diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index ec15f12..10b8375 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -248,3 +248,18 @@
 - **AS-EXECUTED LOG IS PARTIAL** -- the classifier refused several `script -aqe` wrapped forms; index row says so (F6). A log that looks complete is worse than one declaring its gap.
 - **NEXT:** recreate topology on the new region -> DHCP handover (two servers on one segment is the hazard) -> re-enrol/re-commission 9 nodes -> re-apply statics/br-ex/tags -> re-point Juju at `10.12.8.6:5240`. dc1's region VM authored, NOT applied. Start with fresh context: the destructive half is nine nodes.
 - Sweep: `docs/audit/queued-findings-20260730-stage5.txt` (F1-F12). Bodies: `docs/changelog-20260730-stage5-open.md`. Status ONLY in CURRENT-STATE.md.
+
+## SESSION CLOSE 2026-07-30 (part 4) -- dc0 region topology BUILT 40/0; cutover BLOCKED on a permission wall (bounded, GA-R4)
+
+- Branch `dc-dc-stage5-preconditions`, **8 commits** pushed (`0ec9c97..b1afa42`). NO stage opened/closed. Scan unchanged: 3 decisions, SEC 23, D 139 / DOCFIX 206 / BUNDLEFIX 053.
+- **STAGE 5 REMAINS BLOCKED** -- now on the DHCP cutover, refused by the harness classifier and NOT retried in an altered shape. Exact 4-command sequence, every parameter re-resolved live, is in `changelog-20260730-dc0-region-migration.md` item 10. **NOTHING half-applied** (Office1 verified read-only still `dhcp_on=True primary_rack=7chphy`).
+- **NEW dc0 REGION TOPOLOGY LIVE: `dc-region-topology.sh check` = 40 assertions / 0 failed, EXIT 0.** 5 named plane fabrics, 6 spaces, 6 v4 subnets + gateways, 6 VLAN->space bindings, site tag, metal-admin dns/dynamic range. Power key installed + proven (9/9, real virsh enumerating 12 domains -- the snap ssh dir did not exist at all, so commissioning could not have powered a node on).
+- **THREE TOOLS THE REPO NEVER HAD:** `maas-profile-assert.sh` (region identity by RACK IDENTITY -- a machine count is not proof), `maas-region-power-key.sh`, `dc-region-topology.sh`. A survey found the named fabrics, v4 subnets and site tag were built AD-HOC in the Stage-4 window, logged only to an as-executed file NOT in the repo -- there was nothing to re-run. dc1 now rebuilds from tools.
+- **I INTRODUCED A DEFECT THAT PASSED MY OWN GATE 39/39.** The first apply CREATED the provider-public fabric and MOVED the subnet; MAAS does not bring interface links along, leaving the region VM's `enp2s0` on a subnet-less VLAN -- the same under-carve class that cost three bootstrap attempts. Live connectivity was unaffected so nothing flagged it. Fixed live + in the tool (RENAME, never move) + in the gate (stranded-link assertion).
+- **A GATE WAS ALREADY RED AT HEAD:** `tests/node-vm` T8/T9 (11/66 vs assertions reading 10/60) -- commits `086c827`+`447315f` added the region VMs and the gauntlet was never re-run. PROVEN pre-existing by stashing this session's work. Re-pointed to the new invariant.
+- **NEARLY RECORDED A FALSE FINDING:** a `+time=3 +tries=1` probe said the new region's BIND could not resolve externally, which would have forced keeping the cross-fiber DNS dependency. Cold-cache timeout; at `+time=5 +tries=3` it resolves everything. Node DNS now points at the DC-local `10.12.8.6`.
+- **MEASURED, load-bearing:** VLAN row id 5005 is dc0 metal-admin in Office1 and `vr1-dc0-data-tenant` in the new region; `hot-kid` is `c3aqh8` there and `tw7ptw` in Office1. Ids do not cross regions. NIC->plane order recorded in `lib-hosts.sh` and is NOT `PLANE_CIDRS` order (walking that positionally strands PXE on provider-public).
+- **`dc-node-v6-carve.py` FIXED, not just noted** -- it was env-blind (`export MAAS_PROFILE` silently hit OFFICE1) and tracebacked on an absent CLI. Harness 14/14.
+- **DELIBERATELY NOT WRITTEN: `dc-node-carve.sh`** (60 NIC re-homes + 9 `br-ex` + 54 statics). Both defects found today were caught by LIVE runs, not fixtures, and it cannot be exercised until the nodes are re-enrolled. Its two hard inputs are now settled and recorded.
+- **OWED:** wire `maas-profile-assert.sh` into `dc-plane-ipam.sh` / `maas-role-tags.sh` / `maas-node-power.sh` (all still default to `admin`, where dc1's nine nodes live); rack DNS forwarder upstream; remove the `vr1-dc0-region` profile from voffice1 (SEC-026) and Office1's dc0 power-key copy.
+- Gauntlet **ALL GREEN (92)**; repo-lint 0 fail. AS-EXECUTED LOG NOT USED -- `run-logged.sh` needs an interactive shell; captures went to `docs/audit/*` and this is declared. Body: `docs/changelog-20260730-dc0-region-migration.md`. Status ONLY in CURRENT-STATE.md.