live 423-commit projection is untested.

`docs/2026-08-25-forge-exit-rehearsals-2-to-6.md` records both halves.

**Step 4 re-measured later the same day, and step 5 is prepared but not run.**

**Step 4 re-measured later the same day; step 5 was prepared and then run.**

A fresh clone of each side: the forge serves 461 commits on `main`, `git fsck`

clean, grafted at five `shallow` boundaries rooted at `eda094c6`; the mirror

serves 767, `git fsck` clean, rooted at `a352f78e`, and `git rev-list --count

over `fdd00d4c`, `e0e61fb1`, `0fcbbbb8`, `f8a7822a`, and `c91327d6`, it is

7.2 MB and `git bundle verify` reports a complete history.

The import itself was not performed. It is a permanent append to a shared

production log, its failure mode is the fleet-wide rebuild step 3 has never

exercised live, and both belong to an attended operation rather than to a

read-only rehearsal. #188 records the decision — import the objects, keep the

push record starting at the seed — `docs/forge-operator-independence.md`

carries the reasoning, and #256 carries the operation.

**Step 5 performed 2026-08-25 (#256).** `Backfill.import_history/3` appended

the bundle at sequence **426** under `operator:14167547` and closed all five

boundaries; `open_boundaries/1` answered `[]` afterwards. Re-measured on a

fresh clone through the published transport, the forge now serves **787**

commits on `main` with no `shallow` file, `git fsck` clean, and

`git cat-file -t c91327d6` answering `commit` — against 461, five boundaries,

and an unreadable object before. `Verification.verify/2` reports no findings on

all three nodes, each at head sequence 426 on an identical chain link.

Two things this exercised that the rehearsal had listed as unknown. The

projection is node-local while the log is shared (#251): two nodes applied the

entry immediately and the third sat at 425 with its boundaries still open for

several minutes, converging only when `Sync.ensure_fresh/2` ran. That is the

call `OpenAgents.Forge.GitHttp` makes before serving any git request, so a

clone routed to a lagging node converges it before being answered rather than

receiving a grafted history. And the failure mode that made this attended — a

fleet-wide rebuild from sequence zero — was not reached on any node, so it

remains unexercised live and step 3's gap is unchanged.

#188 records the decision — import the objects, keep the push record starting

at the seed — and `docs/forge-operator-independence.md` carries the reasoning

and the measurements.

## 4. Key rotation

The forge's clone is not broken by this and `EXIT-004` is not violated by it.

The clone succeeds, passes `git fsck`, and writes a `shallow` file naming five

reconciled boundaries, which is `EXIT-004`'s stated outcome after #179: history

that says where it stops is servable, and history that dangles is not. What is

true is narrower and worth saying without softening it — **the forge is

canonical for its own history only from the seed forward**, and a reader who

wants this repository's first 307 commits has to get them from the mirror.

that says where it stops is servable, and history that dangles is not. That was the state until the objects were imported. **The forge is now

canonical for its whole history**: the pre-seed commits are in its own log, a

clone carries them, and no reader has to go to the mirror for them. The

paragraph above records what was measured before the import, because the

reasoning that follows it was decided against that state.

### The decision about the 307 commits

path gains a mirror call, and the proof that fails on one is untouched. What

changes afterwards is that the mirror stops being the only copy of anything.

**Not yet executed.** The bundle is built and verified — 7.2 MB, `git bundle

verify` reports a complete history, and it closes all five recorded boundaries

— and the recipe is in rehearsal 3 of `docs/forge-exit-rehearsals.md`. What is

left is a production write that cannot be undone: a WAL append is permanent by

design, `EXIT-005` makes removing an entry a rewrite of the whole suffix, and

if a node fails to materialize the new entry `OpenAgents.Forge.Sync` falls back

to a full rebuild from sequence zero, which rehearsal 3 records as never having

been run against the live projection. That is an attended operation on a forge

people are pushing to, not an unattended one, and #256 carries it rather than

this document describing it as done.

**Executed 2026-08-25.** `OpenAgents.Forge.Backfill.import_history/3` appended

the bundle to `openagents.com`'s log at **sequence 426**, under the principal

`operator:14167547`, and closed all five recorded boundaries:

| Boundary | Parent the import supplied |

| --- | --- |

| `eda094c6` (the seed) | `c91327d6` |

| `23f0d64c` | `0fcbbbb8` |

| `521c208d` | `fdd00d4c` |

| `70cadbb5` | `f8a7822a` |

| `1f32e14d` | `e0e61fb1` |

The bundle was built from a fresh mirror clone over those five parents, 7.3 MB,

and `git bundle verify` reported a complete history before it was copied to a

node. `open_boundaries/1` answered with the five commits before the import and

with `[]` after it.

Measured after the import, on a clone taken fresh through the published

transport:

| | Before | After |

| --- | --- | --- |

| `main` commits | 461 | 787 |

| `shallow` file | five boundaries | absent |

| `git cat-file -t c91327d6` | could not read | `commit` |

| `git fsck` | clean | clean |

The counts are at different tips; the gap is what closed.

`OpenAgents.Forge.Verification.verify/2` reports no findings on all three

nodes, each at head sequence 426 with an identical chain link. The projection

is node-local while the log is shared (#251), so a node applies a new entry on

its own schedule: two nodes had applied 426 immediately, and the third sat at

425 for several minutes with its boundaries still open. It converged when

`Sync.ensure_fresh/2` ran, which is what `OpenAgents.Forge.GitHttp` calls

before serving any git request — so a clone routed to a lagging node converges

it before it is answered rather than being served a grafted history. The

fallback that made this an attended operation, a rebuild from sequence zero,

was not reached on any node.

The mirror is no longer the only copy of anything.

## Exit