diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index b6d662a..a9e8dae 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -800,7 +800,11 @@
    a `creds-manifests/vm-secret-locations` list bounds `--remote` absolutely (no tenant
    surface touched, D-069 preserved). To be faithful the list must include the headend
    shadow stores (SEC-022), the region maas-secrets dir, and the three dirs outside the
-   SEC-009 convention found by the creation-point inventory. Sub-rulings 4-5 remain OPEN and the
+   SEC-009 convention found by the creation-point inventory. **SUB-RULING 4 RULED 2026-07-26:
+   "D-137 is the authority"** -- D-137 becomes the credential-lifecycle policy authority and
+   the SEC-009 convention block demotes to a pointer (its founding history stays in the
+   ledger as history); gates may then cite a D-number instead of an exposure register.
+   Sub-ruling 5 remains OPEN and the
    entry stays PROPOSED until all five are ruled; nothing is built before that.
    Research capture: `docs/audit/creds-creation-points-20260725.md`.
 
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index 4b486f6..15e0858 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -5064,8 +5064,24 @@
 ruling: a secret minted at a location nobody ever declares stays invisible -- so ADDING a
 row to this list is part of the definition-of-done for any new mint site.
 
-**Sub-rulings 4-5 OPEN** (policy home; whether the SEC-020 human/service identity
-conflation folds in). Design record, committee review and the measured findings
+**Sub-ruling 4 (POLICY HOME) -- RULED 2026-07-26.** Question as presented: "D-137 ruling
+4 of 5 -- policy home. Where does the credential-lifecycle RULE live as authority? Today
+it lives only in the security ledger, which is a register of exposures -- so no gate can
+cite it, and it has no Roosevelt-transferable home." Options presented: D-137 is the
+authority / policy stays in the ledger / split by audience. Operator selection, exact:
+**"D-137 is the authority (Recommended)"**. CONSEQUENCE: D-137 becomes the
+credential-lifecycle POLICY AUTHORITY. The SEC-009 standing-convention block in
+`docs/security-ledger.md` DEMOTES to a pointer at D-137, and the ledger returns to being
+purely a register of exposures and rotation obligations (its stated purpose, and the GA-R4
+F3 amendment's intent). Gates may then cite a D-number as authority rather than citing an
+exposure register. Satisfies the GA-R3 A1 test directly: a Roosevelt build session greps
+`docs/design-decisions.md` before touching a built surface, so the rule must live there to
+be found. IMPLEMENTATION CARE: the demotion must MOVE the convention text, not delete it
+-- SEC-009's block carries the founding history (the NetBox-token miss that motivated the
+control) and the enforcement description; that history stays in the ledger as history,
+while the RULE moves to D-137.
+
+**Sub-ruling 5 OPEN** (whether the SEC-020 human/service identity conflation folds in). Design record, committee review and the measured findings
 that shaped them: plan `whimsical-wandering-spindle`, capture
 `docs/audit/creds-creation-points-20260725.md`, rows SEC-021/-022/-023.