diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 505b84b..af38c5e 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -411,6 +411,22 @@
   isolation). If none, persistent volumes are unavailable out of the box --
   candidate template improvement (would need a D-NNN). 5.5 is written self-verifying
   so the doc is correct either way.
+- **CLEANUP QUEUE RECONCILED against live (2026-07-08 read-only audit) -- LIVE IS
+  AHEAD OF LEDGER, several "open" items already resolved:**
+  - foil1 offboard (was RECOMMENDED, addendum-40 c): DONE -- no foil project/user,
+    no orphan trustee. (Closes the dormant-shell item; also means the gated
+    DOCFIX-126/127 offboard live-verify was NOT exercised by us -- still unverified
+    end-to-end, next real offboard confirms.)
+  - capi-test-1 CREATE_FAILED delete (REMAINING-OPEN item 3, was operator-executes):
+    DONE -- no cluster record, trustee reaped.
+  - beta-cluster teardown + lbtest LB (addendum-40 a/b, cross-stream/main-chat):
+    DONE -- no beta cluster, no stray LB. (Main-chat to log its side.)
+  - Audit state: only devteam TestCluster (CREATE_COMPLETE) + its kubeapi LB +
+    its protected trustee remain; orphan sweep ORPHAN=0 PROTECTED=2 UNPROVEN=0;
+    zero unattached floating IPs.
+  - STILL OPEN from the addendum-40 audit: only (d) quota-vs-capacity expectation
+    -- trim testcloud quotas or document the capacity ceiling in clientdocs
+    (unruled, operator). Everything else in that audit is closed.
 
 ## REMAINING OPEN WORK (single list for session resume; 2026-07-07, updated post-devteam-window)