review: iteration-2 fixes (fail-closed loader whole-name match + doc accuracy)

Second recursive pass: two adversarial re-reviewers verified the iteration-1 fixes.
Fuzz/empirical checks cleared the freshness min-budget rewrite (200k random trials),
the config-lint reg-token scanner, its UTF-8 boundary safety, and the build-kernel.sh
trap (5 exit scenarios) — no defects. Three items corrected here:

- config-lint is_known_safe_loader: match the WHOLE normalized loader name, not an
  unanchored substring. The iteration-1 allowlist swap kept `contains()`, so a future
  coprocessor whose name merely contained a boot word ("AudioLoader" ⊃ "loader",
  "SplRtos" ⊃ "spl", "Bl32" ≠ "bl31") would have been waved through — reopening the
  0x40000-brick false-negative the fail-closed change exists to prevent. Regression
  test added with those exact adversarial names.
- docs/architecture.md §3: the `cru` bullet no longer claims flared's devmem `Bus`
  seam is shipped — it lands when flare-edge consumes warden-sdk ([maintainer]-gated), which
  is what §7 item 3 already said. Resolves an in-document contradiction.
- drivers/README.md: modbus "11 pty scenarios" -> "8 pty scenarios + 3 wire/daemon
  checks (11 total)", matching flare-edge tools/modbus-sim's actual SCENARIOS list.
- docs/decisions/0002-mcdc-tiering.md: Consequences now describe the shared
  drivers/enforce-mcdc.sh + drivers/<name>/test/ layout actually built (not the
  per-driver dirs the ADR first anticipated); Rust MC/DC tooling reality noted.

config-lint: 9 tests pass; clippy clean under -D warnings; gitleaks clean. C drivers
untouched (still relays 40/40, freshness 66/66 MC/DC).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

docs/architecture.md

@@ -63,8 +63,10 @@ supervisor logic runs in CI with no panel.
 - **`cru` — reset ladder.** Done. `CruSim` on `MemBus` (so `flared::devmem::hard_reset`'s
   ladder is host-tested against the known glb_srst_fst / DW-watchdog registers), plus
   the boot-mode register's survives-warm-reset / cleared-by-POR behaviour (the MaskRom
-  recovery maneuver). flared's `devmem` now has a matching `Bus` seam and unit tests
-  that assert the shipped ladder pokes the confirmed offset, never the wrong-SoC one.
+  recovery maneuver). The matching firmware-side `Bus` seam on flared's `devmem` — so
+  the shipped ladder can be asserted to poke the confirmed offset, never the wrong-SoC
+  one — lands when flare-edge consumes warden-sdk (§7 item 3, [maintainer]-gated), not yet on
+  flare-edge `main`.
 - **`modbus` — RS-485 device end.** Done. `ModbusSlave`: a byte-in/byte-out RTU slave
   (CRC16 byte-identical to the master, FC 0x01–0x06/0x0F/0x10/0x11, exception replies,
   and fault injection — silent-drop and forced-NAK) so `warden-modbus`'s master can be

docs/decisions/0002-mcdc-tiering.md

@@ -14,8 +14,10 @@ A **two-tier** policy, measured against the Hardware Abstraction Seam:
 - **Tier 1 — our own hardware-facing code → real 100% MC/DC.** `modbus_engine.c`,
   `relays.c`, `warden_rga.c` (wrapper), `hpmcu.rs`, `devmem.rs`, `freshness.c`, plus
   the two smallest near-mainline drivers where feasible. Enforced in CI
-  (`gcc-14 -fcondition-coverage` + `gcov-14 --conditions`; `cargo-llvm-cov --mcdc`
-  for Rust).
+  (`gcc-14 -fcondition-coverage` + `gcov-14 --conditions`). Rust uses
+  `cargo-llvm-cov` line/region coverage for now — true `--mcdc` needs a nightly
+  toolchain (`-Z coverage-options=condition`) and is deferred on that tooling skew;
+  the C drivers carry the literal MC/DC gate.
 - **Tier 2 — ported/vendor drivers → fault-injection + branch coverage + benchmarks**
   against the simulator, behind a stable seam. Explicitly NOT literal MC/DC.
 
@@ -24,5 +26,8 @@ A **two-tier** policy, measured against the Hardware Abstraction Seam:
   rest, a very serious testing and benchmarking system."
 - The seam is the shared object: the same thing MC/DC is measured against and the
   simulator implements — the two goals reinforce, not duplicate.
-- Every Tier-1 file gets a `drivers/<name>-mcdc/` host harness with an
-  `enforce-mcdc.sh` that fails CI below 100%.
+- Every Tier-1 file gets a `drivers/<name>/test/` host harness (a `Makefile` +
+  `test_<name>.c`) that calls the one shared `drivers/enforce-mcdc.sh` — which derives
+  the driver name from the `.gcov` file, so there is a single gate to maintain, not a
+  per-driver copy. The CI `mcdc` job auto-discovers any `drivers/*/test/Makefile` and
+  fails below 100%.