First manual Production Storage v1 deployment

Withdrawn from retry use: ANDROID sparse transfer failed 3154. Use the Storage02 retry checklist. Everything below records the historical first package; it is not current deployment guidance.

READY at the manual package boundary; NOT physically qualified. No assistant physical eMMC write or SPFT operation. First actual eMMC/rootfs qualification belongs to the owner. The latest live system remains SD-backed AUDIO-02.

1. Build Git commit: f2ef297a81cc0229155ba5d96f1955bdd230f11d.

   Canonical project SchulzCode/Y2Linux; existing Luca/SchulzCode identity retained. Later evidence-only commits do not change these built bytes.

2. Exact stock map and 3. classification of every entry follow. All normal

   starts are physical EMMC_USER bytes; the full machine-readable map includes distinct scatter linear values, stock runtime mappings and provenance.

PRELOADER is EMMC_BOOT_1: the scatter's20MiB span is a vendor abstraction, not a physical readback length; each boot hardware region is4MiB. BMTPOOL's sentinels remain UNKNOWN/unapproved. FAT's zero scatter span resolves physically to0x15dc00000 bytes and may contain user media; leave it alone. EMMC_USER capacity is7,784,103,936 bytes. Preserve MBR/EBR1/EBR2; no repartitioning occurs.

Full source-backed classification/dependencies · Machine-readable map.

1. Y2ROOT choice: ANDROID, ext4 LABEL=Y2ROOT.
2. Original purpose/name: stock ANDROID /system, historically stock Linux p5.
3. Physical start: 0x05180000 =85,458,944 bytes; scatter linear0x06580000.
4. Partition size: 0x33400000 =859,832,320 bytes (820MiB).
5. Raw Y2ROOT image size: 536,870,912 bytes (512MiB).
6. Raw Y2ROOT SHA256: 041fbd7fbe0a2966e178649ff958cb3ad3cfea1610ef75aa580ba2391b1f5be8.
7. Y2DATA: stock USRDATA (/data, historical p7), physical0x40380000

   =1,077,411,840 bytes, size0x32000000 =838,860,800 bytes (800MiB). ext4 LABEL=Y2DATA mounted /data; initializes Android data on first install. UUIDs are79324c69-6e75-4801-8000-000000000101 (root) and 79324c69-6e75-4801-8000-000000000102 (data). Root detection checks native internal host and stock geometry, not fixed mmcblk numbers.

8. BOOTIMG, 12. scatter, 13. manifest, and filesystem transports:

All files below are in /home/luca/Dokumente/Code/Y2Linux/out/y2linux-production-v1/.

The scatter maps the .spft.img filesystem files. Their expanded content is byte-for-byte identical to the raw .img; never compare sparse-file hashes with physical eMMC hashes. BOOTIMG is raw, at physical0x01d80000 within its16MiB span. The first scatter selects BOOTIMG/ANDROID/USRDATA; the preserving profile selects BOOTIMG/ANDROID only.

1. Restoration material for every overwritten partition: verified original

   FM sources below exist locally in /home/luca/Dokumente/Code/Y2Player/y2_v3.2.0_FM-20260813/. They restore factory Android, not personalized installed Android state. Preserve a private USRDATA readback before install if original settings/apps must be recoverable; likewise ANDROID if its modifications matter. Keep an independent accessible copy of recovery material. No full-ROM rebackup needed.

1. SPFT boxes to select: BOOTIMG→BOOTIMG.img,

   ANDROID→Y2ROOT.spft.img, USRDATA→Y2DATA.spft.img for FIRST installation only.

2. Boxes NEVER selected in this installation: PRELOADER, MBR, EBR1,

   PRO_INFO, NVRAM, PROTECT_F, PROTECT_S, SECCFG, UBOOT/LK, RECOVERY, SEC_RO, MISC, LOGO, EBR2, EXPDB, CACHE, FAT, BMTPOOL.

3. Download Only procedure: use owner-proven SPFTv5.2032 and its DA, verify

   package checksums, retain before readbacks/table identity, load the package's first-install scatter, review all21 rows, select exactly the3 above, choose Download Only, and use the established owner USB/power entry sequence. No Format All + Download, Firmware Upgrade, Write Memory, table changes or workaround if SPFT reports an identity/table/image error. Remove SD before first normal production boot. Exact install procedure.

4. Readback/verification: before the write capture the13 bounded EMMC_USER

   KEEP ranges in metadata/readback-plan.json. The verifier checks original MBR/EBR prefixes with --before-only; after download recapture these ranges plus full BOOTIMG16MiB, ANDROID820MiB and USRDATA800MiB, before boot. Compare protected ranges exactly and target raw-image prefixes by SHA256:

python3 tools/production/verify_readback.py --package out/y2linux-production-v1 --before /path/to/before --before-only
python3 tools/production/verify_readback.py --package out/y2linux-production-v1 --before /path/to/before --after /path/to/after

Physical starts are BOOTIMG0x1d80000, ANDROID0x5180000, USRDATA0x40380000; scatter linear starts are0x3180000,0x6580000,0x41780000. SPFT normal Download uses its original scatter mapping; EMMC_USER Readback uses physical offsets. Linux whole-disk offsets are those same physical values, while a partition node starts at offset0. No custom DA/global offsets are guessed. Preserve logs proving which device/DA/region was read; file hashes alone cannot establish that.

1. Expected first boot: stock ROM→preloader→LK→Linux6.18.0-y2linux-storage01

   rescue→internal Y2ROOT/Y2DATA→switch_root→Buildroot. Discovery allows40s.

2. Expected no-SD boot: identical boot path; removable SD is ignored by the

   root resolver. Later SD serves media through explicit y2-media mount; nothing autoformats it. Old SD root labels cannot hijack production boot.

3. Expected SSH/USB: initial ACM diagnostics and usb0 at10.42.0.1/24,

   key-only SSH after normal Buildroot boot. New per-owner client private key lives OUTSIDE the package at /home/luca/Dokumente/Code/Y2Linux/out/y2linux-production-private/id_ed25519. Keep it private and backed up separately. Only its new public key is inside Y2DATA. Dropbear generates new host keys on-device and persists them on /data. First key generation can wait for kernel entropy; historical delay was~154s. Use a separate host alias for the new production identity:

ssh -F /dev/null -o HostKeyAlias=y2linux-production-v1 -i /home/luca/Dokumente/Code/Y2Linux/out/y2linux-production-private/id_ed25519 [email protected]

Verify the new host key. No development private key or universal production credential is packaged. USB cable reconnect remains a known deferred limitation.

1. Rescue failure behavior: missing/ambiguous/wrong label/UUID/geometry,

   root/data marker failure, failed executable preflight, unrepairable fsck or mount failure retains rescue PID1 and ACM diagnostics. No automatic format, SD fallback or reboot loop. There is no rescue SSH service. Stock UART/console shell remains where usable; ACM keeps one log writer. Final handover crashes and pre-gadget faults are outside this fallback's guarantee. A torn BOOTIMG can require SPFT because its own rescue may no longer load.

2. Exact restoration: quickest Linux fallback: original scatter,

   Download Only, deselect all, BOOTIMG only→the preserved AUDIO-02 image (4816896bytes, SHA256b9dbf6b528e4afbee2a5ffb2fc65df7f6a076564e92960332e24cee3809b5842), verify readback prefix, insert original SD and boot. It disables eMMC and leaves new internal root/data intact. Factory Android restoration instead selects ONLY BOOTIMG→FM boot.img, ANDROID→FM system.img, USRDATA→FM userdata.img; it destroys Y2DATA. Never restore loaders/tables/ calibration as part of either route. Full restoration/readback procedure.

3. Future OTA support: independent kernel/root/app versions and hashes,

   stable layout1 geometry, explicit component/partition allowlists and ABI/schema requirements. BOOTIMG-only updates must supply/validate matching DRM modules; Y2ROOT image replacement preserves /data. Future app bundles can live under /data/apps/y2player/releases with atomic activation and /data/y2player state, alongside a future built-in Buildroot package. No app partition or app/updater code is implemented. Staged rescue updates are preferred to forced A/B; interrupted BOOTIMG uses external SPFT recovery. No repartition is needed for this direction. Update/installer contract.

Validation and remaining physical boundary

PASS24 regression tests, emitted kernel/DT/D08 memory/BOOTIMG checks, matching DRM module, ARM ABI and ALSA utilities, rescue shell syntax, ext4 e2fsck checks, label/UUID, root/data contents and ownership, sparse RAW/FILL expansion hashes, all21 stock scatter coordinates/no overlap, allowlists, versions and package hash inventory. Synthetic readback tests reject both root-image corruption and protected-byte mutation; they are explicitly not physical readbacks.

Production Storage v1/#33/milestone3 remains ACTIVE. M3's44.1kHz result stands, 48kHz/LR/repeat remain pending. No-SD boot, native internal MMC filesystems, writability/persistence, display/input/audio retention, protected-byte readbacks and rescue-negative behavior must be physically demonstrated. Expected RAM is comparable to live AUDIO-02's954384KiB, with four CPUs; record the actual new value. Do not close the milestone from SPFT completion. M4/M5 remain unstarted and Y2PlayerNative remains deferred. STOP here for the owner's manual operation.