diff --git a/scripts/package-recon.sh b/scripts/package-recon.sh
new file mode 100644
index 0000000..1e7de71
--- /dev/null
+++ b/scripts/package-recon.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Built standing on the shoulders of billions of dwarves
+# Created by John A. Hoeven with the ethical assistance of Claude AI
+# Licence: The Unlicense — https://unlicense.org
+# ---------------------------------------------------------------------------
+# package-recon.sh
+# Version: v0.0.1 | Status: DEVELOPMENT
+# Role:     Recon
+# ---------------------------------------------------------------------------
+# Purpose:  Confirm exact package names, availability, and repo source for
+#           every package still needed across Phase 2-5, directly on
+#           BigBoy's live, network-connected AlmaLinux 10.2 install. Run
+#           this before finalizing task docs — don't assume package names
+#           carried over from RHEL8/9 conventions or Debian/Ubuntu habits
+#           still hold here.
+# Target:   BigBoy — AlmaLinux 10.2
+# Entry:    ./package-recon.sh
+# Depends:  dnf (present by default)
+# Note:     Read-only — this script only searches/queries, never installs
+#           anything. Safe to run anytime.
+# ---------------------------------------------------------------------------
+
+# No 'set -e' — every operation checked and logged explicitly (CE OS standard §1.8).
+
+# ── Configuration ────────────────────────────────────────────────────────
+
+LOG_DIR="${HOME}/.local/logs/package-recon"
+LOG_FILE="${LOG_DIR}/recon-$(date '+%Y-%m-%d_%H%M%S').log"
+
+mkdir -p "${LOG_DIR}"
+
+# ── Logging ──────────────────────────────────────────────────────────────
+
+_log() {
+    local level="${1}"
+    local msg="${2}"
+    local ts
+    ts="$(date '+%Y-%m-%d %H:%M:%S')"
+    printf '[%s] [%s] %s\n' "${ts}" "${level}" "${msg}" | tee -a "${LOG_FILE}"
+}
+log_info()  { _log "INFO " "${1}"; }
+log_warn()  { _log "WARN " "${1}" >&2; }
+
+# ── Candidate package list ────────────────────────────────────────────────
+#
+# Each entry: primary candidate name, plus space-separated alternates to
+# also check in case naming differs from what's assumed. Grouped by which
+# phase actually needs them.
+
+declare -A PACKAGES=(
+    # Outstanding from Phase 1 (kickstart dropped vim due to the
+    # cross-repo vim-data mismatch during install — needs installing now
+    # that we're on a live, in-sync network rather than the installer's
+    # constrained resolver)
+    ["vim (Phase 1 leftover)"]="vim vim-enhanced vim-common vim-minimal"
+
+    # Phase 4 — NVIDIA driver, precompiled open-kmod path
+    ["nvidia bootstrap release pkg"]="almalinux-release-nvidia-driver"
+    ["nvidia driver cuda userspace"]="nvidia-driver-cuda"
+    ["nvidia open kernel module"]="nvidia-open-kmod"
+    ["nvidia full driver (optional, if wanted beyond compute-only)"]="nvidia-open"
+
+    # Phase 5 — llama.cpp build requirements
+    ["cmake (missing from kickstart pkg list)"]="cmake"
+    ["libcurl dev headers (for llama-server -hf flag)"]="libcurl-devel curl-devel"
+    ["openssl dev headers"]="openssl-devel"
+    ["nginx reverse proxy"]="nginx"
+
+    # Sanity checks — already expected present via kickstart, confirm not
+    # assumed
+    ["git (kickstart already lists this)"]="git"
+    ["gcc (kickstart already lists this)"]="gcc"
+    ["make (kickstart already lists this)"]="make"
+    ["btrfs-progs (kickstart already lists this, Phase 3 needs it)"]="btrfs-progs"
+    ["chrony/NTP (Phase 2 base-system check)"]="chrony"
+)
+
+# ── Recon ────────────────────────────────────────────────────────────────
+
+log_info "Starting package recon on $(hostname), $(date -Iseconds)"
+log_info "Enabled repos:"
+dnf repolist enabled 2>&1 | tee -a "${LOG_FILE}"
+log_info ""
+
+for label in "${!PACKAGES[@]}"; do
+    log_info "── ${label} ──"
+    for candidate in ${PACKAGES[${label}]}; do
+        log_info "  Checking: ${candidate}"
+
+        # dnf info tells us: does it exist, which repo, what version,
+        # and whether it's already installed
+        result="$(dnf info "${candidate}" 2>&1)"
+
+        if echo "${result}" | grep -q "^Name"; then
+            repo_line="$(echo "${result}" | grep -E "^Repo" | head -1)"
+            version_line="$(echo "${result}" | grep -E "^Version" | head -1)"
+            installed="$(echo "${result}" | grep -qi "Installed Packages" && echo "ALREADY INSTALLED" || echo "available, not installed")"
+            log_info "    FOUND — ${version_line} | ${repo_line} | ${installed}"
+        else
+            log_warn "    NOT FOUND — ${candidate} is not available from any enabled repo"
+        fi
+    done
+    log_info ""
+done
+
+log_info "Recon complete. Full log: ${LOG_FILE}"
+log_info ""
+log_info "Review any 'NOT FOUND' lines above before finalizing task docs —"
+log_info "those need either a different package name, a different repo"
+log_info "enabled, or a different install approach entirely."
\ No newline at end of file
diff --git a/tasks/TASK-phase4-5-bringup.md b/tasks/TASK-phase4-5-bringup.md
index eab81be..474083e 100644
--- a/tasks/TASK-phase4-5-bringup.md
+++ b/tasks/TASK-phase4-5-bringup.md
@@ -54,17 +54,38 @@ sudo reboot
 
 ## Phase 5 — llama.cpp
 
-1. **Pick a pinned build tag.** Check
-   `https://github.com/ggml-org/llama.cpp/releases` (or `git ls-remote
-   --tags`) for a recent, stable-looking tag — do not build against
-   `master`. Record the chosen tag in `group_vars/bigboy.yml` once decided.
+1. **Pinned build tag: `b9968`.** Already confirmed and cloned into the
+   repo — checked against real commit dates (8 days old at time of
+   selection, not tracking `master`) and reviewed for any fix/regression/
+   revert pattern in the surrounding range (none found; one relevant
+   fix — `llama-batch: fix allowed decreasing pos in a seq` — is already
+   included in this tag, not something still pending). Do not re-derive
+   or second-guess this pin; if a newer tag is wanted later, that's a
+   deliberate monthly-cadence decision, not part of this task.
 2. **Shallow clone at that tag**, build with the standard flags from
    `CLAUDE.md` (`-DGGML_CUDA=ON -DCMAKE_BUILD_TYPE=Release
    -DCMAKE_CUDA_ARCHITECTURES=120`).
-3. **Model**: pull a Q4_K_M or Q5_K_M GGUF from Bartowski or Unsloth on
-   Hugging Face for initial testing — a 7B-class instruct model is
-   sufficient to validate the pipeline end to end. Do not use an
-   MXFP4-quantized model (see `CLAUDE.md` — known sm_120 build hazard).
+3. **Model: Ministral 3 14B Instruct, Q4_K_M.** This is the confirmed
+   choice for initial bring-up and testing — not a placeholder pending a
+   better pick. Pull via llama.cpp's own Hugging Face integration:
+
+   ```bash
+   llama-server -hf mistralai/Ministral-3-14B-Instruct-2512-GGUF:Q4_K_M \
+     -ngl 99 --jinja
+   ```
+
+   `--jinja` is required for this model's chat template/system-prompt
+   handling per its own model card — don't drop it. `libcurl-devel` must
+   be installed first (confirmed available via `dnf` from AppStream,
+   per the package recon — not yet installed as of this writing, add it
+   alongside `cmake` and `nginx`, also confirmed-available-but-not-yet-
+   installed in that same recon pass).
+
+   Root's ~499GB gives plenty of headroom to keep other quants or models
+   around later without needing to commit permanently — this pick is
+   about getting a clean first success, not a final answer for every
+   future use case. Do not use an MXFP4-quantized model regardless of
+   which model is chosen (see `CLAUDE.md` — known sm_120 build hazard).
 4. **Serve** via `llama-server` under systemd:
    - Bind `127.0.0.1`, not `0.0.0.0`
    - `--api-key` set (placeholder value is fine for initial bring-up,
@@ -78,13 +99,25 @@ sudo reboot
 5. **Firewall**: only the reverse-proxy port needs opening; the
    `llama-server` port itself stays localhost-only.
 
+## Success criterion — deliberately minimal for this task
+
+Ministral 3 14B Instruct installed and reachable through llama-server's
+built-in web UI, producing a coherent chat response — **at whatever
+quality it delivers with zero tuning or refinement.** This is the bar for
+a successful deploy at this stage. Model selection, quantization
+tradeoffs, and response-quality tuning are all separate, later work — do
+not block this task on any of that.
+
 ## Done criteria for this task
 
 - `nvidia-smi` confirms GPU visible and driver loaded
 - `systemctl status llama-server` shows active/running
 - `curl http://127.0.0.1:<port>/health` (or equivalent) returns healthy
-- One real inference request through the API returns a coherent response
-- The chosen build tag is recorded in `group_vars/bigboy.yml`
+- A real chat request through the built-in web UI (or the API directly)
+  returns a coherent response from Ministral 3 14B Instruct — quality as-
+  delivered, no tuning required
+- `b9968` and the Ministral 3 14B Instruct choice recorded in
+  `group_vars/bigboy.yml`
 - `planning/STATUS.md` updated to reflect Phase 4 and 5 as complete
 
 ## Explicitly out of scope for this task