diff --git a/docs/changelog-20260721-tenant-review-pin.md b/docs/changelog-20260721-tenant-review-pin.md
new file mode 100644
index 0000000..55bafa4
--- /dev/null
+++ b/docs/changelog-20260721-tenant-review-pin.md
@@ -0,0 +1,34 @@
+# Session changelog 2026-07-21 (fourth session) -- tenant-onboarding review verdict recovered + pinned
+
+One changelog per session (GA-R2/D1). Status lives ONLY in
+docs/CURRENT-STATE.md; this file is narrative + reverts. Predecessor
+(stage-3-close session, disconnected ~21:16):
+docs/changelog-20260721-netem-install-verify.md.
+
+## 1. Disconnected-session recovery (read-only)
+
+- Bootstrap reconciled clean: main at b2d4317, lint 0-fail, ledger scan
+  matches the hand-seeded block (D=132, DOCFIX=198, BUNDLEFIX=052; 10 open
+  SEC rows). No uncommitted traces from any disconnected session.
+- The predecessor's final undelivered message (the 3-seat committee verdict
+  on Chat's three tenant-onboarding-runbook inserts) was recovered VERBATIM
+  from its local session transcript and re-presented to the operator. No
+  repo edit and no commit had resulted from that review -- the verdict
+  existed nowhere durable.
+
+## 2. Tenant-onboarding review items PINNED to deployment close (operator-directed)
+
+- Operator ruling this session: do NOT land the committee's recommended
+  items now; pin all four for an end-of-deployment consideration review,
+  because this deployment is changing posture and end goals and the items
+  should be judged against the final shape.
+- Delivered: a self-contained compact block in docs/session-ledger.md
+  ("Deployment-close consideration review -- tenant-onboarding items"),
+  carrying the corrected substance of all four items plus the standing
+  caveat that every citation gets re-verified at review time (the full
+  verdict text lives only in the predecessor's session transcript).
+- Explicitly NOT done: no appendix-A entries, no contract edit, no
+  dc-dc-phase6 edit, no numbering consumed (stated token-free in the
+  ledger block per the standing counter discipline).
+- **Revert:** git revert this commit (records only; no live surface or
+  script was touched).
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 1f7d08e..a94cfd6 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -77,6 +77,27 @@
   do-documents into a v1 deploy runbook; flip repo PRIVATE (SEC-004);
   revoke/rotate SEC-005/006/007; v2-deferred: GitBucket SSH, IPv6
   dual-stack, NetBox import bundle.
+- **Deployment-close consideration review -- tenant-onboarding items (PINNED
+  2026-07-21, operator-directed):** the committee review of Chat's three
+  tenant-onboarding inserts refuted each as written but identified corrected
+  residue; the operator DEFERRED all of it to an end-of-deployment review
+  (posture and end goals are shifting this deployment -- reconsider fit then;
+  nothing lands before that review). Items: (1) appendix-A symptom entry for
+  sub-floor OR nonexistent flavor -> cluster-create rejection (capi-helm
+  thresholds are CONFIG OPTIONS, defaults 2 vCPU / 2048 MB RAM, as-built sets
+  neither; the RAM error also fires for mistyped flavors; command shape
+  `--public -f json`, never the deprecated `--long` -- archive R9); (2)
+  appendix-A entry for tenant-net-cannot-reach-public-keystone -> nodes
+  register but stall uninitialized (auth_url in the per-cluster clouds secret
+  is hardcoded PUBLIC at capi-helm 1.4.0; as-built carries no interface key),
+  pointing at the phase-08 D-011.3 probe, plus a per-DC precondition line in
+  dc-dc-phase6 Step 12; (3) tenant contract hardening list: PROPOSED
+  `-svc`-only password neutralization (admin-rotate to discarded value;
+  keystone `lock_password` blocks password CHANGE, not auth; NEVER lock
+  `-cluster` -- it keeps PASSWORD auth permanently per D-066); (4) flavor
+  catalog marking = commercial catalog policy, operator prioritization only.
+  RE-VERIFY every citation at review time -- the full verdict lives in the
+  2026-07-21 disconnected-session transcript, not in a repo surface.
 
 
 ## SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary