45052da4dc
1) keep operator-signed decommission; 2) Q4 both — intent-aware ReassertGuestBinds load-bearing/sufficient, GuestBindStore.Remove hygiene (re-commission re-Records via recordGuestBind, B2 to state); 3) data move = controller via rsync copy-verify-remove (not cp -a); 4) decommission role-gated unmount. Gate cleared; B1/B2 may proceed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>