diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index de43b23..1e616cf 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -368,3 +368,19 @@
 - Open sub-rulings: octavia family, reserved-range registry, vault-vip-derivation file. Deferred:
   CURRENT-STATE s4 stale-HIGH, G14 SEC 12->15, phase-4 designate. Chat skill pkg:
   .claude/skills/openstack-cloud-ops-consolidated-20260725.md. Detail: changelog items 1-17.
+
+## SESSION CLOSE 2026-07-25 -- MAAS admin-account recovery (SEC-020; bounded, GA-R4)
+- **PREMISE FALSIFIED before any mutation:** MAAS GUI login DID exist -- `admin` pw minted
+  2026-07-13 by site-headend-install.sh:452, MEASURED working (204 vs 400 wrong-pw control).
+  Defect was root-only + un-consolidated on voffice1 (SEC-009 class), NOT a missing account.
+- Scope RE-RULED by operator: "New account + consolidate only" -- no existing password rotated.
+- DONE: `operator` superuser minted (pw via stdin, never argv); `admin` pw consolidated
+  byte-identical to ~/vr1-office1-creds/ (**VM copy stays source-of-record**); dc0/dc1 manifest
+  backfill -> creds-audit CLEAN x3; README index lists both. juju-* UNTOUCHED by ruling (their
+  SEC-018/019 keys gate the blocked Stage-5 bootstrap). SEC-020 opened (open rows 15->16);
+  falsified IMMEDIATE NEXT struck; machine-derived block re-seeded.
+- OWNED: called a login probe read-only; it authenticated, writing last_login twice (benign).
+- LOGGED not executed: headend-install consolidate-at-mint; conflation proposable as next-free D
+  [ARCH]; 3 /root secrets unmoved. **GA-R4 F1: ledger 370 lines at OPEN vs 300 cap -- rotation OWED.**
+- Gauntlet 79 GREEN, repo-lint 0-fail, b2b0c80 pushed. Bookend EARLY (07-21 precedent); further
+  work appends a POST-CLOSE ADDENDUM. Details: docs/changelog-20260725-maas-admin-recovery.md.