diff --git a/docs/audit/sec010-reassert-20260723.txt b/docs/audit/sec010-reassert-20260723.txt
new file mode 100644
index 0000000..8b33da9
--- /dev/null
+++ b/docs/audit/sec010-reassert-20260723.txt
@@ -0,0 +1,73 @@
+== SEC-010 re-assert PRE-STATE capture 2026-07-23T03:59:29Z ==
+--- voffice1 (region; hand-extended two-leg file) ---
+#!/usr/sbin/nft -f
+table inet sec010 {
+  chain forward {
+    type filter hook forward priority -10; policy accept;
+    oifname "enp2s0" drop
+    iifname "enp2s0" drop
+    oifname "enp3s0" drop
+    iifname "enp3s0" drop
+  }
+}
+..RULESET..
+table inet sec010 {
+	chain forward {
+		type filter hook forward priority filter - 10; policy accept;
+		oifname "enp2s0" drop
+		iifname "enp2s0" drop
+		oifname "enp3s0" drop
+		iifname "enp3s0" drop
+	}
+}
+--- vvr1-dc0 rack (172.31.0.2) ---
+#!/usr/sbin/nft -f
+table inet sec010 {
+  chain forward {
+    type filter hook forward priority -10; policy accept;
+    oifname "enp1s0" drop
+    iifname "enp1s0" drop
+  }
+}
+..RULESET..
+table inet sec010 {
+	chain forward {
+		type filter hook forward priority filter - 10; policy accept;
+		oifname "enp1s0" drop
+		iifname "enp1s0" drop
+	}
+}
+--- vvr1-dc1 rack (172.31.0.6) ---
+#!/usr/sbin/nft -f
+table inet sec010 {
+  chain forward {
+    type filter hook forward priority -10; policy accept;
+    oifname "enp1s0" drop
+    iifname "enp1s0" drop
+  }
+}
+..RULESET..
+table inet sec010 {
+	chain forward {
+		type filter hook forward priority filter - 10; policy accept;
+		oifname "enp1s0" drop
+		iifname "enp1s0" drop
+	}
+}
+
+== POST-STATE 2026-07-23T04:01:45Z: preamble present, double-restart converged (2/2, 2/2, 4/4 drops) ==
+--- voffice1 ---
+#!/usr/sbin/nft -f
+table inet sec010 {}
+delete table inet sec010
+4
+--- vvr1-dc0 ---
+#!/usr/sbin/nft -f
+table inet sec010 {}
+delete table inet sec010
+2
+--- vvr1-dc1 ---
+#!/usr/sbin/nft -f
+table inet sec010 {}
+delete table inet sec010
+2
diff --git a/docs/changelog-20260723-queue-pass.md b/docs/changelog-20260723-queue-pass.md
index 1fe9576..1abc85e 100644
--- a/docs/changelog-20260723-queue-pass.md
+++ b/docs/changelog-20260723-queue-pass.md
@@ -41,11 +41,8 @@
   declare-then-delete preamble (`table inet sec010 {}` + `delete table inet
   sec010`) so any reload converges to exactly one rule pair. No `destroy`
   keyword (older-nft-safe).
-- LIVE STATE NOT TOUCHED: the files already installed on vvr1-dc0, vvr1-dc1
-  and voffice1 keep the old shape until a gated re-run of the installer (or a
-  hand re-write) -- QUEUED as a gated live re-assert, NOT done this session.
-  Until then a sec010-fw restart on those hosts duplicates rules (benign to
-  enforcement -- same verdict, duplicated -- but wrong).
+- LIVE STATE: re-asserted same session under operator approval -- see Item 8
+  (all three hosts converged, pre/post captured).
 - HARNESS: asserts the preamble is present in the generator.
 - REVERT: restore the old heredoc; drop the assertion.
 
@@ -104,6 +101,24 @@
   one is a possible future deliverable, logged here, not started).
 - REVERT: remove the requirements block.
 
+## Item 8 -- LIVE re-assert of /etc/nftables-sec010.nft on all three hosts (operator-approved)
+
+- RULING (GA-R5): question "Re-assert the idempotent nftables-sec010 file on
+  the three live hosts now?" -- operator answer, exact utterance (option
+  selected): "Approve -- run now (Recommended)". Logged window
+  ops-sec010-reassert (index row added); each host an individually gated
+  mutation.
+- WHAT: on vvr1-dc0 (172.31.0.2), vvr1-dc1 (172.31.0.6), voffice1 -- backup
+  to `/etc/nftables-sec010.nft.pre-reassert-20260723`, inserted the
+  declare-then-delete preamble after the shebang IN PLACE (voffice1's
+  hand-extended two-leg file preserved verbatim), then restarted sec010-fw
+  TWICE per host: rule counts stable at 2/2, 2/2, 4/4 drops -- the double
+  restart is the proof the append-duplication defect is gone. Pre+post
+  capture: `docs/audit/sec010-reassert-20260723.txt`. SEC-010 enforcement
+  never gapped (delete+recreate inside one atomic `nft -f`).
+- REVERT (per host): `sudo cp -a /etc/nftables-sec010.nft.pre-reassert-20260723
+  /etc/nftables-sec010.nft && sudo systemctl restart sec010-fw`.
+
 ## Non-items (verified/logged, nothing executed)
 
 - Netem runbook Step-11 DOCFIX flagged at step E: ALREADY delivered at stage
diff --git a/logs/as-executed-index.md b/logs/as-executed-index.md
index 7be6d69..8bb8846 100644
--- a/logs/as-executed-index.md
+++ b/logs/as-executed-index.md
@@ -15,3 +15,4 @@
 | 2026-07-08 | ops-devteam-template | jesse.austin (Claude Code lane, per-command wrap) | deliver devteam-k8s cluster template (stage5, calico, hidden=False) after stuck flannel TestCluster2 confirmed gone + RAM reclaimed; closes the addendum-39 no-delivered-template gap |
 | 2026-07-21 | ops-commissioning-diag | jesse.austin (Claude Code lane, per-command wrap) | G10 commissioning diagnosis: instrumented run per committee; MAC-drift fault (all 9) repaired in place (ruled); MAAS 3.7 rack-only agent resolver defect found, dc0-node-dns forwarder workaround (ruled); ALL 9 NODES READY; SEC-014 opened; D-131 proposed |
 | 2026-07-22 | dc1-deploy | jesse.austin (Claude Code lane, per-command wrap) | G12 dc1 build: apex --commit (transit /30 + rack IP, 2 objects), dc1 svc key minted, outer apply 5/0/0 exact (vvr1-dc1 + uplink), converged zero diff |
+| 2026-07-23 | ops-sec010-reassert | jesse.austin (Claude Code lane, per-command wrap) | SEC-010 nft file re-assert to idempotent shape on voffice1 + both DC racks (declare-then-delete preamble); double-restart converged 4/2/2 drops; pre/post capture docs/audit/sec010-reassert-20260723.txt |