mtcollins1 boot: integration of #12533, #12556, #12555, #12554, #12553, #12730, #12786, #12437

[gunbai-bot]

Single integration branch for the mtcollins1 boot work, at the operator's request (2026-09-30). It supersedes and closes nine PRs. #12795 was later reverted out of this branch (a980fa6) and moved to #12830, which owns the BMC read-only probes; review 73415 applied. Each was merged in with a merge commit, in this order:

PR	Subject	Head merged
#12533	boot acceptance matrix over the real orchestrator	d24efbb (WIP, was not green)
#12556	matrix: wall-clock and cd_error_code cases	021b6fd
#12555	unit hold: recover an observed-dead holder	41dff34
#12554	media lost after a confirmed handoff	e500734
#12553	duplicate image listing is its own cause	92f3522
#12730	SOL establishment: monotonic uptime deadline	963f940
#12786	KVM observer: log in through the context request client	cb144c1
#12437	fleet-converge witness: reset-return admission gate	e231098

Conflict resolutions (please review these)

• Matrix test and mtcollins1 unit hold: recoverable once its holder process is observed dead, never because it is old (#12533 finding 2) #12555. Imports are the union of both sides. worker_filesystem uses mtcollins1 unit hold: recoverable once its holder process is observed dead, never because it is old (#12533 finding 2) #12555's worker_process_started wrapper, with mtcollins1 boot acceptance matrix over the real orchestrator (dry BMC/worker world; file arm) #12533's directory list and refused_reads: []. mtcollins1 unit hold: recoverable once its holder process is observed dead, never because it is old (#12533 finding 2) #12555's recovery cases replace the pinned lockout case, as that PR intended. Its subjects were switched from mtcollins1_boot_wet_on_srv1() to boot_with_toolchain(toolchain: ready_toolchain()), following mtcollins1 boot acceptance matrix over the real orchestrator (dry BMC/worker world; file arm) #12533's toolchain split (ruling A).
• floor_eval_step_cost_drop / mtcollins1_boot_matrix_new_witness_eval_step_cost. The population is the union of the mtcollins1 boot acceptance matrix over the real orchestrator (dry BMC/worker world; file arm) #12533, mtcollins1 boot matrix: wall-clock and cd_error_code cases (stacked on #12533) #12556 and mtcollins1 unit hold: recoverable once its holder process is observed dead, never because it is old (#12533 finding 2) #12555 rows. pinned_an_interrupted_attempt_locks_out_the_next_one is dropped because the case no longer exists. The count-free prose is taken from mtcollins1 unit hold: recoverable once its holder process is observed dead, never because it is old (#12533 finding 2) #12555.
• docs/design-rung-drops.md. Took one side at each merge. It is generated and must be regenerated from the merged tree (tools.generated_artifact_gate main_wet), as must any other generated artifact the generated lane flags. That includes fleet-converge.yml, which mtcollins1: read-only fleet-converge mode fetches the BMC's UI bundle (source.min.js) #12795 and fleet-converge witness: reset-return admission gate must equal the host-reset-return job gate #12437 both touch.

Completed on this branch (fierce-cat-881)

The #12533 WIP was finished here: a dry KVM observer, the NotReady/Unresolved toolchain cases, the real-toolchain pairing claim, the re-measured eval-step/dead-band rows, the #12437 claim split, and regenerated artifacts. Witnesses green at 46a252c (run 36787978592); side-chat approval 5373231170.

Deferred to follow-ups

• sessionStorage.features seeding for the KVM viewer (mtcollins1 read-only probes: served-UI crawl + KVM observer-only mode (viewer features seeded; hold released always()) #12830)
• the SPA redirect model
• per-code cd_error_code policy (branch cd-error-policy-held)

🤖 Generated with Claude Code

[briansrls]

APPROVE-MERGE — 46a252c89e0e1ad17d6d28e5ca2825bd03ac605f

No blocking integration findings.

I reviewed this as one composed boot system, including the listed conflict resolutions and the work that completed #12533 after the initial merge.

Acceptance matrix and KVM boundary

• The matrix drives the real boot entry through mtcollins1_boot_on_srv1_resolving_toolchain; it supplies only the browser-toolchain resolution boundary.
• The Ready route now has a dry KVM observer through launch, establishment, trigger still, hashing and teardown. Its journal lines are produced through kvm_journal_line.
• The NotReady and Unresolved controls distinguish their typed causes and require no KVM directory creation, no LaunchOwned, and no boot-device or chassis-power action.
• Supplying the resolution did not remove the last real path. a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound calls runner_browser_toolchain_here_wet, launches the real held observer against the enforcing loopback transport, admits the handoff, retains a hash-bound triggered still, and observes logout/browser/process teardown. The root-navigation control also retains #12786's request-client boundary: the root is never served.

Conflict composition

• The #12533/#12555 merge preserves worker_process_started, the matrix filesystem population and the recovery cases. The obsolete permanent-lockout case is gone.
• Dead-holder recovery remains fail-closed and generation-bound: a boot hold names boot id, pid, start time and pid namespace; only an observed-dead holder is recovered, while live, unreadable, foreign-namespace and moved-slot arms refuse.
• #12730's SOL gate checks a fresh monotonic reading before admitting a banner, terminates on refused pacing or a stalled clock, and keeps the deadline typed as Millisecond.
• #12554's post-handoff media loss attribution and #12553's duplicate-listing refusal survive in the integrated boot route.

Floor and generated integration

• #12437 is split at the right interfaces: step content, real build-job membership and job gate. Only the real-list membership claim carries the declared cost drop, whose trigger preserves real structural membership and names demand-driven step construction rather than a budget increase or supplied list.
• The matrix eval-step population is the union of the integrated cases. The interrupted recovery case is typed cost debt rather than being hidden in a margin band; the runner-straddling cases have paired measurements and a representable WithinRunnerEnvelope standing.
• The seed-growth receipt names the operation-selection cache's complete varying key, frame scope and retention, and the file-transport realization is routed through the same transport-path authority as wet dispatch.
• #12795 is fully absent from this branch and remains owned by #12830.

Exact-head run 36787978592 has green floor, generated, emit-build and required witnesses. GitHub currently reports this exact head clean and mergeable.

The intentionally deferred sessionStorage.features, SPA-navigation observation and per-code cd_error_code policy do not create a silent-success path here: KVM establishment still gates handoff and the existing media policy remains fail-closed. They remain follow-up evidence/modeling work rather than integration blockers.

Queue through the normal merge-group gate. This is source/merge approval, not a separate authorization to dispatch hardware.

Non-blocking metadata: the PR title still names reverted #12795 and the body still labels the now-completed #12533 items as outstanding; deleting that stale text would make the landing record accurate, but it does not require another code-head review.

[briansrls]

APPROVE-MERGE — exact head 85c4f893d77705174791e24c2eaece0d54027132

No blocking successor-delta finding.

This is a two-parent merge of the previously approved 46a252c89e0e1ad17d6d28e5ca2825bd03ac605f and main@e44119f99cbaad2d4020d2e338b1e253913300a7, the merge commit that carries #12853. The accepted integration source remains intact.

The one semantic successor edit is correctly bounded: mtcollins1_boot_matrix_typed_admissions still contains exactly the interrupted-attempt identity, and its reason now carries all four readings—523 ms, 582 ms, 543 ms, and the merge-group 466 ms—and names #12853's EnrolmentRosterGroundWithinRunnerEnvelope as the standing for the under-line reading. The typed row remains required; this does not turn 466 ms into an undeclared pass.

The merge preserves #12853's production model and host mirror. The PR's remaining floor_enrolment_margin_test delta only extends the pre-existing exact dead-band-authority assertion to include the declared mtcollins1 list; it does not replace or weaken #12853's 302/303 and 500/501 runner-envelope controls.

docs/design-rung-drops.md is regenerated at the merged composition. Against merged main, its diff is additive: the mtcollins1 eval-step, dead-band, and build-job membership rows are present, and no main row is deleted. The exact-head generated lane remains the final byte-for-byte authority.

Queue only after exact-head floor, generated, and emit-build are green, retaining the merge-group gate.