review: iteration-2 fixes (fail-closed loader whole-name match + doc accuracy)

Second recursive pass: two adversarial re-reviewers verified the iteration-1 fixes.
Fuzz/empirical checks cleared the freshness min-budget rewrite (200k random trials),
the config-lint reg-token scanner, its UTF-8 boundary safety, and the build-kernel.sh
trap (5 exit scenarios) — no defects. Three items corrected here:

- config-lint is_known_safe_loader: match the WHOLE normalized loader name, not an
  unanchored substring. The iteration-1 allowlist swap kept `contains()`, so a future
  coprocessor whose name merely contained a boot word ("AudioLoader" ⊃ "loader",
  "SplRtos" ⊃ "spl", "Bl32" ≠ "bl31") would have been waved through — reopening the
  0x40000-brick false-negative the fail-closed change exists to prevent. Regression
  test added with those exact adversarial names.
- docs/architecture.md §3: the `cru` bullet no longer claims flared's devmem `Bus`
  seam is shipped — it lands when flare-edge consumes warden-sdk ([maintainer]-gated), which
  is what §7 item 3 already said. Resolves an in-document contradiction.
- drivers/README.md: modbus "11 pty scenarios" -> "8 pty scenarios + 3 wire/daemon
  checks (11 total)", matching flare-edge tools/modbus-sim's actual SCENARIOS list.
- docs/decisions/0002-mcdc-tiering.md: Consequences now describe the shared
  drivers/enforce-mcdc.sh + drivers/<name>/test/ layout actually built (not the
  per-driver dirs the ADR first anticipated); Rust MC/DC tooling reality noted.

config-lint: 9 tests pass; clippy clean under -D warnings; gitleaks clean. C drivers
untouched (still relays 40/40, freshness 66/66 MC/DC).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

tools/config-lint/src/lib.rs

@@ -54,7 +54,7 @@ fn parse_addr(s: &str) -> Option<u64> {
     }
 }
 
-/// Loaders that are part of the normal RK boot chain — DDR init, SPL/loader, the
+/// Loaders that are part of the normal RK boot chain — DDR init, SPL/miniloader, the
 /// secure monitor, U-Boot — and are NOT boot-loaded coprocessor firmware, so their
 /// LOAD_ADDR (if any) is the vendor boot flow, not a DRAM carve-out that must be
 /// reserved. Anything NOT on this allowlist that declares a LOAD_ADDR is treated as
@@ -62,17 +62,33 @@ fn parse_addr(s: &str) -> Option<u64> {
 /// "Rtos"/"Bl32"/"M0" must not slip through an MCU-*name* allowlist the way the
 /// original `hpmcu`/`mcu`/`amp` substring test would have — that is exactly the
 /// c8a3 0x40000-brick class this tool exists to catch.
+///
+/// Matched as a WHOLE normalized name (separators stripped), never a substring, so a
+/// coprocessor whose vendor name merely *contains* a boot-chain word — "AudioLoader"
+/// ⊃ "loader", "SplRtos" ⊃ "spl", "Bl32" (≠ "bl31") — is still checked, not waved
+/// through. Over-inclusion here would only over-report (the safe direction); a missed
+/// coprocessor is the dangerous one.
 fn is_known_safe_loader(name: &str) -> bool {
-    let n = name.to_ascii_lowercase();
+    let n: String = name
+        .chars()
+        .filter(|c| c.is_ascii_alphanumeric())
+        .map(|c| c.to_ascii_lowercase())
+        .collect();
     const SAFE: &[&str] = &[
         "flashdata",
         "flashboot",
+        "nandboot",
+        "nandboot1",
+        "nandboot2",
+        "sdboot",
+        "emmcboot",
+        "spinorboot",
         "ddr",
         "usbplug",
         "spl",
         "uboot",
-        "u-boot",
         "loader",
+        "miniloader",
         "trust",
         "tee",
         "atf",
@@ -80,7 +96,7 @@ fn is_known_safe_loader(name: &str) -> bool {
         "fsbl",
         "idblock",
     ];
-    SAFE.iter().any(|s| n.contains(s))
+    SAFE.contains(&n.as_str())
 }
 
 /// Extract MCU firmware loads from an rkbin loader `.ini`: for each `LOADERn=<name>`
@@ -360,4 +376,37 @@ LOAD_ADDR=0x40000
         // and it's caught when no reserved-memory node covers it:
         assert_eq!(check(&loads, &parse_reserved_ranges(DT_NO_RTOS)).len(), 1);
     }
+
+    // Coprocessor names that merely *contain* a safe boot-chain word, each with a
+    // LOAD_ADDR: "AudioLoader" ⊃ "loader", "SplRtos" ⊃ "spl", "Bl32" (≠ "bl31").
+    const SUBSTRING_TRAP_INI: &str = r#"
+[LOADER_OPTION]
+NUM=4
+LOADER1=FlashData
+LOADER2=AudioLoader
+LOADER3=SplRtos
+LOADER4=Bl32
+FlashData=bin/ddr.bin
+AudioLoader=bin/audio.bin
+SplRtos=bin/rtos.bin
+Bl32=bin/bl32.bin
+[LOADER2_PARAM]
+LOAD_ADDR=0x50000
+[LOADER3_PARAM]
+LOAD_ADDR=0x60000
+[LOADER4_PARAM]
+LOAD_ADDR=0x70000
+"#;
+
+    /// Regression (2nd-pass correctness review): the safe allowlist matches a WHOLE
+    /// normalized name, never a substring — a coprocessor whose name contains a
+    /// boot-chain word must NOT be waved through. FlashData (a real boot component,
+    /// no LOAD_ADDR here) stays safe; the three coprocessors are all checked.
+    #[test]
+    fn safe_loader_is_whole_name_not_substring() {
+        let loads = parse_ini_mcu_loads(SUBSTRING_TRAP_INI);
+        let mut addrs: Vec<u64> = loads.iter().map(|l| l.load_addr).collect();
+        addrs.sort();
+        assert_eq!(addrs, vec![0x50000, 0x60000, 0x70000], "loads: {loads:?}");
+    }
 }