orchestrator: Pin the orchestrator seams in the docs

Pin three facts the docs left implicit: checkpoint timeouts
are table data the walk consumes — the clockless state machine never
sees a duration, a component's boot timeout is just its walk over the
windows; the device table is the authority the chain is built from;
and Complete maps to ComponentReady or Booted by component kind, in
the shell.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Christina Quast <christina.quast@9elements.com>

services/orchestrator/capabilities/src/boot_watch.rs

diff --git a/services/orchestrator/capabilities/src/boot_watch.rs b/services/orchestrator/capabilities/src/boot_watch.rs
index 6c05cc8..94276c7 100644
--- a/services/orchestrator/capabilities/src/boot_watch.rs
+++ b/services/orchestrator/capabilities/src/boot_watch.rs
@@ -39,7 +39,10 @@
         /// When the awaited checkpoint's window expires.
         deadline_millis: u64,
     },
-    /// Every checkpoint passed — the device is up.
+    /// Every checkpoint passed — the device is up. Which state-machine
+    /// event this becomes is the shell's mapping, by component kind:
+    /// `ComponentReady` for an iRoT-backed device, `Booted` for a
+    /// symbiont.
     Complete,
     /// This boot attempt failed at `checkpoint`; the walk is over.
     /// Whether to try again, recover, or give up is the orchestrator's

services/orchestrator/config/src/lib.rs

diff --git a/services/orchestrator/config/src/lib.rs b/services/orchestrator/config/src/lib.rs
index ffc34ab..c544a79 100644
--- a/services/orchestrator/config/src/lib.rs
+++ b/services/orchestrator/config/src/lib.rs
@@ -27,8 +27,13 @@
     /// (in `orchestrator-capabilities`). An id rather than a function, so
     /// the table stays pure data — the type-level docs say why.
     pub signal: G,
-    /// Window for one attempt at this checkpoint. Expiry is the
-    /// orchestrator's own judgment; hung devices report nothing.
+    /// Window for one attempt at this checkpoint. Expiry is the boot
+    /// walk's own judgment; hung devices report nothing.
+    ///
+    /// The orchestrator state machine never sees this value — it is
+    /// clockless. The walk consumes the windows and reports expiry as a
+    /// failed attempt; a component's whole boot timeout is nothing more
+    /// than its walk over these windows, in order.
     pub timeout: core::time::Duration,
 }
 

target/mock/devices.rs

diff --git a/target/mock/devices.rs b/target/mock/devices.rs
index 6008e1b..33af731 100644
--- a/target/mock/devices.rs
+++ b/target/mock/devices.rs
@@ -25,7 +25,8 @@
 }
 
 /// Declaration order is the boot order: the orchestrator releases devices
-/// top to bottom, one at a time.
+/// top to bottom, one at a time. This table is the authority — the
+/// orchestrator's chain of trust is built from it, never beside it.
 ///
 /// The mock board's reset controller addresses reset lines by plain index,
 /// so the reset id type is `u8`.