diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 14679d3..b6d662a 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -796,7 +796,11 @@
    manifests from matrix"** -- the matrix is SINGLE SOURCE, `--render` regenerates
    `creds-manifests/*.manifest`, gauntlet fails on rendered-vs-checked-in drift; accepted
    cost is that manifests become generated (their governance prose must become matrix
-   fields, not be dropped). Sub-rulings 3-5 remain OPEN and the
+   fields, not be dropped). **SUB-RULING 3 RULED 2026-07-26: "Declared locations only"** --
+   a `creds-manifests/vm-secret-locations` list bounds `--remote` absolutely (no tenant
+   surface touched, D-069 preserved). To be faithful the list must include the headend
+   shadow stores (SEC-022), the region maas-secrets dir, and the three dirs outside the
+   SEC-009 convention found by the creation-point inventory. Sub-rulings 4-5 remain OPEN and the
    entry stays PROPOSED until all five are ruled; nothing is built before that.
    Research capture: `docs/audit/creds-creation-points-20260725.md`.
 
diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index d492ae1..4b486f6 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -5040,8 +5040,32 @@
 load-bearing: `vr1-dc1.manifest:18-20` is what recorded the dc0 edge-keypair backfill
 debt, and `vr1-office1.manifest:24-27` carries the un-consolidated residue.
 
-**Sub-rulings 3-5 OPEN** (`--remote` discovery scope; policy home; whether the SEC-020
-human/service identity conflation folds in). Design record, committee review and the measured findings
+**Sub-ruling 3 (REMOTE DISCOVERY SCOPE) -- RULED 2026-07-26** (this session crossed the
+date boundary; sub-rulings 1-2 were given and pushed 2026-07-25). Question as presented:
+"D-137 ruling 3 of 5 -- remote discovery scope. This is the half that finds
+unknown-unknowns (it's what would catch the shadow `*-creds/` stores on voffice1,
+SEC-022). The tension is tenant isolation on a commercial multi-tenant cloud." Options
+presented: declared locations only / declared plus a bounded home sweep / broad
+filesystem sweep. Operator selection, exact: **"Declared locations only (Recommended)"**.
+CONSEQUENCE: a new declared list (`creds-manifests/vm-secret-locations`, rows
+`<host-role> <path>`) bounds `--remote` absolutely -- it never walks outside the list. No
+tenant surface is touched; the D-069 custody boundary and the hard-isolation posture are
+preserved, and the check stays fast and auditable on a live region.
+
+**FAITHFUL-IMPLEMENTATION NOTE (not an override).** "Declared locations" must be
+populated with everything ALREADY KNOWN to hold credential material, or this ruling
+leaves measured defects uncovered. The list must therefore include, at minimum: per-site
+creds folders on the jumphost AND on the headend (SEC-022 -- the shadow stores), the
+region's `/root/maas-secrets/` (SEC-020), and the three directories the creation-point
+inventory found outside the SEC-009 convention (`docs/audit/creds-creation-points-20260725.md`
+FINDING 2): the Vault init directory (5 unseal shares + root token), the Octavia PKI
+directory (8 artifacts incl. two CA private keys), and the per-tenant directories. ALSO
+`overlays/octavia-pki.yaml` inside the repo clone. Accepted residual, inherent to the
+ruling: a secret minted at a location nobody ever declares stays invisible -- so ADDING a
+row to this list is part of the definition-of-done for any new mint site.
+
+**Sub-rulings 4-5 OPEN** (policy home; whether the SEC-020 human/service identity
+conflation folds in). Design record, committee review and the measured findings
 that shaped them: plan `whimsical-wandering-spindle`, capture
 `docs/audit/creds-creation-points-20260725.md`, rows SEC-021/-022/-023.