diff --git a/docs/dc0-deploy-readiness.md b/docs/dc0-deploy-readiness.md
index ac91ea0..28dc527 100644
--- a/docs/dc0-deploy-readiness.md
+++ b/docs/dc0-deploy-readiness.md
@@ -104,6 +104,59 @@
 
 ---
 
+## BOOKEND -- vcloud HOST patch + reboot (run BEFORE section D)
+
+Closes the last bookend item: patch the vcloud host and reboot onto kernel **6.8.0-136** (the guests
+already run -136; the host lags at -134). Measured 2026-07-17: `-136` is PENDING in apt but NOT installed,
+no `reboot-required` flag -- so a bare reboot gains nothing; the kernel must be `apt`-installed first.
+Pending set is `linux-*-generic` (-134->-136) + `libntfs-3g89t64 ntfs-3g linux-libc-dev linux-tools-common
+tar ubuntu-pro-client{,-l10n}` -- **no qemu/libvirt**, so no hypervisor upgrade to complicate guest bring-up.
+
+Preconditions / rationale:
+- **Remote Control attached + all decisions done FIRST** -- Step 4 (`sudo reboot`) ENDS the running session.
+- `voffice1` + `office1-opnsense` are BOTH `autostart=enable` (set 2026-07-17, edge after its verified cold
+  boot) -- so the host reboot self-recovers them. LXD `boot.autostart=true` on netbox+tailscale inside voffice1.
+- `libvirt-guests` is enabled+active (default `ON_SHUTDOWN=suspend` = managedsave). Step 3 explicitly
+  `virsh shutdown`s the guests first so the reboot exercises the verified **cold-boot autostart** path
+  (not managedsave-restore). Ordered to patch with VMs UP; quiesce only for the reboot.
+
+```bash
+# Run ON vcloud. Steps 2-4 are gated/sudo; STEP 4 ENDS THIS SESSION.
+
+# STEP 0  preflight / baseline (read-only)
+uptime; uname -r; virsh list --all; free -g
+
+# STEP 1  refresh lists + confirm the plan (read-only)
+sudo apt update
+apt list --upgradable 2>/dev/null            # expect linux-*-generic -134 -> -136 + ~7 pkgs
+sudo apt-get -s full-upgrade | tail -20      # dry-run: review before committing
+
+# STEP 2  install upgrades (guests stay UP; no reboot yet)
+sudo apt full-upgrade -y
+dpkg -l 'linux-image-6.8.0-136-generic' | grep '^ii' && echo "kernel -136 INSTALLED (pending reboot)"
+cat /var/run/reboot-required 2>/dev/null
+
+# STEP 3  gracefully quiesce guests (cold-boot path)
+virsh shutdown voffice1                        # cascades: LXD stops netbox + tailscale cleanly
+virsh shutdown office1-opnsense
+for d in voffice1 office1-opnsense; do virsh domstate $d; done   # wait until BOTH "shut off"
+
+# STEP 4  reboot the host  (THIS ENDS THE SESSION)
+sudo reboot
+```
+
+Post-reboot verify (this feeds section D step 1; autostart should have restored everything):
+```bash
+uname -r                                        # expect 6.8.0-136-generic
+virsh list --all                                # voffice1 + office1-opnsense running (autostart)
+ssh voffice1 'ping -c2 10.10.0.1; ping -c2 -I 10.10.0.20 1.1.1.1'          # edge LAN + egress
+ssh office1-netbox 'curl -s -o /dev/null -w "netbox=%{http_code}\n" http://localhost:8000/'
+ssh office1-tailscale 'tailscale status | head -1'
+```
+After this lands the host is on -136 (matching the guests) and the bookend is CLOSED -> proceed to section D.
+
+---
+
 ## D. Fresh-session bootstrap (start the deployment cleanly)
 
 1. `git pull` ; `bash scripts/repo-lint.sh` (0 fail; 1 legacy WARN) ; `bash scripts/run-tests-all.sh`.