diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index c9753dc..d546538 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -1469,8 +1469,17 @@
 metal-internal as cleartext HTTP)?"; operator selection, exact utterance: "Require for
 Roosevelt (Recommended)". Vault listener TLS is a ROOSEVELT BUILD REQUIREMENT (lands at
 Roosevelt Vault standup with its own runbook step + verification); VR1/testcloud stays
-as-is under rehearsal posture. Item 1 (version migration) additionally needs the re-scoped
-plan per the 2026-07-05 amendment before it can be presented.
+as-is under rehearsal posture. Item 3 RULED 2026-07-21 (GA-R5): question as presented =
+"rule the AppRole secret_id lifecycle posture (TTL audit + renewal + proactive auth
+probe)?"; operator selection, exact utterance: "Adopt + probe on VR1 now" (NOT the
+recommended lean -- operator chose the wider scope). All three legs are Roosevelt build
+requirements (TTL audit at standup; long/renewable TTLs or charm auto-renewal; proactive
+per-consumer Vault auth probe in standing health checks), AND the auth probe additionally
+ships into `cloud-assert.sh` for the CURRENT deployment (T4-style login check; must no-op
+gracefully while the VR1 substrate carries no Juju/Vault yet -- Stage 5 arrival). Delivery
+queued this session: script change + harness + changelog per the change-delivery loop.
+Item 1 (version migration) additionally needs the re-scoped plan per the 2026-07-05
+amendment before it can be presented. Only item 1 now remains open on this entry.
 
 1. **Vault version.** Live is 1.8.8 (charm 1.8/stable) -- EOL. bundle.yaml pinned to 1.16/stable
    this session (D-068). Live upgrade is a MAJOR operation (multi-minor jump; unseal keys ready,