /usr/bin/helm already $WANT"
   else
     T=helm-$WANT-linux-amd64.tar.gz; D=$(mktemp -d); cd "$D"
diff --git a/scripts/preflight.sh b/scripts/preflight.sh
new file mode 100644
index 0000000..c6c2a9c
--- /dev/null
+++ b/scripts/preflight.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# scripts/preflight.sh [repo-root]
+#
+# THE single pre-deploy gate (DOCFIX-073). Before this existed the gate surface
+# was six artifacts the operator had to remember independently (pre-flight-checks
+# + its three delegates + provider-bundle-check + standup dry-run) -- the same
+# fragmentation that let review-bundle.py rot into noise. This runs every
+# stage-1 (pre-add-model) gate in dependency order with sectioned output and
+# worst-exit aggregation, then prints the stage-2 gates it CANNOT run yet.
+#
+# Mutates NOTHING. Stages:
+#   P1 repo lint            scripts/repo-lint.sh          (static hygiene)
+#   P2 bundle invariants    scripts/provider-bundle-check.py
+#   P3 channel assert       scripts/channel_assert.py     (needs charmhub; WARN if offline)
+#   P4 live pre-flight      scripts/pre-flight-checks.sh  (needs MAAS; overlay/VIP/planes/nodes)
+#   P5 reminders            stage-2 gates: juju-spaces-check.sh (AFTER add-model),
+#                           osd-blank-check.sh (sudo), 'juju deploy --dry-run' (phase-01 1.2)
+#
+# Exit: 0 all pass | 1 any FAIL (do NOT deploy) | 2 warnings only (review, then decide).
+# ASCII + LF.
+set -uo pipefail
+REPO="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+cd "$REPO" || { echo "FAIL: cannot cd to repo root $REPO"; exit 1; }
+WORST=0
+note() { local rc=$1; [ "$rc" -eq 1 ] && WORST=1; [ "$rc" -eq 2 ] && [ "$WORST" -ne 1 ] && WORST=2; }
+
+echo "================ P1: repo lint ================"
+bash scripts/repo-lint.sh "$REPO"; note $?
+
+echo "================ P2: bundle invariants ================"
+python3 scripts/provider-bundle-check.py bundle.yaml; note $?
+
+echo "================ P3: channel assert (charmhub) ================"
+python3 scripts/channel_assert.py bundle.yaml; note $?
+
+echo "================ P4: live pre-flight (MAAS/overlay/nodes) ================"
+if [ -x scripts/pre-flight-checks.sh ] || [ -f scripts/pre-flight-checks.sh ]; then
+  bash scripts/pre-flight-checks.sh; note $?
+else
+  echo "  [FAIL] scripts/pre-flight-checks.sh missing"; note 1
+fi
+
+echo "================ P5: stage-2 reminders (NOT run here) ================"
+echo "  - after 'juju add-model': bash scripts/juju-spaces-check.sh"
+echo "  - with sudo:              bash scripts/osd-blank-check.sh"
+echo "  - phase-01 Step 1.2:      juju deploy --dry-run (plan: 50 apps / 97 relations)"
+
+case "$WORST" in
+  0) echo; echo "PREFLIGHT: PASS -- clear to add-model / deploy" ;;
+  2) echo; echo "PREFLIGHT: WARN -- review warnings, then decide" ;;
+  *) echo; echo "PREFLIGHT: FAIL -- do NOT deploy" ;;
+esac
+exit "$WORST"
diff --git a/scripts/provider-bundle-check.py b/scripts/provider-bundle-check.py
index 159b377..ab6ffe5 100644
--- a/scripts/provider-bundle-check.py
+++ b/scripts/provider-bundle-check.py
@@ -11,9 +11,19 @@
      openstack0's -- the Pattern A revert re-adds the openstack0 MAC that D-057 trimmed
      for the now-dead provider-vip plane.
 
-This does NOT re-review the whole bundle. It is the deploy-gate that REPLACES the retired
-scripts/d057-bundle-check.py (which asserted the now-superseded D-057 provider-vip end
-state). FAIL -> exit 1. ASCII-only output.
+Structural invariants (absorbed from the retired scripts/review-bundle.py -- DOCFIX-070;
+that linter's expectations were pre-D-052 and its NOT CLEAN verdict was pure noise):
+  4. every relation side names an EXISTING app and carries an explicit :endpoint
+  5. mysql-innodb-cluster deploys at num_units 3 (D-062 -- single-unit seed never bootstraps)
+  6. no VIP last-octet is shared between applications
+  7. keystone ships the D-051/D-064 policy IN the bundle (resources: policyd-override,
+     use-policyd-override true), and the committed zip content matches
+     policies/domain-manager-policy.yaml (DOCFIX-071 drift guard; content compare, not
+     byte compare, so zip mtimes cannot false-fail it)
+
+It is the single deploy-gate: it REPLACED the retired scripts/d057-bundle-check.py (D-060)
+and now also scripts/review-bundle.py (DOCFIX-070). FAIL -> exit 1. ASCII-only output.
+(repo-lint: allow-stale-tokens -- guard checks name retired tokens by necessity)
 """
 import sys, re, ipaddress
 try:
@@ -94,6 +104,70 @@
         else:
             oks.append("%s bridge-interface-mappings: all 4 chassis MACs present (incl openstack0)" % n)
 
+    # -- 4. relations: existing apps, explicit endpoints (the magnum-shared-db class) --
+    rels = (doc or {}).get("relations", []) or []
+    rel_bad = 0
+    for r in rels:
+        if not isinstance(r, list) or len(r) != 2:
+            fails.append("relation not a 2-list: %r" % (r,)); rel_bad += 1; continue
+        for side in r:
+            side = str(side)
+            if ":" not in side:
+                fails.append("relation side lacks explicit :endpoint: %r" % side); rel_bad += 1; continue
+            if side.split(":")[0] not in apps:
+                fails.append("relation references unknown app: %r" % side); rel_bad += 1
+    if rels and not rel_bad:
+        oks.append("%d relations well-formed (explicit endpoints, all apps exist)" % len(rels))
+
+    # -- 5. D-062: mysql-innodb-cluster at target count 3 --
+    mi = apps.get("mysql-innodb-cluster") or {}
+    if mi.get("num_units") != 3:
+        fails.append("mysql-innodb-cluster num_units=%r (D-062 requires 3: single-unit seed never bootstraps)" % mi.get("num_units"))
+    else:
+        oks.append("mysql-innodb-cluster num_units=3 (D-062)")
+
+    # -- 6. VIP octet uniqueness --
+    seen_oct = {}
+    for n, s in apps.items():
+        vip = ((s or {}).get("options", {}) or {}).get("vip")
+        if not vip: continue
+        for part in str(vip).split():
+            o = part.rsplit(".", 1)[-1]
+            if o in seen_oct and seen_oct[o] != n:
+                fails.append("VIP last octet .%s shared by %s and %s" % (o, seen_oct[o], n))
+            seen_oct.setdefault(o, n)
+
+    # -- 7. DOCFIX-071: keystone policy ships in-bundle, zip content matches source --
+    import os, zipfile
+    ks = apps.get("keystone") or {}
+    res = ((ks.get("resources") or {}).get("policyd-override"))
+    upo = ((ks.get("options") or {}).get("use-policyd-override"))
+    if not upo:
+        fails.append("keystone use-policyd-override is not true (D-051)")
+    if not res:
+        fails.append("keystone has no resources: policyd-override (DOCFIX-071: policy unreachable on redeploy)")
+    else:
+        base = os.path.dirname(os.path.abspath(path))
+        zp = os.path.normpath(os.path.join(base, str(res)))
+        src = os.path.join(base, "policies", "domain-manager-policy.yaml")
+        if not os.path.isfile(zp):
+            fails.append("policyd-override zip missing at %s" % zp)
+        elif not os.path.isfile(src):
+            fails.append("policy source missing at %s" % src)
+        else:
+            try:
+                with zipfile.ZipFile(zp) as z:
+                    inzip = z.read("domain-manager-policy.yaml")
+                ondisk = open(src, "rb").read()
+                if inzip != ondisk:
+                    fails.append("policyd-override zip content DIFFERS from policies/domain-manager-policy.yaml (rebuild + recommit the zip)")
+                else:
+                    oks.append("keystone policyd-override wired in-bundle; zip content matches source (DOCFIX-071)")
+            except KeyError:
+                fails.append("zip lacks top-level domain-manager-policy.yaml (keystone reads the top-level name)")
+            except Exception as e:
+                fails.append("cannot read policyd zip: %s" % e)
+
     for o in oks:   print("  [ok]   %s" % o)
     for f in fails: print("  [FAIL] %s" % f)
     print("\n%s: Pattern A / D-052-D-053 bundle invariants (%s)" % ("PASS" if not fails else "FAIL", path))
diff --git a/scripts/repo-lint.sh b/scripts/repo-lint.sh
new file mode 100644
index 0000000..36ffe2e
--- /dev/null
+++ b/scripts/repo-lint.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# scripts/repo-lint.sh [repo-root]
+#
+# Thin runner for scripts/repo_lint.py (DOCFIX-074) -- static repo hygiene lint.
+# Mutates NOTHING. See the .py docstring for the check catalog (L1-L6).
+# Exit: 0 clean | 1 FAIL findings | 2 warnings only.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+command -v python3 >/dev/null 2>&1 || { echo "FAIL: python3 required"; exit 1; }
+python3 "$HERE/repo_lint.py" "${1:-$HERE/..}"
diff --git a/scripts/repo_lint.py b/scripts/repo_lint.py
new file mode 100644
index 0000000..0f7ae3d
--- /dev/null
+++ b/scripts/repo_lint.py
@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+"""
+repo_lint.py -- static hygiene lint for the openstack-caracal-ipv4 repo (DOCFIX-074).
+
+Read-only. Catches the drift classes that accumulated silently between the D-052
+rebuild and the 2026-07-02 redeploy-readiness sweep (46 findings), so they are
+caught at commit time instead of at the next redeploy:
+
+  L1  encoding      non-ASCII / CR bytes in committed text (repo rule: ASCII+LF).
+                    Carve-out: docs/design-decisions.md legacy D-001..018 region
+                    (em-dash style documented) -> WARN with count, never FAIL.
+  L2  stale tokens  retired space names / CIDRs / VIP band in LIVE docs
+                    (runbooks/, scripts/, bundle.yaml, README.md). Lines that
+                    are explicitly historical (retired/STALE/superseded/D-058/
+                    D-060/DOCFIX context) are exempt.
+  L3  ghost refs    scripts/<name>.(sh|py) referenced in a runbook must exist.
+  L4  deprecated    invoking a deprecated/retired script outside a deprecation
+                    or historical context.
+  L5  numbering     duplicate D-/DOCFIX-/BUNDLEFIX- definition headings in the
+                    decision/changelog docs (collision guard); prints next-free.
+  L6  bare invoke   runbook lines executing scripts/*.sh without a bash/source
+                    prefix (repo carries NO exec bits -- DOCFIX-069; bare form
+                    fails "Permission denied" on a fresh clone).
+
+Exit: 0 clean | 1 FAIL findings | 2 warnings only.  ASCII + LF.
+Usage: python3 scripts/repo_lint.py [repo-root]
+(marker: repo-lint: allow-stale-tokens -- this file names them by necessity)
+"""
+import re, sys, pathlib, collections
+
+def main():
+    R = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else ".").resolve()
+    fails, warns = [], []
+
+    def live_docs():
+        out = [R / "README.md", R / "bundle.yaml"]
+        out += sorted((R / "runbooks").glob("*.md")) if (R / "runbooks").is_dir() else []
+        out += sorted((R / "scripts").iterdir()) if (R / "scripts").is_dir() else []
+        return [p for p in out if p.is_file()]
+
+    def all_text():
+        exts = {".md", ".sh", ".py", ".yaml", ".yml", ""}
+        skip_names = {"overrides.zip"}
+        out = []
+        for p in R.rglob("*"):
+            if not p.is_file() or ".git" in p.parts or "__pycache__" in p.parts:
+                continue
+            if p.suffix.lower() == ".zip" or p.name in skip_names:
+                continue
+            if p.suffix in exts or p.name == ".gitattributes":
+                out.append(p)
+        return out
+
+    # ---- L1 encoding ----
+    for p in all_text():
+        data = p.read_bytes()
+        rel = str(p.relative_to(R))
+        cr = data.count(b"\x0d")
+        na = sum(1 for b in data if b > 127)
+        if cr:
+            fails.append("L1 %s: %d CR byte(s) (repo is LF-only)" % (rel, cr))
+        if na:
+            if rel == "docs/design-decisions.md":
+                warns.append("L1 %s: %d non-ASCII byte(s) (legacy D-001..018 carve-out; "
+                             "NEW entries must be ASCII)" % (rel, na))
+            else:
+                fails.append("L1 %s: %d non-ASCII byte(s) (repo rule: ASCII only)" % (rel, na))
+
+    # ---- L2 stale tokens in live docs ----
+    STALE = [
+        (re.compile(r"\b(provider-vip|fabric-data)\b"), "retired space name"),
+        (re.compile(r"\b(?<![\w.])lbaas\b(?!-)"), "retired lbaas space"),
+        (re.compile(r"10\.12\.(20|24|60)\."), "D-058-era CIDR (never deployed)"),
+        (re.compile(r"10\.12\.4\.2(2[4-9]|3[0-6])\b"), "pre-R14 VIP band"),
+        (re.compile(r"jesse\.austin/openstack-caracal-ipv4"), "dead repo path"),
+    ]
+    EXEMPT = re.compile(r"retired|stale|supersed|historical|deprecat|D-05[3-9]|D-060|DOCFIX|"
+                        r"must[- ]be[- ]absent|no provider-vip|renam|8_lbaas|ex-lbaas|old",
+                        re.IGNORECASE)
+    for p in live_docs():
+        try:
+            txt = p.read_text(errors="replace")
+        except Exception:
+            continue
+        # explicit per-file opt-out for guard scripts whose PURPOSE is naming
+        # stale tokens (fail-closed checks, deprecation lists):
+        if "repo-lint: allow-stale-tokens" in txt:
+            continue
+        lines = txt.splitlines()
+        rel = str(p.relative_to(R))
+        for i, ln in enumerate(lines, 1):
+            if EXEMPT.search(ln):
+                continue
+            for rx, why in STALE:
+                if rx.search(ln):
+                    fails.append("L2 %s:%d %s: %s" % (rel, i, why, ln.strip()[:80]))
+
+    # ---- L3 ghost script refs / L4 deprecated / L6 bare invocation ----
+    DEPRECATED = ["phase-00-teardown.sh", "phase-00-maas-recidr.sh",
+                  "provider-vip-standup.sh", "d057-bundle-check.py",
+                  "review-bundle.py",
+                  "04a-capi-bootstrap-cluster", "05-magnum-capi-driver"]
+    DEP_EXEMPT = re.compile(r"deprecat|retired|historical|git rm|DO NOT USE|absorbed|replac",
+                            re.IGNORECASE)
+    ref_rx = re.compile(r"scripts/([a-z0-9_\-]+\.(?:sh|py))")
+    bare_rx = re.compile(r"^(?!.*\b(?:bash|source|python3?)\b)[^#]*(?<![\w/.])(?:\./)?scripts/[a-z0-9_\-]+\.sh\b")
+    rb_dir = R / "runbooks"
+    for p in (sorted(rb_dir.glob("*.md")) if rb_dir.is_dir() else []):
+        rel = str(p.relative_to(R))
+        in_code = False
+        for i, ln in enumerate(p.read_text(errors="replace").splitlines(), 1):
+            if ln.strip().startswith("```"):
+                in_code = not in_code
+                continue
+            for m in ref_rx.finditer(ln):
+                if not (R / "scripts" / m.group(1)).exists():
+                    fails.append("L3 %s:%d references missing scripts/%s" % (rel, i, m.group(1)))
+            if not DEP_EXEMPT.search(ln):
+                for d in DEPRECATED:
+                    if d in ln:
+                        fails.append("L4 %s:%d references deprecated %s" % (rel, i, d))
+            if in_code and bare_rx.search(ln):
+                fails.append("L6 %s:%d bare script invocation (no exec bits in repo; "
+                             "use 'bash scripts/...'): %s" % (rel, i, ln.strip()[:70]))
+
+    # ---- L5 identifier numbering ----
+    heads = collections.Counter()
+    for name in ("docs/design-decisions.md",):
+        p = R / name
+        if not p.exists():
+            continue
+        for m in re.finditer(r"(?m)^##+\s+(D-0\d{2})\b(?!.*AMENDMENT|.*RESOLVED)",
+                             p.read_text(errors="replace")):
+            heads[m.group(1)] += 1
+    for ident, n in sorted(heads.items()):
+        if n > 1:
+            fails.append("L5 %s defined %d times in design-decisions.md (collision)" % (ident, n))
+    used = collections.defaultdict(set)
+    for p in all_text():
+        for m in re.finditer(r"\b(D|DOCFIX|BUNDLEFIX)-(0\d{2})\b", p.read_text(errors="replace")):
+            used[m.group(1)].add(int(m.group(2)))
+    nf = ", ".join("%s-%03d" % (k, max(v) + 1) for k, v in sorted(used.items()) if v)
+    print("  [info] L5 next-free identifiers: %s" % (nf or "n/a"))
+
+    for w in warns:
+        print("  [WARN] %s" % w)
+    for f in fails:
+        print("  [FAIL] %s" % f)
+    verdict = "FAIL" if fails else ("WARN" if warns else "PASS")
+    print("\n%s: repo lint (%d fail, %d warn)" % (verdict, len(fails), len(warns)))
+    return 1 if fails else (2 if warns else 0)
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/review-bundle.py b/scripts/review-bundle.py
deleted file mode 100644
index 665b1fa..0000000
--- a/scripts/review-bundle.py
+++ /dev/null
@@ -1,546 +0,0 @@
-#!/usr/bin/env python3
-"""
-review-bundle.py -- comprehensive pre-deploy review of the Charmed OpenStack
-Caracal 2024.1 IPv4-only bundle (VR0 / DC0 / Omega test cloud).
-
-READ-ONLY. Encodes every lesson learned from the 2026-05-28/29/30 deploy
-sessions as a fail-closed check. Superset of audit-bundle-fixes.py.
-
-Severities:
-  FAIL  deploy-blocker or known regression       -> exit 1
-  WARN  review item / possible issue             -> exit 1 only under --strict
-  INFO  informational summary                    -> never affects exit
-
-Dependencies: PyYAML only (already used by the existing fix scripts); rest stdlib.
-ASCII-only output by design (non-ASCII has caused silent daemon failures here).
-
-Usage:
-  python3 review-bundle.py [BUNDLE] [--strict] [--quiet]
-    BUNDLE   path to bundle.yaml (default: ./bundle.yaml)
-    --strict treat WARN as failing for exit code
-    --quiet  suppress PASS/INFO lines (show only WARN/FAIL)
-"""
-
-import sys
-import argparse
-import ipaddress
-
-try:
-    import yaml
-except ImportError:
-    sys.stderr.write("ERROR: PyYAML not installed (pip install pyyaml --break-system-packages)\n")
-    sys.exit(2)
-
-# --------------------------------------------------------------------------- #
-# Config -- the known-good baseline. Adjust here if the design changes.
-# --------------------------------------------------------------------------- #
-EXPECTED_APPS = 51
-EXPECTED_RELATIONS = 98
-
-PROVIDER_NET = ipaddress.ip_network("10.12.4.0/22")
-METAL_NET = ipaddress.ip_network("10.12.8.0/22")
-VIP_OCTET_MIN = 224          # MAAS reserved metal VIP range 10.12.8.224-254 (D-020)
-VIP_OCTET_MAX = 254
-
-# BUNDLEFIX-001: the 7 per-endpoint binding keys that were phantom and removed.
-# Final anchors are {"":metal} and {"":metal, public:provider} -> none of these
-# should reappear in any app's effective bindings.
-PHANTOM_BINDING_KEYS = {
-    "admin", "internal", "shared-db", "amqp", "certificates", "cluster", "ha",
-}
-
-# D-020 clustered-API charm -> provider VIP last octet (metal mirrors it).
-EXPECTED_CLUSTERED = {
-    "barbican": 224, "cinder": 226, "glance": 228, "keystone": 229,
-    "magnum": 230, "neutron-api": 231, "nova-cloud-controller": 232,
-    "octavia": 233, "openstack-dashboard": 234, "placement": 235,
-}
-
-# Verified Caracal channel matrix (from prior charmhub verification).
-# WARN-only: channels can be intentionally pinned; flag deviation, do not block.
-OPENSTACK_CORE_CHANNEL = "2024.1/stable"
-OPENSTACK_CORE_CHARMS = {
-    "keystone", "glance", "cinder", "cinder-ceph", "nova-cloud-controller",
-    "nova-compute", "neutron-api", "neutron-api-plugin-ovn", "placement",
-    "octavia", "barbican", "magnum", "magnum-dashboard", "openstack-dashboard",
-}
-CHANNEL_MATRIX = {
-    "ovn-central": "24.03/stable", "ovn-chassis": "24.03/stable",
-    "ceph-mon": "squid/stable", "ceph-osd": "squid/stable",
-    "ceph-fs": "squid/stable", "ceph-radosgw": "squid/stable",
-    "mysql-innodb-cluster": "8.0/stable", "mysql-router": "8.0/stable",
-    "rabbitmq-server": "3.9/stable", "vault": "1.8/stable",
-}
-EXPECTED_BASE = "ubuntu@22.04"   # jammy; Caracal-bundle paradigm (not noble)
-
-MAC_RE = None  # compiled below
-import re
-MAC_RE = re.compile(r"([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}")
-
-# --------------------------------------------------------------------------- #
-# Duplicate-key-detecting YAML loader (PyYAML silently keeps the last dup).
-# --------------------------------------------------------------------------- #
-_DUP_KEYS = []
-
-
-class DupKeyLoader(yaml.SafeLoader):
-    def construct_mapping(self, node, deep=False):
-        seen = set()
-        for key_node, _ in node.value:
-            try:
-                key = self.construct_object(key_node, deep=deep)
-            except Exception:
-                continue
-            if isinstance(key, (str, int, float, bool)) or key is None:
-                if key in seen:
-                    _DUP_KEYS.append((str(key), key_node.start_mark.line + 1))
-                seen.add(key)
-        return super().construct_mapping(node, deep)
-
-
-# --------------------------------------------------------------------------- #
-# Reporter
-# --------------------------------------------------------------------------- #
-class Reporter:
-    def __init__(self, quiet=False):
-        self.quiet = quiet
-        self.rows = []  # (section, level, code, msg)
-        self.counts = {"PASS": 0, "WARN": 0, "FAIL": 0, "INFO": 0}
-
-    def add(self, section, level, code, msg):
-        self.rows.append((section, level, code, msg))
-        self.counts[level] = self.counts.get(level, 0) + 1
-
-    def emit(self):
-        section = None
-        for sec, level, code, msg in self.rows:
-            if self.quiet and level in ("PASS", "INFO"):
-                continue
-            if sec != section:
-                print("\n--- %s ---" % sec)
-                section = sec
-            print("  [%-4s] %-10s %s" % (level, code, msg))
-        print("\n==================== SUMMARY ====================")
-        print("  PASS=%d  WARN=%d  FAIL=%d  INFO=%d"
-              % (self.counts["PASS"], self.counts["WARN"],
-                 self.counts["FAIL"], self.counts["INFO"]))
-
-
-# --------------------------------------------------------------------------- #
-# Helpers
-# --------------------------------------------------------------------------- #
-def ep_app(endpoint):
-    """'keystone:shared-db' -> 'keystone'. Non-str -> None."""
-    if not isinstance(endpoint, str):
-        return None
-    return endpoint.split(":", 1)[0]
-
-
-def in_net(addr, net):
-    try:
-        return ipaddress.ip_address(addr) in net
-    except ValueError:
-        return False
-
-
-# --------------------------------------------------------------------------- #
-# Checks
-# --------------------------------------------------------------------------- #
-def check_ascii(R, text):
-    sec = "0. Structure / integrity"
-    bad = []
-    for i, line in enumerate(text.splitlines(), 1):
-        for ch in line:
-            if ord(ch) > 127:
-                bad.append((i, repr(ch)))
-                break
-    if bad:
-        for ln, ch in bad[:20]:
-            R.add(sec, "WARN", "NON-ASCII",
-                  "non-ASCII char %s on line %d (non-ASCII has caused silent daemon failures here)" % (ch, ln))
-        if len(bad) > 20:
-            R.add(sec, "WARN", "NON-ASCII", "...and %d more non-ASCII line(s)" % (len(bad) - 20))
-    else:
-        R.add(sec, "PASS", "ASCII", "file is pure ASCII")
-
-
-def check_structure(R, doc):
-    sec = "0. Structure / integrity"
-    if not isinstance(doc, dict):
-        R.add(sec, "FAIL", "STRUCT-00", "top-level YAML is not a mapping")
-        return None, None
-    if _DUP_KEYS:
-        for k, ln in _DUP_KEYS:
-            R.add(sec, "FAIL", "DUPKEY", "duplicate key '%s' near line %d" % (k, ln))
-    else:
-        R.add(sec, "PASS", "DUPKEY", "no duplicate keys")
-
-    apps = doc.get("applications")
-    rels = doc.get("relations")
-    if not isinstance(apps, dict):
-        R.add(sec, "FAIL", "STRUCT-APPS", "no 'applications' mapping")
-        apps = {}
-    if not isinstance(rels, list):
-        R.add(sec, "FAIL", "STRUCT-RELS", "no 'relations' list")
-        rels = []
-
-    na, nr = len(apps), len(rels)
-    R.add(sec, "INFO" if na == EXPECTED_APPS else "WARN", "APP-COUNT",
-          "applications=%d (baseline %d)" % (na, EXPECTED_APPS))
-    R.add(sec, "INFO" if nr == EXPECTED_RELATIONS else "WARN", "REL-COUNT",
-          "relations=%d (baseline %d)" % (nr, EXPECTED_RELATIONS))
-    return apps, rels
-
-
-def check_relations(R, apps, rels):
-    sec = "1. Relation integrity"
-    bad_shape = miss_colon = dangling = 0
-    for r in rels:
-        if not (isinstance(r, list) and len(r) == 2):
-            R.add(sec, "FAIL", "REL-SHAPE", "relation not a 2-element list: %r" % (r,))
-            bad_shape += 1
-            continue
-        for e in r:
-            if not isinstance(e, str) or ":" not in e:
-                R.add(sec, "FAIL", "REL-COLON", "endpoint missing colon: %r in %r" % (e, r))
-                miss_colon += 1
-            else:
-                a = ep_app(e)
-                if a not in apps:
-                    R.add(sec, "FAIL", "REL-DANGLE",
-                          "endpoint references unknown app '%s' in %r" % (a, r))
-                    dangling += 1
-    if not (bad_shape or miss_colon or dangling):
-        R.add(sec, "PASS", "REL-INT",
-              "all relations well-formed, colon-explicit, both ends resolve to apps")
-
-
-def check_bindings_phantom(R, apps):
-    sec = "2. BUNDLEFIX-001 (phantom binding keys)"
-    hits = 0
-    for name, spec in apps.items():
-        b = (spec or {}).get("bindings")
-        if not isinstance(b, dict):
-            continue
-        bad = sorted(set(b.keys()) & PHANTOM_BINDING_KEYS)
-        if bad:
-            R.add(sec, "FAIL", "PHANTOM",
-                  "%s has phantom per-endpoint binding key(s): %s" % (name, ", ".join(bad)))
-            hits += 1
-    if not hits:
-        R.add(sec, "PASS", "PHANTOM",
-              "no app reintroduces a removed phantom binding key (%s)"
-              % ", ".join(sorted(PHANTOM_BINDING_KEYS)))
-
-
-def check_vault(R, apps, rels):
-    sec = "3. BUNDLEFIX-002 (vault de-HA)"
-    v = apps.get("vault")
-    if v is None:
-        R.add(sec, "WARN", "VAULT", "no 'vault' app found")
-        return
-    opts = (v or {}).get("options") or {}
-    if "vip" in opts:
-        R.add(sec, "FAIL", "VAULT-VIP", "vault has a 'vip' option (must be de-HA'd): %r" % opts["vip"])
-    else:
-        R.add(sec, "PASS", "VAULT-VIP", "vault has no vip")
-    if "os-public-hostname" in opts:
-        R.add(sec, "WARN", "VAULT-HOST", "vault has os-public-hostname (expected removed)")
-    if "vault-hacluster" in apps:
-        R.add(sec, "FAIL", "VAULT-HA", "vault-hacluster application is present (must be removed)")
-    else:
-        R.add(sec, "PASS", "VAULT-HA", "no vault-hacluster application")
-    for r in rels:
-        if isinstance(r, list) and any(isinstance(e, str) and e.startswith("vault:ha") for e in r):
-            R.add(sec, "FAIL", "VAULT-HAREL", "vault:ha relation present: %r" % (r,))
-
-
-def map_hacluster(apps, rels):
-    """principal -> hacluster_app_name, using charm==hacluster + the :ha relation."""
-    hac_apps = {n for n, s in apps.items() if (s or {}).get("charm") == "hacluster"}
-    principal_of = {}
-    for r in rels:
-        if not (isinstance(r, list) and len(r) == 2):
-            continue
-        a0, a1 = ep_app(r[0]), ep_app(r[1])
-        if a0 in hac_apps and a1 and a1 not in hac_apps:
-            principal_of[a1] = a0
-        elif a1 in hac_apps and a0 and a0 not in hac_apps:
-            principal_of[a0] = a1
-    return hac_apps, principal_of
-
-
-def check_hacluster(R, apps, rels):
-    sec = "4. BUNDLEFIX-003 (hacluster cluster_count)"
-    hac_apps, principal_of = map_hacluster(apps, rels)
-    if not hac_apps:
-        R.add(sec, "WARN", "HAC", "no hacluster apps found")
-        return principal_of
-    principal_for_hac = {h: p for p, h in principal_of.items()}
-    ok = 0
-    for h in sorted(hac_apps):
-        opts = (apps[h].get("options") or {})
-        cc = opts.get("cluster_count")
-        prin = principal_for_hac.get(h)
-        nu = (apps.get(prin, {}) or {}).get("num_units") if prin else None
-        if cc is None:
-            R.add(sec, "FAIL", "HAC-CC", "%s missing cluster_count" % h)
-            continue
-        if not prin:
-            R.add(sec, "WARN", "HAC-PRIN", "%s has no principal via :ha relation" % h)
-        if isinstance(nu, int) and cc > nu:
-            R.add(sec, "FAIL", "HAC-OVER",
-                  "%s cluster_count=%s > principal %s num_units=%s" % (h, cc, prin, nu))
-            continue
-        if cc != 1:
-            R.add(sec, "WARN", "HAC-NE1",
-                  "%s cluster_count=%s (testcloud baseline is 1)" % (h, cc))
-        else:
-            ok += 1
-    if ok:
-        R.add(sec, "PASS", "HAC", "%d hacluster app(s) cluster_count=1 and <= principal num_units" % ok)
-
-
-def check_memcached(R, apps, rels):
-    sec = "5. BUNDLEFIX-004 (memcached)"
-    if "memcached" not in apps:
-        R.add(sec, "FAIL", "MEMCACHE-APP", "no 'memcached' application")
-    else:
-        R.add(sec, "PASS", "MEMCACHE-APP", "memcached application present")
-    found = False
-    for r in rels:
-        if not (isinstance(r, list) and len(r) == 2):
-            continue
-        s = set()
-        for e in r:
-            if isinstance(e, str):
-                s.add(e)
-        if {"nova-cloud-controller:memcache", "memcached:cache"} <= s:
-            found = True
-    R.add(sec, "PASS" if found else "FAIL", "MEMCACHE-REL",
-          "nova-cloud-controller:memcache <-> memcached:cache relation %s"
-          % ("present" if found else "MISSING"))
-
-
-def check_router_bindings(R, apps):
-    sec = "6. BUNDLEFIX-005 (mysql-router metal binding)"
-    routers = [n for n, s in apps.items() if (s or {}).get("charm") == "mysql-router"]
-    if not routers:
-        R.add(sec, "WARN", "ROUTER", "no mysql-router apps found")
-        return
-    bad = 0
-    for n in sorted(routers):
-        b = (apps[n].get("bindings") or {})
-        # effective default space is the "" key; anchors already resolved by yaml
-        default = b.get("", None)
-        non_metal = {k: v for k, v in b.items() if v not in ("metal",)}
-        if default == "metal" and not non_metal:
-            continue
-        if default != "metal":
-            R.add(sec, "FAIL", "ROUTER-BIND",
-                  "%s default space binding is %r (expected metal)" % (n, default))
-            bad += 1
-        elif non_metal:
-            R.add(sec, "WARN", "ROUTER-BIND",
-                  "%s has non-metal endpoint binding(s): %r" % (n, non_metal))
-    if not bad:
-        R.add(sec, "PASS", "ROUTER-BIND",
-              "%d mysql-router app(s) bound to metal" % len(routers))
-
-
-def check_vips(R, apps, rels):
-    sec = "7. BUNDLEFIX-006 / D-020 (dual provider+metal VIPs)"
-    _, principal_of = map_hacluster(apps, rels)
-    clustered = sorted(principal_of.keys())
-    # set comparison vs expected D-020 clustered set
-    got = set(clustered)
-    exp = set(EXPECTED_CLUSTERED)
-    if got != exp:
-        if exp - got:
-            R.add(sec, "WARN", "VIP-SET", "expected-clustered apps NOT detected as clustered: %s"
-                  % ", ".join(sorted(exp - got)))
-        if got - exp:
-            R.add(sec, "WARN", "VIP-SET", "clustered apps beyond the D-020 set: %s"
-                  % ", ".join(sorted(got - exp)))
-    ok = 0
-    for name in clustered:
-        opts = (apps[name].get("options") or {})
-        vip = opts.get("vip")
-        if not vip:
-            R.add(sec, "FAIL", "VIP-MISS", "%s is clustered but has no vip" % name)
-            continue
-        parts = str(vip).split()
-        if len(parts) != 2:
-            R.add(sec, "FAIL", "VIP-DUAL", "%s vip is not dual (got %r)" % (name, vip))
-            continue
-        prov, metal = parts
-        if not in_net(prov, PROVIDER_NET):
-            R.add(sec, "FAIL", "VIP-PROV", "%s provider vip %s not in %s" % (name, prov, PROVIDER_NET))
-            continue
-        if not in_net(metal, METAL_NET):
-            R.add(sec, "FAIL", "VIP-METAL", "%s metal vip %s not in %s" % (name, metal, METAL_NET))
-            continue
-        po, mo = int(prov.split(".")[-1]), int(metal.split(".")[-1])
-        if po != mo:
-            R.add(sec, "FAIL", "VIP-MIRROR", "%s octets differ: provider .%d vs metal .%d" % (name, po, mo))
-            continue
-        if not (VIP_OCTET_MIN <= mo <= VIP_OCTET_MAX):
-            R.add(sec, "FAIL", "VIP-RANGE",
-                  "%s metal vip octet .%d outside reserved %d-%d" % (name, mo, VIP_OCTET_MIN, VIP_OCTET_MAX))
-            continue
-        expected_octet = EXPECTED_CLUSTERED.get(name)
-        if expected_octet is not None and po != expected_octet:
-            R.add(sec, "WARN", "VIP-OCTET",
-                  "%s vip octet .%d != D-020 map .%d" % (name, po, expected_octet))
-        ok += 1
-    if ok:
-        R.add(sec, "PASS", "VIP-DUAL",
-              "%d clustered API charm(s) have mirrored dual VIPs in the reserved range" % ok)
-
-
-def check_osd(R, apps):
-    sec = "8. Anti-pattern: ceph-osd osd-devices"
-    osds = [n for n, s in apps.items() if (s or {}).get("charm") == "ceph-osd"]
-    if not osds:
-        R.add(sec, "WARN", "OSD", "no ceph-osd app found")
-        return
-    for n in osds:
-        dev = (apps[n].get("options") or {}).get("osd-devices")
-        if not dev or not isinstance(dev, str) or not dev.strip().startswith("/"):
-            R.add(sec, "FAIL", "OSD-DEV", "%s osd-devices not a real path: %r" % (n, dev))
-        else:
-            note = ""
-            if "/dev/disk/by-" not in dev:
-                note = " (kernel-name; by-path/by-id is harder for bare metal -- Roosevelt note)"
-            R.add(sec, "PASS", "OSD-DEV", "%s osd-devices=%s%s" % (n, dev.strip(), note))
-
-
-def check_ovn(R, apps):
-    sec = "9. Anti-pattern: ovn-chassis mappings (MAC over NIC name)"
-    chassis = [n for n, s in apps.items() if (s or {}).get("charm") == "ovn-chassis"]
-    if not chassis:
-        R.add(sec, "WARN", "OVN", "no ovn-chassis app found")
-        return
-    for n in sorted(chassis):
-        opts = (apps[n].get("options") or {})
-        bim = opts.get("bridge-interface-mappings")
-        if not bim:
-            R.add(sec, "INFO", "OVN-BIM", "%s has no bridge-interface-mappings (expected for octavia-side chassis)" % n)
-            continue
-        if MAC_RE.search(str(bim)):
-            R.add(sec, "PASS", "OVN-BIM", "%s bridge-interface-mappings is MAC-based" % n)
-        else:
-            R.add(sec, "WARN", "OVN-BIM",
-                  "%s bridge-interface-mappings has no MAC (NIC-name? fragile): %r" % (n, bim))
-
-
-def check_os_networks(R, apps, rels):
-    sec = "10. D-020: spaces-native (no os-*-network pinning)"
-    _, principal_of = map_hacluster(apps, rels)
-    flagged = 0
-    for name in sorted(principal_of):
-        opts = (apps[name].get("options") or {})
-        for k in ("os-internal-network", "os-admin-network", "os-public-network"):
-            if k in opts:
-                R.add(sec, "WARN", "OS-NET",
-                      "%s sets %s (D-020 found spaces-native resolve sufficient; verify intent)" % (name, k))
-                flagged += 1
-    if not flagged:
-        R.add(sec, "PASS", "OS-NET", "no clustered charm pins os-*-network (spaces-native, per D-020)")
-
-
-def expected_channel(charm):
-    if charm in CHANNEL_MATRIX:
-        return CHANNEL_MATRIX[charm]
-    if charm in OPENSTACK_CORE_CHARMS:
-        return OPENSTACK_CORE_CHANNEL
-    return None
-
-
-def check_channels_base(R, apps):
-    sec = "11. Channels / base (verified Caracal matrix; WARN-only)"
-    mismatch = 0
-    for name, spec in sorted(apps.items()):
-        spec = spec or {}
-        charm = spec.get("charm")
-        ch = spec.get("channel")
-        exp = expected_channel(charm)
-        if exp and ch and ch != exp:
-            R.add(sec, "WARN", "CHANNEL", "%s (%s) channel=%s expected=%s" % (name, charm, ch, exp))
-            mismatch += 1
-        base = spec.get("base")
-        series = spec.get("series")
-        if base and base != EXPECTED_BASE:
-            R.add(sec, "WARN", "BASE", "%s base=%s expected=%s" % (name, base, EXPECTED_BASE))
-        if series and series not in ("jammy",):
-            R.add(sec, "WARN", "SERIES", "%s series=%s expected=jammy" % (name, series))
-    if not mismatch:
-        R.add(sec, "PASS", "CHANNEL", "no charm deviates from the known Caracal channel matrix")
-
-
-def summary_tables(R, apps, rels):
-    sec = "12. Inventory (informational)"
-    _, principal_of = map_hacluster(apps, rels)
-    for name in sorted(principal_of):
-        vip = ((apps[name].get("options") or {}).get("vip"))
-        R.add(sec, "INFO", "CLUSTERED", "%-26s vip=%s" % (name, vip))
-    routers = sorted(n for n, s in apps.items() if (s or {}).get("charm") == "mysql-router")
-    R.add(sec, "INFO", "ROUTERS", "%d mysql-router apps: %s" % (len(routers), ", ".join(routers)))
-
-
-# --------------------------------------------------------------------------- #
-# Main
-# --------------------------------------------------------------------------- #
-def main():
-    ap = argparse.ArgumentParser(description="Comprehensive Caracal bundle reviewer (read-only).")
-    ap.add_argument("bundle", nargs="?", default="bundle.yaml")
-    ap.add_argument("--strict", action="store_true", help="treat WARN as failing for exit code")
-    ap.add_argument("--quiet", action="store_true", help="show only WARN/FAIL")
-    args = ap.parse_args()
-
-    try:
-        with open(args.bundle, "r", encoding="utf-8", errors="replace") as fh:
-            text = fh.read()
-    except FileNotFoundError:
-        sys.stderr.write("ERROR: bundle not found: %s\n" % args.bundle)
-        return 2
-
-    try:
-        doc = yaml.load(text, Loader=DupKeyLoader)
-    except yaml.YAMLError as e:
-        sys.stderr.write("ERROR: YAML parse failed: %s\n" % e)
-        return 2
-
-    R = Reporter(quiet=args.quiet)
-    print("================ Caracal v1 bundle review: %s ================" % args.bundle)
-
-    check_ascii(R, text)
-    apps, rels = check_structure(R, doc)
-    if apps is None:
-        R.emit()
-        return 1
-    check_relations(R, apps, rels)
-    check_bindings_phantom(R, apps)
-    check_vault(R, apps, rels)
-    check_hacluster(R, apps, rels)
-    check_memcached(R, apps, rels)
-    check_router_bindings(R, apps)
-    check_vips(R, apps, rels)
-    check_osd(R, apps)
-    check_ovn(R, apps)
-    check_os_networks(R, apps, rels)
-    check_channels_base(R, apps)
-    summary_tables(R, apps, rels)
-
-    R.emit()
-    fail = R.counts["FAIL"] > 0
-    warn = R.counts["WARN"] > 0
-    if fail or (args.strict and warn):
-        print("\nVERDICT: NOT CLEAN" + (" (--strict: WARN counts)" if (warn and not fail) else ""))
-        return 1
-    print("\nVERDICT: CLEAN" + (" (with WARN review items)" if warn else ""))
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
diff --git a/scripts/run-logged.sh b/scripts/run-logged.sh
new file mode 100644
index 0000000..5780e8c
--- /dev/null
+++ b/scripts/run-logged.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# scripts/run-logged.sh <phase-label>
+#
+# As-executed session logger (DOCFIX-076). Opens a logged interactive subshell;
+# EVERYTHING typed and printed is appended to ~/as-executed/<UTC date>-<label>.log
+# via script(1). Exit the subshell to stop logging. The verbatim-retrieval rule
+# for one-shot/irreversible steps (vault init, CA issuance, authorize-charm)
+# depends on these logs EXISTING and being FINDABLE -- see
+# docs/as-executed-log-convention.md. Logs stay on the jumphost (secret-adjacent:
+# NEVER commit them); commit only the index entry.
+#
+# Mutates: creates/appends ~/as-executed/<date>-<label>.log (0600, dir 0700).
+# Exit: the subshell's exit code (script -e passthrough) | 1 usage/precondition.
+# ASCII + LF.
+set -uo pipefail
+LABEL="${1:-}"
+[ -n "$LABEL" ] || { echo "usage: bash scripts/run-logged.sh <phase-label>   (e.g. phase-02-vault)"; exit 1; }
+printf '%s' "$LABEL" | grep -qE '^[A-Za-z0-9._-]+$' || { echo "FAIL: label must be [A-Za-z0-9._-]"; exit 1; }
+command -v script >/dev/null 2>&1 || { echo "FAIL: util-linux 'script' not found"; exit 1; }
+DIR="$HOME/as-executed"; ( umask 077; mkdir -p "$DIR" )
+LOG="$DIR/$(date -u +%F)-$LABEL.log"
+( umask 077; touch "$LOG" )
+echo "== logging to $LOG -- exit the shell to stop =="
+# -a append, -q quiet, -e return child exit code
+script -aqe "$LOG"
+RC=$?
+echo "== log closed: $LOG (add an index entry: logs/as-executed-index.md) =="
+exit "$RC"
diff --git a/scripts/tenant-onboard.sh b/scripts/tenant-onboard.sh
index 8523c88..1e7f74f 100644
--- a/scripts/tenant-onboard.sh
+++ b/scripts/tenant-onboard.sh
@@ -34,6 +34,7 @@
 newpw(){ python3 -c 'import secrets;print(secrets.token_urlsafe(24))'; }
 
 # ---- admin context helper (operator) ----
+command -v jq >/dev/null 2>&1 || die "jq required (image-ID resolution uses -f json | jq)"
 admin_env(){ for v in $(env|awk -F= '/^OS_/{print $1}'); do unset "$v"; done; source ~/admin-openrc; }
 # ---- named-identity password context (subshell-scoped by callers) ----
 
@@ -42,7 +43,7 @@
   echo "== stage0: preflight =="
   juju status keystone -m openstack --format=yaml 2>/dev/null | python3 -c 'import sys,yaml;m=yaml.safe_load(sys.stdin)["applications"]["keystone"]["units"]["keystone/0"].get("workload-status",{}).get("message","");print("keystone:",m);sys.exit(0 if m.startswith("PO:") else 1)' || { echo "  keystone override not PO: active"; fail=1; }
   for R in manager member load-balancer_member; do is_id "$(openstack role show "$R" -f value -c id </dev/null 2>&1)" || { echo "  role $R MISSING"; fail=1; }; done
-  local img; img=$(openstack image list --public -f value -c ID -c Name </dev/null 2>&1 | awk '/kube/{print $1;exit}')
+  local img; img=$(openstack image list --public -f json </dev/null 2>&1 | jq -r '[.[]|select(.Name|test("kube"))][0].ID // empty' || true)   # -f json (column-order trap); ID-by-position rode alphabetical luck
   is_id "${img//-/}" 2>/dev/null || [[ "$img" =~ ^[0-9a-f-]{36}$ ]] || { echo "  no public kube image"; fail=1; }
   is_id "$(openstack domain show "$CLIENT" -f value -c id </dev/null 2>&1)" && { echo "  domain $CLIENT already EXISTS -- decide reuse/clean"; fail=1; } || true
   [ "$fail" = 0 ] && echo "  PREFLIGHT PASS" || die "preflight failed"
@@ -57,7 +58,8 @@
   openstack user create --domain "$DOM" --password "$MPW" --description "$CLIENT domain manager (D-051/D-064)" "${CLIENT}-domain-admin" </dev/null >/dev/null 2>&1 || true
   local MUID; MUID=$(openstack user show "${CLIENT}-domain-admin" --domain "$DOM" -f value -c id </dev/null 2>&1); is_id "$MUID" || die "manager create failed"
   openstack role add --domain "$DOM" --user "$MUID" manager </dev/null 2>&1 || true
-  openstack role assignment list --user "$MUID" --names -f value -c Role </dev/null 2>&1 | grep -qw manager || die "manager grant failed"
+  local RA; RA=$(openstack role assignment list --user "$MUID" --names -f value -c Role </dev/null 2>&1 || true)
+  grep -qw manager <<<"$RA" || die "manager grant failed"   # capture-then-test: the raced form false-died on a SUCCESSFUL grant
   local MF="$OUT/${CLIENT}-domain-admin-cred.txt"; : > "$MF"; chmod 600 "$MF"
   printf 'domain=%s\ndomain_id=%s\nusername=%s-domain-admin\nuser_id=%s\npassword=%s\nauth_url=%s\n' "$CLIENT" "$DOM" "$CLIENT" "$MUID" "$MPW" "$AUTH_URL" > "$MF"; chmod 600 "$MF"
   echo "  domain=$DOM manager=$MUID  cred -> $MF"
@@ -124,7 +126,8 @@
 stage4(){ # tenant L3 via app cred
   [ -n "$TENANT_CIDR" ] || die "set TENANT_CIDR (e.g. 10.20.24.0/24)"
   admin_env
-  openstack subnet list -f value -c Subnet </dev/null 2>&1 | grep -qw "$TENANT_CIDR" && die "CIDR $TENANT_CIDR in use"
+  local SNL; SNL=$(openstack subnet list -f value -c Subnet </dev/null 2>&1 || true)
+  grep -qw "$TENANT_CIDR" <<<"$SNL" && die "CIDR $TENANT_CIDR in use"   # capture-then-test: the raced form let a COLLIDING CIDR through (guard failed open)
   local ACF="$OUT/${CLIENT}-svc-appcred.txt"
   echo "== stage4: tenant L3 (net/subnet/router/ext-gw) via app cred =="
   ( for v in $(env|awk -F= '/^OS_/{print $1}'); do unset "$v"; done
@@ -142,7 +145,7 @@
 
 stage5(){ # tenant template (image by UUID)
   admin_env
-  local IMG; IMG=$(openstack image list --public -f value -c ID -c Name </dev/null 2>&1 | awk '/kube/{print $1;exit}')
+  local IMG; IMG=$(openstack image list --public -f json </dev/null 2>&1 | jq -r '[.[]|select(.Name|test("kube"))][0].ID // empty' || true)   # -f json (column-order trap)
   [[ "$IMG" =~ ^[0-9a-f-]{36}$ ]] || die "kube image uuid resolve failed"
   local ACF="$OUT/${CLIENT}-svc-appcred.txt"
   echo "== stage5: tenant cluster template (image by UUID) =="
diff --git a/tests/cloud-assert/run-tests.sh b/tests/cloud-assert/run-tests.sh
new file mode 100644
index 0000000..bd9fcb2
--- /dev/null
+++ b/tests/cloud-assert/run-tests.sh
@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# tests/cloud-assert/run-tests.sh -- offline fakebin harness for cloud-assert.sh
+# (DOCFIX-075). Fake juju/openstack/jq-free: real jq stays real; fake juju and
+# openstack replay fixture outputs keyed by argument patterns, selected per test
+# via FIXDIR. Asserts the behavioral checks fire on the exact incident
+# signatures they were written for (D-045/D-046/D-051/D-062/vault-sealed).
+# Mutates nothing outside $TMP. Exit: 0 all pass | 1 any failed.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+BIN="$TMP/bin"; mkdir -p "$BIN"
+
+cat > "$BIN/juju" <<'FB'
+#!/usr/bin/env bash
+# fake juju: replay fixtures from $FIXDIR keyed by argv patterns
+A="$*"
+case "$A" in
+  *"status -m"*"keystone --format=line"*) cat "$FIXDIR/ks-line.txt" ;;
+  *"status -m"*"--format=json"*)          cat "$FIXDIR/status.json" ;;
+  *"vault/0"*"vault status"*)             cat "$FIXDIR/vault.txt" ;;
+  *"cluster/status OVN_Northbound"*)      cat "$FIXDIR/ovn-nb.txt" ;;
+  *"cluster/status OVN_Southbound"*)      cat "$FIXDIR/ovn-sb.txt" ;;
+  *"connection-status"*)                  cat "$FIXDIR/chassis.txt" ;;
+  *"ps -ww -C magnum-conductor"*)         cat "$FIXDIR/conductor.txt" ;;
+  *) echo "fake-juju: unmatched: $A" >&2; exit 1 ;;
+esac
+FB
+cat > "$BIN/openstack" <<'FB'
+#!/usr/bin/env bash
+A="$*"
+case "$A" in
+  *"hypervisor list"*)        cat "$FIXDIR/hypervisors.json" ;;
+  *"compute service list"*)   cat "$FIXDIR/services.json" ;;
+  *"loadbalancer list"*)      cat "$FIXDIR/lbs.json" ;;
+  *"domain show magnum"*)     cat "$FIXDIR/domain.txt" ;;
+  *"user show magnum_domain_admin"*) cat "$FIXDIR/user.txt" ;;
+  *"coe service list"*)       cat "$FIXDIR/coe.txt" ;;
+  *) echo "fake-openstack: unmatched: $A" >&2; exit 1 ;;
+esac
+FB
+chmod +x "$BIN/juju" "$BIN/openstack"
+
+mkgood() { # healthy-cloud fixture set
+  local d="$1"; mkdir -p "$d"
+  cat > "$d/status.json" <<'J'
+{"applications":{
+ "mysql-innodb-cluster":{"units":{
+   "mysql-innodb-cluster/0":{"workload-status":{"current":"active","message":"Unit is ready: Mode: R/W, Cluster is ONLINE"}},
+   "mysql-innodb-cluster/1":{"workload-status":{"current":"active","message":"Unit is ready: Mode: R/O, Cluster is ONLINE"}},
+   "mysql-innodb-cluster/2":{"workload-status":{"current":"active","message":"Unit is ready: Mode: R/O, Cluster is ONLINE"}}}},
+ "ovn-central":{"units":{"ovn-central/0":{"workload-status":{"current":"active"}},
+   "ovn-central/1":{"workload-status":{"current":"active"}},"ovn-central/2":{"workload-status":{"current":"active"}}}},
+ "nova-compute":{"units":{"nova-compute/0":{"workload-status":{"current":"active"}}}},
+ "octavia":{"units":{"octavia/0":{"workload-status":{"current":"active"}}}},
+ "glance-simplestreams-sync":{"units":{"glance-simplestreams-sync/0":{"workload-status":{"current":"unknown"}}}}
+}}
+J
+  printf 'Initialized  true\nSealed       false\n' > "$d/vault.txt"
+  printf 'Cluster ID: abcd (uuid)\nServers: 3\n' > "$d/ovn-nb.txt"
+  cp "$d/ovn-nb.txt" "$d/ovn-sb.txt"
+  printf 'connected\n' > "$d/chassis.txt"
+  printf '/usr/bin/python3 /usr/bin/magnum-conductor --config-file /etc/magnum/magnum.conf --config-dir /etc/magnum/magnum.conf.d\n' > "$d/conductor.txt"
+  printf '[{"Hypervisor Hostname":"openstack0","State":"up"}]\n' > "$d/hypervisors.json"
+  printf '[{"Binary":"nova-compute","Host":"openstack0","Status":"enabled","State":"up"}]\n' > "$d/services.json"
+  printf '[]\n' > "$d/lbs.json"
+  printf 'True\n' > "$d/domain.txt"
+  printf 'magnum_domain_admin\n' > "$d/user.txt"
+  printf 'magnum-conductor\n' > "$d/coe.txt"
+  printf 'keystone: active/idle 2024.1 PO: 10.12.4.50\n' > "$d/ks-line.txt"
+}
+run() { # run <want_rc> <regex> <label> <fixdir> [env...]
+  local want="$1" rx="$2" label="$3" fd="$4"; shift 4
+  local out rc
+  out="$(cd "$TMP" && env "$@" FIXDIR="$fd" PATH="$BIN:$PATH" OS_AUTH_URL="https://fake:5000/v3" \
+        bash "$REPO/scripts/cloud-assert.sh" 2>&1)"; rc=$?
+  if [[ "$rc" == "$want" ]] && grep -qE "$rx" <<<"$out"; then
+    echo "  PASS  $label"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $label (rc=$rc want=$want)"; grep -E '\[(FAIL|WARN)\]|CLOUD-ASSERT' <<<"$out" | head -6 | sed 's/^/        /'; FAIL=$((FAIL+1))
+  fi
+}
+
+F="$TMP/good"; mkgood "$F";  run 0 'CLOUD-ASSERT: PASS' "T1 healthy cloud -> PASS" "$F"
+F="$TMP/sealed"; mkgood "$F"; printf 'Initialized  true\nSealed       true\n' > "$F/vault.txt"
+                              run 1 'vault SEALED' "T2 sealed vault FAILS (with unseal pointer)" "$F"
+F="$TMP/rw2"; mkgood "$F"; python3 - "$F/status.json" <<'PY'
+import json,sys; p=sys.argv[1]; d=json.load(open(p))
+u=d["applications"]["mysql-innodb-cluster"]["units"]
+u["mysql-innodb-cluster/1"]["workload-status"]["message"]="Unit is ready: Mode: R/W, Cluster is ONLINE"
+json.dump(d,open(p,"w"))
+PY
+                              run 1 'R/W count=2' "T3 mysql split-brain (2x R/W) FAILS" "$F"
+F="$TMP/chassis"; mkgood "$F"; printf 'not connected\n' > "$F/chassis.txt"
+                              run 1 'chassis NOT connected' "T4 dead chassis FAILS (D-045 class)" "$F"
+F="$TMP/pobroken"; mkgood "$F"; printf 'keystone: active/idle 2024.1 PO (broken) 10.12.4.50\n' > "$F/ks-line.txt"
+                              run 1 'PO \(broken\)' "T5 PO(broken) FAILS (DOCFIX-071)" "$F"
+F="$TMP/nodomain"; mkgood "$F"; printf 'No domain with a name or ID\n' > "$F/domain.txt"
+                              run 1 "domain-setup" "T6 missing trustee domain FAILS (D-046)" "$F"
+F="$TMP/graft"; mkgood "$F"; printf '/usr/bin/python3 /usr/bin/magnum-conductor --config-file /etc/magnum/magnum.conf\n' > "$F/conductor.txt"
+                              run 1 'lack --config-dir' "T7 dead conductor graft FAILS (D-037)" "$F"
+F="$TMP/lberr"; mkgood "$F"; printf '[{"name":"lb1","provisioning_status":"ERROR","operating_status":"OFFLINE"}]\n' > "$F/lbs.json"
+                              run 1 'LBs unhealthy' "T8 LB in ERROR FAILS (with failover pointer)" "$F"
+# T9: no admin scope -> A5-A7 HELD, exit 2 (never a silent pass)
+F="$TMP/held"; mkgood "$F"
+out="$(cd "$TMP" && env -u OS_AUTH_URL FIXDIR="$F" PATH="$BIN:$PATH" bash "$REPO/scripts/cloud-assert.sh" 2>&1)"; rc=$?
+if [[ "$rc" == "2" ]] && grep -q 'HELD: no admin scope' <<<"$out"; then echo "  PASS  T9 missing admin scope -> HELD (rc 2)"; PASS=$((PASS+1))
+else echo "  FAIL  T9 (rc=$rc)"; FAIL=$((FAIL+1)); fi
+
+echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1
diff --git a/tests/phase-00-maas-recidr/fakebin/maas b/tests/phase-00-maas-recidr/fakebin/maas
deleted file mode 100644
index 514ff06..0000000
--- a/tests/phase-00-maas-recidr/fakebin/maas
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-# fake maas for re-CIDR: serves reads from fixtures; mutations succeed (apply path).
-prof="${1:-}"; obj="${2:-}"; act="${3:-}"; a4="${4:-}"
-case "$obj $act" in
-  "subnets read")  cat "${FIX_SUBNETS:?}";  exit 0 ;;
-  "ipranges read") cat "${FIX_IPRANGES:?}"; exit 0 ;;
-  "subnet ip-addresses") cat "${FIX_IPADDRS:?}"; exit 0 ;;
-  "vlans read")    jq --arg f "$a4" '[.[]|select((.fabric_id|tostring)==$f)]' "${FIX_VLANS:?}"; exit 0 ;;
-  "subnets create"|"subnet delete"|"iprange delete") echo "Success."; exit 0 ;;
-esac
-echo "{}"; exit 0
diff --git a/tests/phase-00-maas-recidr/make_fixtures.py b/tests/phase-00-maas-recidr/make_fixtures.py
deleted file mode 100644
index b3dbbb4..0000000
--- a/tests/phase-00-maas-recidr/make_fixtures.py
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/env python3
-# Fixtures for phase-00-maas-recidr.sh: pre-migration (d052), migrated (done), wrong-vid.
-import json, os
-FIX = os.path.join(os.path.dirname(os.path.abspath(__file__)), "fix"); os.makedirs(FIX, exist_ok=True)
-def sub(cidr, sid, space, vid, fab): return {"cidr": cidr, "id": sid, "space": space, "vlan": {"vid": vid, "fabric_id": fab}}
-def vlan(vid, vid_id, fab): return {"vid": vid, "id": vid_id, "fabric_id": fab}
-def ipr(start, end, sid, rid): return {"id": rid, "type": "reserved", "start_ip": start, "end_ip": end, "subnet": {"id": sid}}
-def dump(scn, subs, vlans, ipranges, ipaddrs):
-    for nm, obj in (("subnets", subs), ("vlans", vlans), ("ipranges", ipranges), ("ipaddrs", ipaddrs)):
-        open(os.path.join(FIX, f"{scn}_{nm}.json"), "w").write(json.dumps(obj, indent=2) + "\n")
-
-# vlans common to a metal(2)/data(3)/provider(0)/storage(9)/replication(5) layout
-def vlans_pre():
-    return [vlan(0,10,0), vlan(0,20,2), vlan(103,21,2), vlan(0,30,3), vlan(0,90,9), vlan(0,50,5)]
-
-# d052 (pre-migration): the three movers at their OLD cidrs, correct space+vid
-d052_subs = [
-    sub("10.12.4.0/22", 1, "provider-public", 0, 0),
-    sub("10.12.8.0/22", 2, "metal-admin", 0, 2),
-    sub("10.12.12.0/22", 3, "metal-internal", 103, 2),
-    sub("10.12.16.0/22", 4, "data-tenant", 0, 3),
-    sub("10.12.32.0/22", 6, "storage", 0, 9),
-    sub("10.12.36.0/22", 7, "replication", 0, 5),
-]
-d052_ipr = [ipr("10.12.8.2","10.12.8.100",2,100), ipr("10.12.12.2","10.12.12.100",3,101)]  # ranges on metal-admin + metal-internal old subnets
-dump("d052", d052_subs, vlans_pre(), d052_ipr, [])
-
-# done (migrated D-058): old cidrs now host different planes
-done_subs = [
-    sub("10.12.4.0/22", 1, "provider-public", 0, 0),
-    sub("10.12.8.0/22", 2, "provider-vip", 104, 0),
-    sub("10.12.12.0/22", 3, "metal-admin", 0, 2),
-    sub("10.12.16.0/22", 4, "metal-internal", 103, 2),
-    sub("10.12.20.0/22", 5, "data-tenant", 0, 3),
-    sub("10.12.32.0/22", 6, "storage", 0, 9),
-    sub("10.12.36.0/22", 7, "replication", 0, 5),
-]
-done_vlans = [vlan(0,10,0), vlan(104,11,0), vlan(0,20,2), vlan(103,21,2), vlan(0,30,3), vlan(0,90,9), vlan(0,50,5)]
-dump("done", done_subs, done_vlans, [], [])
-
-# wrongvid: metal-internal at old .12 is space metal-internal but VID 99 (not 103)
-wv_subs = [s for s in d052_subs if s["cidr"] != "10.12.12.0/22"] + [sub("10.12.12.0/22", 3, "metal-internal", 99, 2)]
-dump("wrongvid", wv_subs, vlans_pre(), d052_ipr, [])
-print("fixtures written")
diff --git a/tests/phase-00-maas-recidr/run-tests.sh b/tests/phase-00-maas-recidr/run-tests.sh
deleted file mode 100644
index dead104..0000000
--- a/tests/phase-00-maas-recidr/run-tests.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# Behavior regression for phase-00-maas-recidr.sh (D-052/053 -> D-058). Fake maas + real jq.
-set -uo pipefail
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SCRIPT="$(cd "$HERE/../../scripts" && pwd)/phase-00-maas-recidr.sh"
-BIN="$HERE/fakebin"; FIX="$HERE/fix"
-chmod +x "$BIN"/* 2>/dev/null || true
-command -v jq >/dev/null || { echo "FAIL: jq required"; exit 1; }
-python3 "$HERE/make_fixtures.py" >/dev/null
-rc_all=0; OUT="$(mktemp)"
-run() {  # want label scenario [--apply]
-  local want="$1" label="$2" s="$3"; shift 3
-  PATH="$BIN:$PATH" FIX_SUBNETS="$FIX/${s}_subnets.json" FIX_VLANS="$FIX/${s}_vlans.json" \
-    FIX_IPRANGES="$FIX/${s}_ipranges.json" FIX_IPADDRS="$FIX/${s}_ipaddrs.json" \
-    bash "$SCRIPT" "$@" >"$OUT" 2>&1
-  local rc=$?
-  if [ "$rc" -ne "$want" ]; then printf '  [XX] %-44s exit %s (want %s)\n' "$label" "$rc" "$want"; sed 's/^/        /' "$OUT"; rc_all=1; return 1; fi
-  printf '  [ok] %-44s exit %s\n' "$label" "$rc"; return 0
-}
-has()   { grep -qE "$1" "$OUT" || { printf '       MISS /%s/\n' "$1"; rc_all=1; }; }
-absent(){ grep -qE "$1" "$OUT" && { printf '       LEAK /%s/\n' "$1"; rc_all=1; } || true; }
-before(){ local x y; x=$(grep -nE "$1" "$OUT"|head -1|cut -d: -f1); y=$(grep -nE "$2" "$OUT"|head -1|cut -d: -f1); { [ -n "$x" ] && [ -n "$y" ] && [ "$x" -lt "$y" ]; } || { printf '       ORDER /%s/ not before /%s/\n' "$1" "$2"; rc_all=1; }; }
-
-echo "=== phase-00-maas-recidr.sh -- D-052/053 -> D-058 (fake maas + real jq) ==="
-run 0 "pre-migration (d052): dry-run plan" d052
-has 'metal-admin: 10\.12\.8\.0/22 .*fabric 2, vid 0. -> 10\.12\.12\.0/22'
-has 'metal-internal: 10\.12\.12\.0/22 .*vid 103. -> 10\.12\.16\.0/22'
-has 'data-tenant: 10\.12\.16\.0/22 .*fabric 3.*-> 10\.12\.20\.0/22'
-has 'metal fabric .* = 2'
-has 'data  fabric .* = 3'
-has 'reserved range ids to delete first: 100'
-has 're-run with --apply'
-absent 'DO:'
-
-run 0 "pre-migration (d052): --apply, deletes BEFORE creates" d052 --apply
-has 'DO: delete iprange 100'
-has 'DO: delete subnet id=2'
-has 'DO: create subnet 10\.12\.12\.0/22 on fabric 2 vid 0'
-has 'DO: create subnet 10\.12\.16\.0/22 on fabric 2 vid 103'
-has 'DO: create subnet 10\.12\.20\.0/22 on fabric 3 vid 0'
-before 'MUTATE 1/2' 'MUTATE 2/2'
-before 'DO: delete subnet id=4' 'DO: create subnet 10\.12\.12'
-
-run 0 "migrated (done): nothing to migrate" done
-has 'already migrated or not this plane; SKIP'
-has 'nothing to migrate'
-absent 'DO:'
-absent 'WOULD:'
-
-run 1 "wrong VID at old .12 -> refuse" wrongvid
-has "subnet 10\.12\.12\.0/22 on VID '99', expected 103 -- refusing"
-
-echo
-[ "$rc_all" -eq 0 ] && echo "ALL PASS" || echo "SOME FAILED"
-rm -f "$OUT"; exit "$rc_all"
diff --git a/tests/phase-00-teardown-d061/run-tests.sh b/tests/phase-00-teardown-d061/run-tests.sh
new file mode 100644
index 0000000..53f9722
--- /dev/null
+++ b/tests/phase-00-teardown-d061/run-tests.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# tests/phase-00-teardown-d061/run-tests.sh -- offline harness for the D-061
+# teardown PAIR (phase-00-teardown-release.sh / phase-00-teardown-destroy.sh).
+# These are the most destructive scripts in the repo and shipped WITHOUT tests
+# (their --no-prompt flag exists for "tested automation only" -- this is it).
+# Replaces the retired tests/phase-00-teardown/ (its target script is git rm'd).
+#
+# Stateful fakebin: fake `maas` serves machines-<phase>.json selected by a
+# state file; fake `juju remove-machine`/`destroy-model` advance the phase, so
+# survival/decompose verification reads post-mutation state. Fake `sleep` makes
+# the 30s settle instant. Mutates nothing outside $TMP.
+# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+BIN="$TMP/bin"; mkdir -p "$BIN"
+
+cat > "$BIN/maas" <<'FB'
+#!/usr/bin/env bash
+# fake maas: `maas admin machines read` serves machines-$(phase).json;
+# `maas admin machine delete <sid>` logs the delete.
+case "$*" in
+  "admin machines read") cat "$FIXDIR/machines-$(cat "$FIXDIR/phase").json" ;;
+  "admin machine delete"*) echo "$4" >> "$FIXDIR/deleted.log" ;;
+  *) echo "fake-maas unmatched: $*" >&2; exit 1 ;;
+esac
+FB
+cat > "$BIN/juju" <<'FB'
+#!/usr/bin/env bash
+case "$*" in
+  "models --format=json") printf '{"models":[{"name":"admin/openstack"}]}' ;;
+  "machines -m openstack --format=json") cat "$FIXDIR/juju-machines.json" ;;
+  "remove-machine "*)
+    echo "$*" >> "$FIXDIR/remove.log"
+    # advance state so the survival re-read sees post-remove reality
+    echo "postremove" > "$FIXDIR/phase" ;;
+  "destroy-model "*)
+    echo "$*" >> "$FIXDIR/destroy.log"
+    echo "postdestroy" > "$FIXDIR/phase" ;;
+  *) echo "fake-juju unmatched: $*" >&2; exit 1 ;;
+esac
+FB
+printf '#!/usr/bin/env bash\nexit 0\n' > "$BIN/sleep"
+chmod +x "$BIN"/maas "$BIN"/juju "$BIN"/sleep
+
+MJ_FULL='[
+ {"hostname":"juju","system_id":"sub001","status_name":"Deployed"},
+ {"hostname":"lxd","system_id":"sub002","status_name":"Deployed"},
+ {"hostname":"tailscale","system_id":"sub003","status_name":"Deployed"},
+ {"hostname":"openstack0","system_id":"abc100","status_name":"Deployed"},
+ {"hostname":"openstack1","system_id":"abc101","status_name":"Deployed"},
+ {"hostname":"openstack2","system_id":"abc102","status_name":"Deployed"},
+ {"hostname":"openstack3","system_id":"abc103","status_name":"Deployed"},
+ {"hostname":"capi-mgmt","system_id":"orp001","status_name":"Ready"}]'
+MJ_SUBSTRATE_ONLY='[
+ {"hostname":"juju","system_id":"sub001","status_name":"Deployed"},
+ {"hostname":"lxd","system_id":"sub002","status_name":"Deployed"},
+ {"hostname":"tailscale","system_id":"sub003","status_name":"Deployed"}]'
+JM='{"machines":{"0":{"instance-id":"openstack0"},"1":{"instance-id":"openstack1"},"2":{"instance-id":"openstack2"},"3":{"instance-id":"openstack3"}}}'
+
+mkfix() { # mkfix <name> <initial-json> <postremove-json> <postdestroy-json>
+  local d="$TMP/$1"; mkdir -p "$d"
+  printf '%s' "$2" > "$d/machines-initial.json"
+  printf '%s' "$3" > "$d/machines-postremove.json"
+  printf '%s' "$4" > "$d/machines-postdestroy.json"
+  printf '%s' "$JM" > "$d/juju-machines.json"
+  echo "initial" > "$d/phase"; : > "$d/remove.log"; : > "$d/deleted.log"; : > "$d/destroy.log"
+  echo "$d"
+}
+run() { # run <script> <want_rc> <regex> <label> <fixdir> [args...]
+  local sc="$1" want="$2" rx="$3" label="$4" fd="$5"; shift 5
+  local out rc
+  out=$(env FIXDIR="$fd" PATH="$BIN:$PATH" bash "$REPO/scripts/$sc" "$@" 2>&1); rc=$?
+  if [ "$rc" = "$want" ] && printf '%s' "$out" | grep -qE "$rx"; then
+    echo "  PASS  $label"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $label (rc=$rc want=$want)"; printf '%s\n' "$out" | tail -6 | sed 's/^/        /'; FAIL=$((FAIL+1))
+  fi
+}
+
+R=phase-00-teardown-release.sh
+D=phase-00-teardown-destroy.sh
+
+# --- release path ---
+F=$(mkfix r-dry "$MJ_FULL" "$MJ_FULL" "$MJ_FULL")
+run "$R" 0 'OK \(dryrun\)' "R1 release dry-run: plan only, nothing changed" "$F"
+[ -s "$F/remove.log" ] && { echo "  FAIL  R1b dry-run must not remove"; FAIL=$((FAIL+1)); }
+
+F=$(mkfix r-canary "$MJ_FULL" "$MJ_FULL" "$MJ_FULL")
+run "$R" 0 'CANARY OK: openstack0 .* SURVIVED' "R2 canary: remove openstack0 only, survival verified, STOP" "$F" --apply --canary --no-prompt
+CNT=$(wc -l < "$F/remove.log"); [ "$CNT" = 1 ] || { echo "  FAIL  R2b canary must remove exactly 1 (got $CNT)"; FAIL=$((FAIL+1)); }
+[ -s "$F/destroy.log" ] && { echo "  FAIL  R2c canary must NOT destroy the model"; FAIL=$((FAIL+1)); }
+
+# decompose detection: post-remove state DROPS openstack0 -> FAIL LOUD, no destroy
+F=$(mkfix r-decomp "$MJ_FULL" "$(printf '%s' "$MJ_FULL" | jq 'map(select(.hostname!="openstack0"))')" "$MJ_FULL")
+run "$R" 1 'DECOMPOSED .* did NOT hold' "R3 canary decompose-detection FAILS LOUD" "$F" --apply --canary --no-prompt
+[ -s "$F/destroy.log" ] && { echo "  FAIL  R3b decompose must block destroy-model"; FAIL=$((FAIL+1)); }
+
+F=$(mkfix r-full "$MJ_FULL" "$MJ_FULL" "$MJ_FULL")
+run "$R" 0 'hosts are KEPT' "R4 full release: 4 removes + destroy + orphan delete, hosts kept" "$F" --apply --no-prompt
+CNT=$(wc -l < "$F/remove.log"); [ "$CNT" = 4 ] || { echo "  FAIL  R4b want 4 removes (got $CNT)"; FAIL=$((FAIL+1)); }
+grep -q -- '--release-storage' "$F/destroy.log" || { echo "  FAIL  R4c destroy must use --release-storage"; FAIL=$((FAIL+1)); }
+grep -qx 'orp001' "$F/deleted.log" || { echo "  FAIL  R4d orphan capi-mgmt not deleted"; FAIL=$((FAIL+1)); }
+
+# substrate collision: a host hostname resolving to a PROTECTED sid must abort pre-mutation
+F=$(mkfix r-prot "$(printf '%s' "$MJ_FULL" | jq '(.[] | select(.hostname=="openstack0") | .system_id) = "sub001"')" "$MJ_FULL" "$MJ_FULL")
+run "$R" 1 'PROTECTED sid .* ABORT' "R5 substrate-sid collision aborts with nothing changed" "$F" --apply --no-prompt
+[ -s "$F/remove.log" ] && { echo "  FAIL  R5b abort must precede any remove"; FAIL=$((FAIL+1)); }
+
+# --- destroy path ---
+F=$(mkfix d-dry "$MJ_FULL" "$MJ_FULL" "$MJ_FULL")
+run "$D" 0 'OK \(dryrun\)' "D1 destroy dry-run: plan only" "$F"
+
+F=$(mkfix d-full "$MJ_FULL" "$MJ_FULL" "$MJ_SUBSTRATE_ONLY")
+run "$D" 0 'OK \(apply\)' "D2 full destroy: hosts decomposed, substrate intact, orphan deleted" "$F" --apply --no-prompt
+grep -q -- '--destroy-storage' "$F/destroy.log" || { echo "  FAIL  D2b destroy must use --destroy-storage"; FAIL=$((FAIL+1)); }
+grep -qx 'orp001' "$F/deleted.log" || { echo "  FAIL  D2c orphan not deleted"; FAIL=$((FAIL+1)); }
+
+F=$(mkfix d-prot "$(printf '%s' "$MJ_FULL" | jq '(.[] | select(.hostname=="capi-mgmt") | .system_id) = "sub002"')" "$MJ_FULL" "$MJ_FULL")
+run "$D" 1 'PROTECTED sid .* ABORT' "D3 orphan-sid collision with substrate aborts" "$F" --apply --no-prompt
+[ -s "$F/destroy.log" ] && { echo "  FAIL  D3b abort must precede destroy"; FAIL=$((FAIL+1)); }
+
+echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ] && { echo "ALL PASS"; exit 0; } || exit 1
diff --git a/tests/phase-00-teardown/fakebin/juju b/tests/phase-00-teardown/fakebin/juju
deleted file mode 100644
index 78d33ee..0000000
--- a/tests/phase-00-teardown/fakebin/juju
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-# fake juju: models --format=json from fixture; destroy-model succeeds.
-sub="${1:-}"
-case "$sub" in
-  models) cat "${FIX_MODELS:?}"; exit 0 ;;
-  destroy-model) echo "destroying model: $*"; exit 0 ;;
-esac
-echo "{}"; exit 0
diff --git a/tests/phase-00-teardown/fakebin/maas b/tests/phase-00-teardown/fakebin/maas
deleted file mode 100644
index cfbad21..0000000
--- a/tests/phase-00-teardown/fakebin/maas
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-# fake maas: serves machines read from fixture; machine delete succeeds.
-prof="${1:-}"; obj="${2:-}"; act="${3:-}"; a4="${4:-}"
-case "$obj $act" in
-  "machines read") cat "${FIX_MACHINES:?}"; exit 0 ;;
-  "machine delete") echo "Success."; exit 0 ;;
-  "machine read") cat "${FIX_MACHINES:?}" | jq --arg s "$a4" '.[]|select(.system_id==$s)'; exit 0 ;;
-esac
-echo "{}"; exit 0
diff --git a/tests/phase-00-teardown/make_fixtures.py b/tests/phase-00-teardown/make_fixtures.py
deleted file mode 100644
index 93832e5..0000000
--- a/tests/phase-00-teardown/make_fixtures.py
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env python3
-# Fixtures for phase-00-teardown.sh. Machine roster + sids measured 2026-06-29.
-import json, os
-FIX=os.path.join(os.path.dirname(os.path.abspath(__file__)),"fix"); os.makedirs(FIX,exist_ok=True)
-def m(host,sid,st): return {"hostname":host,"system_id":sid,"status_name":st}
-ROSTER=[
-  m("juju","88fkyf","Deployed"), m("lxd","mfewpp","Deployed"), m("tailscale","rkd3da","Deployed"),
-  m("capi-mgmt","cffxxg","Ready"),
-  m("openstack0","6xey8x","Deployed"), m("openstack1","4667xm","Deployed"),
-  m("openstack2","f6t87k","Deployed"), m("openstack3","htbft7","Deployed"),
-]
-def dump(scn, machines, models):
-    open(os.path.join(FIX,f"{scn}_machines.json"),"w").write(json.dumps(machines,indent=2)+"\n")
-    open(os.path.join(FIX,f"{scn}_models.json"),"w").write(json.dumps({"models":models},indent=2)+"\n")
-MODELS_WITH=[{"name":"admin/openstack"},{"name":"admin/controller"}]
-MODELS_WITHOUT=[{"name":"admin/controller"}]
-dump("live",        ROSTER, MODELS_WITH)                                  # normal: model present, all machines
-dump("hostmissing", [x for x in ROSTER if x["hostname"]!="openstack2"], MODELS_WITH)   # openstack2 gone
-dump("modelgone",   ROSTER, MODELS_WITHOUT)                               # model already destroyed
-print("fixtures written")
diff --git a/tests/phase-00-teardown/run-tests.sh b/tests/phase-00-teardown/run-tests.sh
deleted file mode 100644
index eabf488..0000000
--- a/tests/phase-00-teardown/run-tests.sh
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-# Behavior regression for phase-00-teardown.sh. Fake juju + fake maas + real jq.
-set -uo pipefail
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SCRIPT="$(cd "$HERE/../../scripts" && pwd)/phase-00-teardown.sh"
-BIN="$HERE/fakebin"; FIX="$HERE/fix"
-chmod +x "$BIN"/* 2>/dev/null || true
-command -v jq >/dev/null || { echo "FAIL: jq required"; exit 1; }
-python3 "$HERE/make_fixtures.py" >/dev/null
-rc_all=0; OUT="$(mktemp)"
-run() { local want="$1" label="$2" s="$3"; shift 3
-  PATH="$BIN:$PATH" FIX_MACHINES="$FIX/${s}_machines.json" FIX_MODELS="$FIX/${s}_models.json" \
-    bash "$SCRIPT" "$@" >"$OUT" 2>&1; local rc=$?
-  if [ "$rc" -ne "$want" ]; then printf '  [XX] %-44s exit %s (want %s)\n' "$label" "$rc" "$want"; sed 's/^/        /' "$OUT"; rc_all=1; return 1; fi
-  printf '  [ok] %-44s exit %s\n' "$label" "$rc"; return 0; }
-has()   { grep -qE "$1" "$OUT" || { printf '       MISS /%s/\n' "$1"; rc_all=1; }; }
-absent(){ grep -qE "$1" "$OUT" && { printf '       LEAK /%s/\n' "$1"; rc_all=1; } || true; }
-# assert NONE of the substrate system_ids appear on a "DO:" line
-no_substrate_do(){ if grep -E '^\s*DO:' "$OUT" | grep -qE '88fkyf|mfewpp|rkd3da'; then printf '       SUBSTRATE in a DO line!\n'; rc_all=1; fi; }
-
-echo "=== phase-00-teardown.sh -- model destroy + orphan delete, substrate-protected ==="
-run 0 "audit (dry-run): plan + protections" live
-has 'PROTECTED substrate'
-has 'juju = 88fkyf .*PROTECTED'; has 'lxd = mfewpp .*PROTECTED'; has 'tailscale = rkd3da .*PROTECTED'
-has 'openstack0 = 6xey8x'; has 'openstack3 = htbft7'
-has 'capi-mgmt = cffxxg .*DELETE'
-has "model 'openstack' is PRESENT"
-has 'OK \(dryrun\)'
-absent '^\s*DO:'
-
-run 0 "apply --no-prompt: destroy + delete orphan" live --apply --no-prompt
-has 'DO: destroy model openstack'
-has 'DO: delete orphan capi-mgmt'
-has 'VERIFY 3/3'
-has 'PROTECTED tailscale -> Deployed \(unchanged\)'
-has 'OK \(apply\)'
-no_substrate_do
-
-run 1 "safety: a host missing -> ABORT" hostmissing --apply --no-prompt
-has 'openstack2: not found in MAAS'
-has 'ABORT'
-absent 'DO: destroy model'
-
-run 0 "idempotent: model already gone -> skip destroy" modelgone --apply --no-prompt
-has "model 'openstack' not present"
-absent 'DO: destroy model openstack'
-has 'DO: delete orphan capi-mgmt'
-has 'OK \(apply\)'
-
-echo
-[ "$rc_all" -eq 0 ] && echo "ALL PASS" || echo "SOME FAILED"
-rm -f "$OUT"; exit "$rc_all"
diff --git a/tests/preflight/run-tests.sh b/tests/preflight/run-tests.sh
new file mode 100644
index 0000000..2fde066
--- /dev/null
+++ b/tests/preflight/run-tests.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# tests/preflight/run-tests.sh -- offline harness for preflight.sh (DOCFIX-073).
+# Builds a fixture repo whose gate scripts are stubs with controlled exits, plus
+# a fakebin juju for the channel assert. Asserts ordering, aggregation (worst of
+# 0/1/2), and fail-closed behavior on a missing gate. Mutates nothing outside $TMP.
+# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+
+mkfix() { # mkfix <name> <lint_rc> <bundlechk_rc> <preflight_present:0|1>
+  local d="$TMP/$1"; mkdir -p "$d/scripts" "$d/fakebin"
+  cp "$REPO/scripts/preflight.sh" "$REPO/scripts/channel_assert.py" "$d/scripts/"
+  printf 'applications:\n  keystone: {charm: keystone, channel: 2024.1/stable}\n' > "$d/bundle.yaml"
+  printf '#!/usr/bin/env bash\necho "  [stub] lint"\nexit %s\n' "$2" > "$d/scripts/repo-lint.sh"
+  printf '#!/usr/bin/env python3\nimport sys;print("  [stub] bundlechk");sys.exit(%s)\n' "$3" > "$d/scripts/provider-bundle-check.py"
+  if [ "$4" = "1" ]; then
+    printf '#!/usr/bin/env bash\necho "  [stub] live preflight"\nexit 0\n' > "$d/scripts/pre-flight-checks.sh"
+  fi
+  # fakebin juju: publishes 2024.1/stable in the channel map
+  cat > "$d/fakebin/juju" <<'FB'
+#!/usr/bin/env bash
+if [ "$1" = "info" ]; then
+  printf 'name: %s\nchannels:\n  2024.1/stable: 778 2024-05-01\n' "$2"; exit 0
+fi
+exit 1
+FB
+  chmod +x "$d/fakebin/juju"
+  echo "$d"
+}
+run() { # run <want_rc> <regex> <label> <dir>
+  local out rc
+  out="$(PATH="$4/fakebin:$PATH" bash "$4/scripts/preflight.sh" "$4" 2>&1)"; rc=$?
+  if [[ "$rc" == "$1" ]] && grep -qE "$2" <<<"$out"; then
+    echo "  PASS  $3"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $3 (rc=$rc want=$1)"; echo "$out" | tail -6 | sed 's/^/        /'; FAIL=$((FAIL+1))
+  fi
+}
+
+D=$(mkfix all_pass 0 0 1);   run 0 'PREFLIGHT: PASS' "T1 all gates pass -> PASS" "$D"
+D=$(mkfix lint_fail 1 0 1);  run 1 'PREFLIGHT: FAIL' "T2 lint FAIL -> overall FAIL" "$D"
+D=$(mkfix bundle_fail 0 1 1); run 1 'PREFLIGHT: FAIL' "T3 bundle FAIL -> overall FAIL" "$D"
+D=$(mkfix warn_only 2 0 1);  run 2 'PREFLIGHT: WARN' "T4 lint WARN -> overall WARN" "$D"
+D=$(mkfix missing_gate 0 0 0); run 1 'pre-flight-checks.sh missing' "T5 missing gate FAILS CLOSED" "$D"
+# T6: channel pinned to a track fakebin does not publish -> FAIL
+D=$(mkfix badpin 0 0 1); printf 'applications:\n  vault: {charm: vault, channel: 9.9/stable}\n' > "$D/bundle.yaml"
+run 1 'does not publish' "T6 unpublished channel pin FAILS" "$D"
+# T7: juju unreachable -> WARN (exit 2), not FAIL
+D=$(mkfix offline 0 0 1); rm "$D/fakebin/juju"
+run 2 'verify .* manually' "T7 charmhub unreachable -> WARN" "$D"
+
+echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1
diff --git a/tests/provider-bundle-check/run-tests.sh b/tests/provider-bundle-check/run-tests.sh
new file mode 100644
index 0000000..0894856
--- /dev/null
+++ b/tests/provider-bundle-check/run-tests.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# tests/provider-bundle-check/run-tests.sh
+#
+# Offline regression harness for scripts/provider-bundle-check.py. No live infra;
+# fixtures are generated from the repo bundle by targeted mutation, so every check
+# is proven to FAIL when its invariant is violated (bash -n / "it parsed" proves
+# nothing -- behavior is the contract). Mutates NOTHING outside $TMP.
+# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+CHK="$REPO/scripts/provider-bundle-check.py"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+
+# fixture base: real bundle + the policies dir the DOCFIX-071 check resolves
+mkdir -p "$TMP/policies"
+cp "$REPO/bundle.yaml" "$TMP/good.yaml"
+cp "$REPO/policies/domain-manager-policy.yaml" "$REPO/policies/overrides.zip" "$TMP/policies/"
+
+mutate() { # mutate <out> <python-expr operating on dict b>
+  python3 - "$TMP/good.yaml" "$TMP/$1" "$2" <<'PY'
+import sys, yaml
+src, dst, expr = sys.argv[1], sys.argv[2], sys.argv[3]
+b = yaml.safe_load(open(src))
+exec(expr)
+yaml.safe_dump(b, open(dst, "w"))
+PY
+}
+
+run() { # run <want_rc> <regex> <label> <bundle>
+  local want="$1" rx="$2" label="$3" f="$4"
+  local out rc
+  out="$(python3 "$CHK" "$f" 2>&1)"; rc=$?
+  if [[ "$rc" == "$want" ]] && grep -qE "$rx" <<<"$out"; then
+    echo "  PASS  $label"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $label (rc=$rc want=$want)"; echo "$out" | sed 's/^/        /' | head -6; FAIL=$((FAIL+1))
+  fi
+}
+
+# T1 happy path: the repo bundle itself must PASS
+run 0 'PASS: Pattern A' "T1 repo bundle passes clean" "$TMP/good.yaml"
+
+# T2 relation referencing a ghost app
+mutate t2.yaml 'b["relations"].append(["ghost-app:amqp","rabbitmq-server:amqp"])'
+run 1 'unknown app' "T2 ghost relation app FAILS" "$TMP/t2.yaml"
+
+# T3 endpoint-less relation side (the missing-colon class)
+mutate t3.yaml 'b["relations"].append(["keystone","rabbitmq-server:amqp"])'
+run 1 'lacks explicit :endpoint' "T3 endpoint-less relation FAILS" "$TMP/t3.yaml"
+
+# T4 D-062 regression: mysql at 1 unit
+mutate t4.yaml 'b["applications"]["mysql-innodb-cluster"]["num_units"]=1'
+run 1 'D-062 requires 3' "T4 mysql num_units=1 FAILS" "$TMP/t4.yaml"
+
+# T5 shared VIP octet between two apps
+mutate t5.yaml 'b["applications"]["glance"]["options"]["vip"]="10.12.4.50 10.12.8.50 10.12.12.50"'
+run 1 'shared by' "T5 duplicate VIP octet FAILS" "$TMP/t5.yaml"
+
+# T6 DOCFIX-071 regression: keystone resource stanza removed
+mutate t6.yaml 'b["applications"]["keystone"].pop("resources",None)'
+run 1 'DOCFIX-071' "T6 missing policyd resource FAILS" "$TMP/t6.yaml"
+
+# T7 DOCFIX-071 drift: zip content differs from the yaml source
+mutate t7.yaml 'pass'
+printf '\n# drift\n' >> "$TMP/policies/domain-manager-policy.yaml"
+run 1 'DIFFERS from policies' "T7 zip/source drift FAILS" "$TMP/t7.yaml"
+cp "$REPO/policies/domain-manager-policy.yaml" "$TMP/policies/"   # restore
+
+# T8 original invariant still guarded: octavia VIP off-band
+mutate t8.yaml 'b["applications"]["octavia"]["options"]["vip"]="10.12.4.233 10.12.8.233 10.12.12.233"'
+run 1 'outside 50-60' "T8 off-band VIP octet FAILS" "$TMP/t8.yaml"
+
+echo
+echo "RESULT: PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1
diff --git a/tests/provider-vip-standup/fakebin/maas b/tests/provider-vip-standup/fakebin/maas
deleted file mode 100644
index 0c88b34..0000000
--- a/tests/provider-vip-standup/fakebin/maas
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-# fake maas: serves read endpoints from fixtures; dry-run never calls mutations.
-prof="${1:-}"; obj="${2:-}"; act="${3:-}"
-[ "$obj" = subnets ]  && [ "$act" = read ] && { cat "${FIX_SUBNETS:?}";  exit 0; }
-[ "$obj" = spaces ]   && [ "$act" = read ] && { cat "${FIX_SPACES:?}";   exit 0; }
-[ "$obj" = vlans ]    && [ "$act" = read ] && { cat "${FIX_VLANS:?}";    exit 0; }
-[ "$obj" = ipranges ] && [ "$act" = read ] && { cat "${FIX_IPRANGES:?}"; exit 0; }
-echo "{}"; exit 0
diff --git a/tests/provider-vip-standup/fix/ipr_done.json b/tests/provider-vip-standup/fix/ipr_done.json
deleted file mode 100644
index 9f88ef6..0000000
--- a/tests/provider-vip-standup/fix/ipr_done.json
+++ /dev/null
@@ -1,2 +0,0 @@
-[ {"id":1,"type":"reserved","start_ip":"10.12.4.2","end_ip":"10.12.4.100","subnet":{"id":1},"comment":"prov vip"},
-  {"id":9,"type":"reserved","start_ip":"10.12.8.2","end_ip":"10.12.8.100","subnet":{"id":4},"comment":"provider-vip API VIP band (D-057)"} ]
diff --git a/tests/provider-vip-standup/fix/ipr_fresh.json b/tests/provider-vip-standup/fix/ipr_fresh.json
deleted file mode 100644
index edf3872..0000000
--- a/tests/provider-vip-standup/fix/ipr_fresh.json
+++ /dev/null
@@ -1 +0,0 @@
-[ {"id":1,"type":"reserved","start_ip":"10.12.4.2","end_ip":"10.12.4.100","subnet":{"id":1},"comment":"prov vip"} ]
diff --git a/tests/provider-vip-standup/fix/spaces_done.json b/tests/provider-vip-standup/fix/spaces_done.json
deleted file mode 100644
index d6c89aa..0000000
--- a/tests/provider-vip-standup/fix/spaces_done.json
+++ /dev/null
@@ -1 +0,0 @@
-[ {"id":10,"name":"provider-public"},{"id":11,"name":"metal-admin"},{"id":12,"name":"metal-internal"},{"id":30,"name":"provider-vip"} ]
diff --git a/tests/provider-vip-standup/fix/spaces_fresh.json b/tests/provider-vip-standup/fix/spaces_fresh.json
deleted file mode 100644
index 4c5a397..0000000
--- a/tests/provider-vip-standup/fix/spaces_fresh.json
+++ /dev/null
@@ -1 +0,0 @@
-[ {"id":10,"name":"provider-public"},{"id":11,"name":"metal-admin"},{"id":12,"name":"metal-internal"} ]
diff --git a/tests/provider-vip-standup/fix/sub_done.json b/tests/provider-vip-standup/fix/sub_done.json
deleted file mode 100644
index 538da6c..0000000
--- a/tests/provider-vip-standup/fix/sub_done.json
+++ /dev/null
@@ -1,3 +0,0 @@
-[ {"id":1,"cidr":"10.12.4.0/22","space":"provider-public","managed":true,"gateway_ip":"10.12.4.1","dns_servers":[],"vlan":{"id":5001,"vid":0,"fabric":"1_provider","fabric_id":1,"mtu":1500}},
-  {"id":3,"cidr":"10.12.16.0/22","space":"metal-internal","managed":true,"gateway_ip":null,"dns_servers":["10.12.12.1"],"vlan":{"id":5003,"vid":103,"fabric":"2_metal","fabric_id":2,"mtu":1500}},
-  {"id":4,"cidr":"10.12.8.0/22","space":"provider-vip","managed":true,"gateway_ip":"10.12.8.1","dns_servers":["10.12.12.1"],"vlan":{"id":5004,"vid":104,"fabric":"1_provider","fabric_id":1,"mtu":1500}} ]
diff --git a/tests/provider-vip-standup/fix/sub_fresh.json b/tests/provider-vip-standup/fix/sub_fresh.json
deleted file mode 100644
index f04e9f0..0000000
--- a/tests/provider-vip-standup/fix/sub_fresh.json
+++ /dev/null
@@ -1,34 +0,0 @@
-[
-{
-"id": 1,
-"cidr": "10.12.4.0/22",
-"space": "provider-public",
-"managed": true,
-"gateway_ip": "10.12.4.1",
-"dns_servers": [],
-"vlan": {
-"id": 5001,
-"vid": 0,
-"fabric": "1_provider",
-"fabric_id": 1,
-"mtu": 1500
-}
-},
-{
-"id": 3,
-"cidr": "10.12.16.0/22",
-"space": "metal-internal",
-"managed": true,
-"gateway_ip": null,
-"dns_servers": [
-"10.12.12.1"
-],
-"vlan": {
-"id": 5003,
-"vid": 103,
-"fabric": "2_metal",
-"fabric_id": 2,
-"mtu": 9000
-}
-}
-]
\ No newline at end of file
diff --git a/tests/provider-vip-standup/fix/sub_nofab.json b/tests/provider-vip-standup/fix/sub_nofab.json
deleted file mode 100644
index 5f0dc7d..0000000
--- a/tests/provider-vip-standup/fix/sub_nofab.json
+++ /dev/null
@@ -1 +0,0 @@
-[ {"id":3,"cidr":"10.12.16.0/22","space":"metal-internal","managed":true,"dns_servers":["10.12.12.1"],"vlan":{"id":5003,"vid":103,"fabric":"2_metal","fabric_id":2,"mtu":1500}} ]
diff --git a/tests/provider-vip-standup/fix/sub_wrongvid.json b/tests/provider-vip-standup/fix/sub_wrongvid.json
deleted file mode 100644
index a23b84e..0000000
--- a/tests/provider-vip-standup/fix/sub_wrongvid.json
+++ /dev/null
@@ -1,2 +0,0 @@
-[ {"id":1,"cidr":"10.12.4.0/22","space":"provider-public","managed":true,"gateway_ip":"10.12.4.1","dns_servers":[],"vlan":{"id":5001,"vid":0,"fabric":"1_provider","fabric_id":1,"mtu":1500}},
-  {"id":4,"cidr":"10.12.8.0/22","space":"undefined","managed":true,"gateway_ip":null,"dns_servers":[],"vlan":{"id":5099,"vid":99,"fabric":"1_provider","fabric_id":1,"mtu":1500}} ]
diff --git a/tests/provider-vip-standup/fix/vlans_done.json b/tests/provider-vip-standup/fix/vlans_done.json
deleted file mode 100644
index 748ee78..0000000
--- a/tests/provider-vip-standup/fix/vlans_done.json
+++ /dev/null
@@ -1,2 +0,0 @@
-[ {"id":5001,"vid":0,"name":"untagged","fabric_id":1,"space":"provider-public","mtu":1500},
-  {"id":5004,"vid":104,"name":"provider-vip","fabric_id":1,"space":"provider-vip","mtu":1500} ]
diff --git a/tests/provider-vip-standup/fix/vlans_fresh.json b/tests/provider-vip-standup/fix/vlans_fresh.json
deleted file mode 100644
index fc2a6cb..0000000
--- a/tests/provider-vip-standup/fix/vlans_fresh.json
+++ /dev/null
@@ -1 +0,0 @@
-[ {"id":5001,"vid":0,"name":"untagged","fabric_id":1,"space":"provider-public","mtu":1500} ]
diff --git a/tests/provider-vip-standup/run-tests.sh b/tests/provider-vip-standup/run-tests.sh
deleted file mode 100644
index 3869264..0000000
--- a/tests/provider-vip-standup/run-tests.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# Behavior regression for provider-vip-standup.sh (D-057). Fake `maas` + real jq.
-# Drives the script in DRY-RUN and asserts the emitted WOULD/SKIP/fail behaviour.
-set -uo pipefail
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SCRIPT="$(cd "$HERE/../../scripts" && pwd)/provider-vip-standup.sh"
-BIN="$HERE/fakebin"; FIX="$HERE/fix"
-chmod +x "$BIN"/* 2>/dev/null || true   # GitHub Desktop lands files mode 100644
-command -v jq >/dev/null || { echo "FAIL: jq required"; exit 1; }
-rc_all=0; OUT="$(mktemp)"
-
-run() {  # <want_exit> <label> <subnets> <spaces> <vlans> <ipranges>
-  local want="$1" label="$2"
-  PATH="$BIN:$PATH" FIX_SUBNETS="$3" FIX_SPACES="$4" FIX_VLANS="$5" FIX_IPRANGES="$6" \
-    bash "$SCRIPT" >"$OUT" 2>&1
-  local rc=$?
-  if [ "$rc" -ne "$want" ]; then
-    printf '  [XX] %-38s exit %s (want %s)\n' "$label" "$rc" "$want"; sed 's/^/        /' "$OUT"; rc_all=1; return 1
-  fi
-  printf '  [ok] %-38s exit %s\n' "$label" "$rc"; return 0
-}
-has()   { grep -qE "$1" "$OUT" || { printf '       MISS expected /%s/\n' "$1"; rc_all=1; }; }
-absent(){ grep -qE "$1" "$OUT" && { printf '       LEAK forbidden /%s/\n' "$1"; rc_all=1; } || true; }
-count() { local n; n=$(grep -cE "$1" "$OUT"); [ "$n" -eq "$2" ] || { printf '       COUNT /%s/ = %s (want %s)\n' "$1" "$n" "$2"; rc_all=1; }; }
-
-echo "=== provider-vip-standup.sh -- D-057 plane stand-up (fake maas + real jq) ==="
-
-run 0 "fresh: full create sequence" "$FIX/sub_fresh.json" "$FIX/spaces_fresh.json" "$FIX/vlans_fresh.json" "$FIX/ipr_fresh.json"
-has 'provider fabric_id = 1'
-has 'WOULD: create space provider-vip'
-has 'WOULD: create VLAN vid=104 name=provider-vip mtu=1500 on fabric 1'
-absent 'mtu=9000'
-has 'WOULD: assign fabric 1 vid 104 -> space provider-vip'
-has 'WOULD: create subnet 10\.12\.8\.0/22 vlan=<vid-104-vlan-obj-id>'
-has 'WOULD: subnet 10\.12\.8\.0/22 -> gateway_ip=10\.12\.8\.1'
-has 'WOULD: subnet 10\.12\.8\.0/22 -> managed=true'
-has 'WOULD: subnet 10\.12\.8\.0/22 -> dns_servers=10\.12\.12\.1'
-has 'WOULD: create reserved range 10\.12\.8\.2-10\.12\.8\.100'
-absent 'hardcoded|10\.12\.8\.0/22 vlan=5004'   # vlan obj must be a live lookup / placeholder, never a literal id
-
-run 0 "idempotent: all present -> all SKIP" "$FIX/sub_done.json" "$FIX/spaces_done.json" "$FIX/vlans_done.json" "$FIX/ipr_done.json"
-has 'space provider-vip exists -- SKIP'
-has 'VID 104 already on fabric 1 -- SKIP'
-has 'already in space provider-vip -- SKIP'
-has 'subnet 10\.12\.8\.0/22 exists -- SKIP'
-has 'gateway_ip already 10\.12\.8\.1 -- SKIP'
-has 'reserved range starting 10\.12\.8\.2 exists -- SKIP'
-count 'WOULD:' 0
-
-run 1 "provider fabric missing -> fail" "$FIX/sub_nofab.json" "$FIX/spaces_fresh.json" "$FIX/vlans_fresh.json" "$FIX/ipr_fresh.json"
-has 'provider fabric not found'
-
-run 1 "subnet on wrong VID -> fail" "$FIX/sub_wrongvid.json" "$FIX/spaces_fresh.json" "$FIX/vlans_fresh.json" "$FIX/ipr_fresh.json"
-has "subnet 10\.12\.8\.0/22 exists on VID '99', expected 104"
-
-echo
-[ "$rc_all" -eq 0 ] && echo "ALL PASS" || echo "SOME FAILED"
-rm -f "$OUT"; exit "$rc_all"
diff --git a/tests/repo-lint/run-tests.sh b/tests/repo-lint/run-tests.sh
new file mode 100644
index 0000000..477a50e
--- /dev/null
+++ b/tests/repo-lint/run-tests.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# tests/repo-lint/run-tests.sh -- offline harness for repo_lint.py (DOCFIX-074).
+# Builds throwaway fixture repos with planted violations; asserts each lint class
+# fires, and that a clean fixture passes. Mutates nothing outside $TMP.
+# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+
+mkrepo() { # mkrepo <name>  -> minimal clean fixture repo
+  local d="$TMP/$1"; mkdir -p "$d/runbooks" "$d/scripts" "$d/docs"
+  printf '# readme\n' > "$d/README.md"
+  printf 'applications: {}\n' > "$d/bundle.yaml"
+  printf '## D-001\ntext\n' > "$d/docs/design-decisions.md"
+  printf '#!/usr/bin/env bash\necho ok\n' > "$d/scripts/real.sh"
+  printf '# phase\n```bash\nbash scripts/real.sh\n```\n' > "$d/runbooks/phase-x.md"
+  echo "$d"
+}
+run() { # run <want_rc> <regex> <label> <dir>
+  local out rc
+  out="$(python3 "$REPO/scripts/repo_lint.py" "$4" 2>&1)"; rc=$?
+  if [[ "$rc" == "$1" ]] && grep -qE "$2" <<<"$out"; then
+    echo "  PASS  $3"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $3 (rc=$rc want=$1)"; echo "$out" | sed 's/^/        /' | head -5; FAIL=$((FAIL+1))
+  fi
+}
+
+D=$(mkrepo clean);            run 0 'PASS: repo lint' "T1 clean fixture passes" "$D"
+D=$(mkrepo l1); printf 'line with \xe2\x80\x94 dash\n' >> "$D/runbooks/phase-x.md"
+                              run 1 'L1 .*non-ASCII' "T2 L1 non-ASCII FAILS" "$D"
+D=$(mkrepo l1b); printf 'crlf line\r\n' >> "$D/scripts/real.sh"
+                              run 1 'L1 .*CR byte' "T3 L1 CRLF FAILS" "$D"
+D=$(mkrepo l2); printf 'bind to provider-vip here\n' >> "$D/runbooks/phase-x.md"
+                              run 1 'L2 .*retired space' "T4 L2 stale space FAILS" "$D"
+D=$(mkrepo l2b); printf 'the provider-vip plane is retired (D-060)\n' >> "$D/runbooks/phase-x.md"
+                              run 0 'PASS' "T5 L2 historical context EXEMPT" "$D"
+D=$(mkrepo l3); printf 'run scripts/ghost.sh now\n' >> "$D/runbooks/phase-x.md"
+                              run 1 'L3 .*missing scripts/ghost.sh' "T6 L3 ghost ref FAILS" "$D"
+D=$(mkrepo l4); printf 'use phase-00-teardown.sh --apply\n' >> "$D/runbooks/phase-x.md"
+                              run 1 'L4 .*deprecated' "T7 L4 deprecated ref FAILS" "$D"
+D=$(mkrepo l5); printf '## D-001\ndupe\n' >> "$D/docs/design-decisions.md"
+                              run 1 'L5 D-001 defined 2' "T8 L5 numbering collision FAILS" "$D"
+D=$(mkrepo l6); printf '```bash\nscripts/real.sh --apply\n```\n' >> "$D/runbooks/phase-x.md"
+                              run 1 'L6 .*bare script invocation' "T9 L6 bare invoke FAILS" "$D"
+
+echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1
diff --git a/tests/tenant-onboard/run-tests.sh b/tests/tenant-onboard/run-tests.sh
new file mode 100644
index 0000000..36b2b8e
--- /dev/null
+++ b/tests/tenant-onboard/run-tests.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# tests/tenant-onboard/run-tests.sh -- focused offline harness for the two
+# stage4 guard behaviors hardened in the 2026-07-03 sweep (H1: the raced
+# duplicate-CIDR guard previously FAILED OPEN under pipefail SIGPIPE).
+# Fake openstack replays fixtures; fake HOME provides a stub admin-openrc.
+# Not a full-stage harness: stage4 is cut short right AFTER the guard by an
+# empty app-cred path -- the assertions target guard behavior only.
+# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+BIN="$TMP/bin"; H="$TMP/home"; mkdir -p "$BIN" "$H"
+printf 'export OS_AUTH_URL=https://fake:5000/v3\nexport OS_CACERT=$HOME/vault-init/vault-ca-root.pem\n' > "$H/admin-openrc"
+mkdir -p "$H/vault-init"
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -subj /CN=fake-ca \
+  -keyout "$H/vault-init/ca.key" -out "$H/vault-init/vault-ca-root.pem" -days 2 >/dev/null 2>&1
+cat > "$BIN/openstack" <<'FB'
+#!/usr/bin/env bash
+case "$*" in
+  *"subnet list"*) cat "$FIXDIR/subnets.txt" ;;
+  *) echo "fake-openstack: unmatched: $*" >&2; exit 1 ;;
+esac
+FB
+chmod +x "$BIN/openstack"
+
+run_stage4() { # run_stage4 <fixdir> -> captures output+rc of stage4 under fakes
+  ( cd "$TMP" && env HOME="$H" FIXDIR="$1" PATH="$BIN:$PATH" \
+      TENANT_CIDR="10.20.24.0/24" \
+      bash "$REPO/scripts/tenant-onboard.sh" testco stage4 2>&1 )
+}
+check() { # check <want_in_out:regex> <must_not:regex|-> <label> <out> <rc>
+  local want="$1" not="$2" label="$3" out="$4" rc="$5"
+  local okw=1 okn=1
+  grep -qE "$want" <<<"$out" || okw=0
+  [ "$not" = "-" ] || { grep -qE "$not" <<<"$out" && okn=0; }
+  if [ "$okw" = 1 ] && [ "$okn" = 1 ]; then echo "  PASS  $label"; PASS=$((PASS+1))
+  else echo "  FAIL  $label (rc=$rc)"; echo "$out" | head -4 | sed 's/^/        /'; FAIL=$((FAIL+1)); fi
+}
+
+mkdir -p "$TMP/fx-collide" "$TMP/fx-clear" "$TMP/out"
+printf '10.20.7.0/24\n10.20.24.0/24\n10.20.9.0/24\n' > "$TMP/fx-collide/subnets.txt"
+printf '10.20.7.0/24\n10.20.9.0/24\n'                > "$TMP/fx-clear/subnets.txt"
+
+# T1: colliding CIDR present in the list -> guard MUST die (the bug was fail-open)
+out=$(run_stage4 "$TMP/fx-collide"); rc=$?
+check 'CIDR 10.20.24.0/24 in use' '-' "T1 duplicate-CIDR guard fires (was fail-open under SIGPIPE)" "$out" "$rc"
+[ "$rc" -ne 0 ] || { echo "  FAIL  T1b guard must exit non-zero"; FAIL=$((FAIL+1)); }
+
+# T2: CIDR absent -> guard must NOT fire; script proceeds past it into stage4 body
+out=$(run_stage4 "$TMP/fx-clear"); rc=$?
+check '== stage4:' 'CIDR .* in use' "T2 clear CIDR passes the guard (no false die)" "$out" "$rc"
+
+echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1