diff --git a/docs/audits/2026-09-07-k1-linux-route-contract-r7.md b/docs/audits/2026-09-07-k1-linux-route-contract-r7.md
index aca863d..d23207e 100644
--- a/docs/audits/2026-09-07-k1-linux-route-contract-r7.md
+++ b/docs/audits/2026-09-07-k1-linux-route-contract-r7.md
@@ -76,3 +76,20 @@ The canonical Core is operational and serves the exact new index, SHA256
 `ab8f6a515715715b8842023729e1a22fbf2d524ca157a7e53f774e2fe081a8da`.
 One Ubuntu GUI installer is awaiting owner sudo authentication. Installation,
 read-only DeviceInfo/control verification and live/recovery remain pending.
+
+## Installed readback
+
+The GUI installer subsequently exited with code 0. Installed Node 0.8.5 and K1
+0.1.4+private.1 both report source e6521e8; Node reports DG 5b882bc. Both services
+are active/running with zero restarts, started at 13:50:44 and 13:50:52 MSK.
+The preserved Fleet binding is fresh/available, with discovery generation 0
+and both scan-ble and observe-configured-device-network permitted. This confirms
+retention of the applied-network recovery path across the update, without
+claiming a verified K1 control session.
+
+Core 8000 is still the only integrated service and 8765 has no listener. The
+owner was invited to clear Chrome cache, explicitly discover/select K1 and use
+Check K1 state without re-entering Wi-Fi credentials. That read-only physical
+verification and live/recovery acceptance remain pending. Private manifest and
+hashes record installed state; Ops K1/Node progress was updated without changing
+the Node card's architectural baseline.