docs: BRINGUP describes the present, CAMPAIGN-LOG carries the dated record

BRINGUP had grown to 3,122 lines in which the same subject was answered
differently depending on where the reader stopped: GATE A "stays open, no
live-fire" in the phase text and closed in the campaign record, the catalog
at 24 tests in one section and 35 in another, several "bench validation
pending" headings over bodies that recorded the pass.

Split by kind rather than by age. BRINGUP (907 lines) is the present state
only - status, bench runbook, laser, lid/interlock/button policy, homing,
forgectrl, diagnostics, logging, release acceptance, the measured facts
bank, and a Next work list of the 15 items that are actually open.
CAMPAIGN-LOG (2,657 lines) takes the dated blocks verbatim, in
chronological order, and is append-only: a correction is a later entry, not
an edit. Its two reading rules are stated up front, since moved text keeps
its original "above"/"below" and its pre-split item numbers.

Facts corrected against the tree while rewriting: the liveness probe gates
at p2p 800, not 500, with the real wedge, noise and jolt figures; the panel
has seven tabs including Logs and is built from src/ui/, not ui.c; the
devserver replaced tools/mock.py; /status reports real head presence; the
estop_halts_motion opt-in is gone; core PR #999 is merged, leaving only the
step_us_min commit fork-only; the update system stands at Phase 5, the
uSDHC pads and the 2026-08-08 kernel batch have shipped, and 8 MP camera
capture is tracked here for the first time.

SAFETY and UPDATE-SYSTEM point their drill records at the log. ACCEPTANCE
records that inheritance is local: there is no import of a published
artifact, so a second bench starts from a full campaign - one of the four
open items the retired tool plan held, the rest of which are now in
BRINGUP's acceptance item.

Documentation only, no behavior change and no catalog consequence: docs/
is outside every layer and .md is excluded from the layer content hash.

docs/ACCEPTANCE.md

@@ -99,6 +99,10 @@ cannot be authorized (that is a catalog change, not a skip).
 itself changed - new tube, driver swap, cable work, a judgment call - and
 forces a full campaign; nothing before it can be inherited.
 
+**Inheritance is local.** The history a bench inherits from is its own
+results log; there is no import of a published `acceptance.json`. A second
+bench, or one whose `/data` has been wiped, starts from a full campaign.
+
 ## Running a campaign
 
 1. Boot the dev image on the bench (`forgefirm-image-dev`), open

docs/SAFETY.md

@@ -267,7 +267,7 @@ the same FIRE gating as the live stream.
 ## 4. What is proven, and how
 
 Verified on the bench with a probe on the PSU-connector LASER_ON pin and the
-kernel readbacks (the runbook `BRINGUP.md` holds the drill records):
+kernel readbacks (`CAMPAIGN-LOG.md` holds the drill records):
 
 - Latch **locked**: 40,000 streamed FIRE bits → PSU pin flat, `laser_enable`
   0 — the lock severs the FIRE drive entirely.

docs/UPDATE-SYSTEM.md

@@ -3,10 +3,11 @@
 Design and contracts of the ForgeFIRM install/update/recovery system:
 the factory's own A/B slot scheme, signed `.fw` packaging, the GUI
 update manager, factory restore, and the recovery image. The system is
-described in the implementation units ("phases") it is built from; the
-bench status of each lives in `BRINGUP.md`, as does the measured ground
-truth this rests on (eMMC layout, boot0/boot1 maps, saved-env location,
-factory `.fw`/updater internals — "eMMC boot & recovery architecture").
+described in the implementation units ("phases") it is built from. The
+measured ground truth this rests on lives in `BRINGUP.md` (eMMC layout,
+boot0/boot1 maps, saved-env location, factory `.fw`/updater internals —
+"eMMC boot & recovery architecture"), which also carries what is still
+open; the bench record of each phase is in `CAMPAIGN-LOG.md`.
 
 ## Settled decisions