Two defects in the durable record, both because the bookend was written BEFORE the merge.
Fixing them before the session is cleared, since the ledger is what the next session reads.

1. The bookend said "Merge to `main` is the ONLY remaining step and is operator-gated" -- stale
   the moment the merge landed. Now records the actual end state: merge commit 6f5701d (2
   parents, not squashed, 77 commits), branch retired local + remote, post-merge gauntlet ALL
   GREEN (81) + repo-lint 0-fail ON main, close recorded by 1023596.

2. A finding was logged only in commit c29059b's MESSAGE, which is findable but is not a surface
   any session reads at open: `tests/creds-matrix` T24's finding-class baseline covers TIER 1
   ONLY, so tier-2/3 classes (E1/E3/E4/V1/V2) have no baselined red state and a future false
   green there would not turn the gauntlet red. That is the same class as the two false greens
   this session fixed, so burying it in a commit message was the wrong home. Now in the
   bookend, together with the still-open `creds-mint.sh` advice -- worth ruling BEFORE Stage 5,
   which is the largest credential-minting event in the deployment.

Bookend stays within the GA-R4 15-line cap (9 body lines); ledger 317 lines, under the 300-line
cap's rotation trigger for the next close to handle. repo-lint 0-fail.

Revert: text-only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf