v2.5.81 - engine upgrade

v2.5.81 (2026-09-15)

Five defects from the 2026-09-14 laptop diagnostics and the September lab runs, each
implemented and unit-tested in an isolated worktree and merged on 2026-09-15.

Fixed

• A laptop sleeping mid-phase no longer has its healthy provider killed on wake. Provider
  timeouts measured elapsed time with the wall clock, so a suspend counted against the idle
  and hard limits; on 2026-09-13/14 one laptop saw four "hard timeout" kills 1-2 s after wake,
  each preceded by a 50-158 minute heartbeat gap. A poll-to-poll gap far beyond the cadence is
  now treated as suspension and walked out of both clocks, logged once as "System was
  suspended for N min during ; not charged to the timeout." (-xglj).
• Boot identity alone no longer declares a new boot when the monotonic reading says the
  same boot. The same laptop twice logged "new Windows boot session (identity)" within
  two minutes of the previous pass, resetting the same-boot retry budget each time. When a
  prior and current monotonic reading both exist and agree, an identity move is logged as
  clock jitter with both deltas; legacy state without a monotonic reading behaves as before.
  The observation line now carries Δidentity and Δmonotonic in seconds (-vhcm).
• A portable package Winget refuses to replace because it was modified is deferred
  inventory, not a terminal failure. "Unable to remove Portable package as it has been
  modified" stopped a cycle for manual attention twice in one afternoon. It is now recorded
  as PortableModified with the override command, does not enter the failure signature, and
  the cycle converges qualified. An empty machine-scope inventory ("No installed package
  found matching input criteria") after a user-scope success is no longer read as
  unparseable (-qjkh).
• A trusted per-phase hook is no longer rejected because BUILTIN\Users can read the trust
  root. The write mask OR-ed composite rights that include read bits; it now tests the
  specific mutation rights only, with real-ACL tests for read-only and writable broad grants
  (-egwn).
• A pass that dies during final verification after the cohort is now charged and named.
  The state carries a FinalVerification intent after CohortDone, so a crash there counts
  as an unobserved stop, re-runs only the final checks, and leaves provider flags and the
  reboot budget untouched (-z72k).

Added

• upd bootstrap now upgrades an already-installed PowerShell 7 to the latest stable
  release, not just verifies it exists. Machines without Winget — Windows Server 2016
  chief among them — had no path to a newer engine short of a manual MSI. upd bootstrap
  compares the running pwsh.exe against the latest non-prerelease GitHub release, upgrades
  through Winget when present or the same signed-MSI route the fresh install already uses
  otherwise, and never downgrades. An unreachable GitHub API is a warning, not a failure:
  bootstrap still exits 0 so the launcher keeps working offline.
  The upgrade itself runs detached from the launcher, under Windows PowerShell 5.1 in a hidden
  host that logs to %TEMP%\boot-upd-pwsh-upgrade.log, because the installer closes every
  running pwsh.exe, the launcher's own included. The first attempt hosted the MSI inside the
  launcher and lost the source package mid-transaction when Restart Manager's shutdown unwound
  a finally that cleaned the temp directory; the installer then failed with 1316/1603 and
  left the guest with no pwsh.exe. The package is now removed only after a successful exit
  code, and Restart Manager is kept out of the install (MSIRESTARTMANAGERCONTROL=Disable).
  Verified on lab-b (no Winget): upd bootstrap took 7.6.5 to 7.6.6, MSI event 11707
  "Installation completed successfully", pwsh -v 7.6.6 afterwards.

Validation

Unit/process behavior:       PASS     (537 tests, 0 failed)
User/SYSTEM boundary:        PASS
Published launcher upgrade:  PASS     (from v2.5.43)
Live bootstrap:              NOT RUN  (README one-liner on a hosted VM)
PowerShell 7 engine upgrade: PASS     (lab-b, no Winget, 7.6.5 -> 7.6.6; see below)
Provider integration:        NOT RUN
Multi-reboot convergence:    PARTIAL  (A PASS, B PARTIAL, F PASS; watchdog rows NOT RUN)
Release assets:              PASS     (20 assets with SHA256 sidecars)

Gates were run from an elevated PowerShell 7 console on 2026-09-15 against the final tree, and the three rows below ran against the same tree.
The unit suite's six trusted-file ACL tests run only from an elevated console; from a
non-elevated one they skip and the count is lower.

• PowerShell 7 engine upgrade - lab-b, no Winget, PowerShell 7.6.5 installed. PASS.
  upd bootstrap reported 7.6.5 behind 7.6.6, handed off, and the detached host upgraded it:
  MSI event 11707 "Installation completed successfully", pwsh -v 7.6.6, no restart needed.
  Manual check, not a harness row; the harness has no row shape for it yet.

• Watchdog rows (kill-and-resume, short-interval no-double-run): NOT RUN on this
  build. They ran on 2026-09-12 for v2.5.80 and nothing in this release touches the trigger
  or the probe.

• Row A - interactive user, three armed reboots, lab-a. PASS.
  A-v2581-release-boot-upd-matrix-20260915-143619. Four passes, converged in 11.8 minutes
  with 2 verified updates, RebootsClaimed 3 = RebootsObservedOS 3, no state file, no
  continuation tasks, no pending CBS. Two of the three boots fell inside the 120-second
  identity window and were caught by the monotonic signal; the observation line shows both
  deltas ("identity delta=108s, monotonic delta=107s"). No jitter suppression fired, as
  expected on a guest that does not suspend.

• Row B - headless, SYSTEM fallback, one armed reboot, lab-b. PARTIAL.
  B-v2581-final-lab-b-20260915-134435. Five passes, converged in 31.2 minutes with a
  qualified claim (user-scope work deferred after two rediscovery attempts, one re-offered
  Windows Update), RebootsClaimed 2 = RebootsObservedOS 2, no state file, no continuation
  tasks. PARTIAL rather than PASS because the harness read the CBS RebootPending key at
  collection after the updater's own two-probe settle was clean; on 2026-09-12 the same
  post-completion reading was traced to Windows' own update agent staging a package, but that
  was not re-established for this run.

• Row F - PowerShell 5.1-only bootstrap through upd.cmd, lab-b. PASS.
  F-v2581-final-lab-b-20260915-142045. The launcher installed PowerShell 7.6.6 from the
  signed MSI through the refactored install function and the cycle converged in one pass
  with a cleanup advisory, no state file, no continuation tasks, no pending CBS.

Not run for this release: row D (failed restart command) and the hosted-VM live bootstrap.
Treat them as NOT RUN.