PID1 return and first userspace syscall: physical capture

ONE physical UART capture of the default-off two-point transition variant, 2026-10-05 20:24:27–20:28:01 UTC, controller revision bfef07f1 (tools and flake unchanged from frozen build revision a60b0eae). Candidate readiness bound180 seconds. Controller exit1: ordinary init login readiness unverified. Actual host proof and both independent actual-host reviews passed first.

Guarded staging

Staging receipt: root ran the reviewed private stage guard once (20:19:56–20:21:16 UTC), return0. A fresh prompt and full protected preflight against the old 5f2j… staged bundle preceded one acknowledged upload. The board checked the compressed NAR SHA256, imported the 8 new of 630 closure paths, retained a separate candidate GC root, copied only trial files and verified staged checksums. One exact fresh-token RC0 frame preceded the full post-guard against the new candidate. Protected normal identities, eight boot hashes, three active services and registration absence were identical on the same boot. No reboot, profile switch or boot-file replacement. Independent complete UART staging review PASS. The transfer server was stopped afterwards.

Capture

python3 tools/mainline-drm-system-trial.py begin \
  --wait-initramfs-in-initcall --without-boot-markers --init-exec-return \
  --init-exec-transition \
  --bundle /nix/store/jx56x86gihamimhj6hqr8d13rn6ax25r-k230-mainline-drm-trial-boot-files \
  --manifest PRIVATE_MANIFEST --normal-report PRIVATE_NORMAL \
  --state NEW_PRIVATE_STATE --log NEW_PRIVATE_LOG --result NEW_PRIVATE_RESULT

All five U-Boot load size/CRC pairs matched the manifest. The kernel received the exact 351-byte arguments with both gate tokens. A fresh 7.3.0-rc5 banner and Run /init as init process (4.573720) preceded exactly one of each record, in order (fixed observations, safe result):

[    4.584221] K230_INIT_EXEC_RETURN_V1 ret=0
[    4.584235] K230_INIT_EXEC_TRANSITION_V1 point=kernel-init-return
[    4.584361] K230_INIT_EXEC_TRANSITION_V1 point=first-user-ecall

The parser reported a complete sequence, no missing records and no errors. No qualified login or primary prompt appeared within180 seconds. The last host-to-board annotation is bootm; the reviewed source only reads after it. That is source/transcript evidence, not electrical TX proof.

What this shows, within the diagnostic’s stated limits: the selected kernel_init returned to ret_from_fork_kernel, user mode executed and issued an ECALL whose kernel-entry setup succeeded. It does not prove the syscall handler returned, loader constructors or systemd main ran, or that the last record’s own print returned.

Bytes after the last record

The raw UART ends with exactly \r\n ESC P + q 6E616D65 ESC \ and then nothing for the rest of the 180-second bound. This is a DCS XTGETTCAP query for the hex string 6E616D65 (“name”). On the protected normal 6.6.36 boot, systemd PID1 emits the same query and immediately follows it with further terminal queries (ESC[18t, ESC[6n, …) and its version banner. The earlier 5s capture ends with the same bytes, which that write-up did not mention; it made no claim of silence. The emitter of these bytes, and where execution stopped after them, are UNVERIFIED from UART alone. They are recorded here as an observation for the next source-grounded plan, not as a cause.

Recovery

After the capture completed, the user performed a NEW operator reset. The independently source-reviewed recovery checker (adapted from the 5s checker only for the new bundle, both flags and a fresh-only output guard) ran once and returned0: fresh prompt, distinct boot, exact normal system/profile/kernel/init, uname 6.6.36, eight protected boot hashes equal to the trial preflight, three active services and registration absence (recovery receipt). No passive fresh SPL or automatic return is claimed.

Independent physical capture review PASS: hashes, loads/CRCs, arguments, three ordered unique records, trailing bytes, read-only window and result fields. Raw UART, URLs, tokens and boot IDs remain private; receipts bind their hashes. Publication receipt verifies the deployed revision. Ordinary root, panel, camera/real glass and task5b.5 remain UNVERIFIED.