diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index b769126..45935f4 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -133,8 +133,11 @@
 The TWO oldest remaining live summaries -- 2026-07-25 handoff-pack execution + recon +
 Chat D-136 coupling, and 2026-07-25 MAAS admin-account recovery (SEC-020) -- moved VERBATIM
 to `docs/archive/session-ledger-rotated-20260727.md`. The live ledger was 321 lines against
-the 300-line cap; one pass left it at 3
-  work appends a POST-CLOSE ADDENDUM. Details: docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md.
+the 300-line cap; one pass left it under. (This paragraph was left MANGLED by an earlier
+edit -- a sentence broke off mid-number and ran into a stray fragment of the
+2026-07-25 MAAS-admin-recovery summary. Found by a 2026-07-29 sweep and repaired here;
+that summary's full body is at
+docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md.)
 
 ## ROTATED 2026-07-27 (fourth pass, GA-R4 rule 3 / F1 -- cap restored at this close)
 
diff --git a/render/values/vr1-dc0-vips.yaml b/render/values/vr1-dc0-vips.yaml
index 56cf3cf..c1797db 100644
--- a/render/values/vr1-dc0-vips.yaml
+++ b/render/values/vr1-dc0-vips.yaml
@@ -9,6 +9,7 @@
   provider-public: 10.12.4
   metal-admin: 10.12.8
   metal-internal: 10.12.12
+source_v4: scripts/lib-net.sh lib_net_select_dc vr1-dc0
 apps:
 - name: keystone
   octet: 50
diff --git a/scripts/render-dc-overlays.py b/scripts/render-dc-overlays.py
index 3f415f0..f186c73 100755
--- a/scripts/render-dc-overlays.py
+++ b/scripts/render-dc-overlays.py
@@ -140,7 +140,11 @@
         v4[leg] = str(net.network_address).rsplit(".", 1)[0]   # e.g. 10.12.64
 
     vals = {"dc": a.dc, "output": a.output or "overlays/%s-vips.yaml" % a.dc,
-            "family": "v4", "legs": list(LEGS), "prefixes_v4": v4}
+            "family": "v4", "legs": list(LEGS), "prefixes_v4": v4,
+            # Provenance, recorded on BOTH families. The v4 prefixes come from
+            # lib-net.sh and NEVER from the apex, so a values file that carried
+            # only `apex_record` would misattribute half its own inputs.
+            "source_v4": "scripts/lib-net.sh lib_net_select_dc %s" % a.dc}
 
     if a.dual_family:
         v6map, rec = apex_v6(a.dc)