diff --git a/docs/changelog-20260806-step34-g3-probe.md b/docs/changelog-20260806-step34-g3-probe.md
index 41958f1..6c19b09 100644
--- a/docs/changelog-20260806-step34-g3-probe.md
+++ b/docs/changelog-20260806-step34-g3-probe.md
@@ -146,3 +146,15 @@
 STILL OWED (dc0): start the VM -> MAAS enlist/commission/deploy Ubuntu -> carve .7 metal-admin
 (10.12.8.7) + provider-public (10.12.4.7 gw) -> install tailscale -> (Headscale join, deferred).
 REVERT: macs->[] restores the pre-pin map; `tofu destroy -target module.vr1_dc0_node["vr1-dc0-tailscale-01"]` removes the VM.
+
+## Item 9 -- dc1 substrate APPLIED FULL (region + tailscale VMs) + MACs pinned (gated)
+
+WHAT: operator-approved full dc1 apply (scope choice included the region VM): `tofu apply` (saved
+plan) -> "4 added, 0 changed, 0 destroyed" -- vr1-dc1-maas-01 (the region VM, authored 07-30 but
+never applied) AND vr1-dc1-tailscale-01 created, both powered off. MACs for BOTH captured (virsh
+domiflist, dc1 provider URI 172.31.0.6) and pinned in vr1_dc1_node_nics order, pre-enlistment.
+NOTE: standing up vr1-dc1-maas-01 is the FIRST step of the dc1 MAAS-region workstream (init /
+PostgreSQL / image sync / eventual node migration) -- the VM now exists; its setup is owed.
+STILL OWED (dc1): the region setup workstream; and for the tailscale VM the same start ->
+enlist/commission/deploy -> carve .7 -> install as dc0. Headscale join deferred (access).
+REVERT: macs->[] + `tofu destroy -target ...["vr1-dc1-maas-01"]` / ...["vr1-dc1-tailscale-01"].
diff --git a/opentofu/vr1-dc1-substrate/main.tf b/opentofu/vr1-dc1-substrate/main.tf
index 3b69445..1e61abe 100644
--- a/opentofu/vr1-dc1-substrate/main.tf
+++ b/opentofu/vr1-dc1-substrate/main.tf
@@ -183,7 +183,13 @@
     # at enlistment -- the region needs egress for image sync, and metal-admin alone leaves
     # it with no default route (the under-carve that cost three bootstrap attempts on the
     # dc0 controller VM on 2026-07-30).
-    "vr1-dc1-maas-01" = { vcpu = 4, mem = 8192, disk_gib = 150, macs = [] }
+    # MACs PINNED 2026-08-07 from measurement (`virsh domiflist vr1-dc1-maas-01` via the dc1
+    # qemu+ssh provider URI) immediately after the first apply, before enlistment. Order =
+    # vr1_dc1_node_nics. Libvirt-generated 52:54:00: (NOT the dc1 schematic scheme -- authored
+    # macs=[]). Identity values: change one and MAAS no longer knows the node.
+    "vr1-dc1-maas-01" = { vcpu = 4, mem = 8192, disk_gib = 150, macs = [
+      "52:54:00:ff:5c:02", "52:54:00:f8:0f:1a", "52:54:00:38:68:c4",
+    "52:54:00:a9:af:28", "52:54:00:ca:f3:ef", "52:54:00:fd:38:64"] }
 
     # ---- D-129(iii) AMENDMENT (RULED 2026-08-07): the DEDICATED per-DC TAILSCALE subnet router.
     # dc1's copy of the dc0 entry -- identical rationale (rulings a-d: dedicated VM at utility .7,
@@ -196,7 +202,11 @@
     # CARVE metal-admin 10.12.68.7 (the plane it ADVERTISES) AND provider-public 10.12.64.7
     # (gw 10.12.64.1 -- egress to Headscale); the other four legs stay uncarved. Non-overlapping
     # with dc0's 10.12.8.0/22 (Headscale has no 4via6 -- D-129(iii) amdt note 3).
-    "vr1-dc1-tailscale-01" = { vcpu = 2, mem = 2048, disk_gib = 25, macs = [] }
+    # MACs PINNED 2026-08-07 from `virsh domiflist vr1-dc1-tailscale-01` (dc1 provider URI),
+    # post-apply pre-enlistment, vr1_dc1_node_nics order.
+    "vr1-dc1-tailscale-01" = { vcpu = 2, mem = 2048, disk_gib = 25, macs = [
+      "52:54:00:f9:d6:df", "52:54:00:e3:1c:82", "52:54:00:4a:bb:9f",
+    "52:54:00:fc:82:83", "52:54:00:fd:a9:c8", "52:54:00:54:c4:01"] }
 
   }
 }