Storage06 internal boot and owner SSH — accepted on hardware

The owner flashed the single corrected Storage06 BOOTIMG, then the corrected initial Y2DATA image. SSH now authenticates with the existing ~/.ssh/y2linux_ed25519 identity. Internal Y2ROOT and Y2DATA mount read-write without an SD block device. No further flash is needed for this fix. Authenticated physical evidence and retained data-package checks.

Root cause and production correction

The production eMMC port omitted the stock logical disk translation. Linux sector 0 was reading the reserved native prefix instead of the intact MBR. The actual stock driver adds 23552 sectors and exposes a 15203328-sector disk. Storage06 restores that mapping once for CMD17/18/24/25, leaves EXT_CSD and companion command arguments intact, and keeps writes limited to the original ANDROID/USRDATA spans. Upstream Linux parses the existing MTK tables; no table, DT, hardware clock or memory change was needed. See the source and stock-binary proof.

The original data template separately authorized a public key whose private counterpart was missing. The corrected seed uses the owner's existing .pub file exactly. No client identity was generated, inspected or copied. Normal production packaging now defaults to that existing public file and validates the authorization inside the completed Y2DATA filesystem before publication. /root/.ssh resolves into persistent Y2DATA; BOOTIMG/Y2ROOT updates preserve it.

Exact artifacts

All paths below are relative to the repository root.

Kernel source: bea30cd5883f524a252d8b94d7e914d9d2f7cbdb. Owner-key packaging source: dcb7f45fd7fbe0adffc10195239f8df934491c8b. The root filesystem retains its Storage04 build metadata; the running kernel and its BOOTIMG-owned modules are Storage06. The independent component contract permits this unchanged userspace reuse.

The BOOTIMG digest above now matches a complete 5193728-byte read through the running Linux block device. The Y2DATA digest identifies the unused flash seed; mounted data subsequently changes as the system creates persistent host keys. The old rescue fallback restores the known rescue/ACM state, not working internal boot. The original data seed restores its old authorization failure.

Manual selections used for this correction

Storage repair: SPFT Download Only, load out/y2linux-production-v1-r6/MT6582_BOOTIMG_only_scatter.txt, select BOOTIMG only.

Owner-key initialization: SPFT Download Only, load out/y2linux-production-v1-r6-owner-key/MT6582_Y2DATA_only_scatter.txt, select USRDATA → Y2DATA.img only. BOOTIMG, ANDROID and every other row stay unchecked. Never select Format or Firmware Upgrade. This initialization replaces Y2DATA, including its initial state and generated server host keys; the owner confirmed there were no saved files or settings to retain. It is not a normal system update.

Both manual flashes have now been reported complete. MBR/EBR1/EBR2 remain byte-identical to the stock fixtures through Linux reads. Y2ROOT is p5 at 166912 + 1679360 sectors; Y2DATA is p7 at 2104320 + 1638400 sectors.

Physical acceptance

The completed test is a boot with no SD block device followed by:

ssh -i ~/.ssh/y2linux_ed25519 [email protected]

Authenticated read-only commands confirm Linux 6.18.0-y2linux-storage06, both internal ext4 mounts, exact geometry/UUIDs, four CPUs, 954376 KiB RAM and USB ECM 10.42.0.1/24. The public file in live Y2DATA has SHA256 bf9cc937fb5dcee8569514b674fb9b3d5ba25396162efac7e8854f88bfe98c25, matching ~/.ssh/y2linux_ed25519.pub and fingerprint SHA256:IS9HhrmQKRtlEEbrcJjZa0XQHVwnRXRUzQQ61/7XAb8. The host USB profile is 10.42.0.2/24 with no default route. The host's obsolete 10.42.0.1 server-key entry was replaced with the public key verified after initialization; the normal SSH configuration now succeeds too.

54 firmware regressions, ARM shell/ABI checks, BOOTIMG bounds and 13 package rejection cases passed before the kernel flash. The localized SSH change passed five focused source tests, ARM filesystem identification, ext4 integrity checks, exact public-key validation and 11 isolated data-package rejection cases.

Two synthetic ext4 buddy-cache inode warnings remain recorded; filesystem checks complete cleanly and the system boots. No deliberate physical scratch write, protected-region write, stress or power-fail test was performed. Those wider qualification gates and #33 remain open; this pass activates no later subsystem.