mtcollins1 boot branch (operator fast path): #12800 + Started-row cd_error rule + KVM features seeding

docs/design-rung-drops.md

@@ -368,7 +368,7 @@ the enrolment-margin decision over exactly two App Attest verifier claims whose
 
 ### the enrolment-margin decision over the mtcollins1 boot acceptance matrix cases whose honest CPU lies in (margin, per-subject line]: they execute, and an exact reading inside the band is reported rather than decided — declared 2026-09-30
 
-the enrolment-margin decision over the mtcollins1 boot acceptance matrix cases whose honest CPU lies in (margin, per-subject line]: they execute, and an exact reading inside the band is reported rather than decided: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the matrix cases executing as natively emitted witnesses, the same replacement the eval-step drop mtcollins1_boot_matrix_new_witness_eval_step_cost waits on). Population: test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_host_that_never_prints_a_census_refuses_at_the_deadline: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 449 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_healthy_census_completes_and_releases_its_collector: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 433 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_the_handoff_is_the_reported_cause: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 421 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_already_presented_image_is_not_attached_again: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 411 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_two_socket_answer_is_a_truthful_topology_refusal: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 374 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_sol_loss_mid_boot_is_reported_before_the_deadline: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 381 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted: the real boot entry end to end over the dry realization through a stop, a replace and a full boot, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 473 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_readiness_stops_the_handoff: the real boot entry end to end over the dry realization up to the handoff gate, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36775473983 of gunbc#12800 at b907f7dc0c3 (srv3) observed 303 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 287 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope), test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_does_not_clear_is_replaced_and_booted: the real boot entry end to end over the dry realization through a stop, a replace and a full boot, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 444 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.cd_error_16_with_nothing_presented_attaches_and_boots_with_the_code_recorded: the real boot entry end to end over the dry realization through readiness and a full boot, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 429 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.cd_error_appearing_with_readiness_is_recorded_and_booted: the real boot entry end to end over the dry realization through readiness and a full boot, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 434 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_mount_error_refuses_by_name: the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 288 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_device_ejected_refuses_by_name_as_no_fault: the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 291 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.media_that_never_becomes_ready_refuses_before_any_power_action: the real boot entry end to end over the dry realization through the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36783312538 of gunbc#12800 at 8042d175c2a (srv3) observed 320 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 283 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope). Restored when: THE CAPABILITY: witnesses emitted to native code with the emitted runtime realizing v2.std.witness_evaluation evaluate_in_witness_frame and its v2.std.operation_realization modeled realization, EXECUTING ON THE MERGE PATH as a phase of a required lane whose red blocks a merge, running the mtcollins1 boot acceptance matrix with the real mtcollins1_boot_wet_on_srv1 entry; WHAT THAT MUST BE SUFFICIENT FOR: each dead-band identity reaches its verdict with stable headroom under the enrolment margin v2.workflow.floor_enrolment_margin derives, with its route and outcome assertions unchanged -- at which point every row stales and deletes. Cutting the polling route the cases assert, or supplying a decided value in place of the entry, satisfies neither.
+the enrolment-margin decision over the mtcollins1 boot acceptance matrix cases whose honest CPU lies in (margin, per-subject line]: they execute, and an exact reading inside the band is reported rather than decided: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the matrix cases executing as natively emitted witnesses, the same replacement the eval-step drop mtcollins1_boot_matrix_new_witness_eval_step_cost waits on). Population: test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_host_that_never_prints_a_census_refuses_at_the_deadline: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 449 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_healthy_census_completes_and_releases_its_collector: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 433 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_the_handoff_is_the_reported_cause: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 421 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_already_presented_image_is_not_attached_again: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 411 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_two_socket_answer_is_a_truthful_topology_refusal: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 374 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_sol_loss_mid_boot_is_reported_before_the_deadline: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 381 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted: the real boot entry end to end over the dry realization through a stop, a replace and a full boot, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 473 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_readiness_stops_the_handoff: the real boot entry end to end over the dry realization up to the handoff gate, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36775473983 of gunbc#12800 at b907f7dc0c3 (srv3) observed 303 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 287 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope), test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_mount_error_refuses_by_name: the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 288 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_device_ejected_refuses_by_name_as_no_fault: the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 291 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.media_that_never_becomes_ready_refuses_before_any_power_action: the real boot entry end to end over the dry realization through the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36783312538 of gunbc#12800 at 8042d175c2a (srv3) observed 320 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 283 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope). Restored when: THE CAPABILITY: witnesses emitted to native code with the emitted runtime realizing v2.std.witness_evaluation evaluate_in_witness_frame and its v2.std.operation_realization modeled realization, EXECUTING ON THE MERGE PATH as a phase of a required lane whose red blocks a merge, running the mtcollins1 boot acceptance matrix with the real mtcollins1_boot_wet_on_srv1 entry; WHAT THAT MUST BE SUFFICIENT FOR: each dead-band identity reaches its verdict with stable headroom under the enrolment margin v2.workflow.floor_enrolment_margin derives, with its route and outcome assertions unchanged -- at which point every row stales and deletes. Cutting the polling route the cases assert, or supplying a decided value in place of the entry, satisfies neither.
 
 ### new-witness eval-step cost gate over the one claim that inhabits the real byte-span argv with its really-serialized program: it still executes, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered — declared 2026-09-22