diff --git a/docs/audit/app3-site-publish-audit-2026-09-12.md b/docs/audit/app3-site-publish-audit-2026-09-12.md
new file mode 100644
index 0000000..d12b37a
--- /dev/null
+++ b/docs/audit/app3-site-publish-audit-2026-09-12.md
@@ -0,0 +1,69 @@
+# app3 Site Publish Audit - 2026-09-12
+
+**Purpose.** Precondition gate for the 2026-09-12 S3 backup-mirror cleanup. User directive:
+"leave 815bistro alone. that's a live client site that should be on app3 with all of the other
+websites. Make sure that all of the sites on app3 are currently published before deleting anything."
+
+**Method.** Domain list derived from app3 docroots (`/home/*/htdocs/*/` on 152.53.241.111), 34 unique
+domains. For each: `dig +short <d> A` for DNS, then `curl -L --max-redirs 5 -w '%{http_code}|%{url_effective}'`
+against `https://<d>/`. Script: `/root/.hermes/scripts/audit-app3-sites.sh`. Raw evidence: `/tmp/app3-audit-final.txt`.
+
+**Result: 34 tested, 28 published (HTTP 200), 6 not.**
+
+## Not published / defective
+
+| Domain | DNS | HTTP | Final URL | Verdict |
+|---|---|---|---|---|
+| boxpilotlogistics.com | 188.114.96.3, .97.3 (Cloudflare) | 301 | https://www.boxpilotlogistics.com/ | BROKEN - apex/www redirect loop, never reaches a served page |
+| vigilanttac.com | 104.21.83.95, 172.67.220.243 (Cloudflare) | 301 | https://www.vigilanttac.com/ | BROKEN - apex/www redirect loop, never reaches a served page |
+| voipsimplicity.com | NO-DNS-RECORD | 000 | - | BROKEN - no DNS at all; site dark |
+| www.voipsimplicity.com | NO-DNS-RECORD | 000 | - | BROKEN - no DNS at all |
+| timapta.org | 188.114.96.4, .97.4 (Cloudflare) | 301 | https://ptatime.org/ | BROKEN FORWARD - ptatime.org itself has no DNS records |
+| forms.itpropartner.com | 152.53.241.111 (app3) | 404 | https://forms.itpropartner.com/ | NOT A DEFECT - POST-only API, see below |
+| iamgmb.com | 188.114.97.3, .96.3 (Cloudflare) | 200 | https://www.google.com/ | Suspicious - public domain 301s to google.com (decommissioned Aug 9 2026) |
+
+### Details
+
+- **boxpilotlogistics.com / vigilanttac.com.** Both are WordPress installs on app3 fronted by
+  Cloudflare (301 carries `x-redirect-by: WordPress`). Apex 301s to `www`, and `www` 301s back to apex;
+  after 5 redirects curl is still on a 301 and never receives a body. Browsers surface
+  "this page isn't redirecting properly". Both client sites are effectively down.
+- **voipsimplicity.com + www.** Zero A records, yet the full WordPress install exists on app3 at
+  `/home/voipsimplicity/htdocs/voipsimplicity.com/` and `/home/voipsimplicity/htdocs/www/`.
+  `my.voipsimplicity.com` (Cloudflare) is up and returns 200. The marketing site is unreachable.
+- **timapta.org.** Correctly 301s per the TIMA forwarding setup, but the target `ptatime.org` has no
+  DNS records, so the forward dead-ends. Verified: `dig +short ptatime.org` is empty.
+- **forms.itpropartner.com.** `msp-forms.service` (MSP Shared Form Handler, FastAPI) is `active (running)`
+  since 2026-08-21, listening on 127.0.0.1:8700 (uvicorn pid 1498), nginx fronts it on 443. GET / returns
+  `{"detail":"Not Found"}` - the expected FastAPI 404 for a POST-only handler. No action needed.
+- **iamgmb.com.** Returns 200 but the final URL is `https://www.google.com/`. The domain was decommissioned
+  2026-08-09; a redirect to Google is not a normal retirement. Needs an owner decision (park, 410, or
+  forward to itpropartner.com).
+
+## 815bistro.com - NOT on app3
+
+User directive is to leave it alone because it "should be on app3 with all of the other websites."
+**It is not on app3 and never was migrated.** There is no `815bistro` docroot among the 34 app3 sites,
+and both the apex and `www` resolve to **35.212.86.161**, the SiteGround box (SiteGround runs on GCP,
+so the IP reverse-resolves into `*.bc.googleusercontent.com`). The site itself is live (200) on SiteGround.
+
+Consequence for the cleanup: the only 815bistro artifact in our possession is the export at
+`/root/.hermes/.backups/siteground/815bistro.com/` (261 MB). It was explicitly removed from the delete list
+and explicitly removed from the sync-exclude list so it keeps mirroring. **This site still needs migrating
+to app3.**
+
+## Published (28)
+
+apextrackexperience.com, buzz.iamgmb.com, debtrecoveryexperts.com, docs.itpropartner.com,
+my.verdicttank.com, verdicttank.com, auth2-api.itpropartner.com, auth2.itpropartner.com, intelsight.io,
+mockups.itpropartner.com, proposals.itpropartner.com, support.itpropartner.com, katiewattsdesign.com,
+mainwp.itpropartner.com, modelortho.com, www.modelortho.com, my.voipsimplicity.com, panel.itpropartner.com,
+my.radartank.com, my.rfptank.com, radartank.com, review.watchdogcitizen.com, rfptank.com,
+watchdogcitizen.com, scirium.com, my.transitpin.com, transitpin.com, iamgmb.com (200, but to google.com).
+
+## Cleanup impact
+
+Nothing deleted on 2026-09-12 touched app3 site content. Deletion targets were stale Hermes/UNMS backup
+mirrors in `s3://hermes-vps-backups/live/.backups/` plus stale data on the standby. Held back:
+`.backups/siteground/` (815bistro) and `.backups/wphost02-backup-2026-07-10.tar.gz` (fallback data for the
+8 WordPress sites migrated to app3 - held until boxpilotlogistics.com and vigilanttac.com are verified healthy).