docs(t0): the gray zone gets its second dimension, and the budgets get values

T0-2 defined two coordinates and T0-5 then judged a scalar `value` against a
PASS_LIMIT. Nothing produced that scalar and nothing said which number it was —
relative, absolute, some normalisation, the larger of the two. The decision
function was underdetermined, and the missing piece was a dimension, not a limit.

R5 — the gray zone is two-dimensional. PASS iff relative <= M_pass OR absolute
<= A_pass; FAIL iff relative >= M_fail AND absolute >= A_fail; otherwise
NO_DECISION, with M_pass < M_fail and A_pass < A_fail required. The two
conditions are then mutually exclusive, so each gate is a total single-valued
function. PASS_LIMIT, FAIL_LIMIT and gray_zone_margin_binding are removed as
symptoms of the wrong model, not filled in.

R6/R7 — eight budgets, per resource, superseding M, A and M_A_scope: time gates
5 %/50 ms to pass, 10 %/100 ms to fail; RSS gates 10 %/32 MiB to pass, 20 %/64 MiB
to fail, recorded in bytes so a checker needs no arithmetic. Both regimes of a
resource share its budgets; time and memory share nothing, because one absolute
value cannot span milliseconds and bytes.

R8 — retry_budget: 1. One initial attempt plus at most one full-session retry
after INVALID; a second INVALID is NO_DECISION. R9 — a fresh manifest per
session, identity rechecked after it, drift INVALID.

R10-R13 — the host predicate splits declared provisioning evidence from
runtime-verified invariants, and does not call the first a proof: a guest OS
cannot establish what the hypervisor is doing. Power policy is pinned per
platform with turbo left alone, background prohibitions name transient heavy
jobs rather than a debloat ritual, and quiesce is 120 s with a measured 60 s
window — whose failure is "not eligible to start", never INVALID, so it starts no
clock, produces no number and cannot be outcome-selective.

Zero UNRESOLVED_OWNER_DECISION slots remain. Status stays NOT_FROZEN and
collection_authorized: false until the hostile freeze review is done —
completeness is what makes a freeze reviewable, not the freeze itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018xhcg5opoFbSTdYHpkSXCh

Author: claude