Seal physical probe failures as FAIL_0 receipts, clear consumed proof only through an authorized receipt, and isolate each legacy virtqueue in a 128 KiB region sized for JD Cloud.