Y2 + Reborn Platform 1.0 integration plan
Independent final baseline — 2026-10-04
Current software handoff: Y2LINUX-PLATFORM-V1-BASELINE-01 — READY_FOR_PLATFORM_V1_PHYSICAL_QUALIFICATION. Compiled Linux 98daf3f0220f4a1580bb4893094ee9f0e02362a5 / Reborn 9cd12baeeb70b204e08299bd4c91c8c35604c304; kernel 6.18.0-y2linux-platform-v1-baseline-01, root 2025.02.18-platform-v1.24. Canonical owner candidate: /home/luca/Dokumente/Code/Y2Linux/out/y2linux-platform-v1-baseline-candidate. Fresh 475 production cases / 465 passed / ten dependency skips, all ten independently passed; 324 Reborn tests, fmt/strict Clippy/fresh kernel/ARM/QEMU/package/source/privacy PASS. SOFTWARE_VALIDATED / INTEGRATED_PHYSICAL_NOT_RUN; PUBLIC_DISTRIBUTION_NOT_READY. UART01 CPU hardware is inherited; Baseline02 RTC FAIL remains unresolved. Policy-enabled C3, native S16, battery safeguards, DATA/layout and recovery stay.
See baseline, twelve sessions, independent integration review and one smoke-gated physical campaign. This current section supersedes candidate/build/acceptance wording in the dated master planning and execution record below. Older NOT_CREATED/NOT_BUILT/accepted-none and in-progress text describes its observation time, never the current baseline. No main merge, push, flash or physical/public milestone promotion occurred.
Historical master planning and execution record (retained)
Started 2026-10-04. State: READY_FOR_PLATFORM_V1_PHYSICAL_QUALIFICATION. This plan records decisions for future semantic integration; it does not authorize modifying live subsystem worktrees. Status contains exact observed tips, paths, changed files and receipts. Master contains release readiness. Every boundary repeats the standing audit.
Protected foundation and admission
Linux starts from b5aea937a3b8e3e8ec398f8cb2e04656b8a53f8c. Reborn starts from b71b468860233faa0a42b8448ec5777fa952b8e3, including release of owned scanout during screen sleep. Reborn main at 7f9df397 omits that commit; starting there without bringing it forward would damage C3 admission. No active branch is stale against these foundations at initial discovery.
Protect C1 WFI, C2 SLIDLE and C3 DORMANT; GPT6/GPT4/PPI29/CNTFRQ/highres/NO_HZ; UART request/ACK and exact checked restore; Linux generic context ownership; CIRQ; natural parking/hotplug; all five guarded OPPs; dynamic clock/domain/ deadline/radio/USB/workload guards; once-per-boot CPU0 activation and manual stop; y2.deep_idle=off, y2.cpu_safe=1 and other established fallback controls. Suspend's shared spm.c changes need explicit review even if no idle function text changes. A suspend restore fault now affects the shared broken-state gate. Retain fail-closed safety; verify it cannot silently disable healthy idle through an incorrect restore predicate. The installed Baseline02 one-shot RTC trial now fails through watchdog reboot with an unmatched CS43131 1-0030 phase-7 resume entry in the retained ring. Suspend owner investigates offline. Do not use staged PM passes, successful MMC callbacks or reboot integrity as full-resume evidence; review any resulting codec PM changes against precision/AFE and radio restore contracts, then repeat the standing audit before materially expanding scope.
Before admitting an owner: inspect complete base-to-tip diff, dirty state, coherent local commits, final handoff, actual test receipts and exact binary/ image/device provenance. A closing report with uncommitted moving code is a draft handoff. A clean tree with commits is not proof of completion. Accept an evidence-backed intentional no-change conclusion. Use:
ACCEPT_AS_ISfor a complete, compatible source result.ACCEPT_WITH_INTEGRATION_ADJUSTMENTfor useful changes requiring owned adapters.NEEDS_REBASE_OR_RECONCILIATIONfor incompatible shared implementations.NEEDS_MORE_WORKfor incomplete source/evidence; separate software admissionfrom outstanding physical/release gates.
REJECT_CHANGE_KEEP_CURRENT_BASELINEfor regressions or unsupported changes.
During the active phase, master writes only its observation tooling and master documentation. No owner checkout/ref/index mutations, merge/rebase/reset/clean, push, flash or hardware experiments. Device access, if ever necessary, first requires nonblocking /tmp/y2-platform-v1-device.lock; busy means stay offline.
Precision review also retains the live post-conversion VolumeRamp: integer PCM passes through f64 gain scaling and returns to integer, while native decode gain is forced to 100. The highres fixtures prove unity-volume software narrowing, not all volume/DSP states or a native physical 24/32-bit path. Audio owner7163181 has corrected its research diagram; implementation scope remains unchanged.
Current dependency order
The order follows actual shared code, rather than subsystem labels alone. Paired Linux/Reborn contracts enter together. Do not wait until step 11 to test.
| Order | Concern | Dependency and integration treatment | Immediate validation |
|---|---|---|---|
| 0 | Frozen foundations and source selection | Final owner handoffs; refresh audit; create isolated codex/platform-v1-integration worktrees in both repos from the exact foundations above | Ancestry and diff review; protected idle/boot policy tests |
| 1 | Shared kernel fixes | Select storage/USB patches and suspend restore helpers by ownership. Review SPM interactions now; activate full product sleep only after Reborn contracts land | Affected kernel policy/native tests; changed config/DT/module/ABI/build checks |
| 2 | Storage / filesystems | Storage owns diskseq block lifetime, mount claims and filesystem semantics | MMC/storage/filesystem/mount identity and hotplug tests |
| 3 | USB / desktop transfer | Consume storage identities; one Linux filesystem owner; no raw block export; transfer/eject and library generation semantics | USB/MTP native confinement, disconnect, RO/full-volume, SD eject/replacement tests |
| 4 | Wi-Fi + shared readiness daemon | Reconcile USB control wake and Wi-Fi socket wake in one wait mechanism; one lease/reconnect owner | Delayed STATUS, DNS epoch/route changes, idle cadence and USB wake combination |
| 5 | Bluetooth | Keep one reconnect authority and existing negotiated PCM/codec contract; union safe diagnostic fields | Serializer, fake bus, reconnect/intent/owner restart, codec and privacy tests |
| 6 | Wired precision + media metadata | Precision owner owns sample narrowing/hardware contract; FFmpeg owns parsing, tag/ABI and bounded artwork behavior | PCM low bits/ties/saturation/float32 limits; formats/metadata/artwork/cancellation; ARM FFI layout |
| 7 | SQLite / library | DB owner owns query/transaction/scan lifetime; adapt FFmpeg metadata acquisition and counters into that implementation | Incremental scans, no-op writes, removals/moves/source replacement, aborted scans, restart/durability, catalog completeness |
| 8 | Graphics + performance | One selected artwork decoder; GPU owner owns render/scanout/runtime-PM; performance instrumentation consumes it | Small/large JPEG, PNG/WebP, malformed art, capture disabled normally, screen sleep/release/wake, measured overhead |
| 9 | Input | Input owns physical identity/evdev drain/timestamps/debounce; add full-suspend resume hooks to that pipeline | Rebind, overflow, backlog timing, deterministic detents/buttons/holds, resume cancellation |
| 10 | Reborn application + full suspend | One AppState/worker/catalog/scanner; canonical PowerShort/PowerHold routing and RPC; USB copy/refusal and radio restore sequencing | Workspace fmt/clippy/tests + ARM; sleep same-boot/real reset/restore proof and no immediate resleep |
| 11 | Release composition | Resolve all dependencies/flags/pins; regenerate capabilities/inventory/source/notices from integrated installed contents | Broad software, QEMU/ELF/package/privacy/fallback gate, then seal one candidate |
These are semantic steps, not a requirement to cherry-pick an entire branch in one operation. Split paired commits where dependencies require it, retaining a per-step coherent tree. Use coherent cherry-picks or manual integration of selected changes. Do not import experimental histories or old branch-local candidate metadata wholesale. Preserve author/committer identity and authenticated account settings. No blind --ours/--theirs conflict resolution.
Coherent source units reviewed before admission
The following source units are preliminary selections, not executed cherry-picks. Every full tip and commit is in the status report. Preserve final owner reports and dated planning history separately, then author the integrated current audit; do not replay repeated roadmap insertions as if they describe the final image. No accepted integration commit exists yet.
| Owner | Source unit / treatment |
|---|---|
| bluetooth | 5846a7a0 / de092094; safe diagnostics union |
| wifi | d408b28→61eecee→2bd345a→7056977 / 2cdb9cce; shared wait semantic integration |
| storage | 2a603c1 / ee1c25a→f726ae4; include no-follow lifetime guard and legacy source policy |
| usb | 418723d→5cb5be0→6fcd1b2→08019df→1115933 metrics /51d477b; source/config/header union |
| highres-audio | d9595d6 / cd5d243;7163181 documentation correction |
| ffmpeg-metadata | a22107c→43a695c Reborn; adapt scanner into DB owner, compose media with precision/graphics/storage |
| library-db | 9152005→b0b114e→eca41fc→25d4ea4→d6c92b1→c161404; retain executed durability/scale tests |
| graphics | a2df691 Reborn artwork with FFmpeg wrapper;383234d Linux retained evidence, current kernel/DRM kept |
| input | 99087ba Linux observer / a701e0b→e51a335; adapt suspend/performance timing once |
| suspend | 69fa2c7→c73cd83→50cc218→7e10bdc→a69bd50 /4544b1a→f69c3c4→c57a55f; ordinary sleep remains qualification-gated |
| reborn-performance | b8c05db→069415a; omit stale BT wait hunk, compose app/input/artwork; 7ed4a406/949b78ce clean final handoff; exact069 binary measured pass reviewed |
Generated codec/storage/USB patch manifests need one final digest set. New owner test files must join the production runner’s explicit list, including test_suspend_audio, test_platform_v1_suspend, audio precision and native USB/ filesystem coverage; default discovery alone must not hide a production-runner gap. Each semantic step must be buildable/testable on its own before the next.
Conflict decisions required before integration
Initial temporary-copy merge probes show concrete text conflicts in the shared readiness daemon, library scanner, media artwork and input router. The timestamped probe receipt is in out/platform-v1-integration-analysis/; it modifies no Git ref or owner tree. Textually clean overlaps still require the following review.
| ID | Files / owners | Classification | Canonical integration decision and regression |
|---|---|---|---|
| C01 | Linux service.py: USB + Wi-Fi | Text + semantic conflict | One service loop must wait for supplicant activity, USB SIGUSR1/control wake, termination and bounded deadlines. Neither threading.Event.wait nor supplicant-only select alone satisfies both branches. Test events arriving while idle, signal-only wake, acquisition cadence and shutdown without spin. |
| C02 | Reborn reborn-library/src/lib.rs: FFmpeg + DB + storage | Text conflict + duplicated optimization/helper | FFmpeg and DB remove scan-wide maps and change unchanged-file handling. DB owns TEMP seen/candidate tables, batch probe, transactions, catalog and pruning. Adapt FFmpeg demux-only acquisition, file-race checks and metrics into one scanner. Storage and DB also independently add the same CID-qualified sd_id_matches_uuid helper; retain one implementation and complementary tests. Keep aborted/removable-media scans from pruning; prove unchanged scans do not rewrite durable rows. Final performance receipts decide which details survive. |
| C03 | Reborn reborn-media/native/media.c: FFmpeg + graphics | Text conflict + duplicated JPEG reduction | Proposed semantic selection: one shared decode wrapper from FFmpeg and one header/lowres admission using graphics' checked receive result and baseline/extended-sequential/progressive profile gate. Graphics has exact native-ARM before/after benefit; FFmpeg adds shared embedded/external ownership and stricter PNG/WebP, I/O/cancel/allocation limits. Both edges must cover the target; retain rectangular/progressive/small-cover pixel and corruption/budget tests. Do not stack header probes. Selection awaits final source review and integrated tests; independent measurements do not measure the combined path. GPU/display work remains graphics-owned. |
| C04 | Reborn reborn-platform/src/input.rs: input + suspend + performance | Text + semantic conflict | Input owns physical stream and timing. Adapt suspend c57a55f's complete queue close/reopen and overflow/press reset, Power wake-edge suppression, and performance descriptor wait into input's four-field handle/monotonic-provenance design. Use input-owned reset/typed Cancels and reset the ActionRouter at the resume boundary; a bounded old-FD drain cannot discard every wake edge. Preserve stable identity, retry and successful clock selection. Canonical product selection follows the suspend owner's reported explicit Power requirement: long hold opens existing shutdown confirmation; reconcile input's older QuickSettings expectation rather than keeping two actions. Short paused Power uses qualified sleep/wake; playing Power blanks. Suppress only the wake gesture, preserving the next deliberate press and RTC wake. Test backlog/overflow/rebind and short/long exclusivity across resume. |
| C05 | app/reborn/src/main.rs: DB + performance + suspend + USB + input | Semantic integration required; later source cuts may also conflict textually | One catalog, scanner lifecycle and event loop. Keep DB catalog paging, performance trace, USB coalesced durable refresh, input capture/frame correlation, and sleep prepare/restore acknowledgement. No duplicated workers or unconditional scans; no render while scanout sleeps. |
| C06 | Linux observe.py: storage + USB + Wi-Fi + audio | Independent sections, shared schema | Preserve diskseq identity, USB DMA/PIO/IRQ/file-transfer, Wi-Fi epoch/RSSI observations and audio PCM contract. Validate one status fixture against Rust parser, health, capabilities and redacted export. Never infer readiness from configured policy or stale receipts. |
| C07 | Linux media.py + Reborn storage.rs: storage + USB | Independent additions with lifetime dependency | Preserve FAT UTF-8, stable block source identity and MTP root lifetime. Unbind/release responder roots before SD eject; reject attached/busy export. Durable completed transfer generation triggers one incremental scan after quiet/busy gates. Test same-CID reinsert and replacement mount. |
| C08 | Linux diagnostic_fields.py: Bluetooth + audio + Wi-Fi; diagnostics.py: audio + Wi-Fi | Independent additions subject to privacy review | Union fixed Bonded/Pairable/Discoverable, PCM contract and Wi-Fi keys/public enums. Verify nested values remain bounded and peer addresses/names/object paths, owner keys/calibration remain redacted. USB/sleep new fields also need coverage. |
| C09 | Reborn reborn-media/src/native.rs: FFmpeg + audio | Textually clean, shared FFI ABI | C/Rust RbMetadata date/genre/timing fields and rb_media_limits must match the shipped shared object. Preserve S24/S16 rounding tests and honest FLTP precision limits. Detect old library/new Rust pairs in ARM/dependency validation. |
| C10 | kernel/patches/manifest.json: storage + USB; defconfig/config/package manifests | Independent patch entries; composition risk | Regenerate every patch digest from selected patches. Union required FunctionFS/MTP/filesystem/media/codec dependencies and pinned sources. Verify fresh effective config and installed contents rather than carrying a stale defconfig snapshot. |
| C11 | Reborn sleep/USB core, typed client, preview/UI | Mostly independent sections; changed enum surface | Preserve additive USB variants/generation and canonical sleep lifecycle, including legacy restoring parser compatibility. Fix all exhaustive matches/constructors and preview fixtures. Keep unsupported/old-schema values conservative. |
| C12 | All owner roadmap/gap-audit edits | Repeated top insertions; documentation conflict | Summarize chosen outcomes in a new master boundary, retain each dated admission and evidence limitation. Owner documents never override newer exact-image identity or retroactively qualify the RC. |
| C13 | Suspend spm.c/policy shared with protected idle | Architectural coupling without a second writer | Check normal PCM length/address, UART request restore, timer/CIRQ/context results and shared broken flag. Repeat protected CPU source tests and integrated physical C1/C2/C3 after suspend/wake. No idle guard weakening to obtain a suspend pass. |
| C14 | Reborn InputEvent: input + performance | Concrete interface-name/provenance disagreement | Input adds kernel_mono_us; performance adds evdev_us for the same event timestamp. Choose input-owned kernel_mono_us, valid only after successful evdev monotonic-clock selection. Adapt performance traces and every event constructor/test. Synthetic events remain None; do not maintain two competing timestamps. |
| C15 | Reborn bluetooth.rs: Bluetooth + performance | Duplicated optimization; reject weaker overlapping hunk | Performance changes the old 20-ms polling wait to 100 ms while powered off; completed Bluetooth owner replaces polling with descriptor/command/deadline wake and tested restart/uncertainty handling. Keep Bluetooth de092094 implementation; omit performance's old-loop hunk. Preserve performance's independent native input wait helper alongside Bluetooth wait. |
| C16 | USB config/localversion + all release metadata | Subsystem identity versus integrated identity | USB names its local kernel -y2linux-platform-v1-usb and disables legacy CDC composite in favor of configfs/FunctionFS for both product and developer modes (the earlier module design is superseded by 5cb5be0). Select one integrated localversion and coherent gadget startup; validate ECM observer/recovery availability before any MTP switch. Do not let a source-correct integrated package still advertise Baseline02 or a subsystem name. |
| C17 | USB auto-refresh + suspend Reborn prepare | Cross-subsystem race requiring a combined regression | USB's durable-generation consumer can directly start scanner.scan; suspend's prepare rejects existing scans/queries, then sets sleep_prepared. After composition, prevent any queued/background refresh or query from starting after that acknowledgement until explicit restoration. Define MTP-copy/cable refusal at the platform owner before quiescence; preserve deferred completed generations for one post-wake scan. Test copy completion/disconnect concurrent with prepare and wake. |
| C18 | Diagnostic projection versus new Bluetooth/USB/Wi-Fi/sleep fields | Confirmed contract gap despite a clean allowlist union | The first Bluetooth + audio projection redacted boolean bonded through the private bond regex, redacted waking, and dropped file_transfer and signal_observation (11:25 receipt). Wi-Fi 7056977 subsequently adds reviewed observations/enums; the three-owner union probe at 20261004T114043.030102Z/combined-diagnostic-probe.json confirms that partial resolution while bonded/USB/sleep remain incomplete. Add reviewed fixed fields/enums and, if retaining bonded telemetry, an exact boolean-only exception. Never remove general bond-secret redaction. Test combined status and malformed types, addresses, arbitrary strings, paths and secret bond objects. |
| C19 | Storage persistent source IDs versus DB retained catalog | Explicit safe upgrade policy; capacity/queue regression required | Storage ee1c25a changes UUID-bearing SD IDs from uuid: to uuid::cid:; f726ae40 rejects old Track snapshots at actual decoder admission. Preserve the owner’s one rescan/new queue selection policy and no automatic rebind or guessed card migration. DB catalog retains old offline rows, but reviewed UI catalog.rs filters t.online, so normal browsing already excludes those rows. Test existing schema-1 same-card upgrade and cloned-UUID replacement: new online tracks appear once, legacy/saved queue snapshots remain unavailable, IDs are preserved, and totals/memory/250k resident-catalog cap remain truthful when old plus new rows coexist. Existing DB tests cover 25k offline plus 25k online distinct IDs, generic same-path replacement without reuse/prune, and CID-qualified guards; these do not cover exact UUID-only saved-queue upgrade or physical cloned UUID. The 250k cap counts offline nondeleted rows and rejects the entire catalog above the limit; only 50k is qualified. Queue20k/session8MiB stay unchanged. Do not delete history or invent a schema migration merely to remove retained offline records. diskseq is a live lifetime token, never a persistent library ID. |
| C20 | USB handoff versus newer installed-image receipts | Stale hardware assumption, corrected by owner | The earlier USB report called UART01 installed; newer locked receipts identify Baseline02 boot 27e6d684…. USB 6fcd1b2 explicitly corrects this using the retained Bluetooth identity receipt. Keep the original discrepancy/receipt dated, retain UART01 as its physical authority, and bind each new harness to the actual manifest/boot. Do not copy a branch-local installed label into the RC matrix without its provenance. |
| C21 | Performance reborn-graphics/native/graphics.c / native Rust renderer | Render change outside the graphics owner’s unchanged pipeline | Select measured adjacent-texture batches in original order, new shaders/color attributes and fixed48KiB vertex buffer (256×6×8 GLfloat,49,152bytes); no extra render worker/texture pool. Final exact069415a device comparison lowers render CPU and retains ten benchmark pixel captures:600 of6,912,000channels (0.0087%), max5/255, small antialias/interpolation differences, live covers excluded. This is near-equivalence, not byte identity. Preserve exact hashes/fixture/tolerance and require integrated order/blend/texture/capture/off-wake/no-normal-readback tests. Old GPU01 evidence does not qualify the new integrated renderer. |
| C22 | Graphics ARM SDK versus final FFmpeg component pin | Stale report wording resolved, final build pairing still required | Graphics closing 383234de corrects 9.0.1 to SDK FFmpeg 9.0.2, with staging header/build-source/target version-string evidence and tested ARM membrane SHA256 5d448d9a28c5ec41c6bbc7fc38207d684e6dde4c263bcc857555d7cc49953904. Actual device FFmpeg runtime version is explicitly NOT_INDEPENDENTLY_CAPTURED by that harness. This resolves the report disagreement; it does not qualify the combined future membrane. Fresh integrated Reborn/native build and runtime checks must use exact pinned 9.0.2 libraries and matching C/Rust ABI/configuration. |
| C23 | USB new native responder versus ARM SDK UAPI | Observed build failure, superseded at exact source pair | The 11:50 build failed on missing linux/openat2.h; retain that receipt. Owner 08019df supplies pinned Linux 6.18 openat2 definitions and freshly generated ARM EABI syscall definitions, preserving confinement. The sealed USB candidate and reviewed build-freeze/exit-code receipts bind a fresh successful ARM/package pass to Linux 08019df44c8a7fbc249fc49a5a41f7ac906429ba / Reborn 51d477b2f30edfc90418d8d0c3fa5fad8de6f581. Later d9ea222 report/harness changes do not change image identity. Revalidate these generated-header dependencies in the final integration build; physical MTP remains NOT_RUN. |
| C24 | FFmpeg extractor revision versus DB-owned bounded scanner | Persistent metadata compatibility not present in DB lane | FFmpeg adds tracks.metadata_revision INTEGER NOT NULL DEFAULT 0 without changing schema/user_version 1, recording revision 2 only after successful extraction. The DB branch has no revision column and uses a different TEMP scan/probe protocol. Carry the additive migration, revision-aware reuse, row-ID preservation and one-time reparse tests into the DB-owned scanner. Keep one generation protocol: DB TEMP membership and active-source tokens must not be accidentally replaced by FFmpeg's durable seen/wall-time scheme. Test legacy schema-1, unchanged files with old metadata, malformed neighbors, reopen/cancel/superseded scans and no redundant durable writes. |
| C25 | Performance background observations versus storage/USB/suspend app lifecycle | New asynchronous result authority | Current performance main.rs moves read-only power/source observation onto the existing watchdog using capacity-one request/result channels and a two-second request cadence. UI still owns state changes, but accepting a result can update DB sources and launch a scan; the draft discards changed music-directory results only. Compose source/mount freshness and pending-result cancellation with storage guards and suspend prepare/restore so no stale result restarts work after preparation acknowledgement. Preserve 250 ms shutdown-intent handling and critical shutdown authority. Test removal/reinsert/reconfigure, a slow/failed observer, prepare with an in-flight observation, wake, bounded queues and watchdog diagnostic responsiveness. Final source/physical receipts are still pending. |
| C26 | Saved/queued track playback versus removable-source identity | Confirmed old defects; owner source fixed, combined regression pending | Storage f726ae40 supersedes ee1c25a path-only decoder opens and the first dirty root pin that followed nested symlinks (master host reproduction retained at 20261004T123800.318457Z/nested-source-pin-probe.json). Root/parent/file no-follow walks check regular-file/device/mount identity, retain file and parent FDs through native close, and recheck live source before/after admission. First/current/queued decoders and sidecars use pins; suffix-free JPEG/PNG/RIFF-WEBP detection reads at most 12 bytes and keeps the local codec/ABI contract. Reviewed source and reported 33 direct-versus-FD metadata/PCM/position plus artwork pixel/special-file tests close the owner implementation gap. Integration must retain FFmpeg limits/custom AVIO, graphics reduction and suspend quiescence; test gapless/crossfade, old queue IDs, cloned/reinserted card, nested/final/root symlink, subtree/file replacement, removal during open/read and pinned-parent artwork. When composing FFmpeg, compare semantic metadata separately from variable open/probe timing and IO counters; test counters independently. Preserve case-insensitive cover/folder/album priority and corrupt-candidate fallback through the retained parent FD, including Cover.JPG; do not search the lexical track path or /proc/self/fd parent. Source is now integrated and its combined host regressions pass; exact-RC physical qualification remains NOT_RUN. Initial UI admission still synchronously checks sources; preserve fresh authority when composing performance’s background observations and measure that cost. |
| C27 | Collection artwork worker: FFmpeg + performance | Cache eviction/freshness interaction | FFmpeg changes load to return pixels plus cacheability, retaining embedded covers only so sidecar edits are checked again; its current miss path evicts a valid entry even when no cacheable result will be inserted. Performance independently fixes missing/corrupt-result eviction and adds timing/hit fields. Compose one rule: evict only when inserting successful, correctly sized, cacheable pixels. Keep the four-entry bound, cancellation/latest-result ownership, FFmpeg sidecar freshness and performance metrics. Test four valid embedded covers followed by missing/corrupt/sidecar requests, then retained hits and edited sidecar refresh. |
| C28 | Suspend CS43131 codec PM versus audio precision | Newly evidenced runtime dependency; source fixed, physical gate open | Baseline02 retained ring has CS43131 1-0030 resume entry7407 without leave through7422; the exact internal stalled instruction is unknown. Suspend owns narrow codec system/runtime PM restoration and failed-suspend rollback in patch0030, committed a69bd50 retained substep notes around regulators/reset/regcache/XTAL and disable-error rollback repair, with final2d2b543 evidence. Eleven executed callback fault tests and a fresh ARM kernel build pass; the exact inner physical stall remains unproved. Highres continues to own AFE/interconnect/sample precision; no speculative audio-clock/DSP redesign follows this trace. Review final complete diff, patch manifest digest, all error unwinds and normal codec resume with targeted PM/audio/clock tests. Preserve new instrumentation as diagnosis, not physical root-cause/fix proof; future exact integrated-image RTC/Power same-boot resume and wired/audio runtime-PM regression remain required. Repeat standing audit/roadmap before material scope changes. |
| C29 | Performance wired PCM pacing versus precision/transport | Exact-source audio-owner review and measured device pass; combined regression required | Source069415a4207c00f0a32a3a2ac00602ddea29a895 adds wired-only WritePacing: return each accepted prefix immediately; next call waits after control polling at most one configured20ms readiness wait, including ready→EAGAIN; timeout/EINTR consumes0, recovery/discard clears pacing, fatal errors propagate. Bluetooth partial behavior, negotiated formats/buffers/periods/byte stride/gain/DSP/leases remain unchanged. Audio owner PASS_SOURCE_REVIEW binds native.rs Gitblob0580a3450921ff00a621283e4eff526dd807f6da/fileSHA78a1f816c79776e9ef9955b987b7350e4b30cd04dea737fa91117eed81066a4e; review patchSHA5e23ec06 is a separate artifact. Ten scripted/native-null tests cover partial/timeout/EINTR/ready-EAGAIN/full/EPIPE/fatal, S16/S24/S32/recovery/discard and BT positive partial. Exact VolumeRamp S16/48k/512period/4096buffer probe isolates>10600shortwrites/s/~999msCPU/sec versus131writes/~30ms after pacing, distinct from whole app. Final ARM appSHA7871ec67 matched on Baseline02 boot88: playing87.95→11.21% one core, audio82.63→5.11%, zero measured xruns/playback/FFmpeg errors; actual seek/reopen/pause/resume/stop and active SIGTERM317.28ms pass, stock/data/integrity restored. Supplemental16resume/16pause/side improves KMS43.98→22.55/64.70→38.50ms; primary2sample regression remains dated. Full243workspace/fmt/clippy/ARM pass. Integrated precision/FD-pinned playback/cancel/transport regression and actual native XRUN/real BT peer/analog quality remain required; no b8-only result is assigned to the later binary. |
| C30 | Collection artwork worker versus storage source admission | Old key/path/mount can outlive a media replacement | Pin a live source file and parent in the existing worker, recheck before cache/publication, retain FFmpeg sidecar priority/freshness and performance valid-only eviction; cached pixels retain immutable source/file evidence and no open FD/mount pin so they cannot block SD eject. Decode alone retains file/parent FDs. Worker and UI publication recheck inode/ctime/mount/card. Replacement/removal/corrupt-sidecar and zero-cache-FD tests. |
| C31 | Release audio metadata versus software conversion/native AFE | Old generic unimplemented_output_formats conflated separate capabilities | Emit implemented_software_output_formats S16/S24/S32, deployed enabled_native_output_formats/rates, unimplemented_native_output_formats and empty integrated physical acceptance. FFmpeg canonical filter FLTP remains accurate; conversion never admits wide native hardware. Regression executes actual metadata generator with selected S16 policy. |
| C32 | Delivered MTP capability versus installed composition | Kernel USB alone was insufficient build evidence | Require CONFIG_USB_CONFIGFS/F_FS/ECM, BR2_PACKAGE_Y2_MTP, installed umtprd and installed sole USB policy together. Missing each dependency refuses an enabled MTP delivery claim. |
| C33 | Reborn package label versus workspace/manifest | Stale 0.1.0-premium.02 label for actual 0.2.0 application | Buildroot queries the canonical workspace-package version parser; actual make show-info confirms 0.2.0. Compiled full Reborn source commit remains independent. |
| C34 | Native Bluetooth fault tests versus minimal locked host | Two new fake-peer/GIO tests assumed undeclared host libraries | Mark dependency absence explicitly in the minimal profile and execute the unchanged real native tests on the packaging host; fresh ARM observer compilation/QEMU remains mandatory. No test is deleted or accepted on a skipped receipt alone. |
Additional source-lifetime finding before integration
C30 — collection artwork admission. Storage f726ae40 pins actual playback, queued tracks and their sidecars. The independently modified collection-art worker still opens Key.path and lexical folder_artwork, even when the key contains an old source ID/mount. Those names cannot authorize a freshly mounted replacement while an observation result is pending. Compose source-aware FD admission in the existing collection worker, retain the file/parent through media/sidecar decoding and recheck the source before publishing/cache use. Keep FFmpeg case-insensitive sidecar priority/corrupt fallback, cancellation and performance's valid-only eviction. Add a replacement/removal/sidecar regression; no second artwork worker or hardware policy owner.
Canonical contract ledger
Selected contracts are now composed in source and targeted checks pass, including Reborn324 tests and new cross-owner regressions. Fresh exact production ARM/QEMU, package and physical acceptance gates remain; source reconciliation is not hardware qualification. The master execution ledger records commits and actual checks.
| Contract | Canonical spelling / authority | Required compatibility check |
|---|---|---|
| Platform status/capability/health | Keep established API v1 / feature contract 2 unless final source requires a reviewed version change | Same schemas in Linux output, installed capability manifest, Rust typed client and diagnostics; unknown evidence stays unknown |
| Bluetooth codec | Existing bluetooth.negotiated_codec; preferred_codec/requested_codec remain intent; actual PCM Format/Rate and transport generation remain observation | No active_codec/codec_current alias authority; peer, owner restart and uncertainty tests |
| Bluetooth device policy | Paired, Bonded, Trusted, Connected and ServicesResolved remain separate; reconnect helper owns policy | UI only submits bounded intent; BlueZ/BlueALSA own controller/encoder transport |
| Wi-Fi | Existing association/IP/route/DNS distinctions plus boot/epoch/BSSID/address freshness; signal_observation and status_query_failures are observations | Late/unknown STATUS is not DISCONNECTED; new lease cannot inherit stale Online/DNS proof |
| Storage lifetime | Storage-owned source_instance = block:<dev_t>:diskseq:<seq>; persistent CID/UUID library identity remains separate | Linux media claims, Rust source identification, USB root pins and scanner removal/reuse agree; missing diskseq fails closed; C19 upgrade compatibility must be settled |
| USB | system.usb.file_transfer, schema org.y2linux.usb-transfer/v1; refresh_generation, current boot_id, active, views/mode/state | Linux remains filesystem owner; Ready/Copying/Developer typed separately; completed changes only; raw block export never selectable |
| Audio precision | Audio-owned audio.pcm_contract and truthful container/meaningful/slot/payload/rate fields | Configured/running support and physical bit capture stay separate; S32/FLTP does not claim 32 meaningful preserved bits |
| Media native ABI | FFmpeg owner extends paired C/Rust metadata and limits initialization | Exact dynamic symbols, layout and one shipped library source revision; precision tests still pass |
| Library | DB owns scan tokens, TEMP seen/probe lifetime, bounded query/catalog and pruning | One implementation; FFmpeg metadata and USB generation adapt to it; no schema/data reset from integration |
| Product sleep | org.y2linux.sleep/v1: requested, preparing, refused, sleeping, waking, restored, restore_failed; legacy restoring accepted | Same-boot, real reset return, expected full-suspend PCM, wake and explicit Reborn acknowledgement; pm_test success is not full sleep |
| Reborn control/input | Suspend owns sleep_prepare/sleep_restore acknowledgement; input owns physical normalization | PowerShort/PowerHold actions have one definition; wake edges cannot resleep; render/audio/database quiescence acknowledged |
| Input/performance timing | One input-owned kernel_mono_us: Option<u64> from a successfully selected CLOCK_MONOTONIC evdev stream | Adapt the competing evdev_us performance field; unknown clock and synthetic timing remain None; present-return timestamp is not independently measured physical scanout latency |
| Diagnostics | Existing fixed-field/redaction mechanism; additive safe keys | Export contains no private addresses, bond/profile secrets, keys, library paths/tags or raw device evidence |
Validation boundaries
Use affected tests after each coherent integration step. Existing files include tests/test_storage_*, test_mmc_*, test_platform_storage_tools, test_usb_*, test_platform_network_time, test_radio_policy, test_platform_bluetooth, test_connectivity, test_audio*, test_cpu*, test_slow_idle, test_suspend_policy, test_sleep_product, test_gpu and test_gpio_input. Add each owner's new tests and native harnesses. In particular, new files such as USB/MTP, filesystem, precision and DB regressions must enter the selected production test entrypoint; test discovery alone may not include them. Preserve fixtures. Record command, source pair, environment, exit code, counts/skips and artifact identity. Host dependency skips are separate from native/ARM coverage. Earlier failed logs remain dated; only a demonstrated superseding receipt retires a failure. Master observation does not rerun builds.
After all selected code: fresh kernel build, effective config, emitted DT, modules/ABI; CPU/idle/timer/hotplug/suspend, MMC/filesystems/USB, radios/codecs, audio/clock, battery/charging/power, display/GPU/input, platform/production tests. Run Reborn cargo fmt --all -- --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo test --workspace --locked, and the pinned ARM build. Run Cortex-A7 QEMU, ELF/dependency closure, installed ARM commands, package/layout/BOOTIMG checks, capability inventory, corresponding source/notices and private-state rejection. Bind everything to the integrated commits; retained Baseline02 counts are not new integrated test results. Packaging requires this broader boundary.
One integrated physical qualification campaign
Prepare one master entrypoint and one run directory bound to the sealed RC manifest/source pair/hashes. Reuse the current CPU and feature-completion helpers as modules, after adapting final contracts; do not launch eleven independent campaigns. Both current entrypoints were inspected in offline plan mode during this review. The passive tools/host/qualify.py collector does not exercise features and cannot itself certify endurance or playback.
| Phase | Automated work and required physical result | Minimal owner action |
|---|---|---|
| A | Exact image/source/rootfs/release/boot/taint, real cold-boot policy, normal boot/UI/SSH | Owner installs one sealed preserving RC when ready; master never flashes |
| B | C1/timers/OPPs/hotplug, natural parking, C2 useful residency; guarded first C3 plus 20, restore continuity | Device quiet and required detach/radio controls coordinated by one harness; never bypass guards |
| C | eMMC/SD filesystem scratch hashes, actual negotiated modes, runtime-PM, replacement/eject refusal | SD presence/removal only where required for genuinely uncovered conditions |
| D | Desktop MTP durable copy/delete/rename/readback, disconnect recovery, independent observer; Wi-Fi DHCP/DNS/TCP | One desktop connect/reconnect/unplug sequence; host tool records hashes |
| E | Wired formats/rates/meaningful bits, playback/DSP/stop/restart, library incremental changes | Headphones/listening; instrument only modes whose physical bit/rate evidence is absent |
| F | Real Bluetooth peer, each enabled codec/mutual/negotiated PCM, reconnect/fallback and Wi-Fi coexistence | One available compatible bonded headset; currently unavailable in owner reports |
| G | GPU/display/scanout sleep/wake, correlated input/UI/frame, counted wheel/buttons | Short scripted counted detent/button/feel check; retain hardware timing limits |
| H | Full RTC and Power suspend with same boot, true reset stamp/wake/normal PCM, all subsystem/owner settings restored | Power wake once; RTC repeats automated after awake gates; stop on integrity failure |
| I | Charging/voltage/refusal/estimated SOC, thermal monitoring, shutdown/update/recovery preservation | Existing safe charging condition; no forced deep discharge; update/recovery only explicit owner operation |
| J | Representative actual wired/radio/codec/screen-off/storage coexistence endurance, no hidden passive-only acceptance | Declared playback workloads; one integrated duration/condition ledger |
Acquire the shared nonblocking lock for the whole admitted hardware batch; do not interfere with an existing holder. Maintain exact identities, before/after boot/taint and error/restore counters per phase. Keep raw private evidence in a restricted ignored directory; publish sanitized summaries and hashes. A failure stops the unsafe lane and retains independent safe work. No automatic flash or recovery reset. Reuse unchanged subsystem evidence only with an explicit unaffected-code/config/binary/condition argument; cross-subsystem changed behavior requires fresh RC evidence. Missing peer, electrical instrument or physical mode proof stays a named gate, never a silent feature removal.
Candidate, release inventory and final promotion
Only after integration/software gates build out/y2linux-platform-v1-integration-candidate/. Pin both integration commits, component versions/flags, image hashes, capability/API/data/layout schemas, owner firmware inputs, source/notices, qualification plan and exact preserving fallback. Preserve Y2DATA, SD and protected partitions; payloads remain BOOTIMG and ANDROID/Y2ROOT unless a separately audited owner scope change exists.
Append evidence applicability to the existing 233-feature release inventory. For every required feature retain implementation, software, physical, endurance, release, hardware-condition and distribution-condition axes. Keep old candidate rows and failures; mark supersession explicitly. Owner firmware, calibration and optional codec rights/source obligations remain independent from technical success. New MTP source/dependencies require their own notices and installed dependency inventory. No public-distribution clearance is inferred.
States progress only on evidence: PARALLEL_WORK_IN_PROGRESS → READY_TO_INTEGRATE → INTEGRATION_IN_PROGRESS → READY_FOR_PLATFORM_V1_PHYSICAL_QUALIFICATION → PLATFORM_V1_READY. No main merge until both broad software and required physical qualification pass. No push. Final report records all discovered sessions, complete conflicts and duplicates, implemented reconciliation, selected/rejected behavior, preserved foundations, integration commits, software results, remaining physical/legal gates, exact candidate path/BOOTIMG/Y2ROOT hashes and the single next owner action.
Production source composition — 2026-10-04
C01–C30 source reconciliation is complete. Paired master branches contain all selected source units and source-bound owner receipts. The production boundary audit precedes the new release identity and fresh build. Next: one fresh pinned kernel/Buildroot/Reborn ARM composition, broad software and package checks, then one source/image-bound physical coordinator. No subsystem image becomes the final Platform 1.0 product.
Software exit and next integrated phase
C01–C34 source contracts are reconciled, broad software gates PASS and one candidate is sealed. All merge units are complete in master-owned paired branches; remaining work is one source/image-bound A–J physical campaign and distribution review. Use the final master16-item handoff and exact preserving owner package instructions. No main merge/push/automatic hardware action.