Classify AllowNoVault-<chain> as an operational mimir

Itzamnarequested to merge
allow-novault-operational-mimir into develop

Summary

AllowNoVault-<CHAIN> (a8bf9617) gates the noop:novault vault debit behind a chain-scoped mimir that operators are meant to open only for a brief, coordinated insolvency-correction window. Today the key is classified as an economic mimir, so it needs 2/3 of active nodes before the debit applies.

That makes the window impractical in the situation it exists for: during the churn migration a retiring vault ran out of gas (its TRX migrated ahead of a 182k TRON.USDT txout), the operator top-up was sent with noop:novault, the gate was closed, and the vault was credited — a credit that a later novault cannot undo. The next migration round then tries to migrate the top-up itself.

Change

  • IsOperationalMimir: keys with the ALLOWNOVAULT- prefix are operational (plurality of node votes, like HALT* / PAUSE* / COMPROMISEDVAULT-), so operators can open and close the window quickly.
  • Unit test TestIsOperationalMimirAllowNoVault (case-insensitive, unrelated keys stay non-operational).
  • docs/concepts/memos.md: document that :NOVAULT only debits when AllowNoVault-<CHAIN> is set; otherwise it behaves as a plain NOOP.

Context: board 759 (mainnet, 2026-09-15). No behaviour change to the debit itself or its authorization semantics — only who can open the gate.

Merge request reports