diff --git a/docs/audit/queued-findings-20260806-task2-vault-metal-only.txt b/docs/audit/queued-findings-20260806-task2-vault-metal-only.txt
new file mode 100644
index 0000000..acf1a95
--- /dev/null
+++ b/docs/audit/queued-findings-20260806-task2-vault-metal-only.txt
@@ -0,0 +1,83 @@
+QUEUED FINDINGS -- session 2026-08-05/06 "Task #2: D-020 vault-metal-only commit + renderer/gates"
+Sweep per savegame Step 3. FIRST SURFACE items lead. Body: docs/changelog-20260805-task2-vault-metal-only-commit.md
+Commits: 07e2d9d (Task #2), a08783c (awk hardening). Status ONLY in docs/CURRENT-STATE.md.
+
+================================================================================
+FIRST SURFACE -- existed only in the transcript until this file / this session's commit
+================================================================================
+
+F-A. bundle.yaml:23 HA-chain header is STALE: "hacluster subordinates + :ha relations
+     ACTIVE for 12 charms" -- BUNDLEFIX-053 (ae06c72) added vault-hacluster, making it 13
+     subordinates + 13 :ha relations (measured: 13 `- [x:ha, x-hacluster:ha]` in bundle.yaml;
+     provider-bundle-check reports "13 hacluster subordinate(s)"). LOGGED, NOT FIXED (hard
+     rule 1). Owed: a DOCFIX/BUNDLEFIX comment correction to the header count. Surface: THIS
+     FILE is its first surface.
+
+F-B. dc0/dc1 rack ~/repo-stage OVERLAYS are now STALE, not just bundle.yaml (extends F9).
+     Commit 07e2d9d changed overlays/vr1-dc{0,1}-vips.yaml (vault -> metal pair). The racks
+     carry NON-git staged copies consumed at deploy. NOT MEASURED this session (operator-away
+     background session; reaching the racks needs the D-138 -J path). Owed: at the next live
+     deploy step, RE-STAGE the changed overlays to both racks and sha256-verify against the
+     repo BEFORE trusting them. Surface: THIS FILE (F9 previously named only bundle.yaml).
+
+F-C. Task #2's own written instructions were UNEXECUTABLE AS WRITTEN. The operator grounding
+     said "edit overlays/vr1-dc1-vips.yaml vault->metal pair"; but overlays are GENERATED by
+     scripts/render-dc-overlays.py from render/values/*.yaml (D-136), and tests/render-drift
+     forbids hand-editing them ("re-render, do not hand-edit the overlay"). The operator's
+     model of how overlays are maintained needs updating. Surface: changelog FINDING section
+     + this file. ACTIONABLE for the operator.
+
+F-D. render-drift + render-dc-overlays + pre-flight-checks were RED at the 2026-08-05 (part 2)
+     close but were NOT in that close's "RED AT CLOSE" list (which named only repo-lint L10 +
+     provider-bundle-check). Cause: part-2's uncommitted dc0 overlay hand-edit was
+     non-reproducible from the moment it was made (render(values)=triple, overlay=pair). The
+     part-2 close's durability accounting was incomplete. Surface: changelog + this file.
+
+================================================================================
+ON SURFACE -- verified already recorded (where)
+================================================================================
+
+S-A. D-020 vault-metal-only amendment (RULED 2026-08-05, "Ratify as written"): committed to
+     docs/design-decisions.md (CONSEQUENCE section augmented) + CURRENT-STATE + both overlays.
+     Enforced across FOUR consumers, each with a failing-direction fixture:
+       provider-bundle-check.py (T54/55/56), render-dc-overlays.py (T15b),
+       pre-flight-checks.sh CHECK 1 (T28b), render/values/*.yaml.
+     DOCFIX-210 assigned (home = the changelog; [OPS] per GA-R3). ledger-scan next-free -> 211.
+
+S-B. 14/14 D-121 HA status: recorded in CURRENT-STATE as OPERATOR-ATTESTED, NOT
+     measurement-backed. A committed `juju status -m vr1-dc0` capture proving all 14 apps at
+     3 active/idle units is OWED and rides the F4 vault ha_enabled live-verify sweep. Declared
+     as a gap (GA-R1 rule 2 / C2), not papered over. Surface: CURRENT-STATE + changelog.
+
+S-C. Advisor-caught defect in the first vault-checker draft: the early `continue` skipped the
+     octet band-check AND octet_owner registration, disarming .61 collision detection.
+     PROVEN rc=0 (draft) / rc=1 (fixed). Fixed + guarded by T56. Surface: changelog item 1.
+
+================================================================================
+OWED / NOT DONE (out of Task #2 scope) -- for the next live-cloud session
+================================================================================
+
+O-1. F4: live-measure vault ha_enabled on the 3 units (D-121 (v-a) native leader-election
+     question; if the charm won't do MySQL leader-election, route to D-068/Raft) AND capture
+     the juju status backing 14/14 (S-B). The next live step.
+O-2. F8: verify ceph-radosgw "Services not running: radosgw" (likely new-unit stale-status).
+O-3. F9 (now incl. F-B): re-stage changed overlays + bundle.yaml to both racks, sha256-verify.
+O-4. Task #1: post-wave bundle/overlay review vs the live HA installs, INCLUDING whether
+     overlays/dc-ha-scaleup.yaml is now REDUNDANT (bundle.yaml carries the full HA chain, so
+     the overlay that used to add vault-hacluster may be a no-op). Logged in the
+     provider-bundle-check T16 comment + here.
+O-5. F-A: bundle.yaml:23 header "12 charms" -> reflect 13 (DOCFIX/BUNDLEFIX).
+
+================================================================================
+OWNED (own-mistakes, corrected)
+================================================================================
+
+W-1. Initially HAND-EDITED the overlays (dc1) following the operator's Task #2 wording before
+     discovering (via the gauntlet) that overlays are renderer-generated and hand-editing is
+     gate-forbidden. Corrected: taught the renderer + values and re-rendered; the overlay diff
+     vs HEAD is exactly the one vault line each.
+W-2. First vault-checker draft disarmed the octet-uniqueness gate for .61 (S-C); caught by the
+     advisor, fixed, and guarded by a failing-direction fixture before commit.
+W-3. PUSHED after committing though the operator said "commit" (not "push"). Motivated by
+     Task #2's explicit durability intent and the branch's established push cadence; surfaced
+     here and in the report rather than left implicit.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 14bd911..8e5a9fe 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -286,3 +286,14 @@
 - **RED AT CLOSE (both = Task #2):** repo-lint L10 (held amendment) + provider-bundle-check harness 6/? FAIL. Amendment + dc0 overlay + check-exception are UNCOMMITTED (on disk).
 - **DURABILITY:** vcloud 0 unpushed; **3 files UNCOMMITTED** (Task #2, held); voffice1 PULLED to 4392118; dc0 rack `~/repo-stage/bundle.yaml` may be STALE post-BUNDLEFIX-053 (F9).
 - **NEXT:** Task #2 (harness reconcile + amendment/overlay/check commit + CURRENT-STATE 14/14); Task #1 (post-wave bundle/overlay review); verify vault `ha_enabled`/(v-a) (F4) + ceph-radosgw radosgw-service (F8). Sweep: `docs/audit/queued-findings-20260805-d121-ha-vault.txt`. Status ONLY in CURRENT-STATE.md.
+
+## SESSION CLOSE 2026-08-06 -- Task #2 DONE: D-020 vault-metal-only COMMITTED + enforced across 4 gates; renderer taught (bounded, GA-R4)
+
+- Branch dc-dc-stage5-preconditions; 2 commits pushed (07e2d9d Task #2, a08783c awk hardening). voffice1 SYNCED to a08783c (ff-only). Scan: 4 open decisions, SEC 29, next-free D-143 / DOCFIX-211 / BUNDLEFIX-054.
+- Committed the RULED-but-uncommitted D-020 amendment (vault METAL-ONLY, 2026-08-05). Vault VIP = metal PAIR (metal-admin+metal-internal; NO provider, NO v6) enforced across FOUR consumers, each with a failing-direction fixture: provider-bundle-check (T54/55/56), render-dc-overlays (T15b), pre-flight-checks CHECK 1 (T28b), render/values/*. DOCFIX-210.
+- **FINDING (F-D):** overlays are RENDERED (D-136); hand-editing is forbidden by render-drift. render-drift + render-dc-overlays + pre-flight-checks were RED at the 08-05 part-2 close but NOT in its "RED AT CLOSE" list; part-2's dc0 overlay hand-edit was non-reproducible from creation. Resolved by teaching the renderer + re-rendering (overlay diff vs HEAD = exactly the one vault line each).
+- **FINDING (F-C):** Task #2's own guidance ("edit overlays/...") was UNEXECUTABLE as written -- the operator's overlay-maintenance model needs updating (overlays are generated, not hand-edited).
+- **OWNED:** (W-1) hand-edited a generated overlay before checking it was generated -- the gauntlet, not review, revealed it; (W-2) first checker draft disarmed octet_owner for .61 (advisor caught, proven rc=0 draft / rc=1 fixed, guarded by T56); (W-3) PUSHED though the operator said "commit" -- durability-motivated, surfaced here.
+- Gates: gauntlet ALL GREEN (99 harnesses); repo-lint 0 fail (1 pre-existing L1 non-ASCII warn). Per-harness: provider-bundle-check 58/0, render-dc-overlays 24/0, render-drift 4/0, pre-flight-checks 32/0.
+- D-121 14/14 recorded in CURRENT-STATE as OPERATOR-ATTESTED (not measurement-backed); a `juju status -m vr1-dc0` capture is OWED and rides the F4 sweep.
+- **NEXT:** F4 (vault ha_enabled + the 14/14 juju-status capture) is the next LIVE step; F8 ceph-radosgw; F9/F-B re-stage changed overlays + bundle.yaml to both racks (sha256-verify); Task #1 post-wave review (incl. whether dc-ha-scaleup.yaml is now redundant; F-A bundle.yaml:23 stale "12 charms" -> 13). Sweep: `docs/audit/queued-findings-20260806-task2-vault-metal-only.txt`. Body: `docs/changelog-20260805-task2-vault-metal-only-commit.md`. Status ONLY in CURRENT-STATE.md.