diff --git a/.claude/skills/openstack-cloud-ops-consolidated-20260727.md b/.claude/skills/openstack-cloud-ops-consolidated-20260727.md
index 51beed7..a774af2 100644
--- a/.claude/skills/openstack-cloud-ops-consolidated-20260727.md
+++ b/.claude/skills/openstack-cloud-ops-consolidated-20260727.md
@@ -51,10 +51,15 @@
 BEFORE any other doc (it is the only status authority), then `docs/session-ledger.md`
 + `bash scripts/ledger-scan.sh` to recover what is in flight and reconcile it against
 repo ground truth (open decisions, open SEC count, next-free numbers). Re-do this
-after any compaction. CLOSE: a bounded ledger summary (15-line hard cap, GA-R4 rule
-1); the full session body goes to `docs/archive/` in the same close commit; commit
-and push -- a session ending without its bookend is treated as NOT durable by the
-next session. See `references/operating-discipline.md` (Session continuity).
+after any compaction. CLOSE: a bounded <=15-line summary (GA-R4 rule 1) appended to
+`docs/session-ledger.md` as a `## SESSION CLOSE <date>` block; the session's full body
+is its changelog (`docs/changelog-<date>-<label>.md`, GA-R2 one-per-session), cited by
+that block's `Body:` line. `docs/archive/` is NOT the per-session body store -- it holds
+periodically-rotated full ledgers (`session-ledger-rotated-*.md`, GA-R4 rule 3) and
+per-stage consolidated records (`archive/changelogs/`, `archive/stage-records/`, GA-R2
+rule 2 at STAGE close). Commit and push -- a session ending without its bookend is
+treated as NOT durable by the next session. See
+`references/operating-discipline.md` (Session continuity).
 ## Step 1 - detect the environment
 
 - **Live shell to the jumphost / infra** (Claude Code on `vcloud` or
diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index 12ae95d..4868b29 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -42,10 +42,15 @@
 BEFORE any other doc (it is the only status authority), then `docs/session-ledger.md`
 + `bash scripts/ledger-scan.sh` to recover what is in flight and reconcile it against
 repo ground truth (open decisions, open SEC count, next-free numbers). Re-do this
-after any compaction. CLOSE: a bounded ledger summary (15-line hard cap, GA-R4 rule
-1); the full session body goes to `docs/archive/` in the same close commit; commit
-and push -- a session ending without its bookend is treated as NOT durable by the
-next session. See `references/operating-discipline.md` (Session continuity).
+after any compaction. CLOSE: a bounded <=15-line summary (GA-R4 rule 1) appended to
+`docs/session-ledger.md` as a `## SESSION CLOSE <date>` block; the session's full body
+is its changelog (`docs/changelog-<date>-<label>.md`, GA-R2 one-per-session), cited by
+that block's `Body:` line. `docs/archive/` is NOT the per-session body store -- it holds
+periodically-rotated full ledgers (`session-ledger-rotated-*.md`, GA-R4 rule 3) and
+per-stage consolidated records (`archive/changelogs/`, `archive/stage-records/`, GA-R2
+rule 2 at STAGE close). Commit and push -- a session ending without its bookend is
+treated as NOT durable by the next session. See
+`references/operating-discipline.md` (Session continuity).
 ## Step 1 - detect the environment
 
 - **Live shell to the jumphost / infra** (Claude Code on `vcloud` or
diff --git a/docs/changelog-20260805-skill-close-convention-docfix.md b/docs/changelog-20260805-skill-close-convention-docfix.md
new file mode 100644
index 0000000..c10fe19
--- /dev/null
+++ b/docs/changelog-20260805-skill-close-convention-docfix.md
@@ -0,0 +1,86 @@
+# Changelog 2026-08-05 (skill close-convention DOCFIX) -- SKILL.md close bookend corrected
+
+Session changelog (GA-R2/D1: ONE per session; distinct session from the
+2026-08-05 vault-init close, whose body is
+`docs/changelog-20260805-vault-init-ovn-resolved.md`). Branch
+`dc-dc-stage5-preconditions`. Session open reconciled at HEAD `e252b31`:
+repo-lint 0 fail / 1 legacy warn, `ledger-scan` 4 open decisions / 29 open SEC /
+next-free D-143, DOCFIX-209, BUNDLEFIX-053. Status claims live in
+`docs/CURRENT-STATE.md` ONLY; nothing here is a status claim.
+
+Scope: a single skill/repo divergence in the session-CLOSE bookend text, surfaced
+2026-08-05. No live-cloud mutation; no state-bearing surface touched (a skill routing
+line is not a status claim, so no GA-R1 L10 coupling). Stage 5 dc0 remains OPEN and
+untouched by this session.
+
+---
+
+## Item 1 -- DOCFIX-209: SKILL.md close-bookend text conflated GA-R4 ledger rotation with the GA-R2 changelog body
+
+**WHAT WAS WRONG.** `.claude/skills/openstack-cloud-ops/SKILL.md` (the always-loaded
+routing layer -- F12: a wrong line here misleads every fresh session before any runbook
+loads) described session CLOSE as: "a bounded ledger summary (15-line hard cap, GA-R4
+rule 1); **the full session body goes to `docs/archive/` in the same close commit**."
+That last clause is a paraphrase of ratified GA-R4 rule 2's literal words -- but it
+CONFLATES two distinct ratified mechanisms and describes neither correctly:
+
+- **GA-R4 rule 2 + amendment F1** (`docs/audit/ga-rulings.md:328-338`) is the LEDGER
+  ROTATION mechanism: bounded summaries rotate out to a dated
+  `docs/archive/session-ledger-rotated-*.md` file when the 300-line live-ledger cap
+  binds at a close -- NOT a "full body" and NOT "in the same close commit" of every
+  session. Practice follows this: `docs/archive/` holds 11 such rotated ledgers
+  (latest `session-ledger-rotated-20260804.md`).
+- **GA-R2 amendment D1** (`docs/audit/ga-rulings.md:228-234`) makes the CHANGELOG the
+  session body-of-record ("one changelog per session"). The session's full body is
+  `docs/changelog-<date>-<label>.md`, cited by a `Body:` line in the
+  `## SESSION CLOSE <date>` block appended to `docs/session-ledger.md`. That changelog
+  is consolidated per-stage into `docs/archive/changelogs/` at STAGE close (GA-R2 rule
+  2), not moved at session close.
+
+So the skill line was wrong on both counts: the per-session body is the changelog (it
+stays in `docs/changelog-*` until stage-close consolidation), and what reaches
+`docs/archive/` at a session close is a ledger rotation, and only at cap.
+
+**EVIDENCE (measured, not asserted).**
+- Ratified text: `docs/audit/ga-rulings.md:328-332` (GA-R4 rules 1-2),
+  `:333-338` (F1 cap-at-close), `:209-234` (GA-R2 rules 2/5 + D1).
+- `ls docs/archive/` -> `session-ledger-rotated-*.md` (x11) PLUS `changelogs/`
+  (consolidated per-stage bodies) PLUS `stage-records/` PLUS one-off historical docs.
+  Archive is NOT "rotated ledgers only".
+- Close blocks in `docs/session-ledger.md` carry `Body:` changelog citations: 08-05 ->
+  `docs/changelog-20260805-vault-init-ovn-resolved.md`; 08-04 ->
+  `docs/changelog-20260804-ovn-central-cert-fix.md`; 08-02 ->
+  `docs/changelog-20260802-queued-items.md`.
+- `references/operating-discipline.md` "Session continuity" (`:100-112`) is already
+  correct (ledger = what is open; changelog = what changed) and needs NO edit.
+
+**DISPOSITION.** Operator-ruled 2026-08-05: "Proceed as DOCFIX-209". Because both
+same-day rulings, read correctly, BACK the practice and CONTRADICT the skill line's
+conflation, no ratified text changes -- this is a skill-text correction, not a GA-R5
+amendment. (The alternative -- amend GA-R4 rule 2 first -- was offered and declined.)
+
+**THE FIX.** In `.claude/skills/openstack-cloud-ops/SKILL.md`, the CLOSE sentence now
+reads: bounded <=15-line summary (GA-R4 rule 1) appended to `docs/session-ledger.md`
+as a `## SESSION CLOSE <date>` block; the session's full body is its changelog
+(`docs/changelog-<date>-<label>.md`, GA-R2 one-per-session) cited by that block's
+`Body:` line; and `docs/archive/` is explicitly NOT the per-session body store -- it
+holds periodically-rotated full ledgers (`session-ledger-rotated-*.md`, GA-R4 rule 3)
+and per-stage consolidated records (`archive/changelogs/`, `archive/stage-records/`,
+GA-R2 rule 2 at STAGE close). ASCII-only (`<=` not the glyph; `--` dashes).
+
+**SECOND COPY FIXED.** The derived Chat-upload snapshot
+`.claude/skills/openstack-cloud-ops-consolidated-20260727.md:54-57` carried the
+byte-identical sentence and was patched identically, so the Chat mount does not stay
+stale in the interim (a stale mount is the known failure mode that caused a bad clone
+2026-07-25, `docs/audit/skill-divergence-20260725.md`). The snapshot is a DERIVED
+artifact; it is properly regenerated from SKILL.md + references at stage close -- this
+hand-patch is an interim-consistency measure, not a substitute for that regeneration.
+(A third copy exists in the git-ignored worktree
+`.claude/worktrees/skill-repackage-20260727/`; left untouched -- it is a separate
+working tree, not part of the tracked surface.)
+
+**REVERT.** `git revert` this commit (skill edits ship uncommitted for operator diff
+review, so pre-commit this is `git checkout -- <the two skill files>`). Restores a
+routing line that conflates GA-R4 ledger rotation with the GA-R2 changelog body and
+mis-describes `docs/archive/`. Do not revert without re-opening the finding -- the line
+misleads every fresh session's close bookend.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index fbf93ab..3228f63 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -30,36 +30,32 @@
 <!-- SECTION: machine-derived | OWNER: ledger-scan (regenerate; never hand-edit) -->
 ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)
 
-_RE-SEEDED 2026-08-02 from `bash scripts/ledger-scan.sh`. The prior seed was the
-2026-07-27 STAGE 4 CLOSE (confirmed unchanged 2026-07-29) and had gone STALE by seven SEC
-rows and three D numbers -- the per-session summaries below carried the current figures
-while this block did not, which is the one thing this block exists to prevent. Re-run the
-scan to refresh._
+_RE-SEEDED 2026-08-05 from `bash scripts/ledger-scan.sh` (this commit). The prior seed was
+2026-08-02; it had gone STALE by one decision (D-142), one SEC row (SEC-033), and the D /
+DOCFIX next-free (D 141 -> 143, DOCFIX 208 -> 210) -- the per-session summaries below carried
+the current figures while this block did not, which is the one thing this block exists to
+prevent. Re-run the scan to refresh._
 
-- **PROPOSED / OPEN decisions (3):** D-068 (Vault substrate hardening, Roosevelt -- sole
+- **PROPOSED / OPEN decisions (4):** D-068 (Vault substrate hardening, Roosevelt -- sole
   remainder is Q2 path selection at Roosevelt Vault design time), D-131 (node-facing DNS for
   rack-only controllers [ARCH] -- sub-4 open + the pinned DNS architectural review), D-132
-  (Roosevelt per-DC MAAS topology [ARCH], operator-pinned to the next deployment).
-  **D-136 was ADOPTED 2026-07-27 at option (D)** and correctly drops off the scan, as D-137
-  did before it (was 4). Status lines in `docs/design-decisions.md` are the only ruling
-  authority.
-- **OPEN security rows:** **28** per `bash scripts/ledger-scan.sh` (was 21 at the last
-  seed). The seven added since, verified against the register: SEC-026..-029 all 2026-07-30
-  (a MAAS admin-scoped key going DC-resident under D-138; the per-DC region credential class;
-  the per-DC juju service credential, which made the RACK credential-bearing for the first
-  time; and the Octavia PKI overlay's residency on the dc0 rack), SEC-030 2026-07-31 (local
-  permission rules bypassing the committed ask-gating -- an ACCEPTED, recorded posture), then
-  SEC-031 and SEC-032 on 2026-08-02 -- **SEC-031 is the live one**: the
-  dc1 edge lost its FreeBSD user database to fsck and runs with NO pf ruleset, i.e. an open
-  router serving its GUI. The SEC register of record is `docs/security-ledger.md`; row-level
-  dispositions live THERE only (GA-R4/F3) -- this block carries pointer + count, never rows.
-- **Next-free numbers:** D = **141**, DOCFIX = **208**, BUNDLEFIX = **053**. D moved
-  138 -> 141 as D-138 (cloud-facing client moves into the DC), D-139 (IPv6/GUA plane carve)
-  and D-140 (tofu manages juju, PINNED) were assigned. **DOCFIX-206 and -207 are both
-  assigned**: 206 was Step 2.0's non-region-scoped credential gate (2026-07-31); 207 is this
-  session's preflight P6 plan-count correction, so `ledger-scan`'s derived next-free of 207
-  is superseded by 208 until the next scan. 204 remains 2026-07-27's stale "NTP from edge"
-  Stage-4 gate bullet.
+  (Roosevelt per-DC MAAS topology [ARCH], operator-pinned to the next deployment), D-142
+  (vault-init workflow QoL sweep -- APPROVED-IN-PRINCIPLE / IMPL-DEFERRED, R2 off-host
+  transport unresolved). D-136/D-137 dropped off the scan when ADOPTED (correct). Status
+  lines in `docs/design-decisions.md` are the only ruling authority.
+- **OPEN security rows:** **29** per `bash scripts/ledger-scan.sh` (was 28 at the last
+  seed). The one added since, verified against the register: SEC-033 2026-08-04 (the
+  tls-certificates relation databag exposes vault's global-client private key to any juju
+  model reader; interface-level, mitigate via juju RBAC). **SEC-031 remains the live-exposure
+  one**: the dc1 edge lost its FreeBSD user database to fsck and runs with NO pf ruleset, i.e.
+  an open router serving its GUI. The SEC register of record is `docs/security-ledger.md`;
+  row-level dispositions live THERE only (GA-R4/F3) -- this block carries pointer + count,
+  never rows.
+- **Next-free numbers:** D = **143**, DOCFIX = **210**, BUNDLEFIX = **053**. D moved
+  141 -> 143 as D-141 (IPAM allocations dual-stack, status-distinguished) and D-142
+  (vault-init QoL, PROPOSED) were assigned. DOCFIX moved 208 -> 210: **DOCFIX-208** (phase-4
+  dc0 machines-overlay omission, 2026-08-02) and **DOCFIX-209** (this session's SKILL.md
+  close-bookend correction) are both assigned.
 - **Gates:** G17 OPENED 2026-07-27 by operator ruling (node-side artifact reachability split out
   of Stage 4; the gate table in `docs/CURRENT-STATE.md` is the authority).
 - **Standing numbering rule:** never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN)