labsim: both matrices green end to end, numbers reproduced

Final confirming run with GRACE=300 and every fix installed:

  --all   ALL PASS  (T0 T3 T5 T8 T11 T12)
  --hard  ALL PASS  (replace / deny / disable, each policy verified)

Second independent measurement of the hard failover, which is what makes the
figures trustworthy rather than anecdotal:

                run 1   run 2
  replace        26s     26s
  deny          148s    141s
  disable        21s     20s

`deny` sits at ~141-148s across both, so it is the AC's dead-peer behaviour
and not a one-off; GRACE=300 keeps roughly 2x margin.

Corrected an overclaim in PPPOE-HA.md while confirming it: the invariant row
read "AC never showed two simdsl sessions", and under session-control=disable
it did -- one live, one orphaned from the destroyed router. Only ever one LIVE
router dialled, which is the invariant that matters. Said so plainly rather
than leaving a table that reads better than the evidence.

migration/PPPOE-HA.md

@@ -67,7 +67,15 @@ either "I do not hold the VIP" or "the lease is stale".
 | Stale lease | guard hangs up within ~5s |
 | Missing peers file | `NRestarts=0` — no loop |
 | Flap holdoff vs live session | session survives a forged 900s holdoff |
-| Invariant | AC never showed two `simdsl` sessions |
+| Invariant | never more than one router dialled, in any run |
+
+On the last row, precisely: the AC *did* report two `simdsl` sessions during the
+`session-control=disable` run — one live, one orphaned from the router that had
+just been destroyed, which that policy does not clean up. Only one live router
+was ever dialled. The count is a proxy for the real invariant and only a valid
+one while the AC enforces single-session, so it is reported as a `WARN` rather
+than silenced: an orphaned session still occupies the single slot at a real ISP,
+and that is exactly what made `deny` take 141–148s.
 
 ## Two failure modes found by running it, not by reading it
 
@@ -145,9 +153,9 @@ a separate change."* This is that change.
 
   | policy | takeover |
   |---|---|
-  | `replace` (accel-ppp default) | 26s |
-  | **`deny`** (hostile) | **148s** |
-  | `disable` | 21s |
+  | `replace` (accel-ppp default) | 26s / 26s |
+  | **`deny`** (hostile) | **148s / 141s** |
+  | `disable` | 21s / 20s |
 
   `deny` is the sizing case: the AC refuses the survivor until its own
   dead-peer timer frees the dead session, and the poller caught two dial

migration/vrrp-wan.conf

@@ -23,11 +23,12 @@ WAN_VIF=53
 # exists to prevent.
 #
 # MEASURED, labsim T4, master destroyed with `virsh destroy`, time until the
-# survivor held a PPPoE session (labsim/wan-failover-evidence/T4-*):
+# survivor held a PPPoE session (labsim/wan-failover-evidence/T4-*). Two
+# independent runs, so these are the AC's behaviour rather than one-offs:
 #
-#     session-control=replace    26s
-#     session-control=deny      148s   <-- worst
-#     session-control=disable    21s
+#     session-control=replace    26s / 26s
+#     session-control=deny      148s / 141s   <-- worst
+#     session-control=disable    21s / 20s
 #
 # `deny` is the hostile case and the only one that matters for sizing: the AC
 # refuses the survivor until its own dead-peer timer frees the dead session.