preflight gating

docs/ARCHITECTURE-BLUEPRINT.md

@@ -310,6 +310,9 @@ Resolves an assessment profile into an executable run plan:
 - isolation and timeout policy,
 - artifact retention policy.
 
+At execution time, a failing preflight blocks downstream check groups for the
+same extension so expensive or misleading harness steps are not invoked.
+
 ### Runner Bridge
 
 Executes or coordinates extension checks.

docs/EXTENSION-SDK.md

@@ -182,6 +182,11 @@ package `artifact_manifest`.
 If a Python runner raises an exception, the core converts that failure into
 `infrastructure_error` evidence so the assessment package remains complete.
 
+Preflight runners are gates. If an extension preflight returns `fail`, `blocked`,
+or `infrastructure_error`, downstream check groups for that extension are not
+executed; they receive `blocked` evidence with `blocked_reason:
+preflight_failed`.
+
 ## Result Statuses
 
 Initial statuses: