diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index cf966fb..f0d3274 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -2390,6 +2390,28 @@
   performs on every apply. **ALSO CORRECTED:** `phase-01:605` said the overlay must be in the
   backup set; it is DERIVABLE from the archived workspace by 1.0-GEN.d, so the workspace-only
   archive is sufficient -- the line implied a gap that does not exist.
+- **BOTH BACKUP PATHS ARE NOW TAKEN AND PROVEN RESTORABLE 2026-07-30. E2 AND E3 ARE FULLY
+  CLOSED.** Operator executed all of it; the session verified read-only.
+  **TFSTATE RESTORE PROVEN, not asserted:** both archives decompress to valid JSON, report
+  **serial 9 (dc0) / 4 (dc1)** and 29 resources each, and are **byte-identical to the live state**
+  (`c16995a1...`, `fbd50636...`). Those are the SAME hashes measured at session open before the
+  voffice1 pull, so the states have not drifted and the backups match what `tofu` actually uses.
+  Archives are mode 600 inside 700 folders, differ between DCs, and the staging copies were
+  removed from the headend only after the checksum-and-parse gate passed.
+  **P5 went 9 -> 7 on the jumphost**, and the two that cleared were precisely the
+  EXPECTED-BUT-ABSENT rows the register had been demanding -- the gate asked for the backup and
+  then confirmed it. **ZERO E2 and ZERO E3 findings remain on any octavia or tfstate artifact.**
+  The residual 7 are the pre-existing set carried into this session (dc0-edge-api, the three
+  power-key asymmetries, the maas-region-admin principal conflation, and the two uncheckable
+  rows) -- none introduced by this work.
+  **THE SERIAL CHMOD CLOSED THE LAST E2:** P5 on the headend fell 8 -> 6, and
+  `octavia-pki.sh verify` reads **PASS 26/0** on both DCs.
+  **NET EFFECT OF THE DAY'S CREDENTIAL WORK:** the Octavia PKI went from a generator that would
+  have destroyed dc0's CA on dc1's generation, an un-ignorable overlay one rename from being
+  committable, a register structurally blind to a missing second CA set, and a gate suite that
+  asserted no SAN and no mode -- to two independent trust domains, both verified 26/0, both
+  backed up with a proven restore, and both fully declared. Every one of those defects was found
+  by measurement rather than inherited from a document.
   **F3 -- both `~/octavia-pki/` and `overlays/octavia-pki.yaml` are ABSENT here** (existence
   checked, no contents read). So this is generation FROM SCRATCH for both DCs: there is
   nothing to reuse, which retires the reuse-vs-regenerate choice