Restart dispatch source audit — 2026-10-02

Audit recorded at 2026-10-02T17:17:05Z. Evidence class: host source/artifact inspection and bounded interpretation of private operator captures. No build, board input, reset, or hardware acceptance was performed by the auditor. Automatic restart and callback execution remain UNVERIFIED.

The audit used worktree /home/jadams/tmp/k230-mainline-restart, branch mainline-restart-port, base c5254075e531487af82841b3ae76582e5535f0fb, with host-proof HEAD 75dee78cdd61e9a8f30ec08a90784c93a11534df. Only this new file is owned by this follow-up. The coordinator owns physical operation and its separate trial evidence. The completed task-start tools/work-status.py output is cached privately; the handoff scan also completed at idle I/O priority.

Exact sources and dispatch

The corrected candidate source is /nix/store/jvz4v73g8a67pqwm06v079h6s1cpqr9s-linux-mainline-k230-drm-src, based on Linux 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e plus the optional K230 restart patch. Source inspection found:

• RISC-V reset.c, lines 19–29 calls do_kernel_restart(cmd) from machine_restart().
• reboot.c, lines 246–249 dispatches restart_handler_list. Its lines 443–470 register SYS_OFF_MODE_RESTART on that same list; lines 342–354 adapt its notifier to the sys-off callback; lines 529–543 implement managed registration/cleanup. The candidate’s local drivers/reset/reset-k230.c:388–390 registers priority 128. This API therefore reaches the RISC-V dispatch; there is no separate managed restart list that RISC-V fails to call.
• notifier.c, lines 17–40 orders higher priorities first. sbi.c, lines 682–689 registers SBI SRST at priority 192 only when the extension probe succeeds. That would precede K230’s 128. No SRST detection message appeared in the inspected capture; absence of that message is not an independent firmware capability test.
• reboot.c, lines 101–106 and 288–299 runs blocking reboot notifiers, disables usermode helpers, shuts devices down, runs restart-prepare callbacks, migrates to the reboot CPU, and shuts syscore down before printing the kernel restart announcement. The subsequent path is kmsg_dump → machine_restart → do_kernel_restart → callbacks. An announcement alone would still not prove callback execution.
• Local drivers/reset/reset-k230.c:341–402 has neither a successful-probe message nor a callback message. Mapping failure logs cannot map boot reset register; registration errors propagate. dd.c, lines 621–646 logs other probe failures, while deferral/match rejection uses debug logging. No corresponding K230 error appeared. Silence does not prove binding. platform.c, lines 1527–1537 calls a driver’s shutdown method, not device removal/devres cleanup. The K230 driver has no shutdown method; ordinary shutdown does not itself remove this managed restart registration.

The matching bundle is /nix/store/asj7l4zj5jrjkgng4nrcx3y72p7jf7aa-k230-mainline-drm-trial-boot-files. fdtget found /soc/reset-controller@91101000, compatible canaan,k230-rst, reg = <0 0x91101000 0 0x1000>, and no status property. Missing status means available in of/base.c, lines 552–560. Node availability and a matching compatible do not prove successful probe.

Candidate-phase boundary

The coordinator’s controller sends /bin/reboot -ff after a distinct candidate receipt. Local inspection selected the actual receipt line, excluding echoed commands and the preceding normal-system boot/reboot phase. After that receipt, the only nonblank captured output was Rebooting.. There was no candidate kernel restart announcement, second SPL, or normal-kernel banner before the reported physical intervention. The capture’s sole kernel restart announcement belongs to the normal pretrial reboot, not the candidate. It must not be used as candidate dispatch evidence. The controller ended on serial disconnect; this audit does not claim expiration of its full recovery deadline.

The matching system’s sw/bin/reboot resolves to /nix/store/srwrq12f962d5prr382vvsq76nfvmm84-systemd-riscv64-unknown-linux-gnu-261.2/bin/systemctl. The source named by its derivation was not locally present; the following version-matched upstream files were inspected read-only:

• systemctl-compat-halt.c, lines 78–80 and 143–159 sets force level 2 for the compatibility -f option and calls halt_now.
• systemctl-util.c, lines 893–922 performs sync() before calling reboot_with_parameter.
• reboot-util.c, lines 124–133 prints the observed userspace message immediately before reboot(RB_AUTOBOOT).

Thus the captured message is consistent with reaching beyond userspace sync and immediately before the reboot syscall. It does not show syscall entry, kernel preparation completion, handler registration, or callback execution. The location of any stall is unknown; kernel preparation/device shutdown is among the paths preceding the unobserved kernel announcement.

The separate private manual-recovery capture was 35 bytes, with bracketed-paste disable/enable sequences and a final >. This is consistent with a readline shell continuation prompt. Its preceding fragment was not usable identity text. It establishes neither a normal nor a mainline shell, a fresh boot, nor protected normal recovery. A full operator power cycle and identity postflight were pending at this audit boundary. Raw UART and private runtime fields are not copied here.

Read-only commands and limits

Commands included date -u '+%Y-%m-%dT%H:%M:%SZ', narrow rg -n/sed -n reads of the exact local source files named above, readlink -f on the matching system’s sw/bin/reboot, and nix derivation show on /nix/store/hrg87xdmvmibsh6mwh9i65mhy03i8887-systemd-riscv64-unknown-linux-gnu-261.2.drv. The upstream systemd files were read at their v261.2 URLs above. DT inspection used the following commands, with BUNDLE set to the exact bundle above:

fdtget -t s "$BUNDLE/k230-tdisplay-mainline-drm.dtb" /soc/reset-controller@91101000 compatible
fdtget -t x "$BUNDLE/k230-tdisplay-mainline-drm.dtb" /soc/reset-controller@91101000 reg
fdtget -t s "$BUNDLE/k230-tdisplay-mainline-drm.dtb" /soc/reset-controller@91101000 status

The first two returned the values recorded above; the third returned FDT_ERR_NOTFOUND. Private Python parsing of $HOME/tmp/k230-mainline-restart-board/minimal-uart.log selected a line matching ^K230_RDINIT_REBOOT\s, then counted candidate-phase announcements and classified only safe post-receipt output. Parsing $HOME/tmp/k230-mainline-restart-board/manual-recovery-uart.log counted terminal sequences and tested the final continuation character without publishing its raw contents. These inspections are not new board actions or hardware passes. Task 5d.4 and the usable-root gate 5b.5 remain open.