Migration: marrair → marrmini, adopt v5.0.0 as baseline, freeze v4.0.3+

[virtualian]

Plan

Governs execution of Plans/v5-0-0-is-a-major-keen-wall.md.

Goal

Migrate PAI execution from marrair to marrmini. Backup marrmini's existing
PAI state, decommission, do a clean v5.0.0 install via upstream's official
installer. Snapshot both runtimes (marrair live, marrmini fresh v5.0.0).
Generate comparison report and v5.0.0+ port design doc.

No code is ported in this issue. Output is evidence + plan. Follow-up
issues governed by Plans/v5-0-0-plus-port.md (generated in step 11)
execute the actual ports.

Decisions Locked

Question	Decision
Snapshot scope	Both ~/.pai/ and ~/.claude/ in full
Snapshot location	~/backups/pai/runtime-<host>-<timestamp>/ (local on each machine, NOT in git)
Comparison report + inventories	reports/v5-comparison/ (in-repo, committed)
v4.0.3+ freeze mechanics	FROZEN.md marker + v4.0.3+-final tag, leave files in place
Output	Design doc only at Plans/v5-0-0-plus-port.md (no porting yet)
Install source on marrmini	Upstream's official installer (vanilla v5.0.0 baseline)
Repo posture re: Releases/v5.0.0/ import	Skip — live marrmini install is canonical
Fork clone on marrmini	Required; cloned to marrmini:~/projects/pai/
marrair clone	Archived (marrair-final tag + ARCHIVED-marrair.md); not deleted
marrair PAI lifecycle	Keep running through port; decommission only after design-doc ports validate

Playbook (track progress here)

• Step 1 — Tag pre-v5-baseline-shift on marrair — tag present
• Step 2 — Branch sync/v5-baseline-shift on marrair — merged via PR Sync v5.0.0 baseline + design doc (#166) #167
• Step 3 — Snapshot marrair runtime → ~/backups/pai/runtime-marrair-20260508-002618/
• Step 4 — Secret-scan hygiene log → reports/v5-comparison/scan-log.txt
• Step 5 — Prepare marrmini (verify SSH, backup existing, decommission existing PAI dirs) — ~/backups/pai/marrmini-pre-v5-20260508-002618/
• Step 6 — Clone fork to marrmini:~/projects/pai/, archive marrair clone — marrair-final tag
• Step 7 — Clean v5.0.0 install on marrmini via upstream's official installer — ~/backups/pai/marrmini-fresh-v5.0.0-20260508-021422/
• Step 8 — Snapshot post-install marrmini state, mirror to marrair — snapshot above
• Step 9 — Freeze Releases/v4.0.3+/ (FROZEN.md + v4.0.3+-final tag) — tag present
• Step 10 — Generate comparison report → targeted diff used in lieu of full multi-day prose (per design doc "What This Session Did NOT Do")
• Step 11 — Generate design doc → Plans/v5-0-0-plus-port.md (PR Sync v5.0.0 baseline + design doc (#166) #167; refined via PR Refine v5.0.0+ port design: demote SecurityValidator, refresh Learning scope #170)
• Step 12 — Open PR sync/v5-baseline-shift → main — PR Sync v5.0.0 baseline + design doc (#166) #167 merged 2026-05-09, PR Refine v5.0.0+ port design: demote SecurityValidator, refresh Learning scope #170 merged 2026-05-10

Status (2026-05-10)

Playbook complete. Follow-up port work tracked on virtualian/pai-v5
(issues #1, #2 OPEN; #3 CLOSED won't-do). Overlay audit findings in
reports/v5-comparison/v5-overlay-audit.md (one drift: SecurityValidator
in overlay scaffold predates PR #170 demotion; cleanup deferred to a
follow-up issue on virtualian/pai-v5, gated on a Phase-B trial probe).
Detailed status snapshot in design doc's "Progress / Status" section.

Approval Gates

Two destructive operations require explicit approval at execution time
(not pre-authorized by issue/plan approval):

• Step 5 — Decommission existing PAI dirs on marrmini (recursive removal of installed PAI state)
• Step 7 — Run upstream's network-fetched installer on marrmini

Out of Scope (Follow-up Issues)

• Actual porting of fork architecture (SecurityValidator, two-root,
  AskUserQuestion contract, Voice removal, Learning standalone pack) —
  governed by Plans/v5-0-0-plus-port.md after step 11
• README posture decision (separate design conversation)
• Cherry-picks of upstream 12265ed, 698b15f, 6e0bcc3 — design doc decides
• marrair PAI decommission — criteria in design doc; happens later
• Submitting fork architecture as upstream PRs — explicitly declined

Verification (end-to-end gates before opening PR)

1. All backups exist on BOTH machines (mirror) per plan
2. marrair PAI runtime untouched: Tools/verify-security-validator.sh PASS=8 FAIL=0
3. marrmini v5.0.0 install operational
4. Releases/v4.0.3+/ frozen with marker + tag
5. marrair clone archived: marrair-final tag + ARCHIVED-marrair.md
6. Comparison report has 8 per-area prose sections + categorised inventory
7. Design doc has HIGH/MED/LOW port priorities + path strategy + marrair decommission criteria
8. scan-log.txt committed, no raw secret values

References

• Plan: Plans/v5-0-0-is-a-major-keen-wall.md
• Existing tooling reused: Tools/UpstreamScan.ts, Tools/verify-security-validator.sh, .pai-protected.json
• Upstream v5.0.0 reference: danielmiessler/Personal_AI_Infrastructure@upstream/main