diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 5dc0981..1388a88 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -116,9 +116,15 @@
   as expected); post-controller cloud-assert PASS.
 - **DONE Section 3:** all 91 openstack-model agents + controller machine at 3.6.25,
   states clean (63 idle / 28 started), nothing stuck.
-- **NEXT:** Section 4 charm refreshes, 17 apps in groups (G0 keystone -> G1 control
-  plane APIs -> G2 octavia -> G3 dashboards -> G4 nova-compute), per-app settle gates,
-  cloud-assert at group boundaries; then post-verify (S5), re-baseline + close-out (S6).
+- **DONE Section 4 G0:** keystone 778->817; token probe OK; cloud-assert PASS.
+- **DONE Section 4 G1 (11 apps, standing group approval, serial+gated):**
+  placement 125->154, nova-cloud-controller 795->823, neutron-api 650->710,
+  neutron-api-plugin-ovn 178->215, glance 642->681, glance-simplestreams-sync
+  124->152, octavia-diskimage-retrofit 196->232, cinder 733->820, cinder-ceph
+  533->568, barbican 209->265, barbican-vault 75->99. All probes OK;
+  boundary cloud-assert PASS.
+- **NEXT:** G2 octavia 441->542 (gated), G3 dashboards, G4 nova-compute; then
+  post-verify (S5), re-baseline + close-out (S6).
 - **Window findings logged for close-out (do not action mid-window):**
   1. magnum can-upgrade-to anomaly REPRODUCED (points at magnum-dashboard-122;
      evidence ~/openstack-baseline/magnum-can-upgrade-anomaly-20260705.json) AND