[ejc3]

Pin the host and tile images built from ejc3/fcvm main e32ad48d:

• host ami-0a63fa06ea592d4c7 (fcvm-fleet-host-x86_64-e32ad48d-202610300823), revised from the 93c33125 image;
• tile ami-0c6f93b542d72ebcf (fcvm-fleet-tile-x86_64-e32ad48d-202610300834), revised from the 93c33125 tile image with the host build's renderer export, its boot prefetch list traced again.

This PR earlier pinned the afc4894d host image (ami-0d4b40dfa5b467f22) and then the 93c33125 pair (ami-019a97413616788a5, ami-01dbdab881c6f5c2a). Neither was applied, so the jumpbox applies one image set. Over afc4894d these images carry the renderer fixes for the owner's report of a speckled, flat wall:

• Renderer: filter the cloud and shading-edge pixels the denoiser skipped fcvm#1454: cloud and shading-edge pixels are filtered, and a taller stream is interpolated. Unencoded speckle on the owner's 3460 x 1946 view dropped from 0.93% to 0.19% (golden-hour clouds; reference 0.15%) and from 0.84% to 0.13% (sunset cloud deck; reference 0.09%). Render time is unchanged.
• Renderer: a word's cut follows the ground, and its glow no longer rims it fcvm#1455: a word cut by terrain follows the ground, and its glow no longer draws a bright rim. Flicker along the cut dropped from 80 to 35 pixels and the rim from 8.19 to 3.33. A tile where terrain cuts a word gains 2.4 ms of frame time.

The page's link-adaptive budget (ejc3/fcvm#1456, std on a link that carries it) is page-only and is already on stage.

Evidence for the e32ad48d images

Built with fleet/ami/build-ami.sh. The host build's own checks:

warm-phone: cold boot ok=1 streaming_ms=52229 gpu=0000:18:00.0
warm-phone: warm snapshot phone-warm in 12582 ms
warm-phone: clone ok=1 click_to_first_scene_frame_ms=6665 gpu=0000:19:00.0

All 16 store parts uploaded with status 200.

fleet/ami/measure-boot.sh host ami-0a63fa06ea592d4c7 (on demand, us-east-1):

fcvm-fleet-vfio active 66407 ms after the request
fcvm-fleet-store active 87407 ms after the request
on-instance: fcvm-fleet-store: mkfs+mount 1408 ms, restore of 16 parts from s3 via tmpfs 22962 ms, 82G apparent
warm: ok=1 first_frame_ms=6362 gpu=0000:18:00.0
snapshot: hit
host: first GPU VM done 107439 ms after the request (includes SSM round trips)

fleet/ami/measure-boot.sh tile ami-0c6f93b542d72ebcf (spot):

tile: request->accepted 2303 ms, ->running (seen) 8663 ms, ->first frame over HTTPS 33698 ms

The first e32ad48d tile image, which kept the earlier image's prefetch list, measured 49.7 s and 44.2 s to first frame. Tracing again (tile/build.sh trace on a boot without the list: 2,333 files, 2,734 pieces, 416.8 MiB) brought it back to 33.7 s, against 33.0 s for the 93c33125 tile and 32 to 37 s for earlier ones.

---

What the afc4894d image already carried (unchanged from the earlier description of this PR):

• a routed port forward whose dial of the guest cannot hold fcvm at exit (Routed port forward: dial the guest asynchronously so a dial in flight cannot hold fcvm at exit fcvm#1453). A client that reached a VM's published port during its teardown kept fcvm alive until the dial of the dead guest gave up, and the agent counts that in teardown_ms: a claimed GPU's old VM took 4221 to 4842 ms to stop on stage (three claims, 10-27 and 10-30), other relaunches on the same host 382 to 440 ms. On a g4dn.metal, SIGTERM to fcvm exit with a client dialling the port every 250 ms through the stop: 4358, 5128, 4373 ms on the staging image; 361, 379, 368 ms on this one;
• (page only, already on stage, not in the image) the own-GPU readouts (Wall page: time a drag by its own camera key; renderer startup times out of the restart bar fcvm#1451): input to pixels timed by the drag's own camera key, which read 11.6 s on stage for a drag drawn at once, and a restart bar without the renderer's own startup times, which made a 7.85 s restart read 8.65 s;
• the phones' GPU mirror (GPU mirror: decode a phone's GL command stream and replay it on WebGL2 fcvm#1432 to #1435), with the streamer's close frame kept apart from queued data when a holder change revokes a mirror (Phone streamer: a mirror revoked by a holder change still sends its close frame fcvm#1440);
• zstd on the mirror's wire (GPU mirror: zstd on the wire, decoded in the page by zstd's decoder in WebAssembly fcvm#1449): the stage page reads zstd only since #1449 merged, so phones on an older image show their mirror closed until this one runs;
• the phone test and container fixes (Phone test: fail closed with logs; turn UWB off; preload the driver's TLS so retakes do not abort the emulator fcvm#1448): the emulator preloads the NVIDIA driver's TLS library (the 29th gpu retake of a phone aborted the emulator without it), and UWB is turned off once a phone boots (its service asked for a bug report about 50 s after boot);
• the emulator built from Retake: stay released when Vulkan does not come back gfxstream#6 on Test CI #5 (GPU mirror: FREE records, no program binaries, ring stream replies; retake stays released without Vulkan fcvm#1450): FREE records for color buffers the host destroys, no program binaries for a mirrorable guest, replies copied on ring streams, and a retake that stays released when Vulkan does not come back;
• from 097595bc's image: a bake that leaves /tmp empty (Host AMI bake: empty /tmp so a boot does not delete a build tree fcvm#1444) and the agent's dial deadlines and silent-connection redial (Agent dial: deadlines on every connect step, redial a silent connection fcvm#1445).

Evidence for the afc4894d image

fleet/ami/measure-boot.sh host ami-0d4b40dfa5b467f22 (on demand, us-east-1):

fcvm-fleet-vfio active 66208 ms after the request
fcvm-fleet-store active 89208 ms after the request
on-instance: fcvm-fleet-store: mkfs+mount 3583 ms, restore of 16 parts from s3 via tmpfs 21745 ms, 82G apparent
on-instance: analyze: Startup finished in 7.720s (kernel) + 40.992s (userspace) = 48.713s
on-instance: blame: 25.378s fcvm-fleet-store.service
on-instance: blame:  7.291s cloud-init-local.service
warm: ok=1 first_frame_ms=5959 gpu=0000:18:00.0
snapshot: hit
host: first GPU VM done 115063 ms after the request (includes SSM round trips)

The d8d5f6ad image measured 68.8, 89.8 and 113.1 s for the same three marks.

The build's own checks: the renderer warm-up to first frame (warm: ok=1), the root warm-up as the agent launches a slot (warm-root: launch ok=1), and the phones (host/warm-phone.sh): the cold boot streamed at 51.7 s (the phone image was already in the store), the warm snapshot of the running phone in 12.6 s, a clone on another T4 at its first scene frame 6.5 s after the click (6.6 s on the d8d5f6ad image).

make phone-test on a g4dn.metal launched from this image (fleet/tools/gpubox.sh with GPUBOX_AMI): passed, 102 checks, 0 failures; flow B (a clone on a second T4) at the app's first frame 5.7 s after the click.

Phones on stage also need --phones 2 (#724).

Summary by CodeRabbit

• Updates
  • Updated the default host and tile images for the US East region. The refreshed images include newer builds and feature updates. This changes the images used by default when setting up hosts and tiles in that region.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d5e755c4-0750-4d6a-ab05-5d3eb09f34ee

Commits

Reviewing files that changed from the base of the PR and between 239ea90 and 3ff529f.

Files selected for processing: 1

• fcvm-fleet.tf

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The us-east-1 fleet host and tile AMI defaults changed. Their descriptions now include details about the updated images.

Changes: Fleet AMI updates

Layer / File(s)	Summary
Update paired AMI defaults fcvm-fleet.tf	The host AMI default and description now identify a newer build and its listed contents. The tile AMI default and description now identify its renderer and boot-prefetch list, and retain its readiness checks.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Possibly related PRs

• ejc3/aws#713: Updates both fleet AMI defaults to a paired renderer image set.
• ejc3/aws#723: Pins the preceding host and tile AMIs for the fleet.
• ejc3/aws#698: Pins earlier images for the same host and tile AMI defaults.

Merge Risk: Minimal · up to 3ff52

No merge-blocking risk was identified in this AMI update; proceed with normal infrastructure validation.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: pinning the host and tile AMIs from the specified fcvm commit.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T15:35:35.440420Z	3ff529f	Manual request
🔒 Security Review	✅ Completed 2026-10-31T15:39:27.268011Z	3ff529f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ejc3]

@codex review
@codex security review
@coderabbitai review
@greptileai review

Please review current head 3ff529f73882c7d8e3288da68edd03b268fa31ba before the infrastructure apply. Independent code and security reviews are running; live state, credential scope and deployment prerequisites will be checked before applying.

[coderabbitai]

Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 3ff529f738

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ejc3]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 3ff529f738

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ejc3]

Applied and runtime verified: host LT version 12 and all tile launch templates use the new private images. Real streams and both owner-scoped phone mirrors passed positive and negative auth checks against the new images; private IVS rejects unsigned access and accepts a valid signed manifest. Final full Terraform follow-up is empty on main 1eecb89. The fixed eight-slot FCVM wall intentionally includes two empty waiting_capacity slots.