docs: close Phase B (B7 concurrent burn-in PASS + B8 stability)

Concurrent capacity burn-in run on the Linux host as ci-runner with the
static-IP pool: WinBuild2025 40/40 PASS (~78.6s/round) and LinuxBuild2404
40/40 PASS (~70.2s/round) — 80/80 jobs, 20/20 rounds, near-deterministic
(static IP eliminates the DHCP IP-acquire variance of the §6/§7 baselines).

- RUNBOOK §9: concurrent burn-in result + ip-pool reset/recovery note.
- PhaseB-user-checklist Passo 7/8 marked done; fixed two checklist bugs:
  run as ci-runner (the simone path needs g+w on the /var/lib/ci root for
  ip-pool.tmp, not just the sub-dirs), and the Linux command was missing
  -SnapshotName BaseClean-Linux (default BaseClean is Windows-only).
- idea-2-linux-host §8 DoD: Phase B complete (B1–B7 + >2 weeks stability).
- TODO §2.8 [P2]: ip-pool is not reconciled against live clones; a killed
  job leaks its lease permanently and exhausts the 4-IP pool. Proposed fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/RUNBOOK.md

@@ -459,3 +459,47 @@ Ready column = WinRM/5986 TCP probe after IP known.
 - Destroy is slower than B6/B7 (~10 s vs ~5 s) — likely disk pressure or
   clone state at test time, unrelated to static IP.
 
+---
+
+## 9. Concurrent capacity burn-in (B7 — 4 × 10)
+
+Recorded 2026-06-07 — `Test-CapacityBurnIn.ps1 -Parallelism 4 -Rounds 10`,
+Linux Mint host + VMware Workstation Pro Linux, run as `ci-runner`, static IP
+pool (`192.168.79.201–204`). Repo `Simone/burnin-dummy`. Each "round" is the
+wall-clock time for 4 concurrent end-to-end jobs (clone → boot → IP →
+transport → build → artifacts → destroy). This is the first concurrent
+capacity burn-in (the §6–§8 baselines are single-job `Measure-CIBenchmark`).
+
+| Template          | Snapshot         | Build cmd       | Jobs PASS | Round time (min–max) | Round avg |
+| ----------------- | ---------------- | --------------- | --------- | -------------------- | --------- |
+| WinBuild2025      | `BaseClean`      | `build.ps1`     | 40 / 40   | 68–81 s              | ~78.6 s   |
+| LinuxBuild2404    | `BaseClean-Linux`| `build.sh`      | 40 / 40   | 70–71 s              | ~70.2 s   |
+
+**Result: OVERALL PASS** — 80/80 jobs, 20/20 rounds, zero orphaned clones,
+zero leaked IP leases between rounds.
+
+**Key findings**:
+- Per-round wall time is near-deterministic (Win σ ≈ 1.3 s, Linux σ ≈ 0.4 s),
+  confirming the static-IP pool eliminates the DHCP IP-acquire variance that
+  dominated the §6/§7 single-job baselines (σ 26–57 s).
+- 4-way concurrency adds no contention penalty: round time ≈ single-job boot
+  total (§8 static ≈ 24 s) plus build + serialized destroy, well within the
+  4-IP pool capacity.
+- Linux rounds (~70 s) slightly faster and tighter than Windows (~79 s).
+- IP-pool release-on-completion works under concurrency — pool returned to
+  all-free (`null`) after every round.
+
+**Operational note (pool not auto-reconciled)**: `ip-pool.json` is *not*
+reconciled against live clones at startup. A job killed mid-flight (SIGKILL,
+crash) leaks its lease permanently; with only 4 IPs for parallelism 4, a
+single leak exhausts the pool and every subsequent round fails fast with
+`IP pool exhausted after 60s`. Recovery: stop all jobs, confirm
+`build-vms/` empty, then reset the pool:
+
+```bash
+sudo -u ci-runner /opt/ci/venv/bin/python -c \
+  "import pathlib; pathlib.Path('/var/lib/ci/ip-pool.json').write_text('{}\n')"
+```
+
+See `TODO.md` (IP-pool auto-reconciliation) for the proposed fix.
+