diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 2fde362..91b6b3a 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -40,8 +40,8 @@
   (New since last re-seed: **SEC-010** -- the rack transit-leg FORWARD-drop artifact -- is COMMITTED
   but stays OPEN until applied + verified on vvr1-dc0. SEC-008 -- the vcloud re-enrolment key --
   carried over.)
-- **Next-free numbers:** D = **128**, DOCFIX = 196, BUNDLEFIX = 013.
-  (Since the last re-seed D-121..127 all ADOPTED. Load-bearing correction to the prior block:
+- **Next-free numbers:** D = **129**, DOCFIX = 196, BUNDLEFIX = 013.
+  (Since the last re-seed D-121..128 all ADOPTED -- D-128 = VR1 operating model (2026-07-17). Load-bearing correction to the prior block:
   **D-123 = Model B** (nodes nest INSIDE `vvr1-dc0`; site-down = one `virsh destroy vvr1-dc0`) via
   operator ruling R-1 2026-07-16 -- this SUPERSEDES the earlier "D-123 Model A" this block used to
   record. Also: D-124 transit addressing PINNED (172.31.0.0/24) + imported to office1-netbox; D-125
@@ -682,7 +682,8 @@
    libvirt bridge, `virbr2`, not routable off-host): `ssh -L 8443:10.10.0.1:443 <user>@10.17.11.248`
    -> `https://localhost:8443`.
 
-**VCLOUD POST-RESTART SWEEP + D-126 BASE-LEG + D-128 OPERATING MODEL (2026-07-17).** The vcloud host
+**VCLOUD POST-RESTART SWEEP + D-126 BASE-LEG + D-128 OPERATING MODEL (2026-07-17) -- SESSION CLOSED
+(committed + pushed; two honest carry-forwards below).** The vcloud host
 completed its bookend patch+reboot (running `6.8.0-136`, 0 upgradable, no reboot-required). Full sweep
 GREEN: libvirt 12 nets/4 pools active+autostart, both VMs autostart=enable+RUNNING, autostart chain proven
 end-to-end (all guests+edge uptime matched host boot). Post-reboot `ssh voffice1` was DOWN -- root cause:
@@ -698,8 +699,19 @@
 UNPROVEN:** `install` run (operator sudo) -- unit written + `enabled` (multi-user.target.wants), `apply` ran
 at install -> status=0, `check office1` -> ok. That run was POST-boot so it did NOT exercise the
 `After=libvirtd`+poll race; boot durability stays UNPROVEN until an ACTUAL reboot shows `ssh voffice1`
-self-heals. The next natural reboot is the proof (no forced test reboot). Ordering MEASURED (monolithic
-libvirtd active here). Next-free D now **129**.
+self-heals. Ordering MEASURED (monolithic libvirtd active here). **COMMITTED + PUSHED** on branch
+`dc-dc-stage3-phase2-dc-substrate`: `1958063` (tool + records + sweep) and `6f26b55` (tooling-gap register
+item **20** CLOSED for Office1 + the skill's per-DC discipline). Gauntlet ALL GREEN (67), repo-lint 0-fail,
+next-free D now **129**. `main` untouched (stage-close merge deferred).
+
+**TWO CARRY-FORWARDS (deliverables CLOSED; these are NOT -- do not mark them done):**
+1. **Boot-race proof.** `site-baseleg-office1.service` is installed + enabled, but the `After=libvirtd`+poll
+   race is UNPROVEN until an ACTUAL reboot self-heals `ssh voffice1` with no manual step. The next natural
+   reboot is the test; if `ssh voffice1` is dead after any reboot, `bash scripts/site-baseleg.sh check
+   office1` is the one-command diagnosis (skill routing row).
+2. **DC leg rows.** `site-baseleg.sh` generalizes to the DCs but a DC row is DEFERRED-until-measured (hard
+   rule 2; the harness fails on an un-commented DC supernet). At each DC standup, MEASURE the vcloud->DC
+   reach and add a MEASURED leg row + install ONLY if that net is isolated (register item 20 / skill invariant).
 
 ## OPEN WORK -- VR0 / DC0 (the running testcloud)