review: iteration-1 fixes across CI, bridge, VM harness, and docs

CI/pipeline:
- KERNEL_TARBALL passed as a YAML env literal '~' was never tilde-expanded
  and would have failed every hosted kernel-build dispatch; the path is now
  exported from the shell. Verified reproducible before the fix.
- Every job gets timeout-minutes; boot smoke uses timeout -k so a wedged
  qemu is SIGKILLed instead of holding the job.
- Tarball fetch + fail-closed sha256 verification deduplicated into
  build/fetch-kernel-tarball.sh (with curl retries), used by build-kernel.sh
  and both CI jobs. busybox fetch gains retries too.
- ccache layer for kernel-build (cache keyed on defconfig+patches) recovers
  the incremental-compile speed the ephemeral-runner move cost.
- build-kernel.sh now asserts every fragment option survived olddefconfig —
  merge_config -m pastes text and Kconfig silently drops unmet symbols.

rs485-bridge:
- pending-buffer cap (2x max RTU ADU) instead of unbounded growth;
  explicit accept-loop error handling with backoff instead of .flatten();
  per-arm inline bounds instead of the string-keyed lookup whose default
  would have mis-bounded a future get-input; control-socket cleanup errors
  surfaced; flag-shaped values rejected in arg parsing; doc example uses a
  private mktemp dir. Test timing margins widened for contended runners
  (gap 25->120ms, 60x margin on the split-frame test).

VM harness:
- stage-1/stage-2 boot scripts share one validated slot parser and one
  by-name populator (qemu/rootfs/etc/warden-lib.sh) — the duplicated
  parser had already diverged on validation; userdata/oem mount failures
  now fail fast with a greppable sentinel; udhcpc fallback keys off the
  interface actually having an address; switch_root applet guarded.
- boot-smoke delegates the qemu invocation to run.sh (machine shape lives
  in ONE place); run.sh port 0 disables a hostfwd.
- mkimage: unknown partition names fail at build time; DISK_END is a max,
  not last-entry; --state keys validated as filenames.
- portal-scenario: mock readiness is asserted (no silent fall-through),
  hostfwd port collisions retried, mount-failure sentinel fails fast.
- ui-shot: fixed sleeps replaced with bounded screendump polling; the
  repaint assertion is real and documented as such. qmp.py loses its
  module-global and gains argv validation.

Docs/scrub: bench-host paths and the site AP name removed from six more
port docs and two evidence tables; path-bearing build artifacts (.elf,
.map) untracked (the 154-byte firmware .bin is path-free and stays);
ADR-0003 marked visibility-superseded by ADR-0007; stale section
cross-reference fixed; flare-edge noted as private for outside readers;
stale root-level review report removed per the new workspace rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/tests/boot-smoke.sh

@@ -27,13 +27,15 @@ command -v qemu-system-arm >/dev/null || {
 LOG="$(mktemp "${TMPDIR:-/tmp}/warden-qemu-smoke.XXXXXX")"
 trap 'rm -f "$LOG"' EXIT
 
-# NOTE: never pass `earlyprintk` — the config's DEBUG_UART_PHYS is the RV1106's
-# 0xff4c0000, which does not exist on -M virt.
-timeout 180 qemu-system-arm \
-  -M virt,highmem=off -cpu cortex-a7 -smp 1 -m 256M \
-  -kernel "$ZIMAGE" -initrd "$INITRD" \
-  -append "console=ttyAMA0 rdinit=/init" \
-  -nographic -no-reboot </dev/null | tee "$LOG" || {
+# Delegate the qemu invocation to run.sh (--no-disk) so the machine shape
+# (-M virt,highmem=off, cpu, memory, virtio topology) lives in exactly one
+# place — the two hand-copied invocations had already drifted once.
+# timeout -k: a wedged qemu that ignores SIGTERM gets SIGKILLed 10s later
+# instead of holding the job until the workflow-level timeout.
+timeout -k 10 180 bash "$QDIR/run.sh" \
+  --kernel "$ZIMAGE" --initrd "$INITRD" --no-disk \
+  --ssh-port 0 --http-port 0 --api-port 0 \
+  </dev/null | tee "$LOG" || {
     echo "FATAL: qemu exited non-zero (or hung until the 180s timeout)" >&2
     exit 1
   }

qemu/tests/portal-scenario.sh

@@ -62,11 +62,19 @@ python3 "$FLARE_EDGE/tools/mock-flare-portal.py" \
   --port "$PORT" --device "$DEVICE_ID:$API_KEY" \
   --wfw "$WORK/offer.wfw" > "$WORK/mock.log" 2>&1 &
 MOCK_PID=$!
+mock_ready=0
 for _ in $(seq 1 50); do
-  curl -so /dev/null "http://127.0.0.1:$PORT/" && break
+  curl -so /dev/null "http://127.0.0.1:$PORT/" && { mock_ready=1; break; }
   kill -0 "$MOCK_PID" 2>/dev/null || { echo "FATAL: mock portal died:" >&2; cat "$WORK/mock.log" >&2; exit 1; }
   sleep 0.2
 done
+# The loop must not fall through silently: an alive-but-unresponsive mock
+# would otherwise surface 420s later as an unrelated assertion timeout.
+[ "$mock_ready" = 1 ] || {
+  echo "FATAL: mock portal never answered on :$PORT within 10s" >&2
+  tail -10 "$WORK/mock.log" >&2
+  exit 1
+}
 echo "== mock portal on :$PORT, device $DEVICE_ID"
 
 # 2. image seeded with the portal URL + credentials.
@@ -79,11 +87,34 @@ bash "$QDIR/mkimage.sh" \
   --state "flare.api_key=$API_KEY" \
   --state "flare.site=qemu-devsim"
 
-# 3. boot the VM headless (daemons run; console log to file).
-bash "$QDIR/run.sh" --kernel "$ZIMAGE" \
-  --ssh-port $((PORT + 1)) --http-port $((PORT + 2)) --api-port $((PORT + 3)) \
-  > "$WORK/console.log" 2>&1 &
-QEMU_PID=$!
+# 3. boot the VM headless (daemons run; console log to file). Random hostfwd
+#    ports can collide with another process — detect the early qemu bind
+#    failure and retry with a fresh base rather than failing spuriously.
+QEMU_PID=""
+for _attempt in 1 2 3; do
+  VMBASE=$((20000 + RANDOM % 20000))
+  : > "$WORK/console.log"
+  bash "$QDIR/run.sh" --kernel "$ZIMAGE" \
+    --ssh-port "$VMBASE" --http-port $((VMBASE + 1)) --api-port $((VMBASE + 2)) \
+    > "$WORK/console.log" 2>&1 &
+  QEMU_PID=$!
+  sleep 3
+  if kill -0 "$QEMU_PID" 2>/dev/null; then
+    break
+  fi
+  if grep -aq 'Could not set up host forwarding' "$WORK/console.log"; then
+    echo "== hostfwd port collision on base $VMBASE — retrying"
+    QEMU_PID=""
+    continue
+  fi
+  echo "FATAL: VM died at launch:" >&2
+  tail -20 "$WORK/console.log" >&2
+  exit 1
+done
+if [ -z "$QEMU_PID" ] || ! kill -0 "$QEMU_PID" 2>/dev/null; then
+  echo "FATAL: could not launch the VM after 3 port attempts" >&2
+  exit 1
+fi
 
 # 4. assert: rootfs up, and the portal saw — from OUR device id — an
 #    authenticated check-in, the firmware desired-state pull, and the signed
@@ -99,6 +130,11 @@ while [ $SECONDS -lt $deadline ]; do
   grep -aq "GET /api/v1/devices/$DEVICE_ID/firmware -> 200" "$WORK/mock.log" && ok_fw=1
   grep -aq "GET /api/v1/devices/$DEVICE_ID/firmware/assets/.* -> 200" "$WORK/mock.log" && ok_asset=1
   [ $ok_report -eq 1 ] && [ $ok_fw -eq 1 ] && [ $ok_asset -eq 1 ] && break
+  grep -aq 'WARDEN-QEMU-MOUNT-FAILED' "$WORK/console.log" && {
+    echo "FATAL: guest partition mount failed (bad image?):" >&2
+    grep -a 'WARDEN-QEMU-MOUNT-FAILED' "$WORK/console.log" >&2
+    exit 1
+  }
   kill -0 "$QEMU_PID" 2>/dev/null || { echo "FATAL: VM exited early" >&2; tail -30 "$WORK/console.log" >&2; exit 1; }
   sleep 2
 done

qemu/tests/qmp.py

@@ -11,7 +11,7 @@ import sys
 import time
 
 
-def rpc(sock, obj):
+def rpc(sock, sock_file, obj):
     sock.sendall((json.dumps(obj) + "\n").encode())
     while True:
         line = sock_file.readline()
@@ -29,15 +29,20 @@ def main():
     if len(sys.argv) < 3:
         sys.exit(__doc__)
     path, cmd = sys.argv[1], sys.argv[2]
-    global sock_file
+    need = {"screendump": 4, "tap": 5, "quit": 3}
+    if cmd not in need:
+        sys.exit(f"unknown command {cmd}\n{__doc__}")
+    if len(sys.argv) < need[cmd]:
+        sys.exit(f"{cmd}: missing argument(s)\n{__doc__}")
+
     s = socket.socket(socket.AF_UNIX)
     s.connect(path)
-    sock_file = s.makefile("r")
-    sock_file.readline()  # greeting banner
-    rpc(s, {"execute": "qmp_capabilities"})
+    f = s.makefile("r")
+    f.readline()  # greeting banner
+    rpc(s, f, {"execute": "qmp_capabilities"})
 
     if cmd == "screendump":
-        rpc(s, {"execute": "screendump", "arguments": {"filename": sys.argv[3]}})
+        rpc(s, f, {"execute": "screendump", "arguments": {"filename": sys.argv[3]}})
     elif cmd == "tap":
         x, y = int(sys.argv[3]), int(sys.argv[4])
         press = [
@@ -46,16 +51,14 @@ def main():
             {"type": "btn", "data": {"down": True, "button": "left"}},
         ]
         release = [{"type": "btn", "data": {"down": False, "button": "left"}}]
-        rpc(s, {"execute": "input-send-event", "arguments": {"events": press}})
+        rpc(s, f, {"execute": "input-send-event", "arguments": {"events": press}})
         # Hold the press across several LVGL indev poll periods (33 ms each):
         # an instantaneous press+release lands inside one poll and no click
         # is ever registered.
         time.sleep(0.2)
-        rpc(s, {"execute": "input-send-event", "arguments": {"events": release}})
+        rpc(s, f, {"execute": "input-send-event", "arguments": {"events": release}})
     elif cmd == "quit":
         s.sendall(b'{"execute":"quit"}\n')
-    else:
-        sys.exit(f"unknown command {cmd}")
 
 
 if __name__ == "__main__":

qemu/tests/ui-shot.sh

@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 # Display + touch scenario: boot the VM headless with virtio-gpu, wait for the
-# LVGL UI (fbdev build) to start, screendump over QMP, inject an absolute
-# touch tap (virtio-tablet), screendump again. Asserts the first frame is
-# non-blank; reports (does not assert) whether the tap changed pixels — the
-# device-level analogue of flare-edge's Xvfb/xdotool sim-test.sh.
+# LVGL UI (fbdev build) to render a real frame, then inject an absolute touch
+# tap on the Metrics tab (virtio-tablet) and ASSERT the frame changed — the
+# device-level analogue of flare-edge's Xvfb/xdotool sim-test.sh. Readiness is
+# polled from screendumps on bounded deadlines, never guessed with fixed
+# sleeps: TCG renders CPU-bound and a loaded host can be arbitrarily slow.
 #
 # FAILS CLOSED on missing prerequisites.
 #
@@ -40,11 +41,30 @@ trap cleanup EXIT
 bash "$QDIR/mkinitramfs.sh"
 bash "$QDIR/mkimage.sh"
 
-PORT=$((21000 + RANDOM % 20000))
-bash "$QDIR/run.sh" --kernel "$ZIMAGE" --display headless --qmp "$WORK/qmp.sock" \
-  --ssh-port "$PORT" --http-port $((PORT + 1)) --api-port $((PORT + 2)) \
-  > "$WORK/console.log" 2>&1 &
-QEMU_PID=$!
+# Random hostfwd ports can collide — detect qemu's early bind failure and
+# retry with a fresh base rather than failing spuriously.
+for _attempt in 1 2 3; do
+  PORT=$((21000 + RANDOM % 20000))
+  : > "$WORK/console.log"
+  bash "$QDIR/run.sh" --kernel "$ZIMAGE" --display headless --qmp "$WORK/qmp.sock" \
+    --ssh-port "$PORT" --http-port $((PORT + 1)) --api-port $((PORT + 2)) \
+    > "$WORK/console.log" 2>&1 &
+  QEMU_PID=$!
+  sleep 3
+  kill -0 "$QEMU_PID" 2>/dev/null && break
+  if grep -aq 'Could not set up host forwarding' "$WORK/console.log"; then
+    echo "== hostfwd port collision on base $PORT — retrying"
+    QEMU_PID=""
+    continue
+  fi
+  echo "FATAL: VM died at launch:" >&2
+  tail -20 "$WORK/console.log" >&2
+  exit 1
+done
+if [ -z "$QEMU_PID" ] || ! kill -0 "$QEMU_PID" 2>/dev/null; then
+  echo "FATAL: could not launch the VM after 3 port attempts" >&2
+  exit 1
+fi
 
 deadline=$((SECONDS + 120))
 while [ $SECONDS -lt $deadline ]; do
@@ -57,36 +77,55 @@ grep -aq 'init: starting warden-ui' "$WORK/console.log" || {
   tail -25 "$WORK/console.log" >&2
   exit 1
 }
-sleep 8   # let LVGL render the first frames
 
 qmp() { python3 "$HERE/qmp.py" "$WORK/qmp.sock" "$@"; }
 
-qmp screendump "$WORK/shot1.ppm"
+# Frame is "real" once it has more than a handful of distinct colors (a blank
+# or console-only frame has very few).
+frame_rendered() { # $1 = ppm path
+  python3 - "$1" <<'EOF'
+import sys
+data = open(sys.argv[1], "rb").read()
+parts = data.split(b"\n", 3)               # P6 header: magic, dims, maxval, raw RGB
+pixels = parts[3] if len(parts) == 4 else b""
+distinct = len(set(pixels[i:i+3] for i in range(0, min(len(pixels), 3*720*720), 3)))
+print(f"{sys.argv[1]}: {len(pixels)} bytes, {distinct} distinct colors")
+sys.exit(0 if distinct > 16 else 1)
+EOF
+}
+
+# Poll for the first rendered frame (bounded, no guessed sleep).
+rendered=0
+deadline=$((SECONDS + 90))
+while [ $SECONDS -lt $deadline ]; do
+  qmp screendump "$WORK/shot1.ppm"
+  if frame_rendered "$WORK/shot1.ppm"; then rendered=1; break; fi
+  sleep 3
+done
+[ "$rendered" = 1 ] || {
+  echo "FATAL: UI never rendered a non-blank frame within 90s" >&2
+  exit 1
+}
+
 # Tap the "Metrics" tab: pixel (373,40) of 720x720 scaled to the QMP absolute
-# range 0..32767 — switching tabs must repaint the content area.
+# range 0..32767 — switching tabs must repaint the content area. Poll for the
+# repaint rather than guessing a delay.
 qmp tap 16975 1820
-sleep 3
-qmp screendump "$WORK/shot2.ppm"
+changed=0
+deadline=$((SECONDS + 30))
+while [ $SECONDS -lt $deadline ]; do
+  sleep 2
+  qmp screendump "$WORK/shot2.ppm"
+  if ! cmp -s "$WORK/shot1.ppm" "$WORK/shot2.ppm"; then changed=1; break; fi
+done
 
 mkdir -p "$OUTDIR"
 cp "$WORK/shot1.ppm" "$OUTDIR/ui-shot1.ppm"
-cp "$WORK/shot2.ppm" "$OUTDIR/ui-shot2.ppm"
+cp "$WORK/shot2.ppm" "$OUTDIR/ui-shot2.ppm" 2>/dev/null || true
 
-# Non-blank: more than one distinct pixel value in the raw PPM payload.
-python3 - "$WORK/shot1.ppm" <<'EOF'
-import sys
-data = open(sys.argv[1], "rb").read()
-# P6 header: magic, dims, maxval, then raw RGB
-parts = data.split(b"\n", 3)
-pixels = parts[3] if len(parts) == 4 else b""
-distinct = len(set(pixels[i:i+3] for i in range(0, min(len(pixels), 3*720*720), 3)))
-print(f"shot1: {len(pixels)} bytes of pixels, {distinct} distinct colors")
-sys.exit(0 if distinct > 1 else 1)
-EOF
-
-if cmp -s "$WORK/shot1.ppm" "$WORK/shot2.ppm"; then
-  echo "FATAL: tapping the Metrics tab did not change the frame — touch is not reaching the UI" >&2
+[ "$changed" = 1 ] || {
+  echo "FATAL: tapping the Metrics tab did not change the frame within 30s — touch is not reaching the UI" >&2
   exit 1
-fi
+}
 echo "tap on the Metrics tab repainted the frame (touch reached the UI)"
 echo "UI-SHOT-PASS (screenshots in $OUTDIR/ui-shot{1,2}.ppm)"