diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index 507a191..c9753dc 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -1462,8 +1462,15 @@
 
 ## D-068: PROPOSED -- Vault substrate hardening (Roosevelt)
 
-**Status:** PROPOSED / OPEN 2026-07-02. Grouped substrate items surfaced while diagnosing D-067.
-None block v1 tenant work; all are Roosevelt-durability items.
+**Status:** PARTIALLY RULED (item 2 RULED 2026-07-21; items 1 and 3 open). Filed PROPOSED /
+OPEN 2026-07-02 -- grouped substrate items surfaced while diagnosing D-067. None block v1
+tenant work; all are Roosevelt-durability items. Item 2 RULED 2026-07-21 (GA-R5): question
+as presented = "rule Vault listener TLS (barbican<->Vault secret traffic currently crosses
+metal-internal as cleartext HTTP)?"; operator selection, exact utterance: "Require for
+Roosevelt (Recommended)". Vault listener TLS is a ROOSEVELT BUILD REQUIREMENT (lands at
+Roosevelt Vault standup with its own runbook step + verification); VR1/testcloud stays
+as-is under rehearsal posture. Item 1 (version migration) additionally needs the re-scoped
+plan per the 2026-07-05 amendment before it can be presented.
 
 1. **Vault version.** Live is 1.8.8 (charm 1.8/stable) -- EOL. bundle.yaml pinned to 1.16/stable
    this session (D-068). Live upgrade is a MAJOR operation (multi-minor jump; unseal keys ready,