diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 5a2e832..bf2a505 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -1208,9 +1208,26 @@
   (v6 planes carry band discipline) is satisfied. Verified identically on ULA and GUA subnets.
   Harness case T19 was RE-POINTED at the surviving invariant rather than deleted, per the
   standing rule that remediating a finding must not be resolved by removing the assertion.
+  **dc1 FIP POOL RULED + APPLIED 2026-07-27 -- R4's ruled scope is now COMPLETE for BOTH DCs.**
+  Operator utterance: **"Rule dc1 FIP pool 10.12.65.0-10.12.67.254"**, recorded on the D-134 R4
+  amendment (the authority). VALIDATED BEFORE RECORDING: inside provider-public
+  `10.12.64.0/22`; **767 addresses, byte-for-byte the same size as dc0's**
+  `10.12.5.0-10.12.7.254`, so the DCs stay structurally symmetric; and no overlap with the
+  D-134 `.64.4-.49` / `.64.50-.99` bands. `lib-net.sh`'s dc1 arm now SETS
+  `FIP_POOL_START`/`END` -- **narrowing the deliberate unset list by exactly one pair.
+  `VIP_PREFIX_*`, `VIP_COUNT_EXPECT` and `KEYSTONE_VIP_DEFAULT` remain UNSET (R9 rules the VIP
+  group GENERATED from the overlay), as do `METAL_INTERNAL_VID`/`IFACE` (D-133 retired that
+  stack).** Applied: 1 planned / 1 applied / 0 errors, read back. **FINAL STATE, both DCs:
+  `check` pass=24 fail=0 AND `reserve` planned=0 skipped=19 errors=0 -- fully converged and
+  idempotent.** ipranges 3 -> 29 (3 dynamic unchanged, 26 reserved); both FIP pools present and
+  `reserved`. Machines 18 Ready + 2 Deployed unchanged throughout.
+  **TWO STALE ASSERTIONS RE-POINTED, NOT DELETED** (the standing rule): `tests/dc-selector`
+  asserted dc1 UNSETS `FIP_POOL_START` and `tests/dc-plane-ipam` T20 asserted dc1 REFUSES the
+  pool -- both encoded a state the ruling retired. Each was replaced with a STRONGER assertion
+  (the ruled VALUE, plus a guard that the still-unset group stayed unset, plus a check that dc1
+  plans its OWN pool and never dc0's). dc-selector 48 -> 51 checks; gauntlet ALL GREEN (83).
   **STILL NOT DONE, each an operator-gated live mutation:** the rack-bridge v6 legs (U17), and
-  the apex population (bands + VIPs as scoped objects). **STILL NEEDING A RULING: dc1's FIP
-  pool** -- unset in `lib-net.sh` by design, so R4 cannot close for dc1 until it is ruled.
+  the apex population (bands + VIPs as scoped objects).
 - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6
   exact; convergence zero --
   `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B
diff --git a/docs/changelog-20260727-stage5-phase0.md b/docs/changelog-20260727-stage5-phase0.md
index 9657a37..afc0f15 100644
--- a/docs/changelog-20260727-stage5-phase0.md
+++ b/docs/changelog-20260727-stage5-phase0.md
@@ -341,3 +341,30 @@
 2026-07-21 pod-delete cascade).
 
 **Capture.** `docs/audit/dc-plane-ipam-executed-20260727.txt`.
+
+## 11. dc1 FIP pool RULED and applied -- R4 now complete for both DCs
+
+**What.** Operator ruling (GA-R5), exact utterance: "Rule dc1 FIP pool
+10.12.65.0-10.12.67.254". Recorded on the D-134 R4 amendment; `lib-net.sh`'s dc1 arm
+now sets `FIP_POOL_START`/`END`; the range was reserved in MAAS (1 applied, read back).
+
+**Validated before recording, not assumed.** Inside `10.12.64.0/22`; **767 addresses,
+identical in size to dc0's** `10.12.5.0-10.12.7.254`; no overlap with the D-134 bands.
+
+**Scope discipline.** The ruling narrows dc1's deliberate unset list by exactly ONE pair.
+`VIP_PREFIX_*`, `VIP_COUNT_EXPECT`, `KEYSTONE_VIP_DEFAULT` stay unset (R9 rules the VIP
+group generated from the overlay); `METAL_INTERNAL_VID`/`IFACE` stay unset (D-133). New
+harness guards assert exactly that, so a future edit cannot widen it silently.
+
+**Two stale assertions RE-POINTED, not deleted.** `tests/dc-selector` asserted dc1
+*unsets* `FIP_POOL_START`; `tests/dc-plane-ipam` T20 asserted dc1 *refuses* the pool.
+Both encoded the pre-ruling state. Each was replaced with a stronger check: the ruled
+value, the still-unset guards, and that dc1 plans its OWN pool and never dc0's. That
+last one is what proves the tool reads a per-DC value rather than a shared literal.
+
+**Final state, both DCs:** `check` pass=24 fail=0 AND `reserve` planned=0 skipped=19
+errors=0 -- converged and idempotent. ipranges 3 -> 29. Machines unchanged.
+dc-selector 48 -> 51; gauntlet ALL GREEN (83).
+
+**Revert.** Delete the iprange whose start_ip is `10.12.65.0`, and restore the
+`unset FIP_POOL_START FIP_POOL_END` line in `lib-net.sh`'s dc1 arm.