Owner reset and state export

Software contract; target filesystem/flush/reboot qualification remains PHYSICAL_GATE. No maintenance command has been run on Y2 during this pass. Commands operate only on identity-checked Y2DATA. They never format it or touch protected partitions, NVRAM, firmware calibration or factory records.

y2-platform export-state creates a private mode-0600 archive under /data/exports. It includes the atomic Reborn session (settings/queue/position) and Bluetooth preferred peer, excluding bonds and all private keys. Add --include-database for a consistent SQLite online backup/quick_check; the source is opened read-only and checked against replacement. Add --include-network only when deliberately exporting private WPA credentials. The manifest records that privacy choice, source identity, sizes and hashes. Each file and the SQLite snapshot is coherent; no cross-file transaction is claimed. Download the archive over authenticated USB SFTP and verify its reported SHA256. Incomplete archives have a .partial name, never a successful export receipt. No automatic import or untrusted archive extraction is provided.

Reset scopes are separate:

Full logical reset preserves owner SSH access, entropy, platform boot/update/ rollback records, existing exports and reset quarantine, factory/calibration, and unknown data directories. It is not secure erasure of every old byte or an indiscriminate Y2DATA wipe. Existing exports can preserve sensitive owner state and must be handled separately before handing the device to another owner.

y2-platform reset plan --scope settings first reports consumers that must be stopped. It never stops hardware or deletes files automatically. Stop the listed init services with a bounded owner command (for example `timeout 10 /etc/init.d/S90reborn stop`) and run plan again. If a process remains in kernel I/O, execution refuses rather than proceeding. The plan returns exact paths, identities, preserved state and a five-minute confirmation digest.

y2-platform reset plan --scope settings
y2-platform reset execute --confirm DIGEST
# Full user reset requires both the matching full-user plan and:
y2-platform reset execute --confirm DIGEST --erase-user-music

Execution rechecks process owners, update state, boot/mount generation and every target inode before mutation. A durable maintenance marker prevents Reborn, connectivity, BlueZ and readiness startup while an operation is incomplete. Each rename into /data/reset-quarantine/ID is fsynced and recorded. After interruption, stop any listed consumers and use reset resume --confirm DIGEST (and the full reset flag if applicable). Resume across a new boot requires the same validated data UUID, original inode identities and private journal. Conflicting new files are never overwritten. Keep the marker and inspect the exact source/quarantine paths if conflicts prevent resume; do not force a reset through uncertainty. On success the marker is removed; the owner reboots through the platform command so ordinary initialization recreates missing defaults and service bind mounts.

Quarantine makes reset recoverable but does not free its occupied space. Explicit reset purge --id ID --confirm DIGEST deletes only that completed reset's numeric payload entries, at most 256 entries/eight seconds per call. Repeat while it says MoreRemaining. It pins directories, rejects submounts, and unlinks symlinks without following them. The small manifest is retained. No cache cleaner ever purges this user-state recovery area or removes music automatically.

Tests exercise live WAL backup, credential exclusion, exact settings-only reset, process/mount/confirmation gates, interrupted multi-file reset across boot, full-reset preservation and symlink-safe bounded purge. Host tests are separate from physical eMMC power-loss behavior. All current services still run with owner/root privilege; this utility narrows paths and state transitions, not the trusted owner's administrative authority.