docs: record verified 4258 ms cold boot after refresh fix

docs/roadmap.md

@@ -15,15 +15,13 @@ baseline): SD storage, save, and **git publish are all wired into the app binary
 and hardware-verified** (`:sync` commits on the SD `/sd/repo` and pushes to a
 test repo), and the **boot splash (Spike 9) is confirmed on the panel** — a
 vector `typoena`-in-a-circle shown at startup while the SD mounts, then the
-editor comes up. **Cold boot measured ~5.5 s** (power-on → cursor, instrumented
-2026-07-11 — the 3.5 s eyeball undercounted; `esp_timer` sees only the ~4.1 s
-app-side slice, missing the bootloader + ~0.74 s PSRAM memtest). **Over the ≤ 5 s
-gate**; **fix implemented 2026-07-11** — the first editor render is now a
-full-area partial (~630 ms) rather than a second full refresh (~1.9 s), expected
-~4.2 s, pending a reflash to re-measure + check ghosting (PSRAM memtest kept on).
-The 1-hour soak is attested from real use; boot time joins the
-remaining post-ship acceptance checks (power-pull recovery, 1000-word no-drop,
-and `Ctrl-G`'s not-yet-built pull-then-retry → v0.9). Beyond v0.1, v0.2 navigation, **v0.2.5 international input (hardware-verified
+editor comes up. **Cold boot verified at 4258 ms** (power-on → cursor,
+2026-07-11; 742 ms under the ≤ 5 s gate). It first measured ~5.5 s; the fix was
+to bring the editor up with a full-area partial (~630 ms) instead of a second
+full refresh (~1.9 s) — panel confirmed clean, no ghosting. The 1-hour soak is
+attested from real use; the remaining post-ship acceptance checks are power-pull
+recovery, 1000-word no-drop, and `Ctrl-G`'s not-yet-built pull-then-retry
+(→ v0.9). Beyond v0.1, v0.2 navigation, **v0.2.5 international input (hardware-verified
 2026-07-11)**, and most of v0.6 Markdown already run. Version numbers are
 unchanged — they track shippable device releases, not core progress.
 
@@ -127,14 +125,13 @@ per ADR-012); **git publish is wired** (`:sync` → commit + fast-forward push o
 the SD `/sd/repo`, hardware-verified against a test repo); and the **boot splash
 (Spike 9) is confirmed on the panel** — [`Frame::splash`](../display/src/lib.rs)
 shows a vector `typoena`-in-a-circle at startup while the SD mounts, then the
-editor comes up. Cold boot measured ~5.5 s (power-on → cursor, 2026-07-11) — **over the ≤ 5 s
-gate**: the 3.5 s eyeball undercounted, and `esp_timer` catches only the ~4.1 s
-app-side slice (it starts after the bootloader + the ~0.74 s PSRAM memtest). Fix
-implemented 2026-07-11: first editor render is now a full-area partial (~4.2 s
-expected, pending a reflash to verify); PSRAM memtest kept on. The 1-hour soak
-is attested from real use; boot time joins the remaining post-ship acceptance
-checks (power-pull recovery, 1000-word no-drop, `Ctrl-G` pull-then-retry → v0.9) —
-see [product → acceptance](v0.1-mvp-product.md#acceptance-criteria).
+editor comes up. Cold boot **verified at 4258 ms** (power-on → cursor, 2026-07-11; 742 ms under
+the ≤ 5 s gate). It first measured ~5.5 s; the fix was to bring the editor up
+with a full-area partial (~630 ms) instead of a second full refresh (~1.9 s) —
+panel confirmed clean. The 1-hour soak is attested from real use; the remaining
+post-ship acceptance checks are power-pull recovery, 1000-word no-drop, and
+`Ctrl-G` pull-then-retry (→ v0.9) — see
+[product → acceptance](v0.1-mvp-product.md#acceptance-criteria).
 
 - [x] ESP32-S3 boots (✓); e-ink shows Typoena splash (✓ Spike 9, confirmed on
       panel 2026-07-11); boot status surfaces via the panel snackbar (no serial on device)
@@ -374,7 +371,9 @@ engine remain (snippets are net-new scope, added 2026-07-08).
 
 ## v1.0 — Polish — [ ]
 
-- [ ] Boot time ≤ 3 s to usable cursor
+- [ ] Boot time ≤ 3 s to usable cursor — currently ~4.26 s; the ~1.9 s cold-boot
+      full refresh is a hard e-ink floor, so ≤ 3 s is marginal (see
+      [`notes/boot-time-budget.md`](notes/boot-time-budget.md))
 - [ ] Font selection (at least one serif + one mono) with adjustable font
       size, switchable at runtime and persisted across reboots
 - [ ] Theme: light / dark (inverted e-ink), switchable at runtime and

docs/v0.1-mvp-product.md

@@ -207,23 +207,21 @@ place to check before declaring an item done.
 
 > **Status 2026-07-11:** v0.1 was declared **delivered**, with acceptance
 > criteria run as **post-ship hardening**. The 1-hour soak is attested from
-> sustained real use (below). Two criteria are known **not** to pass yet, tracked
-> as follow-ups rather than silent passes: cold boot measured **~5.5 s**
-> (instrumented 2026-07-11, over the 5 s gate — fix identified below), and
-> `Ctrl-G`'s pull-then-retry path is **not yet implemented** (deferred to v0.9).
+> sustained real use, and cold boot is now **verified at 4258 ms** (under the 5 s
+> gate, after a boot-refresh fix — see below). One criterion remains known **not**
+> to pass: `Ctrl-G`'s pull-then-retry path is **not yet implemented** (deferred
+> to v0.9).
 
-- [ ] After a cold boot with valid pre-flashed config, cursor is ready in ≤ 5 s.
-      — **MEASURED 2026-07-11: ~5.5 s power-on → cursor**, over the gate (the
-      `boot: cursor ready` log prefix, 5508 ms, from `esp_log_timestamp` ≈ since
-      power-on; the 4091 ms my first instrument printed was only the app-side
-      slice — `esp_timer` doesn't start until ~1.4 s in, after the 2nd-stage
-      bootloader + the ~0.74 s PSRAM memtest, so it excludes them). **Fix
-      implemented 2026-07-11** (pending a reflash to re-measure + confirm no
-      ghosting): the first editor render is now a full-area partial (~630 ms)
-      instead of a second full refresh (~1.9 s), which should bring boot to
-      ~4.2 s. The two boot full refreshes (~3.9 s) were the structural cost; the
-      PSRAM memtest (~0.74 s, left on — a real HW sanity check on a hand-wired
-      board) is a further lever, and both feed the v1.0 ≤ 3 s target.
+- [x] After a cold boot with valid pre-flashed config, cursor is ready in ≤ 5 s.
+      — **VERIFIED 2026-07-11: 4258 ms power-on → cursor** (`boot: cursor ready`
+      log prefix; 742 ms under the gate). First measured ~5.5 s (over the gate);
+      the fix was to bring the editor up with a full-area partial (~630 ms) instead
+      of a second full refresh (~1.9 s) — panel confirmed clean, no splash
+      ghosting. (Instrument note: `esp_timer_get_time` reads only the ~2.85 s
+      app-side slice — it starts ~1.4 s in, after the bootloader + the ~0.74 s
+      PSRAM memtest; the log prefix / `esp_log_timestamp` is the real
+      from-power-on number.) Remaining boot levers for the v1.0 ≤ 3 s target: the
+      ~1.9 s splash full refresh and the ~0.74 s PSRAM memtest.
 - [ ] Typing a 1000-word paragraph never drops a keystroke and never lags
       more than 300 ms behind the keyboard.
 - [ ] `Ctrl-S` durably writes the file (verified by power-cycling immediately

docs/v0.1-mvp-technical.md

@@ -72,7 +72,10 @@ read snapshot (render diff).
 9. STEADY STATE
 ```
 
-Target boot time: ≤ 5 s to cursor (v0.1). The 3 s target is v1.0.
+Target boot time: ≤ 5 s to cursor (v0.1). The 3 s target is v1.0. Measured cold
+boot is **4258 ms** (2026-07-11) — under the v0.1 gate; the full breakdown and why
+≤ 3 s is hard (one ~1.9 s full refresh is unavoidable at cold boot) is in
+[`notes/boot-time-budget.md`](notes/boot-time-budget.md).
 
 ## Hardware bring-up order