v0.4.0: slice 4 Phase B — reversibility gate + signed-op consuming layer

The security core of slice 4: hub-supplied intent is no longer trusted for
destructive change. The gate fronts the per-guest queue's executor, so every
mutation passes it. Reuses internal/authz for all crypto (surface untouched).

- Classifier (doc 03 §4): benign vs destructive by provenance + data-bearing-
  ness, NOT by verb. Destroy/overwrite of customer data is destructive unless
  agent-internal provenance (same-journaled-txn create, or agent-tagged scratch)
  makes it benign — and that provenance is journal-recorded, NEVER hub-sourced.
  Unknown op class fails safe to destructive.
- Reversibility gate: benign -> allowed unsigned; destructive -> requires a
  verified, role-scoped, action-bound operator signature, else pending_signature
  and never executed. Every decision audited (signal, never the guard).
- Signed-op consuming layer over authz.Verifier.Verify (locked pipeline
  untouched): role-scoping (doc 04 §4 — recovery=rotation only, operational=
  ordinary destructive + planned rotation) + op-to-action binding (op+host+
  guest+params must match the gated action).
- Signed-job orchestration: idempotency dedupe by nonce + journal-wrapped
  execution via an injected DestructiveExecutor (nil this slice — inert).
- Crash recovery (Note 1): Engine.Recover consumes the journal InFlight() set at
  startup (resume-or-rollback) — covers an op that crashed after the POST and
  before its terminal record, which idempotency dedupe alone cannot. Added
  TaskStatusOnce to the GuestAPI seam. Wired into daemon startup.
- Note 2: memory comparison canonicalized to MiB (desiredMemoryMiB) so a
  non-MiB-aligned MemoryBytes converges in one pass, not perpetual drift.
- Daemon: builds the verifier from config signers (none = nil verifier, the
  common slice-4 state), the gate (+SlogAudit), runs Recover before mutating.

Adversarial matrix proven against the REAL authz.Verifier with in-test-minted
SSHSIGs (framing replicated in reconcile's test binary; authz untouched, no
signing added to the verify-only package): unsigned job + unsigned desired-state
delta -> pending_signature; unknown signer/expired/replay-across-restart/wrong
host -> typed authz rejections; wrong guest/op/params -> binding_mismatch;
recovery key on ordinary destructive -> role_denied; hub-supplied scratch tag
ignored -> refused; valid+role+target+fresh nonce -> accepted then replay
rejected. Full module race-clean + vet-clean on the Linux build server.

Inert this slice: no destructive deltas served until slice 10; the destructive
path is classified, gated, and tested but not wired to live execution.

CHECKPOINT: Phase B complete (slice 4 done). Awaiting validation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/reconcile/plan.go

@@ -37,6 +37,13 @@ type Action struct {
 // the MiB unit Proxmox's LXC `memory` config field uses.
 const bytesPerMiB = 1024 * 1024
 
+// desiredMemoryMiB canonicalizes a desired byte count to the integer MiB that
+// Proxmox's `memory` field stores and reports. Floor division is deliberate and
+// convergent: the value returned here is exactly the value written via SetConfig, so a
+// subsequent read returns the same MiB and the comparison settles (see Plan's memory
+// note). The actual side (a.MemoryMiB) is already MiB from GuestConfig.
+func desiredMemoryMiB(bytes int64) int64 { return bytes / bytesPerMiB }
+
 // Plan computes the minimal benign action set converging actual → desired. It is a
 // pure function (deterministic, side-effect-free) so it is exhaustively fixture-test
 // -able. Actions are returned sorted by vmid, then config-before-runstate per guest.
@@ -81,7 +88,14 @@ func Plan(desired DesiredState, actual ActualState, norm FieldNormalizers) []Act
 					params["cores"] = strconv.Itoa(d.Spec.Cores)
 					reasons = append(reasons, fmt.Sprintf("cores %d->%d", a.Cores, d.Spec.Cores))
 				}
-				if want := d.Spec.MemoryBytes / bytesPerMiB; want != a.MemoryMiB {
+				// Memory is canonicalized to MiB on BOTH sides before comparison — the
+				// numeric cousin of the description-newline normalization (string
+				// normalizers cover string fields; this is the integer one). We compare
+				// the SAME MiB value we then write, so a non-MiB-aligned desired
+				// converges in one pass (write `want` MiB → PVE stores `want` MiB → next
+				// read a.MemoryMiB == want → no further action), never perpetual drift.
+				// Slice 10 should still serve MiB-aligned MemoryBytes at the source.
+				if want := desiredMemoryMiB(d.Spec.MemoryBytes); want != a.MemoryMiB {
 					params["memory"] = strconv.FormatInt(want, 10)
 					reasons = append(reasons, fmt.Sprintf("memory %dMiB->%dMiB", a.MemoryMiB, want))
 				}