@Walrus 

A) Seems to be right. Also, if you don't allow devices on Deco Main and Guest networks that you would not want to connect to whatever is wired to Archer, you could just connect Main Deco to Archer with no changes on VR900. Of course, disable WiFi on Archer.

The thing is, double NAP is not always bad. Some even consider it an extra security layer. If your wireless devices run with double NAT just fine, why bother? Also, for same reason, why bother with DMZ if you don't let untrusted WiFi devices on your Deco Main and Guest networks.

B) Can't speak for specifically VR900, when it is in bridge mode, but standard bridge mode configuration should disable all Ethernet ports but one.

>How are the 4 LAN ports configured in bridge mode? Are they all active?

Most likely, you'll only have one LAN port active in bridge mode. 

>For my 4 wired devices, I assume I will need a switch connected to the main deco unit?

This is correct.

@Alexandre. Thanks for your input.

Ideally, given scenario (A) I would like communication between the subnets. In this scenario I would like to keep 3 wired devices on the Archer + 1 wired Deco. And then 1 wired device from the main deco. In an ideal world, all wired devices and wireless (Deco) devices would communicate seamlessly. The rationale for the Deco in DMZ of the Archer, is to allow UPNP from wireless devices to operate (though I've yet to test this).

To be honest, it is looking like scenario (B) will be the simpler option, although it pains me to turn a decent router into a dumb modem. It also means I've another switch in the equation (it would be nice to be able to buy a single deco with mutiple LAN ports)

@Walrus 

I hate to bring my work home, that's why I usually go for easiest solutions when it comes to my home network. 

If I were in your position, I would do the following:

1) Buy 4-5 port gigabit switch, they are quite inexpensive nowadays;

2) Connect Deco to VR900, making no changes on it other than disabling WiFi;

3) Connect switch to Deco, reconnect to it all devices that were wired to VR900. Only Main Deco node will be left connected to VR900.

I would now have:

A) Same working configuration on VR900. I would hate to mess something on ISP gateway and then if there are networking problems - not knowing what caused them;

B) Deco router manages all devices on my network, wired and wireless. Problem with that - engage Deco tech support, everything happens inside Deco environment.

C) If I need to troubleshoot ISP Internet connectivity with their tech support, I could just connect wired desktop directly to free VR900 port and not confuse tech support with Deco mesh. If I don't have wired device I could enable WiFi back on Archer, connect wireless device to Archer WiFi and have clean environment for ISP related troubleshooting.

That would be me, of course. Your network, your playground.