diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 6091ae3..c651f32 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -30,36 +30,31 @@
 <!-- SECTION: machine-derived | OWNER: ledger-scan (regenerate; never hand-edit) -->
 ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)
 
-_Re-seeded from the 2026-07-15 scan. Re-run `bash scripts/ledger-scan.sh` to refresh._
+_Re-seeded from the 2026-07-17 scan. Re-run `bash scripts/ledger-scan.sh` to refresh._
 
 - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt -- 1.16 ruled OUT
   per amendment; the off-EOL-1.8.8 path remains OPEN), D-071 (routine update cadence + Juju
   controller patch policy -- AMENDED, still PROPOSED, awaiting operator ratification; gated on
   the pre-DC-DC controller HA/backup session).
-- **OPEN security rows:** SEC-001, SEC-003, SEC-004, SEC-005, SEC-006, SEC-007, **SEC-008**.
-  (SEC-008 -- the vcloud re-enrolment key -- was MISSING from the prior block.)
-- **Next-free numbers:** D = **125**, DOCFIX = 196, BUNDLEFIX = 013.
-  (D-124 PROPOSED 2026-07-16: the Office1-region<->DC-rack management overlay addressing -- numbers the
-  office1<->dc0 mesh leg so the D-123 rack can reach the MAAS region. metal-admin stays DC-local (D-100);
-  the rack straddles metal-admin (nodes) + the mesh (region). Operator rules scheme A (transit /30-31) vs
-  B (metal-admin routed) + rack sizing; then NetBox assigns + the headend wires.)
-  (2026-07-15: D-121, D-122, D-123 assigned -- next-free advanced D 121->124. D-121 ADOPTED (node
-  layout = Option C; vault sub-ruling RESOLVED = v-a). D-122 ADOPTED (site shape + 2-NIC fabric-routed
-  edge). **D-123 ADOPTED Model A** (nodes vcloud-level; site-down = destroy the vr1-dc0-* group). MAAS
-  model RULED: region on Office1 + rack controller per DC (vvr1-dc0 = vr1-dc0 rack, proxies images from
-  the region). REMAINING (genuine Stage-4 design, NOT invented): the rack<->region management-overlay
-  ADDRESSING -- the office1<->dc0 mesh leg has no assigned L3 and the rack needs static IPs on mesh +
-  metal-admin. A NetBox D-101-family addressing pass owned by dc-dc-phase3; vvr1-dc0 + maas-vm-host stay
-  HELD until it lands.)
+- **OPEN security rows:** SEC-001, SEC-003, SEC-004, SEC-005, SEC-006, SEC-007, SEC-008, **SEC-010**.
+  (New since last re-seed: **SEC-010** -- the rack transit-leg FORWARD-drop artifact -- is COMMITTED
+  but stays OPEN until applied + verified on vvr1-dc0. SEC-008 -- the vcloud re-enrolment key --
+  carried over.)
+- **Next-free numbers:** D = **128**, DOCFIX = 196, BUNDLEFIX = 013.
+  (Since the last re-seed D-121..127 all ADOPTED. Load-bearing correction to the prior block:
+  **D-123 = Model B** (nodes nest INSIDE `vvr1-dc0`; site-down = one `virsh destroy vvr1-dc0`) via
+  operator ruling R-1 2026-07-16 -- this SUPERSEDES the earlier "D-123 Model A" this block used to
+  record. Also: D-124 transit addressing PINNED (172.31.0.0/24) + imported to office1-netbox; D-125
+  bridge-in single-NAT uplink; D-126 durable rootless site access; D-127 IaC autostart matrix. The
+  Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned.)
 - **Standing numbering rule:** never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN)
-  ABOVE the real high-water mark anywhere in `docs/` or `runbooks/` prose -- `ledger-scan` reads
-  prose and a decoy token inflates the next-free counter. This has bitten twice.
-- **KNOWN `ledger-scan` DEFECT (found 2026-07-14, logged not fixed):** the scan reports **D-115 as
-  PROPOSED/OPEN. It is not -- D-115 is ADOPTED.** The scan matches the words "PROPOSED/OPEN"
-  anywhere in an entry's prose, and D-115's Status line reads "ADOPTED ... Originally PROPOSED/OPEN
-  the same day". It should read the `**Status:**` line, not the body. This is the *status* twin of
-  the decoy-token rule above. **Until it is fixed, do not trust the scan's PROPOSED/OPEN list
-  without checking the Status line.** D-115 is the only current false positive.
+  ABOVE the real high-water mark anywhere in `docs/` or `runbooks/` prose -- historically a decoy
+  token in prose inflated the next-free counter (hardened in DOCFIX-174); the authoring discipline
+  stands regardless.
+- **`ledger-scan` D-115 false-positive: RESOLVED.** The scan now keys on the LAST `**Status:**`
+  line per `## D-NNN:` block (see `scripts/ledger-scan.sh` awk), not arbitrary body prose, so D-115
+  (ADOPTED) no longer shows as PROPOSED/OPEN. The general hygiene -- trust the Status line over body
+  text -- still holds.
 
 <!-- END: machine-derived -->
 
@@ -171,6 +166,22 @@
 autostart only AFTER clean-startup confirmed); (4) optionally set `boot.autostart` on the LXD service VMs
 inside voffice1. Then resume DC0 readiness (`docs/dc0-deploy-readiness.md`).
 
+**UPDATE 2026-07-17 (session-scoped health sweep + edge cold boot) -- the "bookend" is PARTIALLY done,
+NOT the way the TODO above assumed.** Measured this session: **the vcloud HOST never rebooted** (uptime
+8d 18h, boot 2026-07-08) -- so the host-reboot that "ENDS the running agent session" has not happened.
+What DID reboot was the guests: **voffice1** (07-16 20:56, kernel 6.8.0-136) and **office1-tailscale**
+(07-17 07:25, kernel 6.8.0-136), both healthy. The **office1-opnsense edge was cold-booted THIS session**
+(graceful ACPI `virsh shutdown` -> confirmed `shut off` -> `virsh start`) and VERIFIED clean: up-from-0,
+physmem 2.0 GiB (DOCFIX-188 fix live, not 2 MiB), pf Enabled/80 rules, `kea-dhcp4` up, both NICs up, LAN
+gw + egress 0% loss, netbox 302 + tailscale reachable behind it. That satisfies the D-127 verified-cold-boot
+gate, so **`virsh autostart office1-opnsense` is now ENABLED**. **`voffice1` autostart ALSO ENABLED this
+session** -- so BOTH foundational VMs now autostart per D-127 (POST-REBOOT TODO item 3 DONE; `vvr1-dc0/dc1`
+stay MANUAL and do not exist yet). **STILL PENDING:** (a) the vcloud HOST patch+reboot -- kernel **6.8.0-136
+is pending in apt but NOT installed** (running -134, newest installed -134, no reboot-required flag), so a
+bare host reboot gains nothing: the real step is `sudo apt update && sudo apt full-upgrade` (lands -136 + ~9
+security pkgs) THEN reboot; (b) office1-opnsense itself is still on 14.3-RELEASE-p16 (guest OS not patched,
+only cold-booted).
+
 **DC0 DEPLOY READINESS -- PREP COMPLETE 2026-07-17 (deploy-ready). See `docs/dc0-deploy-readiness.md`.**
 Final gate re-checked clean (validate, tfvars, creds-audit vr1-dc0 CLEAN, gauntlet 65, lint 0-fail).
 Remaining is NOT prep: the bookend restart (vcloud + voffice1 + opnsense patch/reboot together -- voffice1