Alpha.12 verified ext4 repair escalation

[Deadbytes101]

Purpose

Fix the Alpha.11 physical failure tracked by #27 without weakening the USB-only state authority.

Alpha.11 correctly detected the interrupted resize and entered bounded recovery, but e2fsck -f -p exited 4 with an unexpected inconsistency. State therefore remained repair_required, /var/lib/rigos stayed on the live overlay, the recovery password remained boot-scoped, SSH used an ephemeral host key, and profile/miner stayed blocked.

Changes

• advance the next immutable artifact to 0.0.4-alpha.12
• retain the current-boot boot-device attestation, exact PARTUUID, ext4 label, and unmounted-device checks
• run preen first with e2fsck -f -p
• only when preen exits exactly 4, revalidate the exact state device and escalate to bounded e2fsck -f -y
• never escalate timeout, operational, usage, cancelled, or library failures
• revalidate the exact state device again after repair and before resize2fs
• keep each filesystem command bounded to 300 seconds
• expand the state service's total bounded startup window to 20 minutes
• rerun the normal state core after successful repair/resize
• preserve truthful repair_required status on any unrecovered failure
• preserve boot-scoped credentials and ephemeral SSH until state is genuinely ready
• add behavioral source tests and exact-image assertions for the escalation and safety boundaries

Safety boundary

No internal disk targeting is added. Automatic repair is reachable only for the current boot-attested USB state PARTUUID, only when it is an unmounted ext4 filesystem with the expected RIGOS state label, and only for the specific e2fsck exit-4 condition observed physically.

Stacked relationship

This draft is based on fix/alpha11-state-recovery-persistence. It must remain unmerged until exact-head source verification, Alpha.12 exact-image verification, physical state recovery, persistent password restoration across reboot, persistent SSH identity, configuration activation, and miner startup all pass.

[Deadbytes101]

Implementation is now at exact head 55dfd228c41177893bf9be4ae6f1d285ac4a11c9.

Physical Alpha.11 evidence driving this patch:

• state outcome: repair_required
• exact failure: post-timeout ext4 check failed: e2fsck: exit 4: ... UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY.
• /var/lib/rigos remained the live overlay
• recovery credential correctly remained boot-scoped and non-persistent
• SSH correctly remained ephemeral
• profile and miner correctly remained blocked

Alpha.12 implementation:

• exact current-boot USB state attestation and unmounted ext4 identity remain mandatory
• core-generated e2fsck: exit 4 is routed into the verified repair path
• preen runs first
• only exact exit 4 escalates to bounded e2fsck -f -y
• the state device is revalidated before escalation, after repair, and before resize
• operational/usage/cancelled/library failures do not escalate
• filesystem commands remain bounded to 300 seconds
• state service total window is bounded at 20 minutes
• artifact version advanced to 0.0.4-alpha.12
• source behavioral and exact-image contract tests updated

Source gate and image build have not run yet. Keep this PR draft and unmerged.

[Deadbytes101]

Alpha.12 exact-head source verification passed locally at 5af491daed09dff4b5f90244f4fee718edd5ade2 with a clean worktree.

Observed evidence:

• diagnostic SSH persistent/ephemeral authority tests passed
• Alpha.12 firstboot image-gate source assertions passed
• verified ext4 recovery tests passed, including escalation only for e2fsck exit 4
• workspace tests and doc tests passed
• systemd ordering verification passed
• RIGOS verification passed
• RIGOS firstboot theme wrapper verification passed
• final marker: RIGOS_WSL_SOURCE_GATE=PASS

This is source evidence only. Keep PR #28 draft and unmerged pending Alpha.12 exact-image construction and physical validation of state recovery, password restoration across reboot, persistent SSH identity, configuration activation, and miner startup.

[Deadbytes101]

Alpha.12 exact image verification is now PASS at exact head 5af491daed09dff4b5f90244f4fee718edd5ade2.

Artifact:

• dist/usb/rigos-usb-amd64-0.0.4-alpha.12.img
• SHA-256: e4cc44215c70cba7b3d7a9c5916256992c40161e110314a657c1856d9d1a3a16

Verified gates:

• exact head and clean worktree
• USB appliance image
• RandomX performance image
• authenticated XMRig observer image
• firstboot exact-image
• state recovery and credential exact-image
• checksum
• manifest source commit
• manifest image version
• manifest artifact hash

Final marker: ALPHA12_EXACT_IMAGE_BUILD=PASS with clean exit status.

Keep this PR draft and unmerged until physical ext4 repair, persistent state mount, password restoration across reboot, persistent SSH identity, configuration activation, and miner startup pass.