# Script-quality findings register -- read-only sweep, 2026-07-07

**What this is.** The deferred-findings register from the 2026-07-07 read-only
script-quality sweep, recorded so the items survive session compaction. Nothing
in this file has been executed; every fix listed here is a DOCFIX **candidate**
to be delivered later under the standard change-delivery loop (harness green,
repo-lint clean, changelog entry with revert). No identifier numbers are
assigned in this register -- the batch that fixes an item assigns its number
via the next-free rule at delivery time.

**Sweep coverage.** 110 files reviewed (scripts/, tests/, .claude/hooks/).
Tools available on the review host: bash and python3 only; shellcheck and
pyflakes were absent, so findings come from manual read plus targeted fixture
probes, not static analysis.

**Batch note.** The sweep's E/R-class items approved for immediate fix were
implemented in the fix batch of this date and are NOT listed here, except the
two previously-known items marked FIXED-THIS-BATCH below.

## Deferred findings (R-class; fixes are DOCFIX candidates)

### R5 -- lib-validate.sh: vr_json tempfile leak
`vr_json` (scripts/lib-validate.sh, ~line 52) creates `_VR_ERR="$(mktemp)"` on
every call and never removes it. `vr_err_tail` legitimately needs the file
after return, but nothing cleans it up afterwards: one leaked tempfile per
`vr_json` call, per check, per validation run. Fix shape: a single per-process
stderr file reused across calls, or an EXIT trap in the library's sourcing
contract.

### R6 -- `| head -1` SIGPIPE / extract-then-check class in phase-05/06
Live-pipe `openstack ... | head -1` captures that use the fragment without
whole-output validation:
- scripts/phase-05-amphora-pipeline.sh:62 (`image list --tag ... | head -1`)
- scripts/phase-05-amphora-pipeline.sh:66 (`image list --name ... | head -1`)
- scripts/phase-06-mgmt-vm.sh:106 (`port list --server ... | head -1`)
- scripts/phase-06-mgmt-vm.sh:108 (`floating ip list --port ... | head -1`)
Same class the house style forbids (SIGPIPE race on the producer; a partial
failure yields a plausible-looking fragment). Fix shape: capture whole output,
validate shape (uuid regex), then select the first row.

### R7 -- phase-07-conductor-graft.sh: remote tempdir leak
The helm-install payload run on the conductor (~line 153) does
`D=$(mktemp -d); cd "$D"` and never removes the directory: one leaked tempdir
(plus tarball) on the remote unit per graft run. Fix shape: trap cleanup inside
the remote payload.

### R9 -- cloud-assert.sh --capture: `--long` + silent empty images.json
Line ~184: `openstack image list --long -f json </dev/null > "$DIR/images.json"
2>/dev/null || true`. Two defects: (a) the deprecated `--long` flag only adds
stderr noise (and `2>/dev/null` then masks REAL errors, against the
stderr-separation rule); (b) a failed list silently commits an empty/missing
images.json into the captured BOM. Fix shape: drop `--long`, stderr to a
tempfile surfaced on failure, fail the capture loudly if the JSON is empty or
unparseable.

### R11 -- harness tempfile leaks
Harnesses that mktemp without a trap cleanup (leak per run):
- tests/carve-host-interfaces/run-tests.sh
- tests/lib-validate/run-tests.sh (also amplifies R5: every vr_json case leaks)
- tests/phase-00-maas-standup/run-tests.sh
Fix shape: the standard `W=$(mktemp -d); trap 'rm -rf "$W"' EXIT` pattern the
other 34 harnesses already use.

## Previously-known items -- FIXED-THIS-BATCH

- **tenant-offboard.sh Phase B counter (FIXED-THIS-BATCH).** Logged in the
  changelog (2026-07-06 addendum 28) as FOUND-NOT-FIXED: the residual-trust
  sweep incremented SWEEP_FAIL inside a `printf | while` pipeline subshell, so
  failed trust deletes could never raise exit 22. Fixed in this date's batch
  (here-string loop; regression case in tests/tenant-offboard).
- **tenant-offboard.sh hardcoded auth URL (FIXED-THIS-BATCH).** The known
  hardcoded-OS_AUTH_URL class (house rule 3): tenant_env now reads `auth_url=`
  from the cred file with the literal demoted to a KEYSTONE_VIP-overridable
  fallback. NOTE: the tenant-acceptance.sh foil_env sibling of this class
  (addendum 28 FOUND-NOT-FIXED list) remains OPEN and is NOT covered by this
  batch.

## Consolidation proposals (S-class; S1-S8)

Transferred verbatim from the sweep report at integration (2026-07-07);
effort estimates are the sweep's (S/M/L). Operator has NOT ruled on S1-S5/
S7/S8 -- proposals only.

- **S1 (M)** The unset-OS_*/source-env dance is hand-rolled ~15x across
  tenant-onboard (8 subshells), tenant-offboard (2), tenant-acceptance (3),
  d063-apply (1), tenant-assert (2) -- while scripts/lib-validate.sh already
  ships tested vr_scrub_os / vr_admin_env / vr_tenant_env. Proposal: source
  lib-validate.sh from the tenant-* family + d063-apply; add one
  `vr_appcred_env <file>` for the app-cred variant. (The offboard tenant_env
  auth-url bug was fixed narrowly in this batch; this proposal remains the
  wider consolidation.)
- **S2 (S)** run() capture-then-test helper duplicated with eval-counter
  variants in tenant-offboard.sh and d063-apply.sh vs the rc-returning
  lib-validate run(). Consolidate; count failures at call sites.
- **S3 (S)** is_id() defined in 4 scripts (tenant-onboard, tenant-offboard,
  d063-apply, tenant-assert); lib-validate already has vr_is_hex32. Ride
  along with S1.
- **S4 (M)** The trust-list stdout-only capture + inline-python filter block
  is near-identical 3x (tenant-offboard x2, tenant-acceptance x1) and is
  inline python-in-bash beyond one-liner scale (house rule: .py files). One
  fixture-tested scripts/trust_filter.py would serve all three.
- **S5 (S)** Kube-image UUID resolution block (json capture + jq kube filter
  + tempfile + 36-hex validation) appears 3x inside tenant-onboard.sh. One
  local function.
- **S6 (no action)** cap()/oerr() triplicated across clientdocs/scripts/
  {smoke-test,acceptance-run,ci-cleanup-sweep} -- CORRECT as-is: handover
  artifacts must be standalone off-jumphost. Worth a header comment noting
  the duplication is deliberate.
- **S7 (S)** Dead code: checks/d011-04 CF assigned never used; checks/d011-03
  vr_is_ipv4-or-VHOST first test subsumed by second. (The other two S7 items
  -- offboard no-op is_id, validate.sh lost line-rewrite -- were FIXED in
  this batch.)
- **S8 (S)** Move the KEYSTONE_VIP default and the D-003 FIP pool bounds into
  lib-net.sh as tagged constants (the literal is duplicated in 4 files:
  tenant-onboard, phase-03-admin-openrc, phase-06-kubeconfig-gate,
  phase-06-k8s-bootstrap; FIP pool literals duplicated across the two
  phase-04-network scripts; provider-bundle-check.py re-states plane CIDRs
  as a second source of truth -- python cannot source bash, needs a
  generated or parsed form).

## Found during the fix batch (this date; logged, NOT fixed -- out of scope)

- **tenant-offboard.sh Phase A cluster captures merge stderr.** The
  tenant-scope `coe cluster list` captures (inventory ~line 160; delete loop
  and wait loop in Phase A) still use `2>&1`: a stderr warning line would
  word-split into `coe cluster delete` argv and keep the wait loop from ever
  seeing empty (budget exit 21). Same class as the Phase C fix; was not in the
  approved batch scope. The offboard harness deliberately excludes coe
  commands from its stderr-noise scenario until this is fixed.
- **Merged-stderr `domain show`/`token issue` captures (fail-closed class).**
  tenant-offboard.sh (~line 133, sweep-mode preamble) and tenant-onboard.sh
  stage subshells validate `$(... 2>&1)` captures by shape/equality. Failure
  direction is CLOSED (safe), but a benign stderr warning on a noisy CLI would
  abort with a false precondition/auth failure. Cosmetic-risk cleanup
  candidate, same stdout-only pattern.
- **tenant-offboard.sh Phase E0 app-cred inventory merges stderr.** Line ~267
  tests rc (failures route correctly), but a success-with-warning would
  word-split the warning into the display-only cascade-inventory lines.
  Display pollution only; no delete argv exposure.

ASCII + LF.