diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index c7c78ec..c9cef78 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -35,6 +35,11 @@
 The repo is a living draft; this skill's invariants (discipline, hardening)
 change slowly, its facts (IPs, versions, phase status) go stale fast.
 
+**Long sessions get compacted.** At session start (and after any compaction), read
+`docs/session-ledger.md` and run `bash scripts/ledger-scan.sh` to recover what is in flight and
+reconcile it against repo ground truth (open decisions, open security rows, next-free numbers).
+Update the ledger at every deliverable -- it is standing, like the changelog. See
+`references/operating-discipline.md` (Session continuity).
 ## Step 1 - detect the environment
 
 - **Live shell to the jumphost / infra** (Claude Code on `vopenstack-jesse` or
@@ -81,6 +86,7 @@
 | Full-cloud restart after outage/maintenance | repo `runbooks/ops-restart-procedure.md` |
 | Starting any consequential live session | `bash scripts/run-logged.sh <label>` first (as-executed log; docs/as-executed-log-convention.md) |
 | Credential exposures / security TODOs | repo `docs/security-ledger.md` -- add a row, never only a script comment |
+| Resuming work / what is still in flight (esp. after compaction) | repo `docs/session-ledger.md`, then `bash scripts/ledger-scan.sh` to reconcile against repo ground truth |
 | Tenant onboarding / tenant self-service | repo `scripts/tenant-onboard.sh` + `runbooks/tenant-onboarding-v2-DRAFT.md` + `appendix-C/D` |
 | Network / plane / IPAM questions | `references/environment.md`, repo `scripts/lib-net.sh`, NetBox (the IPAM apex) |
 | ANY change request to a built surface | grep repo `docs/design-decisions.md` for the governing D-NNN FIRST - PROPOSED/OPEN means the operator has not ruled: present options, do not implement |
diff --git a/.claude/skills/openstack-cloud-ops/references/operating-discipline.md b/.claude/skills/openstack-cloud-ops/references/operating-discipline.md
index e235e6d..3c7a2f2 100644
--- a/.claude/skills/openstack-cloud-ops/references/operating-discipline.md
+++ b/.claude/skills/openstack-cloud-ops/references/operating-discipline.md
@@ -56,6 +56,12 @@
   appended. `DOCFIX-NNN` - runbook fixes. `BUNDLEFIX-NNN` - bundle fixes.
 - ALWAYS grep the repo for the next free number before assigning one -
   collisions have happened. State "next-free verified" when you assign.
+- PARALLEL WORK numbering: when more than one workstream edits the shared numbered
+  ledgers (this repo + a parallel Claude Code stream), do NOT each independently grab
+  "next-free" -- that collides. One stream owns a given number/block; each DECLARES every
+  identifier it consumes in its commit; the other re-greps AFTER the parallel push lands
+  and resumes above it. `scripts/ledger-scan.sh` derives next-free from decision HEADERS
+  (not prose mentions -- a "next-free D-072" pointer must not inflate the count).
 - Mid-task findings are logged as proposals, not acted on (hard rule 1).
   A finding that changes a runbook becomes a DOCFIX; one that changes
   architecture becomes a D-NNN with status PROPOSED until the operator rules.
@@ -89,6 +95,36 @@
   item states what changed, the evidence for why, and a per-item revert. The
   changelog is the review surface; opinion-weighted calls are flagged as such.
 
+## Session continuity: the in-flight ledger
+
+Long sessions on this cloud get COMPACTED, often several times. Work that lives only in
+chat scrollback is lost at compaction. `docs/session-ledger.md` is the durable record of
+what is IN FLIGHT (active build, backlog, operator-gated items, open decisions, numbering
+state, state facts). Standing practice:
+- Read the ledger AND run `scripts/ledger-scan.sh` at session start; reconcile.
+- The scan is the DRIFT CHECK: it derives open decisions (last Status line per block, so an
+  amendment closes it), OPEN security rows, and next-free numbers straight from the repo.
+  The narrative ledger must not claim CLOSED what the scan shows OPEN, nor omit what it
+  surfaces. A ledger without this check rots (cf. D-070's unexercised-snapshot critique).
+- Update the ledger at every deliverable/commit -- it is a standing deliverable like the
+  changelog. Changelog = what changed; ledger = what is still open.
+
+## Boundary mutations: adds-before-removes with a readback gate
+
+When tightening a security boundary (SG rules, firewall, policy) that a live flow depends on,
+NEVER remove the permissive rule before the specific replacements are proven present. Create
+the narrow rules, READ THEM BACK (fail if any is missing), and only THEN remove the wide rule
+by its MEASURED id. There must be no window in which a required flow (e.g. the magnum
+conductor -> mgmt apiserver poll) is unauthorized. Verify the tightened boundary by FUNCTIONAL
+outcome afterwards, not by assuming the rule text is sufficient.
+
+## Attestation gates for unautomatable safety items
+
+Some acceptance items cannot be scripted -- e.g. a SECOND person performing the Vault unseal
+(D-069). Never auto-pass such an item. Gate it on a ledger ROW (docs/security-ledger.md):
+report PASS_PENDING_MANUAL while the row is OPEN, PASS only when it is attested CLOSED/rehearsed,
+HOLD if the row is missing. Auto-passing an undone safety item is the exact failure D-070 retired.
+
 ## Debate and correction norms
 
 - Challenge weak reasoning with sources; the operator prefers industry best
diff --git a/.claude/skills/openstack-cloud-ops/references/script-authoring.md b/.claude/skills/openstack-cloud-ops/references/script-authoring.md
index 635dcc1..bfe5d1c 100644
--- a/.claude/skills/openstack-cloud-ops/references/script-authoring.md
+++ b/.claude/skills/openstack-cloud-ops/references/script-authoring.md
@@ -140,6 +140,22 @@
 file rather than asserting an expected length (this deployment's app-cred
 secrets are 86 chars, not the commonly assumed 43 - never hardcode either).
 
+**Structured-output captures take stdout ONLY; never merge stderr.** `x=$(openstack ... -f json 2>&1)`
+is a defect: any stderr line (a `--long` deprecation warning, an SDK notice) lands at char 0 and
+kills the JSON parse -- this fail-closed a live SG audit in 2026-07. Capture stdout alone; send
+stderr to a tempfile; surface it on parse failure, never discard it (`2>/dev/null` trades the bug
+for silent error-masking). The `vr_json` helper in `scripts/lib-validate.sh` encodes this. Also
+drop deprecated flags that only add stderr noise (`--long` is unneeded; fields are present without it).
+
+**Fixture-test throwaway probe one-liners like real code.** A measurement `ss`/`tcpdump`/`awk`
+pipeline is code, and it has the same parse traps: `ss` DROPS the State column under a
+`state established` filter (peer is then `$NF`, not `$5`); `cut -d:` splits IPv4-mapped IPv6
+(`[::ffff:10.0.0.1]:443`) at the wrong colon; `grep -oE 'src [0-9.]+'` greedily eats the trailing
+`.` into the next field; charmed magnum logs to `/var/log/magnum/magnum-conductor.log`, NOT
+journald. One measurement chain in 2026-07 shipped four such bugs before each was caught. Run the
+parse against a fixture line (mapped-v6, plain-v4, the real column layout) BEFORE handing the
+operator a probe -- the same discipline as a committed script.
+
 ## Testing: nothing ships on `bash -n`
 
 `bash -n` validates parse, not behavior - and most of the failures above are
@@ -188,3 +204,11 @@
 Read-only verify scripts DETECT and report; remediation stays a gated human
 step even when the fix is obvious - the script's job is evidence, the
 operator's job is the mutation decision.
+
+**Mock worlds must be TRUTHFUL to the real CLI/contract, and test expectations must match the
+SPECIFIED contract.** A mock that emits a 409 must actually have the resource pre-exist; a mock of
+an openstack list command must emit the real deprecation warning ON STDERR (or the stderr-separation
+rule above never gets exercised); a harness assertion that contradicts the documented exit contract
+(e.g. expecting a lone SKIP to lower the overall verdict when the contract says SKIP never lowers it)
+is a TEST bug, not a code bug -- fix the test. Three 2026-07 "failures" were untruthful mocks or
+wrong assertions, each caught by running the harness before delivery.
diff --git a/.claude/skills/openstack-cloud-ops/references/troubleshooting.md b/.claude/skills/openstack-cloud-ops/references/troubleshooting.md
index ef2567c..32465ef 100644
--- a/.claude/skills/openstack-cloud-ops/references/troubleshooting.md
+++ b/.claude/skills/openstack-cloud-ops/references/troubleshooting.md
@@ -77,6 +77,15 @@
   been removed deliberately (check design-decisions) or its absence may be
   the actual root cause several layers up.
 
+**Prove event-driven flows by FUNCTIONAL OUTCOME, not packet/snapshot forensics.** For a
+bursty, per-operation client flow (e.g. the magnum conductor's helm/watch to the mgmt apiserver),
+an instantaneous `ss` snapshot or a short `tcpdump` window will usually catch NOTHING -- the
+connection is idle at rest and short-lived under load. That absence is expected, not a fault.
+The right proof is a forced real operation that SUCCEEDS end-to-end (a cluster resize reaching
+UPDATE_COMPLETE proves the conductor reached the mgmt apiserver through the boundary), plus a
+TCP handshake from the real source. Reach for established-state or a forced functional op before
+concluding a flow is broken; a service's own successful state transition outranks a captured packet.
+
 ## Escalation and blockers
 
 - Missing vault unseal keys, lost one-shot secrets, or anything requiring
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index f621e95..0b13264 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -1056,9 +1056,9 @@
 
 ---
 
-## D-063: PROPOSED / OPEN -- tighten the capi-mgmt-cluster security group ingress for Roosevelt
+## D-063: RESOLVED / CLOSED (2026-07-03) -- tighten the capi-mgmt-cluster security group ingress for Roosevelt
 
-**Status:** PROPOSED / OPEN (recorded 2026-07-01, phase-07 conductor graft). No action taken on v1.
+**Status:** PROPOSED / OPEN (recorded 2026-07-01) -> RESOLVED / CLOSED 2026-07-03 (applied + functionally verified; see the RESOLVED/CLOSED amendment below).
 
 **Context:** the phase-06 in-cloud CAPI management VM (`capi-mgmt-v2`, D-035) sits behind the
 `capi-mgmt-sg` security group. As built by phase-06 (a CAPI/cluster-api default posture), that SG
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
new file mode 100644
index 0000000..5615285
--- /dev/null
+++ b/docs/session-ledger.md
@@ -0,0 +1,94 @@
+# Session ledger -- in-flight work continuity record
+
+**Purpose.** Long ops sessions on this cloud routinely exceed a single context window
+and get COMPACTED (sometimes several times). Anything living only in the chat scrollback
+is lost at compaction. This ledger is the durable, committed record of what is in flight,
+so any session -- after a compaction, or a fresh one, or the parallel Claude Code stream --
+can resume without losing pending work.
+
+**How to use it (standing practice).**
+1. At session start: read this ledger AND run `bash scripts/ledger-scan.sh`. Reconcile.
+2. `ledger-scan.sh` is the DRIFT CHECK -- it derives the open-work it reliably can
+   (PROPOSED/OPEN decisions, OPEN security rows, next-free numbers) straight from the repo.
+   This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what it surfaces.
+3. Update this ledger at every deliverable/commit -- it is a standing deliverable like the
+   changelog. The changelog says what CHANGED; this ledger says what is still OPEN.
+4. Numbers and the machine-derived section below are seeded from a scan; re-run the scan and
+   re-seed rather than editing those by hand.
+
+---
+
+## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)
+
+_As of repo HEAD around 2026-07-03 (re-run the scan to refresh):_
+
+- **PROPOSED / OPEN decisions:** D-050 (keystone policyd override, no policy zip),
+  D-068 (Vault substrate hardening, Roosevelt). _(D-063 is CLOSED as of 2026-07-03.)_
+- **OPEN security rows:** SEC-001 (libvirt cred rotate), SEC-003 (Vault unseal custody /
+  second-person rehearsal), SEC-004 (repo public -> private at v1 close).
+- **Next-free numbers:** D = 071, DOCFIX = 086, BUNDLEFIX = 010.
+  **CONTENDED:** D-071 is being filed by the parallel Claude Code (jumphost) stream
+  (Juju controller update cadence / patch policy). This repo relinquishes D-071 and
+  resumes at D-072+ AFTER that stream's push lands and the scan is re-run.
+
+---
+
+## Active build (this session)
+
+- **validate.sh D-011 runner -- modular.** Foundation committed: `scripts/lib-validate.sh`
+  (exit contract 0/1/2/3/4, emit, vr_json stderr-safe, run, env hygiene, disruptive gate) +
+  `scripts/validate.sh` orchestrator (profiles, verdict, --stop-on-fail, --include-disruptive).
+  - Batch 1 committed: `checks/d011-01-charms` (active/idle), `checks/d011-06-vault-unseal`
+    (SEC-003 attestation -> MANUAL until the rehearsal closes).
+  - **Batch 2 (next):** `d011-02-vip-jumphost` (catalog-derive VIPs, TLS+HTTP probe),
+    `d011-03-vip-tenant` (agnhost on a beta node -> keystone VIP 10.12.4.50:5000, D-035 pattern).
+  - **Batch 3:** `d011-04-octavia-lb` (2-backend round-robin -> member failover -> AMPHORA
+    failover with an N+1 scheduler-headroom HOLD-guard -> recovery -> self-cleanup;
+    --disruptive-gated) and `d011-05-magnum-e2e` (wrap `tenant-acceptance.sh` + timing).
+  - D-011 AMENDED bar: 1 charms; 2 VIP jumphost; 3 VIP tenant; 4 octavia RR/failover/recovery;
+    5 magnum e2e + OCCM; 6 second-person manual unseal (attestation, D-069); 7 DROPPED
+    (D-070 supersedes D-012 snapshots); 8 DROPPED (D-019, no Designate).
+
+## Script backlog (changelog-tracked)
+
+- DONE: tenant-offboard.sh, vault-kv-health.sh, cloud-assert.sh (item 3 largely), validate
+  foundation + batch 1.
+- **item 3 remainder:** fold `vault-kv-health.sh` into cloud-assert as a section; use the
+  combined gate to regenerate the stale restart-procedure runbook.
+- **item 5:** `scripts/tenant-cluster-create.sh` -- generalize the t2-02 stage6 + watch +
+  D-066-evidence wrapper. Not started.
+- **item 6:** `scripts/keystone-policy-drift.sh` -- D-051 base_* alignment (LIVE-READ PENDING).
+  Not started.
+- **item 7:** `scripts/cloud-snapshot.sh` -- juju-export baseline capture (D-070 retired KVM
+  snapshots but KEPT the export/inventory baseline). Not started.
+- **item 8:** `tests/tenant-acceptance/` harness -- pending (tenant-onboard harness landed).
+
+## Register / operator-gated (see docs/handoff-20260703-open-items.md)
+
+- **R-1 / SEC-003:** Vault unseal-key custodian assignment (OPEN). Gates V-2 and closes
+  `d011-06-vault-unseal` (currently MANUAL). Operator input, recorded off-repo.
+- **V-2:** second-person unseal rehearsal (blocked on R-1).
+- **R-2 (D-043 caveat):** capi-mgmt-v2 auto-resume exclusion -- rule or accept.
+- **R-3:** was D-063 -- now CLOSED. The handoff doc still lists R-3 OPEN; update it.
+- **D-1:** Pattern-A full redeploy (VR0 DC0).
+
+## Logged-not-actioned (small; would vanish at compaction)
+
+- offboard v2 `--sweep-magnum-orphans` mode (orphan per-cluster trustee in the magnum domain).
+- offboard stage-3 app-cred idempotency re-run guard.
+- `host_href=None` barbican observation (exercised fine in stage 6; probably closeable).
+- DOCFIX candidate: sweep repo for other `-f json ... 2>&1` stderr-merge hazards (DOCFIX-085 class).
+- D-050 (keystone policyd override) and the D-063-adjacent `identity:list_trusts=""` hardening
+  remain PROPOSED/OPEN, not actioned.
+
+## State facts to remember
+
+- beta cluster left at **node_count=2** (deliberate; bonus resize acceptance coverage).
+- repo is temporarily **PUBLIC** for Claude web_fetch (SEC-004) -- flip private at v1 close.
+- Parallel Claude Code stream active on the jumphost (controller-update workstream, filing D-071).
+
+## Project-completion (execute after D-011 passes)
+
+- Consolidate 10 per-phase do-documents into `docs/v1-deploy-runbook.md`.
+- Set repo visibility PRIVATE (SEC-004).
+- v2-deferred: SSH on GitBucket (port 29418), IPv6 dual-stack, NetBox import bundle.
diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md
index b5e98f8..3dfd883 100644
--- a/docs/v1-redeploy-changelog.md
+++ b/docs/v1-redeploy-changelog.md
@@ -1684,3 +1684,40 @@
 
 REMAINING: batch 2 (d011-02-vip-jumphost, d011-03-vip-tenant); batch 3 (d011-04-octavia-lb w/
 amphora failover + N+1 headroom HOLD-guard, d011-05-magnum-e2e wrapping tenant-acceptance).
+
+### 2026-07-03 (addendum 10) -- session-ledger continuity mechanism + skill hardening rules
+
+Compaction-continuity: long sessions get compacted repeatedly and scrollback-only work is lost.
+
+NEW docs/session-ledger.md -- durable in-flight record (active build, backlog, operator-gated,
+open decisions, numbering state incl. the D-071 parallel-stream contention, state facts).
+Standing practice: read at session start, update at every deliverable (like the changelog).
+
+NEW scripts/ledger-scan.sh (+ tests/ledger-scan 16/16) -- the DRIFT CHECK that keeps the
+narrative honest. Derives from repo ground truth: PROPOSED/OPEN decisions (by the LAST Status
+line per block, so an amendment closes it), OPEN security-ledger rows, and next-free D/DOCFIX/
+BUNDLEFIX (D from decision HEADERS; next-free-pointer prose excluded so a "next-free D-072"
+mention cannot inflate the count). Read-only, exit 0. Its FIRST real run caught two real bugs
+in itself (first-status vs last-status open detection; prose mentions inflating next-free) AND
+one repo drift (D-063 header still said PROPOSED/OPEN after closure) -- all three fixed here.
+
+D-063 header/first-status reconciled to RESOLVED/CLOSED (the closure had been appended as an
+amendment but the header still read PROPOSED/OPEN -- exactly the drift the scan exists to catch).
+
+SKILL HARDENING (repo .claude/skills/openstack-cloud-ops + repackaged .skill) -- generalizable
+lessons from this session promoted to standing discipline so they carry to all future work:
+  operating-discipline.md: parallel-work numbering coordination (declare consumed ids; re-grep
+    after a parallel push; scan derives next-free from headers); Session continuity (the ledger
+    practice + drift check); adds-before-removes readback gate for boundary mutations; attestation
+    gates for unautomatable safety items (never auto-pass; gate on a ledger row).
+  script-authoring.md: structured-output captures take stdout ONLY (never merge stderr into
+    -f json/-f value -- the DOCFIX-085 class); fixture-test throwaway probe one-liners like real
+    code (the ss column-drop / mapped-v6 cut / greedy-src-grep / journald-vs-/var/log family);
+    truthful mock worlds + test expectations must match the specified contract.
+  troubleshooting.md: prove event-driven flows by FUNCTIONAL OUTCOME, not packet/snapshot
+    forensics (a successful resize outranks a captured packet).
+  SKILL.md: session-start step (read ledger + run scan) + a routing-table row.
+  .skill package rebuilt from the updated references.
+
+Next-free (per scan, header-authoritative): D-071 (CONTENDED -- parallel stream), DOCFIX-086,
+BUNDLEFIX-010.
diff --git a/scripts/ledger-scan.sh b/scripts/ledger-scan.sh
new file mode 100644
index 0000000..506d380
--- /dev/null
+++ b/scripts/ledger-scan.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# scripts/ledger-scan.sh -- machine-derived "what is still OPEN" view of the repo.
+#
+# The session ledger (docs/session-ledger.md) is a human narrative; it can drift.
+# This script is the DRIFT CHECK: it greps the repo for the open-work markers that
+# can be reliably derived -- PROPOSED/OPEN decisions, OPEN security-ledger rows,
+# and the next-free D/DOCFIX/BUNDLEFIX numbers -- so the narrative ledger can be
+# reconciled against ground truth at session start and before every handoff.
+# Read-only; mutates nothing. Exit: 0 always (it reports; it does not judge).
+#
+# Reconcile rule: the narrative ledger must not claim CLOSED anything this scan
+# shows OPEN, and must not omit a decision/number this scan surfaces.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="${VR_REPO:-$(cd "$HERE/.." && pwd)}"
+DD="$REPO/docs/design-decisions.md"
+SL="$REPO/docs/security-ledger.md"
+
+echo "=== ledger-scan: open-work ground truth (repo: $REPO) ==="
+
+echo "-- PROPOSED / OPEN decisions --"
+if [ -r "$DD" ]; then
+  # a decision header line whose status line (within the next few lines) is PROPOSED/OPEN.
+  # A decision is OPEN iff the LAST Status line in its block is PROPOSED/OPEN.
+  # (A later RESOLVED/CLOSED/SUPERSEDED amendment closes it -- so we track the last
+  # status per block, not the first; this is the D-063-amendment drift the first
+  # real run surfaced.)
+  OPEN_DEC="$(awk '
+    /^## D-[0-9]+:/ { if (hdr!="" && laststat ~ /PROPOSED|OPEN/) print "  " hdr; sub(/^## /,"",$0); hdr=$0; laststat="" }
+    /\*\*Status:\*\*/ { laststat=$0 }
+    END { if (hdr!="" && laststat ~ /PROPOSED|OPEN/) print "  " hdr }
+  ' "$DD")"
+  if [ -n "$OPEN_DEC" ]; then printf '%s\n' "$OPEN_DEC"; else echo "  (none)"; fi
+else echo "  (design-decisions.md not found)"; fi
+
+echo "-- OPEN security-ledger rows --"
+if [ -r "$SL" ]; then
+  grep -E '^\|[[:space:]]*SEC-[0-9]' "$SL" | awk -F'|' 'toupper($(NF-1)) ~ /OPEN|PENDING/ {gsub(/^ *| *$/,"",$2); gsub(/^ *| *$/,"",$7); print "  " $2 " (" $7 ")"}' || echo "  (none)"
+  [ -z "$(grep -E '^\|[[:space:]]*SEC-[0-9]' "$SL" | awk -F'|' 'toupper($(NF-1)) ~ /OPEN|PENDING/')" ] && echo "  (none open)"
+else echo "  (security-ledger.md not found)"; fi
+
+echo "-- next-free numbers (highest assigned + 1) --"
+# Exclude "next-free" pointer lines from the count -- a "next-free D-072" pointer in
+# prose must NOT inflate the highest-assigned (the first real run counted exactly that).
+nextfree_mentions() { # <regex> <label> -- highest MENTION excluding next-free pointers
+  local pat="$1" label="$2" hi
+  hi="$(grep -rhE "$pat" "$REPO/docs" "$REPO/runbooks" 2>/dev/null \
+        | grep -viE 'next[- ]free' \
+        | grep -oE "$pat" | grep -oE '[0-9]+' | sort -n | tail -1)"
+  if [ -n "$hi" ]; then printf '  %s: highest=%s  next-free=%03d\n' "$label" "$hi" "$((10#$hi + 1))"
+  else printf '  %s: none found\n' "$label"; fi
+}
+# D is AUTHORITATIVE from decision headers in design-decisions.md, not prose mentions.
+if [ -r "$DD" ]; then
+  DHI="$(grep -oE '^## D-[0-9]+' "$DD" | grep -oE '[0-9]+' | sort -n | tail -1)"
+  if [ -n "$DHI" ]; then printf '  D: highest-header=%s  next-free=%03d\n' "$DHI" "$((10#$DHI + 1))"; else echo "  D: none"; fi
+else echo "  D: design-decisions.md not found"; fi
+nextfree_mentions 'DOCFIX-0[0-9]{2}' "DOCFIX"
+nextfree_mentions 'BUNDLEFIX-0[0-9]{2}' "BUNDLEFIX"
+
+echo "-- reconcile against docs/session-ledger.md --"
+if [ -r "$REPO/docs/session-ledger.md" ]; then
+  echo "  ledger present; compare the sections above against its narrative"
+else
+  echo "  NO docs/session-ledger.md -- create/update it (this session's continuity record)"
+fi
+exit 0
diff --git a/skills/openstack-cloud-ops/openstack-cloud-ops.skill b/skills/openstack-cloud-ops/openstack-cloud-ops.skill
index b2eb349..e42006b 100644
--- a/skills/openstack-cloud-ops/openstack-cloud-ops.skill
+++ b/skills/openstack-cloud-ops/openstack-cloud-ops.skill
Binary files differ
diff --git a/tests/ledger-scan/run-tests.sh b/tests/ledger-scan/run-tests.sh
new file mode 100644
index 0000000..ed9035e
--- /dev/null
+++ b/tests/ledger-scan/run-tests.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# tests/ledger-scan/run-tests.sh -- ledger-scan.sh against fixture docs.
+# Verifies: PROPOSED/OPEN decisions surfaced (ADOPTED not), OPEN security rows
+# surfaced (CLOSED not), next-free computed from highest, missing-ledger notice.
+set -u
+SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; SCRIPT="$SD/../../scripts/ledger-scan.sh"
+P=0; F=0; ok(){ echo "PASS: $1"; P=$((P+1)); }; no(){ echo "FAIL: $1"; F=$((F+1)); }
+W="$(mktemp -d)"; trap 'rm -rf "$W"' EXIT; mkdir -p "$W/docs" "$W/runbooks"
+
+cat > "$W/docs/design-decisions.md" <<'DD'
+## D-001: Something adopted
+**Status:** ADOPTED 2026-01-01.
+## D-050: PROPOSED / OPEN -- keystone policyd override
+**Status:** PROPOSED / OPEN (recorded 2026-06-17; no action taken).
+## D-063: tighten SG
+**Status:** RESOLVED / CLOSED (applied 2026-07-03).
+## D-068: Vault substrate hardening
+**Status:** PROPOSED / OPEN 2026-07-02.
+## D-070: snapshots
+**Status:** ADOPTED 2026-07-03.
+## D-063b: reopened then closed via amendment
+**Status:** PROPOSED / OPEN (recorded).
+Some text.
+**Status:** RESOLVED / CLOSED (amendment 2026-07-03).
+DD
+cat > "$W/docs/security-ledger.md" <<'SL'
+| id | date | item | src | owner | status |
+|---|---|---|---|---|---|
+| SEC-001 | 2026-06-26 | libvirt cred | x | operator | OPEN -- rotate |
+| SEC-002 | 2026-06-17 | token rule | x | operator | STANDING RULE |
+| SEC-003 | 2026-07-03 | unseal custody | D-069 | operator | OPEN -- assign |
+| SEC-004 | 2026-05-27 | repo public | x | operator | CLOSED -- flipped private |
+SL
+# next-free fixtures: mention up to DOCFIX-085, BUNDLEFIX-009 in a doc
+printf 'refs: DOCFIX-084 DOCFIX-085 BUNDLEFIX-008 BUNDLEFIX-009 D-070\n' > "$W/runbooks/refs.md"
+printf 'Next-free: D-071, DOCFIX-099, BUNDLEFIX-050\n' > "$W/docs/pointer.md"  # must NOT inflate
+
+OUT="$(VR_REPO="$W" bash "$SCRIPT" 2>&1)"; RC=$?
+chk(){ grep -q "$1" <<<"$OUT" && ok "$2" || no "$2 (missing: $1)"; }
+nochk(){ grep -q "$1" <<<"$OUT" && no "$2 (should be absent: $1)" || ok "$2"; }
+[ "$RC" = 0 ] && ok "exit 0" || no "exit 0 (got $RC)"
+chk 'D-050' "surfaces D-050 PROPOSED"
+chk 'D-068' "surfaces D-068 PROPOSED"
+nochk 'D-001' "omits D-001 ADOPTED"
+nochk 'D-063' "omits D-063 CLOSED"
+nochk 'D-070' "omits D-070 ADOPTED (from decisions section)"
+nochk 'D-063b' "omits amendment-CLOSED decision (last-status wins)"
+chk 'SEC-001' "surfaces SEC-001 OPEN"
+chk 'SEC-003' "surfaces SEC-003 OPEN"
+nochk 'SEC-004' "omits SEC-004 CLOSED"
+grep -q 'SEC-002' <<<"$OUT" && no "omits SEC-002 STANDING (not open)" || ok "omits SEC-002 STANDING"
+chk 'next-free=071' "D next-free 071 (header-authoritative)"
+chk 'next-free=086' "DOCFIX next-free 086 (next-free pointer 099 excluded)"
+chk 'next-free=010' "BUNDLEFIX next-free 010"
+# missing ledger notice
+OUT2="$(VR_REPO="$W" bash "$SCRIPT" 2>&1)"; grep -q 'NO docs/session-ledger.md' <<<"$OUT2" && ok "flags missing session-ledger" || no "flags missing session-ledger"
+# with a ledger present, notice changes
+echo "ledger" > "$W/docs/session-ledger.md"
+OUT3="$(VR_REPO="$W" bash "$SCRIPT" 2>&1)"; grep -q 'ledger present' <<<"$OUT3" && ok "detects present session-ledger" || no "detects present session-ledger"
+
+echo; [ "$F" = 0 ] && { echo "ALL PASS ($P checks)"; exit 0; } || { echo "FAILURES: $F"; exit 1; }