Current Y2Linux + Y2Reborn project state

Historical 2026-09-22 review at the exact commits below. Its "current", "next" and unmet-implementation findings describe that audit snapshot. Some software defects were later corrected and real Fix01 workload/playback behavior was tested; the overall CPU platform still fails acceptance. Use current Reborn state and the paired Linux state for today's status. The original review conclusions remain available as dated evidence.

Review date: 2026-09-22. Read-only engineering review; documentation is the only change.

1. Executive summary

What is Y2Reborn today? A native Linux music-player application running on a substantially working, custom Linux platform for the Innioasis Y2. It has a real accelerated interface, library/database, playback engine and radio-service integration. It is an owner development system with significant physical foundations, not a qualified consumer-player release.

Luna made useful, technically substantive improvements, but the stabilization claim is too broad. The original FFmpeg frame-shell leak is fixed; sink release now precedes probing; database writes are acknowledged; queue occurrences have identities; the selected userspace upgrades really are built. Several original correctness boundaries remain open, and this review found new defects in session/render state, filtered-track queue actions, input-loss handling and the proposed S24 output path. Keep the work as a development base, with a corrective pass before feature expansion. A wholesale rollback or architecture replacement is unwarranted.

Reviewed identities and evidence limits

Both repositories were checked with git status, git rev-parse HEAD and git log --oneline --decorate -30; the reported heads were confirmed.

All intervening changes were examined: Linux 13 files, +267/−33; Reborn 15 files, +1499/−217. Linux changes do not alter kernel drivers, DT or kernel configuration. Reborn's last two commits only update Luna's report. The existing ARM package records Reborn 42dc1f562d00439e8edcbb52fc070be28a69378e, which contains the same production code as current HEAD, and Linux 8e5b53b….

The package labels itself release 0.1.0-premium.3, rootfs 2025.02.18-premium.3, with layout/data schema 1. Reborn's application label is 0.1.0-premium.01; its session schema is 2 and library DB schema is 1. These separate version domains should not be confused with hardware acceptance.

Primary inputs were all 16 current-system audit files, the codec architecture, its evidence, Luna's report, actual before/after source, generated package configuration, ELF files and retained raw validation output. Luna's report is a claim source, not acceptance evidence. This review activates/closes no milestone and authorizes no hardware, memory or production-scope change; the standing roadmap audit rule still applies before those decisions.

2. Luna change review

VERIFIED_FIXED below means the specified software defect has convincing source/targeted evidence; it does not mean physical product qualification. PARTIAL identifies both a real improvement and a remaining defect. Detailed source locations and failure traces are in LUNA_STABILIZATION_REVIEW.md.

P0 correctness groups

Queue semantics traced: duplicates are distinguishable; successful remove/reorder/clear operations update IDs and replace active playback; current-entry removal is refused; clear keeps the current/past prefix and removes future entries. Repeat-one reloads the current track; repeat-all restarts the queue at its end, with a sink restart rather than seamless wrapping. Shuffle is applied when constructing a new play queue. Collection playback is materially improved, but the context-action defect and metadata edge cases prevent complete sign-off.

P1 findings

New S24 defect and BlueALSA readiness

The typed negotiated format is a good direction, but S24 support is not correct. Rust and ALSA define format 3 as signed 24-bit samples in four-byte containers; C's format_from_int(3) returns AV_SAMPLE_FMT_S16. A direct call to the existing native library converted stereo S32 [1073741824, -1073741824] into bytes 00 40 00 c0 00 00 00 00: S24 containers [-1073725440, 0], instead of [4194304, -4194304]. The added S24 test uses zeros and misses the defect.

Current SBC is S16 and unaffected by this specific bug. S32 follows the S32 branch and does not inherently pass through S16. Wider-codec readiness also needs real transport epochs and format revalidation: the current generation is a hash of the PCM path, while the installed bluealsa: PCM is an ALSA plug wrapper that can conceal a stale-format conversion. Optional codecs being disabled is appropriate and is not a negative finding.

Tests and build evidence

The retained final workspace output really reports 91 passing tests. This review independently reran 45 existing cached host tests: playback 6, media 15, core 7, library 8, input 9; all passed. These binaries were not rebuilt. The separate nonzero S24 probe failed its sample contract. No test/source fixtures were added or changed.

The existing fresh-output ARM build has actual upgraded package trees and installed libraries. This review reran the generated FFmpeg component/ELF verifier and the production package/rootfs validator: both passed, including preserve-data packaging and ext4 identity. ELF inspection confirmed dynamic BlueALSA dependencies, Reborn's lazy FFmpeg boundary, libasound.so.2 and libsqlite3.so.0. This is build/integration evidence, not an ARM behavioral or hardware acceptance pass. Current QEMU assertions must be updated before that check can truthfully validate FFmpeg 9.0.2.

The original broad sweep ran 123 tests and returned 1 failure + 42 errors. Its raw output was inspected and representative failures traced into the fixtures/current source:

No new product regression is established by those 43 results. The unmaintained broad runner is still a test-infrastructure debt, not a green suite. Conversely, passing focused tests did not catch the real source defects above. Missing boundary tests include failed sink reopen, scan batch/finalization/full-disk/source loss, 5/10/15-second crossfades with decode failure, live queue operations, save/render cadence and nonzero S24 values.

3. Architecture overview

flowchart TD
    ROM[MT6582 Boot ROM] --> PRE[Stock preloader]
    PRE --> LK[Stock LK bootloader]
    LK --> BOOT[Linux BOOTIMG: kernel + DT + rescue initramfs]
    BOOT --> ROOT[Y2Linux / Buildroot on Y2ROOT]
    ROOT --> SERVICES[Native drivers and platform services]
    SERVICES --> APP[Reborn]

BOOTIMG establishes storage identity, root/data mounting and recovery before handing over to Buildroot/BusyBox. Y2Linux owns hardware, filesystem policy, power and radio infrastructure. Reborn owns the player and user interaction. Stock early boot is retained; this is not a new bootloader or Android application.

flowchart LR
    INPUT[Physical evdev input] --> ACTION[Semantic actions]
    ACTION --> MODEL[UI / AppModel / effects]
    MODEL --> WORK[Playback, library and connectivity workers]
    WORK --> API[FFmpeg, ALSA, SQLite, D-Bus, DRM/KMS, sysfs]
    WORK --> EVENTS[Events and observed state]
    EVENTS --> MODEL
    MODEL --> DRAW[Draw commands → GLES renderer]

The Rust application coordinates bounded workers; native C boundaries handle FFmpeg, ALSA and graphics. AppModel holds user/session state, while service observations report reality. The remaining bugs largely concern synchronizing those boundaries, rather than an unsuitable architecture.

What is good — preserve these foundations

• Stock boot/recovery compatibility, explicit partition identity and preserve-data updates.
• Platform ownership of shared CONSYS power/reset/calibration and PMIC/source control.
• FFmpeg as the sole decode/resample/DSP/sample-conversion authority, loaded behind a small native boundary.
• One SQLite writer, stable source/path identities, transaction batching and retained offline entries.
• One ALSA writer actor and generation cancellation; finish its reconfiguration/error contract.
• Semantic input, UI/service separation and native DRM/GBM/EGL/GLES rendering.
• Bounded local diagnostics, structured events, restricted control commands and persistent owner SSH identity.
• y2-bt-reconnect as the single automatic Bluetooth connection-retry owner.

Do not replace these with another media engine, database, GUI framework, radio retry service or boot scheme to address local correctness defects.

4. Hardware/platform overview

Status labels: WORKING / PHYSICALLY EVIDENCED refers to the stated older measurements; IMPLEMENTED BUT NEEDS CURRENT QUALIFICATION means code exists without sufficient current proof. PARTIAL, MISSING and UNKNOWN retain their literal meanings.

Principal physical receipts: GPU/audio/runtime-PM and failed suspend, September 18, connectivity scans, September 17, installed Reborn inspection, September 18. Historical milestone wording inside those receipts is historical, not this review's current project status.

5. Audio overview

File → FFmpeg demux/decode → canonical stereo planar float → volume/ReplayGain/EQ/limiter → final rate/format conversion → ALSA sink. Crossfade retains next/previous PCM windows and uses FFmpeg mixing; transition working buffers are S32. Outputs are internal CS43131 and Bluetooth via BlueALSA.

ReplayGain metadata parsing and limiter headroom improve in Luna's pass. EQ's processing exists, but a normal user cannot configure bands/presets. Gapless preopening/continuous delivery exists, with tests for limited fixtures; lossy priming, heterogeneous formats/rates and repeat wrapping are not comprehensively qualified. Crossfade 5/10/15-second block sizing is repaired, but failure recovery, timing and memory are not signed off. One 15-second stereo S32 window at 44.1 kHz is 5,292,000 bytes; several such windows, filter buffers and copies coexist. Thirty seconds doubles each window.

True wired high resolution is missing from the exposed AFE path. S32 DMA/sample format, preserved 24-bit payloads and native 88.2/96-kHz operation require AFE packing, DAI/codec format agreement, I²S framing and both clock families to be established. Existing 32-bit slots, generic DAC capability and source decoding are insufficient. Treat this as a separate, audited hardware milestone; do not unlock it merely by changing the qualification JSON.

6. Bluetooth / Wi-Fi overview

Bluetooth

The observed MediaTek controller reports Bluetooth 4.0 and BR/EDR capability. Software codecs run on the application CPU through BlueALSA; controller capability alone does not prove codec throughput or coexistence. LE Audio is not an implemented path for this controller stack.

The new types make optional codecs easier to add, but the complete path is not software-ready yet. Repair conversion/transport identity, qualify SBC, then add capabilities deliberately. No optional-codec absence is counted as a stabilization failure.

Wi-Fi

Native cfg80211 scanning and shared-radio operation are physically proven. Reborn handles scan UI, saved WPA-PSK configuration and association requests; wpa_supplicant owns association/reconnect, while platform event handling starts DHCP and installs network configuration. WPA COMPLETED alone is not proof of an address, route, DNS or Internet access.

Retained results include 23/12 BSS entries during the platform run, later 19/23 with GPU/radio activity, and 28 through installed Reborn. Both radios being powered while a scan succeeds proves limited coexistence only. No retained successful WPA association, DHCP lease, DNS query, sustained transfer, saved-network reconnect or Bluetooth-audio-plus-Wi-Fi traffic run was found. Current UI supports the intended WPA-PSK case; open networks, enterprise authentication and WPA3 are not complete product paths.

7. Library / state / UI overview

Library: A scanner walks internal music and mounted SD sources, reuses size/mtime metadata, and sends 64-track transactions to one SQLite writer. Source identity is internal or SD UUID plus path; unplugged sources can remain indexed as offline. Albums/artists/folders are views over track metadata. The current pruning and storage-error defects must be corrected before hot-removal can be trusted.

Scale: Queue and query-result cap: 20,000 tracks; scan/existing-record guard: 250,000; session file cap: 8 MiB. These are implementation limits, not a measured supported library size. The UI loads a bounded first result set, clones track collections during interaction and rebuilds rows; it has no completed paged browsing contract. Full queue/session serialization and artwork/decode allocations compound memory use. A representative 10k/20k library needs target RSS/latency measurement before promising that scale.

State: Queue occurrence identity is separate from library track identity. Sessions use an explicit schema, bounded load/save and temporary-file/fsync/rename persistence, restoring paused. These foundations are useful; render/persistence dirty-state coupling is wrong. Corrupt-DB quarantine is implemented but needs error classification and recoverable multi-file handling. “Rebuild library” currently performs an incremental scan, not a complete forced metadata repair/recovery workflow.

UI architecture: Native draw commands → GLES2 textures/quads → GBM/KMS presentation; no browser/desktop compositor is required. Screen/navigation state, focus, modal actions and service effects are mostly separated. Physical wheel navigation, Select/Back, playback/volume keys and Power have semantic mappings. Screen-off suppresses browsing; volume/playback actions can continue, and Power wakes the display. Long-press/lost-input edge cases remain.

Design maturity: This is a functioning interface architecture with an unfinished visual/product layer. Another visual-design pass is appropriate. Typography, spacing, hierarchy, colors, icons, album presentation and navigation feedback can evolve independently once action/state contracts are stable. International text, collection edge cases, truthful errors, stale artwork and scale responsiveness remain practical UX gaps. Architecture quality does not establish visual-design quality.

8. Power / storage / recovery overview

Power

The native charger has explicit PMIC register ownership, validation, watchdog handling and fault containment. Source detection has one USB-PHY owner. Current policy includes a 4.175-V target, 4.200-V software ceiling and 4.110-V recharge threshold. Deep-recovery/precharge policy now permits up to 450 mA below 3.4 V; configured source-dependent limits include 450 mA for the normal SDP allocation and 650 mA for recognized higher-current sources. Configured charging current is not measured pack current or total USB input current.

Earlier 70-mA observations showed falling battery voltage under load; they do not validate the later current revision. POWER-03 owner acceptance is real historical acceptance, not a current electrical measurement. Battery-cell temperature, reliable state of charge, actual current, useful charging under load, source/cable limits and cutoff behavior remain insufficiently established. Unattended charging safety is UNKNOWN.

• Offline charging: dedicated early-boot charging UI/policy exists, with deliberate Power-button boot and a voltage guard. Current integrated behavior still needs qualification.
• Low battery: boot-time guard exists; complete normal-runtime warning, checkpoint and graceful low-battery shutdown policy is missing.
• Display sleep: panel/backlight and renderer resources can be released while audio continues. This is not deep suspend.
• GPU runtime PM: bounded physical power-down/redraw observations exist.
• Deep suspend: helper/activity leases/radio quiescence and CPU-mask corrections are implemented. The retained GPU-01 attempt failed to resume in the same boot; CPU3 ACK-mask failure was diagnosed and corrected for GPU-02. Same-boot RTC/Power wake with integrated graphics/audio/storage remains unqualified.

Storage and updates

Normal system updates select only BOOTIMG and ANDROID. The reviewed candidate contains no Y2DATA image and its preserve-data validator passes. Rescue runs from initramfs and refuses incompatible root/data identities; manual fallback artifacts are retained. There is no automatic A/B rollback, atomic torn-BOOTIMG recovery, signed OTA chain or new verified-boot guarantee. Public installation/recovery qualification is still broader than the owner development workflow.

9. Current dependency stack

These are selected/built versions, checked against transformed Buildroot recipes, actual build directories, generated configuration and installed ELF/library names. The source authorities are the Buildroot lock, package adapter, FFmpeg adapter and Rust toolchain. Upstream release freshness was not re-audited here.

Integration/pinning assessment

Buildroot's archive is SHA-256 locked; guarded transformations install exact package versions and source hashes. This review independently matched cached Buildroot, FFmpeg, BlueZ, BlueALSA, SBC, ALSA-lib and SQLite archives to their pins. Source hashes establish local input identity, not repeat-build equivalence or a blanket security audit.

One clean output directory with cached inputs does not establish a fresh-machine or byte-reproducible build. The manifest also still describes unimplemented Y2PlayerNative, despite packaging Reborn; the validator enforces part of that obsolete contract. Source/build IDs now align, but product identity and runtime receipts do not yet fully agree.

10. Master feature matrix

Host means some focused software checks exist, not complete failure coverage. ARM means present in the reviewed build, not executed successfully on hardware. Older physical evidence is explicitly from pre-candidate builds; no row claims physical acceptance of this modernization image. Owner scope means a useful established development foundation whose new package still needs qualification; it is not public-release approval.

11. Remaining weaknesses

1. Correctness closure is incomplete: save/redraw coupling, sink failure state, scan pruning/source loss, recovery classification, queue context actions and input cancellation. These affect current use and state preservation.
2. Audio assurance is thin: long crossfades, decode-failure recovery, exact boundary/artwork timing, meaningful nonzero conversion tests, heterogeneous gapless/seek, and target memory/XRUN behavior.
3. Hardware qualification trails implementation: new userspace has no physical pass; Bluetooth audio and Wi-Fi connectivity have no retained complete flow. Deep suspend has a concrete historical failure with an unqualified correction.
4. Power readiness is unresolved: current useful charging, cell/source limits and runtime low-battery behavior cannot be inferred from old acceptance or host tests.
5. Release receipts and validation disagree: stale application manifest, FFmpeg labels/QEMU expectations, historical suite fixtures and cache-dependent acquisition. Distribution rights/input provisioning for private firmware, calibration and assets remain a release constraint.
6. Product UX/scale need work: EQ control without bands, metadata/text limits, stale artwork/errors, expensive whole-library/UI operations and no measured library-scale promise. Visual refinement remains a separate expected pass.

12. Missing features

These are distinct from implemented-but-unqualified SBC, Wi-Fi association, charging and suspend:

• True internal wired S32/preserved-24-bit/high-rate output path.
• Reborn AVRCP player/control/metadata integration.
• Application Bluetooth Auto codec selection/fallback policy and requested-versus-actual presentation.
• Enabled/qualified AAC, aptX, aptX HD and LDAC product integrations; upstream codec support alone is insufficient.
• USB host/OTG audio output and a USB sink-selection/lifecycle path.
• User EQ band/preset configuration; robust runtime low-battery UX/shutdown.
• Complete paged large-library browsing and comprehensive non-ASCII text support.
• Signed update/distribution workflow and automatic rollback; complete public installation/recovery qualification.

13. Release readiness

The package inspected in this historical review was the private local Y2Linux/out/y2linux-reborn-software-modernization-01/manifest.json. Its exact contents were useful build evidence at the time; the ignored out/ path is not a public documentation link, and its name/validators do not elevate readiness.

14. Next development paths

15. NEXT 3 THINGS

1. Close the remaining software correctness boundaries — MEDIUM, software-only. Fix save/redraw state, sink failure outcomes, scan/pruning and DB recovery, queue/input semantics, crossfade prefix preservation and S24 packing; add tests at those exact failure boundaries. Why now: current “fixed” claims cannot support qualification. Unlocks: a coherent baseline suitable for meaningful physical tests and later UI/audio work.
2. Qualify that exact baseline on the Y2 — LARGE, physical with software evidence collection. Owner-controlled playback/input/storage/network/SBC checks, measured memory/XRUN behavior, and explicitly bounded charging/low-battery/suspend qualification. Why now: most uncertainty is the gap between implementation and real hardware. Unlocks: an honest supported-feature set and defensible choices between Bluetooth, high-res and USB work.
3. Make the release/build contract truthful and repeatable — MEDIUM, mainly software/documentation; eventual independent install validation. Align Reborn manifests and FFmpeg runtime receipts, repair/profile the historical suites, complete clean input acquisition and document the limited alpha/install/recovery contract. Why now: current metadata and green-check meanings are inconsistent. Unlocks: a maintainable private alpha and a reliable basis for later public-release decisions.