Targeted SD1 clock ownership passes automatic restart

Root physically ran the inspected five-clock candidate on 2026-10-03 UTC (October 2, America/Chicago), using ~/tmp/k230-mainline-probe-integration, branch integrate/mainline-probe-path, bounded base 65578ff2. Root owned the single board/UART reservation; no kernel build slot was used.

The host build proof identifies the realized 9vdk79… kernel, 5yqilsfy… bundle and 9gdms… console system. The coordinator independently repeated bundle inspection. A fresh protected normal identity check preceded the staging operation: eight new store paths were imported with archive SHA verification, the matching bundle was GC-rooted, and its four staged artifact hashes passed. The later trial preflight verified registered validity of the complete 629-path system closure and exact metadata. Normal profile, boot files and persistent boot selection were unchanged.

python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal \
  --runtime-shutdown-trace \
  --bundle /nix/store/5yqilsfyj35jzrcqjjqilkr6sd47qlms-k230-mainline-drm-trial-boot-files \
  --manifest "$HOME/tmp/k230-mainline-sd1-board/candidate-manifest.json" \
  --normal-report "$HOME/tmp/k230-mainline-sd1-board/normal-report.json" \
  --log "$HOME/tmp/k230-mainline-sd1-board/minimal-uart.log" \
  --result "$HOME/tmp/k230-mainline-sd1-board/minimal-result.json"

Controller exit 0: recovery-verified-diagnostic-passed. The exact printed volatile arguments contained no clk_ignore_unused. The candidate printed clk: Disabling unused clocks at 3.245763 seconds. Fresh readiness/reception, true/proc/uptime and all six runtime tracing stages passed, including the independent Y parameter readback.

The real reboot passed the previous MMC shutdown boundary and the remaining devices. At 5.757050 seconds the candidate printed reboot: Restarting system, then SPL and the normal system booted. Within the 180-second return window, protected postflight verified a fresh normal boot ID, exact system/profile/ kernel/init, three active shell services and all eight boot hashes unchanged. No operator reset or global clock bypass was needed.

Result preserves the controller facts, selected artifact hashes, source identity and raw-log hash/timestamp; only the private raw-log pathname was removed. The curated console excerpt selects candidate shutdown and following SPL; raw normal-system output remains private. This is physical serial proof, distinct from host builds or injected input. No new photograph or real-finger acceptance was obtained for this restart trial.

The earlier comparison established global cleanup dependence. This result shows the targeted five-clock correction is sufficient for this candidate’s bounded restart trial with ordinary cleanup; it does not attribute failure to one particular gate or prove all other hardware resources are complete. Task 5d.4 now has no-bypass physical proof. Task 5b.5 remains open for ordinary NixOS root activation and deliberate touch; the initrd shell used here is not a usable mainline system.

Returned SD label check

After the protected minimal return, the operator ran the same explicit bundle/manifest/normal-report command with --mode label, without clock bypass or runtime tracing, and fresh label-uart.log / label-result.json private paths. Controller exit 0, recovery-verified-diagnostic-passed. Fresh receipt, true/proc/uptime, devtmpfs setup and the expected block node passed. The bounded read-only partition-label command returned RC0 and matched NIXOS_SD. The single reboot returned through SPL to a fresh protected normal boot; all identities/services/eight hashes passed. Result and excerpt retain that physical observation. This neither mounts the root nor activates init.

Read-only mount reply interleaved with kernel logging

The same exact candidate was next run with --mode root-mount, fresh root-mount-uart.log / root-mount-result.json private paths and the post-label protected normal report. The controller exited 2, unknown at root-mount mount, and sent no subsequent probe or reboot input. Original failed result preserves that limit.

The private capture contains complete mount-reply fragments ending in RC0 and a fresh initrd shell prompt, but an EXT4 informational line splits the nonce. The kernel reports a read-only mount without journal replay. This is an interleaved protocol response, not proof of a hung mount. The original strict parser did not accept it. A narrowly reviewed parser correction and independent fresh mount-flag/lookups/unmount checks are required before resuming recovery. Root activation, deliberate touch and recovery from this specific stopped trial remain UNVERIFIED at this checkpoint.

The ordinary-init/touch source plan records the separate full-boot procedure and profile-preserving trial guards. It does not substitute for those physical gates.

Parser correction and operator-reset recovery

The mount-only parser correction landed in ad34cc5b; its 100 host tests passed. Independently replaying the original complete private receipt now returns RC0. A fresh CR prompt check and a separate LF-only observation each received zero bytes. No root, unmount or reboot command was sent after those checks. This later silence does not establish the cause or turn the original completed mount into a failed mount.

The user pressed reset. A fresh normal check verified the exact original system/profile/kernel/init, three active shell services, all eight unchanged boot hashes and a new boot identity. Reset recovery result records this as operator recovery, not automatic recovery of the paused session. A whole-protocol retry uses the landed parser and new private logs.

Complete corrected read-only root retry

Source 2fc70b46 ran the same explicit bundle/manifest/normal-report invocation with --mode root-mount and fresh root-mount-retry-20261003T0415-uart.log / corresponding result paths. Controller exit 0, recovery-verified-diagnostic-passed.

Fresh minimal/device/label prerequisites passed. All root stages returned RC0: previously unmounted, directory creation/empty check, ro,noload ext4 mount, exact read-only/no-recovery flags, executable selected init and prepare-root lookups, unmount and confirmed absence of the mount. Neither init file was executed. One acknowledged reboot returned through SPL to a fresh normal boot, with exact protected identities, three active services and eight unchanged boot hashes. No operator reset was needed during this complete retry and no clock-ignore parameter was used.

Complete retry result preserves controller facts and private log identity. This supersedes the earlier recovery blocker for proceeding to the separate ordinary-init trial; it does not prove root activation or real touch, and task 5b.5 remains open.