docs: the second kernel round on the bench (CAMPAIGN-LOG, BRINGUP item 21)

The 2026-08-24 second-round record on dev 20260824200726: the dmesg
lines gone, the UP kernel on the performance governor, the two-file
WL18xx firmware set, every port answering over IPv6 on the ULA, the
export, and the two leftovers (no GUA from the DHCPv6 server, the NVS
loader line that patch 0015 removes). Item 21 says what remains.

Docs only; no catalog consequence.

docs/BRINGUP.md

@@ -1552,10 +1552,16 @@ Open items only. Anything closed is in `CAMPAIGN-LOG.md`.
     grblHAL's TCP:23 and forgetest listening dual-stack); the log export
     carries `/sys/fs/pstore`; and the release rootfs drops nano/libmagic,
     the udev hardware database and urllib3's pyOpenSSL chain (~22 MB).
-    Owed on the bench: boot (dmesg without the three lines), a GUA on
-    wlan0 with each port answered over IPv6, `scaling_governor` reading
-    performance, Wi-Fi up without the NVS warning, an export that contains
-    the sysrq record, then the item-16 drill and the campaign.
+    Bench-validated on dev 20260824200726 (CAMPAIGN-LOG 2026-08-24, second
+    round): the three lines are gone, the kernel is UP at 996 MHz on the
+    performance governor, Wi-Fi is up on the two-file firmware set, every
+    port answers over IPv6 on the board's ULA, the export runs. Two things
+    remain from it: the DHCPv6 server answers NoAddrsAvail and the GUA
+    prefix is not autonomous, so the board holds no GUA until the network
+    side hands one out (the client is running and asking); and with no NVS
+    on the rootfs the firmware loader logs the missing file at ERR level,
+    which patch 0015 (wlcore asks for the optional file the quiet way)
+    removes on the next build. Then the item-16 drill and the campaign.
 
 **Deliberately not gated:** an armed GRBL job after an underrun cuts at the
 stale origin unless homing is required (GRBL mode permits unhomed cutting; the

docs/CAMPAIGN-LOG.md

@@ -3808,6 +3808,50 @@ Still owed: a GRBL job on the image, the acceptance campaign (platform
 change), and the `spi_device_id` table for `glowforge,pic`, which
 rides the module's next pin bump. Bench left clean.
 
+## 2026-08-24: the second kernel round, on the bench
+
+Dev 20260824200726, cold boot after the flash (the pstore region came up
+empty and re-initialized its headers, as a power cycle must). The dmesg
+lines the round set out to remove are gone: no spi-imx "can't get the TX
+DMA channel", no `consoleblank` in the unknown-parameter list (only
+`board=`, which userspace reads), no "cannot start cut; no data enqueued"
+(grblHAL treats that run-on-empty-ring race as ordinary; the module now
+agrees), no `spi_device_id` warning (the pinned module carries the
+table), no "unconfigured mac address in nvs". One line took its place:
+with no NVS on the rootfs the firmware loader reports the missing file
+at ERR level; patch 0015 asks for the optional file the quiet way and
+rides the next build.
+
+The kernel is UP: `nproc` 1, no IPI rows, the TWD still the tick and the
+GPT the clocksource. The performance governor is the only one and the
+core reads 996 MHz. Wi-Fi associated on `wl18xx-fw-4.bin` with
+`wl18xx-conf.bin` beside it and nothing else in `ti-connectivity`; PG 2.2
+silicon, firmware 8.9.0.0.83, regulatory database loaded.
+
+IPv6: the kernel took the router advertisement (link-local, a ULA by
+SLAAC, the ULA and GUA prefix routes, the default route) and `udhcpc6`
+ran from the `wlan0 inet6` stanza. It got no address: the DHCPv6 server
+answered every Solicit with an IA_NA carrying only a status option (18
+bytes, which busybox reports as "IA_NA option is too short"), which is
+NoAddrsAvail; the GUA prefix is advertised on-link without the
+autonomous flag. So the board has a routable ULA and no GUA until the
+network hands one out; the client side is doing its part. Every service
+answered over IPv6 on the ULA from the board itself: sshd (banner),
+grblHAL TCP:23, forgectrl :8080 (200), forgetest :8090 (200);
+`netstat` shows all four on `:::`. This host sits on another IPv6 LAN,
+so cross-network reachability was not testable from here.
+
+The rootfs: nano and `file` present on the dev image, the udev hardware
+database gone, `cryptography` not importable while `urllib3` and
+`requests` import; `/lib/firmware` down to the WL18xx pair and the
+DualLite VPU blob. A sanitized log export ran (200, 1.9 MB) with the
+`system/` snapshot in place; the `system/pstore/` directory appears only
+when records exist, and after the cold boot there were none. Memory
+475 MB total, 325 MB available at idle in GRBL mode.
+
+Owed: the NVS line (patch 0015, next build), the item-16 drill on this
+kernel, the campaign. Bench left clean.
+
 ## Superseded status notes
 
 ### Shared machine services — remaining polish, as listed 2026-08-13