docs(T07): settle the approver origin as decisions.coulomb.social

The operator assigned decisions.coulomb.social, not the decide.coulomb.social
this workplan proposed. Redirect URIs match byte-exactly at /authorize, so the
proposal is corrected in place rather than reconciled after submission — a
one-character miss presents as a rejected approval, not as a registration
defect.

DNS resolves. The Ingress and certificate are written in railiance-apps
(manifests/informed-decision-ingress.yaml, dry-run clean) but not applied, so
T07 stays progress: DNS alone is not an origin, and a host that does not answer
over TLS fails the same way a wrong hostname does, only later.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EJbh7o7UWF4tQ5jxygnNGu

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2072522@bnt-lap001
Assistant-Session: 46173adf-7302-4ede-99d6-963b61359928

docs/keycape-client-registration.md

@@ -28,25 +28,34 @@ That component is this repository. These are the two strings.
 | Field | Value |
 | --- | --- |
 | `client_id` | `informed-decision-approver` |
-| Redirect URI | `https://<origin>/auth/callback` |
+| Redirect URI | `https://decisions.coulomb.social/auth/callback` |
 
 **`client_id` is fixed and stable.** It will not change.
 
-**The origin is the one outstanding input.** Redirects match exactly at
-`/authorize`, so a near-miss fails closed — which is precisely why
-`approval-engine` refused to guess and why this document is not yet submitted.
+**The origin is settled.** 2026-09-10: the operator assigned
+`decisions.coulomb.social` to this surface. It is not the
+`decide.coulomb.social` this document proposed — the assigned name is the one
+that counts, and it is recorded here rather than the proposal, because
+redirects match exactly at `/authorize` and a near-miss fails closed. That
+exactness is why `approval-engine` refused to guess in the first place, and it
+is the reason the proposed name is corrected here before submission rather
+than reconciled afterwards.
 
-- **Proposed:** `decide.coulomb.social`, giving
-  `https://decide.coulomb.social/auth/callback`.
+- **Assigned:** `decisions.coulomb.social`, giving
+  `https://decisions.coulomb.social/auth/callback`.
 - **Consistent with** the estate's existing pattern (`forgejo.coulomb.social`,
   `hub.coulomb.social`, `kc.coulomb.social`), Traefik `ingressClassName`, TLS
   secret per host.
-- **Requires, in `railiance-apps` rather than here:** a DNS A record for
-  `decide.coulomb.social`, an Ingress manifest, and a certificate.
+- **DNS resolves** to the cluster address as of 2026-09-10.
+- **Still requires, in `railiance-apps` rather than here:** an Ingress manifest
+  and an issued certificate. Manifest written 2026-09-10
+  (`manifests/informed-decision-ingress.yaml`); not yet applied.
 
-**This document is submitted to `key-cape` when that origin resolves — not
-before.** The path component `/auth/callback` is fixed now so only the host
-remains variable.
+**This document is submitted to `key-cape` once the host answers over TLS — not
+before.** DNS alone is not the origin; an origin that does not complete a TLS
+handshake fails the same way a wrong hostname does, only later. The path
+component `/auth/callback` was fixed ahead of the host, so nothing else in this
+registration moves.
 
 ---
 
@@ -163,6 +172,6 @@ while it stands.
 
 | # | Item | Owner |
 | --- | --- | --- |
-| 1 | DNS A record + Ingress + TLS for the chosen origin | `railiance-apps` / deployment |
+| 1 | ~~DNS A record~~ (done 2026-09-10) + Ingress + TLS for `decisions.coulomb.social` | `railiance-apps` / deployment |
 | 2 | Submit this document to `key-cape`, closing `KEY-WP-0013-T02` | this repo, once 1 lands |
 | 3 | Prove a token issued against the registration is accepted by `approval-engine` | `T08` |