diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 1dc4a5e..32424c2 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -102,6 +102,62 @@
   later unplaced `juju add-unit ceph-osd`, which would match no machine. The real
   impact is measurable at Step 4.2's `--dry-run` and not before, so it is recorded here
   and decided there -- it is not folded into the P5 ruling above.
+  **STEP-1/2.0 GATES PASSED 2026-07-30, all read-only, ON voffice1.** Selectors: both
+  `lib_net_select_dc vr1-dc0` and `lib_hosts_select_dc vr1-dc0` exit 0; six planes
+  (`10.12.4/8/12/16/32/36.0/22`); ten hosts, the tenth being `vr1-dc0-juju-01`, the
+  D-104 dedicated controller VM. Step 2.0 credential gate = outcome 1 of 3 (LISTED +
+  user exists): `juju credentials --client` shows `vr1-dc0-cred, vr1-dc1-cred` on cloud
+  `vr1-maas` (`credential-count: 2`), MAAS user `juju-vr1-dc0` present -- so the mint is
+  SKIPPED, correctly: re-minting would be SEC-018 credential sprawl on an already-red
+  register. Controller-tag gate: `maas-role-tags.sh check vr1-dc0` PASS (0 missing,
+  0 needing a tag, 0 not in MAAS) and EXACTLY ONE machine carries
+  `juju-controller-vr1-dc0` -- system_id `7n87bt`, `Ready`.
+  **ARTIFACT SOURCES AND EGRESS RE-MEASURED 2026-07-30, both DCs.** dc0 mirror PASS
+  (`last-sync: OK 2026-07-30T00:20:20Z ubuntu=0 uca=0`, answers 200 on 10.12.8.4);
+  dc1 proxy PASS (apt-cacher-ng active on 10.12.68.4:3142, serves archive AND UCA 200).
+  Egress re-probed from BOTH rack hosts with `--noproxy '*'` so a cache hit could not
+  fake it: juju agent stream `streams.canonical.com/juju/tools/` 200, snap store
+  `api.snapcraft.io` answering, `archive.ubuntu.com` jammy Release 200, 1.1.1.1 0% loss,
+  default routes via 10.12.4.1 / 10.12.64.1. **The bootstrap window is OPEN on both DCs
+  as of this date** -- the shelf-life clause on the 2026-07-27 measurement is discharged
+  for this session and no further. **INSTRUMENT NOTE, recorded because it cost a
+  measurement:** run from voffice1, `dc-mirror.sh check dc0` and `dc-cache-proxy.sh check
+  dc1` both report EVERY item MISS and FAIL. That is the scripts measuring voffice1's own
+  filesystem -- they RUN ON THE RACK HOST and must be piped there
+  (`ssh voffice1 "ssh <rack-transit-ip> 'sudo -n bash -s -- check <site>'" < scripts/<script>`,
+  transit IPs 172.31.0.2 / 172.31.0.6 from `scripts/lib-hosts.sh`). Identical to the trap
+  already recorded at `docs/audit/stage5-committee-raw-20260727.md:299`; the scripts state
+  the requirement in prose and still do not enforce it.
+  **OBSERVATION, not a defect: every VR1 node carries a MAAS auto-generated hostname**
+  (`moved-troll` is the dc0 controller `7n87bt`; `square-ferret` the dc1 one; the nine dc0
+  role nodes are `ace-robin`, `wired-thrush`, `real-filly`, `keen-dove`, `superb-piglet`,
+  `first-oryx`, `wise-stud`, `alert-cub`, `moral-salmon`). None carries its ruled
+  `vr1-dc0-<role>-NN` name. This is uniform across all 20 nodes, so it is not a controller
+  anomaly; `maas-role-tags.sh` and preflight P4 both resolve by PINNED BOOT MAC, which is
+  why both read clean against ruled names. Consequence is cosmetic -- `juju status` will
+  show the auto-names -- and the bundle selects by TAG, never by hostname, so the deploy is
+  unaffected. Recorded so a later session does not "discover" it as a fault mid-deploy.
+  **BOOTSTRAP CONSTRAINT-FLAG RULING 2026-07-30 (GA-R5).** Question as presented: Step 2's
+  command and D-104's amendment text both read `juju bootstrap --constraints
+  tags=juju-controller-$DC`, described as targeting the dedicated controller VM
+  deterministically; but juju 3.6.27's own help ON voffice1 assigns that flag different
+  semantics -- `--bootstrap-constraints` "will also apply to any future controllers
+  provisioned for high availability (HA)", whereas `--constraints` "will be set as the
+  default constraints for all future workload machines in the model, exactly as if the
+  constraints were set with `juju set-model-constraints`". By that text the
+  machine-targeting flag is `--bootstrap-constraints`. There is no `--dry-run` for
+  bootstrap (checked), so the command is one-shot, and the failure mode if targeting does
+  not bite is the controller landing on one of the nine role nodes -- the exact outcome the
+  D-104 amendment rejects. Options put: use `--bootstrap-constraints`; use `--constraints`
+  exactly as written; use both. **Operator answer, exact utterance: "Use both flags".**
+  CONSEQUENCE: the executed form carries BOTH, so machine targeting is unambiguous AND the
+  runbook's literal text is honoured. The cost is accepted and is nil in practice -- the
+  controller model carries a tag constraint as its workload default, and that model runs no
+  workloads (juju's own help: "The 'controller' model typically does not run workloads");
+  the bundle deploys into the separate `vr1-dc0` model created at Step 3.5. **D-104 is NOT
+  amended by this** -- the decision is unchanged; only the flag that implements it is
+  clarified. A DOCFIX to correct the Step 2 command and annotate D-104's mechanism sentence
+  is OWED and is recorded in this session's changelog.
 
 - Project: Omega Cloud, VR1 DC-DC rehearsal -- a two-DC + Office1-headend
   virtual rehearsal on KVM (vcloud host), rehearsing the future bare-metal
diff --git a/docs/changelog-20260730-stage5-open.md b/docs/changelog-20260730-stage5-open.md
index 284d225..a3e302c 100644
--- a/docs/changelog-20260730-stage5-open.md
+++ b/docs/changelog-20260730-stage5-open.md
@@ -21,6 +21,10 @@
    authority). The six enumerated findings are accepted, known, pre-existing exposure;
    `preflight.sh` continues to exit FAIL on P5 for the stage's duration and that RED is
    ruled-accepted. The acceptance covers those six and nothing else.
+2. **BOOTSTRAP CONSTRAINT FLAG** -- **"Use both flags".** Question as presented and the
+   full consequence text are in `docs/CURRENT-STATE.md` section 1. The executed bootstrap
+   carries BOTH `--bootstrap-constraints` and `--constraints`. D-104 is NOT amended; only
+   the flag implementing it is clarified.
 
 ---
 
@@ -77,3 +81,27 @@
 mid-step, and the standing rule is that a finding is an observation, not a conclusion.
 
 **Revert.** Nothing to revert -- no artifact was changed.
+
+### 3. OWED -- DOCFIX for the Step 2 bootstrap command and D-104's mechanism sentence
+
+**What.** Not yet assigned a number (next-free DOCFIX is 206; assign at the point of
+delivery, per the standing numbering rule -- do not write the token above the high-water
+mark in prose before it exists). Two surfaces state the bootstrap machine is targeted by
+`juju bootstrap --constraints tags=juju-controller-$DC`:
+`runbooks/dc-dc-phase4-juju-bundle-per-dc.md:277-278` and the D-104 amendment's
+"**Distinct tag, no role tag**" bullet in `docs/design-decisions.md`.
+
+**Why (evidence).** Juju 3.6.27's own help, read ON voffice1 rather than from memory,
+assigns machine-targeting to `--bootstrap-constraints` and model-defaulting to
+`--constraints` (both sentences quoted verbatim in `docs/CURRENT-STATE.md` section 1).
+The operator ruled "Use both flags", so the live command is correct; the RUNBOOK is what
+still reads wrong, and a future DC standup following it literally would get the
+single-flag form. **No gate reads prose, so nothing in this repo can catch it** -- the
+same class as the citation defect the 2026-07-27 audit recorded.
+
+**Scope note.** The DOCFIX corrects the FLAG only. D-104's decision -- a dedicated
+per-DC controller VM carrying its own tag and none of the role tags -- is untouched and
+was independently confirmed live this session: `moved-troll` (`7n87bt`) carries
+`juju-controller-vr1-dc0` and no `openstack-vr1-dc0`.
+
+**Revert.** N/A -- nothing delivered yet; this item is the record that it is owed.