diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 6f61dcc..b5a5f04 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -163,8 +163,14 @@
   secret exposure during diagnosis). Queued delivery: appendix-A
   entries, LP report, stale pod object cleanup. Forwarder + rack-legs
   persistence SHIPPED 2026-07-21 as `scripts/dc-rack-net.sh` (D-131
-  sub-1 delivery; harness 14 cases; gauntlet 74 ALL GREEN); rack
-  install PENDING, operator-gated. **MAC pinning SHIPPED 2026-07-21** (54 MACs
+  sub-1 delivery; harness 14 cases; gauntlet 74 ALL GREEN) and
+  **INSTALLED on the rack 2026-07-21 (operator-approved)**: install
+  EXIT 0, self-check PASS 10/10
+  (`docs/audit/dc-rack-net-install-20260721.txt`), post-install
+  behavioral probe = forwarder answers authoritative `maas-internal`
+  SOA. The three rack bridge legs are now reboot-persistent
+  (dc0-rack-legs.service); the hand-placed interim state is fully
+  superseded. **MAC pinning SHIPPED 2026-07-21** (54 MACs
   measured via `virsh domiflist` + pinned in modules/node-vm +
   vr1-dc0-substrate; harness 15 cases; gauntlet 73 ALL GREEN) together
   with an operator-ruled power-ownership guard (`ignore_changes =
diff --git a/docs/audit/dc-rack-net-install-20260721.txt b/docs/audit/dc-rack-net-install-20260721.txt
new file mode 100644
index 0000000..8189601
--- /dev/null
+++ b/docs/audit/dc-rack-net-install-20260721.txt
@@ -0,0 +1,12 @@
+dc-rack-net install (dc0): done -- running check:
+  OK   /usr/local/sbin/dc0-rack-net-apply matches
+  OK   /etc/systemd/system/dc0-rack-legs.service matches
+  OK   /etc/dnsmasq-dc0-node.conf matches
+  OK   /etc/systemd/system/dc0-node-dns.service matches
+  OK   dc0-rack-legs enabled
+  OK   dc0-node-dns enabled
+  OK   dc0-node-dns active
+  OK   10.12.8.2/22 on virbr2 (vr1-dc0-metal-admin)
+  OK   10.12.8.3/22 on virbr2 (vr1-dc0-metal-admin)
+  OK   10.12.4.2/22 on virbr5 (vr1-dc0-provider-public)
+dc-rack-net check (dc0): PASS
diff --git a/docs/changelog-20260721-close-and-delivery.md b/docs/changelog-20260721-close-and-delivery.md
index 093ef41..c64377d 100644
--- a/docs/changelog-20260721-close-and-delivery.md
+++ b/docs/changelog-20260721-close-and-delivery.md
@@ -97,8 +97,12 @@
 - NEW tests/dc-rack-net harness (14 cases incl. no-virbrN-literal,
   MEASURED-tag discipline, read-only check path). Gauntlet 73 -> 74 ALL
   GREEN; repo-lint 0 fail.
-- Rack install is a gated mutation (operator approval pending at time of
-  this entry); check EXIT 0 capture cited from CURRENT-STATE when run.
+- Rack install EXECUTED (operator-approved, same session): EXIT 0,
+  self-check PASS 10/10 (docs/audit/dc-rack-net-install-20260721.txt);
+  behavioral probe: `dig @10.12.8.3 maas-internal SOA` answers through
+  the region. dnsmasq restart blip occurred with all 9 nodes powered
+  off (zero impact). The interim hand-placed unit/conf are OVERWRITTEN
+  in place by the generated equivalents (same paths).
 - **Revert:** git rm the script + harness; on the rack (if installed):
   systemctl disable --now dc0-rack-legs dc0-node-dns; rm the four
   installed files; re-add the legs + old unit per changelog-20260721-