review: iteration-1 fixes across CI, bridge, VM harness, and docs

CI/pipeline:
- KERNEL_TARBALL passed as a YAML env literal '~' was never tilde-expanded
  and would have failed every hosted kernel-build dispatch; the path is now
  exported from the shell. Verified reproducible before the fix.
- Every job gets timeout-minutes; boot smoke uses timeout -k so a wedged
  qemu is SIGKILLed instead of holding the job.
- Tarball fetch + fail-closed sha256 verification deduplicated into
  build/fetch-kernel-tarball.sh (with curl retries), used by build-kernel.sh
  and both CI jobs. busybox fetch gains retries too.
- ccache layer for kernel-build (cache keyed on defconfig+patches) recovers
  the incremental-compile speed the ephemeral-runner move cost.
- build-kernel.sh now asserts every fragment option survived olddefconfig —
  merge_config -m pastes text and Kconfig silently drops unmet symbols.

rs485-bridge:
- pending-buffer cap (2x max RTU ADU) instead of unbounded growth;
  explicit accept-loop error handling with backoff instead of .flatten();
  per-arm inline bounds instead of the string-keyed lookup whose default
  would have mis-bounded a future get-input; control-socket cleanup errors
  surfaced; flag-shaped values rejected in arg parsing; doc example uses a
  private mktemp dir. Test timing margins widened for contended runners
  (gap 25->120ms, 60x margin on the split-frame test).

VM harness:
- stage-1/stage-2 boot scripts share one validated slot parser and one
  by-name populator (qemu/rootfs/etc/warden-lib.sh) — the duplicated
  parser had already diverged on validation; userdata/oem mount failures
  now fail fast with a greppable sentinel; udhcpc fallback keys off the
  interface actually having an address; switch_root applet guarded.
- boot-smoke delegates the qemu invocation to run.sh (machine shape lives
  in ONE place); run.sh port 0 disables a hostfwd.
- mkimage: unknown partition names fail at build time; DISK_END is a max,
  not last-entry; --state keys validated as filenames.
- portal-scenario: mock readiness is asserted (no silent fall-through),
  hostfwd port collisions retried, mount-failure sentinel fails fast.
- ui-shot: fixed sleeps replaced with bounded screendump polling; the
  repaint assertion is real and documented as such. qmp.py loses its
  module-global and gains argv validation.

Docs/scrub: bench-host paths and the site AP name removed from six more
port docs and two evidence tables; path-bearing build artifacts (.elf,
.map) untracked (the 154-byte firmware .bin is path-free and stays);
ADR-0003 marked visibility-superseded by ADR-0007; stale section
cross-reference fixed; flare-edge noted as private for outside readers;
stale root-level review report removed per the new workspace rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/rs485-bridge/src/main.rs

@@ -2,10 +2,14 @@
 //! there); this file only parses arguments, connects sockets, and spawns the
 //! control listener.
 //!
-//! Typical use (matches qemu/run.sh --rs485):
+//! Typical use (matches qemu/run.sh --rs485). Put the sockets in a private
+//! per-run directory (mktemp -d) — short (AF_UNIX caps paths at ~108 chars)
+//! and not guessable/pre-creatable by other local users, unlike a fixed
+//! /tmp name:
 //!
-//!   qemu/run.sh --kernel ... --rs485 /tmp/warden-rs485.sock &
-//!   rs485-bridge --serial /tmp/warden-rs485.sock --control /tmp/warden-rs485-ctl.sock
+//!   d=$(mktemp -d /tmp/rs485.XXXXXX)
+//!   qemu/run.sh --kernel ... --rs485 "$d/serial.sock" &
+//!   rs485-bridge --serial "$d/serial.sock" --control "$d/ctl.sock"
 
 use std::io::{BufRead, BufReader, Write};
 use std::os::unix::net::{UnixListener, UnixStream};
@@ -31,10 +35,19 @@ fn main() {
 
     let mut args = std::env::args().skip(1);
     while let Some(a) = args.next() {
-        let mut val = |name: &str| args.next().unwrap_or_else(|| {
-            eprintln!("{name} needs a value");
-            usage()
-        });
+        let mut val = |name: &str| {
+            let v = args.next().unwrap_or_else(|| {
+                eprintln!("{name} needs a value");
+                usage()
+            });
+            // A following flag means the value was omitted — report the real
+            // problem instead of swallowing the flag as a bogus value.
+            if v.starts_with("--") {
+                eprintln!("{name} needs a value, got flag '{v}'");
+                usage()
+            }
+            v
+        };
         match a.as_str() {
             "--serial" => serial = Some(val("--serial")),
             "--control" => control = Some(val("--control")),
@@ -55,14 +68,32 @@ fn main() {
     let bus: &'static Bus = Box::leak(Box::new(Bus::new(address, regs, bits)));
 
     if let Some(path) = control {
-        let _ = std::fs::remove_file(&path); // stale socket from a previous run
+        // Clear a stale socket from a previous run. A failure here that is not
+        // "nothing to remove" (e.g. someone else's file behind /tmp's sticky
+        // bit) will make the bind below fail — surface both errors.
+        let removed = std::fs::remove_file(&path);
         let listener = UnixListener::bind(&path).unwrap_or_else(|e| {
             eprintln!("FATAL: cannot bind control socket {path}: {e}");
+            if let Err(re) = removed {
+                if re.kind() != std::io::ErrorKind::NotFound {
+                    eprintln!("       (removing the pre-existing file also failed: {re})");
+                }
+            }
             exit(1);
         });
         eprintln!("rs485: control socket at {path}");
         std::thread::spawn(move || {
-            for conn in listener.incoming().flatten() {
+            // Explicit error handling: `.flatten()` would turn a persistent
+            // accept() failure (fd exhaustion etc.) into a silent hot loop.
+            for conn in listener.incoming() {
+                let conn = match conn {
+                    Ok(c) => c,
+                    Err(e) => {
+                        eprintln!("rs485: control accept failed: {e} — backing off");
+                        std::thread::sleep(Duration::from_millis(200));
+                        continue;
+                    }
+                };
                 let reader = BufReader::new(conn.try_clone().expect("clone control conn"));
                 let mut writer = conn;
                 for line in reader.lines() {