docs: policy governance, effective profiles and release-management roadmap

docs/architecture/FORGE_V1_BOOTSTRAP_GOVERNANCE_DECISION.md

@@ -1,8 +1,10 @@
 # Forge V1 Bootstrap Governance Decision
 
-**Status: canonical governance decision.** This governs a temporary V1
-bootstrap programme only; it neither implements a runner nor changes EP's
-execution or lease authority.
+**Status: canonical governance decision when present on owning main.** This
+governs a temporary V1 bootstrap programme only; it neither implements a runner
+nor changes EP's execution or lease authority. Policy clarifications are part of
+[Policy governance and effective profiles](POLICY_GOVERNANCE_AND_EFFECTIVE_PROFILES.md).
+They do not activate, renew or modify a live grant.
 
 ## Authority
 
@@ -45,7 +47,8 @@ the Forge mapping: `NORMAL_LOW` changes need no separate owner authorization;
 changes require exact-head Owner Authorization; `HIGH` security/auth,
 credential, execution/lease, installer/update, remote-access or autonomous
 mutation changes require exact-head Owner Authorization plus security review.
-New commits invalidate it. It is distinct from CI and Human UI Review.
+New commits invalidate candidate qualification, not automatically the unchanged
+programme grant. Exact-head evidence is distinct from CI and Human UI Review.
 
 `FORGE_OWNER_AUTHORIZATION_RISK_MAPPING = DEFINED`  
 `OWNER_AUTHORIZATION_APPLICABILITY = DEFINED`  
@@ -55,27 +58,51 @@ New commits invalidate it. It is distinct from CI and Human UI Review.
 ## Merge and operating boundary
 
 Within a valid programme authorization, a node may be squash-merged only after
-an executable exact-head qualification has passed. A node reaches `MERGE_READY` only after
-implementation, local and exact-head hosted qualification, resolved reviews,
+executable exact-head qualification has passed. `MERGE_READY` requires
+implementation, local and current hosted qualification, resolved reviews,
 applicable UI/owner/security gates, valid authority, fresh contracts and
-mergeability. It then enters `WAITING_HUMAN_MERGE`; human merge is followed by
-post-merge qualification before `DONE`. A bounded merge packet includes node,
-PR, exact head, risk, DoR/DoD, CI/reviews/gates, scopes, unlocked dependents and
-known risks. Parallel PRs re-evaluate after every merge.
+mergeability. A bounded merge packet binds node, PR, exact head, risk, DoR/DoD,
+checks/reviews/gates, scopes, unlocked dependents and known risks.
+
+Without a applicable delegation, retain the explicit human merge boundary.
+With a valid scoped delegation, the existing authorized merge executor may
+consume the exact qualified packet without another owner message. A policy
+flag alone does not authorize a merge; branch protection is never bypassed.
+Post-merge qualification is still required before `DONE`. Parallel PRs
+re-evaluate after every relevant merge. This target does not assert that every
+current runtime/CI merge adapter already consumes the grant.
 
 `BOOTSTRAP_AUTO_MERGE = QUALIFIED_SQUASH_ONLY`
 `QUALIFIED_SQUASH_MERGE_REQUIRED = TRUE`
 `MERGE_DECISION_PACKET = DEFINED`  
 `PARALLEL_PR_MERGE_REEVALUATION = TRUE`
 
-Autonomous repair is permitted only when its programme authorization states a
-finite per-PR/per-head budget. The current policy supports at most three
-attempts for an exact head; a new head requires a fresh exact-head
-qualification and its own budget. The runner must stop at scope expansion,
-expired or revoked authorization, failed security/review/CI, or exhausted
-budget.
+## Repair budget and exact-head proof are separate
+
+Autonomous repair requires a finite authorized budget. Consumption is bound to
+the Action/run continuation lineage and survives new SHA, PR, phase, process
+restart and resubmission of the same work. The current bootstrap upper bound is
+three total operational repair rounds per run/continuation lineage, subject to
+any stricter applicable programme ceiling. EP owns actual operational round
+reservation/consumption; Forge correlates it and enforces programme limits,
+not an additional independent provider-repair allowance.
+
+Every changed candidate needs fresh exact-head qualification. It does not
+receive a fresh repair budget. This explicitly supersedes the earlier per-PR/
+per-head wording that could imply a budget reset on each commit. Previously
+recorded consumption and provenance remain evidence and must be preserved.
 
-`AUTONOMOUS_REPAIR_ENABLED = BOUNDED_PER_EXACT_HEAD`
+The runner stops at scope expansion, expired/revoked authorization, unresolved
+security/review/CI blockers or exhausted limits. Ordinary bounded corrective
+work may continue under the same valid delegation; a failed check is not itself
+new authority. A fourth repair cannot be created by a new run ID or a UI edit.
+
+`AUTONOMOUS_REPAIR_ENABLED = BOUNDED_ACTION_LINEAGE`
 `UNBOUNDED_AUTONOMOUS_REPAIR = FALSE`  
 `BOOTSTRAP_RUNNER_CAN_SELF_AUTHORIZE = FALSE`  
 `BOOTSTRAP_GOVERNANCE_FORWARD_COMPATIBLE = TRUE`
+
+Documentation/DAG adoption does not renew expiry, mint capability grants,
+retroactively approve candidates, reset counters or migrate runtime state.
+Any material change to a live programme's authorized node set or objectives
+requires explicit staleness reconciliation through the owning writer.