diff --git a/opentofu/README.md b/opentofu/README.md
index 08bc8ce..7720c50 100644
--- a/opentofu/README.md
+++ b/opentofu/README.md
@@ -10,20 +10,40 @@
 for where every provider fact below was sourced from and the fetch
 methodology that worked -- read that first if extending any module here.
 
-**Status: STAGE-1 VALIDATED + APPLIED (2026-07-10); Stage 2/3 modules still
-UNVALIDATED.** First real `tofu` run: 2026-07-10 on the vcloud host (OpenTofu
-v1.12.3), executing `runbooks/dc-dc-phase0-vcloud-prep.md`. The root module +
-the four Stage-1 module types (`dc-planes`, `dc-storage-pool`, `mesh-link`,
-`office1-network`) passed `tofu init`/`validate`/`plan` and were `apply`-ed
-clean (13 libvirt objects, all MTU 9000). Two fixes were required (DOCFIX-179):
-per-module `required_providers` (child modules do NOT inherit provider SOURCE
-mapping -- without their own `versions.tf`, OpenTofu infers `hashicorp/libvirt`,
-which does not exist), and `tofu fmt -recursive`. The root `provider "maas"`
-block was also deferred to Stage 3 (it forced Stage 1 to supply a sensitive key
-for zero MAAS resources). STILL UNVALIDATED -- the modules not yet instantiated
-from root: `node-vm`, `base-image`, `cloudinit-vm`, `opnsense-edge`,
-`maas-vm-host`, `netem-link` (Stage 2/3). Re-run before trusting those, on a
-machine with the binary + provider-registry access:
+> ## !!! STATUS RECONCILED 2026-07-16 -- READ THIS FIRST; the per-module prose below predates the D-123 Model B reshape + D-113(a2) and parts are STALE or (config.xml/ISO) DANGEROUS !!!
+>
+> - **TWO ROOTS now (D-123 Model B).** The DC substrate is split: the OUTER root (this dir,
+>   `opentofu/`, vcloud provider) boots + sizes the containment VM `vvr1-dc0` + the transit + the
+>   **D-125** vcloud ISP uplink (`vr1-dc0-uplink`); the INNER root (`opentofu/vr1-dc0-substrate/`,
+>   provider = `qemu+ssh` to `vvr1-dc0`, R-5) builds the DC fleet INSIDE it -- **9 node VMs** (3+2+4,
+>   D-121/R-3), the 6 planes, the OPNsense edge, the inner pool, and `vr1-dc0-wan`. A gated BOOTSTRAP
+>   (`scripts/site-headend-install.sh --host-nodes`) sits between. **Both roots `tofu validate`;**
+>   `scripts/opentofu-validate.sh` (S3) validates EVERY module standalone. NOT YET APPLIED beyond Stage 1.
+> - **Modules ADDED since the "Built" list below was written:** `site-wan` (per-site ISP NAT, D-122)
+>   and `wan-bridge` (the D-125 bridge-in WAN segment) -- both are MISSING from that list.
+> - **INSTANTIATED (contradicts several "not instantiated" claims below):** `cloudinit-vm` + `base-image`
+>   (voffice1, vvr1-dc0, `ubuntu_noble_base`), `node-vm` (9/DC, inner root),
+>   `dc-planes`/`site-wan`/`wan-bridge`/`opnsense-edge` (inner root). Node sizing is RULED (D-121/R-3),
+>   not "a decision that hasn't been made."
+> - **DANGER -- the OPNsense `config.xml` + config-ISO path described below is DELETED; do NOT run it.**
+>   `templates/opnsense-config.xml.tmpl`, `scripts/opnsense-build-config-iso.sh`, and
+>   `scripts/opnsense-render-config.sh` are GONE (D-112: the Importer can never fire on a nano image;
+>   D-113(a2): edge config is the REST API, `scripts/opnsense-api.sh`). A full `config.xml` push would
+>   CLOBBER the live Office1 edge's API-managed state. The `opnsense-edge` module dropped
+>   `config_iso_path`/`config_seed`.
+> - **GitBucket is OUT of scope (D-116)** wherever this doc lists it as an Office1 service VM.
+>
+> Treat the design-decisions ledger (D-103/D-113/D-116/D-121..D-125) + the actual tree as authoritative
+> where the per-module prose below disagrees; that prose is kept for its provider-research value, not as
+> current instantiation state.
+
+**Stage-1 history (still true):** first real `tofu` run 2026-07-10 on the vcloud host (OpenTofu
+v1.12.3), executing `runbooks/dc-dc-phase0-vcloud-prep.md`. The root module + the four Stage-1 module
+types (`dc-planes`, `dc-storage-pool`, `mesh-link`, `office1-network`) passed `init`/`validate`/`plan`
+and were `apply`-ed clean (13 libvirt objects, all MTU 9000). DOCFIX-179 fixes: per-module
+`required_providers` (child modules do NOT inherit provider SOURCE mapping -- without their own
+`versions.tf`, OpenTofu infers `hashicorp/libvirt`, which does not exist) + `tofu fmt -recursive`.
+Re-validate on a machine with the binary + provider-registry access:
 
 ```
 bash scripts/opentofu-validate.sh
@@ -65,7 +85,7 @@
   Linux cloud images) -- check that specifically before assuming this module
   covers OPNsense too. Neither module instantiated in root `main.tf` yet: no
   image source has been chosen for any Office1 service VM.
-- `modules/opnsense-edge` (2026-07-09) -- one OPNsense edge VM per call, using
+- **[SUPERSEDED -- see the STATUS banner: the config-ISO/`config.xml` path below is DELETED and DANGEROUS; the module dropped `config_iso_path`, and edge config is the REST API (D-112/D-113(a2)). The paragraph is kept only for the Importer research.]** `modules/opnsense-edge` (2026-07-09) -- one OPNsense edge VM per call, using
   OPNsense's own Configuration Importer (NOT cloud-init -- see the dedicated
   research section below) via a plain ISO9660 volume containing
   `/conf/config.xml`, attached as a secondary cdrom disk -- mechanically
@@ -79,7 +99,7 @@
   their harnesses only test the guard-clause paths, not the real
   download/convert/build behavior; see each script's header. `config_iso_path`
   has no default. Not instantiated in root `main.tf`.
-- `templates/opnsense-config.xml.tmpl` + `scripts/opnsense-render-config.sh`
+- **[DELETED FILES (D-113(a2)) -- `templates/opnsense-config.xml.tmpl` and `scripts/opnsense-render-config.sh` no longer exist; retained below as historical design notes only. Do NOT render/push a full config.xml -- it clobbers the live edge.]** `templates/opnsense-config.xml.tmpl` + `scripts/opnsense-render-config.sh`
   (2026-07-09) -- the actual `config.xml` DESIGN, not just the mechanism:
   a `{{TOKEN}}`-parameterized template built from OPNsense's own real,
   currently-shipped `config.xml.sample` (confirms the LAN/WAN role is set