diff --git a/documentation/IDF55_REMEDIATION_IMPACTS.md b/documentation/IDF55_REMEDIATION_IMPACTS.md
index 2d77d1b1..0dc7c4bb 100644
--- a/documentation/IDF55_REMEDIATION_IMPACTS.md
+++ b/documentation/IDF55_REMEDIATION_IMPACTS.md
@@ -230,8 +230,39 @@ It focuses on remediation outcomes (what broke, what was fixed, and where).
   - binary/footprint constraints (IRAM pressure hint and image-size pressure hint)
   - `recovery.bin` partition overflow warning (`recovery` partition too small for current binary)
 - Latest investigated logs:
-  - `build/log/idf_py_stderr_output_52883`
-  - `build/log/idf_py_stdout_output_52883`
+  - `build/log/idf_py_stderr_output_68994`
+  - `build/log/idf_py_stdout_output_68994`
+
+## Footprint Net-Gain Ledger (Recovery App)
+
+Partition policy note: app partition sizes are fixed; this ledger tracks binary reduction only.
+
+Baseline reference (handover):
+- `recovery.bin`: `0x149a60`
+- `recovery` partition: `0x130000`
+- overflow: `0x19a60`
+
+Measured changes applied:
+1. Disable mbedTLS certificate bundle in `sdkconfig`
+   - `# CONFIG_MBEDTLS_CERTIFICATE_BUNDLE is not set`
+   - observed `recovery.bin`: `0x149ae0` (intermediate run)
+2. Disable optional Wi-Fi auth feature families in `sdkconfig`
+   - `# CONFIG_ESP_WIFI_ENABLE_WPA3_SAE is not set`
+   - `# CONFIG_ESP_WIFI_ENABLE_WPA3_OWE_STA is not set`
+   - `# CONFIG_ESP_WIFI_ENTERPRISE_SUPPORT is not set`
+   - observed `recovery.bin`: `0x142e20`
+
+Net result vs baseline:
+- `recovery.bin` delta: `-0x6c40` bytes (`-27,712`)
+- overflow delta: `-0x6c40` bytes (`-27,712`)
+- current overflow: `0x12e20`
+
+Latest size snapshot (`build/recovery.map`):
+- Total image size: `1,322,415` bytes
+- Flash code: `961,016`
+- Flash rodata (+appdesc): `237,152`
+- IRAM: `98,647` (75.26%)
+- DRAM: `33,748` (27.09%)
 
 ## Notes for Contributors
 
diff --git a/sdkconfig b/sdkconfig
index f086a8d8..de18651c 100644
--- a/sdkconfig
+++ b/sdkconfig
@@ -1561,11 +1561,8 @@ CONFIG_ESP_WIFI_MGMT_SBUF_NUM=32
 # CONFIG_ESP_WIFI_IRAM_OPT is not set
 # CONFIG_ESP_WIFI_EXTRA_IRAM_OPT is not set
 # CONFIG_ESP_WIFI_RX_IRAM_OPT is not set
-CONFIG_ESP_WIFI_ENABLE_WPA3_SAE=y
-CONFIG_ESP_WIFI_ENABLE_SAE_PK=y
-CONFIG_ESP_WIFI_ENABLE_SAE_H2E=y
-CONFIG_ESP_WIFI_SOFTAP_SAE_SUPPORT=y
-CONFIG_ESP_WIFI_ENABLE_WPA3_OWE_STA=y
+# CONFIG_ESP_WIFI_ENABLE_WPA3_SAE is not set
+# CONFIG_ESP_WIFI_ENABLE_WPA3_OWE_STA is not set
 # CONFIG_ESP_WIFI_SLP_IRAM_OPT is not set
 CONFIG_ESP_WIFI_SLP_DEFAULT_MIN_ACTIVE_TIME=50
 # CONFIG_ESP_WIFI_BSS_MAX_IDLE_SUPPORT is not set
@@ -1578,7 +1575,6 @@ CONFIG_ESP_WIFI_SOFTAP_SUPPORT=y
 CONFIG_ESP_WIFI_ESPNOW_MAX_ENCRYPT_NUM=7
 # CONFIG_ESP_WIFI_NAN_ENABLE is not set
 CONFIG_ESP_WIFI_MBEDTLS_CRYPTO=y
-CONFIG_ESP_WIFI_MBEDTLS_TLS_CLIENT=y
 # CONFIG_ESP_WIFI_WAPI_PSK is not set
 # CONFIG_ESP_WIFI_11KV_SUPPORT is not set
 # CONFIG_ESP_WIFI_MBO_SUPPORT is not set
@@ -1595,8 +1591,7 @@ CONFIG_ESP_WIFI_MBEDTLS_TLS_CLIENT=y
 # end of WPS Configuration Options
 
 # CONFIG_ESP_WIFI_DEBUG_PRINT is not set
-CONFIG_ESP_WIFI_ENTERPRISE_SUPPORT=y
-# CONFIG_ESP_WIFI_ENT_FREE_DYNAMIC_BUFFER is not set
+# CONFIG_ESP_WIFI_ENTERPRISE_SUPPORT is not set
 # end of Wi-Fi
 
 #
@@ -2033,13 +2028,7 @@ CONFIG_MBEDTLS_PKCS7_C=y
 #
 # Certificate Bundle
 #
-CONFIG_MBEDTLS_CERTIFICATE_BUNDLE=y
-CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL=y
-# CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN is not set
-# CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_NONE is not set
-# CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE is not set
-# CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEPRECATED_LIST is not set
-CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_MAX_CERTS=200
+# CONFIG_MBEDTLS_CERTIFICATE_BUNDLE is not set
 # end of Certificate Bundle
 
 # CONFIG_MBEDTLS_ECP_RESTARTABLE is not set
@@ -2634,10 +2623,9 @@ CONFIG_ESP32_WIFI_SOFTAP_BEACON_MAX_LEN=752
 CONFIG_ESP32_WIFI_MGMT_SBUF_NUM=32
 # CONFIG_ESP32_WIFI_IRAM_OPT is not set
 # CONFIG_ESP32_WIFI_RX_IRAM_OPT is not set
-CONFIG_ESP32_WIFI_ENABLE_WPA3_SAE=y
-CONFIG_ESP32_WIFI_ENABLE_WPA3_OWE_STA=y
+# CONFIG_ESP32_WIFI_ENABLE_WPA3_SAE is not set
+# CONFIG_ESP32_WIFI_ENABLE_WPA3_OWE_STA is not set
 CONFIG_WPA_MBEDTLS_CRYPTO=y
-CONFIG_WPA_MBEDTLS_TLS_CLIENT=y
 # CONFIG_WPA_WAPI_PSK is not set
 # CONFIG_WPA_11KV_SUPPORT is not set
 # CONFIG_WPA_MBO_SUPPORT is not set