diff --git a/docs/dc0-deploy-readiness.md b/docs/dc0-deploy-readiness.md
index e6583b9..ec75287 100644
--- a/docs/dc0-deploy-readiness.md
+++ b/docs/dc0-deploy-readiness.md
@@ -5,6 +5,17 @@
 deployment from here. **Nothing has been applied** -- the outer `tofu apply` is the first mutation
 and is operator-gated. `vr1-dc1` is HELD (no ruled addressing; see below), DC0 only.
 
+> **STATUS 2026-07-17: PREP COMPLETE -- DC0 IS DEPLOY-READY.** Final gate re-checked: opentofu-validate
+> clean (both roots + 12 modules), the four `vr1_dc0_rack_*` + `vr1_dc0_ssh_pubkey_path` tfvars in place,
+> `creds-audit vr1-dc0` CLEAN, gauntlet ALL GREEN (65), repo-lint 0-fail. Per-env-key (D-126 option a)
+> DONE; netem = placeholder (deploy-time, Step 11). The ONLY remaining items are NOT prep: (1) the final
+> **bookend restart** -- OS patch + reboot of vcloud + voffice1 + office1-opnsense, done together as the
+> boundary into the new session (voffice1 is load-bearing like vcloud -- it hosts netbox/MAAS + the only
+> netbox path, so it defers WITH vcloud, not mid-prep); (2) fresh-session start = re-verify the plan
+> (state drifts after a reboot -- VMs stop) + open a logged shell + gated outer apply. Decoupled hygiene
+> (NetBox D-124/edge-WAN import; the Stage-3 record sweep) is OPTIONAL and can run anytime -- it does NOT
+> gate the deploy (no netbox provider in the tree).
+
 ---
 
 ## A. Readiness ESTABLISHED (done, verified this session)
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index e005b22..378b0e4 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -150,7 +150,11 @@
 autostart only AFTER clean-startup confirmed); (4) optionally set `boot.autostart` on the LXD service VMs
 inside voffice1. Then resume DC0 readiness (`docs/dc0-deploy-readiness.md`).
 
-**DC0 DEPLOY READINESS (2026-07-16) -- at the outer-apply gate; see `docs/dc0-deploy-readiness.md`.**
+**DC0 DEPLOY READINESS -- PREP COMPLETE 2026-07-17 (deploy-ready). See `docs/dc0-deploy-readiness.md`.**
+Final gate re-checked clean (validate, tfvars, creds-audit vr1-dc0 CLEAN, gauntlet 65, lint 0-fail).
+Remaining is NOT prep: the bookend restart (vcloud + voffice1 + opnsense patch/reboot together -- voffice1
+is load-bearing like vcloud) + fresh-session (re-verify plan post-reboot + logged shell + gated outer
+apply). Decoupled hygiene (NetBox import; Stage-3 record sweep) is OPTIONAL, does not gate the deploy.
 Stage-3 Phase-2 DC0 is EXECUTABLE (D-121..125 ADOPTED, R-1/R-2/R-3 ruled, tfvars in, opentofu-validate
 clean). Outer-root `tofu plan` RUN + VERIFIED SAFE: 5 add (`vvr1-dc0` 416GiB/108vcpu + D-125 uplink) /
 0 change / 6 destroy (the six EMPTY vr1-dc0 planes relocating to the inner root -- verified 0 leases/0