diff --git a/_meta/decision-log.md b/_meta/decision-log.md
index 5ce2b3b..19a9fb6 100644
--- a/_meta/decision-log.md
+++ b/_meta/decision-log.md
@@ -2,6 +2,19 @@
 
 Records key architectural decisions for the Personal Agent OS.
 
+## 2026-09-26: VeriPath fleet rules and persistence-before-Regis
+
+**Decision:** Gatekeeper stays on irreversible calls only. CoS runs the rest. Fleet record lives in `Tony_tech/personal-agent-os`, not `veripath-operations`. Web app password was changed and is not stored in git. Park the Regis-to-Hermes line until Leonard, the web app, and the Cloudflare tunnel start without an interactive / RDP session.
+
+**Rationale:**
+- Password had leaked into Jimmy logs, Nous, and chat. Change first.
+- Web app currently dies when the remote session ends. Opening it on Headscale before persistence adds an attack surface and another babysitting job.
+- Ty stays out of Headscale changes unless Gatekeeper asks.
+
+**Next:** Windows scheduled task or service, run whether user is logged on or not. Then smallest Regis listen: `100.64.0.1` plus firewall allow `100.64.0.6` only.
+
+**Snapshot:** `memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md`
+
 ## 2026-06-20: Initial Repo Structure
 
 **Decision:** Created `personal-agent-os` as a single repo under `Tony_tech` org with `projects/`, `knowledge-base/`, `archive/`, `templates/`, `agent-config/`, and `_meta/`.