diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 1efe158..0e76d4b 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -788,7 +788,13 @@
    (declared-directories vs broader sweep, a tenant-isolation
    concern); policy home (this D as authority with SEC-009 demoted to
    a pointer, vs policy stays in the ledger). NOT implemented --
-   PROPOSED means present options, never build.
+   PROPOSED means present options, never build. **SUB-RULING 1 RULED 2026-07-25
+   (GA-R5, utterance quoted in the D-137 Status block): "Blocking in preflight"** --
+   the check lands as a new `Pn` in `scripts/preflight.sh` and HARD-FAILS on any
+   expected-but-absent / undeclared / per-DC-asymmetric credential. The PreToolUse
+   guard and advisory-only were NOT adopted. Sub-rulings 2-5 remain OPEN and the
+   entry stays PROPOSED until all five are ruled; nothing is built before that.
+   Research capture: `docs/audit/creds-creation-points-20260725.md`.
 
 ## 9. Additional defect found while authoring (FIXED in sweep Batch 0.3,
 2026-07-19 -- wrap-aware exclusion, GA-F15; history below)
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index b907c07..4a66afb 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -5003,9 +5003,31 @@
 **Status:** PROPOSED 2026-07-25 (this session, repo HEAD `1155729`; operator asked for
 "a better best practices method for minting and saving these credentials going forward"
 and "a durable rule to make sure when accounts are created there is a consolidation
-that happens every time so credentials aren't misplaced or lost" -- the mechanism is
-NOT ruled; three forks below are presented, not chosen). Supersedes nothing. Would make
-the SEC-009 standing convention a D-governed policy with a Roosevelt-transferable home.
+that happens every time so credentials aren't misplaced or lost"). Supersedes nothing.
+Would make the SEC-009 standing convention a D-governed policy with a Roosevelt-transferable home.
+
+**PARTIALLY RULED -- sub-rulings recorded individually (GA-R5, one exchange each).
+The entry stays PROPOSED until all five forks are ruled; NOTHING is built before that.**
+
+**Sub-ruling 1 (ENFORCEMENT STRENGTH) -- RULED 2026-07-25.** Question as presented:
+"D-137 ruling 1 of 5 -- enforcement strength. This decides whether the rule binds or
+merely advises, and it gates rulings 2-5." Options presented: blocking in preflight /
+blocking plus a PreToolUse guard / advisory only. Operator selection, exact:
+**"Blocking in preflight"**. CONSEQUENCE: the credential check runs inside
+`scripts/preflight.sh` as a new `Pn` and HARD-FAILS (exit 1) on any expected-but-absent,
+undeclared, or per-DC-asymmetric credential -- no deploy proceeds past a credential gap.
+NOT adopted: the PreToolUse guard (so an agent is not constrained at write time, only at
+the deploy gate) and advisory-only (explicitly the posture that failed -- the phase-3
+prose rule was advisory and never fired at either DC standup: dc0 carried 3 and dc1 1
+undeclared secret). Preflight is the correct home per its own header intent: it exists to
+collapse a fragmented gate surface into one artifact, so a creds gate operators must
+remember to run separately is the exact failure mode preflight was built to delete.
+
+**Sub-rulings 2-5 OPEN** (derivation: manifests generated FROM the matrix vs dual
+maintenance; `--remote` discovery scope; policy home; whether the SEC-020 human/service
+identity conflation folds in). Design record, committee review and the measured findings
+that shaped them: plan `whimsical-wandering-spindle`, capture
+`docs/audit/creds-creation-points-20260725.md`, rows SEC-021/-022/-023.
 
 **Problem -- the existing control cannot detect the failure class it was built for.**
 SEC-009 (2026-07-15) established the `~/<site>-creds/` convention AND its enforcement