diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index e5c0736..d2537c1 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -479,10 +479,44 @@
   --record-guide-skill-coupling`. Harness +5 (28/28), gauntlet 39/39. So the next
   guide edit CANNOT land without a conscious skill review. Skill-lag closed at the
   source.
-- **S-CLASS BATCH STATUS:** DONE = S7, S4, S8a (DOCFIX-132/133/134). HELD/DEFERRED =
-  S8b, S8c, and S1/S2/S3/S5 (lib-validate adoption -- until DOCFIX-126/127
-  live-verify). S6 was ruled no-action earlier. Next operator decision: S8b/S8c
-  scope, and whether to schedule the lib-validate adoption.
+- **S-CLASS BATCH STATUS (operator ruled 2026-07-08):** DONE = S7, S4, S8a
+  (DOCFIX-132/133/134). **S8b APPROVED -- DO IT (next actionable):** centralize
+  KEYSTONE_VIP into lib-net.sh (verified source-safe: constants + read-only helpers,
+  no set/side-effects); wire the 6 literal sites (phase-03-admin-openrc, phase-06-
+  kubeconfig-gate, phase-06-k8s-bootstrap, tenant-onboard, tenant-offboard,
+  tenant-acceptance). **S8c RULED WON'T-DO** (operator: marginal value for as-built
+  constants vs bash<->python emit/parse machinery). S1/S2/S3/S5 (lib-validate)
+  STILL HELD -- operator keeps DOCFIX-126/127 live-verify open for an upcoming
+  opportunity (devteam actively using resources; not now). S6 no-action.
+- **quota-vs-capacity (addendum-40 d): CLOSED -- operator ACCEPTS as-documented**
+  (DOCFIX-130 sec 2.3/5.5 + skill cover NoValidHost/capacity thoroughly; no quota trim).
+- **StorageClass follow-up (DOCFIX-130 sec 5.5): RESOLVED 2026-07-08.** Operator
+  authorized full read of devteam's cluster (fully internal domain); scoped via
+  ~/devteam-cluster-openrc (snap needs $HOME for --dir; kubeconfig fetched under
+  $HOME, used, DELETED). devteam TestCluster HAS a default StorageClass:
+  `default (default)` provisioner cinder.csi.openstack.org, Retain,
+  WaitForFirstConsumer, expansion=true. So the delivered template (volume_driver
+  unset) DOES yield PV support via the cinder-CSI magnum default -- persistent
+  storage works out of the box; no template change needed. sec 5.5 doc is correct
+  and self-verifying; OPTIONAL enhancement: state the expected `default` cinder
+  class (would trigger L8 skill sweep). Cleanup: kubeconfig removed, no residue.
+- **D-076 assessment (operator #6: "tested working w/ devteam domain-admin? check
+  for additional work"):** NOT fully working -- optimistic recollection. Revision 1
+  FAILED (full-page 403s + forced logout), reverted. Revision 2 PARTIALLY passed:
+  identity panels render for the manager persona + session intact, BUT the
+  create-user GUI flow submits a NON-managed role (load-balancer_admin) whose grant
+  403s, stranding a role-less user (flow not atomic). ADDITIONAL WORK before it can
+  advance: (1) root-cause why the Role dropdown submitted load-balancer_admin
+  (form default-role preselection vs mis-select); (2) add a per-view SEMANTIC harness
+  test asserting create-user grants exactly `member` (invisible to the existing 50
+  policy pass/fail assertions); (3) clean up the orphaned test user
+  9a62f88e331f41adb5c9e41225ec8698 (name `test1`, CONFIRMED still present in devteam,
+  ZERO roles -- delete or grant member); (4) operator RULING: adopt rev2 (a) vs
+  close GUI/CLI-only (b) + accept/reject the charmhelpers blacklist-hole reliance;
+  (5) another operator-present gated window to re-test after rework. NOTE: live
+  override state UNVERIFIED -- juju macaroon expired (needs `juju login`); confirm
+  use-policyd-override is reverted to baseline. Draft in worktree agent-a73ec798
+  (uncommitted). Clients unaffected: CLI identity path is the documented behavior.
 
 ## REMAINING OPEN WORK (single list for session resume; 2026-07-07, updated post-devteam-window)