diff --git a/docs/ledger/rows/NAV-QUEST-VISIBILITY.json b/docs/ledger/rows/NAV-QUEST-VISIBILITY.json
index 4e40ae91b..94e5cbd88 100644
--- a/docs/ledger/rows/NAV-QUEST-VISIBILITY.json
+++ b/docs/ledger/rows/NAV-QUEST-VISIBILITY.json
@@ -4,16 +4,17 @@
   "lane": "live",
   "priority": "P1",
   "size": "S",
-  "status": "open",
+  "status": "done",
   "source": {
     "file": "scripts/ops/repair-root-quest-page-visibility.sql",
     "ref": "Read-only Frequency Community root page_settings metadata and current admission source, 2026-11-04."
   },
-  "detail": "Actual authenticated /crew redirected to /feed. Production metadata confirms exactly one root Space and its /crew page_settings row is published, visibility_role=crew, updated_at=2026-06-22 15:21:37.887+00. The community crew rung is retired and separate from paid Crew entitlement. Current Quest matrix and docs/ROLES.md grant every signed-in member full Quest access, while the shared layout still honors this stale operator visibility gate. PROPOSAL ONLY: exact operator transaction resolves one root, locks only /crew, refuses unless status/visibility/updated_at still match this reviewed snapshot, sets native visibility_role NULL (any authenticated member) and updated_at, verifies one row and unchanged remaining columns. No generic page gate, auth, RLS, role or unrelated route changes. The exact SQL passed eleven disposable PGlite 0.4.0 / PostgreSQL 17.5-compatible fixture cases, including unchanged unrelated rows and rollback/refusal cases; this is not hosted Supabase equivalence. Fresh compare-and-set preflight, exact main-committed SQL hash review/authorization and actual production postconditions are still required before any production execution. Never execute twice; an already-null or changed row refuses. Acceptance: authenticated member /crew reaches My Quest, guest remains signed out, other host-only/draft routes and other Space settings stay enforced.",
+  "detail": "PRE-REPAIR HISTORY (2026-11-04): Actual authenticated /crew redirected to /feed. Production metadata confirms exactly one root Space and its /crew page_settings row is published, visibility_role=crew, updated_at=2026-06-22 15:21:37.887+00. The community crew rung is retired and separate from paid Crew entitlement. Current Quest matrix and docs/ROLES.md grant every signed-in member full Quest access, while the shared layout still honors this stale operator visibility gate. PROPOSAL ONLY: exact operator transaction resolves one root, locks only /crew, refuses unless status/visibility/updated_at still match this reviewed snapshot, sets native visibility_role NULL (any authenticated member) and updated_at, verifies one row and unchanged remaining columns. No generic page gate, auth, RLS, role or unrelated route changes. The exact SQL passed eleven disposable PGlite 0.4.0 / PostgreSQL 17.5-compatible fixture cases, including unchanged unrelated rows and rollback/refusal cases; this is not hosted Supabase equivalence. Fresh compare-and-set preflight, exact main-committed SQL hash review/authorization and actual production postconditions are still required before any production execution. Never execute twice; an already-null or changed row refuses. Acceptance: authenticated member /crew reaches My Quest, guest remains signed out, other host-only/draft routes and other Space settings stay enforced.\n\nCLOSED 2026-11-04, core metadata repair only. The preceding proposal/pre-repair facts are historical. #4667 is main d8787e6d5e98c5855cef36adf8b5c0dbe6922a68 and exact production deployment dpl_8Z7oKcim73NCtLJNGY6TZjHbn2LS is READY for frequencylocal.com. Daniel specifically approved the exact committed operator SQL SHA-256 258956ee13d656f2b67959fc9a4c3c15690dc3e6a1740d0ced9d2127e1e43cec; it was executed ONCE and must never be rerun. Independent before/after metadata confirms exactly one root and target, still published, visibility_role now native NULL, with other target-column hash and unrelated control-row hash preserved. Actual existing authenticated production /crew now renders My Quest at 1280px with scrollWidth 1280px; no challenge, reward or session interaction was performed. An ordinary no-cookie HTTP GET returns 307 to /sign-in?next=%2Fcrew, confirming server-side anonymous admission remains closed. Six actual-current-main access/predicate controls preserve ordinary-member access, stale-crew refusal reproduction, native NULL admission, draft refusal and host-only semantics. This closes the scoped stale-setting repair, not a role-wide or all-device audit: actual 390 px mobile render, separate signed-out browser journey and wide role matrix were not exercised. No auth/RLS/grants/source gate changes or further operator action are part of this closure.",
   "verify": {
     "kind": "manual",
     "checked": "2026-11-04",
-    "evidence": "Read-only production gate/schema metadata confirms PK(space_id,route), nullable text visibility_role, published root /crew with crew restriction and exact updated_at. Unchanged committed operator SQL SHA-256 258956ee13d656f2b67959fc9a4c3c15690dc3e6a1740d0ced9d2127e1e43cec passes eleven isolated PGlite/PostgreSQL 17.5-compatible scenarios: valid one-row repair with other tenant/host/draft rows unchanged; missing/stale/wrong/already-cleared/ambiguous targets and unexpected target-column trigger changes refuse/roll back. Nine actual-source gate/nav controls keep other draft/host gates and Admin/preview framing intact. This is fixture/source proof, not hosted Supabase/browser/session evidence. Production operator SQL NOT EXECUTED and no setting changed. Keep open until fresh authorized repair/postconditions and member/guest production proof."
+    "evidence": "DONE, scoped production metadata and admission proof. #4667 main d8787e6d5e98c5855cef36adf8b5c0dbe6922a68; deployment dpl_8Z7oKcim73NCtLJNGY6TZjHbn2LS READY on frequencylocal.com. Exact unchanged operator SQL SHA-256 258956ee13d656f2b67959fc9a4c3c15690dc3e6a1740d0ced9d2127e1e43cec executed exactly once under Daniel's explicit approval; never rerun. Production receipt checked 22:14:33Z records root_count=1, target_count=1, published status, visibility_role crew -> NULL, equal before/after remaining-target-columns hash 6b4cac44d70791a1184ae124061cea5d and control-rows hash 18285c9ed41c3876fbf76b1c9556960e. Actual existing signed-in /crew browser receipt 22:14:06Z: heading My Quest., Leaderboard/Vault present, viewportWidth=scrollWidth=1280; no interactions/writes. No-cookie anonymous HTTP 22:14:33Z: 307 -> /sign-in?next=%2Fcrew; this is server HTTP proof, not a separate signed-out browser. Six source predicate/access controls on exact d878 main pass for member/NULL, stale crew, draft and host semantics; they are not a wide live role matrix. Actual 390 px mobile, separate signed-out browser and broader role audit remain unexercised. Evidence receipts: Quest-Production-Once-Only-Receipt-2026-11-04.json; Quest-Production-d8787e-Browser-2026-11-04.json/png; Quest-Production-d8787e-Anonymous-HTTP-2026-11-04.json."
   },
-  "wave": "W7"
+  "wave": "W7",
+  "closed": "2026-11-04"
 }