diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 5971298..d60f925 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -173,9 +173,12 @@
   - **OPEN before deploy (from the expansion review):** RESOLVE-BEFORE-DEPLOY --
     (a) **vault VIP** (decorative-HA regression: vault scaled 3 + hacluster but NO vip
     anywhere; D-036 says vault carries VIPs; needs a dc1-band VIP overlay + the vault-HA
-    VERIFY-LIVE); (b) **v4-only vs dual-stack phasing** (vr1-dc1-vips v4 and
-    dc-dc-ipv6-family-matrix v4+v6 both own `vip:` -> per-key REPLACE collision if both
-    applied; operator decides). FOLLOW-UP scripts/gates -- preflight.sh runs the checker
+    VERIFY-LIVE); (b) **address family: RULED 2026-07-25** (D-101 CONFIRMED via a dated ruling note under
+    ## D-101; GA-R5) -- dual-stack where IPv4 is required, IPv6-only where IPv6-only is
+    sound, for BOTH DC0 and DC1 this deployment; the v4-only phasing option is CLOSED.
+    Consequence: the vr1-dc1-vips / dc-dc-ipv6-family-matrix per-key REPLACE collision must
+    be reconciled to ONE dual-family `vip` per app per DC before deploy -- no longer
+    deferrable. Octavia family remains an OPEN sub-ruling (see D-136 open question 2). FOLLOW-UP scripts/gates -- preflight.sh runs the checker
     BARE (must pass the dc1 overlays + --dc vr1-dc1); pre-flight-checks.sh VR0-frozen
     (no $DC selector, host_sysid-by-hostname); cloud-assert.sh false-passes decorative HA
     on the 12 scaled API services; `juju bootstrap` needs a controller-tag constraint;
diff --git a/docs/changelog-20260724-stage5-committee-fork1.md b/docs/changelog-20260724-stage5-committee-fork1.md
index 54db26e..cb9b6ad 100644
--- a/docs/changelog-20260724-stage5-committee-fork1.md
+++ b/docs/changelog-20260724-stage5-committee-fork1.md
@@ -181,6 +181,22 @@
 **Revert:** `git rm docs/audit/decision-recon-20260725.md` + restore the CURRENT-STATE
 Stage-4 recon bullet.
 
+## Item 12 -- Ruling 1 recorded (GA-R5): address-family policy
+
+**What:** recorded the operator's 2026-07-25 address-family ruling as a dated RULING NOTE
+under `## D-101` in `docs/design-decisions.md` (verbatim question + utterance) + resolved
+the CURRENT-STATE resolve-before-deploy bullet (b). Confirms D-101's matrix; NO amendment.
+**GA-R5 record.** Question: v4-only vs dual-stack for dc1 phase-4. Operator utterance,
+verbatim: "Dual stack to be used where IPv4 is required, IPv6 where IPv6 only makes sense."
+Clarifying, verbatim: "Dual stack deployment for DC0 and DC1. This is the deployment when
+the dual-stack is added".
+**Why:** GA-R5 -- the VIP reconciliation (dependent work) is invalid until this is
+committed+pushed. Closes the v4-only phasing option for both DCs. From the Chat handoff
+pack (`_handoff-not-committed/20-ruling-records.md`, ruling 1); the verbatim was
+transcribed into durable homes (D-101 note + here) rather than left in the delete-after-use
+pack file (committee BLOCKER-1 fix).
+**Revert:** `git revert <commit>` -- deletes the D-101 ruling note + restores bullet (b).
+
 ## Next (not done this session; gated)
 
 Commit+push this batch (GA-R5: rulings land before dependent work). Then, each
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index bd26269..9912344 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -2031,6 +2031,30 @@
 
 **Remaining open item:** the exact NetBox literals (org ULA /48, per-DC GUA carve, DC2's v4 supernet) -- pending NetBox assignment (gap #3 in `docs/dc-dc-deployment-workflow.md`'s tooling gap register), not a ratification question.
 
+### D-101 -- RULING NOTE (2026-07-25): address-family policy CONFIRMED (no amendment)
+
+**Status:** D-101's family matrix CONFIRMED by operator ruling 2026-07-25 (GA-R5). This
+NOTE records the ruling; it changes NOTHING in D-101 (the matrix rationale already reads
+"v6 wherever possible, v4 only where forced").
+
+Question as presented: whether dc1 phase-4 deploys v4-only (deferring IPv6, per the
+expansion review's option (b)) or dual-stack.
+
+Operator utterance, verbatim (2026-07-25): "Dual stack to be used where IPv4 is required,
+IPv6 where IPv6 only makes sense."
+
+Clarifying exchange, verbatim: "Dual stack deployment for DC0 and DC1. This is the
+deployment when the dual-stack is added"
+
+**Effect:** the v4-only phasing option (expansion review option (b)) is CLOSED, for BOTH
+DC0 and DC1 in this deployment. `overlays/vr1-dc1-vips.yaml` (v4-only) is not a
+D-101-conformant deploy input on its own; the `vr1-dc1-vips` / `dc-dc-ipv6-family-matrix`
+per-key REPLACE collision must be reconciled to ONE dual-family `vip` per app per DC
+before deploy. STILL OPEN under this ruling: octavia's family -- D-101 places `lb-mgmt`
+in the IPv6-only ULA group, but `overlays/dc-dc-ipv6-family-matrix.yaml` documents live
+upstream IPv6 breakage there (LP #1911788, #1913409); operator sub-ruling pending (see the
+D-136 open questions).
+
 ---
 
 ## D-102: IPv6 tenant addressing and MTU sub-policy (VR1)