refactor(rust): dispose the whole-tree Rust audit corpus

bazel/checks/nix/defs.bzl

@@ -59,6 +59,11 @@ NIX_BIN=$(runfile "__NIX_KEY__")
 PYTHON_BIN=$(runfile "__PYTHON_KEY__")
 PEAK_RSS=$(runfile "__PEAK_KEY__")
 FLAKE_PATH=$(runfile "__FLAKE_KEY__")
+# The runfile can be a symlink into the Bazel output tree (runfiles tree
+# layout). Resolve it to the real workspace file so nix never receives a
+# path under bazel-out/, which its flake source rules refuse inside a git
+# repository.
+FLAKE_PATH=$(readlink -f -- "$FLAKE_PATH")
 ROOT=${FLAKE_PATH%/flake.nix}
 if [ "$ROOT" = "$FLAKE_PATH" ]; then
     ROOT=.

changelog.d/audit-review-remediation.md

@@ -0,0 +1,21 @@
+### Fixed
+
+- A mutating request that sets neither `dryRun` nor `apply` decodes again
+  instead of failing admission, so the daemon refuses it through the same
+  structured `InvalidRequest` outcome and remediation string every other
+  invalid mutating request gets, rather than an opaque frame error.
+- A persisted Azure VM recovery record whose legacy operation pair is only
+  half present now fails its decode with a typed error instead of aborting the
+  thread, and the restore documentation no longer promises a predicate that
+  the collapsed pair no longer needs.
+- The `StatusServicesOutputV2` wire shape is pinned again, including the
+  asymmetry where only `qemuMedia` is omitted when absent while the four
+  sidecar fields serialize an explicit `null`.
+
+### Changed
+
+- Two `shared-family-knowledge` ratchet exemptions that named tokens the
+  target module does not contain are removed; the list only ever shrinks.
+- Seven changelog fragments no longer open with a filename title line the
+  fragment parsers reject, and internal audit identifiers are out of the
+  release prose.

changelog.d/fix-forward-rendezvous-test-bound.md

@@ -0,0 +1,10 @@
+### Fixed
+
+- The forward-rendezvous concurrent-calls test no longer reads the
+  process-wide thread count, which parallel test load inflates while other
+  tests spin up their runtimes. It now counts the threads that executed its
+  own held calls, so it stays deterministic under load and still fails when a
+  per-call thread-ownership regression returns.
+- The forward-rendezvous test clients no longer fail when a refused call's
+  write races the server's refuse-and-close: the refusal is already queued
+  for the socket, so the reply is read instead of the write error.

changelog.d/fix-host-mutation-flag-refusal-order.md

@@ -0,0 +1,8 @@
+### Fixed
+
+- `d2b host prepare` and `d2b host destroy` without `--dry-run`/`--apply` are
+  refused with the documented `--apply-or-dry-run-required` envelope at exit 78
+  even when the public socket is unreachable. The missing-mode refusal is a
+  property of the invocation, so it is now emitted before the Zone is resolved
+  rather than after; previously the daemon reachability check ran first and the
+  same invocation reported `zone-unavailable` at exit 1.

changelog.d/fix-host-preflight.md

@@ -0,0 +1,32 @@
+### Fixed
+
+- The daemon's Process-family broker clients poll their calls for the family's
+  own declared per-call deadline instead of a hardcoded 10 seconds. The three
+  budgets in `ProductionProcessProviders::new_for_mode`
+  (`packages/d2bd/src/process_provider_runtime.rs`: the adoption observation
+  socket, `BrokerProcessBackend::with_socket_profile_and_role`, and
+  `BrokerSystemdEffectOwner::with_socket_and_role`) now derive from
+  `BROKER_IO_TIMEOUT`, which is the carrier's `DEFAULT_CONTEXT_DEADLINE_MS`
+  (25 s) - the same constant `DeadlineTier::Standard::budget_ms()` returns, so
+  no literal is restated. Polling shorter than the budget the call is served
+  under abandoned spawns the broker was still running, and an abandoned spawn
+  is not inert: the controller child the broker had already created stayed
+  live holding its runner registration, so every relaunch was refused as a
+  duplicate (`handler-refused`) and the Process wedged in `Pending` until the
+  `runtime-cloud-hypervisor-guest-preflight` host-integration wait expired.
+  The daemon now receives the broker's own verdict on those legs, ordered
+  under the launch ticket's deadline (30 s at the call sites), whose
+  late-launch path stops a process that outruns it.
+
+- The Guest lifecycle claim (`consume_lifecycle_lease`) reports an unanswered
+  broker as `StateUnavailable` rather than `EffectRejected`, and polls the
+  `consume-cell`/`complete-cell` rows under their declared
+  `DEFAULT_CONTEXT_DEADLINE_MS` (25 s, `LIFECYCLE_CELL_IO_TIMEOUT`) instead of
+  the legacy 10 s `KERNEL_IO_TIMEOUT`. A lost claim reply used to arrive as the
+  permanent spelling the Device Providers refuse to retry, so the TPM device
+  controller spun on `Effect(EffectRejected)` for the rest of the run (100 to
+  855 lines in the failing `device-worker-launch` runs against none in most
+  passing ones) and the one-shot `EphemeralProcess/swtpm-flush-tpm0` stayed
+  refused, making the fixture's flush-outcome wait unsatisfiable. The served
+  replay refusal still carries `EffectRejected`, so a genuinely spent claim
+  keeps its permanent classification.

changelog.d/fix-nix-flake-eval-check.md

@@ -0,0 +1,8 @@
+### Fixed
+
+- The Bazel flake-evaluation checks (`flake-eval-x86`, `flake-eval-aarch64`,
+  `flake-eval-x86-outputs`, and the `realized-*` variants) now resolve the
+  flake runfile to the real workspace path before handing it to nix, so the
+  checks pass when run directly with `bazel test` instead of only through the
+  Makefile wrappers. Previously the runfiles-tree layout placed the flake
+  under `bazel-out/`, where nix's git-tracking check rejected it as untracked.

changelog.d/fix-postw6-check-lane-clippy.md

@@ -0,0 +1,6 @@
+### Fixed
+
+- The volume-local binding derivation forwards its borrowed volume reference
+  to the binding-name hasher instead of re-borrowing it, so the crate builds
+  clean under the deny-warnings lint set. The emitted binding names, their
+  inputs, and every caller are unchanged.

changelog.d/fix-provider-artifact-signature.md

@@ -0,0 +1,29 @@
+### Fixed
+
+- The committed cloud hypervisor Provider artifact ships a signature that
+  verifies again. `packages/d2b-provider-guest-cloud-hypervisor/provider-manifest.json.sig`
+  was signed over an earlier manifest, so the commit that moved
+  `root-config.schema.json` and updated the manifest `configDigest` without
+  re-signing left the compiler refusing the artifact with
+  `provider-signature-verification-failed`. The publisher keypair is rotated:
+  `publisher-public-key.pem` now carries the new SPKI public key and
+  `provider-manifest.json.sig` is a fresh raw 64-byte Ed25519 signature over
+  the current manifest bytes. The manifest itself is byte-for-byte unchanged.
+  The previous private key is not recoverable, so the publisher key changes
+  rather than being re-derived; the operator holds the new private half
+  outside the repository. The new public key is the committed
+  `packages/d2b-provider-guest-cloud-hypervisor/publisher-public-key.pem`,
+  whose `sha256` over the DER `SubjectPublicKeyInfo` is
+  `d798fa9f94f64015d5711c0484b5b30cef1b6c9bb918cb46bf43338e0d817b57`.
+  Consumers that pinned the old publisher key must trust the new public key
+  before building a Zone that installs this artifact.
+
+### Added
+
+- A hermetic test in `packages/d2b-resource-compiler` loads the committed
+  manifest, signature sidecar, and publisher key and asserts the signature
+  verifies over the manifest, with a probe for each half moving alone. It runs
+  in the Layer-1 `make check` aggregate, so a future manifest or schema change
+  that forgets to re-sign fails the gate instead of shipping. The Nix build
+  only asserted that the sidecar was 64 bytes long, so nothing caught the
+  staleness before.

changelog.d/fix-usbip-clippy.md

@@ -0,0 +1,8 @@
+### Fixed
+
+- `d2b-broker`'s `W6UsbipOperation` variants no longer repeat the enum's
+  `Usbip` prefix, clearing `clippy::enum_variant_names` once the module is
+  no longer part of the crate's exported API; each variant keeps its exact
+  kebab-case wire label (`usbip-bind`, `usbip-unbind`,
+  `usbip-proxy-reconcile`) through an explicit `#[serde(rename = "...")]`,
+  so the audit discriminants are byte-identical.

changelog.d/fix-w5-crate-layout.md

@@ -0,0 +1,3 @@
+### Changed
+
+- Moved the validated USB busid type to `d2b_host::media::BusId`, beside the busid grammar validator it enforces, so broker media and firewall call sites build the validated value from the host media vocabulary instead of naming the `nftables` module; `d2b_host::nftables` now renders the validated value without owning the type.

changelog.d/fix-w5-flake-mirror.md

@@ -0,0 +1,11 @@
+### Fixed
+
+- Mirrored `d2b-resource-client` into the copied Guest workspace (`flake.nix`,
+  `tests/fixtures/guest-rust-workspace/Cargo.toml`, and
+  `packages/Cargo.guest.lock`) after
+  `d2b-provider-guest-cloud-hypervisor` gained a dependency on it; the
+  realized supply-chain lane resolves that workspace and failed on the absent
+  manifest, so the crate directory, its membership, and its lock entry are
+  restored.
+- Regenerated the package policy inputs so the `guest-static` contexts carry
+  the refreshed `packages/Cargo.guest.lock` digest.

changelog.d/fix-wave3-gate-breaks.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- A cross-slice merge left the workspace gate red: the status-size single-pass change dropped the last non-test use of `canonical_json_bytes` in the v3 resource status contract while its import stayed at module scope, the telemetry meter registry kept a module-scope import used only by tests, the test-support runner-intent rebuild hook still read the pre-merge flat guest intent map after the resolver nested it per zone, the CLI receive-buffer slice added a `std::sync::Mutex` critical section without the sanctioned CLI-only allow its sibling sites carry (tripping the blocking census), the nftables/hosts renderers wrote trailing-newline format strings with `write!` where the newline form trips the clippy gate, the clipboard controller's route-shape validators and their tests exceeded the clippy argument and type-complexity limits, and the merged `Cargo.lock` and the async-gate inventory were never regenerated after the parallel remediation slices changed dependencies and marker sites, leaving the policy-input closures and the inventory stale. The imports now live at their test-module use sites, the hook iterates the nested map, the receive-buffer lock carries the per-site allow, the renderers use `writeln!`, the route-shape checks take a plain-field shape struct, and the lock, policy inputs, and async-gate inventory are regenerated, so `cargo check --workspace --all-targets`, the blocking census, the policy-input check, the async-gate check, the clippy gate, and the Layer-1 gate lanes are green again.