docs: re-point the source citations #600 and #601 moved

[bonk-ai]

What and why

#600 (e209162) and #601 (a4047ea) moved lines in the source files the hand-written pages cite, so 604 path:line citations on 15 pages pointed a few lines off while still resolving, which docs:check cannot see. This re-points them, and rewords one sentence on docs/behavior/state-machines.md that #601 made incomplete. The branch starts from main at 8797176; only Markdown under docs/ changes.

How each move was found

For every citation, evidence/blame-shift-citations-2026-10-12.py (in the nightly job's workspace) takes the doc line's git blame commit as its baseline, reads the cited block there, and looks for the same text at HEAD. It reported 645 citations whose block is no longer at the cited lines: 353 with one exact match elsewhere, 240 with several, and 52 with none.

Each match was then checked against git's own line mapping: git diff -U0 <baseline> HEAD -- <file> hunks map every cited line that sits outside a changed hunk to its HEAD line. A citation moves here only when that mapped range is one of the exact-text matches; that settled 592 rows, including 239 of the 240 with several matches (mostly #[arg(long)] lines in cli.rs). The one CONTRIBUTING.md:133 row is an example mutants.out line, not a citation, and stays.

The 53 rows without a settled match got two passes. Comparing with version numbers normalized cleared 29 Cargo.toml rows whose cited lines are right and only carry the 1.0.1 version. A read-only audit of 20 others, against each doc sentence, found 7 still right, 12 moved, and 1 contradicted. The last 4 are debugging-guide.md rows (commands/local.rs:47-68, :52-58, main.rs:22-24) whose cited text no longer matches; they were already flagged on 2026-10-12, and each needs its sentence checked against the code, which this change doesn't attempt.

Moves by page

Page	Moves
docs/reference/cli.md	377
docs/behavior/processes.md	46
docs/insights/contract-map.md	29
docs/insights/impact-analysis.md	22
docs/behavior/state-machines.md	20
docs/diagrams/behavioral/sequences.md	20
docs/diagrams/architecture/components.md	18
docs/reference/public-api.md	16
docs/architecture/system-overview.md	15
docs/insights/business-logic.md	12
docs/reference/rpc-tools.md	11
docs/architecture/data-flow.md	9
docs/analysis/risk-hotspots.md	5
docs/analysis/dead-code.md	3
docs/diagrams/structural/dependency-graph.md	1

Most cite crates/microvms-cli/src/cli.rs (386), crates/microvms-app/src/sandbox.rs (80) and crates/microvms-app/src/session/mod.rs (44). On cli.md, each moved flag citation's HEAD line was read back: 368 of 373 land on the #[arg] of a field whose name is the flag the bullet names, and the other five are right too: four flags whose field is spelled differently (--tag is tags, --for is for_sec, --egress-network-connector is egress_network_connectors twice), and --identity-host-seed, whose citation is the field's "Prefer --from or --identity-host-seed-file." doc line (cli.rs:1991) that the bullet paraphrases.

The reworded sentence

state-machines.md's VmState section said "ResumeRequested preserves Suspended while recording an in-flight resume." Since #601, ResumeRequested from Suspended does that only until the new SuspendedVmEnded action has set platform_ended (crates/model/src/client.rs:509-512); after it, the request writes VmState::Terminated and was_terminated and returns Verdict::RefusedByService (crates/model/src/client.rs:494-499). The sentence now states both cases, and its range follows the verdict match to client.rs:390-532.

Unverified: the VmState diagram below that sentence has no SuspendedVmEnded edge; whether the diagram should show the platform-ended path is a modeling choice this change leaves alone.

Evidence

• mise run docs:check on this branch: EXIT=0 in 169 s; astro check 0 errors and 0 warnings over 54 files, and vitest 15 files, 223 tests passed.
• mise run prose:check on this branch: EXIT=0 in 37 s, "Prose: 0 errors, 4069 warnings, 0 suggestions." tools/prose.py --lint on main and on this branch lists the same warnings for every file and rule, so no ceiling in .vale/warnings.json moves.
• Seeded-fault anchors: no transform in verify/guards/faults/*.toml names an edited file.
• Every move's new range was dumped with its first and last HEAD lines (moves-verify-2026-10-14.txt, moves-audited-verify-2026-10-14.txt in the job's evidence directory); a 14-row sample outside cli.md and all 13 audited moves were read by hand.
• mise run pr-body:check -- --body <this body>: EXIT=0.
• mise run check: not run; this changes only Markdown under docs/, and prose:check is the check tier that reads it.

Guards

None: this adds no guard.

Follow-ups

• docs/insights/debugging-guide.md:31, :44, :48 and :60 cite crates/microvms-cli/src/commands/local.rs:47-68, :52-58 and crates/microvms-cli/src/main.rs:22-24, whose text changed after the page's baseline; each needs its sentence checked against the code.
• The VmState diagram on state-machines.md has no edge for SuspendedVmEnded or the refused resume it leads to.

Platform claims

• Not applicable: this changes no claim about AWS behavior.

Scope

• This is not an orchestrator or a fork implementation
  (see docs/STRATEGY.md).