docs(agent): defer #20 KVM CI to FUTURE; keep eval-only VPS

Standing decision: IONOS Gitea/act_runner docker stays eval-tier.
vm-checks needs a separate KVM host later — not the 4G compose box.

.gitea/workflows/check.yml

@@ -86,12 +86,11 @@ jobs:
           done < <(git ls-files '*.sh')
           exit "$fail"
 
-  # ── vm-checks (DISABLED until a KVM runner exists) ────────────────────
-  # The real prize: running the checks.* VM suite + a toplevel build in
-  # CI. Needs a runner on a NixOS (or at least nix + /dev/kvm) host —
-  # register one with a dedicated label, then uncomment and set runs-on
-  # to that label. Do NOT enable this against a label that doesn't
-  # exist: Gitea queues such jobs forever instead of failing.
+  # ── vm-checks (DISABLED — FUTURE #20, not NEXT) ─────────────────────
+  # Eval-only CI is the standing decision: Gitea act_runner stays docker
+  # compose (no /dev/kvm). Full checks.* VMs need a *separate* host with
+  # nix + KVM (label nix-kvm); see agent/BACKLOG.md FUTURE #20. Do NOT
+  # uncomment until that label is online — Gitea queues forever otherwise.
   #
   # vm-checks:
   #   runs-on: nix-kvm

agent/BACKLOG.md

@@ -24,17 +24,11 @@ in [`docs/ROADMAP.md`](../docs/ROADMAP.md); map in
 
 ## NOW
 
-*(empty — NEXT's top item is the queue head)*
+*(empty — NEXT is empty; see LATER / FUTURE / PROPOSED)*
 
 ## NEXT
 
-### 20. KVM runner → VM suite in CI `[human]`
-The remaining stretch of the CI item — checks-on-push is live and
-**green** (run #58; runner = gitea/act_runner docker, eval tier).
-Register a second runner on a host with `/dev/kvm` + nix (host-mode
-label `nix-kvm`), then an agent uncomments the workflow's `vm-checks`
-job: the `checks.*` VM suite + real toplevel/HM builds on every push
-that later upgrades the bump gate from eval-only to the full suite.
+*(empty — no actionable queue head; #20 deferred to FUTURE)*
 
 ## LATER
 

agent/MEMORY.md

@@ -30,12 +30,12 @@ iteration would otherwise rediscover.
   realise it): extract the logic into a pure importable file and
   unit-test THAT (monitor-rules.nix / checks.display-profiles is the
   pattern).
-- CI (`.gitea/workflows/check.yml`) is **eval-tier only**: the act_runner
-  is a docker container (no systemd, no /dev/kvm). Container gotchas are
-  documented in the workflow header (single-user Nix + nixbld users,
-  `sandbox=false` for Stylix IFD, Nix pinned 2.31.5 vs lazy-trees, no JS
-  actions past node20) — learned over the legacy repo's 57 runs; read
-  them before touching the workflow.
+- CI (`.gitea/workflows/check.yml`) is **eval-tier only** (standing
+  decision 2026-07-10): act_runner docker-compose on the Gitea VPS; no
+  KVM there. Full VM suite is BACKLOG **FUTURE #20**, not NEXT — needs a
+  separate nix+/dev/kvm runner. Container gotchas are in the workflow
+  header (single-user Nix + nixbld users, `sandbox=false` for Stylix
+  IFD, Nix pinned 2.31.5 vs lazy-trees, no JS actions past node20).
 - The Gitea instance is **1.25.4** — `on: schedule` workflows are
   supported; bump.yml assumes the Actions token can push to `main`
   (standard Gitea behaviour, but unconfirmed until the first run lands).