diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 5bd9099..ee842bc 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -2498,8 +2498,18 @@
   offset (4->64/8->68/12->72/16->76 are +60; 32->80/36->84 are +48), so no rule can be derived.
   Whether the DCs split it into two `/23`s or dc1 takes a separate block is UNRULED. **The v6
   half is complete and unaffected** (each DC's OOB `/64` comes from its own `/48`), **and the
-  step-1 push is v6-only, so it is NOT blocked by this.** **VPN (`:e0`) is the SAME omission,
-  surfaced alongside OOB, named in neither utterance, and left OPEN rather than folded in.**
+  step-1 push is v6-only, so it is NOT blocked by this.** **VPN (`:e0`) IS NOW RULED 2026-08-01 (GA-R5): DEFERRED TO ROOSEVELT DESIGN TIME.**
+  Operator answer, exact utterance: **"Defer to Roosevelt design time"**. Recorded as a
+  DEFERRAL rather than left silent -- an unrecorded hole is exactly how the OOB omission
+  survived. Measured basis: **VPN is a RESERVATION at both precedents, never a carved plane**
+  -- VR0 DC0 and Willamette hold the `:e0::/60` parent ONLY, no `/64` and no IPv4, unlike OOB
+  which holds `/60`+`/64` at both. VR1's VPN is Tailscale under D-129(iii), addressed from
+  `fd7a:115c:a1e0::/48`, which this deployment does not carve -- so a VR1 `:e0::/60` would
+  reserve space with no occupant. **CONSEQUENCE: VR1's octet map diverges from VR0 and
+  Willamette on exactly one hextet, BY DECISION**, and ruling B's "conforms to an existing org
+  standard" should be read with that documented exception. Nothing in D-139's execution list,
+  the deploy, or any gate depends on it. Full text: `### DEFERRAL 2026-08-01 -- VPN (:e0)` in
+  `docs/design-decisions.md`.
   **>>> CONFORMANCE VERIFIED AGAINST THE SOLIDIFIED SPECS, AND THE DEPLOY INPUT FAILS IT.
   Capture: `docs/audit/d139-conformance-dc0-20260801.txt` (83 lines). <<<** Every ruled row of
   D-139 ruling A, ruling B, the "B plus C" narrowing and the OOB amendment was compared to the
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index cd1e75f..12f1806 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -7238,3 +7238,41 @@
 dc1 not yet pushed). **The v4 half is RULED AND NOT BUILT** -- neither `/22` exists in the apex or
 in MAAS. `netbox/d139-gua-carve.py` cannot create them: it is v6-prefixes-only by construction.
 The v4 rows are OWED and gate nothing in D-139 or the Stage-5 deploy.
+
+### DEFERRAL 2026-08-01 -- VPN (`:e0`) is knowingly ABSENT from VR1's carve, pinned to Roosevelt design time
+
+**Operator answer, exact utterance: "Defer to Roosevelt design time".**
+
+**RECORDED RATHER THAN LEFT SILENT, and that is the whole point of this note.** VPN was the
+SECOND omission found alongside OOB in D-139's `CARVE` table (`design-decisions.md:3066` put
+`lbaas-mgmt (:80)`, `vpn (:e0)` and `oob (:f0)` all out of scope of the six-plane tool; D-139
+brought `:80` back, the 2026-08-01 amendment brought `:f0` back, and `:e0` is now deferred BY
+DECISION). The OOB gap survived undetected precisely because nothing recorded it; this note
+exists so a future session finds a ruled deferral instead of rediscovering a hole.
+
+**MEASURED STATE at the time of the ruling, so it does not have to be re-derived:**
+
+| Site | VPN prefix | Shape |
+|---|---|---|
+| VR0 DC0 | `2602:f3e2:e02:e0::/60` | **`/60` parent ONLY -- no `/64`** |
+| Willamette | `2602:f3e2:102:e0::/60` | **`/60` parent ONLY -- no `/64`** |
+| VR1 dc0 / dc1 | none | -- |
+| (global, unscoped) | `fd7a:115c:a1e0::/48` role `vpn` | "Tailscale Addresses" |
+
+**VPN IS A RESERVATION AT BOTH PRECEDENTS, NEVER A CARVED PLANE** -- neither holds a `/64`,
+and neither holds any IPv4. That is a different shape from OOB, which holds `/60` + `/64` at
+both and was therefore a real gap.
+
+**WHY DEFERRAL IS COHERENT AND NOT AN OVERSIGHT.** VR1's VPN is Tailscale under D-129(iii)
+(operator: "Dedicated node per site"), and Tailscale supplies its own addressing from
+`fd7a:115c:a1e0::/48` -- a range this deployment does not carve. A VR1 `:e0::/60` would
+therefore reserve space with no defined occupant. A real site-to-site VPN is a Roosevelt
+concern, which is where the ruling pins it.
+
+**CONSEQUENCE, stated plainly: VR1's octet map diverges from VR0 and Willamette on exactly one
+hextet (`:e0`), by decision.** D-139 ruling B's "conforms to an existing org standard" claim
+should be read with that one documented exception. Nothing in D-139's execution list, the
+Stage-5 deploy, or any gate depends on `:e0`.
+
+**TRIGGER:** Roosevelt VPN/site-to-site design. Present alongside D-132 (per-DC MAAS topology)
+and D-131 sub-4 (pinned DNS review), which are pinned to the same design window.