Production Storage / Installation v1 partition audit

Current correction: stock Y2 eMMC address compatibility. Storage05's physical boot failed, but the corrected owner readback at21:10:43 CEST proves intact MBR/EBRs and exact flashed ext4 identity prefixes. The actual stock FM kernel adds23552 native user sectors and exposes15203328 sectors; the port omitted that mapping. Stock geometry/classification below remains unchanged. Upstream Linux6.18 parses these tables without a compatibility parser. Storage06 ACM now confirms internal ext4 read-write root/data and Buildroot. SSH now authenticates with the existing owner key after the manual data initialization. Accepted deployment. Deliberate scratch-write/stress acceptance remains outside this read-only check. BOOTIMG now owns loadable modules; rootfs/data and module ownership follow the update contract. No physical success is inferred from builds.

Current correction: the first manual attempt completed BOOTIMG transfer but failed3154 on ANDROID. Selected DA[5] rejects sparse FILL. Storage02 uses raw ext4 transport. DA physical user capacity is7818182656bytes (15269888sectors); the historical Android exported disk remains7784103936bytes (15203328sectors). The difference is outside layoutv1 allocation, never reclaimed. See the retained failure proof. Partition boundaries and classification below remain unchanged.

2026-09-13, baseline 1583360. All 21 stock scatter entries reviewed before implementation. Sources: reconciled physical Android map, map interpretation, LK/boot contract, recovery material, native MSDC identity, donor/address research, and local owner-proven FM scatter. No source or ROM-wide rehash was repeated. Only the scatter, overwritten-partition stock sources and table bytes are checked for this package. Current Linux disables eMMC; initial SSH timed out; owner then connected Y2 and read-only SSH succeeded. Native CID/CSD evidence and stock runtime metadata remain the latest available evidence, not live native filesystem proof. 48 kHz remains unqualified; M3 is not closed.

All normal starts below are stock logical disk bytes, matching the scatter's physical_start_addr field. Native EMMC_USER commands add0xb80000 (23552 sectors). Legacy global DA coordinates instead add0x1400000. The full JSON preserves the original scatter fields; current packages also carry explicit storage_addressing and corrected readback coordinates. PRELOADER (EMMC_BOOT_1) and BMTPOOL (sentinel) are separate: the vendor20MiB PRELOADER span is not a hardware boot-region extent (each boot region is4MiB).

FAT's zero scatter length is dynamic: stock runtime resolves 0x15dc00000 bytes from 0x72380000, ending at 0x1cff80000. The historical Android exported bound is 0x1cff80000; DIAG01 confirms native physical capacity 0x1d2000000 (15269888 sectors). BMTPOOL has no approved operational range. EBR1's vendor allocation is 512 KiB, but Linux's stock p1 view is only 1024 bytes; preserve both facts.

Reuse decision and dependencies

LK reads BOOTIMG's legacy Android/MediaTek envelopes and transfers its ramdisk; it does not need Android /system or /data to run Linux. Preloader loads stock LK and retains the stock partition contract. No table, LK, preloader, recovery or security mutation is required. Stock recovery still expects Android filesystems: never use its wipe/update menus on Y2Linux. Restoring Android requires the verified FM boot/system/userdata images (factory state, not original personal Android data). Original installed Android data is not backed up; take a private USRDATA readback before first install if its personal state must be recoverable. Preserve FAT/media.

Native Linux must check host11230000, nonremovable MMC type, disk capacity and partition start/size before accepting LABEL=Y2ROOT/Y2DATA. Labels alone are not write authorization. No fixed mmcblk number or vendor /emmc alias is assumed. Both native filesystem mounts and owner-key SSH are now **physically confirmed on Storage06**. Broader write/power-fail qualification remains. Resolver failure leaves ACM rescue active.

CACHE (126 MiB) cannot hold the current 512 MiB root image. FAT is large but dynamic and may hold user media; it is unnecessary for v1. ANDROID is sufficient and preserves the stock tables. USRDATA provides independent persistent storage now. A/B BOOTIMG is not cheaply available without taking RECOVERY or changing LK's selection contract. Prefer staged single-slot updates from rescue; reserve no new partitions. Y2DATA can stage compact current system/app payloads; future updater must check free space and expanded size, and permit host-assisted recovery if a larger image cannot be staged. No promise of automatic rollback after torn BOOTIMG.

Native write policy review

Production MSDC remains at legacy one-bit/13MHz with inherited LK pinmux and rails. The v6.18 MMC core needs EXT_CSD WRITE_BYTE using command-set1 (see locked include/linux/mmc/mmc.h and drivers/mmc/core/mmc_ops.c), including volatile ERASE_GROUP_DEF initialization that the historical identity-only kernel rejected. Storage03 permits explicitly reviewed volatile EXT_CSD controls and read/identity commands, validated bounded CMD23 companions and idempotent unchanged user-area selection. It refuses boot-configuration changes, other hardware partition selection, erase/trim/sanitize, RPMB/vendor operations and firmware writes. Only sector-addressed cards of the observed capacity in EMMC_USER may issue writes; the complete request must fit ANDROID or USRDATA. Boot-area enumeration is disabled and production uses serialized requests. See the correction rationale. All other stock partitions remain outside the write allowlist, including BOOTIMG; future rescue OTA must deliberately extend the guard for that component. This is accident containment, not a security boundary against a replaceable kernel.