diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 56c787a..379ea43 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -110,9 +110,44 @@
   SHIPPED (site-keyed check/install; harness 15/15) + INSTALLED + verified
   on the DC1 rack 2026-07-24 (check PASS 8/8 -- apt-cacher-ng
   3.7.4-1ubuntu5.24.04.1 active on .4:3142; proxy serves archive + UCA
-  200). NEXT: DC0 full-mirror completes (last-sync.status OK) ->
-  reachability gate -> stage close-out; DC1 build consumes the proxy
-  (juju apt-http-proxy=http://10.12.68.4:3142).
+  200). DC1 build consumes the proxy (juju apt-http-proxy=http://10.12.68.4:3142).
+  **DC1 STAGE-5 (proxy-method deploy) STARTED 2026-07-24, then BLOCKED on a
+  bundle-rework gap (committee-reviewed):**
+  - DONE (committed, valid regardless of the blocker): per-DC MAAS service creds
+    (SEC-018 dc0 / SEC-019 dc1, staged vcloud, juju-store copy on voffice1);
+    Juju 3.6.25 on voffice1 (headend, D-128; removed from vcloud); `juju add-cloud
+    vr1-maas` (region 10.10.0.20:5240) + `add-credential` both DCs; VIP overlay
+    `overlays/vr1-dc1-vips.yaml` (11 apps -> dc1 bands); phase-4 Step 2.0
+    (MAAS-cred deployment task) added to the runbook.
+  - **DNS = GREEN for bootstrap (committee Q2, live-probed 2026-07-24):** the
+    D-131 forwarder (10.12.68.3, no-resolv -> recursive region BIND) resolves
+    BOTH maas-internal AND external (streams.canonical.com/archive/snap NOERROR);
+    the SERVFAIL hang class CANNOT recur (nodes use configured resolver). **HARD
+    ORDERING CAVEAT: `juju bootstrap` fetches the juju agent stream + juju/juju-db
+    SNAPS pre-apt (not covered by the apt proxy; D-135 items 2-3 agent/snap mirror
+    NOT built) -- it works ONLY while the DC1 edge egress is OPEN. Do NOT apply the
+    D-135/D-107 egress-narrowing until AFTER bootstrap (or mirror agents/snaps first).**
+  - **BLOCKER (committee Q1): the committed `bundle.yaml` is still VR0's 4-node
+    HYPERCONVERGED layout** (4 machines "8"-"11", `tags=openstack`, `num_units: 1`,
+    LXD-on-metal `to:`), but VR1 dc1 is 9 ROLE-SEPARATED nodes (3 control/2 compute/
+    4 storage, tag `openstack-vr1-dc1`) per D-121 Option C. The ARCHITECTURE is
+    fully DECIDED (D-121 role-sep + HA scale-up 1->3; D-104 keeps the JUJU
+    controller single-unit; D-119 tags) and the substrate is built to it -- but the
+    DEPLOY ARTIFACTS were never rendered to it: `overlays/dc-ha-scaleup.yaml` is
+    PARTIAL (control-plane only, not compute/storage/quorum), UNRENDERED
+    ({{VR1_DC0_CONTROL_0N}} tokens), dc0-NAMED, STALE (ceph-osd 3 vs amended 4), and
+    NOT wired into any runbook; the machines block (4->9), tag, role-based placement,
+    nova-compute 3->2, and num_units 1->3 are UNHANDLED; the phase-4 runbook Step 4
+    is STALE ("deploy the EXISTING bundle.yaml", omits both overlays, region-naming
+    drift: its "DC1"=vr1-dc0, its "DC2"=vr1-dc1-marked-BLOCKED). Neither the gap
+    register nor this doc tracked it before now.
+  - **NEXT (new session -- context exhaustion 2026-07-24):** render the vr1-dc1
+    9-node role-separated HA `bundle.yaml` (machines block, `openstack-vr1-dc1` tag,
+    role-based `to:`, num_units 1->3) + re-scope/render/wire `dc-ha-scaleup.yaml`
+    (+ ceph-osd/nova-compute/quorum placement) + the VIP overlay + de-stale the
+    phase-4 runbook (+ region-naming). THEN controller placement (consumes 1 of 9;
+    resolve the arithmetic) -> gated bootstrap (egress OPEN) -> deploy.
+    Separately: DC0 full-mirror completes -> reachability gate -> stage close-out.
 - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6
   exact; convergence zero --
   `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 6cbc900..b847467 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -322,3 +322,25 @@
   detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED
   number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded.
 - Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md.
+
+## SESSION CLOSE 2026-07-24 -- caveman guardrails + DC1 proxy-build start (bounded, GA-R4)
+
+- caveman plugin DISABLED (enabled:false both scopes) + SEC-017 + guardrails (repo-lint L11
+  *.original.md detector; deny compress; CLAUDE.md norm). commits up to 338c919..d0db020.
+- DC-mirror: DC0 full mirror still syncing; DC1 debmirror PAUSED ~330G (bandwidth NOT the
+  bottleneck, measured) + switched to an INTERIM apt caching proxy (D-135 AMENDED 2026-07-24):
+  scripts/dc-cache-proxy.sh shipped + INSTALLED on dc1 (serves archive+UCA 200). Two per-DC
+  Stage-5 test methods (dc0 full-mirror / dc1 proxy) = gates on ONE branch, not sub-branches.
+- DC1 Stage-5 deploy STARTED: per-DC MAAS creds (SEC-018/-019); Juju 3.6.25 on voffice1
+  (headend, D-128); add-cloud vr1-maas + add-credential both DCs; VIP overlay
+  overlays/vr1-dc1-vips.yaml; phase-4 Step 2.0 (MAAS-cred task) added. commits ..116e9b2.
+- **BLOCKED before bootstrap (committee-reviewed):** committed bundle.yaml is still VR0 4-node
+  HYPERCONVERGED; VR1 dc1 is 9 ROLE-SEPARATED (D-121 Option C). Architecture DECIDED, deploy
+  ARTIFACTS not rendered (dc-ha-scaleup.yaml partial/unrendered/dc0-named/stale/unwired; tag/
+  placement/num_units unhandled; phase-4 runbook stale). DNS confirmed GREEN for bootstrap
+  (D-131 forwarder resolves external; hang can't recur) -- but bootstrap needs edge egress OPEN
+  (juju agents/snaps unmirrored); do NOT narrow egress until after bootstrap.
+- OWNED: I fabricated a "D-193" reference in analysis (cardinal sin) -- corrected to D-121;
+  verified NOT persisted to repo. NEXT SESSION: render vr1-dc1 role-separated HA bundle +
+  wire overlays + de-stale phase-4, THEN bootstrap. Full detail: CURRENT-STATE Stage-4 bullet.
+- Status ONLY in CURRENT-STATE.md. Changelog: docs/changelog-20260724-caveman-disable.md.