fwmanager: Pin the orchestrator seams in the docs

Three facts reviewers keep having to reconstruct: checkpoint timeouts
are table data the walk consumes — the clockless state machine never
sees a duration, a component's boot timeout is just its walk over the
windows; the device table is the authority the chain is built from;
and Complete maps to ComponentReady or Booted by component kind, in
the shell.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Christina Quast <christina.quast@9elements.com>

Author: chrysh

services/fwmanager/api/src/boot_watch.rs

@@ -39,7 +39,10 @@ pub enum WalkVerdict {
         /// When the awaited checkpoint's window expires.
         deadline_millis: u64,
     },
-    /// Every checkpoint passed — the device is up.
+    /// Every checkpoint passed — the device is up. Which state-machine
+    /// event this becomes is the shell's mapping, by component kind:
+    /// `ComponentReady` for an iRoT-backed device, `Booted` for a
+    /// symbiont.
     Complete,
     /// This boot attempt failed at `checkpoint`; the walk is over.
     /// Whether to try again, recover, or give up is the orchestrator's

services/fwmanager/api/src/config.rs

@@ -26,8 +26,13 @@ pub struct BootCheckpoint<G> {
     /// function, so the table stays pure data — the type-level docs say
     /// why.
     pub signal: G,
-    /// Window for one attempt at this checkpoint. Expiry is the
-    /// orchestrator's own judgment; hung devices report nothing.
+    /// Window for one attempt at this checkpoint. Expiry is the boot
+    /// walk's own judgment; hung devices report nothing.
+    ///
+    /// The orchestrator state machine never sees this value — it is
+    /// clockless. The walk consumes the windows and reports expiry as a
+    /// failed attempt; a component's whole boot timeout is nothing more
+    /// than its walk over these windows, in order.
     pub timeout: core::time::Duration,
 }
 

target/mock/devices.rs

@@ -25,7 +25,8 @@ pub enum MockSignal {
 }
 
 /// Declaration order is the boot order: the orchestrator releases devices
-/// top to bottom, one at a time.
+/// top to bottom, one at a time. This table is the authority — the
+/// orchestrator's chain of trust is built from it, never beside it.
 ///
 /// The mock board's reset controller addresses reset lines by plain index,
 /// so the reset id type is `u8`.