diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 4b10918..77c5345 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -356,6 +356,37 @@
   dir retired by hand. Fix: owner-context-or-skip E0 inventory, do not count
   known-403 as failure; + harness case.
 
+## Jumphost stream -- session 2026-07-08 (cont.): devteam self-service cluster live (post-handover)
+
+- **devteam self-created their first cluster (read-only audit, no cloud change).**
+  `TestCluster` (uuid 92b92eed-afa3-4aaf-ab33-13d3ddeea869) CREATE_COMPLETE +
+  HEALTHY (cluster / infrastructure / controlplane / nodegroup all Ready), created
+  2026-07-08 17:18 UTC in devteam-prod. 1 master + 1 worker, keypair devteam-key,
+  api https://10.12.7.130:6443. calico + small-first + correct keypair + no
+  Public/Hidden flag -- the DOCFIX-121 dashboard symptom resolved IN PRACTICE on
+  their first real self-service create. (Note: this fresh TestCluster reuses the
+  name of the earlier deleted TestCluster/TestCluster2, addenda 40/42 -- cosmetic.)
+- **Built via HORIZON, not the CLI.** They created their own template
+  `TestTemplate` (calico, public/hidden False, keypair baked in = devteam-key) in
+  the dashboard and launched TestCluster from it, rather than the delivered CLI
+  template devteam-k8s (keypair_id None; measured, correct-by-design, still unused).
+  Both are valid Magnum objects.
+- **What the Horizon path changes (LOGGED, not actioned; DOCFIX candidate, no
+  number consumed):**
+  1. Nothing about the running cluster -- same Magnum API object either way.
+  2. Explains the keypair-on-template confusion this session: Horizon's Create
+     Cluster Template dialog exposes an OPTIONAL Keypair field, so their
+     GUI-built TestTemplate shows a key while the delivered devteam-k8s (CLI
+     stage5 omits it by design) shows none. Comparing the two in-GUI drove the
+     "no keypair -> must be required" read. It is not; the key is supplied at
+     cluster-create time and their live cluster already carries it.
+  3. Doc-gap: jenkins-kubernetes-guide.md is CLI-centric. Their next guide step
+     (Section 3, kubeconfig fetch via `openstack coe cluster config`) has NO
+     Horizon equivalent documented -- magnum-ui offers a cluster-config download,
+     but the guide does not mention it, and the Jenkins integration requires the
+     CLI/app-cred path regardless. Candidate: a short "if you drive the dashboard"
+     note in Sections 2-3 pointing GUI users to the CLI for kubeconfig + Jenkins.
+
 ## REMAINING OPEN WORK (single list for session resume; 2026-07-07, updated post-devteam-window)
 
 1. **Devteam delivery -- last two steps are OPERATOR-MANUAL (everything