Fix operational reset preview for updater runtimes

docs/development/ENGINEERING_PLATFORM_ROADMAP.md

@@ -477,6 +477,7 @@ The lane is:
 schema-68 implementation + fixture qualification
   -> protected review/full EP gates
   -> 2.3.81 exact-artifact release and authorized installation
+  -> 2.3.82 installed-preview inventory correction and exact-artifact release
   -> installed read-only preview
   -> later explicit coordinated Forge+EP clean-CENTRAL preflight
 ```

docs/engineering/EP_CENTRAL_OPERATIONAL_RESET_V1.md

@@ -2,7 +2,7 @@
 
 **Owning product:** Engineering Platform.  **Profile:**
 `EP_CENTRAL_OPERATIONAL_HISTORY_V1`.  **Server schema:** 68.  **Candidate
-release:** 2.3.81.
+release:** 2.3.82.
 
 This is a bounded local maintenance route for removing EP operational history
 while retaining installation identity, project and repository attachment,
@@ -163,6 +163,45 @@ classification. An arbitrary file hidden inside `runtime/`, `operations/`,
 blocks prepare without being moved or deleted. A pending CENTRAL import is an
 explicit active-ingest blocker.
 
+An exact `operations/<operation-id>/candidate-venv/` below a parseable owning
+`operation.json` and `candidate-runtime.json` is one opaque
+`INSTALLATION_RUNTIME` preserve boundary only when both records bind the same
+operation, the currently inspected CENTRAL installation identity, the exact
+owning update steps/cleanup roots, plan and candidate path. The
+preview records the directory boundary but does not descend into, hash, copy or
+follow its contents; normal Python virtual-environment links therefore do not
+become reset targets or false symlink findings. The `candidate-venv` directory
+itself must be a real directory. A linked venv root, a venv-shaped directory
+without its owning identity records, malformed or path-conflicting records,
+symlinks in other staging trees and unclassified sibling data remain
+fail-closed.
+
+The target identity is a non-empty canonical UUID and must match independently
+in `runtime-identity.json`, `ep_installations` and
+`engineering_metadata['installation.instance_id']`. Empty or malformed values
+and any pairwise disagreement block preview before updater staging can be
+classified. Marker, journal and prepared-candidate installation IDs must equal
+that same verified target UUID.
+
+Candidate preparation intentionally precedes journal creation. In that exact
+crash window, a closed-schema `candidate-runtime.json` may be the only durable
+owner record. If it binds the parent operation ID, installation, exact
+`candidate-venv`, contained staged wheel, target version/digest and source
+revision—and the staged wheel's bytes and canonical filename verify against
+that digest/identity—preview preserves the exact `candidate-venv`, `download` and
+`pip-cache` boundaries opaquely as
+`INSTALLATION_RUNTIME_STAGING_UNBOUND` and reports
+`INCOMPLETE_NO_OPERATION_JOURNAL`. It does not follow or copy their contents.
+This fallback applies only while `operation.json` is genuinely absent;
+malformed, linked or conflicting records fail closed. Any sibling outside
+those exact updater staging boundaries remains unknown.
+
+Every accepted opaque directory is held through a non-following directory
+descriptor. Immediately before the inventory receipt returns, preview requires
+both that pinned descriptor and the current path to remain the same directory
+device/inode. A directory-to-link replacement, including one after initial
+classification, fails closed without publishing a stale preserve receipt.
+
 ## Protected backup and recovery
 
 `prepare` requires an operator-selected backup root outside the active data
@@ -462,8 +501,11 @@ decision.
 
 ## Delivery status
 
-At source-candidate creation this slice is `IMPLEMENTED` and locally fixture
-qualified, while protected PR review, hosted full gates, release publication,
-artifact-byte qualification and installed live preview remain separate
+The installed 2.3.81 read-only preview proved schema 68, `quick_check`, foreign
+keys and counts, but exposed a false `EXTERNAL_SYMLINK_UNSAFE` blocker by
+descending into a preserved updater `candidate-venv`. Release 2.3.82 contains
+the targeted opaque-boundary correction and synthetic positive/negative
+qualification. Protected PR review, hosted full gates, release publication,
+artifact-byte qualification and a new installed live preview remain separate
 evidence. Installation may activate schema 68 and the chat relationship repair
 but must not automatically prepare/apply a reset or delete historical rows.

docs/engineering/EP_SERVER_PRODUCTION_RELEASE.md

@@ -17,6 +17,24 @@ maintenance controls; neither publication nor installation authorizes
 artifact qualification and an installed read-only preview are required before
 the capability can be reported installed.
 
+The 2.3.82 corrective patch keeps the same schema and reset semantics. It
+prevents read-only maintenance preview from recursively entering an exact
+updater-owned `operations/<id>/candidate-venv` and falsely rejecting normal
+virtual-environment symlinks. The venv is preserved as an opaque runtime
+boundary only when the journal and candidate marker bind its exact operation,
+current CENTRAL installation, closed updater step/cleanup contract and path.
+Opaque directories stay descriptor-pinned until the final inventory receipt,
+so a path swap cannot publish stale classification. All malformed,
+unrecognized and active-route symlink protections remain in force. Publication
+and installation still do not authorize a reset.
+
+The preview also recognizes the updater's bounded pre-journal crash window. A
+closed candidate marker may preserve only its exact candidate/download/cache
+staging boundaries as opaque `INSTALLATION_RUNTIME_STAGING_UNBOUND` after its
+canonical staged wheel filename and digest are verified, with an explicit
+incomplete-state readback. It never turns an arbitrary operation sibling,
+malformed marker or linked boundary into known product data.
+
 ## Release-operation lifecycle V1
 
 After both the production-wheel and dashboard qualifications succeed, the

package.json

@@ -1,7 +1,7 @@
 {
   "name": "engineering-platform-browser-validation",
   "private": true,
-  "version": "2.3.81",
+  "version": "2.3.82",
   "scripts": {
     "test:engineering-dashboard": "PYTHONPATH=src python3 -m engineering_platform.dashboard_browser_validation",
     "test:engineering-dashboard-logic": "node --test tests/engineering/dashboard_status_store.test.mjs tests/engineering/ui_localization_contract.test.mjs tests/engineering/dashboard_translation.test.mjs",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-platform"
-version = "2.3.81"
+version = "2.3.82"
 description = "Local-first Engineering Platform execution operations runtime"
 readme = "README.md"
 requires-python = ">=3.14,<3.15"

src/engineering_platform/ENGINEERING_PLATFORM_CONFIG.json

@@ -3,7 +3,7 @@
   "platform": {
     "id": "engineering-platform",
     "name": "Engineering Platform",
-    "version": "2.3.81",
+    "version": "2.3.82",
     "generation": 2,
     "documentation_namespace": "engineering-platform",
     "capability_registry_version": 1

src/engineering_platform/ENGINEERING_PLATFORM_STATUS.md

@@ -75,6 +75,24 @@ changes execution semantics.
   It targets the installation-owned CENTRAL database, executes `PRAGMA
   optimize` and `VACUUM` only when no CENTRAL lifecycle is active, and never
   opens, compacts or configures a project-local database.
+- The installation-owner maintenance preview inventories preserved updater
+  operations without entering a `candidate-venv` whose owning journal and
+  candidate marker bind the exact operation, current CENTRAL installation,
+  owning update steps/cleanup roots and path. That venv remains a
+  descriptor-pinned opaque installation-runtime boundary through final receipt
+  publication, while malformed or unbound records, path swaps, linked venv
+  roots, symlinks elsewhere, active ingest roots and unknown sibling data
+  remain fail-closed.
+- Operational-reset identity readback independently requires the same non-empty
+  canonical UUID in the runtime identity, installation table and installation
+  metadata. Empty, malformed or pairwise-conflicting values cannot authorize
+  opaque updater classification.
+- A candidate prepared before its update journal was durably created is
+  read back as `INSTALLATION_RUNTIME_STAGING_UNBOUND` only from its exact
+  closed-schema candidate marker. Its candidate/download/cache boundaries are
+  preserved opaquely only after the canonical staged wheel identity and digest
+  verify, with an explicit incomplete state; arbitrary siblings and malformed,
+  missing or conflicting markers remain blocking.
 - During an active run, a fully successful specialist review remains visible
   as compact historical evidence after the review phase. Partial, failed or
   running reviewer projections remain phase-scoped and are never presented as

src/engineering_platform/ENGINEERING_PLATFORM_VERSION.json

@@ -1,15 +1,15 @@
 {
   "bootstrap_contract": "2026.12",
   "checkpoint_format": 1,
-  "dashboard_version": "2.3.81",
+  "dashboard_version": "2.3.82",
   "handoff_protocol": 1,
   "memory_format": 2,
   "minimum_codex_cli": "0.146.0",
   "inbox_protocol": 1,
-  "platform_version": "2.3.81",
+  "platform_version": "2.3.82",
   "report_format": 2,
-  "runner_version": "2.3.81",
+  "runner_version": "2.3.82",
   "status_model": 1,
   "storage_schema": 45,
-  "watcher_version": "2.3.81"
+  "watcher_version": "2.3.82"
 }