diff --git a/docs/handoff-20260705-open-items.md b/docs/handoff-20260705-open-items.md
index 6ebe838..fa39be8 100644
--- a/docs/handoff-20260705-open-items.md
+++ b/docs/handoff-20260705-open-items.md
@@ -76,6 +76,22 @@
   per-phase files; preserve the 10-doc structure in git history via the consolidation commit.
 - Set repo visibility PRIVATE (SEC-004).
 - Hold the pre-DC-DC controller HA/backup planning session -> then rule D-071.
+- **Onboarding completion package (operator-ruled 2026-07-06; complete BEFORE closing this
+  deployment test env).** A written, tested, and validated end-to-end onboarding workflow:
+  scripts + internal docs + drafted client-facing docs (drafts/living, no final polish needed).
+  Items (H-numbers per docs/tenant-onboarding-contract.md section 6):
+  - H1 `tenant-assert.sh` post-onboard verifier, with harness (also offboard preflight +
+    periodic drift sweep).
+  - H2 stage-3 app-cred idempotency re-run guard in tenant-onboard.sh.
+  - H3 canary access-proof stage (boot canary + FIP + SSH via tenant keypair + teardown) --
+    the ruled meaning of "confirm tenant SSH access into their domain" (A1.4 confirmed).
+  - H4 `keystone-policy-drift.sh` (script backlog item 6) wired as a periodic check.
+  - H5 no-ad-hoc rule embedded in the onboarding runbook.
+  - Horizon manager-role GUI identity probe (contract section 5.3) validated live.
+  - Client-facing draft package (intake form, welcome/engagement doc, self-service guide)
+    -- repo location per the structure ruling (pending).
+  - Full workflow validated on a live onboarding end-to-end (the d011-05 foil tenant is the
+    natural first candidate).
 
 ## 7. Deferred, with explicit revisit triggers
 
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index bf0d466..ee88997 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -202,6 +202,11 @@
   proposals logged, none implemented). A1.4 interpretation pending operator
   confirm: "SSH access into their domain" read as canary access-proof (H3).
   Verify-live additions: Horizon manager-role GUI identity probe (contract 5.3).
+- RULED (2026-07-06 cont.): A1.3 H1-H5 ADOPTED as pre-v1-close tasks; A1.4 canary
+  interpretation CONFIRMED + adopted as pre-deployment task. Full onboarding
+  completion package (scripts + internal docs + client-facing drafts + live
+  end-to-end validation) added to handoff section 6 v1-close checklist.
+  Client-docs repo structure recommendation put to operator (pending).
 
 <!-- END: jumphost -->