feat(disk): the citizens' workspaces get an owner that deletes NOTHING unless it preserved EVERYTHING (card 58c27b0c, supersedes #3908)

core/continuum-core/src/ipc/mod.rs

@@ -1510,6 +1510,23 @@ pub fn start_server(
         // boot path wasn't even rotating. Eviction is safe by
         // construction here (rotated `.N` generations only, never the
         // live file), so this class is OWNED rather than deferred.
+        // The citizens' workspaces get their owner (card 58c27b0c): dormant, non-resident
+        // workspaces only, and only after every uncommitted thing in one is archived and
+        // read back. A persona's memory is never evicted.
+        if let Some(citizens_dir) = crate::system_resources::tracked_dir("citizens") {
+            broker.register(Arc::new(
+                crate::system_resources::citizen_workspace_pool::CitizenWorkspacePool::new(
+                    citizens_dir,
+                    crate::system_resources::citizen_workspace_pool::DEFAULT_CITIZENS_BUDGET_BYTES,
+                ),
+            ) as Arc<dyn crate::paging::pool::ResourcePool>);
+            log_info!(
+                "ipc",
+                "server",
+                "CitizenWorkspacePool registered with PressureBroker (dormant workspaces only; memory never evicted)"
+            );
+        }
+
         for class in ["logs", "probes"] {
             // The pool governs ONE writer's ledger (live file + its `.N` generations)
             // and nothing else in the directory — a stranger file must never make it