feat(park): ADR 0068 rung 2 — parked-paused eviction + dwell/pressure reaper (#545)

[nikhilunni]

Stacks on #581 (rung 1: the Evicting → Active edge + cancellable nomination). Part of epic #545 (parking ladder, ADR 0068).

What this adds — rung 2 (parked-paused)

When an idle session is nominated and its host has memory headroom, the eviction pipeline now pauses the VM in place (park_rung=2) instead of capture+destroy. The harness stays resident; a returning user's prompt un-pauses in <100ms rather than paying the full rebuild (prod p50 12.2s / p95 89.1s).

• Park decision (evict_session_to_state, Idle target, before the browser reap / capture): gated on host_has_memory_headroom, which reads the RAM ledger's allocatable_mib (Host RAM ledger: charge base-shm, parked residents, and running VMs under one allocatable_mib budget #540 — already nets out other parked VMs' PSS, so we never over-park) and fails closed on any telemetry gap. allow_park=false (drain + the reaper's own descent) skips it.
• Ascent (try_cancel_nominated_eviction): un-pause before the CAS Evicting → Active, under the held lease; only commit Active if the un-pause succeeded, else leave the session Evicting for the standard resume path (never advertise Active over a paused VM).
• Reaper (park_reaper_advance_one, on the existing eviction-scanner tick): descends a parked VM to a full eviction when the dwell cap (ENGRAM_PARK_DWELL_SECS, default 900s) elapses or the host loses headroom (reason=dwell|pressure). Parked rows route here instead of the eviction pipeline (guarded in both scanner_run_once and scanner_advance_one) — otherwise the pipeline would re-pause + bump evict_attempts to HostLost every tick.

Session gains park_rung/parked_at (projected in get_session + list_evicting_sessions; migration 0086 landed with rung 1). New metrics: parked_paused / unparked_paused / park_descend{reason}.

Scope calls

• Rung 3 (parked-local) is sequenced into Epic: GCS-free resume — authoritative host-affinity + peer-first divergence fill #548, not built here. Its primitive — destroy the VM but retain snapshot staging + NBD backing on local NVMe for a host-pinned resume — is the authoritative-affinity machinery of the GCS-free-resume epic; building it separately would duplicate that state two ways. It lands there reusing park_rung=3.
• Rung 4 (evicted-remote) is today's full eviction, unchanged — now the pressure/dwell floor the ladder descends to.
• Rung 2 is pause-only in v1 — the park-time diff-banking optimization (make the eventual descent near-free) is a clean follow-up that doesn't change the rung's state shape.

Testing

Four coordinator unit tests: park+ascent (same live sandbox after un-pause, nothing captured), dwell descent (un-pause → capture → destroy → Idle, park_rung cleared), and the scanner-routing guard (a parked row is never re-evicted). Native just check green (fmt + clippy -D warnings + nextest); engram-coordinator+engram-postgres compile clean on the linux dev-vm. FC pause/resume is the pre-existing ADR 0045 Phase F primitive — unchanged.

🤖 Generated with Claude Code