feat(admin-config-tool): wire xceadmin into HA deploy/test skills

deploy-ha.sh's --build-config path (task 4.2) pointed at
src/xceadmin/.venv/bin/xceadmin, broken by today's meson/nix rewiring
(xceadmin no longer builds a venv there). Fixed to search the meson
build dir (xce.build/build.release/build.dbg), a nix-installed
result/bin, then PATH.

/xce-deploy-ha's SKILL.md never mentioned xceadmin or --build-config
(predates task 4.2) — documented both.

/xce-test-ha's run-ha-soak.sh hard-required a pre-existing cluster.bin
under ha/data/, exit 2 if missing, with no xceadmin path at all. Now
always builds cluster.bin fresh from src/configs/*.yaml via xceadmin
before every soak run, same resolution order as deploy-ha.sh.

ha/data/cluster.bin is no longer a checked-in fixture: removed from
git tracking and gitignored. It was stale relative to xceadmin's
output anyway (different hash from a different, older generation
path) -- the xceadmin-built one matches the known-good golden-fixture
hash from admin-config-tool task 5.4.

.claude/skills/xce-deploy-ha/SKILL.md

@@ -32,10 +32,13 @@ disown`) before relying on subagent dispatch for unattended use.
 ## Prerequisites
 
 - Build must be current: run `/xce-build controller` first if binary is stale
-- TLS certs and a `cluster.bin` must exist under `ha/data/`:
+- TLS certs must exist under `ha/data/`:
   - `ha/data/xce.crt`
   - `ha/data/xce.key`
-  - `ha/data/cluster.bin`
+- `ha/data/cluster.bin` — either already present, or built automatically by
+  `deploy-ha.sh` from `src/configs/*.yaml` via `xceadmin` (see Step 3). Run
+  `/xce-build xceadmin` first (or `nix build .#xcecore`) so a built
+  `xceadmin` binary exists for that auto-build path to find.
 
 ## Arguments
 
@@ -78,6 +81,21 @@ PEERS="localhost:9991,localhost:9992,localhost:9993"  # from args
 bash src/tools/deploy-ha.sh "$BINARY" "$DATADIR" "$TOP" "$PEERS"
 ```
 
+Add `--build-config` (anywhere in the args) to force a fresh `cluster.bin`
+rebuild from `src/configs/*.yaml` via `xceadmin` even if `$DATADIR/cluster.bin`
+already exists — useful after editing the example configs:
+
+```bash
+bash src/tools/deploy-ha.sh --build-config "$BINARY" "$DATADIR" "$TOP" "$PEERS"
+```
+
+Without the flag, an existing `$DATADIR/cluster.bin` is left untouched; one
+is auto-built via `xceadmin` only if missing. `xceadmin` is resolved from
+the meson build dir (`xce.build/xceadmin/.venv/bin/xceadmin` by default,
+also checks `build.release`/`build.dbg`), a nix-built `result/bin/xceadmin`,
+or `PATH` — in that order. If none is found, the script errors and tells
+you to run `/xce-build xceadmin` or `nix build .#xcecore` first.
+
 This:
 - Creates `$TOP/certs/`, `$TOP/controller/ctrl-{1..N}/conf`, `$TOP/controller/ctrl-{1..N}/data`, `$TOP/logs/`
 - Copies `xce.crt` and `xce.key` into the shared `$TOP/certs/` dir

.claude/skills/xce-test-ha/SKILL.md

@@ -361,7 +361,7 @@ XCE_HA_ROUNDS=10 XCE_HA_TOP=/tmp/my-ha-run nix develop ./src --command bash "$SK
 | Env var | Meaning | Default |
 |---|---|---|
 | `XCE_HA_TOP` | deploy directory | `/home/claude/tmp/xce-ha-deploy` |
-| `XCE_HA_DATADIR` | config/certs source (`cluster.bin`, `xce.crt`, `xce.key`) | `<repo>/ha/data` |
+| `XCE_HA_DATADIR` | config/certs dir (`xce.crt`, `xce.key`; `cluster.bin` freshly built here by `xceadmin` every run, not a fixture) | `<repo>/ha/data` |
 | `XCE_HA_MODE` | `sequential`, `chaotic`, `force-snapshot`, `factstream`, `array-soak`, or `array-chaos-retry` (its `--flag` wins) | `sequential` |
 | `XCE_HA_BIN` | `xce_controller` binary (point at real-fs release for the gate) | `<repo>/src/xce.build/controller/xce_controller` |
 | `XCE_HA_XT` | `xce_test` binary | `<repo>/src/xce.build/controller/xce_test` |
@@ -385,7 +385,7 @@ XCE_HA_ROUNDS=10 XCE_HA_TOP=/tmp/my-ha-run nix develop ./src --command bash "$SK
 
 ## What the driver does (maps to the requested steps)
 
-1. **Preconditions** — verifies `xce_controller`, `xce_test`, `cluster.bin`, and certs exist.
+1. **Preconditions** — verifies `xce_controller`, `xce_test`, and certs exist; builds `cluster.bin` fresh under `XCE_HA_DATADIR` via `xceadmin` (resolved from the meson build dir, a nix-installed prefix, or `PATH`, in that order — fails with a clear message if none is found; run `/xce-build xceadmin` or `nix build .#xcecore` first).
 2. **Deploy** — `src/tools/deploy-ha.sh` into `XCE_HA_TOP` with nodes
    `ctrl-1=localhost:9991, ctrl-2=localhost:9992, ctrl-3=localhost:9993`,
    using config/certs from `XCE_HA_DATADIR`.

.claude/skills/xce-test-ha/run-ha-soak.sh

@@ -302,7 +302,28 @@ kill_node() {
 # ── Preconditions ────────────────────────────────────────────────────────────
 [ -x "$BIN" ] || { echo "[xce-test-ha] FAIL: controller binary missing: $BIN (run /xce-build controller)" >&2; exit 2; }
 [ -x "$XT" ] || { echo "[xce-test-ha] FAIL: xce_test missing: $XT (run /xce-build controller)" >&2; exit 2; }
-[ -r "$DATADIR/cluster.bin" ] || { echo "[xce-test-ha] FAIL: cluster.bin missing under $DATADIR" >&2; exit 2; }
+# cluster.bin is always (re)built fresh from src/configs/*.yaml via xceadmin
+# -- no pre-created/checked-in cluster.bin fixture is used or kept around
+# any more (ha/data/cluster.bin was removed from git tracking accordingly).
+# Same xceadmin resolution order as deploy-ha.sh's --build-config path
+# (meson build dir, then a nix-installed prefix, then PATH).
+XCEADMIN=""
+for candidate in \
+    "$REPO/src/xce.build/xceadmin/.venv/bin/xceadmin" \
+    "$REPO/src/build.release/xceadmin/.venv/bin/xceadmin" \
+    "$REPO/src/build.dbg/xceadmin/.venv/bin/xceadmin" \
+    "$REPO/src/result/bin/xceadmin" \
+    "$(command -v xceadmin 2>/dev/null || true)"
+do
+    [ -n "$candidate" ] && [ -x "$candidate" ] && { XCEADMIN="$candidate"; break; }
+done
+if [ -z "$XCEADMIN" ]; then
+    echo "[xce-test-ha] FAIL: no xceadmin binary found to build cluster.bin (run /xce-build xceadmin or nix build .#xcecore)" >&2
+    exit 2
+fi
+echo "[xce-test-ha] building cluster.bin under $DATADIR via $XCEADMIN"
+"$XCEADMIN" config build "$REPO/src/configs" -o "$DATADIR/cluster.bin" \
+    || { echo "[xce-test-ha] FAIL: xceadmin config build failed" >&2; exit 2; }
 [ -r "$DATADIR/xce.crt" ] && [ -r "$DATADIR/xce.key" ] || { echo "[xce-test-ha] FAIL: certs missing under $DATADIR" >&2; exit 2; }
 
 trap cleanup EXIT INT TERM

.gitignore

@@ -33,3 +33,7 @@ ucai-formatter-cache.local.json
 /final_suite_run.log
 /xce-durability-*.log
 /xce-ha-soak*.log
+
+# --- session checkpoint 2026-07-22: cluster.bin is always freshly built by
+# xceadmin now (deploy-ha.sh / run-ha-soak.sh), never a checked-in fixture ---
+ha/data/cluster.bin

src/tools/deploy-ha.sh

@@ -32,9 +32,25 @@ BINARY=$(realpath "$BINARY")
 # Requirements 8.3/8.4/8.5: rebuild cluster.bin when --build-config is
 # passed or none exists yet; otherwise leave an existing one untouched.
 if [ "$BUILD_CONFIG" = "1" ] || [ ! -f "$DATADIR/cluster.bin" ]; then
-    XCEADMIN="$SCRIPT_DIR/../xceadmin/.venv/bin/xceadmin"
+    # xceadmin is meson-built now (src/xceadmin/meson.build), not a plain
-    if [ ! -x "$XCEADMIN" ]; then
+    # `pip install -e .` venv checked out under src/xceadmin/ -- its build
-        echo "Error: $XCEADMIN not found -- run 'xce-build.sh xceadmin' first"
+    # output lives under whichever meson build dir xce-build.sh's profile
+    # picked, or under a nix-installed prefix's bin/. Try each in turn.
+    XCEADMIN=""
+    for candidate in \
+        "$SCRIPT_DIR/../xce.build/xceadmin/.venv/bin/xceadmin" \
+        "$SCRIPT_DIR/../build.release/xceadmin/.venv/bin/xceadmin" \
+        "$SCRIPT_DIR/../build.dbg/xceadmin/.venv/bin/xceadmin" \
+        "$SCRIPT_DIR/../result/bin/xceadmin" \
+        "$(command -v xceadmin 2>/dev/null || true)"
+    do
+        if [ -n "$candidate" ] && [ -x "$candidate" ]; then
+            XCEADMIN="$candidate"
+            break
+        fi
+    done
+    if [ -z "$XCEADMIN" ]; then
+        echo "Error: xceadmin binary not found -- run 'xce-build.sh xceadmin' or 'nix build .#xcecore' first"
         exit 1
     fi
     "$XCEADMIN" config build "$SCRIPT_DIR/../configs" -o "$DATADIR/cluster.bin"