diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index c046e32..d85bacb 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -1251,7 +1251,27 @@
   ZERO prefixes live and REFUSED rather than writing nothing silently -- the refusal is what
   surfaced the bug. Now matches slug-then-name. Same class as this audit's own "used a
   two-day-old dump instead of polling live" finding.
-  **STILL NOT DONE, an operator-gated live mutation:** the rack-bridge v6 legs (U17).
+  **POST-WRITE SAFETY CHECK, run because the write touched a DHCP-serving VLAN.** The new
+  `fd50:840e:74e2:220::/64` landed on **VLAN 5005, which carries `dhcp_on=True`** for the v4
+  metal-admin subnet -- i.e. the path node commissioning depends on. Measured after: rack
+  `vvr1-dc0` reports **9 services, ZERO degraded/dead**, `dhcpd` **running** (1 live process on
+  the rack), `dhcpd6` **off**. Nothing was disturbed, and `dhcpd6: off` is a LEGITIMATE state
+  rather than a failure -- MAAS starts dhcpd6 only for a v6 DYNAMIC range, and none exists
+  (the D-134 v6 bands are covered by MAAS's own default reservation, so no range was created).
+  **RACK-BRIDGE v6 LEGS (U17) -- MEASURED, AND THE OPEN QUESTION IS NARROWER THAN U17 IMPLIED.**
+  Prior art check: `scripts/dc-rack-net.sh` ALREADY owns rack bridge legs via a site-keyed
+  `LEGS` table installed as a reboot-persistent `<site>-rack-legs.service`, so v6 legs extend
+  that table rather than needing a new tool. Current table is THREE legs per site, not six
+  planes: metal-admin `.2` (rack), metal-admin `.3` (D-131 DNS forwarder), provider-public `.2`
+  (edge-LAN). Measured live: the dc0 rack carries **ZERO global v6 addresses** and MAAS knows
+  **ZERO v6 links** for either rack controller -- confirming U17 at the host layer.
+  **BUT NOTHING CONSUMES A RACK v6 LEG TODAY**, and the substantive question U17 did not ask is
+  **HOW NODES ACQUIRE v6 AT ALL**: via MAAS STATIC assignment on deploy (needs only the subnet,
+  which now exists -- no rack leg, no DHCPv6), via DHCPv6 (needs a v6 dynamic range AND
+  `dhcpd6`, both absent by design), or via SLAAC/RA (needs a router advertising on the plane --
+  the rack or the edge). These have materially different consequences and only the first is
+  already satisfied. **NOT INVENTED: presented to the operator rather than chosen.** The legs
+  are NOT applied.
 - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6
   exact; convergence zero --
   `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B