feat: detect verified boot configuration drift

crates/api-core/src/cfg/README.md

@@ -386,8 +386,21 @@ Extends `StateControllerConfig` with:
 | `uefi_boot_wait` | `Duration` | `5m`    | Wait time for UEFI boot completion after host reboot. |
 | `max_bios_config_retries` | `u32` | `3` | Shared retry budget for automated host boot-configuration convergence across BIOS recovery and boot-order verification. |
 | `polling_bios_setup_stuck_threshold` | `Duration` | `15m` | Time in PollingBiosSetup with `is_bios_setup == false` before recovery escalation. |
+| `boot_interface_observation_interval` | `Duration` | `10m` | Positive time between successful Redfish observations of an already-verified boot interface. |
 | `controller` | `StateControllerConfig` | *(default)* | Common state controller timing (see [StateControllerConfig](#statecontrollerconfig)). |
 
+The Redfish observation is read-only. A successful match refreshes the last
+observation timestamp. A mismatch records a new pending generation for the same
+desired target: Ready enters the existing boot-configuration flow on its next
+controller sweep, while Assigned defers remediation until release. Failed reads
+and skipped observations preserve the last successful observation and retry on
+a later controller iteration.
+
+The controller skips periodic observation for locked Supermicro hosts because
+their reported boot-order view remains stale until lockdown is disabled and the
+host is rebooted. Profiles configured with `disable_lockdown = true` use the
+normal observation path.
+
 ### `NetworkSegmentStateControllerConfig`
 
 Extends `StateControllerConfig` with:

crates/api-core/src/cfg/file.rs

@@ -3975,6 +3975,7 @@ mod tests {
             uefi_boot_wait: Duration::minutes(5),
             max_bios_config_retries: 3,
             polling_bios_setup_stuck_threshold: Duration::minutes(15),
+            boot_interface_observation_interval: Duration::hours(2),
         };
 
         let config_str = serde_json::to_string(&input).unwrap();
@@ -3995,6 +3996,7 @@ mod tests {
     fn deserialize_machine_controller_config() {
         let config = r#"{"dpu_wait_time": "20m","power_down_wait":"10s",
         "failure_retry_time":"1h30m", "dpu_up_threshold": "1w",
+        "boot_interface_observation_interval": "2h",
         "controller": {"iteration_time": "33s", "max_object_handling_time": "63s", "max_concurrency": 13}}"#;
         let config: MachineStateControllerConfig = serde_json::from_str(config).unwrap();
 
@@ -4021,6 +4023,7 @@ mod tests {
                 uefi_boot_wait: Duration::minutes(5),
                 max_bios_config_retries: 3,
                 polling_bios_setup_stuck_threshold: Duration::minutes(15),
+                boot_interface_observation_interval: Duration::hours(2),
             }
         );
     }
@@ -4044,10 +4047,23 @@ mod tests {
                 uefi_boot_wait: Duration::minutes(5),
                 max_bios_config_retries: 3,
                 polling_bios_setup_stuck_threshold: Duration::minutes(15),
+                boot_interface_observation_interval: Duration::minutes(10),
             }
         );
     }
 
+    #[test]
+    fn reject_nonpositive_boot_interface_observation_intervals() {
+        for invalid_interval in ["0s", "-1s"] {
+            let config_json =
+                format!(r#"{{"boot_interface_observation_interval": "{invalid_interval}"}}"#);
+            assert!(
+                serde_json::from_str::<MachineStateControllerConfig>(&config_json).is_err(),
+                "boot_interface_observation_interval={invalid_interval} must be rejected",
+            );
+        }
+    }
+
     #[test]
     fn deserialize_network_segment_state_controller_config() {
         let config = r#"{"network_segment_drain_time": "21m",
@@ -4469,6 +4485,7 @@ mod tests {
                 uefi_boot_wait: Duration::minutes(5),
                 max_bios_config_retries: 3,
                 polling_bios_setup_stuck_threshold: Duration::minutes(15),
+                boot_interface_observation_interval: Duration::hours(2),
             }
         );
         assert_eq!(
@@ -4710,6 +4727,7 @@ mod tests {
                 uefi_boot_wait: Duration::minutes(5),
                 max_bios_config_retries: 3,
                 polling_bios_setup_stuck_threshold: Duration::minutes(15),
+                boot_interface_observation_interval: Duration::minutes(10),
             }
         );
         assert_eq!(
@@ -5094,6 +5112,7 @@ mod tests {
                 uefi_boot_wait: Duration::minutes(5),
                 max_bios_config_retries: 3,
                 polling_bios_setup_stuck_threshold: Duration::minutes(15),
+                boot_interface_observation_interval: Duration::hours(2),
             }
         );
         assert_eq!(

crates/api-core/src/cfg/test_data/full_config.toml

@@ -95,6 +95,7 @@ power_down_wait = "13s"
 failure_retry_time = "31m"
 dpu_up_threshold = "33m"
 scout_reporting_timeout = "20m"
+boot_interface_observation_interval = "10m"
 
 [host_health]
 prevent_allocations_on_stale_dpu_agent_version = true

crates/api-core/src/cfg/test_data/full_config_post_migration.toml

@@ -56,6 +56,7 @@ power_down_wait = "13s"
 failure_retry_time = "31m"
 dpu_up_threshold = "33m"
 scout_reporting_timeout = "20m"
+boot_interface_observation_interval = "10m"
 
 [host_health]
 prevent_allocations_on_stale_dpu_agent_version = true

crates/api-core/src/cfg/test_data/site_config.toml

@@ -41,6 +41,7 @@ dpu_wait_time = "7m"
 power_down_wait = "17s"
 failure_retry_time = "70m"
 dpu_up_threshold = "77m"
+boot_interface_observation_interval = "2h"
 [machine_state_controller.controller]
 iteration_time = "3m"
 max_object_handling_time = "11s"