diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 6f63b0a..e5f408d 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -2509,7 +2509,20 @@
   one must be AUTHORED. And **no gate compares D-139's family matrix or GUA table to any
   artifact**; `dc-node-v6-verify.sh`'s own header says it asserts NIC-against-MAAS and
   explicitly NOT against the ruled table, so this drift class has no detector.
-  **STILL OWED BEFORE THE DEPLOY, in ruled order:** D-139 step 1 (apex CREATE-only push,
+  **>>> D-139 STEP 1 IS DONE: THE APEX CARVE IS PUSHED FOR vr1-dc0, 2026-08-01. <<<** Capture
+  `docs/audit/d139-step1-apex-push-dc0-20260801.txt`. `netbox/d139-gua-carve.py --dc vr1-dc0
+  --commit` exit 0, `CREATE 13 | EXISTS 3 | RETIRE-REPORT 9`, `READ-BACK: 13/13 present`,
+  `errors=0`. **VERIFIED INDEPENDENTLY, not on the tool's own word** -- a separate API query
+  reads **apex prefix count 139 -> 152 (exact)** and **17 GUA rows scoped `vr1-dc0`** (4
+  pre-existing + 13 new), roles correct throughout: `:20::/60,:20::/64` metal-admin,
+  `:21::/64` metal-internal, `:30::` data-tenant, `:40::` storage, `:50::` replication,
+  `:80::` lbaas-mgmt, **`:f0::/60,:f0::/64` oob**. **NOTHING WAS DELETED OR ORPHANED: the 9
+  ULA prefixes are still present and all 26 ULA VIP legs still resolve** -- the tool has no
+  delete path, and the retirement remains step 6. **SCOPE, so no one reads more into it: this
+  writes PREFIXES into the apex ONLY.** No MAAS subnet, no node address and no VIP was
+  created, moved or deleted; steps 2 and 3 are outstanding. **`vr1-dc1` has NOT been pushed**
+  -- the two DCs are separately approved.
+  **STILL OWED BEFORE THE DEPLOY, in ruled order:** ~~D-139 step 1~~ DONE (apex CREATE-only push,
   `netbox/d139-gua-carve.py --dc vr1-dc0 --commit`; tool built, independently reviewed,
   dry-run byte-identical, `--commit` never yet passed), step 2 (MAAS GUA `/64`s alongside the
   ULA), step 3 (node v6 re-carve WHILE v4 IS STILL PRESENT -- `dc-node-v6-carve.py` pivots on
diff --git a/docs/audit/d139-step1-apex-push-dc0-20260801.txt b/docs/audit/d139-step1-apex-push-dc0-20260801.txt
new file mode 100644
index 0000000..cede56b
--- /dev/null
+++ b/docs/audit/d139-step1-apex-push-dc0-20260801.txt
@@ -0,0 +1,35 @@
+d139-step1-apex-push-dc0-20260801.txt
+======================================
+D-139 execution STEP 1 -- apex CREATE-only push, vr1-dc0. EXECUTED 2026-08-01.
+Tool: netbox/d139-gua-carve.py --dc vr1-dc0 --commit   (exit 0)
+Apex: office1-netbox http://10.10.1.10:8000 (the WORKING VR1 apex, DOCFIX-195).
+Host: vcloud. Operator-approved ("Work through the open items in order").
+
+PRE-WRITE, verified immediately before the mutation:
+  apex prefix count                       139
+  dry-run prefix set vs the reviewed capture (docs/audit/d139-carve-dryrun-20260801.txt)
+                                          IDENTICAL for the 11 originally-reviewed rows
+  the 2 OOB rows are NEW since that review -- added by the 2026-08-01 ruling, covered by
+  harness T07/T08/T12/T17 and mutation-proven (removing them turns T07 + both T08 red).
+
+TOOL RESULT: CREATE 13 | EXISTS 3 | RETIRE-REPORT 9;  READ-BACK: 13/13 present; errors=0.
+
+INDEPENDENT READ-BACK (not the tool's own word -- a separate API query):
+  apex prefix count                       152   (139 + 13, exact)
+  GUA rows scoped vr1-dc0                 17    (4 pre-existing + 13 new)
+    :20::/60 :20::/64   role=metal-admin
+    :21::/64            role=metal-internal
+    :30::/60 :30::/64   role=data-tenant
+    :40::/60 :40::/64   role=storage
+    :50::/60 :50::/64   role=replication
+    :80::/60 :80::/64   role=lbaas-mgmt
+    :f0::/60 :f0::/64   role=oob            <- the 2026-08-01 OOB ruling
+  ULA prefixes still present               9     (the tool has NO delete path)
+  ULA VIP legs still present               26    (nothing orphaned)
+
+WHAT THIS DOES NOT DO, stated so no one reads more into it: it writes PREFIXES into the
+apex only. No MAAS subnet, no node address, no VIP was created, moved or deleted. Steps
+2 (MAAS GUA /64s alongside the ULA) and 3 (node v6 re-carve while v4 is still present)
+remain outstanding, and the ULA retirement is step 6.
+
+vr1-dc1 has NOT been pushed -- the two DCs are separately approved.