Audit native transports and retain secure export diagnostics

docs/local-dlp-relay.md

@@ -28,9 +28,12 @@ Native evidence: `artifacts/webtransport-native-proof.json`. The receiver got
 zero packets/bytes with the private relay while ordinary HTTP loaded. The
 Windows core DLP and real restart fixtures also passed with relay integration.
 Chromium upgrades must repeat this receiver proof; it is version-specific.
-WebTransport-specific denial audit events are not yet observed because the
-native rejection occurs before existing HTTP/relay callbacks. Do not claim
-complete transport-attempt SIEM coverage from the ordinary DLP event pipeline.
+The native rejection still occurs before HTTP/relay callbacks. A private native
+observer now supplies real lifecycle records for the tested Window/dedicated
+Worker paths through enrollment and policy changes. See
+[native transport observation](native-transport-observability.md). These are
+Created/Closed observations, not inspected-payload decisions or universal
+transport coverage. The relay remains the release boundary.
 
 Inspected WebSocket/WebRTC support remains the intended compatibility goal.
 Uninspected transports remain restricted until their content gates have their