diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 097ef55..06a4a74 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -297,7 +297,20 @@
    to the two named custodians.
 2. **Operator manual item:** foil1 Horizon checks (contract 5.1/5.3) --
    domain-admin login + GUI probe-user create/delete; non-blocking. Same
-   checks now also apply to devteam.
+   checks now also apply to devteam. IN PROGRESS 2026-07-07: operator
+   browsed the dashboard VIP root and got Apache "Index of /" -- see the
+   two entries below (URL corrected to /horizon in the devteam package;
+   root-autoindex finding OPEN, options presented). Login check at
+   /horizon pending operator confirm.
+2b. **FINDING (2026-07-07, UNRULED -- present options, do not implement):
+   Apache autoindex at the public dashboard VIP root.** Browsing
+   https://10.12.4.58/ (provider-public, tenant-facing) serves "Index of /"
+   instead of Horizon (webroot /horizon, measured). Tenant-visible surface
+   on a commercial cloud => security-relevant posture item. Options for
+   operator ruling: (a) redirect / -> /horizon (upstream-common), (b)
+   disable autoindex on the vhost root, (c) both [recommended]. Charm-vs-
+   local-override mechanism TBD at ruling time; D-072/D-044 adjacent; would
+   consume the next-free D number as a PROPOSED entry when drafted.
 3. **capi-test-1 CREATE_FAILED record delete: RULED YES (2026-07-07),
    execution handed to operator** -- the Claude Code permission classifier
    (correctly) refuses agent-side deletes of resources it did not create;
diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md
index 0316039..a52916b 100644
--- a/docs/v1-redeploy-changelog.md
+++ b/docs/v1-redeploy-changelog.md
@@ -2754,3 +2754,28 @@
 REVERT: rm -rf ~/devteam-package ~/devteam-intake-record.md (quota set was value-identical to defaults; no cloud-side revert needed); git checkout HEAD~ -- docs/session-ledger.md docs/v1-redeploy-changelog.md
 
 Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-118, BUNDLEFIX-012.
+
+### 2026-07-07 (addendum 36, jumphost stream) -- devteam package URL correction (/horizon) + dashboard root-autoindex FINDING (no numbers consumed)
+
+Operator browser check of the delivered dashboard URL hit Apache "Index of /"
+at https://10.12.4.58/ -- two outcomes:
+
+- **As-executed correction (package fixed in place):** the client-facing
+  Horizon URL requires the webroot path: https://10.12.4.58/horizon
+  (webroot measured via `juju config openstack-dashboard webroot`). All 4
+  delivered occurrences in ~/devteam-package corrected by sed + re-verified
+  (no double-path, tokens still zero). NOTE for future instantiations: the
+  D-072 as-executed record's "https 200" at the VIP root was the AUTOINDEX
+  page, not Horizon -- a 200-at-root is a weaker signal than believed; the
+  {{DASHBOARD_URL}} fill value is <VIP>/horizon (or webroot at the time).
+  DOCFIX candidate: record the full URL-with-webroot in the instantiation
+  guidance (clientdocs/README.md) at the next sweep.
+- **FINDING (UNRULED, logged not actioned):** the tenant-facing VIP root
+  serves an Apache directory listing. Options presented to operator:
+  (a) redirect / -> /horizon; (b) disable autoindex at the root; (c) both
+  (recommended). Any fix is a change to a built surface (D-072/D-044
+  adjacent) -- gated on an operator ruling; PROPOSED D entry to be drafted
+  from the next-free number at that time.
+REVERT (package correction only): sed 's|/horizon||' on the 4 corrected lines in ~/devteam-package; git checkout HEAD~ -- docs/session-ledger.md docs/v1-redeploy-changelog.md
+
+Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-118, BUNDLEFIX-012.