diff --git a/docs/security-ledger.md b/docs/security-ledger.md
index 8f7329f..581022d 100644
--- a/docs/security-ledger.md
+++ b/docs/security-ledger.md
@@ -18,6 +18,8 @@
 | SEC-007 | 2026-07-12 | `~/vr1-office1-creds/` on the jumphost holds the Office1 edge root password + its bcrypt hash + the `office1_svc` SSH PRIVATE key + (added 2026-07-13) the OPNsense **API key/secret** (`opnsense-api.txt`, 0600), all in plaintext (dir 0700, files 0600) | 2026-07-12 edge build; custody detail deliberately not recorded here per D-069 | operator | OPEN -- required for edge management (D-112(c) makes SSH the only management path), so this is a ROTATION obligation, not a delete-me. Rotate at v1 close / if the jumphost is rebuilt or shared |
 | SEC-008 | 2026-07-13 | `~/vr1-office1-creds/tailscale-authkey.txt` (vcloud, 0600) -- the operator's 48-char Tailscale auth key for the SELF-HOSTED control plane `tailscale.baldurkeep.com`. Used to enrol `office1-tailscale`. Consumed BY PATH and never printed into a session; the copy shipped to the node was SHREDDED after `tailscale up` (tailscaled holds its own node key now). | 2026-07-13 Office1 Tailscale enrolment; docs/vr1-office1-as-built.md | operator | OPEN -- ROTATION obligation, not a delete-me: the key is still on vcloud for re-enrolment. Revoke/reissue on the control server at v1 close, or immediately if vcloud is rebuilt or shared. |
 | SEC-009 | 2026-07-15 | Credential/env SPRAWL + world-readable exposure on vcloud: three env files sat loose in `~` outside the consolidated `~/vr1-office1-creds/` -- `.vr1-netbox.env` (upstream NetBox token), `vr1-office1.env` (edge root-password hash + SSH key path), and `vr1-stage1.env` which held `TF_VAR_maas_api_key` (a MAAS API secret) at mode **0664 (group/world-readable)**; `tailscale-authkey.txt` in the creds dir was also 0664. | docs/changelog-20260715-creds-consolidation.md | operator | **REMEDIATED 2026-07-15** -- all three moved into `~/vr1-office1-creds/`, every sensitive file `chmod 600`. STANDING CONVENTION established (below). Note: this is a CLOSED in-house test; the rotation obligations of SEC-005/006/007 still apply at v1 close, this row only closes the SPRAWL + PERMS exposure. |
+| SEC-010 | 2026-07-16 | **metal-admin DC-LOCAL invariant (D-052/D-100) is PRESERVED but NOT ENFORCED in the committed Stage-3 config.** The `vvr1_dc0` rack straddles metal-admin (10.12.8.0/22, DC-local) + the office1<->dc0 transit (crosses fiber). Its committed cloud-init pins static IPs only -- **no `net.ipv4.ip_forward=0` sysctl, no host firewall on the transit leg.** Cross-plane routing (metal-admin <-> the whole Office1 /22, bidirectional) is blocked ONLY by Ubuntu's distro default; the deferred MAAS-rack install could silently flip it. A MAAS rack proxies at the application layer and needs no kernel forwarding, so pinning is free. | 2026-07-16 plane-segregation review (advisor + 2 read-only agents); `opentofu/main.tf` vvr1_dc0 :376-439 | operator | **OPEN -- PRE-APPLY hardening.** Add `net.ipv4.ip_forward=0` (+ v6) via cloud-init `write_files`/`bootcmd` sysctl on the rack, and an nft/ufw rule pinning the transit leg to MAAS region ports only. Same pin must follow onto `voffice1` when its transit leg is wired (currently single-homed, so F1 is latent). Region route must target only the rack transit /30, never 10.12.8.0/22 (NetBox/region config, off-repo). Close BEFORE `tofu apply`. |
+| SEC-011 | 2026-07-16 | **Node least-connectivity gap (not an L2 breach).** Under D-121 Option C role separation, all 8 nodes get a uniform 6-plane NIC set, so a ceph-osd STORAGE node has a leg on provider-public (external/FIP) + data-tenant (tenant geneve) -- planes it never binds per D-052. Planes stay isolated L2 (no crosstalk), but it is unnecessary external attack surface that VR0's genuinely-hyperconverged all-6 node did not have. | 2026-07-16 plane-segregation review; `opentofu/main.tf` `local.vr1_dc0_node_nics` :320-352 | operator | **OPEN -- PRE-APPLY hardening.** Replace uniform 6-NIC with per-role NIC sets (storage/ceph-osd drops provider-public + data-tenant at minimum). Confirm the exact per-role plane set against the regenerated D-052 bundle bindings -- do NOT invent it. Attack-surface reduction; not blocking, but cheap to do before apply. |
 
 **STANDING CONVENTION (SEC-009, 2026-07-15): per-site credential/env consolidation.** ALL sensitive
 files AND environment/config files for a site live in a single `~/<site>-creds/` folder on vcloud,
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index d62e6ce..b87023b 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -124,6 +124,31 @@
 `docs/changelog-20260715-d120-load-and-iprange-tooling.md`.
 
 
+**PLANE-SEGREGATION REVIEW of the Stage-3 commit (2026-07-16; advisor + 2 read-only agents).**
+Reviewed the committed networking/plane changes (`a48a60f`, NOT applied) for crosstalk / segregation
+breaches. **VERDICT: no crosstalk, no active violation -- committed state is SAFE.** All six `vr1-dc0-*`
+planes + all three `mesh-*` legs are isolated L2 (measured: `net-dumpxml` shows no forward/ip/nat,
+isolation ENFORCED BY CONSTRUCTION in `dc-planes`/`mesh-link`); the edge is 2-NIC so it structurally
+cannot reach the 5 non-LAN planes; `vr1-dc0-wan` NAT touches only the edge WAN. metal-admin DC-LOCAL
+(D-052/D-100) is **preserved but not ENFORCED** -- it rests on unpinned host defaults. **Two pre-apply
+hardening items logged as SEC-010 (rack `ip_forward=0` + transit-leg firewall -- the one real
+plane-bridge) and SEC-011 (node role-scoped NIC sets -- least-connectivity).** Say plainly at handoff:
+"committed state is safe; two items to close before `tofu apply`." Plus three notes:
+- **FUNCTIONAL (fix before apply, not security):** the rack's committed route `to 10.10.0.0/22 via
+  <transit_peer>` points at a next-hop with **no VM attached** -- `voffice1` is single-homed
+  (`network_names = [office1-local]` only, main.tf:184), NOT on `mesh-vr1-dc0-office1`. As committed,
+  apply yields a rack routing to a nonexistent peer, and the Office1<->DC region path is not closed.
+  Either wire `voffice1`'s transit leg or gate the rack route until it exists.
+- **SEGREGATION CHECK (first boot):** the rack NIC->plane mapping (`enp1s0`->metal-admin,
+  `enp2s0`->transit) is assumed PCI-order==name; if swapped, the metal-admin /22 lands on the
+  Office1-facing wire. Verify via MAC (`virsh domiflist` x `network_names` order) before trusting
+  addressing. This is a segregation check, not cosmetic.
+- **DEFERRED (track):** the edge WAN<->provider-public firewall is post-boot REST (opnsense-api),
+  not in the commit -- "enforced by absence" covers plane REACHABILITY only, not full edge hardening.
+When `voffice1`'s transit leg is later wired it becomes an office1-local<->transit bridge and inherits
+the SAME `ip_forward=0` pin requirement (a richer surface than the rack: MAAS region + LXD host).
+
+
 **STAGE 3 IN PROGRESS (branch `dc-dc-stage3-phase2-dc-substrate`) -- two rulings landed 2026-07-15.**
 Walked the phase2 runbook and surfaced its blocking decisions; the operator ruled both:
 - **D-121 (ADOPTED IN PART).** VR1 makes the decorative single-unit control plane REAL: 14 services