diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 767ac33..fd059e7 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -167,6 +167,16 @@
     SNAPS pre-apt (not covered by the apt proxy; D-135 items 2-3 agent/snap mirror
     NOT built) -- it works ONLY while the DC1 edge egress is OPEN. Do NOT apply the
     D-135/D-107 egress-narrowing until AFTER bootstrap (or mirror agents/snaps first).**
+    **EGRESS MEASURED OPEN 2026-07-27** (Stage-5 grounding audit; previously this entry
+    carried the requirement but no measurement). Probed from the dc1 rack directly with
+    `--noproxy "*"` so an apt-cacher-ng hit could not fake it:
+    `https://streams.canonical.com/juju/tools/` -> **200** (the juju agent stream the
+    bootstrap fetches), `https://api.snapcraft.io/v2/snaps/info/juju` reachable (HTTP 400 =
+    endpoint answered), `http://archive.ubuntu.com/ubuntu/dists/jammy/Release` -> 200,
+    `ping 1.1.1.1` 0% loss, default route via `10.12.64.1`. The bootstrap window is
+    therefore OPEN as of this date. **This measurement has a shelf life -- re-probe
+    immediately before bootstrap, because the D-135/D-107 narrowing is the closing
+    mutation and nothing prevents it being applied first.**
   - **RENDER (committee-adjudicated 2026-07-24; record
     `docs/audit/committee-20260724-track2-bundle-render.md`).** The committed
     `bundle.yaml` is still VR0's 4-node HYPERCONVERGED layout (machines "8"-"11",