diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 0e76d4b..14679d3 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -792,7 +792,11 @@
    (GA-R5, utterance quoted in the D-137 Status block): "Blocking in preflight"** --
    the check lands as a new `Pn` in `scripts/preflight.sh` and HARD-FAILS on any
    expected-but-absent / undeclared / per-DC-asymmetric credential. The PreToolUse
-   guard and advisory-only were NOT adopted. Sub-rulings 2-5 remain OPEN and the
+   guard and advisory-only were NOT adopted. **SUB-RULING 2 RULED 2026-07-25: "Derive
+   manifests from matrix"** -- the matrix is SINGLE SOURCE, `--render` regenerates
+   `creds-manifests/*.manifest`, gauntlet fails on rendered-vs-checked-in drift; accepted
+   cost is that manifests become generated (their governance prose must become matrix
+   fields, not be dropped). Sub-rulings 3-5 remain OPEN and the
    entry stays PROPOSED until all five are ruled; nothing is built before that.
    Research capture: `docs/audit/creds-creation-points-20260725.md`.
 
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index 4a66afb..d492ae1 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -5023,9 +5023,25 @@
 collapse a fragmented gate surface into one artifact, so a creds gate operators must
 remember to run separately is the exact failure mode preflight was built to delete.
 
-**Sub-rulings 2-5 OPEN** (derivation: manifests generated FROM the matrix vs dual
-maintenance; `--remote` discovery scope; policy home; whether the SEC-020 human/service
-identity conflation folds in). Design record, committee review and the measured findings
+**Sub-ruling 2 (DERIVATION) -- RULED 2026-07-25.** Question as presented: "D-137 ruling
+2 of 5 -- derivation. The committee's main risk finding was GA-F06: a hand-maintained
+matrix becomes a fourth surface that goes stale, fails falsely, and gets switched off.
+How do the matrix and the manifests relate?" Options presented: derive manifests from the
+matrix / cross-check only / thin overlay on manifests. Operator selection, exact:
+**"Derive manifests from matrix (Recommended)"**. CONSEQUENCE: the matrix is the SINGLE
+SOURCE. `creds-matrix` gains a `--render` mode that regenerates
+`creds-manifests/*.manifest`, and the gauntlet FAILS if the checked-in manifests differ
+from rendered output -- dual maintenance is eliminated, matching the D-136
+generate-don't-duplicate instinct. ACCEPTED COST, stated at ruling time: the manifests
+become GENERATED artifacts, so hand-edits will be clobbered and today's governance prose
+(SEC-NNN linkage, mint dates/hosts, the "off-manifest" carve-outs for the Juju client
+credential store, the deliberately-un-consolidated findings) must become MATRIX FIELDS or
+be regenerated into the rendered header -- it must not be silently dropped. That prose is
+load-bearing: `vr1-dc1.manifest:18-20` is what recorded the dc0 edge-keypair backfill
+debt, and `vr1-office1.manifest:24-27` carries the un-consolidated residue.
+
+**Sub-rulings 3-5 OPEN** (`--remote` discovery scope; policy home; whether the SEC-020
+human/service identity conflation folds in). Design record, committee review and the measured findings
 that shaped them: plan `whimsical-wandering-spindle`, capture
 `docs/audit/creds-creation-points-20260725.md`, rows SEC-021/-022/-023.