fix(resume): an unusable memory image recovers by disk-only cold boot, not Dead

[nikhilunni]

Problem

After the ADR 0112 phase 2b roll, an Idle session with a memory snapshot from before the roll could not resume. That snapshot has no swap manifest. Every host refuses it (swap restore has no manifest; refusing a stale device). The resume verb counted each refusal as a terminal failure, and after five (RESUME_FAILURE_STREAK_BUDGET) it set the session Dead ("fork it to continue"). The disk was intact the whole time.

A host-agent that adopts a running guest from an older host-agent writes snapshots of the same shape. The guest still uses a raw swap file, and the new capture runs no swapoff, so those memory images can reference swap pages that no snapshot holds. The two kinds look the same in PG. A migration or a host-side rule cannot separate the safe ones from the unsafe ones.

Fix

Refuse the memory image, keep the disk:

• engram-core: new SandboxError::MemoryImageUnusable. The refusal is deterministic (every host answers the same), and the disk is unaffected.
• engram-host-agent: the three swap restore refusals in pooled_backend.rs return the new variant. grpc_server.rs sends it as a failed_precondition marker (the HarnessSpawn precedent), and engram-protocol maps it back.
• WIRE_VERSION 34 → 35. An older host refuses the same snapshot with an untyped error, which would still count toward the Dead budget. The exact-match gate keeps such hosts out of placement during the roll, so resumes wait for upgraded hosts.
• engram-coordinator resume: resume_from_fc_snapshot catches the variant and calls resume_disk_only_cold_boot on the newer of live_disk_manifest and the snapshot's disk_manifest. The cold boot now carries the image's memory and CPU budgets, so placement checks that it fits. After success, the coordinator appends a fenced resumed_from_disk event, and engram_session_resume_memory_image_fallback_total increments.
• engram-coordinator teleport: a live move whose destination refuses the memory image aborts the export and rolls back. Before, it retried three times and then fail_move destroyed the source guest. A captured teleport already rolled back.
• web: resumed_from_disk renders as a marker that says the files are intact and running processes stopped. The orchestrator frame taxonomy lists the new kind.
• ADR 0112: a dated addendum line records the gap and the fallback.

The guest loses its processes and keeps its disk. An operator who upgrades from v0.10.0 needs no data migration: pre-upgrade memory snapshots resume by disk-only cold boot.

Not changed:

• The refused snapshot row stays recoverable. Demoting it would unpin, from chunk GC, the snapshot disk that the cold boot mounts when the session has no live manifest.
• A retained Idle binding is cleared together with live_disk_manifest. A retry after that point boots the snapshot's older disk. This is older than the PR and also affects the existing disk-only branch. It is left for a separate change.

Test

• crates/engram-dst/tests/memory_image_fallback.rs: the sim host refuses the memory image once. The resume reaches Active with exactly one cold boot on the live disk and one resumed_from_disk event. The test fails with the coordinator arm disabled.
• teleport_live_pg scenario refused_memory_image_rolls_back_live_move: one restore attempt, the export is aborted, the source is not destroyed, and the session is Active. It fails without the teleport arm.
• Marker round trip and gRPC mapping unit tests in engram-protocol and engram-host-agent; the wire golden pins 35.
• just check: 2767 passed, 317 skipped. cargo clippy --target aarch64-unknown-linux-musl -p engram-host-agent --all-targets -D warnings: clean.
• web: format:check, lint, buildMessages.test.ts (79 passed), build. orchestrator: typecheck, frame-taxonomy.test.ts (5 passed).

🤖 Generated with Claude Code