diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 32926b6..cc675c4 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -769,7 +769,32 @@
   band constants are separately named in two files. **STILL OWED, not covered by this ruling:
   the CONSUMER SWEEP** -- 20 of 28 scripts never call the selector; Stage-5 exposure is TWO of
   them (`phase-03-core-verify.sh`, `deploy-watch.sh`), the rest bite at Stages 6-7.
-  Remaining: R10 blocking, R12-R15 standing; G18 deferred-and-gated.
+  **R10 RULED 2026-07-27 by operator direction, exact utterance: "R10, we need to fix the
+  stale commit issue and make sure that all working directories are current."** OPS under
+  GA-R3 (an environment fix; no D-number). **This resolves R10 by REMOVING the reds rather
+  than recording an exception basis for them, which the measurement showed is the stronger
+  answer: the red set is substantially an artifact of running the gate on the wrong host.**
+  SCOPE, enumerated by measurement -- exactly ONE stale deployment clone exists:
+  `voffice1:~/openstack-caracal-dc-dc`, 105 commits behind `origin/main` on
+  `dc-dc-g12-dc1-substrate`, a branch DELETED upstream. vcloud's clone is current; **both DC
+  racks have NO CLONE** (by design -- the `dc-*` scripts are piped in over ssh, never cloned);
+  `office1-netbox` and `office1-tailscale` have NO CLONE (measured from vcloud, after a probe
+  via voffice1 returned "unreachable" -- which is NOT the same as absent and was re-run rather
+  than assumed). `~/ops-toolkit` on vcloud is a DIFFERENT repository
+  (`git.baldurkeep.com/git/ops/ops-toolkit.git`) and is out of scope.
+  **RECOVERY SHAPE MATTERS: a plain `git pull` on voffice1 does NOT work** -- its tracked
+  branch no longer exists upstream. It needs `git fetch origin && git switch main`, with a
+  HEAD-equals-origin/main assertion afterward (finding L5-4). The untracked
+  `opentofu/vr1-dc1-substrate/.terraform.lock.hcl` there is not tracked on `main`, so the
+  checkout will not conflict.
+  **CONSEQUENCES ONCE CURRENT:** preflight becomes runnable on voffice1, which CLEARS P3's 33
+  warns and P4's "MAAS unreachable" (both are missing-binary artifacts -- `maas` and `juju`
+  are PRESENT there, ABSENT on vcloud). The octavia-pki absence and the 7 credential findings
+  are host-independent and remain. **THEN OWED:** repo-lint and the gauntlet ON voffice1 --
+  deliberately deferred until now precisely because running them against a 105-commit-stale
+  tree would have produced a meaningless number.
+  Remaining: R12-R15 standing; G18 deferred-and-gated. **All Stage-5 BLOCKING rulings (R1-R11)
+  are now closed.**
 - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6
   exact; convergence zero --
   `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B