diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index 19c16de..669e0c5 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -90,7 +90,7 @@
 | Credential exposures / security TODOs | repo `docs/security-ledger.md` -- add a row, never only a script comment |
 | Resuming work / what is still in flight (esp. after compaction) | repo `docs/session-ledger.md`, then `bash scripts/ledger-scan.sh` to reconcile against repo ground truth |
 | Tenant onboarding / tenant self-service | repo `scripts/tenant-onboard.sh` + `runbooks/tenant-onboarding-v2-DRAFT.md` + `appendix-C/D` |
-| Network / plane / IPAM questions | `references/environment.md`, repo `scripts/lib-net.sh`, NetBox (the IPAM apex) |
+| Network / plane / IPAM questions | `references/environment.md`, repo `scripts/lib-net.sh`, NetBox (the IPAM apex -- but during VR1 the WORKING apex is `office1-netbox`, 10.10.1.10, per DOCFIX-195; `netbox.baldurkeep.com` is a READ-ONLY v1 reference, write-back deferred to end-of-deployment) |
 | ANY change request to a built surface | grep repo `docs/design-decisions.md` for the governing D-NNN FIRST - PROPOSED/OPEN means the operator has not ruled: present options, do not implement |
 | Why is it built this way? / proposing changes | repo `docs/design-decisions.md` (D-NNN); grep before assigning a new number |
 | Versions, channels, pins | repo `runbooks/appendix-B-asbuilt-version-lock.md` |
@@ -126,7 +126,13 @@
 tree BEFORE reaching for a teardown (fix-forward is usually correct). Every
 `opentofu/` command is UNVALIDATED (no `tofu` binary has run in any session
 that authored this tree) -- run `bash scripts/opentofu-validate.sh` first if
-available, and treat every OpenTofu step as reviewed-but-unexercised.
+available, and treat every OpenTofu step as reviewed-but-unexercised. **At STAGE
+CLOSE** (every close-out gate MET, gauntlet ALL GREEN, repo-lint 0-fail): MERGE the
+stage branch to `main` (merge commit, NOT squash; operator-gated) as PART of the
+stage's definition-of-done, then RETIRE the branch (local + remote); the next stage
+branches off post-merge `main`. `main` is trunk-of-record only for stages that have
+merged (precedent: Stage 2 -> PR #1 `e468d2e`, 2026-07-15). See
+`docs/dc-dc-deployment-workflow.md` "Cross-cutting discipline".
 
 **Incident loop:** capture the verbatim error -> `bash scripts/cloud-assert.sh`
 (the service-own-verdict sweep localizes the layer) -> appendix-A by exact