diff --git a/docs/changelog-20260714-d119-tofu-apply.md b/docs/changelog-20260714-d119-tofu-apply.md
new file mode 100644
index 0000000..60d29f1
--- /dev/null
+++ b/docs/changelog-20260714-d119-tofu-apply.md
@@ -0,0 +1,43 @@
+# 2026-07-14 -- D-119 OpenTofu rename APPLIED (operator-gated destroying apply)
+
+The `tofu apply` deferred by the D-119 commit. Executed after explicit operator authorization.
+
+## Pre-apply discipline (verify before mutate)
+
+A LIVE re-check immediately before the apply (not the earlier measurement):
+
+    dc1-* / mesh-dc* networks   -> 0 DHCP leases each
+    dc1-pool / dc2-pool         -> 0 volumes each
+    every libvirt domain        -> none references a dc1-*/mesh-dc* network
+
+Then a fresh `tofu plan`: **11 to add, 0 to change, 11 to destroy** -- all `must be replaced`
+(the `moved{}` blocks). Confirmed empty, so the replace is safe (standing lesson 2: an apply
+touching a live libvirt object's devices is an outage -- none of these carried anything).
+
+## Result
+
+    Apply complete! Resources: 11 added, 0 changed, 11 destroyed.
+
+Verified ON THE HOST, not just in state:
+- state holds all 11 under `vr1_dc0_*` / `vr1_dc1_*` / `mesh_vr1_*`;
+- `tofu plan` -> **"No changes"** (repo/state back in sync);
+- libvirt shows `vr1-dc0-{provider-public,metal-admin,metal-internal,data-tenant,storage,replication}`,
+  `mesh-vr1-dc0-office1`, `mesh-vr1-dc0-vr1-dc1`, `mesh-vr1-dc1-office1`, `vr1-dc0-pool`, `vr1-dc1-pool`;
+- ZERO old `dc1-*`/`dc2-*`/`mesh-dc*` network or pool names remain.
+
+## No collateral
+
+Office1 was never in the plan and is untouched: `office1-local`, `office1-wan`, `wan`, the
+`office1-opnsense` edge and `voffice1` all present; edge (10.10.0.1) and voffice1 (10.10.0.20)
+both reachable after the apply.
+
+## Why this went before Stage 3
+
+Carrying divergent repo/state into Stage 3 would let a Stage-3 `tofu apply` silently bundle this
+11-resource rename with real DC provisioning. Applying it now, while the objects are empty, kept
+the rename a clean standalone change.
+
+## Revert
+
+The `moved{}` blocks are symmetric; reverting the D-119 code commit and re-applying renames back.
+There is nothing to preserve in these objects (they are empty), so a revert is a pure rename.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index ccd376f..d8d90f8 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -60,12 +60,13 @@
   (gw 172.30.1.1). Routing + automatic NAT, egress 0.0% loss, 8 LAN pass rules in pf, serial
   console + getty alive, and `kea-dhcp4` serving DHCP on udp/67 (subnet 10.10.0.0/24, pool
   .100-.199). **DHCP is API-MANAGED (D-113(a2)).**
-- **OpenTofu repo/state DIVERGED BY D-119 (2026-07-14), APPLY GATED.** `tofu plan` now shows
-  **11 to add, 0 to change, 11 to destroy** -- the DC module/object renames (`dc1_*`->`vr1_dc0_*`,
-  `dc2_*`->`vr1_dc1_*`). Every replaced object is EMPTY (measured; Stage 3 hasn't run), and Office1's
-  live objects are NOT in the plan. `moved{}` blocks make it read as clean replacements. This is a
-  DESTROYING apply and is operator-gated -- do it BEFORE any Stage 3 `tofu apply`, so Stage 3 does not
-  silently bundle the rename. tofu v1.12.3; tree validates (10/10 modules); lock committed.
+- **OpenTofu repo/state back IN SYNC -- D-119 rename APPLIED (2026-07-14, operator-gated).**
+  `tofu apply`: **11 added, 0 changed, 11 destroyed**; `tofu plan` now reports "No changes". Verified
+  on the host: six `vr1-dc0-*` networks, three `mesh-vr1-*` links, `vr1-dc0-pool`/`vr1-dc1-pool`; ZERO
+  old `dc1-*`/`dc2-*`/`mesh-dc*` names remain. Pre-apply LIVE re-check confirmed all 11 objects empty
+  (0 leases, 0 volumes, no domain attached). Office1 (`office1-local`/`office1-wan`/`wan`/edge/
+  `voffice1`) was NOT in the plan and is untouched -- edge + voffice1 still reachable post-apply.
+  tofu v1.12.3; tree validates (10/10 modules); lock committed.
 - **VR0 / DC0 testcloud:** fleet fully current (juju 3.6.25, 91 agents); D-011 CLOSED except
   item 6 (manual unseal, blocked on SEC-003). devteam is a live tenant running their own
   cluster. No beta cluster, no foil tenant, no orphan trustees (see State facts).