Deploy the recovery-states shell build, 2026-10-11

This is the deployment for OpenSpec change the-rust-shell-explains-stale-denied-and-ended-states. It precedes task 3.1’s real-finger capture.

• Worktree: /home/jadams/tmp/k230-recovery-deploy-2026-10-11
• Branch: deploy/recovery-states-2026-10-11
• Source revision: 30b3834b45e888ae27a55f4401d8f883f81e890c (master)
• Owned paths: this directory

The board/serial lock (/tmp/k230-board.lock) protected each board action. The build ran under /tmp/k230-nix-build.lock. Times are UTC.

The operator was present at the board and said: “run the new build or whatever it’s fine yeah go i’m here”. This record claims no finger observation.

Build (host)

flock -n /tmp/k230-nix-build.lock nix build .#kernelMainlineDrmShellBootFiles --out-link ~/.local/state/tdisplay-k230/retained-builds/recovery-states-2026-10-11/candidate --print-out-paths --max-jobs 1 --cores 4 passed. See build-tail.log.

• Image and initrd.uimg are byte-identical to the baseline.
• The out-link is the GC root for the bundle.
• No input-retention farm was built this time. Unchanged inputs remain covered by the theme deployment’s retained farm. New inputs are not retained beyond the bundle’s own closure.

Board sequence

1. Preflight (read-only). preflight-used.py matched the baseline system, profile, kernel, Rust/Sway executables and all eight normal boot hashes, with four services active. The first attempt got no console bytes. A direct serial probe then showed the root prompt and the retry passed on boot 6371650b-… (preflight-before-power-cycle.json).
2. Stage. stage-used.py delivered the 33-path closure delta over the board’s Wi-Fi. Attempts 1–3 changed nothing persistent:
   • Attempt 1: curl exit 7, because the private transfer address was stale after a host DHCP change. The private file was updated.
   • Attempt 2: curl exit 28, because the 188 MB uncompressed NAR exceeded the 300 s limit at about 90 KB/s. The delta is now xz-compressed and the limit raised to 3600 s.
   • Attempt 3: interrupted at 19:45:47Z when the board’s console USB was unplugged. The board lost power, and the host kernel log shows a different USB device briefly on that port. The board autobooted the unchanged baseline. preflight.json re-verified it on boot ee934583-….
   • Attempt 4 passed: stage.log, transfer.json, staged-state.json, host-inspection.json.
3. Temporary boot. tools/coherent-shell-board-boot.py --candidate … --state … --output … passed; see candidate-boot.json and its log. runtime-check-used.py with inspect-runtime.py produced candidate-runtime.json: PASS on boot e3cf0c3c-…, exact new system and Rust ELF, four active services, and unchanged normal boot files.
4. Qualification. qualification-used.py wrote and board-validated deployment-authorization.json. Its class is operator-authorized-userspace-update: same kernel and initrd, and no finger checks claimed.
5. Install and ordinary autoboot. … --qualification deployment-authorization.json --install passed; see ordinary-boot.json and its log. ordinary-runtime.json is PASS on a new boot 44fb9940-…:
   • current system and normal profile are both hamn9j9y…;
   • the new Rust ELF is running and four services are active;
   • rollback roots are valid.

Limits

This record proves that the build was installed and boots normally. It does not prove that any recovery state renders correctly on glass. That is task 3.1’s real-finger capture, recorded separately under docs/evidence/recovery-routes/. Raw UART logs stay private on the host.