diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index c20f358..2cefdea 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -344,6 +344,13 @@
   (`docs/vr1-office1-as-built.md:42`, updated 2026-07-18). NOT re-measured
   this session -- measuring requires the gated API credential path; see
   section 7.
+- SEC-010 nft files (2026-07-23, operator-approved live re-assert, logged
+  window ops-sec010-reassert): `/etc/nftables-sec010.nft` on voffice1 and
+  BOTH DC racks now carries the idempotent declare-then-delete preamble --
+  sec010-fw double-restart converged with no rule duplication (4/2/2
+  drops; pre/post capture `docs/audit/sec010-reassert-20260723.txt`;
+  per-host backup `.pre-reassert-20260723` on each host). Generator fixed
+  the same day (queue-pass changelog items 3/8).
 
 ### 2.3 State vs live vs config disagreements (REPORTED, not harmonized)