docs: record native audit sender delivery and reload

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/informed-decision-source-registration.md

@@ -174,7 +174,7 @@ entry is **inert until the token exists** — asserted by test, not by reading.
 The ingress rule ANDs namespace and pod label in one `from` peer.
 `user-engine`'s and `approval-engine`'s policies are unchanged.
 
-## Still owed by others
+## Original owner handoff (current delivery recorded below)
 
 | Input | Owner | Note |
 | --- | --- | --- |
@@ -196,3 +196,20 @@ audit-core will not describe a commitment-only record as satisfying
 what was committed to it establishes nothing, except conditionally — if a
 document is later produced, whether it is the one. No conformance claim, ITC-CAP
 case, or `docs/integrity.md` statement may say otherwise.
+
+
+## Native delivery return — 2026-09-11
+
+The token is now independently held in OpenBao and delivered through its exact
+ESO projection. Namespace restrictions, sibling/full-registry/metadata/listing
+denials, wrong-SA/namespace refusals and the coding-agent boundary passed
+natively. Registry version 8 was compared exactly before Audit Core reloaded;
+receiver c82e0442 is Ready and operational/durable. The admitted manifests and
+sender ingress are applied. See the
+[native receipt](evidence/2026-09-11-factory-audit-delivery-live.json).
+
+Remaining admission evidence is actual producer accepted/duplicate delivery,
+receiver source/tenant/read refusal, independent readback and audit bearer
+revocation. No native producer event or operational heartbeat is claimed by
+the custody receipt. Attestation/offsite operation remains a separate evidence
+quality bound in AUDIT-WP-0009-T12.