diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 5f117f5..e89317f 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -224,12 +224,19 @@
   for this diagnosis and its ranked live hypotheses.
   REMAINING IN G10: netem only (step E,
   NOT started -- target is the dc0<->dc1 mesh = **virbr5 on vcloud**,
-  re-measured 2026-07-21). The sudo blocker is RESOLVED in mechanism:
+  re-measured 2026-07-21). The sudo blocker is RESOLVED end to end:
   operator-ruled scoped NOPASSWD 2026-07-21, fragment SHIPPED
   (`scripts/sudoers.d/netem-tc`, harness 9 cases, gauntlet 75 ALL
-  GREEN); INSTALL on vcloud is operator-only and PENDING, then the
-  step-E placeholder netem run itself (gated). Session changelog
-  2026-07-21 item 7.
+  GREEN) and **INSTALLED on vcloud 2026-07-21 (operator-run)** --
+  verified read-only by the successor session: installed file 0440
+  root:root, byte-identical to the repo fragment, and `sudo -n -l`
+  grant checks exit 0 (both verbs on virbr5; spot checks virbr7/virbr3)
+  (`docs/audit/netem-sudo-install-20260721.txt`). Remaining: wire
+  `modules/netem-link` into the outer root (HELD comment,
+  `opentofu/main.tf:309`) with the ruled placeholder parameters --
+  expected outer plan = ADDS ONLY, any other diff is a STOP (section
+  5) -- then the gated step-E placeholder netem run. Session changelog
+  2026-07-21 item 7; install verification: this session's changelog.
 - The grounding audit is COMPLETE and EXITED (2026-07-19): Phases 1-6 all
   closed (charter `148dcef`; rulings `docs/audit/ga-rulings.md`; the
   Phase-5 sweep ran as six operator-gated batches in one session; exit
diff --git a/docs/audit/netem-sudo-install-20260721.txt b/docs/audit/netem-sudo-install-20260721.txt
new file mode 100644
index 0000000..100690e
--- /dev/null
+++ b/docs/audit/netem-sudo-install-20260721.txt
@@ -0,0 +1,37 @@
+# netem-tc sudoers install verification -- 2026-07-21 (read-only, successor session)
+#
+# The install itself was OPERATOR-RUN interactively 2026-07-21 (in-session
+# `!` prefix, per the fragment header's exact command):
+#   sudo install -m 0440 -o root -g root scripts/sudoers.d/netem-tc /etc/sudoers.d/netem-tc && sudo visudo -c
+# The running session disconnected before the output could be recorded, so
+# this capture is the successor session's independent read-only
+# re-verification. Note: a sudoers parse error disables the file entirely,
+# so the non-interactive grant checks below ALSO prove the installed file
+# parses (they could not exit 0 otherwise).
+
+$ ls -l /etc/sudoers.d/netem-tc
+-r--r----- 1 root root 1888 Jul 21 18:09 /etc/sudoers.d/netem-tc
+
+$ wc -c scripts/sudoers.d/netem-tc
+1888 scripts/sudoers.d/netem-tc
+# byte count identical to the repo fragment at HEAD 8a9c04c -> installed
+# copy is the shipped fragment (mode 0440 root:root as ruled).
+
+# Behavioral grant checks (sudo -n -l <cmd>: non-interactive; exit 0 =
+# command permitted with NOPASSWD; nothing is executed):
+
+$ sudo -n -l /usr/sbin/tc qdisc del dev virbr5 root
+/usr/sbin/tc qdisc del dev virbr5 root
+exit=0
+
+$ sudo -n -l /usr/sbin/tc qdisc replace dev virbr5 root netem delay 5ms
+/usr/sbin/tc qdisc replace dev virbr5 root netem delay 5ms
+exit=0
+
+$ sudo -n -l /usr/sbin/tc qdisc del dev virbr7 root        # exit=0
+$ sudo -n -l /usr/sbin/tc qdisc replace dev virbr3 root netem delay 5ms   # exit=0
+
+# VERDICT: install VERIFIED. Both verbs live on virbr5 (the step-E
+# dc0<->dc1 target); spot checks pass on virbr7/virbr3. Bridge names
+# remain drifting IDs -- the step-E runbook re-measures before any apply
+# (fragment header, fail-closed property).
diff --git a/docs/changelog-20260721-netem-install-verify.md b/docs/changelog-20260721-netem-install-verify.md
new file mode 100644
index 0000000..0189177
--- /dev/null
+++ b/docs/changelog-20260721-netem-install-verify.md
@@ -0,0 +1,48 @@
+# Session changelog 2026-07-21 (third session) -- disconnect collapse + netem install verification
+
+One changelog per session (GA-R2/D1). Status lives ONLY in
+docs/CURRENT-STATE.md; this file is narrative + reverts. Predecessor
+(close-and-delivery session, disconnected after the operator ran the
+netem-tc install): docs/changelog-20260721-close-and-delivery.md.
+
+## 1. Lingering-session sweep (read-only; nothing to collapse but records)
+
+- Verified: working tree clean at pushed HEAD 8a9c04c; zero unpushed
+  commits; single worktree; no stray run-logged windows or tofu
+  processes; branches = stage branch + main only, both synced. The
+  disconnected session's seven deliverable commits were ALL already
+  durable -- the only outstanding items were its ledger bookend and the
+  record of the operator-run netem-tc install.
+- One divergence FLAGGED (logged, not fixed -- queued finding):
+  `ledger-scan.sh` omits D-131 from its PROPOSED/OPEN list because the
+  Status line begins "PARTIALLY RULED" (D-129's "OPEN / PARTIALLY
+  RULED" phrasing is caught; D-131's is not) even though sub-2..4 are
+  OPEN. Candidate fix: widen the scan's status-line match or adopt a
+  status-wording convention. No information is lost today (the ledger's
+  hand-seeded block carries D-131).
+
+## 2. netem-tc sudoers install VERIFIED (read-only)
+
+- The install command itself was operator-run interactively in the
+  predecessor's window (fragment-header command, verbatim). This
+  session re-verified without root: installed file 0440 root:root,
+  byte count identical to the repo fragment (1888), and non-interactive
+  `sudo -n -l` grant checks exit 0 for both verbs on virbr5 (the step-E
+  target) plus spot checks on virbr7/virbr3 -- which also proves the
+  installed file parses (a sudoers parse error disables the file).
+  Capture: docs/audit/netem-sudo-install-20260721.txt.
+- CURRENT-STATE step-E paragraph corrected in this same commit (GA-R1
+  C1/C2): install PENDING -> INSTALLED+VERIFIED; remaining path stated
+  (wire modules/netem-link into the outer root from its HELD comment,
+  adds-only plan gate, then the gated placeholder run).
+- **Revert:** git revert this commit (records only); to remove the live
+  grant: sudo rm /etc/sudoers.d/netem-tc && sudo visudo -c.
+
+## 3. Predecessor bookend LANDED (this commit)
+
+- Bounded SESSION CLOSE entry for the close-and-delivery session
+  appended to docs/session-ledger.md (GA-R4; second same-day
+  disconnect-then-successor-lands cycle, same pattern as item 1 of the
+  predecessor's own changelog).
+- **Revert:** git revert this commit (returns the predecessor to
+  not-durable state; live cloud untouched).
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index ae0206f..70fd259 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -140,3 +140,18 @@
 - REMAINING in G10: netem step E only (netem-link passwordless-sudo blocker).
 - Details: docs/changelog-20260721-commissioning-diag.md + docs/audit/commissioning-diag-20260721.txt.
   Status lives ONLY in CURRENT-STATE.md.
+
+## SESSION CLOSE 2026-07-21 -- close-and-delivery session (bounded, GA-R4)
+
+- Session DISCONNECTED before its bookend (second same-day disconnect); all seven deliverable
+  commits were already pushed (8b3adb3..8a9c04c), so only this entry + the netem-install record
+  were outstanding. Landed by the successor session after read-only re-verification.
+- Delivered: predecessor (ops-commissioning-diag) close landed; node-vm MAC pinning (54 measured
+  pins) + power-ownership guard ruled and APPLIED on voffice1 (0/9/0 exact, converged zero diff);
+  D-131 sub-1 RULED + dc-rack-net.sh shipped AND installed on the rack (check 10/10, SOA probe);
+  incident docs (appendix-A x2, platform-traps 1e corollary, LP draft -- operator to file);
+  step-E netem sudo RULED (scoped NOPASSWD) + fragment shipped (gauntlet 75 ALL GREEN).
+- Post-disconnect: operator ran the netem-tc install interactively; successor VERIFIED read-only
+  (0440 root:root, byte-identical, sudo -n -l grant checks exit 0 --
+  docs/audit/netem-sudo-install-20260721.txt). Step E is now UNBLOCKED (gated run pending).
+- Details: docs/changelog-20260721-close-and-delivery.md. Status lives ONLY in CURRENT-STATE.md.