Updated

docs/ROADMAP.md

@@ -4,7 +4,7 @@ What the Mechanical Compiler is for, and the order in which it gets built.
 
 | | |
 |---|---|
-| Updated | 2026-08-15 |
+| Updated | 2026-08-16 |
 | Companions | `ENVIRONMENT.md`, `STAGING-STATE.md`, `FAILURES.md` |
 
 ---
@@ -121,7 +121,12 @@ a new call into the same machinery, not a new machine.
   provably non-chiral; profile parameters are isolated from one another.
 - **Fixture oracle frozen.** 123 cases, `ddd0f154…`, pinned to OpenSCAD 2021.01
   and BOSL2 `92d697c`. The ten rejected cases are part of the contract.
-- **Staging environment.** In progress — see `STAGING-STATE.md`.
+- **Staging infrastructure accepted, 2026-08-16.** Host, both containers,
+  network isolation, bastion access, TLS trust, reverse proxy and the
+  application filesystem foundation are proven on `srv-b`. Mail alerting and
+  explicit disk monitoring are deferred; backup strategy is postponed by
+  operator decision; application deployment remains blocked on application
+  code. See `STAGING-STATE.md`.
 
 ### Next — the port
 
@@ -235,3 +240,9 @@ on whether it makes distributed manufacturing capacity legible.
 6. **Record the failure before correcting it.** Then apply the smallest
    corrective change, not the one that also fixes three things you were
    worried about.
+7. **Prove the negative.** Isolation is asserted by showing the forbidden path
+   fails, never by showing the interface is gone (F-018). Health is asserted
+   after a reboot, never before (F-021).
+8. **Handoff is not delivery.** An upstream acceptance code proves the message
+   left, not that it arrived (F-023). The same distinction applies wherever a
+   subsystem reports success on behalf of something downstream.