Parity pilot posture: cloned-snapshot plane, write disposition, measured baselines

Context

Phase-5 leaf of epic #15798 (Discussion #15595; the fable-cycle finding folded at 6/6.1): the pilot's data-plane posture was a named hole — a pilot on the canonical durable plane risks the real institution graph (forbidden by the keep-local-primary constraint); a pilot on a throwaway plane isn't dogfood (no real corpus, no real WAL cadence). The honest third posture needs building: a cloned-snapshot plane with an explicit write-disposition contract.

The Problem

A 1–2 week pilot on one seat accumulates real writes on a forked plane. At promotion (parity becomes the seat's reality) or demotion (pilot ends), those writes need a disposition: fork-then-replay onto the native plane if per-seat write volume is low and replayable (the WAL segments ARE the replay substrate), or a dual-journal design if not. The falsifier is measurable before phase 1 commits: a one-week per-seat memory-wal volume baseline decides the posture — measurement, not new instrumentation (drains are already observable; the phase-2 leaf surfaces disposition).

The Architectural Reality

• The snapshot plane is an overlay planeId (#15799): explicitly distinct identity, fail-closed against the durable root — the posture rides the invariant, not new machinery.
• The write-disposition contract is D#15758's Option-G recovery-disposition logic applied locally (forward-complete / restore-by-proof / contained) — cross-consumed, not reinvented; promotion/demotion receipts use the continuity-receipt shape (pre/post fingerprints + drain disposition). This is the second cross-epic edge (wired leaf-to-leaf when the rollout epic's receipt-contract leaf exists — never epic↔epic).
• The observation surface is FM in host-mode pointed at the parity stack (the fold-6 ported gift): one pilot journey walks two release gates (dogfooding the observer while dogfooding the observed) with none of the FM-in-docker chunk required.
• Ada's sweep AC: the pilot captures a before/after boot + hot-call latency pair, or Option A's latency falsifier stays unfalsifiable by construction.

The Fix (one PR)

The pilot harness: snapshot-clone tooling (durable plane → overlay plane, fingerprinted), the write-disposition contract implementation (baseline measurement + the decision procedure + replay path for the fork-then-replay branch), promotion/demotion runbook with continuity receipts, and the baseline capture scripts (WAL volume per seat-day; boot + hot-call latency pairs vs the stdio baseline).

Acceptance Criteria

• Snapshot-clone produces an overlay planeId with pre-clone fingerprints recorded; overlay cannot resolve the durable root (inherits #15799's invariant, test).
• One-week memory-wal baseline procedure documented + scripted; the fork-then-replay vs dual-journal decision rule is explicit and data-driven.
• Replay path proven on a synthetic corpus: replayed-onto-native receipts show monotonic continuity (no loss, no double-apply).
• Boot + hot-call latency pair captured parity-vs-stdio (the Option-A falsifier becomes falsifiable).
• Promotion + demotion runbooks each end in a continuity receipt; failed-contained is a named terminal (never a silent abandon).
• Post-merge: the actual pilot run on one seat is operator-scheduled (this leaf ships the harness, not the pilot execution).

Out of Scope

The pilot RUN itself (operator-scheduled, post-merge validation on this ticket); FM-in-docker; multi-seat rollout (per-seat opt-in is phase 4's surface).

Related

Epic #15798 · blocked_by #15802 and #15805 · cross-epic (leaf-scoped, deferred until the rollout epic exists): consumes the continuity-receipt contract · D#15595 fold 6 (pilot posture) + D#15758 Option G · borrowed-authority caveat as in #15799.

Origin Session ID: 758f110e-a429-4597-beb0-5fd3ec7d1bfc Retrieval Hint: query_raw_memories("pilot posture cloned snapshot plane write disposition WAL replayability baseline")