diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 77a66dd..4b62e22 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -261,6 +261,23 @@
 evidence say **v1.12.3**. Presumed to have arrived with the host patch (not verified). All committed
 plan/validate evidence predates it.
 
+**SESSION CLOSE 2026-07-18 (bookend). Full record: `docs/finding-20260718-voffice1-cloudinit-seed-replace.md` (committed 43b29d7).**
+ESTABLISHED: (1) An autostart-ONLY diff **bounces the guest** -- VERIFIED FROM PRIMARY SOURCE (libvirt
+v0.9.8 `internal/provider/domain_resource.go` L1090/L1107): the sole no-bounce path needs
+`domainConfigUnchanged && runningChanged && autostartUnchanged`, and runningChanged=FALSE here, so it falls
+through to `stopDomainIfRunning` -> undefine -> redefine. (2) `-refresh-only` can NEVER fix it -- Read is
+self-gated at L938 (`isImport || state.Autostart` non-null); ours is NULL. (3) The seed force-replace is
+STRUCTURAL: the reboot cleared `/tmp`, where the provider stages cloudinit ISOs, so the url changes every
+plan. (4) Blast radius CORRECTED to **3 VMs** (voffice1, vvr1-dc0, +vvr1-dc1) -- NOT the 9 nodes
+(`node-vm` = blank-disk PXE, no cloud-init); an earlier claim of mine, retracted.
+OPEN: **D-130 mechanism ruling** (`ignore_changes` vs `$TMPDIR` -- operator's call, unruled); **verification
+7** (what 0.9.8 does replacing a volume attached to a RUNNING domain -- deliberately unasserted);
+**verification 8** (that the chosen D-130 mechanism actually suppresses a force-replacement diff);
+**doc-integrity list** (D-127 changelog's false "collapse to 0" + "no forces-replacement", readiness-doc
+5/0/6-vs-5/2/6, DOCFIX-196 stale Stage-3 NetBox blocker, README tofu 1.12.3->1.12.4, phase-2 runbook).
+Gate before any apply: plan must read EXACTLY 5 add / 0 change / 6 destroy. Nothing applied this session.
+**SUPERSEDED: this session is closed out by a grounding audit charter arriving via git -- read that first.**
+
 **DC0 DEPLOY READINESS -- PREP COMPLETE 2026-07-17 (deploy-ready). See `docs/dc0-deploy-readiness.md`.**
 Final gate re-checked clean (validate, tfvars, creds-audit vr1-dc0 CLEAN, gauntlet 65, lint 0-fail).
 Remaining is NOT prep: the bookend restart (vcloud + voffice1 + opnsense patch/reboot together -- voffice1