docs: log MU-4 (the CI job's version-drift catch) and refresh the counts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -22,8 +22,8 @@ which records not just what changed but what each drill run proved.
   call, `setup-host` and `doctor` answer at the caller's tier. Rehearsed
   end-to-end by `drill/multiuser.sh` (criteria a–l: confinement, lifecycle,
   cross-user visibility, name collisions, the in-box isolation contract,
-  escape hatches, re-sync survival, revoke) — 41/41 on the design host, in
+  escape hatches, re-sync survival, revoke incl. the live-session case) —
-  both container and VM mode.
+  42/42 on the design host, in both container and VM mode.
 - **CI runs the multi-user rehearsal on a real Incus** — a second `rehearsal`
   job stands up the full stack on the runner (setup-host, doctor, then
   `multiuser.sh --container`), so every PR proves the tier's semantics

docs/plans/2026-07-18-restricted-tier.md

@@ -1,8 +1,9 @@
 # Restricted incus tier — design and measured results (#74)
 
-**Status: implemented and rehearsed.** 41/41 rehearsal criteria green on the
+**Status: implemented and rehearsed.** 42/42 rehearsal criteria green on the
 design host (Debian 13 trixie, Incus 6.0.4, nested KVM), in container mode
-and VM mode. This doc records the design, what was measured, and why each
+and VM mode — and green in CI on ubuntu-latest / incus 6.0.0 (whose one
+version-drift false FAIL is MU-4 in `drill/RUNS.md`). This doc records the design, what was measured, and why each
 decision fell where it did. It supersedes the vetoed #72 design
 (`docs/plans/2026-07-17-multiuser-hosts.md` on `feat/restricted-tier-wip`).
 

drill/RUNS.md

@@ -195,6 +195,7 @@ No listener is needed, and none should be started: see trap 3.
 
 | Run | Result | What it cost |
 | --- | --- | --- |
+| MU-4 | 41/1 on CI (ubuntu-latest, incus 6.0.0) → 42/0 | the CI job earned its keep on its second-ever run: the attach-refusal probe matched 6.0.4's error wording and 6.0.0 words it differently (and refuses at a different stage) — a version-drift false FAIL the design host could never show. The probe now asserts the OUTCOME (nothing running on the private bridge) and prints the refusal as evidence. Also this round, from adversarial review: revoke survives the live-session case (groups are read at login; --purge now terminates sessions first, else a stale-group process could recreate the project UNHARDENED after the purge), grant backs out its own group-add on failure, and the session-dies-with-the-tier check is criterion 42 |
 | **MU-3** | **41/0 (containers) + 41/0 (VMs) — the tier holds** | `multiuser.sh` (#74) from zero on Debian 13 / Incus 6.0.4: grant, confinement, lifecycle, the in-box contract with the cross-user sibling drop, closed escape hatches, re-sync survival, scoped revoke. The VM pass needed right-sized boxes (1GiB): two 2GiB nested VMs on a 7.7GiB host measured swap, not isolation |
 | MU-2 | 40/41 (VMs) | the egress probe cried broken over a TLS handshake that outlived its 8s budget under nested-KVM memory pressure — every isolation probe (which PASSES on silence) was immune. Probe budgets raised, reachable-probes retry once, and the mint keeps its log for the post-mortem |
 | MU-1 | 39/41 (containers) | both FAILs were the instrument: a `box new` rc swallowed with its narration (the drill's oldest sin, relearned), and the enumeration probe resolving the box's OWN name — /etc/hosts answered, not the gateway. Probe a SIBLING's name or you measure cloud-init's hostname hygiene. Found for real along the way: `box restore` dispatched `incus restore`, which does not exist in Incus 6 — broken for every tier since the rename |