diff --git a/bundle.yaml b/bundle.yaml
index e49be1f..6416645 100644
--- a/bundle.yaml
+++ b/bundle.yaml
@@ -20,10 +20,15 @@
 #                   os-public-hostname is set nowhere, which is why the designate applications
 #                   this bundle carries deploy INERT (D-106 ruling note 2026-07-27). This base
 #                   bundle stays DC-agnostic; the reactivation is overlay work, never edited here.
-# HA chain:         hacluster subordinates + :ha relations ACTIVE for 12 charms (10 v1 API charms +
-#                   ceph-radosgw, un-deferred, + designate, reactivated 2026-07-10 per D-106) -- of
-#                   these, 11 carry the dual-VIP pattern (designate uses its own dnsaas/DNS-native
-#                   addressing, not an HAProxy VIP, so it doesn't add to the VIP-triple count). VIPs
+# HA chain:         hacluster subordinates + :ha relations ACTIVE for 13 charms (10 v1 API charms +
+#                   ceph-radosgw, un-deferred, + designate, reactivated 2026-07-10 per D-106, + vault,
+#                   re-HA'd 2026-08-05 per D-121 (v-a) / BUNDLEFIX-053) -- ALL 13 carry a VIP (measured
+#                   on the merged dc0 deploy input, BUNDLEFIX-054 2026-08-06): 12 the full
+#                   provider+metal-admin+metal-internal triple, and vault a METAL-ONLY pair
+#                   (metal-admin+metal-internal, no provider leg -- D-020 amendment 2026-08-05).
+#                   designate DID gain a full triple VIP (.62) under R11, so the prior "designate uses
+#                   dnsaas addressing, no HAProxy VIP" note is RETIRED. rabbitmq-server is the 14th HA
+#                   app but clusters natively (no hacluster/VIP), so it is not in this 13. VIPs
 #                   front-loaded into the MAAS-reserved /26: provider 10.12.4.2-.63, metal
 #                   10.12.8.2-.63 (supersedes .224-.254). (B1)
 # VIP VALUES:       NOT IN THIS FILE. Ruling 3 (2026-07-25) made this bundle VIP-FREE --
diff --git a/docs/changelog-20260806-stage5-dc0-f4-postwave.md b/docs/changelog-20260806-stage5-dc0-f4-postwave.md
new file mode 100644
index 0000000..741285b
--- /dev/null
+++ b/docs/changelog-20260806-stage5-dc0-f4-postwave.md
@@ -0,0 +1,76 @@
+# Changelog 2026-08-06 -- Stage 5 dc0: F4 measurement-backed + F8/F9 + F-A header + Task #1 review
+
+Session body (GA-R2, one per session). Branch `dc-dc-stage5-preconditions`. Stage 5 OPEN.
+Status lives ONLY in `docs/CURRENT-STATE.md`. All live reads were read-only (D-138 rack path);
+the one owed mutation (F9 rack re-stage) is gated on operator approval, NOT executed unattended
+(operator-away background session).
+
+## Item 1 -- F4: 14/14 HA now MEASUREMENT-BACKED + vault ha_enabled measured  [commit 7555479]
+
+- Read-only `juju status -m vr1-dc0` captured FROM the dc0 rack (D-138 path
+  `ssh vr1-dc0-rack` -> juju). Capture: `docs/audit/stage5-dc0-juju-status-14of14-20260806.txt`.
+- **14/14 D-121-enumerated HA apps at scale=3** (graded against
+  `changelog-20260805-d121-ha-scaleup.md:24`, NOT reverse-engineered). HONEST SPLIT
+  (GA-R6 E3, not rounded): **12 active/idle; 2 blocked-at-scale=3** on KNOWN non-HA items --
+  octavia (`configure-resources` pending) + designate (`nameservers must be set`).
+  Model-wide 152 active/idle, 7 blocked, 1 unknown (glance-simplestreams-sync, normal).
+  Converted the CURRENT-STATE 14/14 line OPERATOR-ATTESTED -> MEASUREMENT-BACKED (C2).
+- **vault ha_enabled MEASURED FALSE x3** (vault status; unauthenticated, non-secret). CAUSE
+  (measured -- corrected a mid-session draft that mis-blamed the mysql backend as HA-incapable,
+  advisor-caught): the vault charm renders `storage "mysql"` with NO `ha_enabled` and exposes
+  NO such config option (HA options are only `vip` + `dns-ha-access-record`). Vault's HA here is
+  the charm/VIP model, NOT vault-native active/standby -- all 3 units show `active: true`; the
+  hacluster VIP constrains live traffic to one. This CONFIRMS D-121 (v-a) as-built; vault-native
+  HA (Raft) stays owned by D-068 (already the (v-b) alternative in D-121). No new decision.
+- Revert: `git revert 7555479` (record-only; no live-cloud change).
+
+## Item 2 -- F8: ceph-radosgw RESOLVED  [in capture file]
+
+- 3 units active/idle "Unit is ready" (80/tcp). The prior "Services not running: radosgw" was
+  the new-unit stale-status class; converged. No action. Revert: n/a (read-only).
+
+## Item 3 -- F9/F-B: staging drift MEASURED; re-stage GATED  [task #3, pending operator approval]
+
+- dc0 rack `~/repo-stage`: `bundle.yaml` (staged 213b51ba) and `overlays/vr1-dc0-vips.yaml`
+  (staged cf42b937) are STALE vs HEAD (bundle 20ca73a6 pre-F-A / vips 3f403408); dc1 rack has
+  NO `~/repo-stage` (dc1 HELD/undeployed). Re-stage matters only at the NEXT dc0 deploy (running
+  cloud already converged). Prepared + gated -- rack write not executed unattended.
+- NOTE: F-A (Item 4) changes bundle.yaml, so the re-stage MUST carry the post-F-A bundle.
+- ATTEMPTED 2026-08-06 after committing F-A (scp post-F-A bundle.yaml + vr1-dc0-vips.yaml to
+  the dc0 rack + sha256-verify); the Claude Code auto-mode classifier DENIED the rack write.
+  That is the hard rule 3 gate working as designed (read-only audits passed all session; the
+  rack WRITE is blocked). F9 stays PENDING explicit operator approval / a Bash permission rule.
+  Revert: n/a (no write occurred).
+
+## Item 4 -- F-A / BUNDLEFIX-054: bundle.yaml HA-chain header corrected  [OPS]
+
+- `bundle.yaml:23` HA-chain header said "ACTIVE for 12 charms ... 11 carry the dual-VIP pattern
+  (designate ... no HAProxy VIP)". THREE stale claims after BUNDLEFIX-053 + D-020 amendment + R11,
+  all corrected FROM the measured merged dc0 deploy input:
+  (a) 12 -> **13** hacluster subordinates/`:ha` relations (vault-hacluster added by BUNDLEFIX-053;
+      provider-bundle-check reports "13 hacluster subordinate(s)").
+  (b) VIP-carriers: ALL 13 carry a VIP -- **12 the full provider+metal-admin+metal-internal triple,
+      vault a METAL-ONLY pair** (.61, no provider -- D-020 amendment). Measured from
+      `overlays/vr1-dc0-vips.yaml`.
+  (c) The "designate has no HAProxy VIP" note is RETIRED -- designate gained a full triple VIP
+      (.62) under R11.
+  Also clarified rabbitmq-server is the 14th HA app but native-clustered (no hacluster/VIP), so
+  not in the 13. COMMENT-ONLY; no deploy semantics change. gauntlet + repo-lint re-run green.
+- Revert: restore the prior 6-line header block (git revert this commit).
+
+## Item 5 -- Task #1 (post-wave review): dc-ha-scaleup.yaml is now REDUNDANT -- RECOMMENDATION, not executed
+
+- MEASURED: `bundle.yaml` (via BUNDLEFIX-053) now carries the ENTIRE content of
+  `overlays/dc-ha-scaleup.yaml` -- `num_units:3` + `to:[lxd:0,1,2]` on all 14 apps,
+  `cluster_count:3` on the 12 hacluster subs, `vault-hacluster` declared (line 1036),
+  rabbitmq `min-cluster-size:3` (170), memcached scaled, and the `[vault:ha, vault-hacluster:ha]`
+  relation (1058). Applying dc-ha-scaleup.yaml on top would be an all-keys no-op deep-merge.
+- The overlay header itself records "NOT YET APPLIED to any live model"; the live 14/14 scale-up
+  was done via per-app `juju add-unit`, never via this overlay.
+- **RECOMMENDATION (operator decision -- NOT executed):** retire `overlays/dc-ha-scaleup.yaml`
+  and its references (runbook Step 2 whole-overlay apply; provider-bundle-check T17 ordering
+  assertion; the R6 2026-07-27 "apply the overlay whole, sequenced after VIPs" ruling). Because
+  R6 is a RULING and D-121 references the overlay, retiring it needs an operator ruling / D-121
+  amendment, not an unattended edit (hard rule 1). Logged here + already flagged in
+  provider-bundle-check T16 comment.
+- Revert: n/a (finding only).