doc: map the removal of portb's host input in the OpenVMM roadmap

Record the two commits that the previous commit pins as positions 212
and 213 of the microVM chain, and move the NVX pin to 4713c539a.
microsoft/openvmm#4887 proposes position 213 for feature/microvm/dev on
position 212, de29849a4, which microsoft/openvmm#4886 proposes as one
commit on position 211, 5aa8b0285, which microsoft/openvmm#4894
proposes on position 210, eda13d80a, the head of
feature/microvm/release/v4.0, to which feature/microvm/dev also points.
The pin is now 78 commits past the mapped tip, and positions 212 and
213 join the unassigned positions 136-213.

Position 212 makes the guests of the microVM VMM tests run without
portb's host input and removes the petri harness's input. Position 213
removes that input from portb: its receive buffer, its gating, and its
input-pending status bit, while a restore refuses saved state that
holds host input and the CLI gives portb no console input; the device
now polls its backend for a departed peer, which its reads used to
notice. Both follow the v4.0 reorganization, so they combine no earlier
commits; the table says so.

They change what earlier mapped commits add rather than adding to
them: the cold-boot test and portb harness of PR15's position 069, the
snapshot-request check of PR17's position 084, and the management
RPC's microVM test of PR25's position 128; and the receive path of
PR15's position 064's portb console, which PR20's positions 098 and 099
extend, and the console input of PR15's position 068. Replaying them on
upstream main, ca6b2b177, conflicts in all nine of their files, six of
which upstream main lacks, so they follow those PRs upstream. Say both
in the table's remarks.

Part of #549.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ppenna

doc/openvmm-upstream-roadmap.md

@@ -7,18 +7,20 @@
   `b2676222b383bf50c7022f6a5983920421469a47`; see [Upstream status](#upstream-status).
 - Mapped fork tip: `3cdf4fe3834cfb90b9ee685875493bc9bff1b7a4`, position 135. The graph, PR
   summary, and commit mapping below cover positions 001-135 and the PR20 fixup at position 152.
-- NVX's pinned OpenVMM revision: `5aa8b028503237757b95f5629ebdbb4d56a67d51`, position 211.
-  Position 211, which microsoft/openvmm#4894 proposes for `feature/microvm/dev`, is one commit on
-  position 210, `eda13d80a`, the head of the `feature/microvm/release/v4.0` branch of
-  microsoft/openvmm, to which `feature/microvm/dev` also points. The v4.0 reorganization moved the
-  205 commits of `feature/microvm/release/v3.0` and the NVX pin before it, `35e76265f`, onto
-  `c6d3da0ff`. It dropped the eight commits whose changes upstream had landed or superseded,
-  retired the fallible device start that microsoft/nvx#1232 replaces with awaited device
-  restoration, folded that restoration into the commits that it changes, and added 14 commits that
-  give each ABI that the chain introduces a single version; see
-  [The v4.0 reorganization](#the-v40-reorganization). The pin is 76 commits past the mapped tip on
-  the same first-parent chain. Positions 136-211, except the PR20 fixup at position 152, are not
-  yet assigned to PRs; see [Commits after the mapped tip](#commits-after-the-mapped-tip).
+- NVX's pinned OpenVMM revision: `4713c539ac989c5760415f8441bdb85ae9be3e82`, position 213.
+  Position 213, which microsoft/openvmm#4887 proposes for `feature/microvm/dev`, is one commit on
+  position 212, `de29849a4`, which microsoft/openvmm#4886 proposes as one commit on position 211,
+  `5aa8b0285`, which microsoft/openvmm#4894 proposes as one commit on position 210, `eda13d80a`,
+  the head of the `feature/microvm/release/v4.0` branch of microsoft/openvmm, to which
+  `feature/microvm/dev` also points. The v4.0 reorganization moved the 205 commits of
+  `feature/microvm/release/v3.0` and the NVX pin before it, `35e76265f`, onto `c6d3da0ff`. It
+  dropped the eight commits whose changes upstream had landed or superseded, retired the fallible
+  device start that microsoft/nvx#1232 replaces with awaited device restoration, folded that
+  restoration into the commits that it changes, and added 14 commits that give each ABI that the
+  chain introduces a single version; see [The v4.0 reorganization](#the-v40-reorganization). The
+  pin is 78 commits past the mapped tip on the same first-parent chain. Positions 136-213, except
+  the PR20 fixup at position 152, are not yet assigned to PRs; see
+  [Commits after the mapped tip](#commits-after-the-mapped-tip).
 - Upstream main: `ca6b2b177da5e33ae1bcac72986b31d6b039811c` (2026-11-02), one commit past the
   fork base; see [Upstream main past the fork base](#upstream-main-past-the-fork-base).
 
@@ -644,8 +646,8 @@ c6d3da0ff
   -> command lines [189] -> KVP test [190-191]
   -> sandbox block roles [192] -> virtio feature masks [193-194]
   -> IOAPIC interrupt lines [195-196] -> ABI restart [197-210]
-  -> boot console exit drain [211]
-  -> 5aa8b0285 (NVX pin)
+  -> boot console exit drain [211] -> portb without host input [212-213]
+  -> 4713c539a (NVX pin)
 ```
 
 For upstream review, PR01-PR07 and PR14 can be rebased independently onto current upstream main,
@@ -661,12 +663,12 @@ see [The v3.0 reorganization](#the-v30-reorganization).
 
 ## Commits after the mapped tip
 
-The NVX pin extends the chain past position 135 without merges. Of the 76 later commits, position
+The NVX pin extends the chain past position 135 without merges. Of the 78 later commits, position
 152 is a PR20 fixup, and the others are not yet classified or assigned to PRs. Each of positions
 136-191 combines the v2.4 commits that the table lists, as v3.0 positions 145-200 did, which
 developed one concept; "(part)" marks a v2.4 fixup that split across commits. Positions 192-196
 followed the v3.0 reorganization, positions 197-210 are the ABI restart of the v4.0
-reorganization, and position 211 followed it, so they combine none.
+reorganization, and positions 211-213 followed it, so they combine none.
 
 | Position | Commit | v3.0 position | v2.4 positions | Topic |
 | ---: | --- | ---: | --- | --- |
@@ -746,6 +748,8 @@ reorganization, and position 211 followed it, so they combine none.
 | 209 | `31d684ae0` | - | - | microVM: drop the history from the layout and snapshot helpers |
 | 210 | `eda13d80a` | - | - | openvmm_helpers: number the snapshot's fields without gaps |
 | 211 | `5aa8b0285` | - | - | microVM: drain the boot console's terminal output at guest exit (microsoft/openvmm#4894) |
+| 212 | `de29849a4` | - | - | vmm_tests: drive the microVM guests without portb input (microsoft/openvmm#4886) |
+| 213 | `4713c539a` | - | - | microVM: remove portb's host input (microsoft/openvmm#4887) |
 
 The remarks that say whether commits apply to upstream main record what the v3.0 reorganization
 found on its base, `b2676222b`, at the positions that the commits have now.
@@ -774,7 +778,15 @@ position 087 selects, to the IOAPIC input of its window, which changes the inter
 discovery tokens that PR17's position 078 records in the snapshot contract and that the slots of
 PR18, PR19, and PR23 use. Position 211 extends the portb exit drain of PR24's position 123 to the
 relay that copies the boot console of PR16's position 071 to the terminal, and gives the
-management RPC's drain of PR25's position 128 no such relay. Assigning the later
+management RPC's drain of PR25's position 128 no such relay. Position 212 makes the guests of the
+microVM cold-boot test and portb harness of PR15's position 069, of the check of PR17's position
+084 that an unconfigured snapshot request continues, and of the management RPC's microVM test of
+PR25's position 128 run without portb's host input, and removes the harness's input. Position 213
+then removes that input: the receive path of the portb console of PR15's position 064, which
+PR20's position 098 shares with the restore records and PR20's position 099 gates, and the
+console input that PR15's position 068 gives the device on the CLI. Since those reads also
+noticed a departed peer of a listening endpoint, position 213 has the device poll the backend for
+it instead. Assigning the later
 commits therefore means revisiting those PRs, not only appending new ones.
 
 Position 182, by contrast, changes only `disk_blob`, which upstream main and the fork base
@@ -819,6 +831,9 @@ introduce those ABIs upstream.
 Position 211 changes only the microVM CLI's output drain and host consoles, the anonymous serial
 pair that they use, and the CLI guide: replaying it on upstream main, `ca6b2b177`, conflicts in
 five of its seven files, four of which upstream main lacks, so it follows those PRs upstream.
+Positions 212 and 213 change only the microVM portb device, its CLI and test harness, the VMM tests
+of PR15, PR17, and PR25, and their Guide pages: replaying them on upstream main conflicts in all
+nine of their files, six of which upstream main lacks, so they follow those PRs upstream.
 
 ## PR summary