diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index f1e23f4..c894f53 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -286,8 +286,10 @@
 
 ## SESSION CLOSE 2026-07-27 -- creds consolidation + STAGE 4 CLOSE-OUT (bounded, GA-R4)
 
-- Opened on a creds question; ended closing Stage 4. 8 commits `c13cfe4..` pushed. Merge to
-  `main` is the ONLY remaining step and is operator-gated.
+- Opened on a creds question; ended closing Stage 4. **STAGE 4 IS CLOSED AND MERGED** --
+  operator-gated merge commit `6f5701d` on `main` (2 parents, not squashed, 77 commits),
+  branch retired local + remote, post-merge gauntlet ALL GREEN (81) + repo-lint 0-fail on
+  `main`, close recorded in CURRENT-STATE by `1023596`. Next stage branches off `main`.
 - Creds: dc0 SEC-012 power key consolidated + `.pub` derived (SEC-021(b) as written -- measured
   first: it IS the dedicated key, and dc0 using the snap default is SEC-016's ruled design, so
   NO re-mint); NetBox GUI admin password consolidated (**SEC-025**, rows 20->21); dc1 svc `.pub`
@@ -305,5 +307,11 @@
   Carve residue: 108 fabrics -> 17, cascade-checked. dc1 nginx purged.
 - OWNED: first draft of the pf reload sat inside the reconfigure heredoc -- would have fixed
   nothing in the very drop case that caused the bug. Caught pre-ship.
+- **FINDING for the next session (logged, not actioned):** `tests/creds-matrix` T24's
+  finding-class baseline (`expected-findings.txt`) covers **TIER 1 ONLY** -- tier-2/3 classes
+  (E1/E3/E4/V1/V2) have NO baselined red state, so a future false green there would not turn
+  the gauntlet red. Same class as the two false greens this session fixed. Also still open from
+  the D-137 close: `creds-mint.sh` is unbuilt/unruled advice and Stage 5 is the largest minting
+  event, so it is worth ruling BEFORE the bundle deploy rather than after.
 - Gauntlet ALL GREEN (81), repo-lint 0-fail. Full body: `docs/archive/changelogs/changelog-20260727-creds-consolidation.md`;
   stage record `docs/archive/stage-records/vr1-stage4-record.md`. Status ONLY in CURRENT-STATE.md.