diff --git a/docs/archive/stage-records/vr1-stage2-record.md b/docs/archive/stage-records/vr1-stage2-record.md
new file mode 100644
index 0000000..8c2a4d5
--- /dev/null
+++ b/docs/archive/stage-records/vr1-stage2-record.md
@@ -0,0 +1,44 @@
+# VR1 Stage 2 (Office1 standup) consolidated record (GA-R2, Batch 4)
+
+Office1 site: edge boot bugs (DOCFIX-188..193), D-112/D-113 REST pivot, D-114 containment reshape, MAAS+LXD, NetBox apex + D-115/117/118/119/120 loads, IPv6 LAN. Durable content: configuration in vr1-office1-as-built.md; rulings in design-decisions; traps in platform-traps sections 1-4. Stage 2 merged to main PR #1 e468d2e 2026-07-15.
+
+| file (now docs/archive/changelogs/) | title line | lines |
+|---|---|---|
+| changelog-20260711-d111-subcarve-nn-alignment.md | Changelog 2026-07-11 -- DOCFIX-182: D-111 v6 subcarve aligned to deployed NN mnemonic | 48 |
+| changelog-20260711-ula-gen-command-fix.md | Changelog 2026-07-11 -- DOCFIX-183: fix invalid ULA-generation command in the netem/ULA proposal | 31 |
+| changelog-20260712-docfix189-max-context-session-audit.md | Changelog 2026-07-12 -- DOCFIX-189: re-audit of the max-context session's troubleshooting + docs | 92 |
+| changelog-20260712-libvirt-acpi-kernel-panic.md | Changelog 2026-07-12 -- DOCFIX-190: SECOND boot bug -- libvirt domains had ACPI disabled | 120 |
+| changelog-20260712-libvirt-memory-unit-rootcause.md | Changelog 2026-07-12 -- DOCFIX-188: ROOT CAUSE of the OPNsense boot triple-fault (libvirt `memory_unit`) | 119 |
+| changelog-20260712-office1-opnsense-edge-build.md | Changelog 2026-07-12 -- DOCFIX-186: Office1 OPNsense edge build + two first-boot infra findings | 58 |
+| changelog-20260712-opnsense-edge-boot-fixes.md | Changelog 2026-07-12 -- DOCFIX-187: opnsense-edge module first-boot fixes (boot still OPEN) | 55 |
+| changelog-20260712-opnsense-edge-real-isp-router.md | Changelog 2026-07-12 -- DOCFIX-185: OPNsense edge is a real-ISP router, not an egress-airgap | 39 |
+| changelog-20260712-opnsense-prep-bz2-fallback.md | Changelog 2026-07-12 -- DOCFIX-184: opnsense-prep-image.sh bz2 python fallback | 19 |
+| changelog-20260713-apparmor-libvirt-prereq.md | changelog 2026-07-13 -- fold the AppArmor/libvirt rule into scripts/prereqs | 60 |
+| changelog-20260713-config-xml-danger-sweep.md | 2026-07-13 -- safety sweep: the config.xml push path is now a LIVE HAZARD | 57 |
+| changelog-20260713-config-xml-path-deleted.md | 2026-07-13 -- D-113(a2) COMPLETE: the config.xml path is DELETED | 92 |
+| changelog-20260713-d114-voffice1-nested-virt.md | changelog 2026-07-13 -- D-114: voffice1 built; cloudinit-vm gains nested virt | 110 |
+| changelog-20260713-docfix194-opentofu-module-validation.md | DOCFIX-194 (2026-07-13) -- the OpenTofu gate was green over two broken modules | 103 |
+| changelog-20260713-git-credential-store.md | 2026-07-13 -- unattended git push from the jumphost (SEC-005) | 65 |
+| changelog-20260713-office1-dhcp-apply.md | 2026-07-13 -- DOCFIX-193 APPLIED: the Office1 edge now serves DHCP | 97 |
+| changelog-20260713-office1-headend-maas-lxd.md | changelog 2026-07-13 -- Office1 headend LIVE: MAAS 3.7.2 + LXD 5.21, D-114 proven end to end | 102 |
+| changelog-20260713-office1-netbox-deployed.md | changelog 2026-07-13 -- office1-netbox DEPLOYED; NetBox 4.6.4 live on the Office1 headend | 93 |
+| changelog-20260713-opnsense-api-client.md | 2026-07-13 -- D-113(a2) step 1: a thin OPNsense REST API client | 63 |
+| changelog-20260713-opnsense-api-proven.md | 2026-07-13 -- D-113(a2) PROVEN: the OPNsense REST API round-trips the edge config | 64 |
+| changelog-20260713-opnsense-api-write-proven.md | 2026-07-13 -- D-113(a2) write path PROVEN on the live edge | 64 |
+| changelog-20260713-opnsense-apikey-bootstrap.md | 2026-07-13 -- D-113(a2): API-key bootstrap, with no GUI click and no re-implemented crypto | 83 |
+| changelog-20260713-workflow-doc-status-correction.md | 2026-07-13 -- the workflow doc's status was materially FALSE | 43 |
+| changelog-20260714-c4-sandbox-loop-and-upstream-guard.md | 2026-07-14 -- C4 (sandbox loop documented) + the upstream-write guard it exposed | 54 |
+| changelog-20260714-d119-region-qualified-dc-namespace.md | 2026-07-14 -- D-119: region-qualify the VR1 DC namespace (Stage 2 close-out C3 / gap #19) | 108 |
+| changelog-20260714-d119-tofu-apply.md | 2026-07-14 -- D-119 OpenTofu rename APPLIED (operator-gated destroying apply) | 43 |
+| changelog-20260714-netbox-importers-waf-useragent.md | 2026-07-14 -- the two pynetbox importers could NEVER have written upstream (WAF User-Agent) | 54 |
+| changelog-20260714-netbox-write-path-hardening.md | 2026-07-14 -- NetBox write-path hardening (the bugs that would have corrupted the apex at C2) | 85 |
+| changelog-20260714-office1-lan-ipv6-executed.md | 2026-07-14 -- Office1 LAN IPv6 is LIVE (Stage 2 close-out C1: OPEN -> DONE) | 116 |
+| changelog-20260714-opnsense-set-interface-v6.md | 2026-07-14 -- D-113 AMENDMENT: the LAN IPv6 the REST API cannot set | 85 |
+| changelog-20260715-creds-audit.md | 2026-07-15 -- creds-audit: enforce per-site credential consolidation (SEC-009), so the DC0/DC1 spread cannot r | 60 |
+| changelog-20260715-creds-consolidation.md | 2026-07-15 -- credential/env consolidation into ~/vr1-office1-creds/ (SEC-009) | 52 |
+| changelog-20260715-d120-load-and-iprange-tooling.md | 2026-07-15 -- C2 sub-task (ii): D-120 bands loaded + verified; sandbox loop extended to ip-ranges/ip-addresses | 53 |
+| changelog-20260715-d120-office1-service-reip.md | Changelog 2026-07-15 -- D-120 ADOPTED: Office1 service re-IP into the static band | 66 |
+| changelog-20260715-d121-d122-stage3-ha-nodelayout.md | 2026-07-15 -- Stage 3 kickoff: D-121 (HA scale-up + Option C node layout) + D-122 (site shape); phase2 runbook | 116 |
+| changelog-20260715-docfix195-c2-netbox-of-record.md | 2026-07-15 -- DOCFIX-195: office1-netbox holds the VR1 IPAM APEX role (working draft); apex write-back deferre | 75 |
+| changelog-20260715-fidelity-check-scope-correctness.md | 2026-07-15 -- C2 sub-task (i): sandbox re-verified faithful; fidelity checker scope false-positive fixed | 83 |
+| changelog-20260715-stage3-prereqs-prep.md | 2026-07-15 -- Stage 3 batch-deploy prep: OpenTofu wiring, DC-edge NetBox importer, HA overlay, D-123 | 88 |