diff --git a/docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md b/docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md
new file mode 100644
index 0000000..37de7fe
--- /dev/null
+++ b/docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md
@@ -0,0 +1,41 @@
+# 2026-07-17 -- office1-netbox apex recovery + restart policy + edge-WAN import (Block A)
+
+## Context
+
+Asked to run the D-124/edge-WAN NetBox imports while access was up, I found the **IPAM apex was DOWN**:
+the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited (0) ~3h earlier and was
+not auto-restarting (its instance was stopped/rebooted). Operator approved bringing it up + adding a
+restart policy.
+
+## What changed (on office1-netbox, 10.10.1.10 -- host state, NOT repo-tracked)
+
+- **Apex brought up:** `cd /opt/netbox-docker && sudo docker compose up -d` -> all 5 containers healthy;
+  NetBox answers HTTP 302 on `:8000`.
+- **Restart policy added:** `docker-compose.override.yml` now sets `restart: unless-stopped` on all five
+  services (netbox, netbox-worker, postgres, redis, redis-cache) -- verified via `docker inspect`. So the
+  apex survives its instance's reboots (incl. the upcoming bookend). Original override backed up on the
+  host as `docker-compose.override.yml.bak-20260717`. (Config `docker compose config`-validated before
+  apply.)
+
+## Apex writes (Block A -- gated, dry-run-verified then committed)
+
+- **`d115-office-carve.py` (dry-run):** all 11 objects already present (office+edge roles, site vr1-off1,
+  prefixes) -- no-op; edge-WAN precondition satisfied.
+- **`dc-edge-wan-import.py --commit`:** CREATED **172.30.2.0/24** (id=135, role=edge, scope=vr1-dc0) +
+  **172.30.3.0/24** (id=136, role=edge, scope=vr1-dc1). Re-run dry-run confirms both EXIST (0 to create).
+  Token read server-side (`sudo cat /root/netbox-secrets/api.token` ON the apex host) -- never entered
+  agent context. Sandbox target (localhost) -- no upstream write; `netbox.baldurkeep.com` untouched.
+
+## BLOCKED -- Block B (D-124 rack transit + rack IP)
+
+`dc-rack-mgmt-import.py` fails its precondition: **`role 'transit' absent`**. The D-124 transit role +
+the `172.31.0.0/24` container have **no seeder** (the importer is deliberately die-if-absent). Needs a
+`transit`-role + `172.31.0.0/24`-container seed first -- pending an operator decision on tooling (write a
+`d124-transit-seed` + harness, extend `d115-office-carve`, or defer -- Block B is decoupled from the
+deploy: no netbox provider in the tree).
+
+## Revert
+
+- Edge /24s: delete prefixes id=135,136 in NetBox (or `dc-edge-wan-import` has no un-import; delete via UI/API).
+- Restart policy: restore `docker-compose.override.yml.bak-20260717` + `docker compose up -d`.
+- Apex up/down is operational state, not a repo change.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 378b0e4..518712e 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -139,6 +139,16 @@
 `office1-opnsense` all return live from this session -- so the agent now HAS durable shell into Office1
 (load-bearing assumption confirmed: key read from config `IdentityFile`, no creds path in command, passes
 the guard/classifier). The systemd FORWARD layer stays reviewed-but-unexercised (not installed).
+**NetBox apex recovery + edge-WAN import (2026-07-17).** Found the IPAM apex DOWN (netbox-docker cleanly
+exited ~3h prior, no auto-restart). Brought it up (`docker compose up -d`, HTTP 302) + added
+`restart: unless-stopped` to all 5 services (survives the bookend reboot; override backed up on host).
+Block A COMMITTED: `dc-edge-wan-import` created 172.30.2.0/24 (vr1-dc0) + 172.30.3.0/24 (vr1-dc1), edge
+role. Token read server-side (never in agent context); sandbox-only (upstream untouched). **Block B
+(D-124 rack) BLOCKED:** `dc-rack-mgmt-import` dies on `role 'transit' absent` -- the transit role +
+172.31.0.0/24 container have NO seeder. Pending operator decision (write d124-transit-seed+harness /
+extend d115-office-carve / defer -- Block B is decoupled from the deploy). See
+`docs/changelog-20260717-netbox-apex-recovery-edge-wan-import.md`.
+
 **vcloud OS-UPDATE + REBOOT window (2026-07-16) -- IN FLIGHT; D-127 autostart policy recorded.**
 Operator patching the vcloud host during the open restart window (only Office1 VMs live, before the DC0
 build). D-127 RULED: voffice1 autostarts; office1-opnsense autostarts AFTER one verified post-fix cold boot
diff --git a/docs/vr1-office1-as-built.md b/docs/vr1-office1-as-built.md
index b0fb950..7ccf2cc 100644
--- a/docs/vr1-office1-as-built.md
+++ b/docs/vr1-office1-as-built.md
@@ -41,7 +41,7 @@
 | **vcloud** | `10.17.11.248` (lab), `10.10.0.10` on `virbr2`, `172.30.1.1` on `virbr11` | libvirt/KVM hypervisor; OpenTofu runs from here | L1 (itself a KVM guest) |
 | **office1-opnsense** | LAN `10.10.0.1` / WAN `172.30.1.2` | OPNsense 26.1 edge router: routing, NAT, **Kea DHCP**, firewall | L2 |
 | **voffice1** | `10.10.0.20` (Kea reservation) | **MAAS 3.7.2** region+rack + PostgreSQL 16.14; **LXD 5.21.5** (registered to MAAS as VM host `office1-lxd`) | L2 |
-| **office1-netbox** | `10.10.1.10` | **NetBox 4.6.4** (netbox-docker; Django 6.0.6) on `:8000` | L3 (LXD VM) |
+| **office1-netbox** | `10.10.1.10` | **NetBox 4.6** (netbox-docker; `/opt/netbox-docker`, `docker compose up -d`) on `:8000`; **`restart: unless-stopped`** on all 5 services (2026-07-17 -- survives instance reboot) | L3 (LXD VM) |
 | **office1-tailscale** | `10.10.1.11` / tailnet **`100.64.0.53`** (`fd7a:115c:a1e0::35`) | **Tailscale 1.98.8**, subnet router advertising `10.10.0.0/22`. Joined the **SELF-HOSTED** control plane `https://tailscale.baldurkeep.com:443` | L3 (LXD VM) |
 | ~~office1-gitbucket~~ | -- | **NOT BUILT -- AND WILL NOT BE (D-116).** `git.baldurkeep.com` remains the git service of record; new repos are created there as deployment tasks require. | -- |