diff --git a/docs/reviews/2026-10-11-one-app-catalogue-facts-review.md b/docs/reviews/2026-10-11-one-app-catalogue-facts-review.md
new file mode 100644
index 0000000..c7c8fb8
--- /dev/null
+++ b/docs/reviews/2026-10-11-one-app-catalogue-facts-review.md
@@ -0,0 +1,61 @@
+# Informed Decision application-owner catalogue facts review
+
+```yaml
+reviewer: informed-decision-owner (agent informed-decision, codex)
+decision: approved
+work_item: INFD-WP-ADHOC-2026-10-11-T01
+scope: application-facts source acknowledgement only
+comment: >-
+  INTENT.md Purpose and What informed-decision Owns assign the decision surface
+  and browser client to this repository; What informed-decision Does Not Own
+  and Design Principles 9-10 reserve authorization, authentication and human
+  binding to their respective owners. Exact canonical-records.json SHA-256
+  ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b and refined
+  nine-file executor manifest SHA-256
+  0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7 were reviewed
+  under INFD-WP-ADHOC-2026-10-11-T01. Application facts agree with the native
+  identity/declaration/client/requester source and existing value-free receipts.
+```
+
+Application is `informed-decision`, display name `Informed Decision`, owner
+`informed-decision`, allowed profile scopes exactly `[global]`, allowed
+projection types exactly `[application_runtime]`. Binding is application
+`informed-decision`, browser OIDC client `informed-decision-approver`, protected
+system `informed-decision`, empty `catalog_namespaces`, null `event_source`
+and null `deployment_ref`. These are two catalogue metadata entities only;
+allowed profile/projection vocabulary is not a user permission or an IAM grant.
+
+`informed_decision/oidc.py` fixes the browser client, HTTPS origin and exact
+callback; `informed_decision/policy.py:build_request` submits protected system
+`informed-decision`. Governing INTENT.md declares `Staff`/`pep-shaped`, matching
+its derived `layer.yaml`; no layer or role change is proposed.
+`informed_decision/requester.py` instead fixes the separate create-only
+`informed-decision-sitting-requester`, authenticates service subject
+`informed-decision` and requests `approval:create`. The proposal correctly
+binds the browser client, without conflating it with that workload identity.
+
+The User Engine Application/ApplicationBinding model has no URL field.
+`https://decisions.coulomb.social/` remains context only, never an invented
+field or a substitute for event/deployment identity. Existing proposal receipts
+`native-entry-metadata.json`, `keycape-client-presence.json` and
+`native-preflight.json` retain TLS Ingress host/UID, native wrong-redirect
+refusal and absent exact catalogue rows, respectively. These dated receipts
+are supporting evidence, not a fresh live observation or real human MFA proof.
+
+The refined executor's APP/BINDING values agree with these facts. Its standalone
+SERVICE maintenance attribution and retained genuine ordinary PDP denial do
+not create a browser/human identity or claim a normal PDP allow. Exact founder
+exception disposition remains separately required. Single-use/native-clock
+expiry, created-only recovery and retained audit/outbox history are exception
+mechanisms reviewed by their owners; this application ACK neither approves
+those mechanisms for live use nor certifies downstream reversal. Dead-lettering
+excludes automatic drain only: privileged targeted delivery/replay can revive
+the retained event and remains outside the proposed maintenance authority.
+
+This entry records only the informed-decision-owner role. It changes no record
+status, bound claims, admission fields or authority; it approves no maintenance
+exception, credentials, login, native mutation, release or human disposition.
+Real human browser/MFA acceptance and USER-WP-0026-T03/USER-WP-0028-T02 closure
+remain independent gates. No owner-facts correction was found.
+
+Reviewed owner HEAD: `3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168`.
diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md
new file mode 100644
index 0000000..633baef
--- /dev/null
+++ b/workplans/ADHOC-2026-10-11.md
@@ -0,0 +1,41 @@
+---
+id: INFD-WP-ADHOC-2026-10-11
+type: workplan
+title: "Application-owner catalogue facts review"
+domain: infotech
+repo: informed-decision
+status: finished
+owner: codex
+topic_slug: netkingdom
+created: "2026-10-11"
+updated: "2026-10-11"
+flavor: planning
+---
+
+## Review exact one-application catalogue facts
+
+```task
+id: INFD-WP-ADHOC-2026-10-11-T01
+status: done
+priority: medium
+```
+
+Completed informed-decision application-owner source review under INTENT.md
+Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10,
+and Layer Placement. Read actual owner OIDC, requester and policy-request
+code, governing Staff/PEP-shaped declaration, User Engine model, and existing
+value-free native registration/Ingress/preflight receipts. Exact canonical
+facts agree. Browser client is distinct from create-only requester.
+
+Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md.
+Canonical facts SHA-256:
+`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`.
+Reviewed refined nine-file executor manifest SHA-256:
+`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`.
+
+This task completes the application-facts source review only. It grants no
+maintenance exception, native dry-run/apply/recovery, IAM permission, image
+release or human disposition. Existing User Engine native acceptance work
+remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
+created by this bounded review. No tests were needed for this evidence-only
+review; no native, credential or login action occurred.