diff --git a/docs/changelog-20260730-dc0-node-carve.md b/docs/changelog-20260730-dc0-node-carve.md
index 9bec109..64581e4 100644
--- a/docs/changelog-20260730-dc0-node-carve.md
+++ b/docs/changelog-20260730-dc0-node-carve.md
@@ -334,3 +334,55 @@
 **Workaround, and it must be carried forward:** every preflight run for dc0 needs
 `MAAS_PROFILE=vr1-dc0-region` until this is fixed. With it, preflight is RED on **P5 only** --
 the ruled-accepted credential register -- and P1-P4 + P7 all PASS.
+
+## Item 10 -- Step 3.5 complete: model, spaces gate, artifact source
+
+**Model.** `juju add-model vr1-dc0` via the runbook's guarded capture-then-test idiom (a
+live pipe races SIGPIPE under pipefail and reports an AUTH failure as "model not present").
+`Added 'vr1-dc0' model with credential 'vr1-dc0-cred'`. Read back: two models, `controller`
+and `vr1-dc0`.
+
+**Spaces gate: `juju-spaces-check.sh vr1-dc0` = PASS, 0 fatal** -- all six ruled spaces
+present (`provider-public`, `metal-admin`, `metal-internal`, `data-tenant`, `storage`,
+`replication`), none of the five stale names.
+
+**RUN-LOCATION FRICTION, recorded because it will recur.** D-138 puts the juju client on
+the RACK, but the rack has NO REPO CLONE, and `juju-spaces-check.sh` sources `lib-net.sh`
+from its own directory so it cannot simply be piped through `bash -s`. Staged the three
+files to `~/repo-stage/scripts/` on the rack. This is the same class as queued finding F1
+(the `openstack` CLI is absent on the DC client host and blocks Step 7+): **D-138 moved
+where the work runs, and the tooling has not followed.** A repo clone on each DC client
+host is the obvious answer and is NOT taken here (hard rule 1).
+
+**`apt-mirror` KEY VERIFIED, NOT GUESSED.** The runbook deliberately refuses to write the
+key as an executable line because the only in-repo statement of it is a comment. Confirmed
+against the live client: `juju model-config --help` and `juju model-defaults` both list
+`apt-mirror` (and `apt-http-proxy`, which is dc1's proxy key). Set to
+`http://10.12.8.4/ubuntu` -- address READ FROM the DC's own checker, not typed -- and read
+back.
+
+**MIRROR GATE WAS RED AND IS NOW GREEN, with the root cause measured.**
+`dc-mirror.sh check dc0` initially FAILED on CONTENT:
+`last-sync FAILED: FAIL 2026-07-31T00:54:12Z ubuntu=1 uca=0`. **This is the "assert on
+CONTENT, never existence" fix from the earlier audit doing exactly its job** -- the older
+version printed an unconditional OK if the status file merely existed.
+
+Root cause, from the journal: ONE package, `linux-tools-intel-iotg_5.15.0.1107.106_amd64.deb`,
+`500 Server closed connection without sending any data back`. A transient upstream error on
+an Intel IoT gateway kernel-tools package that is irrelevant to KVM nodes running generic
+jammy -- but debmirror's all-or-nothing exit marks the whole run FAILED. Re-ran
+`dc-mirror.sh sync dc0`: completed in **15 seconds** (02:35:08 -> 02:35:23), confirming the
+transient diagnosis. Gate now PASS on `last-sync: OK 2026-07-31T02:35:23Z ubuntu=0 uca=0`.
+
+**The configured URL was asserted on CONTENT too**, not on a 200 at the root (which the
+nginx autoindex answers): `curl http://10.12.8.4/ubuntu/dists/jammy/Release` returns
+`Origin: Ubuntu`, `Suite: jammy`, `Codename: jammy`, `Components: main restricted universe
+multiverse`, `Architectures: ... amd64`.
+
+**OWNED -- an instrument error of my own, caught before it became a claim.** My first
+wait-loop polled `systemctl is-active` immediately after an ASYNC sync start, saw
+"inactive" because the unit had not started yet, and reported the sync finished while the
+status file read `RUNNING`. Re-polled on the status file CONTENT, which is the real signal.
+Same shape as the five instrument errors swept on 2026-07-30.
+
+**Revert.** `juju destroy-model vr1-dc0`; `juju model-config -m vr1-dc0 --reset apt-mirror`.