diff --git a/docs/dc-dc-deployment-workflow.md b/docs/dc-dc-deployment-workflow.md
index 99ade64..6e89f96 100644
--- a/docs/dc-dc-deployment-workflow.md
+++ b/docs/dc-dc-deployment-workflow.md
@@ -155,7 +155,7 @@
 | **Gate** | `vvr1-dc0` up + sized + nested-KVM on (the rack IS `vvr1-dc0`, D-123); inner node VMs boot at depth-4 (D-114/D-123 boot gate); MAAS discovers them; edge routing + the D-125 per-DC ISP egress up (bridge-in isolation test passes); SEC-010 DC-LOCAL enforced; netem parameters applied and measured (D-100 gap #11, still unruled). |
 | **Owns** | D-103 (seam, as AMENDED by D-123 Model B), D-100 (edges), D-121 (node layout, R-3 = 9/DC), D-122 (site/edge shape), D-123 (Model B site-down + two-root), D-124 (rack transit), D-125 (per-DC ISP egress). |
 | **Reuse vs new** | NEW (no OpenTofu/multi-rack precedent in VR0 DC0). Explicitly tagged shim: node-VM creation has no Roosevelt analog (physical racking + BMC enlistment replaces it there) -- do not treat as reusable production IaC. |
-| **Authoring status** | **Runbook WRITTEN 2026-07-09: `runbooks/dc-dc-phase2-tofu-dc-substrate.md`.** DC1-first; DC2 explicitly hard-gated (D-101 supernet unassigned) rather than run with placeholders. Originally walked a set of STOP-gate decisions; most are now RULED (see the rulings summary below): node sizing = D-121/R-3, edge/WAN shape = D-122, site-down/placement = D-123 Model B, rack transit = D-124, ISP egress = D-125, edge-config delivery = D-113(a2) REST (config.xml/ISO retired -- no more `config.xml` tokens). STILL open at execution: MAAS zone/pool + `power_address` (Stage-4 concerns), boot-measured `WAN_IF`/`LAN_IF` (real OPNsense boot), and netem params (D-100 gap #11). NOT YET EXECUTED. The plane/link/pool layer of `opentofu/` (see Stage 1) is reusable here too. `modules/node-vm` (blank disk, PXE-boot), `modules/opnsense-edge`, and `modules/maas-vm-host` (registers the virsh host with MAAS via the official `canonical/maas` provider -- deliberately NOT `maas_vm_host_machine`; under Model B it targets `vvr1-dc0`'s inner virsh -> Office1 region, DOCFIX-179-deferred) all now exist AND are instantiated across the two Model B roots (D-123): the outer root (`opentofu/`) + the inner root (`opentofu/vr1-dc0-substrate/`), plus the new `modules/wan-bridge` (D-125). Both roots `tofu validate`. Remaining un-instantiated is deploy-time (MAAS zone/pool, `power_address`) not authoring. `modules/netem-link` gives the netem mechanism for this stage's edge gate too. See `opentofu/README.md`. |
+| **Authoring status** | **Runbook WRITTEN 2026-07-09: `runbooks/dc-dc-phase2-tofu-dc-substrate.md`.** vr1-dc0-first (D-119 naming); vr1-dc1 explicitly hard-gated (HELD, gate G12: transit/rack addressing unruled -- its v4 supernet 10.12.64.0/19 IS assigned by D-115, R3-F11 fix) rather than run with placeholders. Originally walked a set of STOP-gate decisions; most are now RULED (see the rulings summary below): node sizing = D-121/R-3, edge/WAN shape = D-122, site-down/placement = D-123 Model B, rack transit = D-124, ISP egress = D-125, edge-config delivery = D-113(a2) REST (config.xml/ISO retired -- no more `config.xml` tokens). STILL open at execution: MAAS zone/pool + `power_address` (Stage-4 concerns), boot-measured `WAN_IF`/`LAN_IF` (real OPNsense boot), and netem params (D-100 gap #11). NOT YET EXECUTED. The plane/link/pool layer of `opentofu/` (see Stage 1) is reusable here too. `modules/node-vm` (blank disk, PXE-boot), `modules/opnsense-edge`, and `modules/maas-vm-host` (registers the virsh host with MAAS via the official `canonical/maas` provider -- deliberately NOT `maas_vm_host_machine`; under Model B it targets `vvr1-dc0`'s inner virsh -> Office1 region, DOCFIX-179-deferred) all now exist AND are instantiated across the two Model B roots (D-123): the outer root (`opentofu/`) + the inner root (`opentofu/vr1-dc0-substrate/`), plus the new `modules/wan-bridge` (D-125). Both roots `tofu validate`. Remaining un-instantiated is deploy-time (MAAS zone/pool, `power_address`) not authoring. `modules/netem-link` gives the netem mechanism for this stage's edge gate too. See `opentofu/README.md`. |
 
 **State:** THE ACTIVE STAGE (identity: branch `dc-dc-stage3-phase2-dc-substrate`); status
 authority: docs/CURRENT-STATE.md sections 1 and 6. History: runbook written + reshaped to
diff --git a/docs/dc0-deploy-readiness.md b/docs/dc0-deploy-readiness.md
index 251024a..f922b04 100644
--- a/docs/dc0-deploy-readiness.md
+++ b/docs/dc0-deploy-readiness.md
@@ -94,12 +94,11 @@
 6. **Edge-WAN import** -- done 2026-07-17. `dc-edge-wan-import` created `172.30.2.0/24` + `172.30.3.0/24`
    (edge). (Also recovered the apex: netbox-docker was down; brought up + `restart: unless-stopped` added.)
 
-### C5. Record-hygiene sweep (NON-blocking; queued from the Stage-3 adversarial review)
-7. Sweep the queued amendments into `docs/design-decisions.md`: D-122 MAAS-bullet + site-down
-   wording, D-107 node-artifacts scoping + DR-claim honesty, D-121 Option-C disk record (the
-   `optc-calc.py` "reproducible" reference is to an ABSENT script -- fix or commit the calc; whole-host
-   math lives in `scripts/dc-dc-whole-host-budget.py`), D-115 status-line vs ledger-scan, SEC-011
-   reconsider (downgraded to OBSERVATION).
+### C5. Record-hygiene sweep -- RESOLVED (this queue was stale; R3-F disposition 2026-07-19)
+7. The queued amendments LANDED 2026-07-16 (review sweep Phase A/B,
+   `docs/changelog-20260716-review-sweep-phaseAB.md`): D-122/D-107/D-121/D-115/SEC-011 all
+   amended; the absent `optc-calc.py` replaced by committed `scripts/dc-dc-whole-host-budget.py`
+   (13/13). Residual R3-F items dispositioned in sweep Batch 2 item 2.10 (session changelog).
 
 ### C6. `vr1-dc1` -- HELD (do not attempt)
 No ruled dc1 transit/rack addressing (the `172.31.0.0/24` transit supernet is dc0-scoped), and no