diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index a312db0..9e0603d 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -4590,3 +4590,48 @@
 position). D-120's own office1 compose-net ranges (10.10.1.0/24) are UNTOUCHED -- this
 amendment diverges the DC planes from the compose-net band order deliberately (nodes
 mid-row, dynamic high) and is the authority for that divergence.
+
+---
+
+## D-135: ADOPTED -- VR1 per-DC artifact mirror realization (D-107 build-out, staged) [ARCH]
+
+**Status:** ADOPTED 2026-07-23 (Stage 4, branch dc-dc-stage4-phase3-maas-deploy). Two
+GA-R5 exchanges, both quoted. (1) The Stage-4 mirror gate: a rehearsal-scoped D-107
+exception was presented as Recommended and REJECTED -- operator answer: "Build the
+mirror now". (2) This staged plan: question "Adopt the D-135 staged mirror plan
+(rack-host placement at the utility .4 address per DC) and build item 1 -- the apt +
+Ubuntu Cloud Archive mirror, debmirror+nginx, both DCs -- now?"; operator answer:
+"Adopt + build item 1 (Recommended)".
+
+**Decision.** D-107's per-DC mirror is BUILT (not excepted) for VR1, staged by what
+Stage 5 consumes:
+- **Placement (all classes):** ON each DC's rack host (vvr1-dc0 / vvr1-dc1; measured
+  2026-07-23: 2.9T disk, ~9G used, ~400G free RAM each), served at the FIRST D-134
+  utility-band address on metal-admin: dc0 10.12.8.4, dc1 10.12.68.4 (alias on the
+  metal-admin bridge, forwarder-.3 pattern; bridge DISCOVERED from the libvirt net
+  name, never a baked virbrN). Repo-carried, site-keyed `scripts/dc-mirror.sh` +
+  harness; part of DC-standup definition-of-done from here on. Roosevelt analog: the
+  same service on per-DC utility nodes (D-132/D-133 pinned set).
+- **Item 1 (BUILT NOW): apt + UCA.** Full jammy amd64 BINARY mirror
+  (main/restricted/universe/multiverse; jammy + jammy-updates + jammy-security; no
+  sources) plus Ubuntu Cloud Archive jammy-updates/caracal, synced per-DC through
+  that DC's OWN edge (D-107 sub-item: independent upstream pull, confirmed), served
+  by nginx. Stage-5 wiring: `juju model-config apt-mirror=` per DC model -- MAAS
+  global config and office1 untouched.
+- **Item 2 (PINNED to Stage 5 open): images/simplestreams** (sstream-mirror; Juju
+  container-image metadata + glance-simplestreams-sync mirror config; amphora stays
+  locally built via octavia-diskimage-retrofit -- no mirror class).
+- **Item 3 (measure-then-rule at Stage 5 start): charmhub + snaps.** NOT designed
+  here; first deploy measures what the controller/nodes actually fetch, then options
+  (local charm files via `juju download` / caching proxy / snap-store-proxy) get
+  their own ruling.
+- **Egress narrowing is the CLOSING mutation:** D-107's edge scope (NTP + mirror
+  sync ONLY; general node egress killed) is applied AFTER the mirror proves out,
+  not before.
+- **NTP conflict resolved:** D-107's nodes-chrony-from-edge is SUPERSEDED by the
+  later D-129(iv) ruling (MAAS hierarchy stays the time authority); the edge remains
+  the SITE's upstream sync point.
+
+**A1 test:** Roosevelt greps this for the mirror service shape, the utility-address
+convention, the staged class order, and the measure-then-rule posture on
+charmhub/snaps.