Record the microVM, floor and per-VM-memory state at wind-down

[gunbai-bot]

Operator instruction: wind down all work and store remaining items, so v1 performance and v2 migration can be prioritised.

One new file under docs/plans/. No code, no model changes, no generated artifacts.

Why a document rather than work items

Creating dashboard work items auto-spawns workers within ~30s, which is the opposite of winding down and of keeping host churn minimal. docs/plans/ is the sanctioned home (DESIGN: "Plans and analyses live under docs/plans/"), is durable, and is reviewable. Happy to convert any section into a work item when the lane is funded again.

What it records

• The floor reports SUCCESS over its own refusal — witnesses.yml:67 downgrades structural to none because claim_executor exits 0 over its own typed refusal. This admitted CENSUS-IMAGE 0A: one seeded-image derivation, a measured identity, and the census envelope grammar #11731's unparseable file rather than merely hiding it. The parse class is now closed (census 0, 412 witnesses executing), but the fail-open is unrepaired and unowned, and Fleet lane: the floor job runs the plain lane command, so a refused floor refuses the lane (it was green over FloorRefused) #11836/Required gate: bind the receipt's adjudicator, so a refused floor refuses the lane #11829 are competing repairs.
• microVM: runner_microvm_lifecycle_realize landed (microVM wet lifecycle controller: MainPID realization + srv1 REDs #11803) with five declared frontiers, one of which is that nothing calls run_controller. Every teardown quarantines by construction, so a warm pool is impossible until the slot-network frontier clears — and that one is blocked for a security reason (the converge principal is the job principal), not an engineering one.
• Dynamic per-VM memory: item 1 is built twice, independently, blind to each other, on two branches that conflict textually on every file.
• The srv2 ExitType=cgroup residual risk, the owed Repair the test -e absence probe in runner_host_file_converge (metadata failure read as absent) #11845 RED, two unowned one-line repairs, and five method findings.

On contested claims

The per-phase reading of the fail-open is marked CONTESTED and neither version is asserted — one lane's reading against four run observations that contradict it — with the cheap discriminating test stated. DESIGN §4d: an inference is typed as a bet, and the reader who consumes it as a fact is the defect.

It also corrects two premises of my own closeout instructions: both dynamic-memory branches compile and run green (the uncompiled attempts are the two closed PRs), and #11751 is in the merge queue rather than parked. Both corrections came from the lanes pushing back, and both would have misdirected whoever picked the work up.

🤖 Generated with Claude Code

[gunbai-bot]

Superseded by #11934, which carries the same document cut cleanly from origin/main.

This PR went DIRTY because the branch it was opened from, session/sunny-ant-606, already carried two unrelated commits from earlier in the session (89483757c4 runner_unit ExitType modelling, 753c5afd4d a runner_microvm witness rename). Neither is on main, and they are what conflicts — the document itself touches nothing else. So this PR was asking for a review of three unrelated things at once and blocking on the two I did not intend to land here.

The two runner commits remain on session/sunny-ant-606 for whoever wants them; they are genuine unlanded work from the P0 brief, but reviewing them is not a wind-down activity and they need rebasing onto the ExitType work that has since landed.

— sent from sunny-ant-606