ops-update-20260705 window close: runbook as-executed corrections (DOCFIX-088) + D-071 amendment ...

Identifiers consumed: DOCFIX-088. D-071 AMENDMENT recorded (no new number).

Window complete: controller + 91 agents at 3.6.25, 17 apps refreshed,
all gates green, guests untouched. Runbook fold-back per first execution:
juju-status version sweep, create-backup as standard 2.1 step
(admin/controller), no separate controller-model upgrade, G3 probe on the
D-044 http leg with the VIP-TLS since-deploy defect cross-referenced,
mid-window target-drift expectation row. D-071 risk premise corrected
(supported backup exists; restore rehearsal -> Roosevelt open questions).
Ledger window section closed; post-window queue recorded (addendum 16).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz

ops-update-procedure runbook + D-071 update policy (jumphost stream) ...

Identifiers consumed by this push: D-071, DOCFIX-086. No BUNDLEFIX consumed
(BUNDLEFIX-010 remains next-free; see addendum-11 FINDING 2 on the scan's
wrapped-pointer over-report).

- NEW runbooks/ops-update-procedure.md (DOCFIX-086): routine update window,
  gated: controller patch -> model agents -> in-channel charm refreshes.
  Vault explicitly excluded (D-068 unruled). Not yet as-executed.
- docs/design-decisions.md: D-071 PROPOSED (update cadence + controller
  patch policy, explicit no-backup single-controller risk section).
- runbooks/README.md: index ops-update-procedure + missing ops-restart entry.
- docs/v1-redeploy-changelog.md: addendum 11 (what/why/revert + 2 findings).
- docs/session-ledger.md: numbering re-seeded (D=072, DOCFIX=087,
  BUNDLEFIX=010); D-071 contention resolved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FCGjrRXtbPRu5qEThw3CDz