forgetest: the machine's print behavior under the offline service

Four cloud tests no longer need the app, an account, a network, or
anything on the bed: cloud.lid-interlock-abort, lid-during-button-wait,
paused-lid-cancel and oversize-stream run under the offline service
(enter_offline restarts the cloud client with the /run marker for that
one start; Offline is the socket; offline_job writes the job). The jobs
come from forgetest/puls.py: the header of a factory print of this
machine type (134 tags, MCsn 0, so the client's limits and settings come
from where a service job's do) over a square traced at a steady feed
with a leading power byte of zero and no LASER bit anywhere - the arm
unlocks the latch, the beam is never commanded, so the tests stay live
and need no scrap. A job longer than the ring (33 MiB of ticks, an hour
of squares) is an 87 kB gzip written in a tenth of a second, in place of
a full-bed raster designed in the app.

session_live reads the offline mark as "no web session"; enter_cloud
restarts an offline client with the service, so cloud.pause-resume (the
one real print left, with cloud.mode-switch the service-protocol half of
the catalog) follows the offline tests without the operator's hand.
Replays over a fake socket; the contract and BRINGUP say how the cloud
catalog splits. Catalog consequence: the four re-ported tests move;
nothing else is invalidated.

docs/ACCEPTANCE.md

@@ -149,6 +149,21 @@ bench, or one whose `/data` has been wiped, starts from a full campaign.
    it carries the two service-driven motions with it: the connect-time
    hunt run with the lid open, and the web-service homing (`$H` with
    `homing_mode = gfcloud`) after the switch back.
+   The cloud tests split by what they prove. The service protocol (sign-in,
+   the WebSocket, the hunt, the print from the app, progress, the job's
+   limits reaching the engine) is `cloud.mode-switch` and one real print,
+   `cloud.pause-resume`. The machine's print behavior (the lid and
+   interlock aborts, the button-wait cancel, a paused print ended by the
+   lid, a print longer than the ring with the app's cancel) runs under the
+   **offline service** (`enter_offline`: the cloud client restarted with
+   the `/run/gfcloud-offline` marker, no account, no network; the test
+   hands it a synthesized job over `/run/gfcloud-offline.sock` and reads
+   the machine's events back, see `forgetest/puls.py` and the cloud
+   client's `docs/CLOUD.md`). Those jobs carry no laser command, so
+   nothing is on the bed and nothing burns, but the arm still unlocks the
+   latch, so they stay `live`. The offline client is left running; the
+   next test that needs the service restarts it (`enter_cloud` does), as
+   does a mode switch or a controller restart.
 4. Or hand the whole list to a queue. **Run what is left** offers two:
    **Unattended** takes every `auto` test the campaign does not already
    count as satisfied, and needs nobody in the room; **Operator and live**

docs/BRINGUP.md

@@ -588,9 +588,12 @@ until `releases/v<version>/acceptance.json` is committed.
   its floor), `camera.*`,
   `laser.*` (emission witness, arm-wait lid, disarm-in-hold, armed kill,
   pause/resume/lid-cancel) and `cloud.*` (the mode round trip with the
-  lid-open hunt and the web-service homing on it, and the job-behavior
-  tests). Tests that share a setup are merged; the `auto` tests stay
-  separate for failure isolation. 27 are `auto`, 8 `operator`, 8 `live`.
+  lid-open hunt and the web-service homing on it, one real print, and the
+  job-behavior tests under the offline service: the cloud client driven
+  from a local socket with a synthesized laser-free job, no account, no
+  network, nothing on the bed). Tests that share a setup are merged; the
+  `auto` tests stay separate for failure isolation. 27 are `auto`, 8
+  `operator`, 8 `live`.
 - **The operator's part is asked for by name, not by popup**
   (`docs/ACCEPTANCE.md` "The operator's part"): a Ready prompt before a
   timed step, a standing notice the test takes down when the machine shows
@@ -1151,9 +1154,12 @@ Open items only. Anything closed is in `CAMPAIGN-LOG.md`.
     Cutting the operator's part of a campaign: the forgetest-only step
     (the operator channel, the merged mode-switch, the sensor witnesses,
     the steps pane, the journal, per-test implementation hashing) is done
-    and bench-validated (CAMPAIGN-LOG 2026-08-22). The steps after it, an
-    offline cloud service for the machine-behavior tests and a bench
-    actuator for the lid, interlock and button, are planned, not started. Catalog
+    and bench-validated (CAMPAIGN-LOG 2026-08-22). The offline cloud
+    service for the machine-behavior tests is code-complete (gfutilities
+    `OfflineService`, `gfcloud --offline`, `forgetest/puls.py`, four tests
+    re-ported) with host replays; **its bench run on the next dev image is
+    owed.** A bench actuator for the lid, interlock and button is planned,
+    not started. Catalog
     gaps left from the tool's own plan: `cooling.confirm-escalate` and
     `cooling.fire-gate-blocks-arm` are not ported (both need the pump switched
     by hand mid-run, so they are bench-tab material first), and whether