microVM wet lifecycle controller: MainPID realization + srv1 REDs

[gunbai-bot]

The wet half of the microVM slot lifecycle controller: the host readings the decisions in
gunbc.runner_microvm_lifecycle (#11670) have never been taken from, the host-local
CellReadiness store as bytes, and the six REDs executed against real processes.

What this is

gunbc.runner_microvm_lifecycle carries the controller's DECISIONS and takes every observation as
a supplied value. Nothing in that lane had run against a process. This adds the module those values
come from — gunbc.runner_microvm_lifecycle_realize — plus
gunbc.runner_microvm_cell_readiness_store, which is the record codec and the store I/O.

The split inside the realize module is pure fold beside wet performer: every classification takes
supplied readings and is witnessed hermetically, and every function that touches the host does
nothing but obtain those readings and hand them to a fold.

The six REDs

They are wet .dag claims, not a shell script, because a shell reimplementation of stop-then-force
would establish nothing about the modeled controller. Each one starts its own TRANSIENT unit
through gunbc.systemd_run_transient with the PRODUCTION stop properties, drives the production
fold against it, and sweeps its own slice before returning.

RED	adversary	what the controller must answer
a child that ignores SIGTERM	trap '' TERM under SendSIGKILL=no	StoppedByForce, never graceful
a double-forked escapee	a systemd-run --scope sibling in the cell slice	the subtree read finds it in a cgroup that is not the slice root
an unkillable task	the cgroup freezer	ForceStopBoundExceeded, and the cell quarantines
a failed cgroup read	a cell whose slice the manager holds no control group for	quarantine, and the store refuses to loosen it
a stale-incarnation stop	a stop naming generation N-1 while N runs	refused, and the live unit is still active afterwards
a successful job leaving a process	exit 0 plus an escapee	released only after the residue is observed gone

No live slot is touched. Every unit, slice and path is derived by the PRODUCTION functions from
slot indices 90-95. A fleet host allocates slots from 01 upward and carries tens of them, not
ninety, so the derivation collides with nothing serving; the premise is checkable with
systemctl list-units 'actions-runner@*' on any fleet host.

On the freezer, and why not a genuinely wedged task. A task the kernel will not reap cannot be
created safely on a serving host and cannot be cleaned up afterwards. A frozen cgroup is a real
survivor of SIGKILL — the signal is not delivered until the cgroup is thawed — and it is reversed
by its own inverse verb. It is also the one residue this run can leave that looks like nothing, so
read_slice_freeze_state reads back that no cgroup under the slice is frozen, and every claim's
sweep asserts it. The reversal cannot be made unconditional inside the substrate — there is no
finalizer and a killed process runs nothing — so the unconditional thaw is an operator command
outside the run, stated on the function rather than implied.

Four things the wet lane found before a host ran it

Derived by walking the success path rather than by a compiler. Three of them would have made a RED
read the wrong way round; the fourth had not yet produced a wrong answer and says so:

1. The clean outcome was unobservable. The jail root and credential drive live inside the
   attempt directory, whose deletion is what a successful teardown is — so their absence
   listings were listings of a directory that is gone, and every successful teardown would have
   quarantined its own cell. Absence is now inherited from an established absence of the
   container. Filed as absence_proof_whose_premise_the_success_destroys.
2. The readbacks were not ordered after the stop. They took only the attempt, so nothing in
   the program put them after the effect they describe — and the fields of a record have no order
   at all. Stated precisely, because it is the one of the four that had not yet produced a wrong
   answer: the seed interpreter is eager, so field order happens to hold today, and the fix moves
   the ordering out of the executor's evaluation strategy and into the graph. The stop is bound
   first and handed to each readback; the parameter is the word "after". Filed as
   readback_ordered_only_by_statement_position, which says the same thing.
3. The force was aimed at the unit, not the cell. A process in a sibling scope under the same
   slice is accounted to the cell and survives a kill aimed at the unit. The graceful stop stays
   the attempt's; the force is now a write to the slice cgroup's cgroup.kill, which the kernel
   kills the whole subtree with, atomically against forking. A frozen task still survives it,
   which is the point of RED 3.

A fourth, smaller: a blank ControlGroup is the manager affirming it holds no cgroup under that
name, not a doubt — reading it as doubt made a cell whose slice systemd had garbage-collected
unreleasable, which is exactly what a successful teardown leaves behind.

What is supplied rather than executed

Two things, and both are named on the claims that supply them.

The slot NETWORK readback. gunbc.runner_microvm_network derives it from seven host readings joined
against a ConvergedSlotNetwork receipt, and a synthetic slot has no converged network to read;
producing one would mean converging a tap and an nft ruleset on a serving host. That boundary's real
execution belongs to that module. Everything else is executed: real units, real stops, real reads of
/sys/fs/cgroup, real listings, real files under the store root.

The UNREADABLE CGROUP reading in RED 4. Producing a genuine cgroup read failure on a serving host
means breaking the host — the manager would have to stop answering, or the unified hierarchy would
have to become unreadable to root. So that reading is supplied at its own boundary and assembled
through the production constructor, while the half the brief calls "never released" runs for real:
the quarantine is written to the store as bytes, a Ready settlement at the same generation is
offered and refused, and the store is read back off disk.

What is NOT here

The launch half — jailer/Firecracker bring-up and the #11677 join (a VMM may start only when THIS
attempt's JitDeviceStaged and the same plan's workspace readiness both hold). attempt_staging_verdict
exists only on #11677's branch, and consuming it before that lands would fork it. It is the next
change in this lane, and all six REDs live in the half that is here.

Conformance (DESIGN §3b), for the domains this touches

• fabric / compute — the cell is the subject throughout. The release verdict stays
  product.fabric.sanitation CellReadiness, the across-incarnation meaning stays
  gunbc.runner_microvm_cell_readiness, and this change adds no second verdict: every fold here
  produces a carrier one of those modules already declares. The force targets the CELL because the
  cell is what is released.
• process observability / reporting — the readbacks are observations of a named subject, joined
  against the attempt by attempt_teardown_readback's constructor before any of them can reach a
  verdict. Absence comes from extdeps.filesystem.filesystem_io's established-absence fold and
  never from a failed read; the kernel's own cgroup.procs, cgroup.freeze and cgroup.kill
  interfaces are modeled in extdeps.linux.cgroup_v2 beside the ones already there.
• materialization / realization — the store is a durable record with a codec, and the codec
  owes an inverse: parse ∘ render is the round trip, the escape covers exactly the three
  characters the two grammars rest on, and every way a record can fail to be a record is one typed
  arm. Writes go through apply_cell_readiness_write — this module asks it and performs only the
  one file its answer authorises.
• single authority (§3) — no new spelling of anything that exists: root's uid is
  extdeps.access.posix posix_root_uid, the required store mode is a FileMode rendered by
  file_mode_octal (which is why stat -c %04a and not %a), the attempt's entry names became
  rows rather than being spelled twice, and the disjointness of the wet slot indices is
  runner_slot_membership's answer rather than a sentence.

Where every run happened

(Filled in from the srv1 runs. The required CI check executes no .dag witness, and the wet file is
OfflineLocalRecipe in gunbc.ci.ci_layer_roots so the floor can never select a claim that starts
systemd units.)

[gunbai-bot]

Closing: this duplicates #11803, which owns the same two modules (gunbc.runner_microvm_lifecycle_realize, gunbc.runner_microvm_cell_readiness_store), is based on #11677 so it has the staging join, carries the launch half this branch deferred, and has already run wet. Two branches cannot own that module and merging them would be the DESIGN §3 fork rather than a reconciliation.

The work is not lost. Three findings are on #11803 as review comments — a unit-scoped force that a sibling scope under the same slice survives, an unreadable subtree becoming ForceStopBoundExceeded { survivors: [] } and so a fabricated refuted fact, and readbacks with no dependency edge to the stop — plus the cgroup-freezer approach for producing a task that survives a bounded force-stop safely and reversibly. The two recurring-failure-mode rows are in #11823, which depends on neither branch. One thing from #11803 I'd take over what is here: its test -e exit-status absence probe is better than the listing-based one on this branch, which cannot establish absence once the attempt directory is gone — precisely what a successful teardown leaves.