diff --git a/docs/informed-decision-origin.md b/docs/informed-decision-origin.md
index af0b271..4d6a07b 100644
--- a/docs/informed-decision-origin.md
+++ b/docs/informed-decision-origin.md
@@ -1,6 +1,7 @@
 # decisions.coulomb.social — origin for the informed-decision approver surface
 
-**Status:** manifests written and dry-run clean; **not applied**.
+**Status:** applied and live. `https://decisions.coulomb.social/` answers 200
+over a valid Let's Encrypt certificate as of 2026-09-10 14:32 UTC.
 Last reviewed: 2026-09-10
 
 ## Why this host exists before the app does
@@ -65,7 +66,28 @@ explicitly rather than relying on rule order.
   server dry-run cannot create the new one first; see
   `DRY_RUN_CREATE_NAMESPACES` in `tools/k8s-server-dry-run.sh`.
 
-## To deploy (operator approval required — not yet given)
+## Deployed 2026-09-10
+
+Applied with operator approval. Evidence:
+
+| Check | Result |
+| --- | --- |
+| Placeholder pod | `1/1 Running`, `/healthz` → `ok` in-pod |
+| Certificate `informed-decision-tls` | `Ready=True`, ACME order `valid` |
+| Issuer / subject | `CN=decisions.coulomb.social`, Let's Encrypt `YR2` |
+| Validity | `2026-09-10` → `2026-12-09` (cert-manager renews) |
+| `GET https://decisions.coulomb.social/` | `HTTP/2 200`, chain verify `0` |
+| `GET https://decisions.coulomb.social/auth/callback` | `200` — the exact redirect URI resolves |
+
+`/auth/callback` currently returns the placeholder page via the SPA `try_files`
+fallback. That is the correct behaviour for now: the origin answers, which is
+what the registration needs. The real surface will handle the path when
+`INFD-WP-0001-T08` ships.
+
+**`informed-decision` is unblocked to submit `docs/keycape-client-registration.md`
+to `key-cape` and close `KEY-WP-0013-T02`.**
+
+## Redeploy / recovery
 
 ```bash
 export KUBECONFIG=$HOME/.kube/config-hosteurope
@@ -76,8 +98,8 @@ kubectl -n informed-decision get certificate informed-decision-tls -w
 curl -sSI https://decisions.coulomb.social/ | head -1
 ```
 
-Only when that `curl` succeeds does `informed-decision` submit
-`docs/keycape-client-registration.md` to `key-cape`.
+That `curl` succeeded on 2026-09-10, which is the gate `informed-decision` was
+waiting on.
 
 **Note on the kubeconfig:** `~/.kube/config-hosteurope` names port `16443`, but
 the `k3s-api-railiance01` ops-bridge tunnel currently listens on `16444`.