diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 2a19df1..4c9f94f 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -2309,7 +2309,12 @@
   output only). Remaining non-active are all accounted for: `octavia/0` (D-021, phase-05),
   `designate/0` (DNS activation, Stage 7), `ceph-rbd-mirror/0` (dc1 peer, Stage 6) and
   `glance-simplestreams-sync/0` (gss one-shot) are DEFERRED-by-design; `barbican-vault/0`
-  ('secrets-storage' incomplete) is settling and OWED a verify (next: item (b)).
+  ('secrets-storage' incomplete) was VERIFIED 2026-08-05 (17:55Z) and is NOT settling and NOT
+  deferred -- a genuine incomplete: vault pushed the per-unit `role_id` + `token` but the
+  `secrets-storage` databag is MISSING `vault_url` (both apps' app-data empty), so the charm logs
+  "Requesting access to vault (None)" and never completes. NOT deploy-blocking (barbican/0 is
+  `active` on its software backend; this only gates the vault-backed secret store). Distinct
+  follow-up triage, not the ceph class.
   **NAMED-GATE DEFECT found by measurement -- `phase-03-core-verify.md` Step 3.1 asserts expected
   non-active/idle = 1 (octavia only); the VR1 roster yields 4 deferred-by-design + gss.** That gate
   is STALE for VR1 and a DOCFIX is owed (also owed on that runbook: `-m openstack` -> `-m vr1-dc0`