diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 718af50..6aa0309 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -977,6 +977,21 @@
   whether those six charms' v6 VIP legs can bind at all without it. **That is an R2 / D-136
   ruling-surface question needing a GA-R5 exchange**, presented to the operator with the
   measurement above rather than decided mid-deploy.
+  **^ RULED 2026-07-31 (GA-R5). Question as presented: the vips overlay sets `prefer-ipv6`
+  on all 13 VIP apps but only 7 charms declare it; options were (a) research what the six do
+  with v6 VIPs before touching a ruled surface, (b) drop the option only and keep the v6 legs,
+  (c) drop both and make those six v4-only. Operator answer, exact utterance: "Research what
+  those 6 charms do with v6 VIPs first (Recommended)".** CONSEQUENCE: **the overlay is NOT
+  edited and R2 is NOT amended.** The research question, stated precisely so the next session
+  does not re-derive it: *for `barbican`, `designate`, `magnum`, `octavia`, `placement` and
+  `vault` at their pinned channels, does the charm's generated HAProxy configuration bind
+  `:::port` (or the v6 VIP explicitly) WITHOUT a `prefer-ipv6` option -- or does it bind v4
+  only, making a v6 VIP leg an address pacemaker manages and nothing listens on?* Answering it
+  decides between options (b) and (c) on evidence rather than on a guess. Useful starting
+  points: the charms' `templates/haproxy.cfg` in their respective source trees, charm-helpers'
+  `get_relation_ip`/`ipv6` helpers, and whether `hacluster` assigns a v6 VIP independently of
+  the principal's binding. **STAGE 5 IS BLOCKED ON THIS RESEARCH** -- the deploy cannot
+  complete until the six are resolved one way or the other.
 
 - Project: Omega Cloud, VR1 DC-DC rehearsal -- a two-DC + Office1-headend
   virtual rehearsal on KVM (vcloud host), rehearsing the future bare-metal
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 657c77a..0615797 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -277,3 +277,19 @@
 - **NEXT, and it is the ONLY thing between here and the deploy:** `scripts/dc-node-carve.sh` does not exist -- 60 NIC re-homes + 9 `br-ex` + 54 v4 statics. Its hard inputs are now MEASURED and guarded: `NIC_PLANE_ORDER` (NOT `PLANE_CIDRS` order -- walking that positionally strands PXE on provider-public), the role asymmetry, and `carve-host-interfaces.sh:211-236`'s `build_ovs_brex()` call sequence. Then `dc-node-v6-carve.py --profile vr1-dc0-region`, then re-point Juju at `10.12.8.6:5240` (needs a region-scoped API key + `juju unregister vr1-dc0-controller` on the rack).
 - **CLOSE SWEEP: `docs/audit/queued-findings-20260730-dc0-region-migration.txt` (F1-F10).** THREE items lived ONLY in the transcript: **F1** this session's permission rules exist only in GITIGNORED `settings.local.json` (verbatim text now recorded, incl. a broad `Bash(ssh vr1-dc0-rack *)` auto-added by an approval and worth review); **F2** Office1 STILL registers a rack controller on the dc0 rack (`vvr1-dc0`/`7chphy`) and still holds the region VM's machine record; **F10** the five instrument errors as one pattern. F9 carries the next session's first commands and every measured input the carve tool needs.
 - Gauntlet **ALL GREEN (92)**; repo-lint 0 fail. Body: `docs/changelog-20260730-dc0-region-migration.md` (24 items). Status ONLY in CURRENT-STATE.md.
+
+## SESSION CLOSE 2026-07-31 -- dc0 node carve COMPLETE, controller BOOTSTRAPPED, deploy blocked on prefer-ipv6 (bounded, GA-R4)
+
+- Branch `dc-dc-stage5-preconditions`, **11 commits** pushed (`a859352..80510f4`). NO stage opened/closed. Scan: 3 decisions, **SEC 25** (SEC-028, -029 opened), D 139 / **DOCFIX 207** / BUNDLEFIX 053.
+- **`scripts/dc-node-carve.sh` SHIPPED** (harness 48/48) -- the last no-tool gap. **dc0 v4 carve COMPLETE 10/10, named gate 134/0**, and the diff against the pre-migration capture is **EMPTY**: every node's six legs match Office1 address for address. v6 carve **54/54**; the controller's own v6 restored separately (the tool walks only the nine tagged role nodes).
+- **>>> JUJU CONTROLLER LIVE: `vr1-dc0-controller`, active/idle. <<<** FOURTH attempt, first success; the three failures were each a real defect one layer deeper, closed by D-138, the under-carve fix, and D-132 q1 respectively. Agent binaries resolved on attempt 1.
+- **Model `vr1-dc0` created, spaces gate PASS (6/6), `apt-mirror` set** to the DC mirror -- key VERIFIED against the live client, not guessed; URL asserted on `dists/jammy/Release` content.
+- **2 RULINGS (GA-R5, quoted):** *"Mint juju-vr1-dc0 on the new region (Recommended)"*; *"Copy dc0's PKI overlay to the dc0 rack (Recommended)"*. Both registered BEFORE use -- **SEC-028** (juju service credential; `vm-secret-locations` gained its first `rack` rows) and **SEC-029** (PKI overlay residency). Key proven to AUTHENTICATE before bootstrap, never printed, sha256-verified at every hop.
+- **DOCFIX-206: Step 2.0's credential gate was NOT region-scoped, and I hit it** -- credential listed, folder present, user existed, all in OFFICE1. The SKIP branch would have led to an auth failure that reads as a network fault.
+- **>>> BUNDLE DEPLOY ATTEMPT 1 FAILED; NOTHING IS HALF-APPLIED (model measured EMPTY). <<<** `unknown option "prefer-ipv6"` on barbican. **The dry-run PASSED and the deploy did not** -- `--dry-run` does not validate config option NAMES. Measured plan is **56 apps / 108 relations**, not the 50/97 preflight still quotes.
+- **Root cause measured against CHARMHUB's own schema: 7 of 13 VIP charms declare `prefer-ipv6`, 6 do not**, and barbican never had it at ANY channel -- so R2's uniform application was never valid. **RULED: *"Research what those 6 charms do with v6 VIPs first (Recommended)"*** -- overlay NOT edited, R2 NOT amended. **STAGE 5 IS BLOCKED ON THAT RESEARCH.**
+- **FINDING, logged not fixed: `preflight.sh` is REGION-BLIND** -- 19 false negatives for dc0 ("not enrolled in MAAS") because it defaults to the Office1 profile. `MAAS_PROFILE=vr1-dc0-region` drops them to zero. A blanket refusal would be WRONG: dc1's nodes still live in Office1.
+- **Mutation testing earned its cost again:** a first pass proved less than it looked (deleting an assertion's MESSAGE only proves it exists), and the sharper pass found the `br-ex` static compare **could not fail**. Added a fixture, re-proved the kill.
+- **OWNED -- three instrument errors, all one shape:** a capture parsed at the wrong field, a `systemctl` poll racing an async start, and a charmhub query with a wrong field name returning a uniform "no config" across 13 charms. The last two were caught by the SHAPE of the answer being implausible, not by discipline; that detector is now in auto-memory.
+- Gauntlet **ALL GREEN (93)**; repo-lint 0 fail; creds-matrix 65/65. Permission allowlist +12 read-only rules (all pinned to check/verify/assert/plan subcommands).
+- **NEXT:** the prefer-ipv6 research, then re-deploy. Steps 1-3.5 and the controller are DONE and need no repeat. Body: `docs/changelog-20260730-dc0-node-carve.md` (11 items). Status ONLY in CURRENT-STATE.md.