fix(rootfs/qemu-static): hold EX during state-check+disable; K-builder verifies state=1 after SH-NB

Addresses Codex P2 review feedback on PR #113 / armbian#9769:

- Race in N-builder entry (line:239): EX-NB → release → re-take SH split
  let a K-builder slip in between observation and the state-check write,
  silently disabling qemu-arm while K relied on it. Restructure to hold
  EX during state check + echo 0, then atomically downgrade EX→SH on the
  same fd via Linux flock(2)'s flc_lock transition. SH waiters are
  granted only after our SH is in place and qemu-arm is already 0.

- K-builder symmetric check: after acquiring the emulation-mode SH-NB,
  verify state=1; if 0, concurrent N-builders have disabled qemu-arm
  and the killswitch cannot honor its contract — bail with a clear
  error rather than running a broken anchor.

- Cleanup-ordering invariant comment was inverted. add_cleanup_handler
  PREPENDS, so later registrations run FIRST. The invariant survives
  because setup is called before mount_chroot in both call sites; the
  comment now states the actual mechanism and documents the failure
  mode if a future call site inverts the order.

Assisted-by: Claude:claude-opus-4.7

Author: iav

lib/functions/rootfs/qemu-static.sh

@@ -190,8 +190,19 @@ function _native_armhf_setup_binfmt_elf() {
 		if [[ -e /proc/sys/fs/binfmt_misc/qemu-arm ]] &&
 			{ exec {_native_armhf_emul_lock_fd}< /proc/sys/fs/binfmt_misc/qemu-arm; } 2> /dev/null &&
 			flock -s -n "${_native_armhf_emul_lock_fd}"; then
-			add_cleanup_handler trap_handler_native_armhf_release_emul_lock
-			display_alert "Native armhf via binfmt_elf" "killswitch active; emulation-mode SH-lock acquired (blocks concurrent native-armhf switchover)" "info"
+			# K-builder invariant: qemu-arm must be enabled. If state=0 here,
+			# concurrent N-builders have already disabled it — the emulation
+			# anchor would be a lie and the K-builder's chroot would fail to
+			# exec qemu-arm-static. Bail rather than silently coexist.
+			if [[ "$(_native_armhf_observe_qemu_arm_state)" == "1" ]]; then
+				add_cleanup_handler trap_handler_native_armhf_release_emul_lock
+				display_alert "Native armhf via binfmt_elf" "killswitch active; emulation-mode SH-lock acquired (blocks concurrent native-armhf switchover)" "info"
+			else
+				exec {_native_armhf_emul_lock_fd}>&-
+				unset _native_armhf_emul_lock_fd
+				display_alert "Native armhf via binfmt_elf" "killswitch requested but qemu-arm already disabled by concurrent native-armhf builders" "err"
+				exit_with_error "cannot honor NATIVE_ARMHF_ON_ARM64=no: concurrent native-armhf builders have disabled qemu-arm. Wait for them to finish or run on a separate host."
+			fi
 		else
 			[[ -n "${_native_armhf_emul_lock_fd:-}" ]] && exec {_native_armhf_emul_lock_fd}>&-
 			unset _native_armhf_emul_lock_fd
@@ -228,32 +239,41 @@ function _native_armhf_setup_binfmt_elf() {
 		return 1
 	fi
 
-	# EX-NB probe BEFORE acquiring our own SH (otherwise our own SH would
-	# block the probe — flock counts per-OFD, our two fds on the same file
-	# would interfere). EX-NB success means zero other SH-holders. Failure
-	# with state="1" identifies a killswitch K-builder holding the
-	# emulation-mode anchor — switching qemu-arm off would corrupt their
-	# chroot exec routing. Failure with state="0" is a peer N-builder in
-	# joiner-territory.
+	# Take EX-NB first to determine whether we are alone or joining. While
+	# we hold EX, no SH/EX can enter, so state observation and the disable
+	# write are atomic w.r.t. concurrent K- or N-builders. Then downgrade
+	# EX → SH on the same fd; Linux flock(2) performs the transition under
+	# the inode's flc_lock, granting pending SH waiters only after our SH
+	# is in place — by which time qemu-arm is already 0 and any joiner
+	# sees joiner-territory (state=0).
+	#
+	# EX-NB failure means someone else holds SH. State distinguishes:
+	#   state=1 → killswitch K-builder holds the emulation-mode anchor;
+	#             switching qemu-arm off would corrupt its chroot exec.
+	#   state=0 → peer N-builder; we are a joiner, take SH without writing.
 	if flock -x -n "${_native_armhf_lock_fd}"; then
-		flock -u "${_native_armhf_lock_fd}"
+		if [[ "$(_native_armhf_observe_qemu_arm_state)" == "1" ]]; then
+			if ! echo 0 > /proc/sys/fs/binfmt_misc/qemu-arm 2> /dev/null; then
+				display_alert "Native armhf via binfmt_elf" "could not disable qemu-arm (no CAP_SYS_ADMIN?); falling back to qemu-arm-static emulation" "wrn"
+				exec {_native_armhf_lock_fd}>&-
+				unset _native_armhf_lock_fd
+				return 1
+			fi
+		fi
+		if ! flock -s "${_native_armhf_lock_fd}"; then
+			display_alert "Native armhf via binfmt_elf" "could not downgrade EX→SH on binfmt_misc/qemu-arm; falling back to qemu emulation" "wrn"
+			exec {_native_armhf_lock_fd}>&-
+			unset _native_armhf_lock_fd
+			return 1
+		fi
 	elif [[ "$(_native_armhf_observe_qemu_arm_state)" == "1" ]]; then
 		exec {_native_armhf_lock_fd}>&-
 		unset _native_armhf_lock_fd
 		display_alert "Native armhf via binfmt_elf" "concurrent build holds emulation-mode lock (NATIVE_ARMHF_ON_ARM64=no)" "err"
 		exit_with_error "cannot enable native armhf: concurrent build with NATIVE_ARMHF_ON_ARM64=no holds emulation lock. Wait for it to finish or run on a separate host."
-	fi
-
-	if ! flock -s -w 30 "${_native_armhf_lock_fd}"; then
-		display_alert "Native armhf via binfmt_elf" "could not acquire shared flock on binfmt_misc/qemu-arm within 30s; falling back to qemu emulation" "wrn"
-		exec {_native_armhf_lock_fd}>&-
-		unset _native_armhf_lock_fd
-		return 1
-	fi
-
-	if [[ "$(_native_armhf_observe_qemu_arm_state)" == "1" ]]; then
-		if ! echo 0 > /proc/sys/fs/binfmt_misc/qemu-arm 2> /dev/null; then
-			display_alert "Native armhf via binfmt_elf" "could not disable qemu-arm (no CAP_SYS_ADMIN?); falling back to qemu-arm-static emulation" "wrn"
+	else
+		if ! flock -s -w 30 "${_native_armhf_lock_fd}"; then
+			display_alert "Native armhf via binfmt_elf" "could not acquire shared flock on binfmt_misc/qemu-arm within 30s; falling back to qemu emulation" "wrn"
 			exec {_native_armhf_lock_fd}>&-
 			unset _native_armhf_lock_fd
 			return 1
@@ -290,9 +310,16 @@ function trap_handler_native_armhf_release_emul_lock() {
 # the build's subshells (umount / SDCARD / MOUNT teardown). BSD flock is per-
 # OFD, so a forked subshell inheriting our SH-fd shares the same lock entry —
 # the LOCK_EX-NB probe below would falsely block on the inherited fd of a
-# still-alive child. add_cleanup_handler runs in registration order; the
-# umount handlers register first, so by the time we run, the docker container
-# is dead and its child-tree with it. Verified empirically (SIGINT mid-chroot).
+# still-alive child. add_cleanup_handler PREPENDS to the handler list and
+# run_cleanup_handlers iterates it in order, so later-registered handlers
+# run first. Our setup is invoked before mount_chroot in both call sites
+# (rootfs-create.sh and rootfs-image.sh), so mount_chroot's umount handlers
+# are registered after ours, sit at the head of the list, and execute before
+# us — by the time we run, the chroot is unmounted and inheriting subshells
+# have exited. Verified empirically (SIGINT mid-chroot). If a future call
+# site registers our setup AFTER mount_chroot, this invariant inverts and
+# the EX-NB probe will spuriously fail; the documented escape hatches are
+# POSIX F_SETLK on a helper fd or explicit descendant-kill.
 function trap_handler_native_armhf_restore_qemu_arm() {
 	[[ -n "${_native_armhf_lock_fd:-}" ]] || return 0
 	exec {_native_armhf_lock_fd}>&-