## 1. Research: what mainline actually supports

- [x] 1.1 Determine the current kernel.org latest stable/longterm and the
      newest mainline tag/commit carrying any Canaan K230 support, cited by
      exact tag diff (`git show v7.2:arch/riscv/boot/dts/canaan/` vs.
      `master`). Recorded in
      `docs/research/mainline-kernel-inventory.md` ("Target version").
- [x] 1.2 Build the full hardware-function-by-function mainline status table,
      checking every driver-file claim directly
      (`gh api repos/torvalds/linux/contents/<path>`, 200/404) rather than
      inferring from changelogs. Recorded in the same document's
      "Inventory" table.
- [x] 1.3 Check each of our eleven vendor-kernel patches individually against
      the file it targets upstream, and record a per-patch port/no-port
      disposition, not an aggregate one. Recorded in the same document's
      "Our eleven vendor-kernel patches" section (net result: zero port,
      one already fixed upstream by an independent change, ten target files
      that do not exist upstream).
- [x] 1.4 Write the phased plan, naming the actual first hardware milestone
      correctly ("reaches the serial console", not "SD rootfs", since SD is
      still in review upstream). Recorded in the same document's "Phased
      plan" section.

## 2. Nix: a parallel mainline kernel source pin and build

- [x] 2.1 Pin the mainline commit in `nix/kernel-mainline-src.nix`
      (`fetchFromGitHub torvalds/linux`, dereferenced `v7.3-rc5` commit
      `72d3fcf802c45d00b300f25b848a93c3a2bd7c7e`), hash obtained with
      `nix run nixpkgs#nix-prefetch-github -- torvalds linux --rev
      72d3fcf802c45d00b300f25b848a93c3a2bd7c7e`.
- [x] 2.2 Add `nix/kernel-mainline.nix`: `defconfig = "defconfig"`,
      `autoModules = false`, `ARCH_CANAAN`/`PINCTRL_K230`/`RESET_K230`/
      `COMMON_CLK_K230` turned on, an initrd-capable config
      (`BLK_DEV_INITRD`/`RD_GZIP`/`RD_ZSTD`) with no initramfs content
      supplied yet. Wire `packages.kernelMainline` in `flake.nix` via
      `pkgsCross.linuxPackagesFor`, parallel to but independent of
      `k230Kernel`/`packages.kernel`.
      Proven: `nix build .#kernelMainline --out-link result-kernelMainline
      --max-jobs 2 --cores 8 --print-out-paths` exited 0, producing
      `/nix/store/7idv37hka94mcgnkw0cf6ggrdp8aypky-linux-riscv64-unknown-linux-gnu-7.3.0-rc5`
      (rooted at `result-kernelMainline` in this worktree) — a real
      `file`-confirmed "Linux kernel RISC-V boot executable Image,
      little-endian", 38 504 448 bytes, plus `System.map` and a `dtbs/`
      tree. The generated `.config` was checked directly and carries
      `CONFIG_ARCH_CANAAN=y CONFIG_PINCTRL_K230=y CONFIG_RESET_K230=y
      CONFIG_COMMON_CLK_K230=y CONFIG_BLK_DEV_INITRD=y`. Build proof
      only — no board exists this could have booted on yet.

## 3. Nix: a parallel mainline board device tree

- [x] 3.1 Add `nix/dts/k230-tdisplay-mainline.dts` (mainline's own
      `k230-evb.dts` as template; our board's own 1 GiB memory size and
      model/compatible strings, per design.md decision 3) and
      `nix/device-tree-mainline.nix` (same dtc-invocation shape as
      `nix/device-tree.nix`, against `kernelMainlineSrc` headers). Wire
      `packages.deviceTreeMainline` in `flake.nix`.
      Proven: `nix build .#deviceTreeMainline --out-link
      result-deviceTreeMainline --max-jobs 2 --cores 8 --print-out-paths`
      exited 0, producing
      `/nix/store/0bwb48mn4dzz8ihhsvh9mrhx6gvixd5a-k230-tdisplay-mainline.dtb`,
      and the derivation's own round-trip check (`dtc -I dtb -O dts`)
      passed as part of that same build. Independently re-decompiled after
      the build (`dtc -I dtb -O dts result-deviceTreeMainline/k230-tdisplay-mainline.dtb`)
      to confirm by hand: `compatible = "lilygo,t-display-k230",
      "canaan,kendryte-k230"`, `ddr: memory@0 { reg = <0x00 0x00 0x00
      0x40000000>; }` (1 GiB, matching the vendor board file, not the
      512 MiB `k230-evb.dts` default), `aliases { serial0 =
      "/soc/serial@91400000"; }`, and `uart0`'s `status = "okay"`. Build
      proof only.

## 4. Nix: a boot-files bundle for a future one-shot board test

- [x] 4.1 Add `packages.kernelMainlineBootFiles` in `flake.nix`: a plain
      directory collecting `Image-mainline` and
      `k230-tdisplay-mainline.dtb` under clear names (not the vendor
      blinux flow's fixed `/Image`/`/force.dtb`, since this is a different,
      manual `ext4load` flow the coordinator will drive — see design.md
      decision 5 for why no initrd is bundled yet).
      Proven: `nix build .#kernelMainlineBootFiles --out-link
      result-kernelMainlineBootFiles --max-jobs 2 --cores 8
      --print-out-paths` exited 0, producing
      `/nix/store/23civ9kg8yr675wmlmdjbc718m0hjffv-k230-mainline-boot-files`
      containing exactly `Image-mainline` (38 504 448 bytes) and
      `k230-tdisplay-mainline.dtb` (4660 bytes). Build proof only.

## 5. Milestone 1: boot-critical SD/GPIO/USB forward-port and a full system variant

Coordinator-directed continuation, after the coordinator merged `c5158fa8`
to `master`: "do the actual porting ... so it can mount our SD rootfs."

- [x] 5.1 Forward-port GPIO (`drivers/gpio/gpio-k230.c`), SD/MMC
      (`drivers/mmc/host/sdhci-of-kendryte.c`) and USB
      (`drivers/usb/dwc2/{params.c,core.h,core.c}` hunks) from the pinned
      vendor tree, plus the matching DT nodes in
      `nix/dts/k230-tdisplay-mainline.dts` (real `&sysclk`/`&rst` phandles
      from mainline's own `<dt-bindings/clock/canaan,k230-clk.h>`/
      `<dt-bindings/reset/canaan,k230-rst.h>`, replacing the vendor tree's
      unimplemented `&dummy_sd`/`&clk_dummy` stub clocks). Two real
      vendor-to-mainline API migrations found via failed builds and fixed
      against mainline's own already-migrated reference drivers
      (`gpio-dwapb.c`, `sdhci-of-dwcmshc.c`) — see the new spec requirement
      "Forward-ported drivers are grounded in the vendor tree and checked
      against the pinned mainline API" for the exact citations.
      Proven: `nix build .#kernelMainline --out-link result-kernelMainline
      --max-jobs 2 --cores 8 --print-out-paths` exited 0, producing
      `/nix/store/appd6jgmwfr6rg4k18zjv155xc5841lm-linux-riscv64-unknown-linux-gnu-7.3.0-rc5`
      (38 522 368-byte Image). The generated `.config` carries
      `CONFIG_GPIO_K230=y CONFIG_MMC=y CONFIG_MMC_SDHCI=y
      CONFIG_MMC_SDHCI_PLTFM=y CONFIG_MMC_SDHCI_OF_DWCMSHC_KENDRYTE=y
      CONFIG_USB=y CONFIG_USB_DWC2=y`, confirmed by direct `grep`. Also
      confirmed: `nix build .#deviceTreeMainline` still exits 0 and its
      DTB's `gpio0`/`gpio1`/`usb0`/`usb1`/`mmc_sd0`/`mmc_sd1` nodes
      round-trip with resolved `&sysclk`/`&rst` phandles (`dtc -I dtb -O
      dts`, checked by hand). Build proof only — none of this has probed
      real hardware; the clock-gate/reset-ID choices for these three
      peripherals are UNVERIFIED best-effort mappings, named as such in
      `nix/dts/k230-tdisplay-mainline.dts`'s own header.
- [x] 5.2 Add a full NixOS system variant,
      `nixosConfigurations.k230-mainline-console`, substituting
      `kernelMainline` for the vendor kernel via the same specialArg
      mechanism `k230-rvv-trial` already uses, based on the shell-off
      `k230-console` (not the coordinator's suggested
      `k230-coherent-shell-mainline` name — deviation flagged in
      `flake.nix`'s own comment and in this change's report: the graphical
      shell's Sway/wlroots stack wants a DRM/KMS device mainline does not
      provide yet, and its build would either fail or produce services
      that cannot start). `boot.extraModulePackages`/`boot.kernelModules`
      force-cleared to drop the out-of-tree RTL8189FTV module, which
      `nix/hardware.nix` builds against `config.boot.kernelPackages.kernel`
      dynamically and has no expectation of compiling against a kernel
      seven major versions newer than its 6.6-era origin.
      Proven: `nix build .#toplevel-mainline-console --out-link
      result-toplevel-mainline-console --max-jobs 2 --cores 8
      --print-out-paths` exited 0, producing
      `/nix/store/d488a1cibw8r7ip7hbbb9j52hy0kzb0h-nixos-system-nixos-26.11.20260919.20b1ddd`.
      The build log confirms no `k230-wifi-driver` derivation was built at
      all (the `mkForce [ ]` overrides took effect) and that
      `unit-k230-wifi.service-disabled.drv` was built instead of the
      enabled unit. Build proof only.
- [x] 5.3 Add `nix/kernel-mainline-boot-files.nix` and wire
      `packages.kernelMainlineConsoleBootFiles`: Image, a DTB with this
      system's real bootargs baked into `/chosen` (`fdtput`, same mechanism
      `nix/sd-image.nix` already uses — `cfg.boot.kernelParams` +
      `init=${toplevel}/init`, deliberately with **no** hardcoded `root=`
      device path, since this system's inherited `fileSystems."/" =
      { device = "/dev/disk/by-label/NIXOS_SD"; }` already resolves root by
      ext4 label through the initrd's own fstab — matching the vendor
      image's own proven mechanism instead of guessing an `mmc_sd1` device
      node path), and the system's initrd wrapped as a U-Boot ramdisk image
      (`mkimage`, same invocation shape as `nix/sd-image.nix`'s
      `initrd.uimg`).
      Proven: `nix build .#kernelMainlineConsoleBootFiles --out-link
      result-kernelMainlineConsoleBootFiles --max-jobs 2 --cores 8
      --print-out-paths` exited 0, producing
      `/nix/store/d0idhc2j28n3nn4q1cwq2lin69rnx76r-k230-mainline-console-boot-files`
      containing `Image-mainline` (38 522 368 bytes), `k230-tdisplay-mainline.dtb`
      (7974 bytes, `/chosen/bootargs` confirmed by `dtc -I dtb -O dts`:
      `"console=tty0 consoleblank=0 console=ttyS0,115200n8 root=fstab
      loglevel=4 lsm=landlock,yama,bpf loglevel=7
      init=/nix/store/d488a1cibw8r7ip7hbbb9j52hy0kzb0h-.../init"`), and
      `initrd.uimg` (`file`-confirmed "u-boot legacy uImage, initrd,
      Linux/RISC-V, RAMDisk Image", 27 313 961 bytes uncompressed, CRCs
      present). Build proof only.
- [x] 5.4 Confirm `nix flake check --no-build` still passes with all new
      outputs (it does: `nixosConfigurations.k230-mainline-console` and
      every new package evaluate cleanly) and that no existing output's
      derivation changed:
      `git diff --stat 4ffe809a1b448f98379ea1165d7bca067d01cfdb -- nix/kernel.nix
      nix/kernel-src.nix nix/device-tree.nix nix/k230.nix nix/hardware.nix
      nix/sd-image.nix nix/shell.nix` returns empty.

What remains stubbed after this task group: no rootfs population step —
this milestone produces the boot files, not a card image, and does not
place this system's own closure/profile symlink onto the physical card's
root partition (an explicit non-goal, since a re-flash is out of scope
here per the task's hard rules). No board boot has been attempted or
claimed. `&mmc_sd0` (Wi-Fi SDIO) stays disabled — no driver forward-ported
for it in this task group. Display, touch, audio, PMU/power-key, thermal,
ADC, and crypto remain exactly as inventoried (no mainline driver to port
from); RTC is picked up in task group 5a below.

## 5a. Milestone 3 (partial): RTC forward-port

Coordinator's milestone 3 named touch/RTC/PMU/thermal/ADC/audio "each
forward-ported from the vendor tree with our patches applied." RTC is the
one attempted in this pass — smallest, most self-contained, most
API-stable (RTC-class subsystem) of the group, and a genuine, small proof
that milestone 1's methodology extends.

- [x] 5a.1 Forward-port `drivers/rtc/rtc-k230.c` from the pinned vendor
      tree to `nix/patches/mainline/rtc-k230.c`, carrying this project's
      own already-board-proven `k230-rtc-mday-mask.patch` fix forward
      directly in the copied file (0xf → 0x1f day-of-month mask) rather
      than reintroducing a bug already found and fixed once. One trivial
      fix needed beyond that: `.remove_new` (a transitional
      `struct platform_driver` field from this file's 6.6-era origin)
      does not exist at `v7.3-rc5` — renamed to `.remove` (the function
      already had the matching `void(*)(struct platform_device *)`
      signature). Built cleanly otherwise, on the first attempt. Added
      `rtc@91000c00` to `nix/dts/k230-tdisplay-mainline.dts`
      (`compatible = "canaan,k230-rtc"`, `status = "okay"`, no
      clocks/resets property — the driver calls neither `devm_clk_get()`
      nor `devm_reset_control_get()` anywhere) and `RTC_DRV_K230 = yes;`
      in `nix/kernel-mainline.nix`.
      Proven: `nix build .#kernelMainline --out-link result-kernelMainline
      --max-jobs 2 --cores 8 --print-out-paths` exited 0, `.config`
      confirmed to carry `CONFIG_RTC_DRV_K230=y` by direct `grep`;
      `nix build .#deviceTreeMainline` still exits 0 and round-trips with
      `rtc@91000c00` present (`dtc -I dtb -O dts`, checked by hand); `nix
      build .#toplevel-mainline-console` and
      `.#kernelMainlineConsoleBootFiles` both still exit 0 with RTC
      included; `nix flake check --no-build` passes. Build proof only.
- [x] 5a.2 Scope (not complete) milestone 2 (display): a scratch trial
      forward-porting the vendor's full `canaan_drv.c`/`canaan_vo.c`/
      `canaan_dsi.c`/`canaan_phy.c`/`canaan_plane.c` + `panel-canaan-
      universal.c` (~3,900 lines, before re-applying this project's own
      ~10 existing patches against the panel/DSI/VO files) was attempted
      as scoping, not as a claimed forward-port. Findings: one Kconfig fix
      (a driver below `if DRM` cannot itself `select DRM` — circular
      dependency; `depends on DRM` instead), one already-removed Kconfig
      symbol (`DRM_KMS_DMA_HELPER`), and then a real, structural DRM API
      change on the very first file checked: `drm_panel_init()` was
      replaced upstream by a refcounted `devm_drm_panel_alloc()`
      allocation model (`include/drm/drm_panel.h`), changing how the
      panel struct itself is allocated, not just a symbol name. This is a
      materially larger class of problem than GPIO/SD-MMC/USB/RTC (DRM
      atomic-modeset/bridge/connector/component-framework churn across
      five interconnected files, plus re-applying this project's own
      panel/DSI/VO patches on top of whatever the ported base ends up
      looking like) and was **not carried to completion** — the trial was
      reverted (`git checkout -- nix/kernel-mainline.nix`, the scratch
      `nix/patches/mainline/drm/` directory deleted) rather than committed
      half-working, since `.#kernelMainline` must stay buildable per this
      change's own spec requirement. `git status`/`git diff` confirm the
      revert is complete and the tree matches the previous commit exactly
      for `nix/kernel-mainline.nix`.

## 5b. Milestone 2 continuation: isolated mainline DRM display

- [x] 5b.1 Port the Canaan DRM/DSI/panel sources against the pinned mainline API, then verify the copied driver objects and required DRM/input Kconfig resolution; preserve the exact command and limits in `docs/evidence/mainline-display-api-compile.md` and its log. After the full-build link exposed missing bridge-helper selections, Canaan Kconfig selects `DRM_DISPLAY_HELPER`/`DRM_BRIDGE_CONNECTOR`; the rerun resolved both symbols and compiled the modules. See `docs/evidence/mainline-display-api-compile.log` and `docs/evidence/mainline-display-full-build.log`.
- [x] 5b.2 Build the complete candidate kernel derivation with `nix build .#kernelMainlineDrm --print-out-paths`; the combined build completed successfully and produced `/nix/store/qa041skh6iy7rmx86c5zfn2xyq036f0g-linux-riscv64-unknown-linux-gnu-7.3.0-rc5` (`docs/evidence/mainline-display-full-build.log`).
- [x] 5b.3a Add a separately named, opt-in mainline DRM display/touch DT source and verify preprocessing, dtc compilation, and round-trip decompilation; record the host-only result and any compiler warnings in `docs/evidence/mainline-display-dtb.md` and its log.
- [x] 5b.3b Build the complete candidate device-tree derivation with `nix build .#deviceTreeMainlineDrm --print-out-paths`; the combined build produced `/nix/store/8v2v53z2qpxapsq507nvxsmld4y24d13-k230-tdisplay-mainline-drm.dtb` (`docs/evidence/mainline-display-full-build.log`).
- [x] 5b.4a Add a separately named boot-files output pairing only the candidate kernel image and DTB; it does not change any normal boot/default output.
- [x] 5b.4b Build and inspect that output with `nix build .#kernelMainlineDrmBootFiles --print-out-paths`; `/nix/store/bpbr6vldkm1y48k6wrdh7s6yv5szqa0k-k230-mainline-drm-boot-files` contains only the candidate Image and DTB, byte-identical to the derivation outputs (`docs/evidence/mainline-display-artifact-inspection.log`).
- [x] 5b.4c Prepare a matching opt-in console trial system and boot bundle with its own initrd, volatile bootargs, closure inventory and registration; document offline root staging and manual U-Boot trial/restoration. Host proof: `nix build .#kernelMainlineDrmTrialBootFiles --no-link --print-out-paths --max-jobs 1 --cores 4` and `nix shell --inputs-from . nixpkgs#dtc --command python3 tools/mainline-drm-trial-inspect.py <output-path>`. The built bundle is `/nix/store/9v5jwcg97kp96jfj6nll4a4yixxzqh2x-k230-mainline-drm-trial-boot-files`; see `docs/evidence/mainline-display-boot-preparation.md` and its log. This does not stage a physical card or satisfy 5b.5.
- [x] 5b.5 After staging a compatible usable root path following `docs/evidence/mainline-display-boot-preparation.md` (the built `kernelMainlineDrmBootFiles` contains only the Image and DTB, with no initrd or root filesystem), reserve the board and perform a recoverable manual U-Boot trial. Capture the serial log with `flock /tmp/k230-board.lock python3 tools/console.py /dev/ttyACM0 --wait=10`, plus a panel photograph and deliberate touch interaction. The candidate's display power-domain behavior remains UNVERIFIED until observed on hardware; the locally forward-ported provider planned in group 5c does not turn a host build into physical proof.
      Next current-image ordinary comparison: [bounded handoff](../../../../docs/research/mainline-autonomous-to-ordinary-init-next-2026-10-05.md); existing begin selectors, no new build. Fresh recovery/actual preparation passed; [physical capture](../../../../docs/evidence/mainline-system-trial/current-p2-ordinary-physical-2026-10-05/README.md) reached mounted sysroot/starting closure lookup but no login in 180s. Subsequent NEW [recovery](../../../../docs/evidence/mainline-system-trial/current-p2-ordinary-physical-2026-10-05/recovery.json) passed; group 5o plans manager logging.
      [Full shell, display and touch evidence](../../../../docs/evidence/mainline-full-shell-2026-10-06/README.md): the guarded system-trial controller replaced the manual U-Boot/console.py procedure. Ordinary root qualified (`candidate-ready-qualified-ordinary-init`) for the console and full coherent-shell variants; panel photographed (console, then Home matching the normal system); deliberate real-finger touch recorded by evtest (533 MT events) with camera. Display power domain observed on (`disp_domain` on, `display-subsystem` active). Limits: controller touch retrieval timed out (counts from raw capture); touch inside sway, audio, power key and Wi-Fi not verified.
- [x] 5b.6 Explicitly scope the display power-domain provider gap: pinned mainline has no `sysctl_power`/`K230_PM_DOMAIN_DISP` provider, so the initial host candidate omitted that unsupported phandle (see `docs/evidence/mainline-display-dtb.md`). Group 5c now adds an isolated local provider; physical display power remains UNVERIFIED.

## 5c. Keep the optional DRM display domain powered

The coordinator authorized this bounded continuation after the source audit
found prior vendor-board evidence (`docs/evidence/dsi-phy-hang.md`) of DSI
all-ones reads and DCS timeouts without a held DISP runtime-PM reference.
Upstream at the pin still lacks the provider; a local port is opt-in only.

- [x] 5c.1 Forward-port the pinned vendor `drivers/soc/canaan/k230-power-domains.c` and its five-domain binding/table into the separate DRM candidate. Keep vendor register/repair semantics; remove unused hardlock state, make controller/domain state per-device, check genpd setup/provider errors and clean up partial registration. Enable only in `kernelMainlineDrm`. Host proof: `nix build .#kernelMainlineDrm --no-link --print-out-paths` and record the source/API/build limits in `docs/evidence/mainline-display-power-domain.md` and its log.
- [x] 5c.2 Add the matching binding header/provider node at the vendor's `0x91103000` register range and connect only the candidate's logical display subsystem to `K230_PM_DOMAIN_DISP`. Retain existing clock/reset choices. Host proof: `nix build .#deviceTreeMainlineDrm --no-link --print-out-paths`, round-trip the DTB, and inspect the provider reg/cells and consumer phandle in the evidence log. Passed: `/nix/store/nxbrd4smrcmknipjn4hjk32n87p4g9k6-k230-tdisplay-mainline-drm.dtb`; provider phandle `0xd`, consumer `<0xd 2>`, register tuple `<0 0x91103000 0 0x1000>`, one domain cell, two existing single-child graph warnings.
- [x] 5c.3 Preserve the DRM master's probe-time held runtime-PM reference, but handle a failed resume and release/disable on probe failure and removal. Host proof: `nix build .#kernelMainlineDrm --no-link --print-out-paths`; source/API/build proof only. Passed: `/nix/store/i77i3ppi72k9hw0v2xmnhilc3q7rvv50-linux-riscv64-unknown-linux-gnu-7.3.0-rc5`; full kernel log includes the provider and DRM master object compilations.
- [x] 5c.4 Rebuild `nix build .#kernelMainlineDrmTrialBootFiles --no-link --print-out-paths` and run `nix shell --inputs-from . nixpkgs#dtc --command python3 tools/mainline-drm-trial-inspect.py <output-path>`. Record exact bundle/system/kernel paths, unchanged default/console inputs, and the retained 5b.5 physical gate. Validate with `openspec validate the-board-runs-a-mainline-kernel --strict`. Passed: bundle `/nix/store/gf3aqks2dg0z3ksz33ysfprnlbk83vw3-k230-mainline-drm-trial-boot-files`, system `/nix/store/k9f4r2i9k9qj58z8z4l2kssy9rpwxxm1-nixos-system-nixos-26.11.20260919.20b1ddd`, kernel `i77i3ppi72k9hw0v2xmnhilc3q7rvv50`; matching artifact/CRC checks and `nix flake check --no-build` passed. Source/build evidence only; 5b.5 remains unchecked.

## 5d. Recoverable optional mainline restart

The source audit is committed in
`docs/evidence/mainline-display/physical-2026-10-01/mainline-restart-source-audit-2026-10-02.md`.
The vendor restart sequence is read-source grounding; its behavior in this
mainline candidate remains UNVERIFIED. This group does not close 5b.5.

- [x] 5d.1 Add a narrow vendor-derived restart patch to `kernelMainlineDrm` only. Preserve the vendor `0x91102060` register, bits 0/16, priority 128 and terminal wait; use the pinned managed sys-off API, checked probe-time mapping/registration and cleanup. Compile the changed reset object against pinned prepared headers and prove Nix patch application/evaluation; record exact reproducible commands, source hashes and limits in `docs/evidence/mainline-restart/README.md`. Proof: `bash docs/evidence/mainline-restart/object-check.sh` and `nix build .#kernelMainlineDrm.src --no-link --print-out-paths` (source derivation only; not a complete kernel or hardware reset). Passed on 2026-10-02: patched source `vnzm30w6v4na0ylpw8vclyn7dn9vvkf0`, host LLVM 22.1.8 prepared-header RISC-V object with `W=1` and no warnings; exact commands/hashes/limits are committed in the named evidence. The first full GCC run found `-Werror=return-type`; the vendor unreachable zero return is restored as `NOTIFY_DONE`, and corrected source `jvz4v73g8a67pqwm06v079h6s1cpqr9s` passes the pinned GCC 15.3.0 object check with `W=1`. The failed complete run remains recorded separately.
- [x] 5d.2 Reserve the shared build slot and build the exact patched complete candidate. Proof: `flock /tmp/k230-nix-build.lock nix build .#kernelMainlineDrm --no-link --print-out-paths --max-jobs 1 --cores 16`; preserve the full log, Image SHA-256, store path and effective reset config. Full Nix build proof only. Passed: corrected kernel `4wkhxf55y1abg1kg2xd0acsfjqr64j0h`, Image SHA-256 `70a81b2172710c64463b53693e2e505a4d82ae2f7b644b2fc93cee9016b05330`; full corrected and failed GCC logs are committed separately.
- [x] 5d.3 Build and inspect the matching trial bundle and compare vendor/default/console-only derivation identities with the base. Proof: `flock /tmp/k230-nix-build.lock nix build .#kernelMainlineDrmTrialBootFiles --no-link --print-out-paths --max-jobs 1 --cores 16`, then `nix shell --inputs-from . nixpkgs#dtc --command python3 tools/mainline-drm-trial-inspect.py <bundle-path>` and `openspec validate the-board-runs-a-mainline-kernel --strict`. Record exact kernel/system/initrd/DTB/bundle identities and unchanged default outputs in `docs/evidence/mainline-restart/README.md`. Passed: bundle `asj7l4zj5jrjkgng4nrcx3y72p7jf7aa`, system `v9qc1sf0iz53s3x6g6vwfyaxghkfpnyk`; inspector verifies Image/DTB/initrd/CRC and 629-path inventory. Nine base-relative vendor/default/console derivation identities match; corrected-source flake evaluation and strict OpenSpec validation pass. This does not stage or boot the board.
- [x] 5d.4 After source review and matching bundle proof, the board operator performs a recoverable trial with the protected normal boot selection retained. Proof: serial capture using `flock /tmp/k230-board.lock python3 tools/console.py /dev/ttyACM0 --wait=10`, plus the exact named controller invocation and matching artifact hashes. Require a real kernel restart request, subsequent U-Boot SPL/normal-system boot, a fresh boot ID, protected normal identities/hashes and shell postflight. Commit transcript/timestamps/limits under `docs/evidence/mainline-restart/`. A systemd chroot refusal, manual power cycle or host build does not satisfy automatic restart; physical restart stays UNVERIFIED until observed. Keep 5b.5 open for usable mainline root and deliberate touch.
      Physical proof on 2026-10-02: the exact named minimal runtime-trace comparison with volatile `clk_ignore_unused` returned a real kernel restart, subsequent SPL/normal boot, fresh boot ID, exact protected identities, three active shell services and eight unchanged hashes. Controller exit 0; command, selected artifacts, transcript excerpt, raw hash/timestamp and reviewed normal Home are committed in `docs/evidence/mainline-restart/physical-clock-comparison-2026-10-02/README.md`. This qualifies the diagnostic boot only: baseline without the flag still stalls, permanent global bypass is not enabled, and proper SD1 clock consumers plus restart without the flag remain necessary before usable-root/touch task 5b.5 can close.
      Subsequent no-bypass physical proof: the targeted five-clock candidate `9vdk79…` / `5yqilsfy…` / `9gdms…` passed ordinary unused-clock cleanup, runtime tracing and real automatic restart → SPL → protected normal postflight with controller exit0, fresh bootID, three services and eight unchanged hashes, without `clk_ignore_unused`. Exact command/artifacts/transcript/hash/timestamp are committed in `docs/evidence/mainline-sd1-clocks/physical-no-flag-2026-10-03/README.md`. Ordinary root and deliberate touch stay open in5b.5.
      Host preparation on 2026-10-02: minimal-only `--debug-shutdown` adds volatile `initcall_debug loglevel=8` to the existing exact `asj7l4zj5jrjkgng4nrcx3y72p7jf7aa` bundle, with exact printed-bootargs validation and a fresh rolling recovery buffer. The 71-test controller suite and strict change validation pass; source checkpoints, operator command, and host-only limits are recorded in `docs/evidence/mainline-restart/shutdown-debug-host-preparation-2026-10-02.md`. This does not perform or complete automatic restart verification.

## 6. Confirm no existing output changed

- [x] 6.1 Confirm `.#kernel`, `.#deviceTree`, and
      `.#nixosConfigurations.k230.config.system.build.toplevel` are
      unaffected: `git diff --stat 4ffe809a1b448f98379ea1165d7bca067d01cfdb`
      against this change's base revision shows exactly 11 files changed,
      917 insertions(+), 0 deletions(-) — six new files
      (`docs/research/mainline-kernel-inventory.md`,
      `nix/device-tree-mainline.nix`, `nix/dts/k230-tdisplay-mainline.dts`,
      `nix/kernel-mainline-src.nix`, `nix/kernel-mainline.nix`, plus
      additive-only lines in `flake.nix`) and five new OpenSpec change
      files. `git diff --stat ... -- nix/kernel.nix nix/kernel-src.nix
      nix/device-tree.nix nix/k230.nix nix/hardware.nix nix/sd-image.nix`
      returns empty. Confirmed by direct inspection, not by rebuilding
      those unaffected derivations (their own existing evidence already
      covers them; a change that touches none of their inputs cannot
      invalidate it).

## 7. Publish

- [x] 7.1 Validate with `openspec validate the-board-runs-a-mainline-kernel
      --strict`, checking the exit code directly (never via a pipe), per
      AGENTS.md.
- [x] 7.2 Commit the proposal, design, tasks, spec delta, research
      document, and the new `nix/`/`flake.nix` files together on
      `feat/mainline-kernel`, and report the branch/base/commit hash to the
      coordinator for an early merge to `master`, per AGENTS.md's "keep
      changes moving".

## Remaining evidence gate (explicitly not performed by this change)

Reaching a serial console — and now, potentially, a full NixOS login prompt
over SD — on real hardware is a **hardware milestone**, not a host build,
per `.skills/k230-spec-change/SKILL.md`'s QEMU-vs-hardware distinction.
This change does not touch `/dev/ttyACM0`, does not request a board slot,
and does not claim either gate. The operator command a future change (or
the coordinator, directly) would run once a board slot is free:

```
flock /tmp/k230-board.lock python3 tools/console.py /dev/ttyACM0 --wait=10
```

Two staged artifacts now exist, testing two different claims — do not
conflate them:

1. **`result-kernelMainlineBootFiles`** (task group 4): console-only,
   no drivers beyond UART0. `ext4load` its `Image-mainline` and
   `k230-tdisplay-mainline.dtb`, `bootm`/`booti`, expect OpenSBI + Linux
   boot output and then a panic for lack of a root filesystem (no rootfs
   staged; this is a legible-boot-output test, not a login test).
2. **`result-kernelMainlineConsoleBootFiles`** (task group 5): the
   milestone-1 candidate, with GPIO/SD-MMC/USB forward-ported and this
   system's bootargs+initrd baked in. `ext4load` its `Image-mainline`,
   `k230-tdisplay-mainline.dtb`, and `initrd.uimg`, `bootm`/`booti` all
   three. Its pass condition is a real login prompt over the SD card's
   existing `NIXOS_SD`-labeled root partition — genuinely unverified
   whether the by-label root resolves, whether `&mmc_sd1` actually probes
   with the clock/reset IDs `nix/dts/k230-tdisplay-mainline.dts` guessed,
   and whether this system's own toplevel closure/profile even exists on
   that partition (see `nix/kernel-mainline-boot-files.nix`'s own header:
   this derivation does not populate the card, only produces what a
   separate staging step would load). A failure here is expected to be
   informative (which stage failed) rather than a clean pass on the first
   try, and should be recorded as such rather than retried silently.

No rootfs is staged by test 1; a kernel panic for lack of one, with
legible OpenSBI + Linux boot output first, is that test's actual pass
condition (see `docs/research/mainline-kernel-inventory.md`'s phased plan,
milestone 2).

## 2026-10-01 physical attempt (5b.5 remains open)

Exact matching bundle rebuilt, staged as a registered GC-rooted closure, and manually booted with per-load count/CRC checks. Linux 7.3.0-rc5, DRM/fb0 and photographed boot text are observed; Goodix registers. Both temporary boots stop in initrd before root login, including a repeat with direct initrd console diagnostics; no deliberate touch events were obtained. See `docs/evidence/mainline-display/physical-2026-10-01/README.md` and `result.json`; task 5b.5 stays unchecked pending usable root, physical touch and committed normal restoration. No persistent normal boot selection was changed.

The first bounded `rdinit=/bin/sh` diagnosis reached the PID1 shell but
failed command resolution because PATH was absent; its partition-label value
is invalid as hardware evidence. The controller now supplies volatile PATH
and an absolute reboot command. One corrected-path trial then reached the
Linux 7.3.0-rc5 banner but did not return its complete fresh-token probe
marker. One standalone `K230_PROC` marker appeared; later proc/device/label
and reboot markers did not. No disk or IRQ conclusion follows. A subsequent
physical power-cycle was checked against the protected normal system and all
eight hashes. The controller, sanitized attempt record and proof limits are
recorded in
`docs/evidence/mainline-display/physical-2026-10-01/initrd-shell-diagnostic.md`.

The 2026-10-02 physical power-cycle after the corrected-path trial restored
the selected normal system with a fresh boot ID, exact system/profile/kernel/
init, three active shell services and eight unchanged protected hashes. See
`docs/evidence/mainline-display/physical-2026-10-01/corrected-probe-recovery-2026-10-02/README.md` for committed identity and reviewed visible Home proof. Mainline task 5b.5 stays open
for usable root login and deliberate touch evidence. These captures show the
normal vendor-kernel system, not a working mainline shell.

The host controller now waits for one of at most eight fresh-token built-in
receipt attempts, then requires `/bin/true`, volatile `/proc` directory setup,
and proc mount RC success before reading uptime or requesting reboot. Failed
prerequisites stop with a structured recovery-required result; the full device
survey requires explicit mode. This source/test follow-up has not been run on
hardware and does not change task 5b.5 evidence status. The preceding physical
minimal attempt remains documented as failed, with later independent normal recovery verified, in
`docs/evidence/mainline-display/physical-2026-10-01/minimal-probe-2026-10-02/README.md`.


## 2026-10-02 bounded root-label controller preparation

Task 5b.5 remains unchecked. The explicit candidate selector and gated
`--mode label` controller now pass 49 host tests, including actual sh/bash
execution of the generated device-mount payload against isolated fixtures.
Evidence: `docs/evidence/mainline-display/physical-2026-10-01/candidate-controller-host-2026-10-02.md`
and `docs/evidence/mainline-display/physical-2026-10-01/label-controller-host-2026-10-02.md`.
The label mode accepts one read-only root-partition label check only after
receipt, external-command, proc/uptime, devtmpfs and block-node gates. Unknown
completion stops input and leaves recovery unverified. The optional
`--ignore-unused-clocks` flag adds only a volatile argument for the published
source-audit comparison; it is not a permanent clock policy.
No new board trial or usable-root/touch proof is supplied by these host checks.
The operator must first review the matching restart bundle and prove its
automatic protected-normal return before relying on recovery for label trials.

The bounded `--mode root-mount` follow-up repeats the minimal/device/label gates
before one `ro,noload` root mount, strict mount-flag checks and executable
lookups for the selected system's init/prepare-root, without executing either.
Known mounts receive one bounded unmount; unknown completion stops all input
and leaves recovery unverified. Its 62 host tests include actual isolated sh/bash
mount-table and stub-utility execution. Evidence:
`docs/evidence/mainline-display/physical-2026-10-01/root-mount-controller-host-2026-10-02.md`.
This does not perform ordinary `/init` activation or close task 5b.5; matching
bundle review and physical automatic recovery remain prerequisites for the
operator's root-mount trial. The optional clock flag remains label-only.

## 2026-10-03 complete read-only root prerequisite

Task 5b.5 remains unchecked. The targeted five-clock candidate now passes the
whole corrected `--mode root-mount` protocol without a clock-ignore flag:
read-only/no-journal mount, exact flags, selected init/prepare-root executable
lookups, unmount and one automatic protected-normal return. Command and
physical result are committed in
`docs/evidence/mainline-sd1-clocks/physical-no-flag-2026-10-03/README.md`.
The earlier paused session needed the user's reset after fresh UART checks
received no response; that separate recovery is recorded explicitly.

The reviewed ordinary-init controller (`tools/mainline-drm-system-trial.py`)
has landed with host proof and protected begin/touch/finish phases; the
coordinator independently passed 122 combined tests. Its physical trial is
separate from the returned read-only prerequisite. Ordinary NixOS activation,
deliberate glass touch and protected recovery remain required before 5b.5
can close. Neither the initrd shell nor host tests establish those outcomes.

The first physical ordinary-init attempt subsequently reached initrd
systemd/udev and timed out after 180 seconds without login. No touch or
reboot retry was sent; recovery is pending operator reset and protected
postflight. See `docs/evidence/mainline-system-trial/physical-2026-10-03/README.md`.
This failure leaves task 5b.5 open.

The user subsequently reset the ordinary-trial board; fresh protected normal
postflight passed exact identities, three services and eight unchanged boot
hashes. That operator recovery is now recorded in the same physical packet.
The full mainline initrd stopping point remains unresolved; 5b.5 stays open.


## 2026-10-03 standalone udev metadata proof

The same candidate now passes one bounded `udevadm test-builtin blkid` on the
verified SD1 root partition, including unique ext4/NIXOS_SD properties,
private raw-output preservation and one automatic protected-normal return.
Exact operator command and physical result are in
`docs/evidence/mainline-blkid-trial/physical-2026-10-03/README.md`.
This narrows the unresolved ordinary-init/coldplug boundary; it does not prove
whole-device discovery or close 5b.5. The source-supported next observation is
`docs/research/mainline-initrd-debug-console-2026-10-03.md`; its controller and
physical initrd state/recovery proof are separate required work.


## 2026-10-03 debug-console readiness observation

The bounded debug controller reached the fresh mainline/systemd primary shell
prompt, but asynchronous boot messages followed it immediately. Its tail-only
readiness check timed out before sending any diagnostic command. The user reset;
protected normal recovery and qualified Home IPC passed. Exact command, result
and limits are in
`docs/evidence/mainline-system-trial/debug-readiness-physical-2026-10-03/README.md`.
The prompt-recognition correction needs host review and a separate physical
rerun; initrd unit/worker state is still UNVERIFIED and 5b.5 stays unchecked.


## 2026-10-03 corrected prompt / unacknowledged receipt

The corrected debug readiness check recognizes the fresh primary prompt, but
the first framed receipt has no command echo or reply within ten seconds. No
identity guard, snapshot or reboot followed. The user reset; protected normal
postflight and Home IPC passed. See
`docs/evidence/mainline-system-trial/debug-receipt-physical-2026-10-03/README.md`.
Debug-terminal setup and the exact UART receive boundary need source comparison
before another physical retry; no IRQ/clock/terminal cause is claimed. Ordinary
root, deliberate touch and 5b.5 remain open.


## 2026-10-03 autonomous observer READY boundary

The separately built observer bundle passed actual Image/DTB/ramdisk/archive
and closure inspection, staging and protected normal preflight. Its physical
trial produced one complete fresh READY frame, then no counter frame, primary
prompt or return. The host sent zero receipt commands; the bounded passive
wait ended without automatic recovery. The user reset; protected normal postflight
and qualified Home IPC passed. Automatic return remains UNVERIFIED. Exact
artifacts, command, timestamps,
raw-log digest and limits are in
`docs/evidence/mainline-system-trial/uart-observer-physical-2026-10-03/README.md`.
No helper, UART, console or kernel cause is inferred. Ordinary usable root,
panel photograph, deliberate glass touch and task 5b.5 remain open.


## 2026-10-03 serial-only pre-init comparison

The reviewed controller removed only volatile `console=tty0` while retaining
the same built/staged Image, hardware DT, initrd and helper. Protected normal
preflight, loads/CRCs and exact printed arguments passed. Linux reached display
and Goodix registration, then clock/power-domain/ALSA milestones; no init or
systemd banner, observer frame or automatic return was observed. Zero receipt
commands were sent. The user reset; protected normal postflight and qualified
Home IPC passed. Automatic return remains UNVERIFIED. Exact
command/artifacts/timestamps/limits are in
`docs/evidence/mainline-system-trial/uart-observer-serial-console-physical-2026-10-03/README.md`.
No clock, power-domain, UART or console cause is claimed; further source
discrimination is required. Usable root, panel/touch and task 5b.5 stay open.

## 2026-10-03 retained SBI boot-console host preparation

The user authorized the same-image comparison before a diagnostic kernel
rebuild. The observer controller now accepts explicit `--sbi-boot-console`
only with `--serial-console-only`, adding exactly volatile
`earlycon=sbi keep_bootcon` while retaining all artifact, identity, printed
argument and recovery gates. Strict observer parsing is unchanged; duplicate
readiness still sends zero receipts. The 38 focused tests and actual selected
artifact preparation pass. Commands and limits are in
`docs/evidence/mainline-uart-observer-trial/sbi-boot-console-host-2026-10-03.md`.
Host proof does not diagnose the boot stall or prove automatic return; the
separate physical comparison and task 5b.5 remain open.

## 2026-10-03 retained SBI boot-console physical boundary

The same-image serial-only comparison with volatile `earlycon=sbi keep_bootcon`
passed protected normal preflight, loads/CRCs and printed arguments. Fresh
mainline output confirmed SBI DBCN detection and actual SBI boot-console
enablement; subsequent messages were duplicated. Output ended at the ALSA
milestone (3.838138), with no visible init launch, systemd, observer frame or
automatic return. Zero receipts were sent; the bounded passive trial exited 2.
The user reset; protected normal postflight, qualified Home IPC and a private
camera observation of Home passed. Automatic mainline return remains
UNVERIFIED. Exact command, artifact hashes, sanitized
observations and limits are in
`docs/evidence/mainline-system-trial/uart-observer-sbi-boot-console-physical-2026-10-03/README.md`.
The trial does not identify a cause; optional kernel boundary markers are the
next source-supported diagnostic. Task 5b.5 stays unchecked.


## 2026-10-03 optional kernel boot-boundary host preparation

Within open task 5b.5, the user authorized finite paired kernel markers after
same-image console comparisons failed to reach usable init. Separate
`kernelMainlineBootTrace`, `k230-mainline-boot-trace` and
`kernelMainlineBootTraceTrialBootFiles` outputs add serial-only ordinary init
and exact `k230.boot_trace=1`; existing outputs/controllers are unchanged.
Seven native flag/emergency/cap tests, zero-fuzz source application, a real
RISC-V `main.o` API/lifetime check, narrow Nix evaluation and nine unchanged
existing derivation identities passed. Commands, pins and limitations are in
`docs/evidence/mainline-system-trial/boot-boundary-host-2026-10-03.md`.
Full kernel build/artifact inspection and physical marker/init/root/recovery/
touch proof remain UNVERIFIED. An enter-only marker is only the last visible
boundary; the marker itself can block. Task 5b.5 stays unchecked.

## 2026-10-03 matching boot-boundary bundle host proof

The opt-in `kernelMainlineBootTraceTrialBootFiles` full build passed at source
`7e1e3a60d7ebf607a8312324ae890b97f089b3d1`, producing `cr8bv4s6…` with kernel
`908wxcz…` and system `dxwjvz…`. Exact Image/initrd/DT/CRC/closure inspection
and actual ordinary controller preparation passed. The actual built config
has KUnit disabled; the five-clock hardware DT is unchanged except bootargs.
See `docs/evidence/mainline-system-trial/boot-boundary-build-2026-10-03/README.md`
and its result JSON for commands, paths, hashes and remaining physical gates.
No board was used for this increment; marker output/root/touch/return remain
UNVERIFIED and task 5b.5 remains unchecked.

## 2026-10-03 physical boot-boundary attempt

The exact optional trace bundle passed staging and protected normal preflight,
then emitted basic-setup-enter, initcalls-enter and initcalls-exit on the board.
It produced no next marker or ordinary login within 180 seconds; controller exit 1
closed UART without further candidate input. There is no original blocking work
between the visible post-initcall marker and the missing basic-setup-exit marker,
but the visible marker's own return/flush/scheduling is not proved. See
`docs/evidence/mainline-system-trial/boot-boundary-physical-2026-10-03/README.md`
and result JSON. The user pressed reset and protected normal recovery is verified: fresh boot,
exact normal identities, three active services, eight unchanged files and
registration absent. Automatic return remains UNVERIFIED; ordinary root/panel/
glass touch and task 5b.5 stay open.

## 2026-10-03 separate direct-SBI boundary source proof

The reviewed optional `kernelMainlineBootTraceSbiTrialBootFiles` source adds
four single-attempt public DBCN records around the two printk marker calls
identified by the physical attempt. It preserves all twelve existing output
identities, including the original trace kernel/system/bundle; there is no new
console registration or retry/fallback loop. Ten focused native tests, actual
RISC-V object/API/lifetime/alignment proof and Nix/strictspec checks passed.
See `docs/evidence/mainline-system-trial/boot-boundary-sbi-host-2026-10-03.md`
for exact commands, source paths and interpretation limits. Full matching build
and physical direct-SBI output/root/login/touch/return remain UNVERIFIED; the
user-reset recovery of the previous diagnostic is verified. Task5b.5 stays open.

## 2026-10-03 direct-SBI matching full build proof

`kernelMainlineBootTraceSbiTrialBootFiles` built successfully at source `007410ee`,
producing `j0ad6h3s…` with kernel `f7h2n15…` / system `zcsfgwk…`. Matching Image/
initrd/DT/CRC/closure inspection and actual ordinary-controller preparation
passed. Four public SBI record strings are linked; actual RISCV_SBI/64BIT/
VMAP_STACK/4KiB/KUnit disabled config and hardware DT equality are recorded in
`docs/evidence/mainline-system-trial/boot-boundary-sbi-build-2026-10-03/README.md`.
No board was used for this increment. Physical direct-SBI output/root/touch/
return stay UNVERIFIED and task 5b.5 stays unchecked.

## 2026-10-03 physical direct-SBI boundary attempt

The exact direct-SBI bundle passed staging and protected normal preflight,
then emitted all four direct records plus legacy seq1–4. Both suspect marker
helpers and `do_basic_setup()` returned; the final `basic-after` ECALL return
and entry to the next marker/initramfs wait remain unknown. No login arrived
within 180 seconds; controller exit1 closed UART without further input. See
`docs/evidence/mainline-system-trial/boot-boundary-sbi-physical-2026-10-03/README.md`
and result JSON. The subsequent user-confirmed reset received zero UART bytes
in90seconds and no fresh normal prompt; no Linux command was sent. The camera
shows a dark panel with observation limits. `operator-reset-check.json` records
this failed check; power-cycle confirmation is pending. Protected recovery,
ordinary root/panel/glass/production and task 5b.5 remain open.


## 2026-10-03 separate SBI-only diagnostic source proof

The reviewed optional `kernelMainlineBootTraceSbiOnlyTrialBootFiles` layers
over the original trace source and selects single-attempt fixed public SBI
records at all twenty existing diagnostic sites. Enabled mode skips only
the diagnostic helper's printk/emergency operations; regular kernel logging
is unchanged. Eleven focused /28 combined native tests, actual RISC-V object/
lifetime/table layout, exact source order, narrow Nix evaluation and all
fifteen previous derivation identities passed. See
`docs/evidence/mainline-system-trial/boot-boundary-sbi-only-host-2026-10-03.md`.
The source has landed; full matching bundle build and physical output/root/
touch/return remain UNVERIFIED. The preceding reset check failed with zero
UART bytes; protected normal recovery must pass before another board trial.
Task5b.5 stays open; visible SBI bytes do not prove the last ECALL returned.


## 2026-10-03 subsequent normal recovery / SBI-only full build

The user's second confirmed reset passed fresh protected normal postflight,
unchanged identities/eight files, three active services and registration
absence. Home IPC returned RC0 and reviewed private camera shows normal Home;
see `docs/evidence/mainline-system-trial/boot-boundary-sbi-physical-2026-10-03/operator-reset-recovery.json`.
This is operator recovery; automatic return from the failed trial stays
UNVERIFIED. The matching SBI-only bundle `brmp1qf9…` built successfully,
with actual config/source/all20 linked strings, hardwareDT, Image/initrd/CRC/
closure and ordinary-controller host preparation checks passed. See
`docs/evidence/mainline-system-trial/boot-boundary-sbi-only-build-2026-10-03/README.md`.
SBI-only physical output/login/root/glass/automatic return remain UNVERIFIED;
5b.5 stays open before the separately reserved board attempt.


## 2026-10-03 SBI-only physical boundary

The matching SBI-only bundle passed staging and protected normal preflight,
then emitted five complete fixed labels through `initramfs-wait-enter`, with
zero legacy markers. No exit/login followed within 180 seconds; controller exit 1
released UART with no further input. The preceding basic-setup SBI call
returned; the last ECALL return and actual wait entry remain unknown. The
external `Unpacking initramfs...` printk was visible, with no completion proof.
See `docs/evidence/mainline-system-trial/boot-boundary-sbi-only-physical-2026-10-03/README.md`
and result JSON. Operator reset recovery is pending; automatic return,
ordinary root/panel/glass and 5b.5 remain open. Read-only audit is evaluating
a same-Image `initramfs_async=0` comparison before another kernel rebuild.


## 2026-10-03 same-image initramfs/initcall controller opt-in

Independent source audit supports one volatile `initramfs_async=0` token
as the next bounded discriminator: the same worker is scheduled, then the
rootfs initcall joins it before later initcalls. The controller's reviewed
begin-only `--wait-initramfs-in-initcall` preserves exact artifact/identity/
CRC/argument/state/recovery gates and the 180-second passive deadline.
Corrected focused 29 tests, actual matching-bundle prepare/unchanged drv,
strict/all validation and whitespace checks passed. Evidence and exact
operator command: `docs/evidence/mainline-system-trial/initramfs-initcall-controller-host-2026-10-03.md`.
This is host proof only. Current candidate reset recovery and the new
physical comparison remain UNVERIFIED; ordinary root/glass/return and 5b.5
stay open. No kernel rebuild, board command or production fix is claimed.


## 2026-10-03 SBI-only operator recovery verified

The user hit reset and fresh protected normal postflight passed exact
identities, three services, all eight unchanged files and registration
absence. Home IPC returned RC0; reviewed private camera shows normal Home.
See `docs/evidence/mainline-system-trial/boot-boundary-sbi-only-physical-2026-10-03/operator-reset-recovery.json`.
Automatic return from the failed candidate remains UNVERIFIED. Reviewed
controller `1846fd3e` and its29 focused tests passed CI; the same-image
initramfs comparison is ready for a separately reserved physical attempt.
Ordinary root/glass/production and5b.5 remain open.


## 2026-10-03 physical initramfs/initcall comparison

The exact same staged bundle with one volatile `initramfs_async=0` argument
passed protected preflight/loads/CRCs/printed arguments and emitted18 fixed
records through `init-exec-exit`, including the earlier rootfs join and later
initramfs wait completion. No login arrived in180seconds; controller exit1
released UART without further input. `kernel_execve()` returned but retval,
last SBI return and first userspace instruction are unknown. See
`docs/evidence/mainline-system-trial/initramfs-initcall-physical-2026-10-03/README.md`
and result JSON. Operator reset recovery is pending; ordinary root/panel/
glass/automatic return and5b.5 stay open. Read-only source audit recommends
a same-image no-marker comparison preserving async=0 and normal logging;
reviewed controller support is required before another boot.


## 2026-10-03 initramfs comparison operator recovery verified

The user reset after the failed18-record comparison. Fresh protected normal
postflight, exact identities/eight files/three services/registration absence
passed; Home IPC returned RC0 and a newly reviewed private camera shows Home.
See `docs/evidence/mainline-system-trial/initramfs-initcall-physical-2026-10-03/operator-reset-recovery.json`.
This proves operator recovery only; automatic return, mainline root/panel/glass
and task 5b.5 remain UNVERIFIED. Board/UART and camera are released.


## 2026-10-03 reviewed same-image marker-free controller

The begin-only `--without-boot-markers` opt-in requires the earlier initramfs
join selector and removes both original qualified trace-enable tokens only.
Same Image/closure/DT/logging/controls and exact identity/CRC/arguments/typed
resume/recovery/180-second unknown gates remain. Literal transport is safe
and below 512 bytes before first input. 36 focused tests passed independently;
actual realized-bundle prepare differs only by the two removed tokens and
uses 317 bytes. Narrow proof and operator command:
`docs/evidence/mainline-system-trial/marker-free-controller-host-2026-10-03.md`.
Host proof only; physical root/panel/glass/return and 5b.5 remain UNVERIFIED.


## 2026-10-03 marker-free physical comparison

Same staged Image/initrd/DT/closure with initramfs_async=0 retained and both
marker flags removed passed preflight, five loads/CRCs and exact printed plus
kernel-received arguments. No diagnostic records, as expected; unpacking,
initrd-free and unused-kernel-image-free messages appeared, but no systemd/login
within 180 seconds. Exit 1 released UART without further input. New private
camera appears dark with documented limits. See
`docs/evidence/mainline-system-trial/marker-free-physical-2026-10-03/README.md`
and fixed result JSON. Another operator reset/protected normal postflight is
pending. Source audit suggests a separately reviewed same-initrd Bash-PID1
comparison, not ordinary-root acceptance. 5b.5 remains unchecked; mainline
root/panel/glass/automatic return and production remain UNVERIFIED.


## 2026-10-03 marker-free comparison operator recovery verified

The user pressed reset after the failed marker-free trial. Fresh protected
normal postflight passed exact identities, all eight files, three services
and registration absence; Home IPC returned RC0 and a new reviewed private
camera shows normal Home. See
`docs/evidence/mainline-system-trial/marker-free-physical-2026-10-03/operator-reset-recovery.json`.
This is operator recovery only. Automatic return, mainline ordinary root,
panel/glass and task 5b.5 remain UNVERIFIED. Board/UART/camera are released;
the next guarded same-image Bash-PID1 controller increment is host work.


## 2026-10-03 reviewed same-image Bash PID1 controller

The explicit minimal-only `--same-image-shell-pid1` selector uses the same
qualified marker-free/async=0 bundle and three controls, adding only
`rdinit=/bin/sh`. Original artifacts, archived Bash/systemd/common loader,
safe literal transport before UART and exact printed arguments are checked.
Fresh Linux/init-entry/prompt/receipt precede proc/uptime and strict PID1/root/
Bash/kernel/cmdline/new-boot/initrd guards, renewed before one acknowledged
reboot. Both protected normal phases assert registration absence. Unknown
stops input; ordinary init is NOT_ATTEMPTED. Independent review approved;
14 focused and all 214 existing trial tests passed, strict/all56 validation
and exact realized-bundle single-variable preparation passed. Narrow commands
and operator gate:
`docs/evidence/mainline-system-trial/shell-pid1-controller-host-2026-10-03.md`.
CI covers ordinary/minimal/new focused tests. Physical shell receipt/automatic
return are still UNVERIFIED; ordinary root/panel/glass and task 5b.5 stay open.


## 2026-10-03 same-image Bash physical prompt, reception unknown

Reviewed source/CI bfce9f8b passed a reserved single trial's protected preflight,
five loads/CRCs and exact printed plus kernel-received arguments. Fresh Linux,
Run /bin/sh and primary sh-5.3 prompt prove Bash userspace startup. Eight bounded
builtin receipt attempts produced no replies/echoes; exit 2 at reception
released UART with no further input. True/proc/uptime/full identity/reboot were
NOT_ATTEMPTED. See
`docs/evidence/mainline-system-trial/shell-pid1-physical-2026-10-03/README.md`
and fixed result JSON. New private camera appears dark with explicit limits;
serial startup proof is separate. A subsequent new user reset and checker
exit 0 proved a fresh protected normal boot, exact system/profile/kernel/init,
eight unchanged files, three active services and registration absence. Home
IPC completed with exit 0 and a new privately reviewed camera frame shows
normal Home; see the packet's `operator-reset-recovery.json`. Board/UART and
camera are released. This proves operator recovery, not automatic return.
Read-only audits recommend a finite independent cached UART/IRQ/time reporter,
not a blind shell retry or TTY poll. Ordinary root/panel/glass/automatic return
and task 5b.5 remain UNVERIFIED; no archive or production fix is claimed.

## 5f. Finite independent UART/IRQ progress diagnosis (planned, no physical claim)

- [x] 5f.1 Add separately selected runtime-gated kernel source/configuration:
      normal-priority finite worker, lifecycle-safe cached 8250 snapshot,
      actual mapped timer/UART IRQ accounting and aligned bounded public SBI
      records outside all locks. No MMIO/TTY/settings/critical-path output.
      Source/protocol proof: `python3 tests/test_mainline_uart_progress.py`.
      Twelve actual-code native fixtures pass; the optional effective Kconfig
      resolves built-in reporter/dependencies and 22 existing output identities
      are unchanged. [Source/config/object evidence](../../../../docs/evidence/mainline-uart-progress/source-object-host-2026-10-03.md).
      At this initial source proof, the full matching build and physical observations were UNVERIFIED; later host build proof is recorded in 5f.2–3.
- [x] 5f.2 Compile the changed 8250/timer/reporter objects against the exact
      configured RISC-V headers and verify record layout/lifetime/Kconfig.
      Host-only proof: `nix build .#kernelMainlineUartProgressExactObjects --no-link --print-out-paths`.
      Three changed RISC-V objects compile against immutable installed base
      headers plus an explicit reporter overlay; preliminary layout/API proof passed.
      ExactObjects subsequently passed against the actual selected kernel.dev
      config/autoconf without an overlay; all three ELF/lifetime/layout checks
      passed. [Exact/full host proof](../../../../docs/evidence/mainline-uart-progress/exact-full-host-2026-10-03.md).
- [x] 5f.3 Build the complete optional matching system/initrd/DT/bundle and
      inspect hashes/CRCs/closure/config and unchanged existing derivations.
      Host-only proof: `nix build .#kernelMainlineUartProgressTrialBootFiles --no-link --print-out-paths`
      followed by `python3 tools/mainline-drm-trial-inspect.py BUNDLE`.
      Root's frozen 35e93757 matching build passed; gmsmqk bundle inspection,
      Image/system/initrd/DT/CRCs/closure/config checks and hardware-DT comparison
      passed. Existing identity receipts remain separate from physical proof;
      no UART/receipt/root/touch/recovery result is claimed.
- [x] 5f.4 Add a reviewed explicit minimal-shell/controller opt-in, exact
      original artifact and runtime argument qualification, at most one fresh
      receipt stimulus, bounded passive record capture, fixed public parser,
      missing/duplicate/unknown-no-input policy and protected recovery gates.
      Require the same selected kernel derivation's already-realized dev
      config before UART; exactly match its fresh received kernel arguments.
      Never issue a candidate reboot; preserve actual elapsed capture and
      host-arrival-only sample coverage, then require protected normal recovery.
      Host-only proof: `python3 tests/test_mainline_uart_progress_controller.py` and
      `python3 -m unittest discover -s tests -p 'test_mainline_drm*trial.py'`.
      Controller source/fixture preparation is recorded in
      `docs/evidence/mainline-uart-progress-controller/README.md`; this task
      actual matching bundle/config qualification subsequently passed.
      [Matching controller host proof](../../../../docs/evidence/mainline-uart-progress/controller-matching-host-2026-10-03.md).
- [x] 5f.5 After fresh protected normal recovery, reserve board/UART and run one
      matching physical comparison with its exact prepared identities:
      `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --uart-progress --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      Commit fixed records/stimulus/interpretation and protected normal
      postflight or explicit pending operator recovery. This proves only the
      observations obtained, not full root/panel/glass acceptance.
      [Physical finite observation](../../../../docs/evidence/mainline-uart-progress/physical-2026-10-03/README.md): exact received arguments and Bash prompt, one stimulus,
      zero receipts and zero records; subsequent protected operator reset/postflight verified
      (fresh boot, exact identities, eight files, three services, registration absence).
      This is observation-only, not successful diagnostic/root/touch acceptance.
- [x] 5f.6 Reconcile the diagnostic findings with the next narrow discriminator,
      preserve unknown markers and task 5b.5, land/push evidence and verify
      exact CI/published revision. Planning proof: `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Zero-report limits and manual protected recovery are committed in the
      [physical packet](../../../../docs/evidence/mainline-uart-progress/physical-2026-10-03/README.md).
      Recovery revision 5cdff03b passed CI 37166330080 and published work/evidence
      checks; the reviewed continuation is preserved as planned group 5g below.
      No ordinary-root/touch/automatic-recovery result is inferred.


## 5g. Worker-entry/first-post-sleep comparison (planned, no physical claim)

- [x] 5g.1 Add a separately layered runtime-gated breadcrumb reporter source:
      exactly two fixed <=64-byte aligned ordinary-rodata records in the
      normal-priority worker, entry before first sleep and post-sleep before
      first snapshot, at most one SBI attempt each and no IRQ/TTY/PID1 output.
      Preserve six original samples, delays/getters/stop checks and all existing
      package/source/config/trial identities. Actual-code fixtures cover exact/
      absent/bare/invalid gates, extension absence, placement/stop behavior,
      full/partial/zero/error no-retry and total eight-attempt cap.
      Source/fixture proof: `python3 tests/test_mainline_uart_progress_breadcrumbs.py`.
      Source-host increment: thirteen actual patched-worker native fixtures and
      twelve original source/API fixtures passed; evaluation preserves all 91
      existing package identities and ten kernel source/config pairs. Exact
      original-source layering and inherited config/params are recorded in
      [source-host evidence](../../../../docs/evidence/mainline-uart-progress-breadcrumbs/source-host/README.md).
      This is not a full matching build, actual configured object or physical proof.
- [x] 5g.2 Add/build the separately selected matching kernel/system/initrd/DT/
      bundle, preserving original artifact parameters and every existing
      package plus kernel source/config and trial derivation identity. Commit
      source-layering/identity evaluation and full installed config/closure/
      hash/CRC/hardware-DT inspection, distinct from physical output.
      Host proof: `nix build .#kernelMainlineUartProgressBreadcrumbsTrialBootFiles --no-link --print-out-paths`
      then `python3 tools/mainline-drm-trial-inspect.py BUNDLE`.
- [x] 5g.3 Compile the changed reporter against that exact selected kernel.dev
      config/generated headers without a forced overlay; inspect regular
      helper/flag/strings lifetime, <=64-byte lengths, alignment64/page bounds
      and unchanged cached-getter dependencies. Host-only proof:
      `nix build .#kernelMainlineUartProgressBreadcrumbsExactObjects --no-link --print-out-paths`.
      Actual host proof: coordinator frozen 2a548135 resumed build returned 0;
      verifier source 071086bc exact-object command returned 0 under shared lock.
      Selected dev config/autoconf, three RISC-V objects/regular aligned storage,
      source 7207, full bundle hashes/CRCs/closure and complete hardware DT equality
      passed. [Exact/full host evidence](../../../../docs/evidence/mainline-uart-progress-breadcrumbs/exact-full-host/README.md).
      The initial coordinator session 143/broken-pipe interruption is distinct
      from the successful completion receipt. No hardware/RX/return result is
      inferred; tasks 5g.5–6 and task 5b.5 remain open.
- [x] 5g.4 Add a separate explicit minimal-only typed breadcrumb selector and
      strict fixed-record parser; preserve default/common/numeric protocols,
      exact artifact/dev/received-args preflight, sole volatile gates and fresh
      readiness for at most one receipt stimulus. Test early/late records,
      stale/echo/unknown/truncated/duplicate/reordered/interleaved bytes, split
      transport chunks, missing receipt/no retry/no reboot, bounded private
      capture and independent protected normal recovery. Host-only proof:
      `python3 tests/test_mainline_uart_progress_breadcrumbs_controller.py`
      and `python3 -m unittest discover -s tests -p 'test_mainline_drm*trial.py'`.
      Controller host preparation is recorded in
      `docs/evidence/mainline-uart-progress-breadcrumbs/controller/README.md`.
      Pre-UART qualification additionally ties the same kernel drv to its
      immutable reviewed worker source and unique compiled Image marker/gate
      bytes, rejecting the old reporter even with CONFIG=y. Actual matching
      bundle/dev/source preparation passed on 2026-10-04UTC against mhq10143…,
      as recorded in
      `docs/evidence/mainline-uart-progress-breadcrumbs/positive-controller-host/README.md`
      and `result.json`; the named fixture commands also passed, preserving a
      separate quota failure and bounded ~/tmp rerun. This is host-only proof;
      group5g.5 and task 5b.5 remain open, without candidate reboot or hardware claim.
      [Integrated source/controller checks](../../../../docs/evidence/mainline-uart-progress-breadcrumbs/integration-host-2026-10-03.md) include strict CRLF/embedded-CR framing and CI coverage.
- [x] 5g.5 After fresh protected normal recovery and exact host/controller proof,
      reserve board/UART for one comparison, capture fixed breadcrumb/sample/
      receipt facts and limits, then verify protected normal return or record
      distinct pending operator recovery. Hardware proof operator command:
      `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --uart-progress --uart-progress-breadcrumbs --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No further input or candidate reboot after the single stimulus; this is
      observation only, not ordinary-root/touch or automatic-return acceptance.
      Actual comparison: matching mhq10143 bundle staged with return 0; fresh
      protected preflight/load checks passed. Both fixed breadcrumbs, one
      matching Bash receipt and samples 0/1 arrived; samples 2–5 and normal return
      did not arrive in 180.084 seconds. No further input or candidate reboot.
      [Physical evidence](../../../../docs/evidence/mainline-uart-progress-breadcrumbs/physical-2026-10-03/README.md)
      records fixed facts/deltas, firmware-return limits and distinct operator-reset
      recovery verified after the capture. This is observation proof only; task 5b.5 stays open.
- [x] 5g.6 Reconcile presence/absence and firmware-return limits, retain unknown
      states and task 5b.5, commit public-safe evidence and land/push with exact
      CI/published revision. Planning proof: `openspec validate --all`.

The group 5g observation and interpretation landed as 278769d0. CI run
37171186624 passed build/deploy; both published work and physical evidence pages
returned HTTP 200 with exact revision 278769d0. The committed deployment receipt
is `docs/evidence/mainline-uart-progress-breadcrumbs/physical-2026-10-03/deployment.json`.
Independent review matched the fixed public facts/deltas to the private capture.
Both markers and receipt are proven; later sample/firmware-return/normal-return
remain unknown. The separately proposed next discriminator targets the sample 1
write return versus third sleep. The subsequent user reset passed fresh protected
normal postflight and Home IPC, with separately reviewed camera Home;
`docs/evidence/mainline-uart-progress-breadcrumbs/physical-2026-10-03/operator-reset-recovery.json`
records exact limits. Automatic return and task 5b.5 stay open.


## 5h. After-n1-write/third-post-sleep comparison (captured; new points UNVERIFIED)

- [x] 5h.1 Add a separately layered PostSample reporter source with exact new
      runtime gate, requiring both existing gates/config/DBCN. Two fixed <=64
      aligned ordinary-rodata records occur only after sample1's numeric SBI
      return and after sample2's sleep/stop check before snapshot. Preserve six
      samples/two prior breadcrumbs/sleeps/getters/stop behavior and all old
      package/source/config/trial identities; no IRQ/TTY/PID1/priority changes.
      Actual-code fixtures cover exact/absent/bare/invalid/config/availability
      gates, placement/stop behavior, full/partial/zero/error one-attempt and
      ten-call cap. Source-host proof:
      `python3 tests/test_mainline_uart_progress_post_sample.py` plus unchanged-output/source/config identity evaluation.
      Native 15 new fixtures and 13/12 prior fixtures passed; all 95 prior
      package identities and 11 exposed kernel source/config pairs were equal.
      Source-only/native/pure-evaluation receipt: [source host proof](../../../../docs/evidence/mainline-uart-progress-post-sample/source-host/README.md).
      No matching full build, target object or physical claim follows.
- [x] 5h.2 Build separately selected matching kernel/system/initrd/DT/bundle;
      inspect full installed config, source layering, Image/CRC/closure/hash/
      original artifact parameters and complete hardware DT comparison, distinct
      from physical output. Host proof:
      `nix build .#kernelMainlineUartProgressPostSampleTrialBootFiles --no-link --print-out-paths`
      then `python3 tools/mainline-drm-trial-inspect.py BUNDLE`.
      Matching full build from frozen `75cc49df` returned 0; actual inspector,
      installed config, source layering, linked Image and complete hardware DT
      comparison passed. [Exact/full host proof](../../../../docs/evidence/mainline-uart-progress-post-sample/exact-full-host/README.md); no physical claim.
- [x] 5h.3 Compile actual changed worker/getter/timer against the exact selected
      kernel.dev config/generated headers without overlay; inspect ordinary
      helper/flag/strings lifetime, lengths/alignment64/page bounds and unchanged
      getter dependencies. Host-only proof:
      `nix build .#kernelMainlineUartProgressPostSampleExactObjects --no-link --print-out-paths`.
      Narrow offline exact-object build from source checkpoint `e3edc5e6`
      returned 0 against actual selected dev, without overlay; three RISC-V
      objects, four aligned ordinary-rodata records, original 256-byte buffer
      and unchanged getter dependencies passed inspection. Same host proof;
      controller/physical/receipt/recovery gates remain separate and open.
- [x] 5h.4 Add explicit minimal-only `--uart-progress-post-sample` requiring all
      previous comparison selectors. Preserve exact pre-UART artifact/source/
      linked Image/dev checks, sole new volatile gate, received args/freshness,
      protected normal checks, one stimulus and no later input/reboot. Strict
      record tests cover split transport, complete/partial, stale/echo/extra/
      duplicate/reorder/interleave and missing-point/numeric/receipt facts.
      Host-only proof: `python3 tests/test_mainline_uart_progress_post_sample_controller.py`
      plus existing minimal/progress/breadcrumb controller regression commands.
      Keep this task unchecked until actual NEW matching bundle/dev/source/Image
      positive preparation passes. Fixtures and old-artifact rejection alone
      do not satisfy that gate or establish a performed protected board check.
      Preparation evidence: [PostSample controller host note](../../../../docs/evidence/mainline-uart-progress-post-sample/controller/README.md)
      records 20 focused tests plus unchanged 18 breadcrumb/20 progress/100
      minimal/14 shell/36 ordinary tests, the strict source/Image/config gate,
      and actual old matching artifact rejection before UART access. Actual NEW
      positive preparation now passed against frozen `75cc49df` and realized fjmxf6
      bundle/js4by9 dev: [positive host proof](../../../../docs/evidence/mainline-uart-progress-post-sample/positive-controller-host/README.md).
      Same-drv config, reviewed aee68 source, linked unique Image strings, actual
      archived executables/common loader and exact sole additional gate passed;
      literal transport 419 bytes versus 386. No UART/build or performed protected
      board check by this qualifier. One fresh stimulus is followed only by
      passive bounded capture; no candidate reboot, extra input or physical claim
      is authorized by marker presence. Tasks 5h.5–6 and 5b.5 remain open.
- [x] 5h.5 After independently verified protected recovery and exact host/
      controller proof, reserve board/UART for one comparison; commit fixed
      point/sample/receipt facts and independent protected recovery or explicit
      pending operator reset. Hardware operator command:
      `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --uart-progress --uart-progress-breadcrumbs --uart-progress-post-sample --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      Missing output remains unknown; no further input or candidate reboot.
      This is diagnostic observation, not ordinary-root/touch/automatic return.
      Actual fjmxf6 comparison completed: [physical capture](../../../../docs/evidence/mainline-uart-progress-post-sample/physical-2026-10-03/README.md).
      Fresh args/Bash/worker-entry, one stimulus, no receipt/samples/new points
      during 180.0975s; no protocol errors or candidate reboot. New operator
      reset subsequently passed fresh guarded normal postflight and reviewed
      Home: [reset receipt](../../../../docs/evidence/mainline-uart-progress-post-sample/physical-2026-10-03/operator-reset-recovery.json).
- [x] 5h.6 Reconcile point reach/return/output and sleep/scheduling limits,
      preserve task 5b.5 and unknown states, land/push public-safe evidence and
      verify exact CI/published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.


Group5h source, exact/full artifacts, actual positive preparation and physical
capture are complete. Independent review matched private facts/hash. Evidence
08ea7370 passed CI37175128998; work and physical pages returned HTTP200 with
that exact revision: committed physical deployment.json. Only worker-entry
arrived; neither entry ECALL return nor first sleep/output is established.
The subsequent NEW reset passed guarded fresh normal postflight/Home evidence;
automatic return and5b.5 stay open. Group5i
is a separate output-removal intervention, not a claimed cause or silent scope
completion of ordinary mainline acceptance.

## 5i. Memory progress with one final observer output (planned, UNVERIFIED)

- [x] 5i.1 Implement separately selected layered source/recipes/exact gate;
      retain all previous identities, six sleeps/cached snapshots/stop checks.
      Suppress every worker output only in Memory mode, publish consistent finite
      stages/bitmap/index and create independent normal-priority observer with
      one45s kernel wait/one final <=256-byte aligned DBCN attempt. Freeze grammar;
      fixtures cover gates, ordering, stop/timeout/creation failure and one-call
      counts. Narrow proof: `python3 tests/test_mainline_uart_progress_memory.py`.
      Actual-code 13 fixtures and prior 15/13/12 fixtures passed; all 99 prior
      package drv identities and 12 exposed kernel source/config pairs equal.
      [Source/native/pure-evaluation proof](../../../../docs/evidence/mainline-uart-progress-memory/source-host/README.md); no matching full artifact, target-object,
      controller or physical claim follows. Other 5i gates stay open.
- [x] 5i.2 Build matching Memory kernel/system/bundle/dev, inspect source/config,
      CRC/closure/archive/original args/complete hardware DT. Host proof:
      `nix build .#kernelMainlineUartProgressMemoryTrialBootFiles .#kernelMainlineUartProgressMemory.dev --no-link --print-out-paths`
      then `python3 tools/mainline-drm-trial-inspect.py BUNDLE`.
      Matching frozen `7af8f7b8` full build returned0; actual selected source,
      config/Image/initrd/CRCs/closure/original args/full hardware DT passed.
      [Exact/full host proof](../../../../docs/evidence/mainline-uart-progress-memory/exact-full-host/README.md); no physical claim.
- [x] 5i.3 Compile exact selected-header worker/getter/timer/observer objects;
      inspect consistent publication dependencies, ordinary lifetime/aligned
      buffer/page bounds and unchanged getter behavior. Host-only proof:
      `nix build .#kernelMainlineUartProgressMemoryExactObjects --no-link --print-out-paths`.
      Offline narrow build from source checkpoint `29979175` returned0 against
      actual selected dev, no overlay; three RISC-V objects, Memory observer/
      state/completion/256-aligned buffer, target acquire/release/API and
      inherited buffers/getters passed. Same host proof; concurrency/physical
      output/receipt/recovery remain unverified.
- [x] 5i.4 Implement typed minimal-only Memory controller, reject conflicting
      breadcrumb/post-sample selection, retain exact qualification/normal guards,
      one fresh stimulus/passive capture and strict single-summary facts. Actual
      NEW matching positive preparation required before checking this task.
      Narrow proof: `python3 tests/test_mainline_uart_progress_memory_controller.py`.
      Preparation: [Memory controller host proof](../../../../docs/evidence/mainline-uart-progress-memory/controller/README.md)
      records 20 exact-summary/real-pump/transport/qualification fixtures plus
      unchanged 20 PostSample/18 Breadcrumbs/20 numeric/100 minimal/14 shell/36
      ordinary checks. Actual fjmxf6 old artifact fails the new reviewed worker
      gate before UART. Consistent incomplete/timeout summary, worker completion,
      receipt and protected return remain independent facts; no candidate reboot
      or extra input follows. [Actual NEW positive host proof](../../../../docs/evidence/mainline-uart-progress-memory/positive-controller-host/README.md)
      now passes against frozen `7af8f7b8`, realized lznjjfx1 bundle/1pvqbm4 dev,
      same-drv config, reviewed 307d7c source, unique linked summary format/setup,
      actual archived executables/shared loader and sole additional gate
      (353 to 381-byte literal command). No UART/build or performed protected
      board check by this qualifier. Tasks 5i.5–6 and 5b.5 remain open.
- [x] 5i.5 After NEW guarded protected recovery plus exact host/controller proof,
      reserve board/UART and run one comparison; commit fixed public facts and
      independent protected recovery or explicit pending operator reset.
      Command: `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --uart-progress --uart-progress-memory --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      Memory progress/output/receipt/recovery remain separate; 5b.5 stays open.
      Actual lznjjfx1 comparison completed: [physical capture](../../../../docs/evidence/mainline-uart-progress-memory/physical-2026-10-03/README.md).
      Fresh banner/args/Bash, one stimulus, no receipt or summary in 180.1021s;
      no errors or candidate reboot. Subsequent NEW operator reset passed protected
      normal postflight/Home camera checks: [recovery receipt](../../../../docs/evidence/mainline-uart-progress-memory/physical-2026-10-03/operator-reset-recovery.json).
- [x] 5i.6 Independently reconcile changed-output intervention limits, review,
      land/push public evidence and verify exact CI/published revision.
      Planning proof: `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Independent physical review passed; master `136dbf91`, CI37178946290
      PASS and exact published work/evidence revision verified HTTP200:
      [publication receipt](../../../../docs/evidence/mainline-uart-progress-memory/physical-2026-10-03/publication.json).
      Subsequent NEW reset recovery is verified; ordinary acceptance 5b.5 stays open.


## 5j. Same built Memory image without candidate stimulus (planned, UNVERIFIED)

- [x] 5j.1 Implement typed Memory-only no-stimulus selector, identical bootargs/
      qualification and zero candidate writes after boot on all paths. Record
      NOT_REQUESTED receipt/zero attempts/RX NOT_TESTED; default still one stimulus.
      Real-pump/write-spy fixtures cover success, missing/malformed/duplicate/
      truncated/stale output, no prompt, wrong args, overflow/read errors/timeout,
      pre-open conflicts and independent guarded normal return. Narrow proof:
      `python3 tests/test_mainline_uart_progress_memory_no_stimulus_controller.py`.
      Host implementation/15 real-pump fixtures and 228 previous controller tests
      passed; independent source review PASS. [Host proof](../../../../docs/evidence/mainline-uart-progress-memory/no-stimulus-host/README.md).
      Physical no-stimulus capture/recovery remain UNVERIFIED.
- [x] 5j.2 Requalify actual existing lznjjfx1 bundle/1pvqbm4 dev/source 307d7c/
      linked Image/archive/manifests and exact unchanged Memory args. Record
      controller-revision/policy receipt with no implicit build/UART. Host proof:
      actual `prepare_trial` + `prepare_uart_progress(..., uart_progress_memory=True)`
      and exact equality with selected no-stimulus transport. No kernel rebuild.
      Actual existing lznjjfx1/1pvqbm4 preparation PASS on c62ad389; exact same
      source/Image/config/archive/manifest and 381-byte Memory transport, no added
      token/build/UART. [Executed qualifier and safe receipt](../../../../docs/evidence/mainline-uart-progress-memory/no-stimulus-host/README.md).
      Historical baseline acceptance is host-only; fresh physical preflight and
      no-stimulus capture/recovery remain UNVERIFIED.
- [x] 5j.3 After fresh protected normal recovery and host policy/artifact proof,
      reserve board/UART for one same-image zero-stimulus capture; commit fixed
      facts plus protected recovery or explicit pending operator reset. Command:
      `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --uart-progress --uart-progress-memory --uart-progress-memory-no-stimulus --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No RX, root/glass or cause inference; 5b.5 stays open.
      [Actual zero-input capture](../../../../docs/evidence/mainline-uart-progress-memory/no-stimulus-physical-2026-10-04/README.md):
      fresh banner/args/Bash, zero attempts/NOT_REQUESTED/RX NOT_TESTED, no summary
      in 180.0995s, no protocol error or normal return. Subsequent NEW operator
      reset passed protected normal/Home checks: [recovery receipt](../../../../docs/evidence/mainline-uart-progress-memory/no-stimulus-physical-2026-10-04/operator-reset-recovery.json).
- [x] 5j.4 Reconcile removed-input intervention limits, independently review,
      land/push evidence and verify exact CI/published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Independent physical review PASS; master `691279d0`, CI 37180546857
      PASS and exact published work/evidence revision HTTP 200 verified:
      [publication receipt](../../../../docs/evidence/mainline-uart-progress-memory/no-stimulus-physical-2026-10-04/publication.json).
      Subsequent NEW recovery is verified; ordinary acceptance 5b.5 stays open.


## 5k. Same built Memory image with idle polling (planned, UNVERIFIED)

- [x] 5k.1 Implement typed polling selector requiring all Memory/no-stimulus
      dependencies, qualify actual config/linked setup and append only bare nohlt.
      Retain strict zero candidate writes and all default transports. Narrow proof:
      `python3 tests/test_mainline_uart_progress_memory_poll_idle_controller.py`.
      Typed one-token comparison/14 focused fixtures and 243 prior controller
      tests PASS; independent source review PASS. [Host implementation proof](../../../../docs/evidence/mainline-uart-progress-memory/poll-idle-host/README.md).
      Actual preparation and physical comparison/recovery remain separate gates.
- [x] 5k.2 Run actual existing lznjjfx1/1pvqbm4 artifact preparation with unchanged
      source/Image/config/DT/archive/manifest/load checks; verify exact one-token
      transform and 381→387-byte literal transport. Commit executed qualifier and
      safe controller/artifact receipt. No build/UART. Host proof: actual
      `prepare_trial`, `prepare_uart_progress(..., uart_progress_memory=True)`
      plus typed polling preparation and exact previous-proof artifact equality.
      Actual existing artifact qualification PASS on d10b8fa0; same lznjjfx1/
      1pvqbm4 source/Image/config/DT/archive/manifest, singleton supported setup
      and exact381→387-byte transform. [Safe receipt/executed qualifier](../../../../docs/evidence/mainline-uart-progress-memory/poll-idle-host/README.md).
      Initial host harness comparison failure is preserved; corrected gate PASS.
      No build/UART/live preflight. Physical polling/recovery remain UNVERIFIED.
- [x] 5k.3 After NEW protected normal recovery and actual host proof, reserve
      board/UART and run one passive same-image polling comparison; commit fixed
      facts plus independent recovery or explicit pending operator reset. Command:
      `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --uart-progress --uart-progress-memory --uart-progress-memory-no-stimulus --uart-progress-memory-poll-idle --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No cause/RX/ordinary-root inference; 5b.5 stays open.
      [Actual polling capture and subsequent protected recovery](../../../../docs/evidence/mainline-uart-progress-memory/poll-idle-physical-2026-10-04/README.md):
      exact nohlt args/Bash, zero input, no summary/normal return in 180.0929s;
      no protocol error. Subsequent NEW reset passed normal/Home checks; normal
      system restored. Automatic return and ordinary acceptance remain UNVERIFIED.
- [x] 5k.4 Independently reconcile idle/tick-policy limits, review, land/push
      fixed evidence and verify exact CI/published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Independent physical/recovery review PASS; master `e2a02cb0`, CI
      37182761318 PASS and exact published work/evidence revision HTTP 200
      verified: [publication receipt](../../../../docs/evidence/mainline-uart-progress-memory/poll-idle-physical-2026-10-04/publication.json).
      Normal is restored; no timer/firmware cause or ordinary acceptance inferred.


## 5l. Memory observer through registered Linux console (planned, UNVERIFIED)

- [x] 5l.1 Add separate MemoryPrintk source/kernel/trial/exact-object exports and
      exact gate; retain worker/observer semantics and all prior identities. One
      KERN_INFO K230_UMK1 call with a leading newline in its format to separate
      shell prompt output, no final explicit DBCN in selected path. Narrow
      source/native proof: `python3 tests/test_mainline_uart_progress_memory_printk.py`;
      evaluate every prior package/source/config/trial identity and new source only.
      Preparation: corrected leading-LF one-call source and 10 actual-code native
      tests passed; the inherited worker/init tail and atomic/completion behavior
      are unchanged. All 103 previous package drv identities and 13 kernel
      source/config pairs equal; corrected source realized and hash independently
      reviewed. [Source/native/evaluation proof](../../../../docs/evidence/mainline-uart-progress-memory-printk/source-host/README.md).
      Exact/full/controller/physical gates remain separate and unchecked.
- [x] 5l.2 Freeze reviewed source/native proof and build matching artifacts.
      Command: `nix build .#kernelMainlineUartProgressMemoryPrintkTrialBootFiles .#kernelMainlineUartProgressMemoryPrintk.dev --no-link --print-out-paths -L`.
      Preserve full build receipt and actual config/DT/Image/initrd/archive identities.
      Performed: coordinator full matching build at frozen `1c59f856` returned 0;
      actual p2kdar bundle and 24hbal dev pass Image/system/kernel/initrd/CRC/closure
      inspection, original arguments and complete hardware-DT comparison. Installed
      config/autoconf bytes equal the Memory parent; PRINTK_CALLER is disabled.
      [Actual exact/full host proof](../../../../docs/evidence/mainline-uart-progress-memory-printk/exact-full-host/README.md).
- [x] 5l.3 Inspect exact selected target objects/calls/format, atomic/completion
      behavior and matching source/config. Command:
      `nix build .#kernelMainlineUartProgressMemoryPrintkExactObjects --no-link --print-out-paths -L`.
      Performed: only the named offline exact-object output built under a nonblocking
      shared lock from source revision `bd092485`; actual selected dev headers/config,
      three GCC RISC-V objects, ordinary lifetimes, acquire/release/completion APIs and
      unique regular-rodata leading-newline KERN_INFO format passed. The target observer
      has the ordinary printk call; source/native proof establishes selected return
      without DBCN fallback. Pahole-version warning retained, no C warning observed.
      Host object proof does not establish console/timer/observer execution.
- [x] 5l.4 Add typed controller, strict observed-prefix/new-namespace parser and
      fresh Linux-backend qualification with zero-write/error/recovery fixtures.
      Qualify disabled PRINTK_CALLER for the timestamp-only parser.
      Narrow proof: `python3 tests/test_mainline_uart_progress_memory_printk_controller.py`.
      Then run actual matching artifact/controller preparation and commit safe
      receipt/executed qualifier; no UART or implicit build. Source hash must be
      the independently reviewed realized variant, not an unknown placeholder.
      Controller preparation/20 corrected fixtures and prior controller regressions
      PASS; root independent review PASS. [Host preparation](../../../../docs/evidence/mainline-uart-progress-memory-printk/controller/README.md).
      Actual new bundle p2kdar89 / dev 24hbalyl / reviewed worker 30e8eb1e
      qualification PASS (2026-10-04 07:15 UTC, exit 0): same-derivation actual
      config, linked Image/format/setup, DT/archive/load/CRC and sole gate
      transport 381→416 bytes; no UART/build/new board preflight.
      [Executed qualifier and safe receipt](../../../../docs/evidence/mainline-uart-progress-memory-printk/positive-controller-host/README.md).
      Historical protected normal report is a host anchor only; physical
      observation/recovery and ordinary root/touch remain UNVERIFIED.
- [x] 5l.5 After protected normal recovery plus source/native/exact/full/controller
      gates, reserve board/UART for one new-channel comparison. Commit fixed
      physical facts and recovery or explicit pending operator reset. Command:
      `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --uart-progress --uart-progress-memory --uart-progress-memory-no-stimulus --uart-progress-memory-printk --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No output-return/cause/RX/ordinary-root inference; 5b.5 stays open.
      [Actual new-channel capture](../../../../docs/evidence/mainline-uart-progress-memory-printk/physical-2026-10-04/README.md):
      fresh exact args/registered Linux backend/bin-sh entry, zero input, no UMK
      or normal return in 180.1019s. Original prompt classification misses the
      observed Readline prefix; later host-only correction preserves original
      physical result. Subsequent NEW reset passed protected normal/Home recovery;
      [follow-up receipt](../../../../docs/evidence/mainline-uart-progress-memory-printk/physical-2026-10-04/recovery.json).
- [x] 5l.6 Independently reconcile changed-channel limits, review, land/push
      evidence and verify exact CI/published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Independent physical-packet review PASS; master `adf3ac81`, CI
      37186803102 PASS and exact published work/physical/readiness evidence
      revision HTTP 200 verified: [publication receipt](../../../../docs/evidence/mainline-uart-progress-memory-printk/physical-2026-10-04/publication.json).
      Publication receipt reflects recovery pending at that revision; subsequent
      NEW protected recovery is recorded separately. No ordinary acceptance inferred.


## 5m. Same-image MemoryPrintk tickless-off comparison (planned, UNVERIFIED)

- [x] 5m.1 Add typed `--uart-progress-memory-printk-nohz-off` and focused fixtures.
      Require existing minimal/same-image/progress/Memory/no-stimulus/MemoryPrintk;
      reject conflicts/types/modes before UART. Qualify actual compiled config/Image
      setup; append only trailing nohz=off. Preserve defaults, strict parsing,
      zero candidate writes and protected recovery. No build/UART. Narrow proof:
      `python3 tests/test_mainline_uart_progress_memory_printk_nohz_off_controller.py`.
      [Source/fixture proof](../../../../docs/evidence/mainline-uart-progress-memory-printk/nohz-off-host/README.md):
      13 focused plus 23 MemoryPrintk/14 polling/15 no-stimulus PASS; actual
      existing-artifact gate remains pending under 5m.2. No UART/build.
- [x] 5m.2 Run actual existing p2kdar89/24hbalyl artifact/controller preparation,
      verify unchanged source/config/Image/initrd/DT/manifest/load/archive and sole
      literal 416→425-byte transform. Commit executed qualifier and safe receipt.
      Host-only command: `python3 docs/evidence/mainline-uart-progress-memory-printk/nohz-off-host/qualification-command.py --bundle BUNDLE --dev DEV --normal-report PRIVATE_NORMAL`.
      The executed private copy records its frozen source/worktree and private
      output directory; no implicit build or UART. Freeze and review its exact
      code/parameters before physical use.
- [x] 5m.3 After NEW protected normal recovery and completed host gates, reserve
      board/UART for one passive same-image comparison. Commit fixed physical
      facts plus independently verified recovery or explicit pending NEW reset.
      Command: `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --uart-progress --uart-progress-memory --uart-progress-memory-no-stimulus --uart-progress-memory-printk --uart-progress-memory-printk-nohz-off --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No cause/RX/output-return/ordinary-root inference; 5b.5 stays open.
      [Actual same-image nohz-off capture](../../../../docs/evidence/mainline-uart-progress-memory-printk/nohz-off-physical-2026-10-04/README.md):
      fresh exact args/backend/Bash readiness, zero input, no UMK/normal return
      in 180.025s, no protocol error. Prior NEW recovery verified; another NEW
      reset after this capture remains explicitly PENDING. Same-source-only
      restoration and fresh host requalification are recorded separately.
- [x] 5m.4 Independently reconcile tickless-policy limits, review, land/push evidence
      and inspect exact CI/published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Independent physical/recovery review PASS; master `b04ac4d0`, CI
      37245257792 PASS and exact work/new physical/previous recovery publication
      HTTP 200 verified: [publication receipt](../../../../docs/evidence/mainline-uart-progress-memory-printk/nohz-off-physical-2026-10-04/publication.json).
      Subsequent NEW nohz-off [protected recovery](../../../../docs/evidence/mainline-uart-progress-memory-printk/nohz-off-physical-2026-10-04/recovery.json) passed: distinct boot, exact identities/eight hashes/three services/registration absence. Automatic return and 5b.5 stay UNVERIFIED.


## 5n. Fixed autonomous Bash-PID1 comparison (bounded diagnostic complete)

- [x] 5n.1 Establish native exact Hush lexer/variable/quote/command execution and
      selected Linux next_arg/repair/set_init_arg argv proof for the fixed scout
      script/transport. Verify one volatile setenv, exact 477-byte result/two argv,
      zero expansion/extra/persistent commands and unchanged 512-byte bound.
      Source models/shlex alone do not pass. No UART/kernel build. Narrow proof:
      `python3 tests/test_mainline_autonomous_bash_pid1_argv.py`.
      Native host proof: 12 tests PASS; full unchanged pinned Hush dispatch and
      exact selected Linux argv functions recover 477-byte bootargs and two argv.
      [Receipt](../../../../docs/evidence/mainline-autonomous-bash-pid1/native-argv/README.md)
      records hooks/registration adapters and installed/target/physical limits.
- [x] 5n.2 Implement only typed `--autonomous-bash-pid1` requiring minimal/same-image
      and rejecting competing selectors/types/modes/altered syntax before UART.
      Add strict fresh-nonce begin/end parsing and 60-second zero-input capture, separate
      prompt/unknown/normal recovery, unchanged defaults and failure/finally write
      spies. Narrow proof: `python3 tests/test_mainline_autonomous_bash_pid1_controller.py`.
      Host source checkpoint: [controller preparation](../../../../docs/evidence/mainline-autonomous-bash-pid1/host/controller-host.md); 16 focused fixtures PASS, strict/affected regressions PASS. No UART/build; actual artifact/native qualification remains 5n.3 and physical 5n.4 remains open.
- [x] 5n.3 Execute actual same p2/24h artifact/controller preparation and qualify
      source/config/Image/DT/archive/manifest/loads, executable sh/sleep ABI/loader
      and Bash builtins. Commit executed qualifier and safe receipt, exact fixed
      args/503-byte transport and native proof; no implicit build/UART. Command:
      `python3 docs/evidence/mainline-autonomous-bash-pid1/host/qualification-command.py --bundle BUNDLE --dev DEV --normal-report PRIVATE_NORMAL`.
      Actual [host qualification](../../../../docs/evidence/mainline-autonomous-bash-pid1/host/README.md) PASS on corrected root82b27a36: same p2/24h/0l4 artifacts/archive/loader/Bash exports, committed native receipt/fixtures/selected Linux/vector, exact154/477/503 bytes, historical normal anchors only. No UART/build; 5n.4 requires NEW protected recovery and remains open.
- [x] 5n.4 After NEW protected recovery plus reviewed native/controller/actual host
      gates, reserve board/UART for one 60-second passive comparison and commit fixed
      records/facts plus independent recovery or explicit pending NEW reset.
      Command: `python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal --same-image-shell-pid1 --autonomous-bash-pid1 --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --log PRIVATE_LOG --result PRIVATE_RESULT`.
      Keep RX/output-return/cause/ordinary-root limits; 5b.5 stays open.
      [Physical autonomous capture](../../../../docs/evidence/mainline-autonomous-bash-pid1/physical-2026-10-05/README.md): strict B then E and later primary prompt in60.035s, exact candidate arguments/backend/bin-sh entry, zero input/errors. Selected sleep returned; RX and ordinary init/root/glass remain UNVERIFIED. Capture complete; subsequent NEW protected recovery is verified in recovery.json, independently reviewed. No prior reset reused.
- [x] 5n.5 Independently review parser/execution/recovery limits, land/push evidence
      and inspect exact CI/published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.

      Independent raw/parser/load/recovery-limits review PASS; physical evidence master ad746e5b, CI37250588096 PASS, exact work/autonomous/nohz-recovery publication HTTP200 verified: [publication receipt](../../../../docs/evidence/mainline-autonomous-bash-pid1/physical-2026-10-05/publication.json). Subsequent NEW [autonomous recovery](../../../../docs/evidence/mainline-autonomous-bash-pid1/physical-2026-10-05/recovery.json) passed exact identities/eight boot hashes/three services/registration absence with a distinct boot; automatic return and ordinary init/root/panel/glass task5b.5 stay UNVERIFIED.


## 5o. Fixed ordinary-init manager logging (bounded diagnostic)

- [x] 5o.1 Implement the typed begin-only two-token policy with required existing
      selectors, pre-UART alias/conflict/type guards and restored-state selection.
      Test exact/default arguments, split fresh readiness beyond buffer capacity,
      complete private logging and unknown-no-input paths. No UART/build. Narrow
      proof: `python3 tests/test_mainline_initrd_debug_logging.py`.
      [Host controller proof](../../../../docs/evidence/mainline-initrd-debug-logging/host/controller-host.md): 13 focused plus 36 existing tests PASS, independently rerun; reviewed source integrated ec121e6d, CI37255138757 PASS. No UART/build.
- [x] 5o.2 Execute actual same p2/24h preparation with the fixed policy; verify
      unchanged source/config/Image/DT/archive/manifest/load identities, systemd
      init, exact 356/374-byte policy and fresh normal anchors. Commit executed
      host qualifier and safe receipt; no implicit build/UART. Narrow command:
      `python3 docs/evidence/mainline-initrd-debug-logging/host/qualification-command.py --bundle BUNDLE --dev DEV --normal-report PRIVATE_NORMAL`.
      [Executed actual preparation](../../../../docs/evidence/mainline-initrd-debug-logging/host/README.md) exit0 on ec121e6d, same artifacts/archive, exact356/374 vs317 bytes and fresh preceding recovery anchor; independent review PASS. No live preflight/UART/build.
- [x] 5o.3 After NEW protected recovery and reviewed host/controller gates, reserve
      board/UART for one passive 180-second same-artifact capture. Commit fixed
      safe unit facts plus independently verified recovery or pending NEW reset.
      Command: `python3 tools/mainline-drm-system-trial.py begin --wait-initramfs-in-initcall --without-boot-markers --initrd-debug-logging --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --state NEW_PRIVATE_STATE --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No nested-command/call/cause or ordinary-root inference; 5b.5 stays open.
      [Actual passive capture](../../../../docs/evidence/mainline-initrd-debug-logging/physical-2026-10-05/README.md): same artifacts/exact args, fresh Linux/Run init announcement but no systemd/closure/login in 180s, exit1, zero later input in source/annotations; independent full review PASS. Subsequent NEW protected recovery passed; see recovery.json.
- [x] 5o.4 Independently review manager-state/parser/recovery limits, land/push
      evidence and inspect exact CI and published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Independent physical/parser/load/argument/no-input review PASS; master50daca22, CI37256024917 PASS and exact work/host/physical publication HTTP200 verified: [publication receipt](../../../../docs/evidence/mainline-initrd-debug-logging/physical-2026-10-05/publication.json). Subsequent NEW [protected recovery](../../../../docs/evidence/mainline-initrd-debug-logging/physical-2026-10-05/recovery.json) passed; automatic return and5b.5 stay UNVERIFIED.


## 5p. Fixed info-level console comparison (bounded diagnostic)

- [x] 5p.1 Reconcile pinned logging/startup source; implement typed exclusive info
      selector with old default/debug behavior, aliases/types pre-UART and typed
      saved continuation. Meaningful host fixtures; no UART/build. Narrow proof:
      `python3 tests/test_mainline_initrd_info_logging.py`.
      [Source/controller proof](../../../../docs/evidence/mainline-initrd-info-logging/host/controller-host.md): exact selected261.2 source pin/patch scope checked; 10 new+13debug+36ordinary tests PASS, independently rerun; reviewed source integrated94c78157. No UART/build.
- [x] 5p.2 Execute actual same p2/24h artifact/preparation qualifier, sole one-value
      policy delta and exact355/373 bytes. Commit executed qualifier and safe
      receipt, with recovery anchor limits; no implicit UART/build. Command:
      `python3 docs/evidence/mainline-initrd-info-logging/host/qualification-command.py --bundle BUNDLE --dev DEV --normal-report PRIVATE_NORMAL`.
      [Actual same-artifact qualification](../../../../docs/evidence/mainline-initrd-info-logging/host/README.md) exit0 on94c78157, exact355/373 versus356/374, latest NEW protected recovery bound; independent review PASS. No live preflight/UART/build.
- [x] 5p.3 After NEW protected recovery and reviewed source/host gates, reserve
      board/UART for one passive180s same-image capture. Commit fixed facts and
      independent recovery or explicit pending NEW reset. Command:
      `python3 tools/mainline-drm-system-trial.py begin --wait-initramfs-in-initcall --without-boot-markers --initrd-info-logging --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --state NEW_PRIVATE_STATE --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No syscall/cause or ordinary-root inference;5b.5 stays open.
      [Actual passive info/console capture](../../../../docs/evidence/mainline-initrd-info-logging/physical-2026-10-05/README.md): exact args/source/same artifacts, freshLinux/Run init announcement but no systemd/closure/login within180s; no later candidateinput insource/annotations; independent fullreview PASS. Subsequent NEW armed [protected recovery](../../../../docs/evidence/mainline-initrd-info-logging/physical-2026-10-05/recovery.json) passed; initial zero-byte failed check preserved.
- [x] 5p.4 Independently review comparison/source/recovery limits, land/push
      evidence and inspect exact CI and published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.


Independent physical and subsequent armed recovery review PASS. Physical revision f03ff3ce, CI37257736256 PASS and exact work revision/published capture HTTP200 verified: [publication receipt](../../../../docs/evidence/mainline-initrd-info-logging/physical-2026-10-05/publication.json). Automatic return and ordinary task5b.5 remain UNVERIFIED.

## 5q. Fixed info-level kmsg comparison (bounded diagnostic)

- [x] 5q.1 Reconcile pinned backend/priority/fallback source; implement typed
      exclusive begin-only kmsg selector, unchanged profiles/defaults, pre-UART
      aliases/types/conflicts and saved typed continuation. Host-only narrow proof:
      `python3 tests/test_mainline_initrd_info_kmsg_logging.py`.
      [Controller source proof](../../../../docs/evidence/mainline-initrd-info-kmsg-logging/host/controller-host.md):9 new+10info+13debug+36ordinary tests PASS, independently rerun; source0ba47bc0 reviewed PASS. No UART/build.
- [x] 5q.2 Execute actual same p2/24h artifact qualification and sole one-value
      destination delta with exact352/370 bytes. Commit executed qualifier and
      safe receipt/recovery-anchor limits; no implicit UART/build. Command:
      `python3 docs/evidence/mainline-initrd-info-kmsg-logging/host/qualification-command.py --bundle BUNDLE --dev DEV --normal-report PRIVATE_NORMAL`.
      [Executed actual preparation](../../../../docs/evidence/mainline-initrd-info-kmsg-logging/host/README.md) exit0 on0ba47bc0; same artifacts/archive, sole destination delta352/370 and NEW armed recovery binding; independent review PASS. No live preflight/UART/build.
- [x] 5q.3 After NEW protected recovery and reviewed source/actual host gates,
      reserve board/UART for one passive180s same-build capture. Commit fixed
      facts plus independent recovery or explicit pending NEW reset. Command:
      `python3 tools/mainline-drm-system-trial.py begin --wait-initramfs-in-initcall --without-boot-markers --initrd-info-kmsg-logging --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --state NEW_PRIVATE_STATE --log PRIVATE_LOG --result PRIVATE_RESULT`.
      Preserve fallback/drop/cause limits; ordinary task5b.5 stays open.
      [Actual passive capture](../../../../docs/evidence/mainline-initrd-info-kmsg-logging/physical-2026-10-05/README.md): exact same artifacts/args/source, fresh kernel/pre-exec init only, no systemd/closure/login in180s; independent full review PASS. Subsequent NEW [confirmed recovery](../../../../docs/evidence/mainline-initrd-info-kmsg-logging/physical-2026-10-05/recovery.json) passed independently; expired passive listener0bytes/no postflight remains separate.
- [x] 5q.4 Independently review comparison, source and recovery limits; land/push
      and inspect exact CI/published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.


Independent full capture/recovery-limit review PASS. Physical revision236f6bca, CI37259813601/deployment PASS and exact work revision/published capture HTTP200 verified: [publication receipt](../../../../docs/evidence/mainline-initrd-info-kmsg-logging/physical-2026-10-05/publication.json). Subsequent NEW confirmed recovery passed; automatic return and ordinary5b.5 remain UNVERIFIED.

## 5r. Unchanged quiet ordinary-baseline repeat (bounded control)

- [x] 5r.1 After NEW protected recovery from5q, execute actual same-artifact
      baseline preparation with existing parents/no logging mode. Qualify exact
     299/317 bytes against the original quiet policy and immutable/root/init/
      helper/load/CRC identities; commit executed qualifier and safe receipt,
      independently review. No implicit UART/build. Narrow command:
      `python3 docs/evidence/mainline-system-trial/current-p2-baseline-repeat-host-2026-10-05/qualification-command.py --bundle BUNDLE --dev DEV --normal-report PRIVATE_NORMAL`.
      [Executed same-artifact qualification](../../../../docs/evidence/mainline-system-trial/current-p2-baseline-repeat-host-2026-10-05/README.md) exit0 on3d2a080c; exact original299/317, unchanged source/helpers/artifacts and NEW kmsg recovery binding; independent review PASS. No live preflight/UART/build.
- [x] 5r.2 After reviewed source/actual host gates and NEW protected recovery,
      reserve board/UART for ONE passive180s repeat; commit fixed facts plus
      independent recovery or explicit pending NEW reset. Command:
      `python3 tools/mainline-drm-system-trial.py begin --wait-initramfs-in-initcall --without-boot-markers --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --state NEW_PRIVATE_STATE --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No new intervention, helper trace or cause/root/glass acceptance;5b.5 open.
      [Completed unchanged quiet capture](../../../../docs/evidence/mainline-system-trial/current-p2-baseline-repeat-physical-2026-10-05/README.md): same299/317/source/artifacts, freshLinux/pre-exec init only, no systemd/closure/login within180s. Original closure boundary did not reproduce; independent full review PASS. Subsequent NEW [protected recovery](../../../../docs/evidence/mainline-system-trial/current-p2-baseline-repeat-physical-2026-10-05/recovery.json) passed independent review; no previous reset reused.
- [x] 5r.3 Independently review reproducibility/parser/recovery limits, land/push
      and inspect exact CI/published revision. Planning proof:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.


Independent source/actual host/full physical/parser/recovery-limit/publication review PASS. Exact94920520 CI37261983348/deployment and published work revision/capture timestamps verified: [publication receipt](../../../../docs/evidence/mainline-system-trial/current-p2-baseline-repeat-physical-2026-10-05/publication.json). Subsequent NEW protected recovery passed independent review; ordinary5b.5 stays UNVERIFIED.

## 5s. Selected ordinary init exec-return record (bounded diagnostic)

- [x] 5s.1 Implement additive default-disabled source/kernel/trial variant and
      typed begin-only selection; preserve old outputs, selected init ABI/argv/env,
      original return/fallback and all guards. Meaningful narrow fixtures plus
      selected compiled RISC-V object review; independently review source. No UART.
      Narrow command: `python3 tests/test_mainline_init_exec_return.py`.
      [Reviewed source/native/object/evaluation proof](../../../../docs/evidence/mainline-init-exec-return/host/README.md):15 focused and68 old regressions PASS; exact realized source/config and actual RISC-V object verified, runtime gate in ordinary .sbss. Peer review PASS; root removed duplicate identical helper definitions through reviewed67d40217 and reran15 focused after integration.107 old package derivations unchanged. Full matching headers/link/build/positive artifact qualification remain5s.2; no UART claim.
- [x] 5s.2 Realize the optional variant; execute actual source/config/archive/init/
      helper/DT-hardware/argument/manifest/five-load/CRC qualification, documenting
      each necessary new dependency delta and old-output equality. Commit exact
      build receipt and safe executed qualifier; independently review. No implicit
      UART. Narrow command: `python3 tools/mainline-init-exec-return-qualify.py --bundle BUNDLE --dev DEV --normal-report PRIVATE_NORMAL`.
      [Actual full build/new-header object/positive qualifier](../../../../docs/evidence/mainline-init-exec-return/actual-host/README.md) PASS, independently reviewed7a99b32d. Same config/userspace/DT hardware, only identical17-entry module-tree relocation; exact323/341 one-gate policy. Offline build and initial qualifier failures preserved. Root integrated reviewed narrow correctiond361f364 and reran17 focused; no UART/live-preflight claim.
- [x] 5s.2a Restore the now-missing exact pinned host outputs, retaining persistent
      store roots; preserve a new realization receipt and recheck actual byte hashes
      against historical proof, then run the qualifier in a fresh protected directory.
      No UART. Narrow restoration command: `flock /tmp/k230-nix-build.lock nix build --no-write-lock-file --out-link PRIVATE_ROOT --max-jobs 1 --cores 16 .#kernelMainlineInitExecReturn.src .#kernelMainlineInitExecReturn .#kernelMainlineInitExecReturn.dev .#kernelMainlineInitExecReturnTrialBootFiles`.
      [Historical pre-UART availability failure](../../../../docs/evidence/mainline-init-exec-return/actual-host/availability-2026-10-05.json) preserved. [Exact restoration/registered roots/fresh qualifier](../../../../docs/evidence/mainline-init-exec-return/restoration-host/README.md) PASS with identical bytes/manifest151a; independent reviewb903ceb7 PASS. No source/default or board change.
- [x] 5s.3 After NEW protected recovery and reviewed source/build/host gates,
      reserve sole board/UART for ONE passive180s capture. Commit finite observations
      and independent recovery or explicit pending NEW reset; preserve full private
      coverage/unknown-no-input. Command: `python3 tools/mainline-drm-system-trial.py begin --wait-initramfs-in-initcall --without-boot-markers --init-exec-return --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --state NEW_PRIVATE_STATE --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No loader/main, failed-instruction, output-call-return or ordinary-root/glass
      claim from the record;5b.5 stays open.
      [Reviewed guarded staging](../../../../docs/evidence/mainline-init-exec-return/staging-2026-10-05/README.md) and [physical capture](../../../../docs/evidence/mainline-init-exec-return/physical-2026-10-05/README.md) PASS: exact323/341 arguments, all load/CRC guards, one `ret=0` at4.548457 and no qualified login within180s. Full private parser/no-input/identity/hash/time review PASS. Exec setup succeeded; userspace transition and the probe output call return remain UNVERIFIED. Subsequent NEW [protected recovery](../../../../docs/evidence/mainline-init-exec-return/physical-2026-10-05/recovery.json) passed the checker and independent complete recovery review. No earlier reset is reused.
- [x] 5s.4 Independently review recorded boundary/recovery limits, land/push and
      inspect exact CI/published revision. Planning command:
      `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Independent review PASS; physical revision3fbf380d, CI37357725932/deployment PASS and exact work revision, capture timestamps and staging publication HTTP200 verified: [publication receipt](../../../../docs/evidence/mainline-init-exec-return/physical-2026-10-05/publication.json). Subsequent NEW protected recovery checker and independent complete review PASS. Ordinary task5b.5 stays open.

## 5t. PID1 return and first userspace syscall (bounded diagnostic)

- [x] 5t.1 Land independently reviewed source-grounded bounded plan before source
      work. Proof: `openspec validate the-board-runs-a-mainline-kernel --strict`.
      See design.md group5t; independent exact-source/context/order/both-gate planning review PASS and strict validation PASS. Implementation/build/physical outcomes remain UNVERIFIED.
- [x] 5t.2 Implement additive default-disabled two-point PID1 source/kernel/Nix
      variant and typed fail-closed controller selection/parser; preserve parent
      output, userspace bytes, control flow and old package identities. Source
      context/lifetime/one-shot/order/negative gates and selected RISC-V objects
      require independent review. Narrow proof:
      `python3 tests/test_mainline_init_exec_transition.py`.
      [Source/native/RISC-V parent-header proof](../../../../docs/evidence/mainline-init-exec-transition/source/README.md) and [controller/qualifier source proof](../../../../docs/evidence/mainline-init-exec-transition/controller/README.md) implemented and independently reviewed. Root reran17 transition and10 actual patched-site tests PASS after integration. [Complete base-package identity comparison](../../../../docs/evidence/mainline-init-exec-transition/source/identity-evaluation.json) passed with all110 prior attrs unchanged, equal selected kernel/config/params, and matching independently evaluated new outputs. Root reviewed the actual assertion expression, source hashes and object sections/references. Matching full artifacts remain5t.3–4 and physical outcome5t.5.
- [x] 5t.3 Realize and retain new kernel/dev/source outputs with exact config and
      object/Image proof; record build failures separately. Host proof:
      `nix build .#kernelMainlineInitExecTransition .#kernelMainlineInitExecTransition.dev --no-link --print-out-paths --max-jobs 1 --cores 4`.
      [Actual host proof](../../../../docs/evidence/mainline-init-exec-transition/actual-host/README.md): frozen revision a60b0eae full build return0 with retained source/kernel/dev roots; actual new-header three-object W=1 compile zero warnings with config/autoconf unchanged and verified sections/references. No build failure occurred. Independent source and controller actual-host reviews PASS. Physical outcome remains5t.5.
- [x] 5t.4 Build matching new system/bundle and qualify actual source/config/DT/
      archived init/systemd/Bash/loader/helper/transport bytes and manifest. Host
      proof: `nix build .#kernelMainlineInitExecTransitionTrialBootFiles --no-link --print-out-paths --max-jobs 1 --cores 4`, then
      `python3 tools/mainline-init-exec-transition-qualify.py --bundle BUNDLE --dev DEV --normal-report PRIVATE_NORMAL`.
      [Actual qualification](../../../../docs/evidence/mainline-init-exec-transition/actual-host/positive-host-result.json) returned0 for retained bundle/system: four source pins, linked Image/config/dev, archive/DT/init/loader/helper/checksum/CRC/transport verified; 351-byte args, 369-byte literal command. Independent actual-host review PASS. Normal report is an historical host anchor, not live preflight.
- [x] 5t.5 After independent source/build/host review and NEW protected recovery,
      guard staging, reserve sole board/UART and capture ONE passive180s trial.
      Commit finite observations plus independently verified recovery or explicit
      pending NEW reset. Command:
      `python3 tools/mainline-drm-system-trial.py begin --wait-initramfs-in-initcall --without-boot-markers --init-exec-return --init-exec-transition --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --state NEW_PRIVATE_STATE --log PRIVATE_LOG --result PRIVATE_RESULT`.
      No record grants input or proves its own output return, handler/loader/main,
      ordinary root/glass or cause. Task5b.5 remains open.
      [Physical capture](../../../../docs/evidence/mainline-init-exec-transition/physical-2026-10-05/README.md): guarded staging PASS; ONE capture 20:24–20:28 UTC, exit1 readiness unknown; ordered return, kernel-init-return and first-user-ecall records, then only a DCS XTGETTCAP "name" query and silence for 180s. NEW operator reset recovery verified. Independent staging, capture and recovery reviews PASS. Handler/loader/main, emitter of trailing bytes and cause remain UNVERIFIED.
- [x] 5t.6 Independently review, land/push and inspect exact CI/published revision.
      Proof: `openspec validate the-board-runs-a-mainline-kernel --strict` plus
      committed physical/recovery/publication bindings and limits.
      Independent public-packet review PASS. [Publication receipt](../../../../docs/evidence/mainline-init-exec-transition/physical-2026-10-05/publication.json): CI 37385743786 build/deploy success; work page serves a6900de7 and the physical/actual-host pages return200. Ordinary root/panel/glass5b.5 remains open.


## 5u. Camera liveness repeat of the staged transition capture (bounded diagnostic)

- [x] 5u.1 Land this plan. Proof: `openspec validate the-board-runs-a-mainline-kernel --strict`.
      Landed 3e9edb3b (no separate plan review; no source involved).
- [x] 5u.2 After NEW protected recovery, reserve board/UART and repeat the unchanged
      5t command ONCE against the staged bundle with fresh private outputs while
      recording the panel with the bench camera through the whole capture. Commit
      sanitized UART facts, camera frame-difference classification with selected
      stills, and verified recovery or explicit pending NEW reset. Command:
      `python3 tools/mainline-drm-system-trial.py begin --wait-initramfs-in-initcall --without-boot-markers --init-exec-return --init-exec-transition --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --state NEW_PRIVATE_STATE --log NEW_PRIVATE_LOG --result NEW_PRIVATE_RESULT`
      with `ffmpeg -f v4l2 -input_format mjpeg -video_size 1280x720 -i /dev/video0 -c copy PRIVATE_VIDEO`.
      Camera evidence does not identify cause; task5b.5 remains open.
      [Camera repeat](../../../../docs/evidence/mainline-init-exec-transition/camera-repeat-2026-10-05/README.md): UART identical to 5t; camera inconclusive (candidate never lit the panel); exposed panel-init/unused-clock-cleanup timing pattern. NEW reset PENDING.
- [x] 5u.3 Independently review, land/push and inspect exact CI/published revision;
      plan the next probe only from the classified outcome.
      Landed with 5v; CI 37416968692 deploy PASS, page serves 1a03dfcd. Next probe was the 5v clock work.

## 5v. Driver-owned display clocks (fix candidate)

- [x] 5v.1 List the display AHB/AXI/DPIP gates on `vo` and AHB/CFG/REF on `dsi`
      and enable them from probe with `devm_clk_bulk_get_all_enabled()`, so late
      unused-clock cleanup cannot gate them. Host proof: DTB build plus
      `nix build .#kernelMainlineDrmTrialBootFiles .#toplevel-mainline-drm-trial`.
      Done: `ad627a2b`, plus RTC `c73f6ea2`, GPIO clock-names `f2403a13` and
      spi2axi `CLK_IS_CRITICAL` `0b327025` found by physical bisection; builds PASS; reviews PASS.
- [x] 5v.2 Stage the rebuilt ordinary bundle under the guarded pattern and run ONE
      passive180s ordinary capture with the same quiet policy that reproducibly
      stopped in 5r/5t/5u. Command:
      `python3 tools/mainline-drm-system-trial.py begin --wait-initramfs-in-initcall --without-boot-markers --bundle BUNDLE --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL --state NEW_PRIVATE_STATE --log NEW_PRIVATE_LOG --result NEW_PRIVATE_RESULT`.
      Pass needs panel prepare completion, systemd progress beyond the DCS query
      and the controller's qualified login/prompt; record camera stills of the panel.
      [Clock-ownership evidence](../../../../docs/evidence/mainline-clock-ownership-2026-10-06/README.md):
      the quiet SBI-only policy needs a separate variant build, so the plain ordinary
      policy was used. Final `0b327025` bundle reached `candidate-ready-qualified-ordinary-init`
      with normal unused-clock cleanup; recovery verified. Camera showed only the boot splash.
- [x] 5v.3 Review, land/push, inspect CI/published revision. A pass makes task
      5b.5 (ordinary root, deliberate touch) the next step; a fail returns to
      the clk_ignore_unused/pd_ignore_unused ablation.
      Landed on master; CI 37416968692 build/deploy PASS; work page serves 1a03dfcd and the
      clock-ownership evidence page returns 200 (CI for 0aa88740/91da9557/4bb0170c failed on missing
      blob-inventory rows for the 5u stills, fixed in 1a03dfcd). Next: task 5b.5.

## 5w. Display output and full shell on mainline

- [x] 5w.1 Keep the display DDR port clock (`vpu_ddrcp2` CLK_IS_CRITICAL) and fix the
      aliased `dphy_dft` gate; camera-judged bisection over a full live `clk_summary`.
      Proof: console visible on the panel with normal cleanup ([evidence](../../../../docs/evidence/mainline-full-shell-2026-10-06/README.md)).
- [x] 5w.2 Add `k230-mainline-drm-shell` and fix canaan DRM fops `FOP_UNSIGNED_OFFSET`
      so userspace can open `/dev/dri/card0`. Proof: qualified full-shell boot with
      sway active and the Home UI on the panel; recovery verified.
- [x] 5w.3 Review, land/push and inspect exact CI/published revision.
      Independent review PASS; master ae1a4009; CI 37446811633 deploy PASS; work page serves
      ae1a4009 and the full-shell evidence page returns 200. Follow-up: usb_480m/usb_100m still share 0x100 bit 0.