docs(factory): retain verified critical-path execution and admission handoff

docs/assessments/2026-09-08-helixforge-factory-followthrough.md

@@ -1,5 +1,9 @@
 # Factory implementation return — 2026-09-08
 
+Later execution: [critical-path corrections and next admission](2026-09-08-helixforge-factory-critical-path.md)
+records the installed policy fix, pinned KeyCape rollout candidate, resolved
+audit scope inputs and thirteen updated owner-return records.
+
 The user authorized following through and selected vergabe-teilnahme as the
 primary customer service/UI product. The Custodian selected reuse-surface for
 the first internal capability: its existing hosted registry offers immediate
@@ -48,10 +52,11 @@ restored to disabled. Current main ancestry was verified before the operations.
 Non-secret [publication receipts](https://forgejo.coulomb.social/coulomb/prj-helixforge-factory/src/branch/main/evidence/pr-merge-receipts.json)
 are retained in the project.
 
-The credential proxy reported flex-auth unavailable and its configured
-unknown-zone fail-open behavior during this attended publication. HFACT-WP-0001-T03
-retains live policy availability and authorization-negative verification before
-governed execution acceptance. Login success is not that enforcement proof.
+The credential proxy reported flex-auth unavailable and unknown-zone fail-open
+during publication. Subsequent critical-path execution reproduced an explicit
+HTTP 403 from the reachable PDP, fixed that misclassification and verified the
+installed CLI now refuses before credential transport. WARDEN-WP-0039-T03 and
+HFACT-WP-0001-T03 retain the exact delegated policy binding and live admission.
 
 The workplan retains exact native credential/approval/audit receipts through
 GLAS-WP-0015, protected runtime placement, natural worker claim/heartbeat/close,