zonelink: re-enable Gateway isolation host acceptance after reconciler migration

[vicondoa]

Context

The active host-zone-gateway-isolation VM check is deferred from vmChecks during U20. Its Gateway Guest reaches CH child creation, but Process-watch controller-session/fencing callbacks still perform effect completion work in the Resource commit path. This can hold CommitBatch and prevent the Gateway VMM from progressing.

The fixture is retained at tests/host-integration/deferred/host-zone-gateway-isolation.nix.

Re-enable criteria

• controller: standardize single-write reconcile and durable requeue semantics #489 single-write reconciler and durable requeue/message semantics are implemented for CH, Process, Provider controller sessions, and ZoneLink.
• Resource watch callbacks only enqueue affected owners and return immediately.
• Process/session/StoreSync effects persist completion evidence and request reconciliation rather than blocking a reconciler or store commit.
• Gateway Guest reaches Ready without startup retry loops or polling-driven progress.
• ZoneLink/uplink reaches its expected state while relay credentials remain exclusively inside Guest/gateway.
• The fixture has bounded phase-specific waits and terminal fast-fail diagnostics.
• Restore the fixture to tests/host-integration/host-zone-gateway-isolation.nix and include it in full make test-host-integration acceptance.

Amendment (2026-09-21): acceptance criteria re-scoped to what today's reconciler can test

The 2026-09-13 status note stands, and this amendment records its consequence: the durable-requeue half of the #489 contract was deleted with the store cutover, so the criteria above overstate what the current reconciler can satisfy. The fixture is deferred by construction - tests/host-integration/deferred/ is the designated holding state for checks that cannot pass yet - rather than by unmet criteria alone. Verified in the tree on 2026-09-21: the fixture still sits at tests/host-integration/deferred/host-zone-gateway-isolation.nix while the twelve top-level fixtures in tests/host-integration/ are the active vmChecks set.

Re-scoping:

• The criteria that name controller: standardize single-write reconcile and durable requeue semantics #489's durable requeue/message semantics (first and third bullets) must be re-expressed against what the store and controller actually provide today - single-write reconcile and the requeue timers of the v3 ractor resource runtime - or dropped from this issue and tracked separately. They cannot be met as written because the contract half they reference no longer exists.
• The remaining criteria are testable against the current fixture and should be validated first: watch callbacks enqueue affected owners and return immediately; Gateway Guest reaches Ready without startup retry loops or polling-driven progress; ZoneLink/uplink reaches its expected state with relay credentials exclusively inside Guest/gateway; bounded phase-specific waits with terminal fast-fail diagnostics.
• A move back to tests/host-integration/host-zone-gateway-isolation.nix (and inclusion in full make test-host-integration acceptance) is valid once the re-expressed criteria pass on a host; nothing else gates the move.

Owners: zonelink/ZoneLink controller and the host-integration lane.

[vicondoa]

Status check (2026-09-13, after PR #517 merged): still deferred. The fixture is still at tests/host-integration/deferred/host-zone-gateway-isolation.nix, and the re-enable criteria reference #489's reconciler/requeue semantics - see the scope note there: the durable-requeue half of that contract was deleted with the store cutover, so these criteria need re-scoping before the fixture can come back.

[vicondoa]

Decision: option (b) - re-express the requeue criteria against today`s reconciler, then re-enable.

The durable-requeue half of the contract was deleted with the store cutover, so the original criteria reference something that no longer exists. Re-express them against the current single-write reconcile and the v3 requeue timers, validate the bullets that are testable today, and only then move the fixture out of the deferred directory.

Acceptance: restated criteria that a reader can test against the current reconciler; the fixture relocated to the discovered level and running in the host-integration lane as part of the full set; no criterion referencing a deleted contract half.