diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 94e9c30..a6a8154 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -521,12 +521,12 @@
    (monthly-review window trigger; patch-only controller jumps; order;
    acceptable single-controller risk) as amended by the confirmed backup
    posture (:1677).
-5. D-129 -- four OPEN sub-decisions (OPEN / PARTIALLY RULED,
-   `docs/design-decisions.md:4017`): (i) is the boundary edge in-scope for
-   COS scraping (D-105 scope)? (ii) `os-frr` dynamic routing -- Roosevelt
-   question? (iii) consolidate the Tailscale subnet-router onto the edge
-   vs keep D-107 as-is? (iv) does the edge anchor site NTP? Plus the
-   operator-gated live install of the ruled VR1 profile
+5. D-129 -- three OPEN sub-decisions (OPEN / PARTIALLY RULED; (i) RULED
+   2026-07-21: COS scrapes the edge, in-scope per-DC -- status line in
+   design-decisions.md is the authority): (ii) `os-frr` dynamic routing
+   -- Roosevelt question? (iii) consolidate the Tailscale subnet-router
+   onto the edge vs keep D-107 as-is? (iv) does the edge anchor site
+   NTP? Plus the operator-gated live install of the ruled VR1 profile
    (`scripts/opnsense-plugins.sh apply vr1-edge`).
 6. Audit Phase 4 rulings: GA-R1..GA-R6 individually, plus the legal
    stage-status vocabulary A/B (GA-F10 operator note) -- each gated, one
diff --git a/docs/changelog-20260721-tenant-review-pin.md b/docs/changelog-20260721-tenant-review-pin.md
index 04a6156..f9d92e3 100644
--- a/docs/changelog-20260721-tenant-review-pin.md
+++ b/docs/changelog-20260721-tenant-review-pin.md
@@ -79,3 +79,15 @@
   MAAS design time. Ledger next-free re-seeded D=133; CURRENT-STATE
   section 8 items 7-8 added (same-commit coupling).
 - **Revert:** git revert this commit (records only).
+
+## 6. D-129 sub-decision (i) RULED: COS scrapes the edge, in-scope per-DC
+
+- Question grounded on D-105 (ADOPTED: COS per-DC, no Office1 roll-up)
+  and presented per GA-R5; operator selection, exact utterance:
+  "In-scope, per-DC (Recommended)". Recorded in the D-129 Status line
+  (the ruling authority); the Step-10 os-node-exporter + API-backend pin
+  is now ungated at its deployment step. No live change this session --
+  the install itself remains at its pinned step, operator-gated.
+- Coupled same-commit: CURRENT-STATE section 8 item 5 (four -> three open
+  subs) + ledger machine-block D-129 line.
+- **Revert:** git revert this commit (records only).
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index 5413104..8d83b46 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -4064,7 +4064,14 @@
 
 ## D-129: OPNsense edge plugin / add-on base profile (VR1 -> Roosevelt) [OPS]
 
-**Status:** OPEN (PARTIALLY RULED 2026-07-18) -- profile adopted, FOUR sub-decisions still OPEN.
+**Status:** OPEN (PARTIALLY RULED 2026-07-18; sub-decision (i) RULED 2026-07-21) -- profile
+adopted, THREE sub-decisions still OPEN ((ii)-(iv)). Sub-decision (i) RULED 2026-07-21 (GA-R5):
+question as presented = "is the boundary edge (OPNsense) in-scope for COS scraping, within
+D-105's per-DC observability model?"; operator selection, exact utterance: "In-scope, per-DC
+(Recommended)". Each DC's COS scrapes its OWN edge; the Step-10 pin (os-node-exporter + API
+backend) is therefore UNGATED and lands at its pinned deployment step; exporter listener bound
+to the management plane only; D-105's per-DC failure-domain isolation preserved (no Office1
+roll-up; Roosevelt revisit rides D-105's existing sub-item).
 Operator directive: "install the OPNsense recommendations and pin the full engineering for the rest for
 the appropriate steps in the upcoming deployment(s)". The
 plugin PROFILE is adopted: `os-qemu-guest-agent` + `os-iperf` directed for the VR1 edge via the D-113
@@ -4072,8 +4079,8 @@
 (auto-mode classifier blocked the agent's POST -- cloud mutations stay gated), verification pending. The
 rest is PINNED to its deployment step (mapping below). **FOUR sub-decisions remain OPEN** (a one-line
 directive does not rule these -- they were flagged as decisions, not adds): (i) COS-scrapes-the-edge
-scope, (ii) `os-frr` dynamic routing, (iii) `os-tailscale` subnet-router consolidation, (iv)
-edge-as-site-NTP.
+scope (RULED 2026-07-21, see Status), (ii) `os-frr` dynamic routing, (iii) `os-tailscale`
+subnet-router consolidation, (iv) edge-as-site-NTP.
 
 **Pinned at deployment steps (the "engineering for the rest").**
 - **VR1 edge base profile = {`os-qemu-guest-agent`, `os-iperf`}** -> applied at DC-edge bring-up.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 3d6344f..ff62eb3 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -34,7 +34,8 @@
 
 - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt), D-071 (routine
   update cadence + Juju controller patch policy), D-129 (OPNsense edge plugin/add-on base
-  profile -- OPEN / partially ruled, four sub-decisions), D-131 (node-facing DNS strategy for
+  profile -- OPEN / partially ruled, three sub-decisions; (i) COS-scrapes-edge ruled in-scope
+  per-DC 2026-07-21), D-131 (node-facing DNS strategy for
   rack-only controllers -- PARTIALLY RULED: sub-1 ruled + delivered 2026-07-21, sub-2 ruled
   2026-07-21 (metal-admin only), sub-3 resolved 2026-07-21 (no defect), sub-4 open + pinned
   DNS architectural review;