diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index d60f925..12b8c1b 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -184,7 +184,10 @@
     on the 12 scaled API services; `juju bootstrap` needs a controller-tag constraint;
     phase-4 Step 4 de-stale. VERIFY-LIVE gates: vault 1.8 HA-on-MySQL@3 (D-121), hacluster
     cluster_count:3 semantics, Ceph pools size=3/min_size=2/failure-domain=host,
-    machines-block overlay merge (`--dry-run`).
+    machines-block overlay merge (`--dry-run`); **keystone policyd-override (RULED
+    2026-07-25): `juju status` shows `PO:` on EVERY keystone unit after scale-up, never
+    `PO (broken):`** -- a broken override is atomic (whole policy discarded, silently
+    reverting every tenant domain-manager to a plain user; protects D-051/D-064).
   - **NetBox->deploy coupling PROPOSED -> Chat (design seat).** A per-DC renderer/pipeline
     that GENERATES the overlays + tfvars from NetBox IPAM (eliminating the hand-render
     fragility + the VIP-overlay collision by construction, making the deploy gates
diff --git a/docs/changelog-20260724-stage5-committee-fork1.md b/docs/changelog-20260724-stage5-committee-fork1.md
index cb9b6ad..8a94c5b 100644
--- a/docs/changelog-20260724-stage5-committee-fork1.md
+++ b/docs/changelog-20260724-stage5-committee-fork1.md
@@ -197,6 +197,23 @@
 pack file (committee BLOCKER-1 fix).
 **Revert:** `git revert <commit>` -- deletes the D-101 ruling note + restores bullet (b).
 
+## Item 13 -- Ruling 2 recorded (GA-R5): keystone policy-override VERIFY-LIVE gate
+
+**What:** added a Stage-4 VERIFY-LIVE gate to CURRENT-STATE -- after `dc-ha-scaleup` scales
+keystone to 3, `juju status` must show `PO:` on EVERY keystone unit, never `PO (broken):`.
+**GA-R5 record.** Question: whether to add a VERIFY-LIVE gate confirming the
+`policyd-override` resource lands on every keystone unit after scale-up (a broken override
+is atomic -- the whole policy is discarded, silently reverting every tenant domain-manager
+to a plain user). Operator utterance, verbatim: "dc-ha-scaleup: Yes to the verify-live".
+**Why:** highest-consequence single check in the deploy -- it protects the SCS Domain
+Manager persona (D-051/D-064) the commercial tenant self-service model rests on, and
+failure has no other symptom. Mechanism intact at HEAD (`bundle.yaml` `use-policyd-override:
+true` + `resources: policyd-override` -> `policies/overrides.zip` 3419 bytes;
+`keystone-policy-drift.sh` byte-matches source) -- the gate confirms it SURVIVES scale-up.
+From the Chat handoff pack ruling 2; verbatim transcribed to a durable home (here), not
+left in the delete-after-use pack file.
+**Revert:** `git revert <commit>` -- removes the gate line.
+
 ## Next (not done this session; gated)
 
 Commit+push this batch (GA-R5: rulings land before dependent work). Then, each