M5-CONNECTIVITY-01 — manual deployment handoff

**The integrated candidate is built and host-validated. M5 remains OPEN pending owner installation and physical qualification.** POWER-03 is the owner-accepted M4 baseline. No fresh entry audit, private partition reacquisition, physical flash or protected-partition write was performed.

1–5. Source, hardware and factory identity

1. Source commit: 022c701010c467904ab6025cd98535d3b861c771. Kernel 6.18.0-y2linux-m5-connectivity-01;

   rootfs 2025.02.17-connectivity.1. The evidence commit is the commit containing this receipt; it does not change the built source identity.

2. Controller: CONSYS_MT6582; Wi-Fi is MT6582 AHB fullmac. Bluetooth is

   BTIF + AP_DMA → STP/WMT → standard HCI. One shared antenna. The older board has no useful FM reception; FM is unsupported and excluded from M5.

3. Silicon stepping: actual HVR/FVR remains a first-boot measurement.

   The driver reads chip/HVR/FVR and accepts the inventoried E1/E2 HVR family 0x8a00/0x8a01, with chip 0x6582. No invented numeric PCB revision.

4. Factory mapping: read-only logical NVRAM 0x400000/5 MiB,

   PROTECT_F 0x900000/10 MiB, PROTECT_S 0x1300000/10 MiB. The first 4 MiB AP backup is empty; the tail is history receipts. BT LID 1/001 is 64 bytes; Wi-Fi LID 30/000 is 512 bytes; special LID 36 is PRODUCT_INFO. This unit's PROTECT_F provides ST33A004 (2060 bytes) and MP0D_000 (4); PROTECT_S provides ST33B004 (2060). They remain opaque MD factory records. Journal replay and generated calibration filesystem writes affect bounded RAM only. The native cold boot must satisfy the filesystem completion gate, shut MD1 down, and complete WMT calibration before radio use; physical success is still pending.

5. Addresses: use a valid firmware/controller address when present; reject

   zero/multicast and the known generic BT default. Otherwise independent random local unicast addresses persist privately in /data/connectivity. Board defaults have their generic address fields erased. No release-wide identity, copied external calibration, private raw dump or protected write is used.

6–7. Firmware and provisioning

1. Firmware list, exact SHA256 and first-start loading order:

Install directory: /lib/firmware/mediatek/mt6582/. Patch _1 precedes _0 by header sequence. After successful cold calibration, MD1 stays off for the rest of this Linux boot; warm CONN restart reloads volatile patches and function firmware. Wi-Fi RAM code loads when Wi-Fi starts. The build also installs address-free WIFI.defaults (512 bytes) and BT.defaults (64), with exact hashes in the owner input receipt.

1. Provenance/legal status: the five files are from the owner's retained

   Y2 v3.2.0_FM stock image and the two defaults from its hash-checked stock libcustom_nvram.so. Reuse the completed inventory. Vendor redistribution permission is not established. This is an explicit owner-local image. No blobs are committed/uploaded and no boot downloads occur.

8–20. Implemented production platform

Implementation details and source provenance.

21–23. Candidate images and Y2DATA preservation

1. BOOTIMG changed. Package directory:

   /home/luca/Dokumente/Code/Y2Linux/out/y2linux-m5-connectivity-01/.

2. Y2ROOT changed. Use both new images together:

1. Y2DATA is preserved in place. No data image, formatting or schema reset.

   First normal boot creates private network/Bluetooth/identity directories and bind mounts standard BlueZ/BlueALSA state paths. Existing media, settings, SSH authorization and host keys remain. Credentials/bonds are absent from immutable release inputs. BOOTIMG/Y2ROOT updates keep the existing schema-1 platform contract; the OTA updater itself is not implemented.

Host validation: 81 production/M4/connectivity tests, ARM executable/ plugin checks, emitted DT/config/BOOTIMG checks, clean ext4, verified firmware, and 16 package rejection cases. Evidence. These results do not prove calibration, radio operation, EDR, coexistence, reconnect, standby consumption or M4 resume behavior on this candidate.

24–25. Exact owner installation and fallback

1. Install manually:

1. On the host, verify the complete package:

   ```sh
   cd /home/luca/Dokumente/Code/Y2Linux/out/y2linux-m5-connectivity-01
   sha256sum -c SHA256SUMS
   ```

2. Close other flash/serial tooling, shut down the Y2, and open the
   established working SP Flash Tool/Download Agent setup.
3. Load this directory's `MT6582_preserve_data_scatter.txt` and choose
   **Download Only**. Confirm exactly **BOOTIMG → BOOTIMG.img** and
   **ANDROID → Y2ROOT.img** are selected from this directory. Every other
   row, including USRDATA, PRELOADER/LK, partition tables and protected
   calibration, remains unchecked and has no payload mapping. Do not use
   Format or Firmware Upgrade.
4. Perform the established manual USB connection/download procedure and
   wait for success. Disconnect the flashing cable. Charger insertion
   should retain M4 offline charging; hold and release Power intentionally
   for normal boot. Connect the PC for existing `[email protected]` SSH access.
5. Report the candidate running. The assistant then performs the SSH tests;
   radio preferences initially default off and no AP password is packaged.

1. Fallback: use fallback/MT6582_preserve_data_scatter.txt, Download Only,

   with its POWER-03 BOOTIMG and previous Y2ROOT, selecting the same two rows. Their exact sizes/hashes are in the table above and SHA256SUMS. This restores the owner-accepted platform while preserving current Y2DATA.

26. One coherent physical qualification session

1. Follow the nine-phase physical procedure:

1. Verify candidate identity, same internal storage/data, baseline M4 health
   and private bounded logging; record actual silicon and calibration state.
2. Wi-Fi scan, legal country, WPA2, DHCP renewal, gateway/DNS/LAN/HTTPS, wrong
   password/forget/save, AP disappearance/return and saved reconnect.
3. Pair/trust multiple available audio categories; prove SBC, AVRCP controls,
   volume/metadata, peer off/on, local disconnect and screen-off playback.
4. Read EDR/LE capabilities and credit behavior; test BLE scan/GATT if supported
   with an available phone/accessory. Record unavailable categories honestly.
5. Sustained useful Wi-Fi transfer plus SBC playback, recording throughput,
   dropouts/retries/HCI errors/firmware resets and reconnect behavior.
6. Five radio toggle/reconnect cycles and controlled all-off recovery; verify
   shared power release and absence of unexpected reboot/controller wedge.
7. Active-work suspend inhibition, Power and RTC deep wakes with same boot
   ID and incrementing SPM counters, radio reconnect, display/input/wheel/
   ALSA/eMMC/SD/USB/charging regression checks.
8. Reboot reconnect and persisted identities/networks/bonds, plus offline
   charging and intentional normal boot with radio absence in offline mode.

Owner actions are limited to manual installation, available AP/peer setup, charger/Power handling and listening/visible confirmation. Commands run over SSH. Only concrete physical failures justify targeted corrections.

STOP for owner manual installation. M5 is NOT CLOSED.