claim: Make a VZ abort observable: which guest action makes VZ raise VZErrorDomain code=1, and can the abort be turned into a reason

[drawmeanelephant]

Claim

• Owner: buffy (agent/buffy/1261-probes)
• Scope: Follow-on from SMP boot dies silently under WM traffic: the extra core-0 switch is survivable, the death is not guest-side #1261 (probes landed via #1261 probes: exception entry, spurious ack, timer re-arm, console-free sample #1284): the dying boot's PPIs are delivered and recorded to the last second and VZ aborts the VM (VZErrorDomain code=1) with no guest fault. Find which guest action makes VZ abort — bisect the script2 WM traffic on the scratch tree (scratch/1278-nudge-dying-boot, local commit 46763a5) until a minimal trigger is isolated — and determine whether the abort can be surfaced as a reason (deeper VZ diagnostics, a host-side supervisor pattern, or a filed-feedback-grade reduction). Deliverable: a minimal reproduction + a written statement of what VZ can and cannot be made to say.
• Touches: kernel/src/exceptions.zig,kernel/src/main.zig,kernel/src/forensics.zig,tools/gate/specs/live-forensics.spec
• Depends on: SMP boot dies silently under WM traffic: the extra core-0 switch is survivable, the death is not guest-side #1261, claim: Forensics: a recorder that survives the guest dying, so a boot names its own last instant (#1261 unblock) #1278
• Verification: a minimal trigger boot that aborts deterministically; the finding posted as observed evidence with the trigger named
• Status: 🔄

Notes

<what this claim is, why it matters, how it will be verified>

---

Progress lives in COMMENTS on this issue (append a new comment; never
rewrite earlier ones). Close the issue with a final evidence comment when
the work lands or is abandoned. Filed by tools/status/new-claim.sh — the
coordination gate treats this open claim issue as ACTIVE. The landing PR
MUST say Closes #<this issue> so merge closes it.