[boburning]

Summary

• records merged NET-10 HTTP/Tweaks cleanup PR security(network): retire stale HTTP Tweaks exposure (NET-10) #627 in the authoritative v3 ledger
• advances the NET-10 audit SHA while preserving its in_progress state
• records the removed UI/default-credential exposure, preserved older-card cleanup, ARM identity, deterministic test diagnosis, faster CI scoping, merged SHA, and device limitations

This documentation-only ledger update is based on current main 4e0267c and has no stacked dependency.

Validation

• v3 ledger JSON parsed successfully; 71 package entries and 11 NET-10 evidence records
• NET-10 status, ordered PR list [621, 624, 627], and audited-main SHA assertions passed
• focused ledger-coupled Shell suites: 33/33 passed
• manifest, provenance, transfer-policy, dependency-inventory, and diff checks passed

Device evidence and limitations

No device mutation was performed. NET-10 remains in progress because the coherent signed Full installation/rollback checkpoint is still pending; the ledger does not claim older installed listener remnants are remediated and preserves the existing DISP-04 Shell overlay.