Retained SBI boot console: same-image host preparation

Evidence class: host controller tests and actual immutable artifact inspection. Root worktree /home/jadams/tmp/k230-mainline-probe-integration, branch integrate/mainline-probe-path; this increment starts at e38c9040. Owned paths are the observer controller, its focused tests, this note and the mainline task checkpoint. No kernel rebuild, flash, persistent boot selector, helper change or board operation is established by these host checks.

The source plan qualifies earlycon=sbi keep_bootcon: both previous physical captures contain the kernel’s detected SBI DBCN extension banner, and the installed kernel enables the SBI early console. Retaining the boot console changes printk delivery and timing. It can duplicate output and can itself block; it does not guarantee return or identify a UART/clock/IRQ defect.

--sbi-boot-console requires --serial-console-only, rejects any original earlycon or keep_bootcon token (including alternate values), and appends exactly earlycon=sbi keep_bootcon to the existing qualified diagnostic arguments. Default and serial-only argument values remain unchanged. The original artifact, Image/hardware-DT/initrd/helper/source/closure checks, fresh protected normal preflight, load/CRC checks and exact printed arguments remain prerequisites. Nothing saves the volatile U-Boot environment.

The observer parser, reception gates and passive recovery deadlines are unchanged. Duplicate/interleaved records are still failures, never collapsed into acceptance. Duplicate readiness sends zero receipts. A protected normal return may separately qualify recovery while the diagnostic remains failed; better logging alone is not usable-root or receive-path proof.

Host proof

python3 -B -m unittest discover -s tests -p test_mainline_drm_uart_observer_trial.py
openspec validate the-board-runs-a-mainline-kernel --strict
git diff --check

All 38 focused tests passed (7.432 seconds). New checks cover the exact two-token addition, rejection before artifact access without serial-only mode, conflicting boot-console policy, retained source artifacts through actual newc/ELF/unit/DT fixture preparation, result selectors/fresh arguments, both comparison transports, no boot on printed-argument mismatch, and duplicate readiness yielding zero receipts. Existing malformed-frame, unknown-state, one-receipt and normal-return checks still pass.

Independent read-only controller review approved the increment without a blocking correction and repeated all 38 focused tests successfully (7.408 seconds). The reviewer performed no edits, build or board action.

Actual host prepare() against the selected 16cpjji… bundle passed with both flags, the private manifest/normal report and the successful blkid prerequisite below. It inspected the selected Zstandard archive, matching RISC-V helper/unit/drop-in/marker, unchanged Image and normalized hardware DT, closure and hashes. Outgoing command lengths were 28, 206, 413 bytes, all below the conservative 512-byte limit. No serial port was opened.

The exact operator invocation, using new private output paths:

python3 tools/mainline-drm-uart-observer-trial.py \
  --serial-console-only --sbi-boot-console \
  --bundle /nix/store/16cpjjiifxgwyb6bndhi39vfmlvcdw6h-k230-mainline-uart-observer-boot-files \
  --manifest "$HOME/tmp/k230-mainline-uart-observer-board/candidate-manifest.json" \
  --normal-report "$HOME/tmp/k230-mainline-uart-observer-board/normal-report.json" \
  --blkid-result "$HOME/tmp/k230-mainline-blkid-board/trial-result.json" \
  --log "$HOME/tmp/k230-mainline-uart-observer-board/sbi-boot-console-uart.log" \
  --result "$HOME/tmp/k230-mainline-uart-observer-board/sbi-boot-console-result.json"

Host Python 3.14 with compression.zstd, pyserial and DT tools is required. The controller acquires the exclusive board lock itself. Root is the sole operator after review/landing and a fresh protected normal preflight. Record actual early-console enable/retention, later init progress, observer frames and automatic return separately. Keep raw logs, boot identities and volatile nonces private; commit an explicitly sanitized physical packet.

If passive recovery is unknown, stop candidate input and request operator reset before any protected postflight. If the output still cannot identify the boundary, the separately reviewed opt-in kernel markers in the source plan remain the next diagnostic. Ordinary root/panel/glass task 5b.5 stays unchecked.