diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 500be01..6dff0eb 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -155,8 +155,11 @@
   30-min failures, commissioning scripts visible on serial; fleet of 8
   re-commissioned concurrently, ALL 9 READY in ~4 min, shapes exact to
   D-121 Option C. Committee record closed by addendum (its mechanisms
-  were wrong; its instrument found the cause). D-131 PROPOSED (rack-only
-  node DNS strategy -- Roosevelt-relevant). SEC-014 OPENED (rack cluster
+  were wrong; its instrument found the cause). D-131 PARTIALLY RULED
+  (sub-1 RULED 2026-07-21: the forwarder is the STANDING per-DC
+  pattern, repo-carried + part of DC standup definition-of-done;
+  sub-2..4 OPEN -- status line in design-decisions.md is the
+  authority). SEC-014 OPENED (rack cluster
   secret exposure during diagnosis). Queued delivery: forwarder +
   rack-legs repo-carried persistence, appendix-A entries, LP report,
   stale pod object cleanup. **MAC pinning SHIPPED 2026-07-21** (54 MACs
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index 4f3eb0a..e62a651 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -4176,7 +4176,14 @@
 
 ## D-131: node-facing DNS strategy for rack-only controllers [ARCH]
 
-**Status:** PROPOSED (authored 2026-07-21; interim workaround operator-ruled and live -- see below).
+**Status:** PARTIALLY RULED. Sub-decision 1 RULED 2026-07-21 (GA-R5): question as presented =
+"is the rack dnsmasq node-DNS forwarder the STANDING per-DC pattern, or a temporary measure
+until the upstream MAAS agent-resolver defect is fixed?"; operator selection, exact utterance:
+"Standing per-DC pattern (Recommended)". The forwarder is therefore the ruled node-DNS
+mechanism for rack-only DCs: site-keyed repo-carried delivery (unit + config + install/check
+script + harness, folding in rack-legs persistence per D-128 register item 20), applied to dc0
+and part of every future DC standup's definition-of-done; Roosevelt default unless the LP
+outcome (sub-decision 4, OPEN) rules otherwise. Sub-decisions 2-4 remain OPEN.
 
 **Context (measured, 2026-07-21).** MAAS 3.7's rack-only controllers serve node DNS from the
 `maas-agent` resolver, which on an internet-isolated rack SERVFAILs ALL queries -- including its