Whole-platform evidence ledger — 2026-09-23

Companion to the owner review. This is a documentation-only assessment of application-facing platform behavior, not a milestone closure, implementation authorization or new physical qualification.

Scope and evidence authority

Y2Linux source HEAD: 5f6b4468fb43605ca1da679420823afa72cea73f (clean at entry). Y2Reborn HEAD: d9ba0549e6b34eff029bd13f7c33a491fee09e66; its final commit is validation documentation. The packaged code is dde3c537cec66b3b2f70a032584cb054bdb3037e. Existing untracked Reborn review/audit documents were read and preserved.

The local candidate out/y2linux-reborn-correctness-closure-01 exists, with kernel 6.18.0-y2linux-gpu-02, Buildroot 2025.02.18, Reborn 0.1.0, FFmpeg 9.0.2, BlueZ 5.87, BlueALSA 5.0.0 and SBC 2.2. Its manifest and generated kernel configuration were inspected. Its existing hash/test receipts were read; the images were not rehashed, rebuilt, executed or installed.

The [September 23 closure record][C] reports 143 Reborn tests, 67 + 38 platform tests, eight ARM/QEMU software checks and package validation passing. Those results certify their tested software boundaries, not hardware behavior. The candidate has no retained physical acceptance. Hardware claims below name older receipts; neither a reused kernel release string nor a passing build transfers that evidence to all changes in a newer image.

Current GitHub issue state was read: #16/#27/#28/#29/#31/#32/#33/#34 open, #30 closed. No tracker writes occurred. The [standing audit][R], earlier [whole-system audit][A] and [subsequent review][V] were read before checking the current implementations. Historical manifest/version, database-recovery, SD-pruning and missing Bluetooth-trust findings have subsequent fixes [M], [C]; they are not repeated here as unfixed platform defects. AVRCP application integration and R9B's underlying BlueALSA-format verification limit remain separate gaps.

Evidence matrix

Implemented describes the indicated mechanism, not the complete product promise. Targeted host tests exercise selected policies, parsers, mocks or fault paths. ARM built means included in the recorded candidate; QEMU is userspace emulation, not execution of Y2 peripherals. Physical and measured evidence is bounded to the cited build/workload. None found means no qualifying retained endurance result was located; incidental uptime or owner acceptance is not a repeatable endurance test.

Boot, storage and application durability

Production init and the resolver check internal controller, capacity, partition geometry and ext4 identities, inspect markers read-only, run fsck, then mount root/data and switch root. Failure paths retain rescue; there is no automatic format or SD root substitution. This is valuable containment. It does not establish an end-to-end boot deadline or repair a post-handoff hung service. Reborn's supervisor retries abnormal exits with a budget; its diagnostic heartbeat watcher does not establish system-wide hardware-watchdog recovery. Define failure classes, service readiness and bounded escalation before adding automatic reboot behavior.

The update architecture explicitly describes an unimplemented single-slot updater. BOOTIMG and ANDROID are normal package targets; Y2DATA is preserved. Normal Linux's write guard permits root/data writes and currently rejects BOOTIMG writes. OTA kernel installation therefore needs a separately reviewed rescue writer/guard contract. A torn root can leave rescue usable; a torn BOOTIMG can remove rescue itself and require external SPFT. Fallback files, filesystem journaling and hashes do not implement rollback or authenticity. Prove local staged installation/failure recovery before remote delivery; Wi-Fi only supplies transport. Include schema rollback compatibility, backup consistency, staging space, boot-health acknowledgement and key policy.

The storage layout provides an 820 MiB root slot (current image 512 MiB) and an 800 MiB data slot. The larger legacy FAT area is not free staging space. Media, database, cache, logs and OTA staging compete for the data budget. Do not assume the device's nominal total flash capacity is application-available capacity.

Both controllers' DT configuration remains one bit at 13 MHz; eMMC also has explicit legacy-timing/serialized-request constraints. The ideal single-data-rate wire ceiling is **13 Mbit/s = 1.625 MB/s before overhead** (a calculation, not a benchmark). This is a plausible shared bottleneck, not a measured explanation of all startup or scan latency. Measure sequential and random I/O, file and directory fsync, cache effects and playback contention before any clock/bus/DMA/filesystem change. The guard permits specified flush/cache commands; source permission alone does not prove device cache durability. Erase/trim/sanitize remain rejected. Obtain supported wear indicators read-only where available; quantify write volume before forecasting flash life.

SD mounting accepts a unique ext4/vfat filesystem with nosuid/nodev/noexec. There is no exFAT support or general checked/repair/eject lifecycle. Reborn now checks UUID and mount generation before pruning [C], but target removal during scan/decode, blocked unmounts, card replacement, full filesystems and I/O-error recovery remain unqualified. Preserve prior library data when media disappears.

Reborn's SQLite boundary uses one writer, WAL, synchronous=NORMAL, a two-second busy timeout and startup quick_check(10). Recent tests distinguish corruption from lock, permission, I/O and full-disk failures. Its last-query latency gauge is useful but does not supply percentiles, queue delay or a target benchmark. WAL/NORMAL allows recent committed transactions to be lost on power failure; application crash recovery is a different claim. SQLite's synchronous contract.

The platform must define how much loss is acceptable for rebuildable metadata and for user state. Reborn's session writer fsyncs the temporary file, renames it and fsyncs the parent; periodic checkpoints run at 15 seconds plus explicit events. These mechanisms do not prove the end-to-end flush path or cap a stalled write's latency. Source limits of 20,000 query/queue items, 250,000 scanned/existing records and an 8 MiB session are allocation guards, not physically qualified library sizes. Benchmark realistic schema/data, cold and repeated scans, concurrent playback, WAL checkpoints, nearly-full storage and restart integrity. Distinguish process interruption tests from electrical interruption; the latter depends on power/recovery scope.

CPU, memory and power

The candidate's generated metadata/kernel.config confirms PREEMPT_NONE, 100 Hz ticks, NO_HZ_IDLE, CPU frequency statistics and HIGHMEM. Normal init selects schedutil; offline/default policy is powersave. The DT offers 598/747.5/1040 MHz at fixed 1.15 V; cpuidle offers WFI only, not CPU power-down idle. SPM deep suspend is separate. Existing samples prove operation, not frequency residency, useful idle energy savings, scheduler latency or an audio deadline. Do not infer a need for RT scheduling, a new governor or voltage scaling from their mere availability.

The same generated configuration has no PSI, perf events, ftrace, schedstats, cgroups or swap. Basic proc/sysfs CPU, task, VM, disk and idle/frequency counters can support an initial baseline. Record absent counters as unavailable; add a small diagnostic profile only if needed. Reborn's 15 ms main-loop sleep, two- second service polling, and other background timers are sources to investigate; their power/wakeup impact has not been measured. Sampling also perturbs idle.

[DEV-02 memory evidence][D] reports 954660 KiB = 932.285 MiB MemTotal and a completed 256 MiB allocator test. The larger run stopped at 600 seconds, not a full pass. Later images have different footprints. Existing exclusions guard loader/radio/display ownership; capacity pressure is not permission to reclaim them. Measure lowmem/HIGHMEM separately, process RSS/PSS, slab/page cache, allocation/reclaim stalls, decoder/artwork/library peaks, OOM behavior and post-warmup growth. A small GPU utility's RSS is not Reborn's memory budget.

Thermal acquisition uses own efuses and exposes CPU/PMIC die values; earlier invalid readings drove source corrections. GPU-01's short temperatures are useful relative observations, not externally calibrated absolute temperatures or battery measurements. Sustained combined decode/render/scan/radio/charging heat, thermal cooling effectiveness and a supported ambient envelope remain unknown. Define a measured envelope before tuning clock or thermal policy.

Charging has substantial fault-containment implementation and host tests. The driver exposes voltage, presence/status and configured charge limits, not measured net current, SOC or battery temperature. FULL is a voltage/time policy result. Earlier [70 mA evidence][F] records falling voltage; later POWER-03 owner acceptance [P] remains valid within its scope. Commit 3dc0a8b subsequently changes depleted-battery charging to retain the 450 mA selector on eligible sources. Its recorded limitation still requires physical evidence. Do not extrapolate older acceptance to it.

Offline charging gates normal boot on voltage and user intent. Reborn's power adapter reads supplies and requests shutdown; neither it nor the inspected normal platform services implements a complete low-battery warning/checkpoint/shutdown policy. This is a missing operational capability, distinct from charger protection or eventual hardware cutoff. Assign the platform decision/timeout ownership, provide an application stop/checkpoint handshake and handle missing sensors, blocked storage and a hung app without requiring the UI to remain alive. Derive thresholds/reserve from measured pack behavior; this review sets none.

[GPU-01][G] proves runtime domain-off, static-context redraw and renderer termination recovery. Deep sleep failed and a subsequent staged test exposed the CPU3 status-bit mismatch. Source correction/host tests do not prove resume. Suspend policy quiesces radios and honors activity leases; active charging is also constrained by the kernel. Required evidence is the same boot ID/process state after wake, intended Power/RTC wake reason and restored storage, display, audio, input and radio services. Measure energy and repeat cycles only within the accepted power procedure. Screen-off playback is not system suspend.

Connectivity and USB contracts

Connectivity orchestration starts calibration, supplicant, BlueALSA and reconnect helpers, with selected child liveness checks. The WPA event hook starts DHCP and clears addresses on disconnect. Thus complete networking is partly implemented, not merely a scan stub. However, process existence and supplicant COMPLETED do not prove route/DNS/secure-download readiness. No retained WPA association, DHCP/DNS/data or throughput receipt was found. Qualify wrong credentials, absent AP, DHCP renewal, signal loss, service restart and saved network reboot; measure time to usable IP/DNS and recovery rather than counting scan results. RTC/time bootstrap matters for TLS; curl and CA certificates in a rootfs do not complete this contract.

BlueZ plus BlueALSA/SBC is built. The platform preferred-peer helper owns retries; upstream reconnect attempts are disabled to avoid competing owners. The current Reborn adapter sets trust after user confirmation and invalidates stale transport epochs [M], [C], superseding the earlier missing-trust finding. Physical evidence remains adapter power/discovery and short concurrent Wi-Fi scans, not pairing or PCM delivery. Qualify fresh bonds, peer loss, daemon/bus restarts, SBC transport and Wi-Fi traffic coexistence. The ALSA plug wrapper still prevents a claim about the underlying PCM's exact format; optional codecs and AVRCP are separate scope.

USB is explicitly peripheral-only ACM/ECM in PIO mode. The two measured [POWER-02 reconnects][U] used an on runtime-PM workaround. Current kernel USB code holds a PM reference across live sessions and detach/reentry; that correction already exists. The old userspace pin is release-specific and does not apply to GPU-02. Current repeated reconnect under automatic runtime PM still needs proof; do not propose the already-present reference fix as new work. Throughput, idle draw, charger/cable changes and suspend interactions need measurement. Host/OTG is disabled in both config and DT; SoC capability alone does not prove board VBUS sourcing or role wiring.

Diagnostics, security and maintainability

Useful pieces already exist: platform inventory, bounded GPU telemetry, charging/USB observers, ACM capture, two 256 KiB persistent syslog files, and Reborn's bounded metrics, events, diagnostics and restart budget. Preserve them and establish a shared record format: host date + boot/monotonic time, source/image identity, units, counter-versus-gauge semantics, workload, collection cost and failures. Application/library names, SSIDs and identifiers need controlled export. Persistent logs need wear/free-space budgets; logs on failing storage cannot be the only recovery evidence.

There is no qualified persistent early-crash/reset-cause path. Physical UART remains unresolved; GPU-01 lost continuation logs across a failed suspend. panic=0 and an exit supervisor are not a system hang-recovery policy. The AP/system watchdog must be distinguished from the implemented charger watchdog. Define retention, reset cause and recovery escalation without introducing a reboot loop. Also correct the demonstrably stale y2-status power message: it contradicts the implemented charger. Versioned software capability, service readiness and physically qualified behavior should be separately visible.

Key-only Dropbear binds the USB address; persistent keys/bonds/configuration have private directories, and packages exclude private SSH keys. These are useful security properties. Reborn and its native media/graphics dependencies still run as root. The candidate kernel disables seccomp, LSM security, stack protector and cgroups; rootfs remains writable. This is a development posture, not a sandboxed consumer service. Define the threat model and necessary privileged operations before selecting a small privilege/hardening boundary. Do not expose additional network debugging merely because Wi-Fi becomes usable. Define first-owner provisioning, time/entropy readiness and diagnostic access.

Input locks, exact kernel overlay hashes, device-isolated kernel builds, vendored Rust and corrected per-payload identities are strong foundations. Historical M1 duplicate builds matched exactly. The current complete production release has no retained independent clean-host two-build comparison. Buildroot/native steps also use host tools, and the paired Reborn checkout/toolchain/owner inputs need a complete acquisition recipe. Checksums establish identity, not update authenticity. Preserve selected production test profiles; automate them and archive release receipts without confusing historical suites with current passes. Maintain the version-specific Buildroot overrides and board patches with clear owners, a kernel/userspace security-update cadence and a dependency/source/license inventory. Firmware redistribution remains unestablished in the manifest; this owner-local candidate is not a completed public distribution package.

Measured facts and qualification limits

No retained eMMC/SD MB/s or IOPS baseline, fsync latency distribution, representative SQLite timing, CPU-frequency/idle residency report, current Reborn RSS trajectory, Wi-Fi throughput/reconnect series, calibrated battery runtime/energy series or integrated endurance pass was found in the reviewed receipts. Existing counters/tools are not substitutes for recorded results.

For future qualification, start with bounded attended scenarios, then repeat on the same reference image. Freeze workload sizes and acceptance budgets after measurement. A proposed final 24-hour mixed workload should require no unexplained reset, corruption or normal-playback underrun, stable memory after warmup, and bounded documented recovery from expected injected failures. Repeat boot/reconnect/suspend and update-interruption scenarios only after their prerequisites; a long idle uptime alone is insufficient. Keep normal operation, failure injection and wear testing as explicitly identified workload classes. No tests, benchmarks, device commands or unchanged provenance checks were executed for this review.

[R]: roadmap-gap-audit.md [C]: ../../../Y2Reborn/docs/validation/LUNA-CORRECTNESS-CLOSURE-01.md [M]: ../../../Y2Reborn/docs/validation/LUNA-SOFTWARE-MODERNIZATION-01.md [A]: ../../../Y2Reborn/docs/audit/current-system/03_Y2LINUX_AUDIT.md [V]: ../../../Y2Reborn/docs/review/CURRENT_PROJECT_STATE.md [S]: ../hardware-evidence/2026-09-13-storage06-owner/README.md [D]: ../knowledge/y2linux-dev02-live-qualification.md [G]: ../hardware-evidence/2026-09-18-gpu01/README.md [W]: ../hardware-evidence/2026-09-17-m5-connectivity10/README.md [U]: ../hardware-evidence/2026-09-15-usb-reconnect/README.md [P]: ../build/y2linux-m5-connectivity-01-deployment.md [P2]: ../hardware-evidence/2026-09-14-m4-power02-charge-fault/README.md [F]: ../hardware-evidence/2026-09-14-m4-70ma-baseline/result.json [B]: ../../../Y2Reborn/docs/validation/2026-09-18-radio-inspection.md [L]: ../../../Y2Reborn/docs/validation/REBORN-STARTUP-02.md