docs: record Forge 2.7.25 Mission 3 preflight

BOOTSTRAP.md

@@ -58,6 +58,11 @@ binds the protected implementation and updater deliveries, exact published
 Forge 2.7.25 artifacts, safe schema 38→39 activation, preservation and normal
 installed readback. It does not authorize a reset or Mission 3.
 
+The separately authorized Forge 2.7.25 Mission-3 acceptance preflight is
+recorded in [Mission 3 on Forge 2.7.25 — blocked before T0](docs/operations/MISSION_3_FORGE_2_7_25_PREFLIGHT_ACCEPTANCE_2026_09_18.md).
+It preserves PR #148, performs no reset or Mission allocation, and records the
+failed functional-evidence-fit and autonomous installed-ingress conditions.
+
 ## Previous pickup checkpoint — 17 September 2026
 
 Implementation PR #128 merged the deterministic aggregate-health timeout-boundary

docs/operations/MISSION_3_FORGE_2_7_25_PREFLIGHT_ACCEPTANCE_2026_09_18.md

@@ -0,0 +1,241 @@
+AUTONOMY_E2E_ACCEPTANCE = NIET_GEHAALD
+
+# Mission 3 on Forge 2.7.25 — blocked before T0
+
+Read-only acceptance preflight on 18 September 2026. This is a new assessment
+of the corrected Forge 2.7.25 installation. It does not reopen or rewrite the
+historical Mission-3 rejection in PR #148.
+
+```text
+MISSION_SCOPE_EVIDENCE_FIT = FAIL
+PREPARATION_ACCEPTANCE = NIET_GEHAALD
+CLEAN_CENTRAL_PREFLIGHT = NIET_GEHAALD
+MISSION_EXECUTION_STATE = NIET_GESTART
+AUTONOMY_LOOP_ACCEPTANCE = NIET_GEHAALD
+TELEMETRY_ACCEPTANCE = NIET_GEHAALD
+REPORTING_ACCEPTANCE = NIET_GEHAALD
+EXPORT_ACCEPTANCE = NIET_GEHAALD
+PUBLIC_HANDOFF_DELIVERY = PENDING_PROTECTED_MERGE
+SUPPORTED_CRITERION_SOURCE = repository_json
+AUTHORITATIVE_HOST_CONTROL_SUPPORT = UNSUPPORTED
+E2E_EXECUTION_AND_REVIEW_EVIDENCE = SEPARATE_EP_EVIDENCE_LINE_NOT_EXERCISED
+```
+
+## Decisive pre-T0 findings
+
+Two independent start conditions fail before destructive maintenance is
+permitted.
+
+First, the available `repository_json` source proves only an approved JSON
+property at an exact accepted revision. The read-only scope survey considered
+real open Forge work including the installed inner-loop CI seam and governed
+progression. Those outcomes require proof of process continuity, execution,
+validation, review or decision enforcement. Representing them as JSON fields
+would weaken their functional meaning. `host_control` remains
+`UNSATISFIED / UNSUPPORTED_AUTHORITATIVE_EVIDENCE_SOURCE`. No toy,
+acceptance-only or unused configuration objective was substituted.
+
+Second, the exact installed package contains the documented
+`InstalledDynamicMissionRuntime` Python API and `ForgeRuntimeService.serve`,
+but the published distribution exposes one console entry point whose supported
+commands are storage initialization/status/reset and Execution Host
+configuration/preflight. It exposes no Mission-governance, intake, start or
+supervised-service command. The public `start` and `resume` methods each drive
+one service tick. A new test-session script that repeatedly called those
+methods or private composition helpers would be a new controller, not the
+existing qualified product route. It therefore could not prove the required
+absence of human/external between-Action steering in C07.
+
+The installed Forge-to-EP authenticated read-only preflight did pass after the
+normal Keychain-backed credential was resolved. It reported EP 2.3.83,
+producer-readback 1.2, terminal-evidence 1.4, matching project/repository scope
+and submission authorization. Cryptographic peer identity remains
+`NOT_ASSERTED`. This successful read-only check does not cure either start
+condition and created no submission.
+
+In accordance with the assignment, the first failed start condition froze the
+verdict. No reset, Mission allocation, governance decision, Mission Intake,
+planner invocation, provider invocation or EP execution was attempted.
+
+## A. Exact installation manifest
+
+| Product | Active version | Schema | Product release source | Published wheel SHA-256 | Readback |
+| --- | --- | ---: | --- | --- | --- |
+| Forge | 2.7.25 | 39 | `61e02899277d4ee557696bb24a051916e8c961c2` | `e0ea58bf6ce242d4eca66801ef4c764c7104b90df5503141a8ebf0006c1aa7b8` | normal executable reports 2.7.25; installed isolated interpreter/distribution and schema read back |
+| Engineering Platform | 2.3.83 | 68 | `13691e4502c239e03558a9c79538ae9b7387938f` | `006b47b8a864502a4b4596ba17e2724fe6ddba1e932615e183841cfc913e5021` | authenticated declaration through normal Forge peer preflight |
+
+The selected reset coordinator remains
+`cross-product-operational-reset-coordinator-v2`, bound by the completion
+record to EP source `13691e4502c239e03558a9c79538ae9b7387938f` and artifact SHA-256
+`bdfece75b538994a59dc295ab10d4dac6bdfbfcb1a45c36c7e392c4dbcc82acc`.
+It was not invoked. Fresh remote observations resolved Forge `main` to
+`fd69c443da80c56f11361693fd8ded6e1b20fc3f` and EP `main` to
+`13691e4502c239e03558a9c79538ae9b7387938f`.
+
+The Forge completion record in PR #152 and its installed readback remain the
+owning qualification evidence. The present preflight independently confirmed
+the active version/schema, installed command surface, package entry point and
+authenticated peer contract. It performed no rebuild, downgrade, update or
+installation.
+
+## B. Evidence fit and functional Mission
+
+No functional Mission was approved or allocated. The read-only candidate
+survey deliberately stopped before converting an objective into product state.
+
+| Surveyed real objective | Real consumer meaning | Why the available criterion source is insufficient |
+| --- | --- | --- |
+| Installed inner-loop CI closure | one installed Mission continuously plans, executes, observes evidence and progresses across real process/EP boundaries | requires execution, restart, timing, validation and review evidence; JSON structure cannot prove those events |
+| Governed progression successor fence | Forge blocks/releases successor work from authentic decisions and exact evidence | requires enforcement and replay behavior, not a declarative PASS field |
+
+The only supported criterion source is `repository_json` with exact repository,
+safe path, JSON pointer, canonical expected value and an approved validity
+policy. It could support a genuinely structural product property, but none of
+the surveyed open outcomes could be reduced to that property without dropping
+necessary behavior. No `CriterionAssessmentContract`, requirement identity,
+predicate or validity binding was therefore approved for a Mission. This is a
+failed evidence-fit precondition, not a defect claim about every possible
+future Forge objective.
+
+## C. Reset manifest and clean baseline
+
+The installed Forge reset preview was read-only and returned `READY`, schema
+39, dataset generation 0, intact integrity checks, no foreign-key finding and
+no active maintenance operation. It also reported retained operational history:
+3 Mission states, 2 Action derivations, 2 derivation results, 1 planning state,
+8 execution-host bindings and their associated audit/history records.
+
+Because evidence fit and autonomous ingress failed first:
+
+- the joint coordinator was not invoked;
+- no reset authorization, prepare, backup, revalidate, apply, verify, resume,
+  finish or service stop/start occurred;
+- no EP reset preview was promoted to a joint plan;
+- no fresh coordinated backup set was created;
+- dataset generations stayed unchanged;
+- preserved identities, policy, credentials, security ledgers and allocators
+  were not mutated;
+- no clean-baseline or anti-reingestion claim is made.
+
+Therefore `CLEAN_CENTRAL_PREFLIGHT = NIET_GEHAALD`. Historical reset receipts
+and installation backups were not reused as current reset evidence.
+
+## D. Measurement manifest
+
+| Field | Result |
+| --- | --- |
+| Intended display label | Mission 3 |
+| Intended allocator result | `MISSION-0003` |
+| Actual Mission ID | none |
+| Functional input/criteria | not approved; evidence-fit failed |
+| Initial governance decisions | none |
+| T0 | not set |
+| End time | not applicable; no measured attempt |
+| Repository Truth binding | current Forge main observed read-only; not bound to a Mission |
+| Test-contract population | C01-C20 retained outside runtime; no Mission population created |
+
+The normal allocator was not called, so no identity was forced or predicted
+from repository-document naming.
+
+## E–F. Actions and A-to-B evidence
+
+| Action ID | Contribution | Planner invocation | Predecessor evidence | Baseline | Submission / EP run | Candidate / reviews | Delivery / criteria / reconciliation |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| none | none derived | none | none | none | none | none | none |
+
+There is no A-to-B sequence, partial assessment, remaining-requirement set,
+successor planner input/output or second delivery. None is reconstructed from
+the source qualification scenarios: those scenarios used external planner,
+repository and host fixtures and explicitly did not make a live submission.
+
+## G. Counts
+
+| Item | New-attempt count |
+| --- | ---: |
+| Missions allocated/admitted | 0 |
+| substantive Actions | 0 |
+| planner/provider invocations | 0 |
+| original submissions / EP runs | 0 / 0 |
+| retries / resumes / repairs | 0 / 0 / 0 |
+| initial Mission decisions | 0 |
+| human interventions after Mission release | not applicable; no release |
+| new terminal evidence conflicts | not assessable; no new population |
+
+Zeros are preparation facts only. They are not autonomy, no-retry, telemetry or
+quality PASS evidence.
+
+## H. Telemetry, performance and canonical reporting
+
+There is no new Mission population from which to calculate planning usage,
+Action usage, token/cache aggregation, invocation timing, external wait,
+review/finalization share or Mission duration. Every such value is
+`UNAVAILABLE: NO_MEASURED_ATTEMPT`, not zero. EP usage is not substituted for
+Forge planning usage.
+
+No new Engineering Report, Action Quality/Security result, finalization receipt,
+Forge criterion observation or Mission result exists. Desktop/mobile dashboard
+acceptance was not run because there is no selected attempt/chain. This is not
+a dashboard-defect finding.
+
+## I. Four telemetry downloads
+
+| Export | Downloaded | Snapshot | Result |
+| --- | --- | --- | --- |
+| EX-OV-MD | no | none | not executable without a new Mission population |
+| EX-OV-JSON | no | none | not executable without a new Mission population |
+| EX-DT-MD | no | none | no selected attempt/chain |
+| EX-DT-JSON | no | none | no selected attempt/chain |
+
+No dummy run, old snapshot or administrative report was relabeled as a required
+telemetry download. Parse, MIME, filename, parity and completeness are therefore
+unproven.
+
+## J. C01–C20
+
+`NIET_GEHAALD` for an unexecuted criterion means not proven; it is not by itself
+a separate product-defect classification.
+
+| Criterion | Result | Owning evidence or missing part |
+| --- | --- | --- |
+| C01 — exactly one fresh Mission | NIET_GEHAALD | no allocation, approval, intake or T0 |
+| C02 — real authorized functional work | NIET_GEHAALD | no objective could be approved without weakening required evidence |
+| C03 — at least two substantive Actions | NIET_GEHAALD | no Actions |
+| C04 — Actions derived by the real planner | NIET_GEHAALD | no planner invocation |
+| C05 — new planning after predecessor evidence | NIET_GEHAALD | no predecessor evidence or successor decision |
+| C06 — installed Keychain→HTTP→EP execution/readback | NIET_GEHAALD | authenticated read-only preflight passed; Mission execution/readback did not occur |
+| C07 — no human between-step steering | NIET_GEHAALD | no delivered autonomous Mission service/controller entry; a new tick-driving script was rejected |
+| C08 — zero retries/resumes/repairs | NIET_GEHAALD | no execution; a zero count is not a successful no-retry trial |
+| C09 — first-candidate validation and independent Quality/Security | NIET_GEHAALD | no candidate or Action assurance |
+| C10 — protected implementation/finalization/terminal evidence | NIET_GEHAALD | no Action delivery |
+| C11 — identities/digests/baselines/receipts close | NIET_GEHAALD | installation bindings close; Mission/Action/run chain absent |
+| C12 — no unresolved new evidence conflicts | NIET_GEHAALD | no new terminal population to assess |
+| C13 — Forge assesses and closes Mission | NIET_GEHAALD | no Mission; evidence-fit failed before approval |
+| C14 — safe declared post-execution state | NIET_GEHAALD | read-only safe stop established, but no executed Mission end state exists |
+| C15 — exact qualified Forge/EP installation active before T0 | GEHAALD | Forge 2.7.25/schema39 and EP 2.3.83/schema68 bindings plus authenticated compatibility readback |
+| C16 — correct live telemetry | NIET_GEHAALD | no new telemetry population |
+| C17 — correct desktop/mobile dashboard chain | NIET_GEHAALD | no new attempt/chain |
+| C18 — four consistent telemetry exports | NIET_GEHAALD | none downloaded; no valid snapshot |
+| C19 — both CENTRAL datasets clean with fresh backups | NIET_GEHAALD | reset/backups intentionally not executed; Forge still contains old operational history |
+| C20 — only new-attempt measurement | NIET_GEHAALD | no new measured population or post-reset anti-reingestion proof |
+
+## K. Scoped resource handoff
+
+Lane 1 records the assignment as a read-only pre-T0 preflight with terminal
+`BLOCKED_BEFORE_T0`. Lane 2 revision 14 was read back as having no active
+assignment or reservation. No maintenance/test window was entered because no
+writer stop or product mutation was permitted after the evidence-fit failure.
+
+Effects owned by this assessment are limited to read-only source/installation,
+lane and preflight observations plus this sanitized documentation delivery.
+There are no Mission/Action/provider/EP subprocesses, submissions, runs,
+mutating reset operations, service changes, credentials changes, backups or
+runtime reservations to hand off. The documentation branch/PR is administrative
+and is not an Engineering Action or evidence repair.
+
+Exact local paths, runtime/instance/consumer identities, Keychain references,
+plan/database/backup digests and raw receipts remain outside Git. Public
+product versions, source commits, artifact digests and protected PR identities
+remain exact.
+
+No repair campaign, production patch, second reset/Mission attempt or next
+backlog Mission follows from this result.