diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 61cc468..80dcc57 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -220,7 +220,7 @@
 | G11 | Operator signs THIS document | read top-to-bottom; discrepancies resolved in the document | operator | CLOSED: SIGNED 2026-07-18, section 11 (post-probe version, per sequencing directive) |
 | G12 | `vr1-dc1` build | operator rules dc1 transit/rack addressing; then vars + substrate authored | operator | HELD (`docs/dc0-deploy-readiness.md:100-103`) |
 | G13 | D-129 residuals | operator-gated live plugin install on the edge; qga channel retrofit at next scheduled edge restart; 4 sub-decisions (section 8) | operator | OPEN / PARTIALLY RULED (`docs/design-decisions.md:4017`) |
-| G14 | 9 OPEN SEC rows (SEC-001, -003..-008, -010) | per-row: rotations/flips at v1 close (external to VR1 track) except SEC-010 = apply+verify at G10 | operator / external | `bash scripts/ledger-scan.sh` output, 2026-07-18 |
+| G14 | 8 OPEN SEC rows (SEC-001, -003..-008, -010; prior cell said 9, enumeration + scan both measure 8 -- corrected per GA-R1/C2) | per-row: rotations/flips at v1 close (external to VR1 track) except SEC-010 = apply+verify at G10 | operator / external | `docs/security-ledger.md` (register of record, GA-R4/F3); count cross-checked vs `bash scripts/ledger-scan.sh` 2026-07-19 |
 | G15 | D-068 / D-071 rulings | operator rules (section 8); neither blocks the VR1 substrate | operator | PROPOSED/OPEN (status lines, section 8) |
 
 ## 7. Version pins (measured; the authority for every pin)
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 65e0b90..9331212 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -38,10 +38,9 @@
   the pre-DC-DC controller HA/backup session), D-129 (OPNsense edge plugin/add-on base profile --
   OPEN / partially ruled 2026-07-18: VR1 profile adopted, FOUR sub-decisions still OPEN; review in
   `docs/opnsense-edge-addon-review-20260718.md`).
-- **OPEN security rows:** SEC-001, SEC-003, SEC-004, SEC-005, SEC-006, SEC-007, SEC-008, **SEC-010**.
-  (New since last re-seed: **SEC-010** -- the rack transit-leg FORWARD-drop artifact -- is COMMITTED
-  but stays OPEN until applied + verified on vvr1-dc0. SEC-008 -- the vcloud re-enrolment key --
-  carried over.)
+- **OPEN security rows:** 8 open per `bash scripts/ledger-scan.sh` (re-seeded 2026-07-19). The
+  SEC register of record is `docs/security-ledger.md`; row-level dispositions live THERE only
+  (GA-R4 amendment F3) -- this block carries pointer + count, never rows.
 - **Next-free numbers:** D = **130**, DOCFIX = 196, BUNDLEFIX = 013.
   (Since the last re-seed D-121..128 all ADOPTED -- D-128 = VR1 operating model (2026-07-17). Load-bearing correction to the prior block:
   **D-123 = Model B** (nodes nest INSIDE `vvr1-dc0`; site-down = one `virsh destroy vvr1-dc0`) via
diff --git a/scripts/ledger-scan.sh b/scripts/ledger-scan.sh
index aae52f8..557b09b 100644
--- a/scripts/ledger-scan.sh
+++ b/scripts/ledger-scan.sh
@@ -84,10 +84,19 @@
   if [ -n "$OPEN_DEC" ]; then printf '%s\n' "$OPEN_DEC"; else echo "  (none)"; fi
 else echo "  (design-decisions.md not found)"; fi
 
-echo "-- OPEN security-ledger rows --"
+# SEC reporting is pointer + count (GA-R4 amendment F3): the register of
+# record is docs/security-ledger.md and row-level DISPOSITIONS live there
+# ONLY. This scan surfaces the open count + IDs for reconciliation; the
+# session ledger's machine-derived block carries pointer + count, never rows.
+echo "-- OPEN security-ledger rows (register of record: docs/security-ledger.md) --"
 if [ -r "$SL" ]; then
-  grep -E '^\|[[:space:]]*SEC-[0-9]' "$SL" | awk -F'|' 'toupper($(NF-1)) ~ /OPEN|PENDING/ {gsub(/^ *| *$/,"",$2); gsub(/^ *| *$/,"",$7); print "  " $2 " (" $7 ")"}' || echo "  (none)"
-  [ -z "$(grep -E '^\|[[:space:]]*SEC-[0-9]' "$SL" | awk -F'|' 'toupper($(NF-1)) ~ /OPEN|PENDING/')" ] && echo "  (none open)"
+  OPEN_SEC="$(grep -E '^\|[[:space:]]*SEC-[0-9]' "$SL" \
+    | awk -F'|' 'toupper($(NF-1)) ~ /OPEN|PENDING/ {gsub(/^ *| *$/,"",$2); print $2}')"
+  if [ -n "$OPEN_SEC" ]; then
+    printf '  %s open: %s\n' "$(printf '%s\n' "$OPEN_SEC" | wc -l | tr -d ' ')" \
+                             "$(printf '%s\n' "$OPEN_SEC" | paste -sd' ' -)"
+    echo "  (dispositions live in docs/security-ledger.md ONLY -- GA-R4/F3)"
+  else echo "  (none open)"; fi
 else echo "  (security-ledger.md not found)"; fi
 
 echo "-- next-free numbers (highest assigned + 1) --"
diff --git a/tests/ledger-scan/run-tests.sh b/tests/ledger-scan/run-tests.sh
index a1980f4..6a37494 100644
--- a/tests/ledger-scan/run-tests.sh
+++ b/tests/ledger-scan/run-tests.sh
@@ -54,6 +54,11 @@
 chk 'SEC-003' "surfaces SEC-003 OPEN"
 nochk 'SEC-004' "omits SEC-004 CLOSED"
 grep -q 'SEC-002' <<<"$OUT" && no "omits SEC-002 STANDING (not open)" || ok "omits SEC-002 STANDING"
+# GA-R4/F3: pointer + count, never row-level dispositions
+chk '2 open: SEC-001 SEC-003' "SEC count + ID list (GA-R4/F3)"
+chk 'register of record: docs/security-ledger.md' "SEC section points at the register of record"
+nochk 'rotate' "no row-level disposition text in SEC section (GA-R4/F3)"
+nochk 'OPEN -- assign' "no row-level disposition text for SEC-003 either (GA-R4/F3)"
 chk 'next-free=071' "D next-free 071 (header-authoritative)"
 chk 'next-free=086' "DOCFIX next-free 086 (next-free pointer 099 excluded, reproduction example 1004 excluded)"
 chk 'next-free=010' "BUNDLEFIX next-free 010"