diff --git a/scripts/dc-region-topology.sh b/scripts/dc-region-topology.sh
index 90a10e2..949852d 100644
--- a/scripts/dc-region-topology.sh
+++ b/scripts/dc-region-topology.sh
@@ -300,7 +300,11 @@
         actual_fab="$(sub_fabric_bycidr "$cidr")"
         if [ "$actual_fab" != "$fn" ]; then
           vid="$(fab_vlan_vid0 "$fn")"
-          say "subnet update $sid vlan=$vid   # MOVE $cidr off '$actual_fab' onto '$fn'"
+          # In a DRY run the target fabric may not exist yet (it is created earlier
+          # in this same apply), so its VLAN id cannot resolve. Print an explicit
+          # placeholder rather than an empty value -- an empty `vlan=` reads like a
+          # defect and would hide a real one.
+          say "subnet update $sid vlan=${vid:-<vlan-of-$fn>}   # MOVE $cidr off '$actual_fab' onto '$fn'"
           if [ "$COMMIT" -eq 1 ]; then
             [ -n "$vid" ] || refuse "fabric $fn has no untagged VLAN to move $cidr onto"
             m subnet update "$sid" vlan="$vid" >/dev/null 2>&1 || refuse "could not move subnet $cidr"
@@ -331,7 +335,9 @@
     [ "$cur" = "$plane" ] && { echo "  [idem] $cidr VLAN already in space '$plane'"; continue; }
     vlid="$(sub_vlan_bycidr "$cidr")"; spid="$(space_id_byname "$plane")"
     fabname="$(sub_fabric_bycidr "$cidr")"
-    say "vlan update (fabric '$fabname' vlan $vlid) space=$plane   # was '${cur:-none}'"
+    # Same DRY-run caveat as the MOVE above: on a from-scratch build the subnet
+    # (and therefore its fabric/VLAN) may not exist yet.
+    say "vlan update (fabric '${fabname:-<fabric-for-$plane>}' vlan ${vlid:-<vlan-for-$plane>}) space=$plane   # was '${cur:-none}'"
     if [ "$COMMIT" -eq 1 ]; then
       [ -n "$vlid" ] && [ -n "$spid" ] || refuse "cannot bind $cidr: vlan='$vlid' space='$spid'"
       fabid="$(fab_id_byname "$fabname")"
diff --git a/tests/dc-region-topology/run-tests.sh b/tests/dc-region-topology/run-tests.sh
index 3da8275..d050074 100644
--- a/tests/dc-region-topology/run-tests.sh
+++ b/tests/dc-region-topology/run-tests.sh
@@ -198,6 +198,16 @@
 case "$OUT" in *"vr1-dc1-provider-public"*) ok "dc1 derives vr1-dc1-* fabric names" ;; *) no "dc1 derives vr1-dc1-* fabric names (got '$OUT')" ;; esac
 case "$OUT" in *"vr1-dc0-"*) no "dc1 invocation leaked a dc0 fabric name" ;; *) ok "dc1 invocation carries no dc0 fabric name" ;; esac
 
+# --- DRY-RUN OUTPUT MUST NOT PRINT EMPTY IDS -------------------------------
+# On a from-scratch build the target fabric does not exist yet when the MOVE and
+# space-bind lines are planned, so their ids cannot resolve. They must print an
+# explicit placeholder: an empty `vlan=` looks like a defect and would hide one.
+OUT="$(STUB_STATE=empty bash "$SCRIPT" apply vr1-dc0 --profile vr1-dc0-region --expect-rack hot-kid 2>&1)"
+case "$OUT" in *"vlan="[[:space:]]*|*"vlan= "*) no "dry run printed an EMPTY vlan= id" ;; *) ok "dry run printed no empty vlan= id" ;; esac
+case "$OUT" in *"fabric ''"*) no "dry run printed an EMPTY fabric name" ;; *) ok "dry run printed no empty fabric name" ;; esac
+case "$OUT" in *"<vlan-of-vr1-dc0-provider-public>"*) ok "MOVE line uses an explicit vlan placeholder" ;; *) no "MOVE line uses an explicit vlan placeholder (got '$OUT')" ;; esac
+case "$OUT" in *"<fabric-for-storage>"*) ok "space-bind line uses an explicit fabric placeholder" ;; *) no "space-bind line uses an explicit fabric placeholder" ;; esac
+
 echo
 echo "dc-region-topology: $P passed, $F failed"
 [ "$F" -eq 0 ] || exit 1