RNG persistent-error reset clears hardware evidence without latching the fault

[BitHighlander]

Summary

The new boot-lifetime RNG fault mirror is not set on the active-error recovery path. If SECS/CECS remains asserted for 100 polls, random32() calls reset_rng(), which clears SEIS/CEIS and recursively resumes without ever setting rng_seed_error_seen. A later health gate can therefore see neither the hardware interrupt latch nor the software mirror.

Found while auditing PR #604 at exact head 1d446ccbc9cf32a6e499990e65bcf7b358f1325b.

Evidence

• lib/rand/rng.c:51-65 documents rng_seed_error_seen as boot-lifetime and one-way.
• lib/rand/rng.c:102-107 sets it only after an interrupt is observed with current SECS/CECS clear.
• lib/rand/rng.c:108-115 handles a still-active fault by waiting 100 polls and calling reset_rng() without setting the mirror.
• lib/rand/rng.c:67-86 clears SEIS/CEIS and recursively draws again.
• lib/rand/rng_health.c:72-81 trusts either the current hardware bits or this software mirror to detect the historical fault.

Impact

High — entropy boundary can fail open after a hardware continuous-test error. Key-generation ceremonies may accept output from a source that the code explicitly says must remain distrusted until power cycle.

Acceptance criteria

• Set the software fault latch before every recovery action that clears hardware evidence, including the persistent SECS/CECS path.
• Never clear the software latch except at power-on initialization.
• Add a hardware-register seam or equivalent test double proving a persistent error, reset, and subsequent healthy-looking word still causes random_buffer_checked() to fail and wipe its destination.
• Add a transient-error regression test proving the existing path remains latched.

[BitHighlander]

Resolved on PR #604 at exact reviewed head d842f1e. RNG hardware and health failures now latch across cached checks, with transient, persistent, degenerate-output, and wipe-on-failure regression coverage. Both exact-head CI gates passed. Re-review attestation: #604 (comment). Leaving this issue open until merge.

[BitHighlander]

Addressed in #620 at 41ec6eea.

The persistent-error step now sets the boot-lifetime software latch before reset_rng() clears the hardware evidence. The new PersistentHardwareErrorLatchesBeforeReset regression exercises the 100-poll transition, counter reset, and retained latch. The updated #620 full emulator matrix passes (449 firmware, 13 board/storage, 18 crypto, 6 Pallas tests).

Leaving this issue open until #620 CI is green and a reviewer confirms whether the existing checked-draw/transient regressions plus this register-independent seam satisfy the remaining hardware-seam acceptance language.