diff --git a/README.md b/README.md
index 56b9b51..fd63dc0 100644
--- a/README.md
+++ b/README.md
@@ -48,4 +48,6 @@ exporter and failure/absence rules for package integration.
 The [email acknowledgment component](docs/alert-acknowledgment.md) records an
 explicit Railiance admin confirmation with a durable audit-core outbox. It is
 not activated. Identity/policy adapters are implemented; native package admission,
-SMTP password custody and recipient proof remain under T04.
+webhook/audit custody and audited alert confirmation remain under T04. SMTP
+custody and delivery are verified, including Bernd’s confirmed inbox receipt
+of the transport-test email.
diff --git a/docs/alert-acknowledgment.md b/docs/alert-acknowledgment.md
index f87503b..e37245f 100644
--- a/docs/alert-acknowledgment.md
+++ b/docs/alert-acknowledgment.md
@@ -144,13 +144,17 @@ The optional receiver test uses actual audit-core ingestion and SQLite with
 synthetic credentials: first accepted, lost reply, then duplicate after restart.
 It is not production custody proof. The template follows the upstream
 [notification data contract](https://prometheus.io/docs/alerting/latest/notifications/).
-The founder created `platform@coulomb.social`. The reviewed platform helper
-creates `platform/workloads/railiance-telemetry/smtp` without a password through
-attended OpenBao login. The founder then adds `SMTP_PASSWORD` as a new version,
-preserving existing public SMTP fields.
-Live activation remains blocked on password provisioning, dedicated credential custody,
-client/caller admission, runtime rollout and recipient/readback drills.
-No email or production acknowledgment is claimed.
+The founder created `platform@coulomb.social` and supplied `SMTP_PASSWORD` in
+OpenBao at `platform/workloads/railiance-telemetry/smtp`. Version 2 passed native
+IONOS authentication. The dedicated ESO reader and credential projection are
+Ready; the password was preserved. After adding scoped SMTP egress, the native
+transport test succeeded and Bernd confirmed inbox receipt. See
+`history/2026-09-28-alert-acknowledgment.md` for the evidence sequence.
+
+Live acknowledgment activation remains blocked on webhook/audit sender custody,
+OIDC client and enforced PDP caller admission, runtime rollout and actual alert
+confirmation with independent audit readback. The successful transport-test
+email does not establish those remaining facts.
 
 Runtime validation (hash-pinned dependencies in requirements-runtime.lock):