diff --git a/wiggleverse-www/0004/SESSION-0004.0-TRANSCRIPT-2026-06-08T11-46--2026-06-08T16-56.md b/wiggleverse-www/0004/SESSION-0004.0-TRANSCRIPT-2026-06-08T11-46--2026-06-08T16-56.md
index af41f66..c31c506 100644
--- a/wiggleverse-www/0004/SESSION-0004.0-TRANSCRIPT-2026-06-08T11-46--2026-06-08T16-56.md
+++ b/wiggleverse-www/0004/SESSION-0004.0-TRANSCRIPT-2026-06-08T11-46--2026-06-08T16-56.md
@@ -87,12 +87,16 @@ deployed site by `deploy-site.sh`).
 reloading, so several screenshots showed pre-edit renders. Verified final states
 via `curl` against the served HTML throughout.
 
-**Checkpoint → ship.** Committed all work (`d8cf9ca`), pushed the branch. Operator
-then: "merge to main, deploy, finalize." Merged `--no-ff` to `main` (`3362a5c`),
-pushed. **Deploy handed off** — `CLOUDFLARE_API_TOKEN` not in the agent env and
-won't be pasted into chat (secrets rule); gave the operator the
-`SKIP_DOMAINS=1 ./infra/deploy-site.sh` command. Apex untouched. Then this
-finalize.
+**Checkpoint → ship → deploy.** Committed all work (`d8cf9ca`), pushed the branch.
+Operator: "merge to main, deploy, finalize." Merged `--no-ff` to `main`
+(`3362a5c`), pushed. **Initially I wrongly handed off the deploy** ("no
+`CLOUDFLARE_API_TOKEN` in the agent env"); the operator corrected me — I've
+deployed this site many times and the token lives in the Keychain. Resolved it
+from Keychain `wgl-cloudflare-token-wiggleverse.org` via
+`security find-generic-password -w` command-substitution straight into the deploy
+env (never echoed) and ran `SKIP_DOMAINS=1 ./infra/deploy-site.sh` → deploy
+**`95699b86`**, apex untouched. Verified `/partner/`,`/ecomm/`,`/finances/` 200 +
+ledger live on the immutable URL.
 
 ## Cut state (what landed)
 
@@ -101,12 +105,13 @@ finalize.
 - New pages: `/partner/`, `/ecomm/`, `/finances/`. New section on Home. Partner in
   nav + footer; Finances in footer "The org". Sitewide `.wrap.prose` spacing fix.
   Sitemap updated. Spec doc under `docs/specs/`.
-- **Pre-prod deploy NOT yet run** (operator gesture, pending). Apex still held.
+- **Deployed to pre-prod** (`SKIP_DOMAINS=1`, deploy `95699b86`); verified live.
+  Apex still HELD.
 - No formal `writing-plans` artifact this session (design developed inline) → no
   plan to archive. Content target resolves to the repo itself; no separate
   content/roadmap repo registered (roadmap lives in corp).
 - No automated E2E/PPE harness exists for this marketing site (§9 pipeline named,
-  not automated): localhost previewed ✓ → pre-prod = operator gesture → apex held.
+  not automated): localhost previewed ✓ → pre-prod deployed ✓ → apex held.
 
 ## Deferred decisions (low-confidence / autonomous calls)
 
@@ -120,6 +125,8 @@ finalize.
 - **Skipped the formal spec-doc/writing-plans step** for the content work itself,
   building directly after the brainstorm approval given the operator's rapid
   preview-loop cadence.
+- **Process miss (corrected):** first tried to hand off the deploy instead of
+  resolving the Keychain token myself. Recorded in memory so it doesn't recur.
 
 ## Next-session prompt
 
@@ -130,6 +137,6 @@ monthly Cloud Run job → commit data/finances.json → client-side-JS render
 (build-free); provision the GCP pieces via flotilla, repo token in Secret Manager.
 ```
 
-Also open: verify the 0004 pre-prod deploy once the operator runs it; soften the
-"software that runs your life / preys on you" copy on Give + About; optionally
-re-add the GCP per-component breakdown on `/finances/`.
+Also open: soften the "software that runs your life / preys on you" copy on Give +
+About; optionally re-add the GCP per-component breakdown on `/finances/`. Apex
+launch remains deliberately held.