diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 7e36d1d..ade7c9f 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -97,14 +97,42 @@
 - D-050 (keystone policyd override) and the D-063-adjacent `identity:list_trusts=""` hardening
   remain PROPOSED/OPEN, not actioned.
 
+## Active window (jumphost stream) -- ops-update-20260705, IN FLIGHT
+
+First execution of runbooks/ops-update-procedure.md (DOCFIX-086; addendum 13).
+Logged session ops-update-20260705; checkpointed here at each milestone for
+cross-stream sync. State as of the Section 2 entry checkpoint:
+
+- **DONE Section 1 (pre-flight):** client 3.6.25 / controller 3.6.24 / all 91 agents
+  uniformly 3.6.24 -> target 3.6.25. Worklist = 17 apps. Quiesce clean. Pre-change BOM
+  asbuilt/20260705-102951 committed on a TRUE cloud-assert PASS (required the DOCFIX-087
+  A7 false-negative fix, addendum 14 -- window was HELD on the operator's Option B
+  ruling until it landed).
+- **DONE Section 2.1:** controller state backup via `juju create-backup -m
+  admin/controller` (902MB, checksummed, ~/openstack-baseline/, jumphost-only).
+  NOTE: controller model is admin/controller, NOT <user>/controller.
+- **NEXT:** Section 2.2 `juju upgrade-controller --agent-version 3.6.25` (gated),
+  then model agents (S3), then 17 charm refreshes in groups (S4), post-verify (S5),
+  re-baseline + close-out (S6).
+- **Window findings logged for close-out (do not action mid-window):**
+  1. magnum can-upgrade-to anomaly REPRODUCED (points at magnum-dashboard-122;
+     evidence ~/openstack-baseline/magnum-can-upgrade-anomaly-20260705.json) AND
+     Charmhub magnum 2024.1/stable latest release (r101, 2026-07-01) is s390x-ONLY --
+     no valid amd64 target; magnum EXCLUDED; report upstream to OpenStack Charmers.
+  2. vault NEWLY offers in-channel 372->714 on 1.8/stable -- NOT refreshed (D-068);
+     logged only.
+  3. `juju create-backup`/`download-backup` EXIST on juju 3.6 -- authoring assumption
+     ("removed in 3.0, expected absent") is WRONG; correct ops-update-procedure 2.1
+     and the D-071 risk section at window close (DOCFIX candidate).
+  4. juju status --format=line omits workload messages on 3.6 (root cause of the A7
+     false negative; fixed by DOCFIX-087).
+
 ## State facts to remember
 
 - beta cluster left at **node_count=2** (deliberate; bonus resize acceptance coverage).
 - repo is temporarily **PUBLIC** for Claude web_fetch (SEC-004) -- flip private at v1 close.
-- Parallel Claude Code stream on the jumphost: D-071 + DOCFIX-086 FILED (addendum 11,
-  2026-07-04). Its next step is the LIVE EXECUTION of runbooks/ops-update-procedure.md
-  (controller 3.6.24 -> 3.6.25 + ~20 in-channel charm refreshes), operator-gated, in a
-  run-logged session. Vault stays 1.8/stable (D-068 unruled).
+- Jumphost stream: see "Active window" section above (ops-update-20260705 in flight).
+  Vault stays 1.8/stable (D-068 unruled).
 
 ## Project-completion (execute after D-011 passes)