diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index a046b98..0820ea4 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -1364,16 +1364,23 @@
   means EXPLICITLY CONFIGURED, so creating a subnet addresses nothing and the carve is still
   owed; and NetBox's LIVE API returns `scope.name` as the display name while this repo's dumps
   normalise it to the slug, so a dump-written tool matches zero objects live.
-- **RENDER-PIPELINE STEP 3 -- MAAS, lib-net AND APEX HALVES COMPLETE 2026-07-27.** Every authoritative source now carries the
+- **RENDER-PIPELINE STEP 3 IS COMPLETE 2026-07-27 -- ALL FOUR LAYERS, BOTH DCs.** (Heading
+  corrected at session close: it read "MAAS, lib-net AND APEX HALVES COMPLETE", which was true
+  when written but became an UNDERSTATEMENT once the node carve landed above -- a reader
+  skimming headings would have concluded a half was still owed. The stale-surface class this
+  project keeps finding, caught by a close sweep rather than by a gate.) Every authoritative source now carries the
   ruled values: **MAAS** (12 v6 plane subnets carved; 24 D-134 bands + both FIP pools reserved;
   `dc-plane-ipam check` pass=24 fail=0 and `reserve` planned=0 on BOTH DCs), **`lib-net.sh`**
   (dc1 FIP pool set, with the R9/D-133 unsets now guarded by new harness cases), and the
   **NetBox apex** (ip-ranges 3 -> 27, ip-addresses 4 -> 160, IPv6 0 -> 78, 156 VIP objects).
   Two decisions that had been RULED-BUT-NEVER-BUILT are now artifacts: **D-134's bands** and,
   in the apex, the **D-020/R11 VIP set including vault `.61` and designate `.62`**. Machines
-  measured 18 Ready + 2 Deployed unchanged across every mutation. **Steps 4-6 (build the
-  renderer, dry-run it, audit the chain) are now unblocked -- the apex finally has something
-  real to pull.**
+  measured 18 Ready + 2 Deployed unchanged across every mutation. **The fourth layer, the NODES,
+  is complete too** -- 108 v6 links carved, `dc-node-v6-carve check` PASS on both DCs (see the
+  entry above). **Steps 4-6 (build the renderer, dry-run it, audit the chain) are now unblocked
+  -- the apex finally has something real to pull.** What is NOT part of step 3 and remains
+  deliberately open: v6 `gateway_ip`/`dns_servers` (no external v6 routing this deployment,
+  D-101 rationale) and the G17 first-boot verification that nodes actually bring the addresses up.
 - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6
   exact; convergence zero --
   `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B