docs: refresh device records

devices.toml

@@ -39,10 +39,10 @@ legacy_page = "preserve"
 soc = "SM8250"
 summary = "Format 2 board, DTS and SM8250 shared support; kernel and image integration pending"
 repository_id = 1432549428
-revision = "695a35bd11337a27473a1ef6687977c0527b6878"
+revision = "0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d"
 board = "alioth"
 os_profile = "ipados-17.7.11-21H461"
-components = ["ArmDTPlatform", "ArmCpu", "SoftwareAES", "ShengUfs", "VirtioMmioBlock", "RamBlock", "GopFramebuffer", "XnuPrelink", "DarwinBoot", "AppleKeyStoreState", "QcomXnuUsbDebug"]
+components = ["ArmDTPlatform", "ArmCpu", "SoftwareAES", "ShengUfs", "ShengHidInput", "VirtioMmioBlock", "RamBlock", "GopFramebuffer", "XnuPrelink", "DarwinBoot", "AppleKeyStoreState", "QcomXnuUsbDebug"]
 record_state = "available"
 
 [[device]]
@@ -111,13 +111,13 @@ record_state = "missing"
 
 [[device]]
 name = "amethyst-bluedmc-amethyst"
-repository = "BluedMC-Amethyst/UniXNU-amethyst"
-title = "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst)"
-title_zh = "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst)"
+repository = "IOS4Amethyst/UniXNU-amethyst"
+title = "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst) (IOS4Amethyst)"
+title_zh = "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst) (IOS4Amethyst)"
 format = 2
 legacy_page = "link"
 repository_id = 1431901118
-revision = "d176e9d002129b3191df3f2a7d0faa9065f0002a"
+revision = "e128c914bd63667f645023f10e2342286bffa1ac"
 board = "amethyst"
 soc = "SM7635"
 os_profile = "ipados-17.7.11-21H461"
@@ -134,7 +134,7 @@ legacy_page = "preserve"
 soc = "SM7635"
 summary = "Eight CPUs, UFS root and userland; display presentation pending"
 repository_id = 1429664198
-revision = "2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b"
+revision = "bd618af4eb9377dafaa512a07c2991c8e2469444"
 board = "asteroids"
 os_profile = "ipados-17.7.11-21H461"
 components = ["ArmDTPlatform", "ArmCpu", "SoftwareAES", "RamBlock", "XnuPrelink", "DarwinBoot", "GopFramebuffer", "AppleKeyStoreState", "QcomGeniSpi", "AdrenoPM4", "ArmSmmu4K", "AdrenoFirmware", "Adreno740", "ShengUfs", "ShengHidInput", "Sm7635Platform", "QcomPmicRtc"]
@@ -314,7 +314,7 @@ legacy_page = "preserve"
 soc = "SDM660"
 summary = "eMMC-backed mockfs root and EL0 test init; APFS probes in development"
 repository_id = 1431566463
-revision = "d20b1cde4f3c325692ff9bd9020d2867fc64331b"
+revision = "1dff2f2101a282e523f9774fe1df4d9777624cfd"
 board = "clover"
 
 [[device]]
@@ -412,7 +412,7 @@ title_zh = "Xiaomi Redmi Pad Pro (dizi); ruan unverified"
 format = 2
 legacy_page = "link"
 repository_id = 1434414153
-revision = "6af10875ae498651ca946b22225c6326b0774dc6"
+revision = "fde4df70346302baeaab2c759adda387cc94bf50"
 board = "dizi"
 soc = "SM7435"
 os_profile = ""
@@ -430,7 +430,7 @@ legacy_page = "preserve"
 soc = "crosvm-gunyah"
 summary = "iPadOS 17 home screen; Metal widgets and icons; keychain and Bluetooth; virtio-net works"
 repository_id = 1428005836
-revision = "389d05c5aefdd8b37c3bfea61a3ac0cba0cbf699"
+revision = "8d4d4930b0fe74537cc760e5c6d410d27d187416"
 board = "droidvm"
 
 [[device]]
@@ -467,7 +467,7 @@ legacy_page = "preserve"
 soc = "UMS9621"
 summary = "Format 2 UMS9621 configuration and early-entry/MMU probes"
 repository_id = 1432985388
-revision = "5f0297fdf1355adab6a30171fbfac1e09950a82f"
+revision = "2a03cc4b3de4ef3fda69fd3c2cd9c13dcf0b436a"
 board = "e5"
 os_profile = "ipados-17.7.11-21H461"
 components = ["ArmDTPlatform", "ArmCpu", "SoftwareAES", "RamBlock", "XnuPrelink"]
@@ -672,7 +672,7 @@ title_zh = "Xiaomi 13 (mouse233)"
 format = 2
 legacy_page = "link"
 repository_id = 1430071949
-revision = "b8fc5d3af5d25b8b2b13059aaa90181b8299bcea"
+revision = "0e24b939f906b898cfe009fb7ec962cefd896ce9"
 board = "fuxi"
 soc = "SM8550"
 os_profile = "ipados-17.7.11-21H461"
@@ -869,7 +869,7 @@ legacy_page = "preserve"
 soc = "SM8750"
 summary = "Hello, six CPUs and physical root; touch and GPU pending"
 repository_id = 1428554171
-revision = "e68a630b9011cb755dbb19ab963bd10bb990f4fb"
+revision = "5a88292ff40348c608f2815b6d91ed4e2a6d31af"
 board = "hummer"
 
 [[device]]
@@ -927,7 +927,7 @@ title_zh = "Xiaomi 13 Ultra - XNU (iOS 18) (markakash)"
 format = 1
 legacy_page = "link"
 repository_id = 1433345906
-revision = "dabad737e7007fd8609b7a0dca0142ee0b75d2c1"
+revision = "2d18690628a88291aa216656c9df5eb3045ef65c"
 board = "ishtar"
 soc = "SM8550"
 
@@ -1090,7 +1090,7 @@ title_zh = "Microsoft Lumia 950 — P1 build research (TwisstedToast)"
 format = 1
 legacy_page = "link"
 repository_id = 1434782425
-revision = "34f1eb79a65119879b4d978ea6ef557a166087ce"
+revision = "4fd1fc85f698cba4dff5fcff618c70f003fcfdc3"
 board = "lumia950"
 soc = "MSM8992"
 
@@ -1168,7 +1168,7 @@ title_zh = "Redmi K60 (mondrian/SM8475): UniXNU UEFI bring-up"
 format = 1
 legacy_page = "link"
 repository_id = 1435726864
-revision = "3c60b0c77c773254a29d99e908aa7ca4b9980b22"
+revision = "83b52fbc3c16efe4e63cc5beda98c38f7b40e041"
 board = "mondrian"
 soc = "SM8475"
 
@@ -1332,7 +1332,7 @@ legacy_page = "preserve"
 soc = "SM8750"
 summary = "UI verified on hardware baseline; format 2 and peripheral builds await device checks"
 repository_id = 1428468035
-revision = "e1436a2dd4c231f4c5184b6851a2c1192e56b012"
+revision = "cdd273d72a1e3a08f118e1fb69b39ed18c3bc929"
 board = "oneplus13t"
 os_profile = "ipados-17.7.11-21H461"
 components = ["BootProgress", "NativeAES", "NativeKeyStoreEvents", "NativeMobileDisplay", "NativeRamBlock", "NativeUfs", "NativeVirtioBlock", "PaganiArmCpu", "PaganiArmDTPlatform", "PaganiDarwinBoot", "ShengPlatformPower", "Stage7Probe", "NativePrelink", "PaganiVerifiedRoot", "Sm8750Platform", "PaganiInput", "PaganiPanel", "QcomGeniSpi"]
@@ -1348,7 +1348,7 @@ legacy_page = "preserve"
 soc = "SM8850"
 summary = "GPU-composited UI and apps, touch and CPU frequency control; audio/network pending"
 repository_id = 1428693704
-revision = "81b71b1bfc7fdbfdd4c33cdc0e79f65f0c438177"
+revision = "9954cf256d67d34989e75cfdd98b27ce24db2f30"
 
 [[device]]
 name = "pdx203"
@@ -1373,9 +1373,21 @@ legacy_page = "preserve"
 soc = "SM8635"
 summary = "WIP device repositories; no hardware result"
 repository_id = 1429494152
-revision = "712e4aad0902b7f5ba10a8dacd61fd1437bf4f84"
+revision = "63daaa69fc9d3669090a4cb4a4f55cf7e664f494"
 board = "peridot"
 
+[[device]]
+name = "peridot-hoshikv"
+repository = "hoshikv/UniXNU-peridot"
+title = "Xiaomi Poco F6 / Redmi Turbo 3 (hoshikv)"
+title_zh = "Xiaomi Poco F6 / Redmi Turbo 3 (hoshikv)"
+format = 1
+legacy_page = "link"
+repository_id = 1429525166
+revision = "0a4012988415dd0281f317c838c1d40e14f06a34"
+board = "peridot"
+soc = "SM8635"
+
 [[device]]
 name = "peridot-wzy114514sb"
 repository = "wzy114514sb/UniXNU-peridot"
@@ -1535,13 +1547,28 @@ name = "pong"
 repository = "Chengdong-Yu/UniXNU-pong"
 title = "Nothing Phone (2) (pong)"
 title_zh = "Nothing Phone (2)（pong）"
-format = 1
+format = 2
 legacy_page = "preserve"
 soc = "SM8475"
 summary = "iOS 16.6.1 home screen with display and touch; UFS and GPU partial"
 repository_id = 1431008794
-revision = "ab74f075320fe54eee24d5d150386e5b0f0f427f"
+revision = "ffdad781cb16b42a1fb5c984f77998253b821d8c"
 board = "pong"
+os_profile = "ipados-18.7.10-22H374"
+components = ["PongPlatform24"]
+record_state = "available"
+
+[[device]]
+name = "pong-hxzbaka"
+repository = "hxzbaka/UniXNU-pong"
+title = "Nothing Phone (2): UniXNU UEFI bring-up (hxzbaka)"
+title_zh = "Nothing Phone (2): UniXNU UEFI bring-up (hxzbaka)"
+format = 1
+legacy_page = "link"
+repository_id = 1433163770
+revision = "b3526408e35aa74fcc68747f557eb79766b20af0"
+board = "pong"
+soc = "SM8475"
 
 [[device]]
 name = "pong-y3d4"
@@ -1787,7 +1814,7 @@ title_zh = "Xiaomi 14 Pro 23116PN5BC"
 format = 1
 legacy_page = "link"
 repository_id = 1435925007
-revision = "2a64266333443e9c001ee3e66ea76cf0f62b2a62"
+revision = "de82d0f235468b6f90887128f2cbf0813a1bf337"
 board = "shennong"
 soc = "SM8650"
 
@@ -1815,7 +1842,7 @@ title_zh = "Xiaomi Mi 8 SE (HuajiFruit)"
 format = 2
 legacy_page = "link"
 repository_id = 1435767913
-revision = "86fe9ffbc700915e006fce11474b0d277f0d7dc3"
+revision = "06a72d58315e45e7f830a429d683861d2fc536d9"
 board = "sirius"
 soc = "SDM710"
 os_profile = "ipados-17.7.11-21H461"
@@ -1847,7 +1874,7 @@ legacy_page = "preserve"
 soc = "SM7325"
 summary = "Desktop, touch, keys, brightness, shutdown, USB diagnostics and persistent Data"
 repository_id = 1432008418
-revision = "77eb481860c4212443305d28720e3d64b5cddaa7"
+revision = "efd0a7519b61e769e19658930065ba42e1a0e1e3"
 board = "gts7fewifi"
 os_profile = "ipados-17.7.11-21H461"
 components = ["ArmDTPlatform", "ArmCpu", "DarwinBoot", "NativePrelink", "VerifiedRoot", "VirtioMmioBlock", "SoftwareAES", "NativeUfs", "NativeRamBlock", "NativeMobileDisplay", "NativeGeniSpi", "NativeFocaltechTouch", "NativeQcomTsens", "NativeQcomSpmi", "NativePmicKeys", "NativeGeniI2c", "NativeQcomDsi", "NativeUsbDebug", "NativeUsbNetwork", "device", "Adreno6xx", "AdrenoMetal", "EarlyEntry"]
@@ -2064,7 +2091,7 @@ title_zh = "Xiaomi Mi 10 / SM8250 UniXNU bring-up (neowiseq)"
 format = 1
 legacy_page = "link"
 repository_id = 1433101213
-revision = "36f6db66bfd5533ebb0d24ec32b7f20e4b1617b2"
+revision = "167384accc377cd8ba29264a71996ab41eed6a78"
 board = "umi"
 soc = "SM8250"
 

docs/.vitepress/device-catalog.json

@@ -36,8 +36,8 @@
   },
   {
     "name": "amethyst-bluedmc-amethyst",
-    "title": "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst)",
-    "title_zh": "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst)"
+    "title": "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst) (IOS4Amethyst)",
+    "title_zh": "Xiaomi Redmi Note 14 Pro+ 5G (BluedMC-Amethyst) (IOS4Amethyst)"
   },
   {
     "name": "asteroids",
@@ -509,6 +509,11 @@
     "title": "Redmi Turbo 3 / Poco F6 (peridot)",
     "title_zh": "Redmi Turbo 3 / Poco F6（peridot）"
   },
+  {
+    "name": "peridot-hoshikv",
+    "title": "Xiaomi Poco F6 / Redmi Turbo 3 (hoshikv)",
+    "title_zh": "Xiaomi Poco F6 / Redmi Turbo 3 (hoshikv)"
+  },
   {
     "name": "peridot-wzy114514sb",
     "title": "Poco F6 / Redmi Turbo 3 (wzy114514sb)",
@@ -574,6 +579,11 @@
     "title": "Nothing Phone (2) (pong)",
     "title_zh": "Nothing Phone (2)（pong）"
   },
+  {
+    "name": "pong-hxzbaka",
+    "title": "Nothing Phone (2): UniXNU UEFI bring-up (hxzbaka)",
+    "title_zh": "Nothing Phone (2): UniXNU UEFI bring-up (hxzbaka)"
+  },
   {
     "name": "pong-y3d4",
     "title": "Nothing Phone (2): UniXNU UEFI bring-up (Y3d4)",

docs/.vitepress/device-records/alioth.toml

@@ -36,17 +36,17 @@ evidence = []
 
 [[area]]
 id = "cpu"
-status = "planned"
+status = "implemented"
 components = []
 paths = ["package/CpuFreq*", "scripts/*armcpu*"]
-inputs = ["Identify the cpu and interrupts hardware, resources and existing component interfaces for this board."]
-configuration = ["Record the board.toml fields, DTS properties and defconfig values used for cpu and interrupts."]
-procedure = ["Follow the cpu and interrupts stage in the porting guide and record the actual commands."]
-findings = ["Collect the first cpu and interrupts observation, its cause when established, and the resulting implementation decision."]
+inputs = ["kona: four Cortex-A55 (cpu0-3) and four Cortex-A77 (cpu4-7), MPIDR core number in Affinity1 so phys ids are 0x000-0x700. Interrupts and timers come from the ArmCpu component; secondary start is PSCI CPU_ON over smc."]
+configuration = ["board.toml: sheng-smp=1 starts secondary CPUs, armcpu-spi-ipi=1 routes IPIs through software-pended SPIs, armcpu-self-ipi=1 makes each core signal itself so XNU enables its IPI (a component argument, not one of the documented boot arguments), armcpu-diagnostics=1 reports the bring-up. dts: unixnu,cluster-type E on cpu0-3 and P on cpu4-7."]
+procedure = ["Apply both SoC patches (native-smp-secondary, native-smp-type-clusters) through the SoC repository's patch series, then build kernel, payload and boot image and boot over USB. Verify in the build tree that MAX_CPUS is 8 in the BCM2837 block, MAX_CPU_CLUSTERS is 2 and __ARM_AMP__ survives the later #undef."]
+findings = ["Without native-smp-secondary.patch the reset vector masks MPIDR with 0xFF, which is Aff0 and is zero for every kona core, so every secondary core picked the boot CPU's cpu_data and reset handler. The boot either panicked with Invalid kernel stack pointer or hard-locked with interrupts off in early initialisation.", "unixnu,cluster-type must never ship without native-smp-type-clusters.patch. With MAX_CPU_CLUSTERS still 1 the topology parser takes phys_cluster_id = (cluster_type == P), which is 1, and writes cluster_phys_to_logical[1] past the end of a one-element stack array. Release builds do not assert: the kernel dies before the console comes up. scripts/check-smp-topology.py refuses that combination.", "Both patches are private to UniXNU-pipa, not present in UniXNU/UniXNU. They live in the SM8250 SoC repository because the topology they describe is a property of the SoC, which is why the pins differ from the SM8550 device's."]
 completion = ["Every enabled CPU reaches its entry checkpoint and timer/IPI handling works on each enabled CPU."]
-limits = ["Hardware inputs and implementation are pending for this example board."]
-next_action = ["Inventory the required cpu and interrupts inputs before implementation."]
-evidence = []
+limits = ["Secondary CPUs have not been brought up on hardware yet. The two patches are applied only in the build feed checkout, not yet committed to FFT-infra/UniXNU-sm8250-common, so a fetch or tree refresh loses them.", "unixnu,cluster-type is still declared in the board DTS rather than the SoC DTSI."]
+next_action = ["Boot the image carrying both patches and read SMP run count, armcpu_smp_step, psci_rc and the boot time."]
+evidence = [{ kind = "source", reference = "scripts/check-smp-topology.py", result = "Refuses a device tree that declares cluster-type without the cluster patch applied and MAX_CPU_CLUSTERS >= 2, the combination that killed three boots silently." }]
 
 [[area]]
 id = "memory"
@@ -134,17 +134,17 @@ evidence = [
 
 [[area]]
 id = "input"
-status = "planned"
-components = []
-paths = ["drivers/ShengHidInput", "drivers/ShengNovatekTouch", "package/*Touch*", "package/*Button*", "scripts/*touch*", "scripts/*hid*"]
-inputs = ["Identify the input hardware, resources and existing component interfaces for this board."]
-configuration = ["Record the board.toml fields, DTS properties and defconfig values used for input."]
-procedure = ["Follow the input stage in the porting guide and record the actual commands."]
-findings = ["Collect the first input observation, its cause when established, and the resulting implementation decision."]
+status = "implemented"
+components = ["QcomGeniSpi", "ShengHidInput", "ShengNovatekTouch"]
+paths = ["drivers/ShengHidInput", "drivers/ShengNovatekTouch", "kits/alioth-touch", "scripts/build-alioth-touch.py", "scripts/build-gop-legacy-display.py"]
+inputs = ["FocalTech FT5652 on GENI SE4 (QUPv3 wrapper 0), per alioth-sm8250.dtsi: spi-max-frequency 6000000, interrupts <39 0x2008>, reset GPIO 33, irq GPIO 39, vdd L10C, vcc_i2c L1C, display-coords 0 0 8640 19200, max-touch-number 10."]
+configuration = ["board.toml: native-touch=1 starts kits/alioth-touch, sheng-touch-hid=1 enables the publication path in ShengHidInput, native-touch-diag=1 is a measurement-only round and must be removed for release images. SPI clock is the device tree's 6 MHz; the source is TCXO 19.2 MHz on DFS level 0."]
+procedure = ["Build with component ShengHidInput selected and the board display recipe, which invokes build-sheng-hid-input.py and archives NativeHidInput.late.o plus hid-original-bindings.o into the force-loaded libNativeLegacyDisplay.late.a. Then build payload and boot image, verify the payload carries the built kernel, and boot over USB."]
+findings = ["The part answers register reads (ID 0x5652) and returns a CRC-correct all-0xFF buffer while it has no report; an earlier version of FocalTouchProtocol.c treated that buffer as a successful empty frame, which is why every image reported frames=valid with contacts=0.", "Frame reads gated on GPIO 39 going low produced real contacts: at t=100 s two contacts, low count 284, raw 0002805f4598; the part's interrupt counter 0x8F rose from 01 to e0 and its work counter 0x91 advances 60 per second, so the sensor, the SPI link, the CRC and the interrupt line are all working.", "The HID publisher was never in the kernel: ShengHidInput compiles NativeHidInput.cpp but nothing archived it, and an object with no inbound reference is dropped from a plain archive. Selected as a component and archived by the display recipe, as UniXNU-sheng does, it links."]
 completion = ["Touches map to the display, simultaneous contacts keep stable IDs, release events arrive, and buttons produce expected HID reports."]
-limits = ["Hardware inputs and implementation are pending for this example board."]
-next_action = ["Inventory the required input inputs before implementation."]
-evidence = []
+limits = ["No HID report has reached the OS yet: native_touch_hid_reports stays 0 while contacts arrive, so the remaining work is the publication path, not the sensor.", "Buttons are not implemented on this board."]
+next_action = ["Boot the image that carries the archived HID objects and confirm native_touch_hid_reports rises and the UI responds to a swipe."]
+evidence = [{ kind = "source", reference = "kits/alioth-touch/FocalTouchProtocol.c", result = "Frame parsing treats an all-0xFF payload as no data, decodes 15-bit coordinates with the low bits in the pressure byte, and records the CRC it compared so 'passed' is visible rather than inferred." }]
 
 [[area]]
 id = "gpu"
@@ -234,6 +234,7 @@ procedure = [
   "./unixnu build kernel, then build payload and bootimg, then fastboot flash boot_b.",
   "Read the console at /dev/tty.usbmodem<N> with a raw 115200 8N1 tty; the dock's SN234567892 node is not the phone.",
   "Control frames are SXNU1 <16 hex session> <8 hex seq> <VERB> <8 hex crc32>, HELLO first to learn the session.",
+  "One unattended round is scripts/run-sheng-unattended.sh <image> [timeout]: fastboot boot the image, wait for the board's own return, boot the reader from slot a, read and decode into build/sheng-logs/<tag>-<boot id>/, then restore the slot. Fail-closed, and the timeout must exceed sheng-autoreset by 60 s.",
 ]
 findings = [
   "The CDC-ACM console refused to start with error=10 core=0 domain=5. QcomUsbDomainInstall calls halted() before scan(), so a PRTCAPDIR of 3 would have returned CoreRunning=4; it returned 5, which proves the controller already reported device mode.",
@@ -242,6 +243,10 @@ findings = [
   "printf and kprintf both fail to reach the console: a DEVELOPMENT kernel leaves disable_kprintf_output true without -enable_kprintf_spam, and printf's console path did not reach the _cnputs tee either. qcom_usb_debug_write() is the entry point that works.",
   "Exit records measured over 420 s: 180 xpcproxy exits with status=0 (normal fork and exit), 13 cryptexd SIGABRT with ns=18 code=2 (OS_REASON_LIBSYSTEM_CODE_FAULT), 11 liveactivitiesd SIGTRAP, 2 lsd SIGSEGV. Each process crashes at one fixed PC repeated, so the fault is deterministic rather than a race.",
   "A software REBOOT via the control channel is acknowledged (state=queued) but does not reach fastboot: the worker calls reboot_kernel(0, NULL), an orderly restart that unmounts every filesystem and returns through UEFI. Entering fastboot needs the ABL IMEM handshake, whose address is not measured here.",
+  "The persistent log writer runs: boot-usb101 recorded 273 rounds over 546 s with zero write errors after the console had already stopped, so the medium is the only record past the link's death.",
+  "Returning to fastboot works with sheng-log=1 and sheng-autoreset=<seconds> together: boot-usb102 rebooted at 153 s and boot-usb103 at 120 s, both landing in the board's own bootloader with the PON spare cell written ('pon: subtype 04 shift 1 spare 00 -> 04 want 04 rc=0 ok pon_rc=0') and IMEM reading the reason back (known=1). PSCI alone cannot do it: SYSTEM_RESET, SYSTEM_RESET2(32) and SYSTEM_RESET2(64) all report NOT_SUPPORTED, so PS_HOLD is the path that works.",
+  "The reader must seek relative to the partition: /dev/block/by-name/userdata starts at LBA 0x2a8000, so the window's last 8192 blocks are skip=59086843, not the absolute LBA 61872123 the header records. Passing the absolute value reads nothing at all and looks like a hung read.",
+  "The console's death is a latch, not a transient: dwc3_poll() returns -1 forever once d->failed is set (Dwc3.c:570/581/584), and nothing in the driver clears it, so the worker's retry path cannot revive the link.",
 ]
 completion = [
   "The console enumerates and answers HELLO and STATUS on the board; STATUS reports usb=3 er=0.",
@@ -253,6 +258,7 @@ limits = [
   "Symbolication of the crash PCs against the extracted dyld shared cache was attempted and produced implausible image names, so it is not reported as a result.",
 ]
 next_action = [
+  "Make the console survive its first error: clear d->failed and re-initialise the controller from the worker, with backoff, and draw the worker's retry and error counters on the diagnostic page so the failure is readable without the link it is about.",
   "Attribute cryptexd's fault, then decide whether the fix is a stub, a mount change, or accepting the crash.",
   "Wait for the MAC refusal to reproduce and read the ip_mac_return value it now prints.",
 ]

docs/.vitepress/device-records/asteroids.toml

@@ -106,7 +106,7 @@ paths = ["package/LegacyDisplay*", "package/PanelProbe.cpp", "package/AsteroidsB
 inputs = ["The firmware's GOP framebuffer, 1080x2392 x8r8g8b8 at stride 4320, on a 120 Hz video-mode panel."]
 configuration = ["offline-legacy-* arguments, sheng-vsync=120, sheng-fb-gpu=1 (the GPU copies each frame to the panel)."]
 procedure = ["Boot and watch the banner rows (sheng-banner=1) for swaps per second and copy times."]
-findings = ["T37 (2026-10-26): DSI0 is reachable under Gunyah (T37a st=1), the brightness test ran (T37b), and with asteroids-panel=3 iOS sets the brightness and sleep turns the panel off and on again (T37d). It is a board default since then.", "T37: the panel (Visionox RM69220 AMOLED, video mode, DSI0 at 0x0ae94000, dsi-ctrl v2.8) takes DCS commands through the controller's TPG command FIFO, scheduled for the first front-porch line (package/PanelProbe.cpp, asteroids-panel=1..4): brightness 51 hi lo (10..4095), off 28 + 10, on 11 + 29. The iOS brightness service is sheng's AppleARMBacklight.cpp with the DCS write instead of I2C (package/AsteroidsBacklight.cpp); level 0 turns the panel off.", "The CPU copy (143-285 ms a frame) mapped the surfaces cacheable without invalidation and showed stale patches; the GPU copy removes both.", "GopFramebuffer 33e941a's direct scanout needs ShengUfs's display SMMU window (native_ufs_dpu_map); our NativeUfs fork has none, so package/LegacyDisplayStubs.c supplies weak zero stand-ins that keep it off.", "T40c (2026-10-27): BootProgress.c's cpu0_park defaults off (see cpu)."]
+findings = ["T37 (2026-10-26): DSI0 is reachable under Gunyah (T37a st=1), the brightness test ran (T37b), and with asteroids-panel=3 iOS sets the brightness and sleep turns the panel off and on again (T37d). It is a board default since then.", "T37: the panel (Visionox RM69220 AMOLED, video mode, DSI0 at 0x0ae94000, dsi-ctrl v2.8) takes DCS commands through the controller's TPG command FIFO, scheduled for the first front-porch line (package/PanelProbe.cpp, asteroids-panel=1..4): brightness 51 hi lo (10..4095), off 28 + 10, on 11 + 29. The iOS brightness service is sheng's AppleARMBacklight.cpp with the DCS write instead of I2C (package/AsteroidsBacklight.cpp); level 0 turns the panel off.", "The CPU copy (143-285 ms a frame) mapped the surfaces cacheable without invalidation and showed stale patches; the GPU copy removes both.", "GopFramebuffer 33e941a's direct scanout needs ShengUfs's display SMMU window (native_ufs_dpu_map); our NativeUfs fork has none, so package/LegacyDisplayStubs.c supplies weak zero stand-ins that keep it off.", "T40c (2026-10-27): BootProgress.c's cpu0_park defaults off (see cpu).", "T40k-T42 (2026-10-27): zero copy on the 3a. NativeUfs sheng-dpu-linux=1 sets the display bank up as Linux does: CBA2R and CBAR written (the apps SMMU is qcom,virt-smmu and the hypervisor attaches the bank on that write), TCR2 with the ASID size and SEP, cached inner-shareable walks with T0SZ 28, TTBR0 with an ASID. The bank then took stage 1 without a fault (T40k), where every earlier setup faulted at level 0, even with blocks lacking the access flag (T40i-af). T41: 1018 direct flips, 4.4 ms mean latch, once startDirect waited for the bank (40 ms); frames showed half drawn (the wallpaper without the app), so T42 flips only once the GPU's completed fence reaches the newest fence submitted at the swap."]
 completion = ["The desktop presents through the legacy display with measured frame times."]
 limits = ["Under 60 frames per second."]
 next_action = ["Measure the frame rate with the CPU governor (T35)."]
@@ -194,17 +194,29 @@ evidence = []
 
 [[area]]
 id = "audio"
-status = "planned"
+status = "implemented"
 components = []
-paths = ["package/Audio*", "package/*Adsp*", "package/Qcom*", "package/FatVolume.*", "package/ShengQrtr.c"]
-inputs = ["The audio DSP and its firmware; sheng's ADSP, GLINK and QRTR stack is the reference."]
-configuration = ["None yet."]
-procedure = ["Boot the ADSP from its firmware partition as sheng does."]
-findings = ["No audio path yet.", "T38 ports sheng's audio DSP bring-up (AdspProbe.cpp, sheng-adsp=1 survey, 2 start) with the 3a's IPCC (0x405000), carveouts (0x99300000, 0x99280000) and crash-reason partition; the firmware comes from modem_a (LUN 4) through NativeUfs's native_ufs_part_find/read (rootstockos/NativeUfs efa8271, from UniXNU's ShengUfs)."]
+paths = ["package/Audio*", "package/Asteroids*Audio*", "package/AsteroidsTfa9873.*", "package/*Adsp*", "package/Qcom*", "package/FatVolume.*", "package/ShengQrtr.c", "package/ShengGpr.*", "package/ShengAudio*", "package/GeniI2c.*", "package/tests/audioreach*", "hal/**", "patches/xnu/zzyd-*", "scripts/*tfa*", "scripts/*audio*"]
+inputs = ["The audio DSP and its firmware; sheng's ADSP, GLINK, QRTR, GPR and AudioReach stack is the reference.", "The 3a's amplifier settings container (vendor/firmware/tfa98xx.cnt, proprietary-files.txt), turned into build/asteroids-tfa/AsteroidsTfaConfig.h by scripts/prepare-asteroids-tfa.py."]
+configuration = ["sheng-audio takes bits (sheng-adsp=2 is required, the default): any nonzero value serves the audio service, 2 plays a 1.5 s 750 Hz test tone at boot, 8 runs the lock sound test.", "sheng-audio-pa moves the DSP period buffer (default 0xe6200000, the splash region's tail); sheng-audio-tone-ms and sheng-audio-atten set the tone.", "asteroids-audio-i2s = interface | data lines << 8 | bits << 16 (default primary MI2S, SD1, 32-bit: the amplifiers take their data on gpio17); asteroids-audio-prm bits (default 3): 1 LPASS core vote, 2 MI2S bit clock request.", "asteroids-mic=<stage> (default 0, with sheng-audio) brings up the WCD9378 microphone path in stages: 1 rails (ldob7, ldob8) and codec reset (gpio162), 2 PRM votes and VA/TX core clocks, 3 LPI SoundWire pins and VA/TX macro clocks, 4 VA SoundWire master (0x33b0000, v1.7) and enumeration, 5 codec init (SCP setup, io_init, SDCA class load), 6 capture path (ports, micbias 1, SmartMIC0 sequencer, TX decimator 0), 7 DSP capture graphs and a 2 s capture test, 8 capture for the plug-in. asteroids-mic-port = sample interval | offset1 << 8 | lane << 16 (default 1 | 1 << 8). asteroids-mic-mux=1 switches the VA macro to its own core clock (0x3420000 = 1) as the vendor clock manager does (default off).", "The GPU addon carries sheng's audio server plug-in as audio/ShengAudio.driver (scripts/build-asteroids-metal-plugin.py builds it with scripts/build-sheng-audio-hal.py unless --no-audio, and adds its CDHash to the owner trust module); patches/xnu/zzyd-board-audio-addon-mount.patch mounts audio/ over /System/Library/Audio/Plug-Ins/HAL."]
+procedure = ["Read the [audio] and [amps] rows: stage, DSP status, amplifiers found (amps=3: both), clocks stable (lock=), errors, SMMU result, I2C engine, PRM results (bus= second word), I2C failures.", "Run scripts/check-audioreach-host.py after changing the graph commands."]
+findings = ["T38 ports sheng's audio DSP bring-up (AdspProbe.cpp, sheng-adsp=1 survey, 2 start) with the 3a's IPCC (0x405000), carveouts (0x99300000, 0x99280000) and crash-reason partition; the firmware comes from modem_a (LUN 4) through NativeUfs's native_ufs_part_find/read (rootstockos/NativeUfs efa8271, from UniXNU's ShengUfs).", "T41: speakers are two NXP TFA9873 (P 0x34 slot 0, S 0x35 slot 1) on QUPv3 wrapper 1 SE6 (SE13, 0x898000, gpio59/60), reset gpio141/142 (active high), fed by primary MI2S (gpio15-18, function 2) as two 32-bit slots at 48 kHz. The container carries no amplifier firmware (a dummy patch), only bitfield settings.", "T41: the microphone is AMIC1 of a WCD9378 (mixer_paths handset-mic: ADC1, MIC BIAS1 by the card routing, ADC_LP, volume 6) on the VA macro's SoundWire master; the handset mic back end is CODEC_DMA-LPAIF_RXTX-TX-3 as on sheng. The codec register recipe is the July 2026 LKML WCD9378 TX driver (v2, paged SDCA registers, built-in power sequencers); the master is v1.7 (apps command FIFO at 0x31c).", "T41: package/AsteroidsAudioProbe.cpp is sheng's AudioProbe.cpp with the 3a's board steps and the TFA9873 programs (AsteroidsTfa9873.c) in place of the CS35L43's; the speaker device runs 32-bit while the stream stays 16-bit (the playback converter widens it). The amplifiers power up after the graphs start, since they wait for the bit clock. No microphone path.", "T40k (2026-10-27): the speaker path ran end to end (DSP graphs, the service, the plug-in, a 48 kHz stream without gaps; both TFA9873 rev B found, clocks and PLL locked) but was silent: on I2S0 SD0 the amplifiers got the clocks and no data. T40k-spk-sd1 (asteroids-audio-i2s=0x200200) played the boot tone and iOS sound through both speakers: the amplifiers take their data on SD1 (gpio17), the default since T41.", "T41: TFA9873 STATUS0 bits 1, 2 and 4 (DCOCPOK, OTDS, UVDS) are ok flags in NXP's field list, not alarms; [audio] err= counts real alarms only (OCDS, MANALARM, NOCLK, TDMERR or a missing ok flag).", "T41, T41-mux: mic stage 4 fails. The rails are voted, the PRM grants the macro and codec votes and the VA/TX core clocks, the LPI pins and macro clocks are set (VA SWR_CONTROL 1) and the master (v1.7) keeps its settings, but COMP_STATUS never shows the link up, no interrupt fires and no device attaches. With asteroids-mic-mux=1 (the VA clock source switch) the master's registers read back 0, so the switch stays off. T42 adds [mic extra]: the codec reset pin read back, COMP_STATUS over time and, with asteroids-mic-pmic=1, the codec's LDOs from the PMIC."]
 completion = ["Playback and capture through the audio server."]
-limits = ["No audio."]
-next_action = ["Port the ADSP start after the battery work."]
-evidence = []
+limits = ["The microphone does not work yet: stage 4 (SoundWire enumeration) fails, so the plug-in's input stream stays silent.", "The master's port timing is not taken from the vendor driver (not in the published tree): asteroids-mic-port tunes it."]
+next_action = ["Boot T42 with asteroids-mic=4 and asteroids-mic-pmic=1 and read [mic extra]: whether the codec's LDOs are on and its reset is released tells whether stage 4 waits on the codec's power or on the bus."]
+[[area.evidence]]
+kind = "host"
+reference = "scripts/check-audioreach-host.py"
+result = "PASS: 207 AudioReach packet checks, including the 3a's primary MI2S port and the 32-bit speaker device format."
+command = "python3 scripts/check-audioreach-host.py"
+revision = "b1621b32a2513ba8e2c4c599d4f4baf602a7369a"
+
+[[area.evidence]]
+kind = "device"
+reference = "https://github.com/rootstockos/UniXNU-asteroids/commit/b1621b32a2513ba8e2c4c599d4f4baf602a7369a"
+result = "T40k-spk-sd1: the boot tone and iOS sounds played through both speakers; [amps] showed the boost converters active and [audio-io] 8.3 M frames without gaps in 494 s."
+command = "fastboot boot with boot args sheng-audio=3 asteroids-audio-i2s=0x200200 sheng-audio-tone-ms=4000"
+revision = "49ec1ccb18fd6b7ddd23b25b2c4ae96cd084ad1a"
 
 [[area]]
 id = "power"

docs/.vitepress/device-records/oneplus13t.toml

@@ -19,6 +19,7 @@ completion = ["All source pins resolve; every selected component has a record; s
 limits = ["The main fork carries community catalog entries; stock upstream alone cannot resolve this selection."]
 next_action = ["Keep build 63 as the verified eight-core baseline and validate further platform changes independently."]
 evidence = [
+  { kind = "host", reference = "feeds.toml", command = "./unixnu status -D ../UniXNU-Pagani_SM8750 --local-module soc:sm8750=../UniXNU-sm8750-common", revision = "830e21446dd45a1b8c0c7b350221ce60e87c2379", result = "The device feed and lock pin SoC b79d675, and upstream.rev pins main b962645 with the matching Sm8750Platform catalog revision. Local profile resolution found 18 selected components; a clean remote fetch remains for cloud CI." },
   { kind = "device", reference = "STAGE6.md", command = "fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "Build-63 user feedback confirms system startup and normal touch with CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096. This is tied to the recorded image and exact build-source pins; no runtime code or configuration changed after the test." },
   { kind = "host", reference = "STAGE6.md", command = "./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The matching build-63 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.791s without flashing. System startup and CPU/RAM observations await feedback." },
   { kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310", command = "Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "Build 63 passed all cloud contracts, original/compiled ABI checks and full kernel link/prelink in 17m00s. Device 3c39baf, main 52560be, drivers 14f50fc and SoC 37ccfbe match the downloaded inputs. No new device boot was performed." },
@@ -106,6 +107,7 @@ completion = ["Every enabled CPU reaches its entry checkpoint and timer/IPI hand
 limits = ["Build 63 confirms eight-core registration/online state and historical timer/IPI coverage. IPI self-test is enabled; directed cross-core stress, long-term stability, CPU frequency control and cluster-aware scheduling remain unqualified."]
 next_action = ["Measure per-core counter progress and directed cross-core IPIs under sustained load; separately qualify idle/sleep behavior, CPU frequency control and cluster-aware scheduling."]
 evidence = [
+  { kind = "host", reference = "STAGE6.md", command = "Android/FAT/ADT readback of stage7-gpu-resources/boot.img", revision = "830e21446dd45a1b8c0c7b350221ce60e87c2379", result = "The resource-only DTS candidate retains all eight CPU affinities in ADT and the verified build-63 kernel. This boot confirmed system UI and touch, but supplied no new CPU counters or directed cross-core stress result." },
   { kind = "device", reference = "STAGE6.md", command = "fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The user reported CPU reg=8 online=8 T=ff I=ff after the build-63 temporary boot. All eight CPUs are registered and online, and every per-core timer and SGI/IPI counter is nonzero. IPI coverage may include the enabled self-test; cross-core stress, sustained interrupt progress, CPU frequency control and long-term stability remain unqualified. Clutch still uses one pset." },
   { kind = "host", reference = "STAGE6.md", command = "./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The actual build-63 image retains eight CPU affinities, both hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the binary-verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved." },
   { kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310", command = "Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The actual build-63 Clutch table retains multiple_psets_enabled=0 and the expected steal callbacks. All eight affinities and SMP arguments remain selected. Online counts and runtime stability are still unqualified." },
@@ -138,6 +140,7 @@ completion = ["All handoff regions are accounted for and each enabled DMA engine
 limits = ["Build 63 reports a 4096 MiB XNU window. Larger allocations, full physical RAM exposure and each DMA engine still need their own allocation/reservation evidence and targeted validation."]
 next_action = ["Eight-core startup is confirmed. For a later 5 GiB trial, first collect the actual UEFI free/allocation map and align the owned-window and DRAM declarations; this observation does not change memory policy."]
 evidence = [
+  { kind = "host", reference = "STAGE6.md", command = "Android/FAT/ADT readback of stage7-gpu-resources/boot.img", revision = "830e21446dd45a1b8c0c7b350221ce60e87c2379", result = "The GPU resource DTS nodes remain disabled and are omitted from ADT. The image retains the eight CPU affinities, 4 GiB owned window, root volume and matching RAM Data; no larger allocation or new DMA mapping was tested." },
   { kind = "device", reference = "STAGE6.md", command = "fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The user reported RAM MiB=4096 free=24 avail=2368; free and available values change dynamically. This confirms the current 4 GiB XNU window, not full use of the reported 12 GB physical RAM or any larger UEFI allocation. The free-page snapshot alone does not establish memory pressure." },
   { kind = "host", reference = "STAGE6.md", command = "./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The actual build-63 ADT requests 4 GiB and its packed RAM Data matches UUID 1726EAC0-2168-4118-AFD6-19E12FE306E7. Same-build payload checks pass. Temporary launch was accepted; live RAM counters and larger allocations remain unobserved." },
   { kind = "host", reference = "STAGE6.md", command = "./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot", revision = "c87bced3d8fba74f11c9f91ed6494fb741f29f90", result = "The actual build-62 ADT requests 4 GiB. Its packed RAM Data matches UUID 9E72E6D9-AC74-428E-A275-E8A25FD3264C and all same-build payload checks. The temporary launch was accepted; live RAM/free/available counters and any larger allocation remain unobserved." },
@@ -238,6 +241,7 @@ completion = ["Touches map to the display, simultaneous contacts keep stable IDs
 limits = ["GENI firmware is retained. Basic touch response is user-confirmed; physical rail voltage has not been measured. No GIC IRQ path, GPI DMA, v1 command fragmentation, firmware recovery or system-sleep wake. Existing translated QUP mappings are refused. The exposed 8 KiB DMA buffer and any timed-out TCS remain reserved until reboot pending reset qualification. Multi-touch, full-screen coordinate calibration, system edge gestures and long-term stability remain unqualified."]
 next_action = ["Test multi-touch, full-screen coordinates, edge gestures and sleep/wake on the eight-core baseline."]
 evidence = [
+  { kind = "device", reference = "STAGE6.md", command = "fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch", revision = "830e21446dd45a1b8c0c7b350221ce60e87c2379", result = "The user confirmed system UI and normal basic touch with the resource-only GPU candidate. The DTS changes were committed after this test; multi-touch, edge gestures and sleep/wake were not tested." },
   { kind = "device", reference = "STAGE6.md", command = "fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The user confirmed normal touch after the build-63 eight-core temporary boot. Basic UI touch now has device evidence under SMP, in addition to build 57. Detailed multi-touch, coordinate calibration, edge gestures, sleep/wake and long-term stability still require focused validation." },
   { kind = "host", reference = "STAGE6.md", command = "./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The build-63 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline." },
   { kind = "host", reference = "STAGE6.md", command = "./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot", revision = "c87bced3d8fba74f11c9f91ed6494fb741f29f90", result = "The build-62 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline." },
@@ -277,15 +281,18 @@ evidence = [
 id = "gpu"
 status = "planned"
 components = []
-paths = ["board.toml"]
-inputs = ["Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected."]
-configuration = ["No driver is enabled for this subsystem."]
-procedure = ["Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component."]
-findings = ["Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected.", "The SpringBoard/input candidate selects no GPU driver or bridge. Updated upstream Adreno submodules are outside the OnePlus 13T component selection; UI presentation still uses the CPU framebuffer.", "The eight-core candidate continues to present through CPU framebuffer copies. CPU topology changes do not establish GPU/Metal acceleration."]
+paths = ["board.toml", "dts/oneplus13t.dts"]
+inputs = ["PKX110 Android runtime DTB SHA-256 d00767f2068d0df73fc2a077de750bba66a5420c77414db1441ff09f6f3ec223, recorded in proprietary-files.txt. It reports Adreno830v2, chip ID 0x44050001, GPU registers 0x3d00000/0x40000, GMU registers 0x3d37000/0x68000, GPUCC 0x3d90000/0x9800, GPU SMMU 0x3da0000/0x40000 and ZAP reserved memory 0x9b09a000/0x2000.", "GPU IRQs are SPI 300 and 80; GMU HFI/GMU IRQs are SPI 304 and 305. The stock GPU SMMU uses stream IDs 0 (user), 1 (LPAC), 2 (secure) and 5 (GMU).", "The stock DTB has six GPU power-level bins; the active speed bin and its voltage/bandwidth policy need measurement before power-up.", "A related OnePlus SM8750 Android device repository lists gen80000_gmu.bin, gen80000_sqe.fw, gen80000_aqe.fw and gen80000_zap.mbn. PKX110 paths and bytes remain unverified.", "Adreno 830/SM8750 requires a Gen8 backend; catalog Adreno740 is scoped to A740/SM8550 and cannot be selected as the 13T GPU driver."]
+configuration = ["The shared SM8750 DTSI describes GPU, GMU, GPUCC and GPU SMMU resources with status=disabled. The board DTS supplies the observed chip ID and model. board.toml selects no GPU or Metal component; CPU framebuffer presentation stays active."]
+procedure = ["Validate the shared and board GPU nodes against the captured runtime DTB, including register extents, interrupts and stream IDs.", "Extract PKX110 GMU, SQE, AQE and signed ZAP firmware from the matching stock image; record paths, sizes and SHA-256 pins in proprietary-files.txt without committing blobs.", "Implement and qualify an A830 power/GMU/HFI backend, then SMMU mappings, CP submission and a bounded fence before selecting a Metal frontend."]
+findings = ["The stock DTB names the GPU Adreno830v2 but advertises qcom,adreno-gpu-gen8-0-1; the two strings are preserved as observed, without inferring a different GPU revision.", "The disabled DTS nodes record four GPU windows, two GMU windows, GPUCC and the separate GPU SMMU. No clock, power, firmware, SMMU or command operation is activated.", "The SpringBoard/input and eight-core candidates continue to use CPU framebuffer copies. Their hardware observations do not establish GPU/Metal acceleration."]
 completion = ["GPU submissions complete, mapping/fence handling is correct, a known image renders, and the selected Metal client presents it."]
-limits = ["No implemented or hardware-verified path is available for this subsystem."]
-next_action = ["Capture SM8750 GPU/GMU resources and the firmware manifest; qualify a matching implementation before enabling GPU components."]
+limits = ["The PKX110 GPU firmware files, hashes and active speed bin have not been captured. The A830 power sequence, SMMU ownership, submission ABI and Turnip/Metal integration have no 13T host or hardware qualification."]
+next_action = ["Capture and pin firmware from the stock PKX110 image, then implement an opt-in read-only GPUCC/SMMU probe before any power or GMU writes."]
 evidence = [
+  { kind = "device", reference = "STAGE6.md", command = "fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch", revision = "830e21446dd45a1b8c0c7b350221ce60e87c2379", result = "The resource-only candidate reached the system UI with normal basic touch. Its GPU nodes remain disabled and were omitted from ADT, so this test provides no GPU power-up or rendering evidence. The DTS changes were committed after this test." },
+  { kind = "source", reference = "proprietary-files.txt", result = "The recorded Android runtime DTB hash identifies the source for the disabled GPU/GMU/GPUCC/SMMU resource nodes and board chip ID." },
+  { kind = "source", reference = "https://github.com/jjpprrrr/android_device_oneplus_sm8750-common/blob/l23.2/proprietary-files.txt", result = "Related SM8750 stock firmware list supplies candidate Gen8 filenames; PKX110 firmware is not pinned." },
 ]
 
 [[area]]
@@ -353,9 +360,10 @@ configuration = ["kernel.prelink roots preserve the previously qualified subset;
 procedure = ["Run ipsw fetch, kernel, build package, firmware, payload, bootimg in order; inspect payload.json and the ADT in FAT."]
 findings = ["Kernel ABI and IPSW stay at 21H461. NativePrelink stays pinned in the community bundle; the OS series selects its matching patches.", "Four byte-qualified userspace fixups now come from the shared OS profile and common validated-page implementation. Board root UUID and PackedRAMDisk/TrustCache placeholders are preserved.", "Android boot v4 packages gzip(BootShim+3 MiB FD+160 MiB FAT) followed by all stock DTBs; Android ramdisk remains empty.", "The build-48 kernel and matching trust/Data inputs are assembled at out/oneplus13t/boot/stage7-run-48/boot.img: 87945216 bytes, SHA-256 ed302c539495dcae18e21fefe0a424d4f09f2b5f480741dbd5b5f6f7ab44a9fe. The existing firmware was reused after confirming its source inputs and FD hash were unchanged. Image unpacking and FAT readback passed. The later temporary boot reached the UI, with nonfunctional peripheral controls and a subsequent UFS read-timeout panic; see STAGE6.md.", "Build 49 boot.img remains 87945216 bytes with SHA-256 5bceb7c3cac31cafde66d8b349c0fec547684aa16e7266645af544a7ae20564f. Its temporary boot succeeded and the user reported no repeat panic in this test. The next image must pair its new kernel, trust cache and pre-edited skip-Setup Data from one cloud build; the next image does not exist yet.", "Build-57 boot.img is 87957504 bytes, SHA-256 33ad1883076f25b944ccde4fd89776e28c9576589eb0cc6fb8e6df10aeee8b55, at out/oneplus13t/boot/stage7-run-57/boot.img. Android v4, empty ramdisk, unchanged UEFI and actual FAT kernel/trust/Data/ADT passed readback. Fastboot accepted the user-requested temporary boot without flashing; earlier images are retained.", "Build-59 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-59/ with 127803392 bytes and SHA-256 2f501babd1daf3a60700588d21b1ff90394d471fd82751158c726ebaf1033400. Its paired RAM Data UUID is 2B2FB879-4530-4537-8CBD-50692F3F0CA0. Source pins, packed/raw Data integrity and UUID embedding pass; no build-59 boot image has been assembled or booted.", "Build-59 boot.img is 87957504 bytes with SHA-256 a58808d933c713e5a32c068f36791d09d2917d2216c7b788250a5a8bafcca349 at out/oneplus13t/boot/stage7-run-59/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.680s without flashing a partition.", "The verified build-59 image was temporarily loaded successfully, then panicked in the kernel. The next image must use the diagnostic kernel and its matching trust/Data inputs; previous images are retained.", "Build-60 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-60/ with 127803392 bytes and SHA-256 422074400f8eff7b9be51dfec3e895a207f304deb678ba527dcaf23da2eeea35. Its paired RAM Data UUID is E81D6D67-C2F6-4CAC-9FF9-100EDFF76900. Source pins, selected diagnostic patch, actual panic strings, packed/raw Data integrity and UUID embedding pass; no build-60 boot image was assembled or booted.", "Build-60 boot.img is 87957504 bytes with SHA-256 fddce67146aca4ce607975264689f3cac014f712f7409c00d5f4de923315b4bf at out/oneplus13t/boot/stage7-run-60/boot.img. Android v4, unchanged UEFI, FAT inputs, eight-affinity ADT and same-build kernel/trust/Data checks pass. Fastboot Sending/Booting returned OKAY in 2.659s without flashing.", "Build-62 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-62/ with 127803392 bytes and SHA-256 671d5cc0c9b60b594b481914d3a5874d88e78ebac906834e78577618cfe6629e. Paired RAM Data UUID is 9E72E6D9-AC74-428E-A275-E8A25FD3264C. Source pins, actual Clutch policy, panic strings, packed/raw Data integrity and UUID embedding pass. No build-62 boot image was assembled or booted.", "Build-62 boot.img is 87957504 bytes with SHA-256 d15c0f5fca06ad13047e653aeaa778b1d3b5c6610448113143d5aa6ab7f1bd2b at out/oneplus13t/boot/stage7-run-62/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.671s without flashing a partition.", "The verified build-62 temporary boot subsequently panicked at display slot 345. No replacement image has been assembled or booted; its kernel, trust cache and RAM Data remain the current local packaging inputs, and earlier images are retained.", "Build-63 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-63/ with 127803392 bytes and SHA-256 076c87c95bf3a1496722f4bddf7538b4be336cc80908e4ef3a15eeb4b0f64540. Paired RAM Data UUID is 1726EAC0-2168-4118-AFD6-19E12FE306E7. Source pins, actual display vtable, Clutch policy, packed/raw Data integrity and UUID embedding pass. No build-63 boot image was assembled or booted.", "Build-63 boot.img is 87957504 bytes with SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149 at out/oneplus13t/boot/stage7-run-63/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted temporary launch in 2.791s without flashing a Line truncated
 completion = ["Kernel and prelink succeed, payload contains all declared inputs, and the boot image matches the bootloader format and size limit."]
-limits = ["Build 63 is device-observed through temporary boot. This does not qualify partition flashing, persistence or future images."]
+limits = ["Build 63 and the resource-only GPU candidate are device-observed through temporary boot. This does not qualify partition flashing, persistence or later images."]
 next_action = ["Retain the verified build-63 image and its matching inputs as the baseline for later independently checked images."]
 evidence = [
+  { kind = "device", reference = "STAGE6.md", command = "fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch", revision = "830e21446dd45a1b8c0c7b350221ce60e87c2379", result = "The resource-only image is 87957504 bytes, SHA-256 34b8738bf6ad044df6045039971936644d32690fa354c524478aed51719e0a22. Fastboot Sending and Booting returned OKAY in 2.656s without partition flash; the user confirmed system UI and normal touch. The DTS additions were committed after this test." },
   { kind = "device", reference = "STAGE6.md", command = "fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "The user-confirmed build-63 system startup used boot.img SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149, 87957504 bytes, with the recorded same-build kernel/trust/Data and unchanged UEFI. The temporary boot route is device-observed; no partition was flashed." },
   { kind = "host", reference = "STAGE6.md", command = "./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "Build-63 boot.img is 87957504 bytes with SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149 at out/oneplus13t/boot/stage7-run-63/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted temporary launch in 2.791s without flashing a partition." },
   { kind = "host", reference = "https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310", command = "Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks", revision = "3c39bafed673ce1233f533e5b8193a1436d894a3", result = "Build-63 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-63/ with 127803392 bytes and SHA-256 076c87c95bf3a1496722f4bddf7538b4be336cc80908e4ef3a15eeb4b0f64540. Paired RAM Data UUID is 1726EAC0-2168-4118-AFD6-19E12FE306E7. Source pins, actual display vtable, Clutch policy, packed/raw Data integrity and UUID embedding pass. No build-63 boot image was assembled or booted." },

docs/.vitepress/device-records/pong.toml

@@ -0,0 +1,189 @@
+schema_version = 1
+
+[device]
+name = "pong"
+soc = "SM8475"
+os_profile = "ipados-18.7.10-22H374"
+summary = "Nothing Phone (2), iPadOS18 Darwin24 local format2 migration and board adaptation"
+
+[[area]]
+id = "configuration"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["board.toml", "feeds.toml", "unixnu.lock", "configs/**", "dts/**", "migration/format2/**", "scripts/*format2*", "scripts/build-pong-profile-kernel.py"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["选择 ARM64、SM8475、22H374 和 Pong 四层配置，数组完整列出。"]
+findings = ["格式2解析、DTS编译、Darwin24内核及启动镜像构建成功；公开源固定版本已补齐。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["SM8475公共层与Pong聚合源码分目录固定；平台组件进一步拆分待完成。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/ipados18/services73-smmu-audio.md", result = "格式2解析、DTS、内核和启动镜像已构建；services73未安装或启动。"}]
+
+[[area]]
+id = "firmware"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["drivers/DarwinBoot24/**", "scripts/build-darwinboot24*"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["复用 Pong UEFI，DarwinBoot24 接管真实可分配区间并使用 PSCI。"]
+findings = ["现有设备可进入桌面，物理内存与可分配内存分别记录。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["固件输入与UEFI源码在独立仓库。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/format2/README.zh.md", result = "现有设备可进入桌面，物理内存与可分配内存分别记录。"}]
+
+[[area]]
+id = "cpu"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["drivers/ArmCpu/**", "drivers/ArmDTPlatform/**", "scripts/build-pong-armcpu*", "scripts/build-pong-platform*"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["使用 0x000..0x700 affinity、GICv3 和 19.2 MHz timer。"]
+findings = ["CPU 4/3/1 拓扑保持 SM8475；受管内存沿用已启动实现。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["没有声明新的多核稳定性测试结果。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/format2/README.zh.md", result = "CPU 4/3/1 拓扑保持 SM8475；受管内存沿用已启动实现。"}]
+
+[[area]]
+id = "memory"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["configs/pong-memory-sm8475.json", "drivers/PongAdreno/ArmSmmu4K/**"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["从实际不连续 DRAM 和保留区接管已取得所有权的 RAM。"]
+findings = ["物理容量12GiB；此前受管容量9728MiB，不能将物理空洞分配给VM。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["尚未接通全部物理内存。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/format2/README.zh.md", result = "物理容量12GiB；此前受管容量9728MiB，不能将物理空洞分配给VM。"}]
+
+[[area]]
+id = "storage"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["drivers/NativeUfs/**", "scripts/*ufs*", "scripts/*storage*", "scripts/*os-delta*"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["原生 UFS + 22H374 IOStorageFamily，独立 OS/SystemOS/Data 窗口。"]
+findings = ["8GiB可写UFS Data已有启动记录；本轮只准备本机OS更新，未写入手机。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["分区与镜像输入本地保存。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/ipados18/services73-smmu-audio.md", result = "本机OS中init及音频策略已更新，设备仍保留services72。"}]
+
+[[area]]
+id = "display"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["configs/pong-display-sm8475.json", "drivers/PongPower/PongBacklight*", "scripts/*display*"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["Pong 1080x2412、stride4320；DCS背光和原有显示服务。"]
+findings = ["桌面与壁纸已有显示；120Hz是请求值，不代表测得帧率。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["实际高刷新率和背光仍需设备反馈。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/format2/README.zh.md", result = "桌面与壁纸已有显示；120Hz是请求值，不代表测得帧率。"}]
+
+[[area]]
+id = "input"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["userland/touch.c", "drivers/NativeHidInput/**", "drivers/GoodixTouch/**", "userland/ui_compat18.c"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["Goodix Berlin-D，PM8350实体按键转HID/原生音量控制。"]
+findings = ["services72真实音量press/release到达SBVolumeControl，电源down到达Consumer HID；本轮核对22H374事件接口，未新增虚构设备。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["音量实际生效及独立电源按下/释放后的锁屏动作尚未确认。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/ipados18/services73-smmu-audio.md", result = "services72已观察真实输入事件，系统动作仍需设备结果。"}]
+
+[[area]]
+id = "gpu"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["drivers/PongAdreno/**", "drivers/PongMetal/**", "patches/mesa/**", "patches/metal2vulkan/**", "scripts/*metal*", "scripts/*adreno*", "scripts/*turnip*"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["SM8475 A730、实际固件、SMMU、Turnip与22H374 Metal ABI。"]
+findings = ["已有桌面硬件渲染记录，保留此前高RAM BO和copy分配修补。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["复杂壁纸和长时间稳定性没有新增结论。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/format2/README.zh.md", result = "已有桌面硬件渲染记录，保留此前高RAM BO和copy分配修补。"}]
+
+[[area]]
+id = "network"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["drivers/PongWifi/**", "configs/pong-wifi-sm8475.json", "scripts/*wifi*", "scripts/*ath11k*"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["Pong PCIe0/QCA6490，82项PHY序列、GPIO80/94/95/96/204、RPMh。"]
+findings = ["services72 PCIe link/BAR及128MiB散页DMA建表成功，停在SMMU context readback；services73按SM8475实现修正先TCR2/TCR后TTBR，编译通过。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["本轮未启动；SMMU启用、QMI固件、扫描与联网仍未确认。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/ipados18/services73-smmu-audio.md", result = "services72日志定位SMMU写序；services73复用ArmSmmu4K公共编程原语，未实机启动。"}]
+
+[[area]]
+id = "audio"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["drivers/PongPower/PongAudio*", "drivers/PongPower/ShengAudioReach*", "userland/PongAudioPlugIn.c", "scripts/*audio*"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["ADSP/GPR/APM、TFA9873双扬声器、MI2S LPAIF0 tertiary/SD0。"]
+findings = ["services72 APM、功放和现代HAL初始化成功；audiomxd因独立AirPlay路由RPC超时退出。services73在launchd前选择原生集成音频provider，运行时已编译。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["尚无StartIO、PCM完成或实际出声证据；不公开麦克风。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/ipados18/services73-smmu-audio.md", result = "services72的audiomxd堆栈定位CoreMedia路由等待，services73策略与launchd服务门控保持一致。"}]
+
+[[area]]
+id = "power"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["drivers/PongPower/**", "configs/pong-power-sm8475.json", "userland/sleepserver/**"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["SM8475 ADSP/RPMh、PMIC battery管理和Pong电源策略。"]
+findings = ["DSP readiness和电池协议已有日志；控制器值保持Pong板级来源。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["系统挂起恢复尚未完成。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/format2/README.zh.md", result = "DSP readiness和电池协议已有日志；控制器值保持Pong板级来源。"}]
+
+[[area]]
+id = "packaging"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["scripts/build-ipados18*", "scripts/make-pong-adt-ipados18.py", "scripts/build-xnu-ipados18.sh", "patches/xnu-ipados18/**", "userland/build-ipados18.py"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["Darwin24/XNU11417与22H374原始组件，格式2硬件输入与固定ABI。"]
+findings = ["services73使用匹配22H374的IOStorage/IOGPU导入；内核43834376字节，启动镜像102514688字节，构建完成。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["Apple镜像、固件和ABI二进制均需本机准备。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/ipados18/services73-smmu-audio.md", result = "内核、运行时与启动镜像已构建，产物留在本机；未安装、未启动。"}]
+
+[[area]]
+id = "diagnostics"
+status = "implemented"
+components = ["PongPlatform24"]
+paths = ["migration/ipados18/**", "scripts/pong_adt_contract.py", "userland/settings_compat18.c", "userland/init.c", "porting.toml", ".github/**"]
+inputs = ["Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore"]
+configuration = ["board.toml、pong_ipados18_defconfig 与对应板级配置"]
+procedure = ["保留屏幕启动日志和ramoops，REC抓取完整console。"]
+findings = ["services72的REC日志与audiomxd超时堆栈已分析，services73修补只构建、未启动。"]
+completion = ["在设备上观察该接口的实际工作结果并保存对应日志"]
+limits = ["本轮未启动，SMMU、联网、PCM声音和按键动作仍需设备结果确认。"]
+next_action = ["读取本轮启动日志并继续完成板级接口"]
+evidence = [{kind = "source", reference = "migration/format2/README.zh.md", result = "services72的REC日志与audiomxd超时堆栈已分析，services73修补只构建、未启动。"}]

docs/.vitepress/device-records/sirius-huajifruit.toml

@@ -42,6 +42,15 @@ findings = [
   "Format 2 replaced the hand-written ADT generator of the legacy port (scripts/make-sirius-adt.py) with a board DTS: the payload step compiles the tree and derives kernel.macho.adt from it.",
   "The arm-io base is derived from the exported nodes, not written by hand: the GIC at 0x17a00000 makes the window start at 0x17000000, which XNU reads as the SoC base.",
   "The legacy port set ipad_identity = true; in format 2 the same identity is the OS profile's [adt] tables, so the board only states its deviations.",
+  "configs/sirius_defconfig keeps the ARM64 profile's CONFIG_XNU_NATIVE_PAN=y: Kryo 360 implements PAN and SCTLR_EL1 leaves SPAN clear, so every exception entry sets PSTATE.PAN, and only the PAN build clears it around copyin/copyout (see the diagnostics area).",
+  "CONFIG_XNU_NATIVE_CS_HASH_CACHE=y is back on: iPadOS signs code in 16 KiB pages, and this 4 KiB kernel accepts the dyld shared cache's signature only through the native 4K hash cache.",
+  "The SystemOS cryptex mount (OWNER_CACHE_MOUNT, OWNER_CACHE_STARTUP, OWNER_UNION_SYSTEMOS) builds in the bring-up mode BRINGUP_OWNER_CACHE, as the uke port does, and its volume is authorized by the boot argument sirius-allow-unverified=1, not by an owner root policy.",
+  "sirius_emmc_hs=3 lets the eMMC driver climb to 25, 50 and 100 MHz, each step proven against blocks read at 400 kHz; the card settles at 50 MHz (HS_TIMING 1).",
+  "The Data volume: OWNER_DATA_MOUNT with SIRIUS_DATA_SEED (NativeEmmc serves the seed instead of RamBlock) and CONFIG_XNU_OWNER_DATA_VOLUME_UUID = EB6CBBA0-ECB9-4556-A483-4B60D54D4306, the volume of the seed that .github/workflows/data-seed.yml built; [payload.adt] owned_memory_size gives the kernel a 1 GiB window to hold the seed. On the phone the window lands below 4 GiB (seed at 0xa3cc1000), the seed is published as the Data window and the kernel mounts its volume (disk3s1, OwnerData) at /private/var before launchd.",
+  "With the Data volume mounted, launchd's mount -P 1 still exits 66: apfs logs 'DT_get_fstab_entries: failed to get filesystem entry at: /filesystems/fstab', and the uke port traced the fatal error to the missing /chosen/boot-manifest-hash. [adt.chosen.bytes] boot-manifest-hash now carries uke's explicit bring-up boot-set identity (SHA-384 of 'UkeBringup.BootSet.v1\\0'), as asteroids does. On the phone mount-phase-1 and mount-phase-2 then pass and launchd reports 'Early boot complete. Continuing system boot.'",
+  "Past early boot the 32 MiB Data volume runs out of space (ENOSPC) and watchdogd traps (brk #1), which panics the boot. kernel_args now pass sheng-disable-watchdogd=1 and sheng-lite=1 to package/BootWatchdogPolicy.c (already linked and called after the Data mount), which disables watchdogd and the network/iCloud/photo daemons through launchd's disabled.plist, and the seed workflow grows the container to size_mib (256 MiB, held in RAM inside the 1 GiB window); the volume UUID stays across the grow. Not yet booted.",
+  "Each seed workflow run formats a new volume, so the 256 MiB seed (run 40621149780, owner-data.cdr 48a10f78...) has UUID E06A21C1-6686-49B8-B242-ED82B00F4AF8, which the defconfig now names; with the seed inside, the payload files take 306 MiB, so [payload] size_mib is 512 (the vendor partition holds 3 GiB).",
+  "Persistent Data configuration: kernel_args now passes sirius-data-write=1 so NativeEmmc publishes the persistent Data container behind the root image in userdata read-write; [payload] size_mib is reset to 256 MiB because the Data container no longer travels in the vendor payload volume; .github/workflows/data-seed.yml default container size is updated to 8192 MiB.",
 ]
 completion = [
   "status --json resolves the ARM64, sdm710, iPadOS and device layers, prints a non-empty patch order and shows the device package as kits/sirius.",
@@ -49,7 +58,8 @@ completion = [
 ]
 limits = [
   "The SoC profile is new: only the GIC, PSCI, counter and the timer INTID are shared, everything else is still board-local.",
-  "No device-verified configuration has been recorded against a commit of this repository yet; the evidence is the legacy port's handoff document.",
+  "The Data seed holds files from the IPSW, so the workflow uploads it encrypted (ARTIFACT_PASSPHRASE) and the payload step takes it from a local path; a new seed has a new volume UUID that the defconfig must follow.",
+  "The 1 GiB window must start below 4 GiB for the eMMC's 32-bit ADMA2; whether this unit's memory map offers one such run is not yet observed.",
 ]
 next_action = [
   "Run status --json and tree against this repository and commit the resulting unixnu.lock.",
@@ -57,6 +67,9 @@ next_action = [
 ]
 evidence = [
   { kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "Hardware values, the boot chain and the bring-up history of the legacy port, from which this configuration is carried over." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261027-pan.log", command = "fastboot flash vendor payload-E-pan-noclear.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420", revision = "b1a11c4f4eb0bfd28b2dd3dfc59b3c7e3a3e742f", result = "With CONFIG_XNU_NATIVE_PAN=y the driver reads PAN as 4194304, all eight CPUs pass the init copyout and launchd's first syscalls return." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261027-fast-emmc.log", command = "fastboot flash vendor payload-H-fast.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 900", revision = "1163990229f446753ef006126e55922aa23bda6a", result = "With the SystemOS mount, the 4K hash cache and sirius_emmc_hs=3 the shared cache is verified in about 104 s at 50 MHz and dyld maps it." },
+  { kind = "host", reference = ".github/workflows/data-seed.yml", command = "gh workflow run data-seed.yml -R HuajiFruit/UniXNU-sirius --ref main", revision = "9562de8b362e6bbae9844052826c609996866aed", result = "Run 40615426205 built owner-data-32.cdr (33554432 bytes, sha256 5679d2cf59eba99aa048be0c0e253581aa5bfb1fdff7ff431ed9e91c2bd58c63) with APFS volume EB6CBBA0-ECB9-4556-A483-4B60D54D4306." },
 ]
 
 [[area]]
@@ -171,7 +184,7 @@ evidence = [
 id = "storage"
 status = "device-verified"
 components = []
-paths = ["docs/HANDOFF.zh-CN.md", "package/sirius_emmc.c", "package/NativeEmmc.cpp", "scripts/derive-storage-bindings.py"]
+paths = ["docs/HANDOFF.zh-CN.md", "package/sirius_emmc.c", "package/NativeEmmc.cpp", "scripts/derive-storage-bindings.py", "scripts/make-data-window-image.py"]
 inputs = [
   "The reference unit is eMMC, not UFS: the UFS transport and its sheng integration points do not apply to this board.",
   "The original kernelcache is the only source of IOStorageFamily's addresses; its kext images carry no symbol table, so they are derived from the dispatch table itself.",
@@ -204,28 +217,47 @@ findings = [
   "The init exec returns 0 and then nothing asks the driver for another block: reads stop at 0x10D (269 requests, 0x98F blocks) while the heartbeat keeps counting, so the wait is past the storage stack. The caller side is now instrumented (sirius-post-exec-trace.patch): the exec thread-switch state, every new user thread start at thread_bootstrap_return, the first pid 1 syscalls with their returns, each bsd_ast for pid 1 and the first user faults after the exec, all written to the same USB ring and summarised by the heartbeat.",
   "The caller-side probe closes that question: the pid 1 thread stays in load_init_program_at_path, inside copyout() of the launchd path, and takes 62.6 million faults in about a minute. The stall is a fault loop in the exec path, not a storage wait.",
   "That fault loop was PAN (see the diagnostics area). With CONFIG_XNU_NATIVE_PAN=y and the driver no longer clearing PAN, all eight CPUs pass the copyout, the exec returns 0 and launchd issues its first syscalls, every one of them returning: 74, 372, 294, 20, 427, 381, 5, 90, 4 and 202. Syscall 294 (shared_region_check_np) returns ENOMEM with 'vm_shared_region_start_address() failed', i.e. dyld finds no shared cache mapped; afterwards the launchd thread waits and the read count stays at 0x113.",
+  "The shared cache is in the SystemOS cryptex. Building the ARM64 series' owner SystemOS mount (OWNER_CACHE_MOUNT, OWNER_CACHE_STARTUP, OWNER_UNION_SYSTEMOS, with BRINGUP_OWNER_CACHE as the uke port has it) and answering its two block hooks from NativeEmmc (sirius-allow-unverified=1) mounts disk4s1 (SystemCryptex, 8846FE78-2910-4297-AF97-D59BB6F8FC16) as a union over / before launchd starts; dyld then opens the cache, fstats it and preads its header.",
+  "Registering the cache's code signature (fcntl, syscall 92) then returned 85 (EBADEXEC): iPadOS signs code in 16 KiB pages, and this 4 KiB kernel only accepts that through native-4k-signature-hash-cache.patch, which the first-console configuration had off. With CONFIG_XNU_NATIVE_CS_HASH_CACHE=y the call returns 0 after the kernel reads the whole cache once, and dyld maps it (197 and 73 return 0).",
+  "The block driver ran at the 400 kHz identification clock all along: sirius_emmc_prepare() reprogrammed it after the probe's 25 MHz switch, and every 512-byte block was its own CMD17 with five ring lines. On this 8-bit bus that is about 770 blocks/s, and the 2.81 GiB cache took two hours. Multi-block reads (CMD18 with Auto-CMD12, 256 blocks per command through an ADMA2 table) and a clock ladder proven against blocks read at 400 kHz bring it to 50 MHz: EXT_CSD reports rev 8, width 2 (8-bit), HS_TIMING 1 and DEVICE_TYPE 0x57, runs pass with EIS 0, and the whole cache is read in about 104 s (27 MiB/s on average, 30 MiB/s peak).",
+  "Past the shared cache launchd runs its boot tasks: mount (pid 3) exits with status 66 (EX_NOINPUT) and the boot panics with 'mount[3] exited'. There is no Data volume yet, which is the mount it needs.",
+  "NativeEmmc serves the Data seed itself instead of RamBlock: the payload's /chosen/memory-map/RAMDisk becomes a read-write RAM window named Data, and the driver answers the two RamBlock entry points kern_exec.c calls once its seed path is compiled in, native_ram_block_volume_seed() (the Data volume on that window) and native_ram_block_gpu_addon() (none on this board; the first link failed on it as an undefined symbol although its declaration is weak). IOMaximumBlockCountRead is 2048 blocks now that transfers run in 256-block commands.",
+  "Once userland read in parallel, APFS reported data hash mismatches on the sealed SystemOS volume (disk6s1). The block driver drains requests on their callers' threads through one shared bounce buffer, and released the transport lock between the read into it and the copy out of it, so a second reader could refill it first and the first request received the other one's blocks. The copy now happens under the lock (the request's memory is wired for the I/O, so it cannot fault back into the driver). Not yet booted.",
+  "native_ram_block_volume_seed() takes the one APFS volume on the RAM window instead of looking the kernel's UUID up, since a Data seed can only be there and every seed build has a new UUID; a differing UUID is reported, not refused, so a new seed no longer needs a new kernel.",
+  "With the copy under the lock, a 256 MiB seed, sheng-disable-watchdogd=1 and sheng-lite=1, the boot runs without a panic for the whole capture (heartbeat at 336 s): no data hash mismatch is reported, the watchdog policy disables watchdogd, early boot completes at 170 s and only liveactivitiesd crashes. The Data volume then fills about a minute after early boot; containermanagerd (first-boot data containers), launchd, analyticsd and APFS itself hit ENOSPC.",
+  "Persistent Data write path and fences: package/sirius_emmc.c implements block writes via CMD24/CMD25 with Auto-CMD12 over ADMA2, polls CMD13 until the card exits programming state with error checking, and issues CMD6 FLUSH_CACHE when EXT_CSD CACHE_CTRL is active. Writes are strictly fenced twice: once to the single window opened by sirius_emmc_set_write_window(), and globally to the userdata partition boundary minus its first MiB (protecting the SHNGROOT manifest).",
+  "Persistent Data container window: package/NativeEmmc.cpp implements prepareDataWindow(), locating the first MiB boundary behind the root image (userdata LBA 35627008) and verifying the NXSB APFS superblock before publishing a read-write eMMC block device when sirius-data-write=1. Writes are drained through the software queue keeping the bounce buffer under the transport lock in both directions, doSynchronizeCache flushes the eMMC write cache, and native_ram_block_volume_seed() resolves the Data volume on whichever window exists.",
+  "scripts/make-data-window-image.py converts the grown 8 GiB APFS Data container into a fastboot sparse image for userdata: a DONT_CARE chunk leaves the root image untouched, RAW chunks write nonzero blocks, and FILL chunks write zero blocks so free space reads as zero on device.",
+  "Persistent Data volume verified on hardware: with sirius-data-write=1 and the 8 GiB container flashed via data-window.simg behind the root image, NativeEmmc opens the write window at LBA 35627008 (16777216 blocks), mounts disk3s1 (OwnerData, 0C28586B-...), early boot completes at 159.6 s, and APFS commits transactions up to xid 85 with 0 ENOSPC errors across the entire capture.",
 ]
 completion = [
   "The eMMC registers, GPT and the SHNGROOT windows are correct; APFS mounts the OS volume, bsd_init completes, init execs /sbin/launchd and execve returns 0.",
 ]
 limits = [
-  "Read-only: the transfer path has no write command and reportWriteProtection() says so.",
-  "After launchd's first syscalls the driver receives no further requests (reads stay at 0x113): dyld finds no shared region and the launchd thread then waits; the probe logs only the first 24 pid 1 syscalls, so the call it waits in is not recorded yet.",
-  "The card clock is still the identification rate (400 kHz, about 550 blocks/s measured); nothing raises it to high speed yet.",
+  "Writes are strictly fenced to the persistent Data window on userdata (LBA 35627008, 8 GiB); the rest of the card remains read-only.",
+  "The card runs at 50 MHz in high-speed SDR on 8 bits (about 30 MiB/s). It supports DDR52 and HS200 (DEVICE_TYPE 0x57), but DDR needs the host's DDR mode and HS200 needs tuning, and neither is implemented; 100 MHz is only tried when the boot chain already left HS200 timing.",
+  "The SystemOS volume is authorized by a bring-up boot argument (sirius-allow-unverified=1), not by an owner root policy.",
   "The exec policy no longer needs a boot argument: the payload carries the original trust-cache bundle and the kernel initialises its runtime at startup. The sirius-skip-cs bypass is kept in the patch series, unused, in case a future image falls outside the bundle.",
 ]
 next_action = [
-  "Verify the 25 MHz switch (sirius_emmc_hs=1) reads the GPT signature back and measure the new block rate; then decide whether the CMD6 high-speed switch to 50 MHz is worth it.",
+  "Display driver: U-Boot leaves a 1080x2240 splash framebuffer at 0x9c000000; bind GopFramebuffer or NativeLegacyDisplay to get screen output past SpringBoard.",
+  "Touch driver: Synaptics S3706 adapter from the fajita reference.",
   "Keep the trust-cache bundle in step with the OS build when the IPSW changes (its sha256 is pinned in board.toml [payload] trust_cache_sha256).",
-  "Find how dyld gets the shared cache: the OS profile's working ports (tb128fu, asteroids) map it after the same exec, so compare their SystemOS cryptex handling with this board's.",
-  "Raise the pid 1 syscall log beyond 24 entries and mirror launchd's stderr writes into the USB ring, so the call launchd waits in and dyld's own message are recorded.",
-  "Raise the SDCC1 clock out of identification speed (GCC root clock plus the card's high-speed mode).",
+  "Raise the pid 1 syscall log beyond 24 entries and mirror launchd's stderr writes into the USB ring, so later boot-task failures name their call and message.",
+  "For more storage speed: DDR52 (8-bit DDR at 52 MHz, no tuning) roughly doubles the rate; HS200 needs the msm tuning sequence.",
 ]
 evidence = [
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261028-pdata.log", command = "fastboot -S 512M flash userdata data-window.simg; fastboot flash vendor payload-M-pdata.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20", revision = "e73a8ecda8998ec36573c5bd2a9d7b6389305b2d", result = "kernel.macho 66d0319c718f6faf894d1d713759b5d82d8da010c3bd2ad2c2c13bd195574a88, payload c0d2e62c0738d6c851eeeebccf0236a310bcd14194df0ea1735efaef647420e6: EMMC write window opened at LBA 35627008 (16777216 blocks, 8 GiB), NativeEmmc discovers NXSB container and mounts persistent Data volume disk3s1 (OwnerData, 0C28586B-...), early boot complete at 159.6 s, APFS transactions commit through xid 85 with 0 ENOSPC errors up to 280 s." },
   { kind = "device", reference = "docs/HANDOFF.zh-CN.md", command = "fastboot flash vendor sirius-obs.img; fastboot reboot; capture-usb-console.py --duration 240", revision = "d867b1d6498dc4d0f4ae4e18060762dcae6c5847", result = "NativeEmmc starts from bsd_init, publishes 0x747BFDF blocks of 512 bytes, and IOStorageFamily reads block 0, block 1 and block 2 with 21 sectors (the 84 GPT entries) through doAsyncReadWrite; the heartbeat keeps ticking with the transfer count fixed at seven, so the boot ends at the root-device wait. Log in docs/HANDOFF.zh-CN.md." },
   { kind = "host", reference = "docs/HANDOFF.zh-CN.md", command = "./scripts/xnu-container.sh run bash -lc './unixnu build kernel --skip-setup -D ../sirius'", revision = "a47f0d6b4615c3cdebf92102400a1bc302eb6d73", result = "The kernel links with NativeEmmc in the image (kernel.macho sha256 372820eb1b2cd9ecee15d769d1296771d0c8141c2681626d54651a62473446b8); the GitHub macOS runner builds the same archive (kernel workflow run 40386710258)." },
   { kind = "device", reference = "docs/HANDOFF.zh-CN.md", command = "fastboot flash vendor sirius-if.img; fastboot reboot; capture-usb-console.py --duration 220", revision = "bb812428dccd1f676455813ad198ed2bee4a8e3e", result = "APFS mounts disk0/disk1s1/disk2s1, bsd_init completes, execve of /sbin/launchd prints activate enter, namei 0, 'exec policy answered 1, skipped by boot arg' and finally 'execve activate 0'; the driver then has no transfer in flight and the read count stops at 0x10D, so the remaining wait is past storage." },
   { kind = "device", reference = "docs/evidence/sirius-usb-console-20261027-pan.log", command = "fastboot flash vendor payload-E-pan-noclear.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420", revision = "b1a11c4f4eb0bfd28b2dd3dfc59b3c7e3a3e742f", result = "kernel.macho 6f0d59b13e4ac3861c902962df8043c3bccac959cffcd859c5f965f697194d17, payload 00c8f4d7feba7982c1fcdcb2f072121d6b7a227fc38ebc0edd229bbd00b5bb08, eight CPUs: PAN reads 4194304, init path copyout 0, execve activate 0, two user thread starts, then launchd syscalls 74 372 294 20 427 381 5 90 4 202 all return; 294 returns 12 with 'vm_shared_region_start_address() failed' and reads stay at 0x113." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261027-systemos.log", command = "fastboot flash vendor payload-F-systemos.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420", revision = "24f6094010c728ecfdf3e3bbacd0effaeec60fb5", result = "kernel.macho 5d045f1a6d6ddad44331a7e6ea8b1cc74a8c84058916287a83603ab912a66038, payload 6b6c562c1e8c91eb2c776fc6ef5f58227fd9eb000872ddb6e2fff6844886515a: NEMMC owner volume /dev/disk4s1, disk4s1 (SystemCryptex, 8846FE78-...) mount-complete before launchd; dyld opens, fstats and preads the cache, then fcntl (92) returns 85." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261027-systemos.log", command = "fastboot flash vendor payload-G-cshash.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 1800", revision = "86fe9ffbc700915e006fce11474b0d277f0d7dc3", result = "kernel.macho a10c51aa4fab72faf86912e1ca6736c0d068432ceff1b233f47948197848b8c4, payload 8402424eb1d9d4126cfe19ab2eb3742aad40d7ba5149267534ae94a7e745c2ce: fcntl (92) no longer fails and stays in the kernel's whole-file hash check, reading about 770 blocks/s (400 kHz on 8 bits) with the pid 1 fault count flat." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261027-fast-emmc.log", command = "fastboot flash vendor payload-H-fast.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 900", revision = "1163990229f446753ef006126e55922aa23bda6a", result = "kernel.macho 3452714ae8b3ef3b775bed9cde5f93c11fc2d147e0375eec22430fb0dcf70999, payload 24118c6275d90fba6dd3e684353d4525640c7d627042092868a413609686f110: ext_csd rev 8 width 2 timing 1 type 0x57, multi=ok eis 0, 25 and 50 MHz ok; 5898655 blocks (2.81 GiB) in about 104 s; fcntl 92, mmap 197 and munmap 73 return 0, then 'mount[3] exited ... exit status 66' panics the boot." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261028-data.log", command = "fastboot flash vendor payload-I-data.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20", revision = "33509e84db86517ff9bf349408dc66ab39c43d18", result = "kernel.macho 2e6e1ddc51b1f8b2d58c607477f81b0327d95f301382d8d4c1180096b402408a, payload 2bd98aa417ab6007b8c95c2071f4907dee5b4afcd09ac3899604e73dc9d21bff: NEMMC data seed at 0xa3cc1000 (33554432 bytes), Data volume disk3s1 (OwnerData, EB6CBBA0-...) mount-complete before launchd, shared cache verified; at 157.7 s mount (pid 3) exits 66 after 'DT_get_fstab_entries: failed to get filesystem entry at: /filesystems/fstab'." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261028-early-boot.log", command = "fastboot flash vendor payload-J-bmh.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20", revision = "09096e3738c618bb18a51af50cdfbc7f6431aa59", result = "kernel.macho 2e6e1ddc51b1f8b2d58c607477f81b0327d95f301382d8d4c1180096b402408a, payload aa917c707d2f0a8f46ae44e635b838e7e3892822c115c0233bdb5bd3e2bae323: launchd runs every boot task through mount-phase-2 and logs 'Early boot complete' at 161.5 s; driverkitd, MobileGestaltHelper, mobileassetd and SpringBoard start; the Data volume reaches ENOSPC at 175.6 s, APFS reports three data hash mismatches on disk6s1, and watchdogd's brk #1 exit panics the boot at 191.9 s." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261028-data256.log", command = "fastboot flash vendor payload-L-data256.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20", revision = "396fdab90dc5b94a830e5a43e5a9084313796683", result = "kernel.macho dd22531c552b5e87208268f3faf793b7acd2516961d45f44e82d3e15b9d86e8c, payload f93d3f9b72b45bb4a4248bd7637e0e8d616472eb28da2d4d5cf479c3574f36b6: seed of 268435456 bytes at 0xa3cc1000, Data volume disk3s1, watchdogd policy applied, early boot complete at 170 s, no hash mismatch, no panic up to 336 s; ENOSPC on disk3s1 from 230 s." },
   { kind = "source", reference = "package/sirius_emmc.c", result = "SDCC1 bring-up, the ADMA2 read path and the GPT parse." },
 ]
 
@@ -489,6 +521,13 @@ findings = [
   "The loop is not limited to the copyout: with the trust-cache bundle back in the payload the exec completes (execve activate 0, AMFI answers nothing) and the exec'd thread enters userland at pc 0x100924e50, where it takes 92 million instruction aborts in about a minute on three addresses (ESR 0x82000007, level-3 translation faults) without ever issuing a syscall or a single block read; the entry point is right, the code pages are simply not visible to the CPU.",
   "Both loops have the same shape: vm_fault opens the page in thread->map's pmap and returns KERN_SUCCESS, while the CPU keeps taking the fault. AT S1E1W and pmap_find_phys disagree about the physical page behind 0x1000, which points at the CPU running with a pmap that is not the thread's after the exec task switch.",
   "A payload built without --trust-cache leaves the ring reporting no external trust caches found and AMFI kills launchd with namespace 9 (OS_REASON_EXEC) code 8; the same kernel with the bundle present reaches execve activate 0 without an exec-policy line, so that panic is a build-argument slip, not a regression.",
+  "The console can be captured on Windows: usbser.sys binds it as a COM port (USB\\VID_1209&PID_0001, serial SIRIUS01) and capture-usb-console.py opens it with plain Win32 calls, because the gadget does not answer SET_LINE_CODING and SetCommState (and pyserial) fail with error 121.",
+  "The ring has no timestamps and is replayed whole on every poke, so capture-usb-console.py --timeline records when each distinct line first arrives; a timed boot shows 51 s from fastboot reboot to the eMMC driver, the shared-cache check until about 168 s and the mount panic at 171.7 s. A hard panic stops the kernel before the heartbeat mirrors its text, so --idle-stop ends a capture after a silence instead.",
+  "NativeEmmc reports the Data seed as 'NEMMC data seed at/bytes' when it publishes the RAM window and 'NEMMC data volume /dev/...' when the owner Data mount asks for it, or 'NEMMC data volume not found on the seed'.",
+  "When the seed's volume UUID differs from CONFIG_XNU_OWNER_DATA_VOLUME_UUID the driver logs 'NEMMC data volume is <seed UUID>, the kernel names <configured UUID>' and mounts it anyway.",
+  "capture-usb-console.py --duration counts from the script's start: counted from the port, which a boot brings up after about a minute, a 280 s capture ran about 5.6 minutes.",
+  "Persistent Data diagnostics: the driver logs 'EMMC write window lba=... blocks=... cache=...' on window configuration, reports EXT_CSD CACHE_CTRL in the probe, logs fallback to single-block writes if a multi-block write command fails, logs 'NEMMC data window lba=... blocks=...' when the persistent container is discovered, logs 'NEMMC data volume (eMMC) ...' or 'NEMMC data volume (RAM) ...' when resolved, and logs 'NEMMC write failed lba ...' on write errors.",
+  "With the persistent 8 GiB Data volume, the entire boot capture runs past early boot (159.6 s) up to 280 s with zero ENOSPC lines (vs 187 on the 256 MiB RAM seed); containermanagerd, launchd, and analyticsd write without running out of disk space; APFS transaction flushes advance through xid 85; SpringBoard (pid 118) and liveactivitiesd (pid 128) crash for want of a display/framebuffer driver.",
 ]
 completion = [
   "Each claimed milestone has a reproducible command, a matching source and image revision and an accessible result.",
@@ -502,6 +541,9 @@ next_action = [
 evidence = [
   { kind = "source", reference = "docs/HANDOFF.zh-CN.md", result = "Entry probe, panic screen, panel rows and the evidence convention of the port." },
   { kind = "device", reference = "docs/evidence/sirius-usb-console-20261026-1605.log", command = "sudo python3 scripts/capture-usb-console.py --wait 60 --duration 190 --output /tmp/boot.log", revision = "366abe2948fdb0c1554f7e0b89b731160f4527a4", result = "3813 bytes of kernel log read from /dev/ttyACM0 over the DWC3 CDC console." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261028-data.log", command = "python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/I-data.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20", revision = "33509e84db86517ff9bf349408dc66ab39c43d18", result = "Captured on Windows (COM7) with --timeline: the Data seed and both owner volumes appear at 52 s after fastboot reboot, the mount panic text at 158.3 s, and the capture stopped on its marker after 5.4 MB." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261028-early-boot.log", command = "python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/J-bmh.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20", revision = "09096e3738c618bb18a51af50cdfbc7f6431aa59", result = "launchd's own [System Event] boot-task lines reach the USB ring, so the timeline shows each task as it starts; the heartbeat mirrored watchdogd's panic text at 191.9 s and the capture stopped on it." },
+  { kind = "device", reference = "docs/evidence/sirius-usb-console-20261028-pdata.log", command = "python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/M-pdata.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20", revision = "e73a8ecda8998ec36573c5bd2a9d7b6389305b2d", result = "Timeline capture of the 8 GiB persistent eMMC Data volume: write window logged at 44.8 s, Data volume disk3s1 (eMMC) mounted at 45.0 s, early boot complete at 159.6 s, tx_flush commits through xid 85, no ENOSPC or panics up to 280 s." },
 ]
 
 [[area]]

docs/devices/alioth.md

@@ -6,7 +6,7 @@
 
 Device template. Complete each area with board-specific inputs and evidence.
 
-Source record: [porting.toml](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/porting.toml), `695a35bd11337a27473a1ef6687977c0527b6878`.
+Source record: [porting.toml](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/porting.toml), `0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d`.
 
 This page is generated from the device record.
 
@@ -14,11 +14,11 @@ This page is generated from the device record.
 | --- | --- |
 | [Configuration](#configuration) | `planned` |
 | [Firmware and boot](#firmware) | `planned` |
-| [CPU and interrupts](#cpu) | `planned` |
+| [CPU and interrupts](#cpu) | `implemented` |
 | [Memory and DMA](#memory) | `planned` |
 | [Storage and root](#storage) | `device-verified` |
 | [Display](#display) | `implemented` |
-| [Input](#input) | `planned` |
+| [Input](#input) | `implemented` |
 | [GPU](#gpu) | `planned` |
 | [Network](#network) | `planned` |
 | [Audio](#audio) | `planned` |
@@ -102,23 +102,25 @@ Collect evidence using the next action.
 
 ## CPU and interrupts {#cpu}
 
-`planned`
+`implemented`
 
 ### Hardware and dependencies
 
-- Identify the cpu and interrupts hardware, resources and existing component interfaces for this board.
+- kona: four Cortex-A55 \(cpu0-3\) and four Cortex-A77 \(cpu4-7\), MPIDR core number in Affinity1 so phys ids are 0x000-0x700. Interrupts and timers come from the ArmCpu component; secondary start is PSCI CPU\_ON over smc.
 
 ### Configuration
 
-- Record the board.toml fields, DTS properties and defconfig values used for cpu and interrupts.
+- board.toml: sheng-smp=1 starts secondary CPUs, armcpu-spi-ipi=1 routes IPIs through software-pended SPIs, armcpu-self-ipi=1 makes each core signal itself so XNU enables its IPI \(a component argument, not one of the documented boot arguments\), armcpu-diagnostics=1 reports the bring-up. dts: unixnu,cluster-type E on cpu0-3 and P on cpu4-7.
 
 ### Procedure
 
-- Follow the cpu and interrupts stage in the porting guide and record the actual commands.
+- Apply both SoC patches \(native-smp-secondary, native-smp-type-clusters\) through the SoC repository's patch series, then build kernel, payload and boot image and boot over USB. Verify in the build tree that MAX\_CPUS is 8 in the BCM2837 block, MAX\_CPU\_CLUSTERS is 2 and \_\_ARM\_AMP\_\_ survives the later \#undef.
 
 ### Development findings
 
-- Collect the first cpu and interrupts observation, its cause when established, and the resulting implementation decision.
+- Without native-smp-secondary.patch the reset vector masks MPIDR with 0xFF, which is Aff0 and is zero for every kona core, so every secondary core picked the boot CPU's cpu\_data and reset handler. The boot either panicked with Invalid kernel stack pointer or hard-locked with interrupts off in early initialisation.
+- unixnu,cluster-type must never ship without native-smp-type-clusters.patch. With MAX\_CPU\_CLUSTERS still 1 the topology parser takes phys\_cluster\_id = \(cluster\_type == P\), which is 1, and writes cluster\_phys\_to\_logical\[1\] past the end of a one-element stack array. Release builds do not assert: the kernel dies before the console comes up. scripts/check-smp-topology.py refuses that combination.
+- Both patches are private to UniXNU-pipa, not present in UniXNU/UniXNU. They live in the SM8250 SoC repository because the topology they describe is a property of the SoC, which is why the pins differ from the SM8550 device's.
 
 ### Completion criteria
 
@@ -126,15 +128,16 @@ Collect evidence using the next action.
 
 ### Current limits
 
-- Hardware inputs and implementation are pending for this example board.
+- Secondary CPUs have not been brought up on hardware yet. The two patches are applied only in the build feed checkout, not yet committed to FFT-infra/UniXNU-sm8250-common, so a fetch or tree refresh loses them.
+- unixnu,cluster-type is still declared in the board DTS rather than the SoC DTSI.
 
 ### Next action
 
-- Inventory the required cpu and interrupts inputs before implementation.
+- Boot the image carrying both patches and read SMP run count, armcpu\_smp\_step, psci\_rc and the boot time.
 
 ### Evidence
 
-Collect evidence using the next action.
+- `source`: [Refuses a device tree that declares cluster-type without the cluster patch applied and MAX\_CPU\_CLUSTERS >= 2, the combination that killed three boots silently.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/scripts/check-smp-topology.py)
 
 ## Memory and DMA {#memory}
 
@@ -216,7 +219,7 @@ Components: `ShengUfs`, `VerifiedRoot`, `VirtioMmioBlock`, `RamBlock`.
 
 ### Evidence
 
-- `device`: [The kernel reports cryptexd aborting with mkdirat ENOSPC while the Data volume reports 31 MiB free, which places the failing write on a mount other than /private/var.](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/docs/evidence/2026-10-27-boot-diagnostics.md)
+- `device`: [The kernel reports cryptexd aborting with mkdirat ENOSPC while the Data volume reports 31 MiB free, which places the failing write on a mount other than /private/var.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/docs/evidence/2026-10-27-boot-diagnostics.md)
   Command: <code>read /dev/tty.usbmodem&lt;N&gt; at 115200 8N1 and collect EXITLOG records</code>. Revision: `24d127c47217eb580dbe3f3a94c32ad25cbaae00`.
 
 ## Display {#display}
@@ -259,28 +262,32 @@ Components: `GopFramebuffer`.
 
 ### Evidence
 
-- `device`: [DISPLAY stage=10 with CLIENT calls=4 class=IOMobileFramebufferUserClient, and SWAP calls=0: a client connects but no frame is submitted.](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/docs/evidence/2026-10-27-boot-diagnostics.md)
+- `device`: [DISPLAY stage=10 with CLIENT calls=4 class=IOMobileFramebufferUserClient, and SWAP calls=0: a client connects but no frame is submitted.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/docs/evidence/2026-10-27-boot-diagnostics.md)
   Command: <code>read the diagnostic page and the USB console after booting the image</code>. Revision: `24d127c47217eb580dbe3f3a94c32ad25cbaae00`.
 
 ## Input {#input}
 
-`planned`
+`implemented`
+
+Components: `QcomGeniSpi`, `ShengHidInput`, `ShengNovatekTouch`.
 
 ### Hardware and dependencies
 
-- Identify the input hardware, resources and existing component interfaces for this board.
+- FocalTech FT5652 on GENI SE4 \(QUPv3 wrapper 0\), per alioth-sm8250.dtsi: spi-max-frequency 6000000, interrupts &lt;39 0x2008&gt;, reset GPIO 33, irq GPIO 39, vdd L10C, vcc\_i2c L1C, display-coords 0 0 8640 19200, max-touch-number 10.
 
 ### Configuration
 
-- Record the board.toml fields, DTS properties and defconfig values used for input.
+- board.toml: native-touch=1 starts kits/alioth-touch, sheng-touch-hid=1 enables the publication path in ShengHidInput, native-touch-diag=1 is a measurement-only round and must be removed for release images. SPI clock is the device tree's 6 MHz; the source is TCXO 19.2 MHz on DFS level 0.
 
 ### Procedure
 
-- Follow the input stage in the porting guide and record the actual commands.
+- Build with component ShengHidInput selected and the board display recipe, which invokes build-sheng-hid-input.py and archives NativeHidInput.late.o plus hid-original-bindings.o into the force-loaded libNativeLegacyDisplay.late.a. Then build payload and boot image, verify the payload carries the built kernel, and boot over USB.
 
 ### Development findings
 
-- Collect the first input observation, its cause when established, and the resulting implementation decision.
+- The part answers register reads \(ID 0x5652\) and returns a CRC-correct all-0xFF buffer while it has no report; an earlier version of FocalTouchProtocol.c treated that buffer as a successful empty frame, which is why every image reported frames=valid with contacts=0.
+- Frame reads gated on GPIO 39 going low produced real contacts: at t=100 s two contacts, low count 284, raw 0002805f4598; the part's interrupt counter 0x8F rose from 01 to e0 and its work counter 0x91 advances 60 per second, so the sensor, the SPI link, the CRC and the interrupt line are all working.
+- The HID publisher was never in the kernel: ShengHidInput compiles NativeHidInput.cpp but nothing archived it, and an object with no inbound reference is dropped from a plain archive. Selected as a component and archived by the display recipe, as UniXNU-sheng does, it links.
 
 ### Completion criteria
 
@@ -288,15 +295,16 @@ Components: `GopFramebuffer`.
 
 ### Current limits
 
-- Hardware inputs and implementation are pending for this example board.
+- No HID report has reached the OS yet: native\_touch\_hid\_reports stays 0 while contacts arrive, so the remaining work is the publication path, not the sensor.
+- Buttons are not implemented on this board.
 
 ### Next action
 
-- Inventory the required input inputs before implementation.
+- Boot the image that carries the archived HID objects and confirm native\_touch\_hid\_reports rises and the UI responds to a swipe.
 
 ### Evidence
 
-Collect evidence using the next action.
+- `source`: [Frame parsing treats an all-0xFF payload as no data, decodes 15-bit coordinates with the low bits in the pressure byte, and records the CRC it compared so 'passed' is visible rather than inferred.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/kits/alioth-touch/FocalTouchProtocol.c)
 
 ## GPU {#gpu}
 
@@ -500,6 +508,7 @@ Components: `QcomXnuUsbDebug`.
 - ./unixnu build kernel, then build payload and bootimg, then fastboot flash boot\_b.
 - Read the console at /dev/tty.usbmodem&lt;N&gt; with a raw 115200 8N1 tty; the dock's SN234567892 node is not the phone.
 - Control frames are SXNU1 &lt;16 hex session&gt; &lt;8 hex seq&gt; &lt;VERB&gt; &lt;8 hex crc32&gt;, HELLO first to learn the session.
+- One unattended round is scripts/run-sheng-unattended.sh &lt;image&gt; \[timeout\]: fastboot boot the image, wait for the board's own return, boot the reader from slot a, read and decode into build/sheng-logs/&lt;tag&gt;-&lt;boot id&gt;/, then restore the slot. Fail-closed, and the timeout must exceed sheng-autoreset by 60 s.
 
 ### Development findings
 
@@ -509,6 +518,10 @@ Components: `QcomXnuUsbDebug`.
 - printf and kprintf both fail to reach the console: a DEVELOPMENT kernel leaves disable\_kprintf\_output true without -enable\_kprintf\_spam, and printf's console path did not reach the \_cnputs tee either. qcom\_usb\_debug\_write\(\) is the entry point that works.
 - Exit records measured over 420 s: 180 xpcproxy exits with status=0 \(normal fork and exit\), 13 cryptexd SIGABRT with ns=18 code=2 \(OS\_REASON\_LIBSYSTEM\_CODE\_FAULT\), 11 liveactivitiesd SIGTRAP, 2 lsd SIGSEGV. Each process crashes at one fixed PC repeated, so the fault is deterministic rather than a race.
 - A software REBOOT via the control channel is acknowledged \(state=queued\) but does not reach fastboot: the worker calls reboot\_kernel\(0, NULL\), an orderly restart that unmounts every filesystem and returns through UEFI. Entering fastboot needs the ABL IMEM handshake, whose address is not measured here.
+- The persistent log writer runs: boot-usb101 recorded 273 rounds over 546 s with zero write errors after the console had already stopped, so the medium is the only record past the link's death.
+- Returning to fastboot works with sheng-log=1 and sheng-autoreset=&lt;seconds&gt; together: boot-usb102 rebooted at 153 s and boot-usb103 at 120 s, both landing in the board's own bootloader with the PON spare cell written \('pon: subtype 04 shift 1 spare 00 -&gt; 04 want 04 rc=0 ok pon\_rc=0'\) and IMEM reading the reason back \(known=1\). PSCI alone cannot do it: SYSTEM\_RESET, SYSTEM\_RESET2\(32\) and SYSTEM\_RESET2\(64\) all report NOT\_SUPPORTED, so PS\_HOLD is the path that works.
+- The reader must seek relative to the partition: /dev/block/by-name/userdata starts at LBA 0x2a8000, so the window's last 8192 blocks are skip=59086843, not the absolute LBA 61872123 the header records. Passing the absolute value reads nothing at all and looks like a hung read.
+- The console's death is a latch, not a transient: dwc3\_poll\(\) returns -1 forever once d-&gt;failed is set \(Dwc3.c:570/581/584\), and nothing in the driver clears it, so the worker's retry path cannot revive the link.
 
 ### Completion criteria
 
@@ -523,14 +536,15 @@ Components: `QcomXnuUsbDebug`.
 
 ### Next action
 
+- Make the console survive its first error: clear d-&gt;failed and re-initialise the controller from the worker, with backoff, and draw the worker's retry and error counters on the diagnostic page so the failure is readable without the link it is about.
 - Attribute cryptexd's fault, then decide whether the fix is a stub, a mount change, or accepting the crash.
 - Wait for the MAC refusal to reproduce and read the ip\_mac\_return value it now prints.
 
 ### Evidence
 
-- `device`: [Console enumerated as 1209:316d named QcomXnuUsbDebug; STATUS returned usb=3 er=0 with the worker polling, so the port is live in both directions.](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/docs/evidence/2026-10-27-boot-diagnostics.md)
+- `device`: [Console enumerated as 1209:316d named QcomXnuUsbDebug; STATUS returned usb=3 er=0 with the worker polling, so the port is live in both directions.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/docs/evidence/2026-10-27-boot-diagnostics.md)
   Command: <code>read /dev/tty.usbmodem&lt;N&gt; at 115200 8N1 and send SXNU1 ... HELLO / STATUS</code>. Revision: `15a15d7cc526262a64531ff56b3a33bdbc46379c`.
-- `device`: [215 exit records captured. 180 xpcproxy status=0 \(normal\), 13 cryptexd ns=18 code=2, 11 liveactivitiesd sig5, 2 lsd sig11; each process repeats one fixed crash PC, so the faults are deterministic.](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/docs/evidence/2026-10-27-serial-exit-records.log)
+- `device`: [215 exit records captured. 180 xpcproxy status=0 \(normal\), 13 cryptexd ns=18 code=2, 11 liveactivitiesd sig5, 2 lsd sig11; each process repeats one fixed crash PC, so the faults are deterministic.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/docs/evidence/2026-10-27-serial-exit-records.log)
   Command: <code>./unixnu build kernel; ./unixnu bootimg; fastboot flash boot_b; read the CDC-ACM console for 420 s</code>. Revision: `15a15d7cc526262a64531ff56b3a33bdbc46379c`.
 
 </div>

docs/devices/amethyst-bluedmc-amethyst.md

@@ -1,5 +1,5 @@
-# Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\)
+# Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\) \(IOS4Amethyst\)
 
-[BluedMC-Amethyst/UniXNU-amethyst](https://github.com/BluedMC-Amethyst/UniXNU-amethyst)
+[IOS4Amethyst/UniXNU-amethyst](https://github.com/IOS4Amethyst/UniXNU-amethyst)
 
 Complete and validate [porting.toml](/porting/records) in the device repository to publish its subsystem record.

docs/devices/asteroids.md

@@ -6,7 +6,7 @@
 
 Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UFS userdata partition, with shared SM7635 support and board-owned storage, GPU, input and power integration. Bring-up runs as numbered staged tests; their results are in docs/asteroids-gpu-gen8.md and docs/asteroids-touch.md of rootstockos/iosonandng.
 
-Source record: [porting.toml](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/porting.toml), `2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b`.
+Source record: [porting.toml](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/porting.toml), `bd618af4eb9377dafaa512a07c2991c8e2469444`.
 
 This page is generated from the device record.
 
@@ -22,7 +22,7 @@ This page is generated from the device record.
 | [GPU](#gpu) | `implemented` |
 | [clock](#clock) | `device-verified` |
 | [Network](#network) | `planned` |
-| [Audio](#audio) | `planned` |
+| [Audio](#audio) | `implemented` |
 | [Power](#power) | `implemented` |
 | [Image assembly](#packaging) | `implemented` |
 | [Diagnostics](#diagnostics) | `implemented` |
@@ -71,7 +71,7 @@ Components: `ArmDTPlatform`, `XnuPrelink`.
 
 ### Evidence
 
-- `source`: [Format 2 board configuration with the SM7635 SoC and 21H461 OS profiles.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `source`: [Format 2 board configuration with the SM7635 SoC and 21H461 OS profiles.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
 
 ## Firmware and boot {#firmware}
 
@@ -111,7 +111,7 @@ Components: `DarwinBoot`.
 
 ### Evidence
 
-- `source`: [\[bootimg\] and \[firmware\] select uefi-asteroids and the payload in the kernel image.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `source`: [\[bootimg\] and \[firmware\] select uefi-asteroids and the payload in the kernel image.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
 
 ## CPU and interrupts {#cpu}
 
@@ -152,7 +152,7 @@ Components: `ArmCpu`.
 
 ### Evidence
 
-- `source`: [EPSS CPU governor with touch boost and frame floor.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/CpuFreqProbe.cpp)
+- `source`: [EPSS CPU governor with touch boost and frame floor.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/CpuFreqProbe.cpp)
 
 ## Memory and DMA {#memory}
 
@@ -189,7 +189,7 @@ Components: `ArmCpu`.
 
 ### Evidence
 
-- `source`: [Memory node for the XNU window's DRAM bank.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/dts/asteroids.dts)
+- `source`: [Memory node for the XNU window's DRAM bank.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/dts/asteroids.dts)
 
 ## Storage and root {#storage}
 
@@ -229,7 +229,7 @@ Components: `ShengUfs`, `RamBlock`, `SoftwareAES`, `VirtioMmioBlock`, `VerifiedR
 
 ### Evidence
 
-- `device`: [T29 booted iPadOS 17.7.11 from the UFS root with persistent Data to the first picture.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `device`: [T29 booted iPadOS 17.7.11 from the UFS root with persistent Data to the first picture.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
   Command: <code>fastboot boot local/unixnu-asteroids-t29-boot.img</code>. Revision: `adf900cf453a6b318864913757f588c9f661596f`.
 
 ## Display {#display}
@@ -257,6 +257,7 @@ Components: `GopFramebuffer`.
 - The CPU copy \(143-285 ms a frame\) mapped the surfaces cacheable without invalidation and showed stale patches; the GPU copy removes both.
 - GopFramebuffer 33e941a's direct scanout needs ShengUfs's display SMMU window \(native\_ufs\_dpu\_map\); our NativeUfs fork has none, so package/LegacyDisplayStubs.c supplies weak zero stand-ins that keep it off.
 - T40c \(2026-10-27\): BootProgress.c's cpu0\_park defaults off \(see cpu\).
+- T40k-T42 \(2026-10-27\): zero copy on the 3a. NativeUfs sheng-dpu-linux=1 sets the display bank up as Linux does: CBA2R and CBAR written \(the apps SMMU is qcom,virt-smmu and the hypervisor attaches the bank on that write\), TCR2 with the ASID size and SEP, cached inner-shareable walks with T0SZ 28, TTBR0 with an ASID. The bank then took stage 1 without a fault \(T40k\), where every earlier setup faulted at level 0, even with blocks lacking the access flag \(T40i-af\). T41: 1018 direct flips, 4.4 ms mean latch, once startDirect waited for the bank \(40 ms\); frames showed half drawn \(the wallpaper without the app\), so T42 flips only once the GPU's completed fence reaches the newest fence submitted at the swap.
 
 ### Completion criteria
 
@@ -272,7 +273,7 @@ Components: `GopFramebuffer`.
 
 ### Evidence
 
-- `device`: [T34b: GPU copy to the panel, no tearing or stale patches, stable.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `device`: [T34b: GPU copy to the panel, no tearing or stale patches, stable.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
   Command: <code>fastboot boot local/unixnu-asteroids-t34b-boot.img</code>. Revision: `e022e84a9721ea6408ea12665b5a23e9b89fc5f6`.
 
 ## Input {#input}
@@ -313,7 +314,7 @@ Components: `ShengHidInput`, `ShengNovatekTouch`, `QcomGeniSpi`.
 
 ### Evidence
 
-- `device`: [Touch input works on the desktop \(stage 6\).](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/AsteroidsTouchProbe.cpp)
+- `device`: [Touch input works on the desktop \(stage 6\).](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/AsteroidsTouchProbe.cpp)
   Command: <code>fastboot boot local/unixnu-asteroids-t34b-boot.img</code>. Revision: `e022e84a9721ea6408ea12665b5a23e9b89fc5f6`.
 
 ## GPU {#gpu}
@@ -358,7 +359,7 @@ Components: `Adreno740`, `AdrenoFirmware`, `AdrenoPM4`, `ArmSmmu4K`, `Sm7635Plat
 
 ### Evidence
 
-- `device`: [GPU compositing and the GPU panel copy run stable.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/GpuPowerProbe.cpp)
+- `device`: [GPU compositing and the GPU panel copy run stable.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/GpuPowerProbe.cpp)
   Command: <code>fastboot boot local/unixnu-asteroids-t34b-boot.img</code>. Revision: `e022e84a9721ea6408ea12665b5a23e9b89fc5f6`.
 
 ## clock {#clock}
@@ -399,7 +400,7 @@ Components: `QcomPmicRtc`.
 
 ### Evidence
 
-- `device`: [T39e: the time set in Settings survived a restart; Settings &gt; Date &amp; Time opens.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `device`: [T39e: the time set in Settings survived a restart; Settings &gt; Date &amp; Time opens.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
   Command: <code>fastboot boot local/unixnu-asteroids-t39e-boot.img</code>. Revision: `e4d1092cc3d051617ee88858b153ed2ba0d456fd`.
 
 ## Network {#network}
@@ -440,24 +441,35 @@ Collect evidence using the next action.
 
 ## Audio {#audio}
 
-`planned`
+`implemented`
 
 ### Hardware and dependencies
 
-- The audio DSP and its firmware; sheng's ADSP, GLINK and QRTR stack is the reference.
+- The audio DSP and its firmware; sheng's ADSP, GLINK, QRTR, GPR and AudioReach stack is the reference.
+- The 3a's amplifier settings container \(vendor/firmware/tfa98xx.cnt, proprietary-files.txt\), turned into build/asteroids-tfa/AsteroidsTfaConfig.h by scripts/prepare-asteroids-tfa.py.
 
 ### Configuration
 
-- None yet.
+- sheng-audio takes bits \(sheng-adsp=2 is required, the default\): any nonzero value serves the audio service, 2 plays a 1.5 s 750 Hz test tone at boot, 8 runs the lock sound test.
+- sheng-audio-pa moves the DSP period buffer \(default 0xe6200000, the splash region's tail\); sheng-audio-tone-ms and sheng-audio-atten set the tone.
+- asteroids-audio-i2s = interface \| data lines &lt;&lt; 8 \| bits &lt;&lt; 16 \(default primary MI2S, SD1, 32-bit: the amplifiers take their data on gpio17\); asteroids-audio-prm bits \(default 3\): 1 LPASS core vote, 2 MI2S bit clock request.
+- asteroids-mic=&lt;stage&gt; \(default 0, with sheng-audio\) brings up the WCD9378 microphone path in stages: 1 rails \(ldob7, ldob8\) and codec reset \(gpio162\), 2 PRM votes and VA/TX core clocks, 3 LPI SoundWire pins and VA/TX macro clocks, 4 VA SoundWire master \(0x33b0000, v1.7\) and enumeration, 5 codec init \(SCP setup, io\_init, SDCA class load\), 6 capture path \(ports, micbias 1, SmartMIC0 sequencer, TX decimator 0\), 7 DSP capture graphs and a 2 s capture test, 8 capture for the plug-in. asteroids-mic-port = sample interval \| offset1 &lt;&lt; 8 \| lane &lt;&lt; 16 \(default 1 \| 1 &lt;&lt; 8\). asteroids-mic-mux=1 switches the VA macro to its own core clock \(0x3420000 = 1\) as the vendor clock manager does \(default off\).
+- The GPU addon carries sheng's audio server plug-in as audio/ShengAudio.driver \(scripts/build-asteroids-metal-plugin.py builds it with scripts/build-sheng-audio-hal.py unless --no-audio, and adds its CDHash to the owner trust module\); patches/xnu/zzyd-board-audio-addon-mount.patch mounts audio/ over /System/Library/Audio/Plug-Ins/HAL.
 
 ### Procedure
 
-- Boot the ADSP from its firmware partition as sheng does.
+- Read the \[audio\] and \[amps\] rows: stage, DSP status, amplifiers found \(amps=3: both\), clocks stable \(lock=\), errors, SMMU result, I2C engine, PRM results \(bus= second word\), I2C failures.
+- Run scripts/check-audioreach-host.py after changing the graph commands.
 
 ### Development findings
 
-- No audio path yet.
 - T38 ports sheng's audio DSP bring-up \(AdspProbe.cpp, sheng-adsp=1 survey, 2 start\) with the 3a's IPCC \(0x405000\), carveouts \(0x99300000, 0x99280000\) and crash-reason partition; the firmware comes from modem\_a \(LUN 4\) through NativeUfs's native\_ufs\_part\_find/read \(rootstockos/NativeUfs efa8271, from UniXNU's ShengUfs\).
+- T41: speakers are two NXP TFA9873 \(P 0x34 slot 0, S 0x35 slot 1\) on QUPv3 wrapper 1 SE6 \(SE13, 0x898000, gpio59/60\), reset gpio141/142 \(active high\), fed by primary MI2S \(gpio15-18, function 2\) as two 32-bit slots at 48 kHz. The container carries no amplifier firmware \(a dummy patch\), only bitfield settings.
+- T41: the microphone is AMIC1 of a WCD9378 \(mixer\_paths handset-mic: ADC1, MIC BIAS1 by the card routing, ADC\_LP, volume 6\) on the VA macro's SoundWire master; the handset mic back end is CODEC\_DMA-LPAIF\_RXTX-TX-3 as on sheng. The codec register recipe is the July 2026 LKML WCD9378 TX driver \(v2, paged SDCA registers, built-in power sequencers\); the master is v1.7 \(apps command FIFO at 0x31c\).
+- T41: package/AsteroidsAudioProbe.cpp is sheng's AudioProbe.cpp with the 3a's board steps and the TFA9873 programs \(AsteroidsTfa9873.c\) in place of the CS35L43's; the speaker device runs 32-bit while the stream stays 16-bit \(the playback converter widens it\). The amplifiers power up after the graphs start, since they wait for the bit clock. No microphone path.
+- T40k \(2026-10-27\): the speaker path ran end to end \(DSP graphs, the service, the plug-in, a 48 kHz stream without gaps; both TFA9873 rev B found, clocks and PLL locked\) but was silent: on I2S0 SD0 the amplifiers got the clocks and no data. T40k-spk-sd1 \(asteroids-audio-i2s=0x200200\) played the boot tone and iOS sound through both speakers: the amplifiers take their data on SD1 \(gpio17\), the default since T41.
+- T41: TFA9873 STATUS0 bits 1, 2 and 4 \(DCOCPOK, OTDS, UVDS\) are ok flags in NXP's field list, not alarms; \[audio\] err= counts real alarms only \(OCDS, MANALARM, NOCLK, TDMERR or a missing ok flag\).
+- T41, T41-mux: mic stage 4 fails. The rails are voted, the PRM grants the macro and codec votes and the VA/TX core clocks, the LPI pins and macro clocks are set \(VA SWR\_CONTROL 1\) and the master \(v1.7\) keeps its settings, but COMP\_STATUS never shows the link up, no interrupt fires and no device attaches. With asteroids-mic-mux=1 \(the VA clock source switch\) the master's registers read back 0, so the switch stays off. T42 adds \[mic extra\]: the codec reset pin read back, COMP\_STATUS over time and, with asteroids-mic-pmic=1, the codec's LDOs from the PMIC.
 
 ### Completion criteria
 
@@ -465,15 +477,19 @@ Collect evidence using the next action.
 
 ### Current limits
 
-- No audio.
+- The microphone does not work yet: stage 4 \(SoundWire enumeration\) fails, so the plug-in's input stream stays silent.
+- The master's port timing is not taken from the vendor driver \(not in the published tree\): asteroids-mic-port tunes it.
 
 ### Next action
 
-- Port the ADSP start after the battery work.
+- Boot T42 with asteroids-mic=4 and asteroids-mic-pmic=1 and read \[mic extra\]: whether the codec's LDOs are on and its reset is released tells whether stage 4 waits on the codec's power or on the bus.
 
 ### Evidence
 
-Collect evidence using the next action.
+- `host`: [PASS: 207 AudioReach packet checks, including the 3a's primary MI2S port and the 32-bit speaker device format.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/scripts/check-audioreach-host.py)
+  Command: <code>python3 scripts/check-audioreach-host.py</code>. Revision: `b1621b32a2513ba8e2c4c599d4f4baf602a7369a`.
+- `device`: [T40k-spk-sd1: the boot tone and iOS sounds played through both speakers; \[amps\] showed the boost converters active and \[audio-io\] 8.3 M frames without gaps in 494 s.](https://github.com/rootstockos/UniXNU-asteroids/commit/b1621b32a2513ba8e2c4c599d4f4baf602a7369a)
+  Command: <code>fastboot boot with boot args sheng-audio=3 asteroids-audio-i2s=0x200200 sheng-audio-tone-ms=4000</code>. Revision: `49ec1ccb18fd6b7ddd23b25b2c4ae96cd084ad1a`.
 
 ## Power {#power}
 
@@ -512,7 +528,7 @@ Components: `AppleKeyStoreState`.
 
 ### Evidence
 
-- `device`: [T29: with the stand-in, SpringBoard boots to the first picture.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/KeyStoreProbe.cpp)
+- `device`: [T29: with the stand-in, SpringBoard boots to the first picture.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/KeyStoreProbe.cpp)
   Command: <code>fastboot boot local/unixnu-asteroids-t29-boot.img</code>. Revision: `adf900cf453a6b318864913757f588c9f661596f`.
 
 ## Image assembly {#packaging}
@@ -549,7 +565,7 @@ Components: `AppleKeyStoreState`.
 
 ### Evidence
 
-- `source`: [Board patch series after the arch, SoC and OS series.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/patches/xnu/series)
+- `source`: [Board patch series after the arch, SoC and OS series.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/patches/xnu/series)
 
 ## Diagnostics {#diagnostics}
 
@@ -586,6 +602,6 @@ Components: `AppleKeyStoreState`.
 
 ### Evidence
 
-- `source`: [Live page and banner rows.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/BootProgress.c)
+- `source`: [Live page and banner rows.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/BootProgress.c)
 
 </div>

docs/devices/fuxi-mouse233.md

@@ -6,7 +6,7 @@
 
 Xiaomi 13 \(fuxi\). XNU for iPad7,1 iPadOS 17.7.11 boots from RAM: a UEFI USB bulk receiver takes the payload into DRAM, the UniXNU menu starts DarwinBoot, and XNU switches its root from the RAM block device to the APFS system volume.
 
-Source record: [porting.toml](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/porting.toml), `b8fc5d3af5d25b8b2b13059aaa90181b8299bcea`.
+Source record: [porting.toml](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/porting.toml), `0e24b939f906b898cfe009fb7ec962cefd896ce9`.
 
 This page is generated from the device record.
 
@@ -80,7 +80,7 @@ Components: `ArmDTPlatform`.
 
 ### Evidence
 
-- `source`: [Parses with schema\_version = 2 and keeps the format 1 tables \(ipsw, userdata, kernel, firmware, payload\), so the board's own scripts and the pre-format-2 driver keep working.](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/board.toml)
+- `source`: [Parses with schema\_version = 2 and keeps the format 1 tables \(ipsw, userdata, kernel, firmware, payload\), so the board's own scripts and the pre-format-2 driver keep working.](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/board.toml)
 - `source`: [Recorded source pins for xnu and edk2 that the candidate builds resolve.](https://github.com/mouse233/unixnu-fuxi/blob/d67e18aec56a21b2e2e81f647b8444f3222ec53d/unixnu.lock)
 - `host`: [Exits 0 with the board resolved to fuxi and every driver and kit listed at base.](https://github.com/mouse233/unixnu-fuxi/commit/e5a7d450c159ae662e7d5785eef19d1ba4cb5fec)
   Command: <code>./unixnu status -D ../UniXNU-fuxi</code>. Revision: `e5a7d450c159ae662e7d5785eef19d1ba4cb5fec`.
@@ -226,7 +226,7 @@ Components: `ArmSmmu4K`, `RamBlock`.
 
 - `device`: [Records the SID 60 0 to 1 transition and the final SCTLR=0, CBAR=10000, CBA2R=1, GFSR=0 and FSR=400 snapshot for the M1 native UFS receiver run.](https://github.com/mouse233/unixnu-fuxi/blob/9644d94e6bb050e4bde5f50f94312dd10cd3f416/diagnostics/ram-root/usb-bulk.md)
   Command: <code>python3 scripts/test-usb-ram-full.py --expected-sha256 &lt;image-sha&gt; --output out/&lt;candidate&gt;/attempt-NN</code>. Revision: `9644d94e6bb050e4bde5f50f94312dd10cd3f416`.
-- `source`: [The probe that reports context bank state is in the device package and builds with the receiver image.](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/package/ArmSmmu4KProbe.c)
+- `source`: [The probe that reports context bank state is in the device package and builds with the receiver image.](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/package/ArmSmmu4KProbe.c)
 
 ## Storage and root {#storage}
 
@@ -559,7 +559,7 @@ Components: `XnuPrelink`, `SoftwareAES`.
 
 - `host`: [Delivered image v47 hashes recorded above, with eighteen checks at run\_id 20261025T074819.554188Z exiting 0 and bound to that image and source.](https://github.com/mouse233/unixnu-fuxi/blob/283834986151e0911a88ffcb3d5fe8531558f8a7/diagnostics/ram-root/README.md)
   Command: <code>PYTHONDONTWRITEBYTECODE=1 python3 scripts/check-fuxi-usb-ram-image.py --uefi ../uefi-fuxi --output out/usb-system-mount-v47 &amp;&amp; PYTHONDONTWRITEBYTECODE=1 python3 scripts/check-usb-ram.py --uefi ../uefi-fuxi --report out/usb-system-mount-v47/host-tests.json</code>. Revision: `283834986151e0911a88ffcb3d5fe8531558f8a7`.
-- `source`: [The packaging entry that writes the tagged payload volume used by the firmware boot entry.](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/scripts/package-sheng-xnu-boot.py)
+- `source`: [The packaging entry that writes the tagged payload volume used by the firmware boot entry.](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/scripts/package-sheng-xnu-boot.py)
 
 ## Diagnostics {#diagnostics}
 
@@ -615,7 +615,7 @@ Components: `ShengPreflight`.
   Command: <code>python3 scripts/test-usb-ram-full.py --boot-profile usb-system --expected-sha256 &lt;image-sha&gt; --output out/&lt;candidate&gt;/attempt-NN</code>. Revision: `9644d94e6bb050e4bde5f50f94312dd10cd3f416`.
 - `host`: [Linux host checks run in the WSL workspace with real exit codes recorded for the rebuild.](https://github.com/mouse233/unixnu-fuxi/blob/0e9eb2196efc5974feed2817e6f56e080e6c68be/diagnostics/ram-root/wsl-linux-rebuild.md)
   Command: <code>PYTHONDONTWRITEBYTECODE=1 python3 scripts/check-usb-smmu-audit.py --uefi ../uefi-fuxi --report out/&lt;candidate&gt;/smmu-tests.json</code>. Revision: `0e9eb2196efc5974feed2817e6f56e080e6c68be`.
-- `source`: [Component and source pins recorded for the RAM root path are committed on the default branch.](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/diagnostics/ram-root/pins.json)
+- `source`: [Component and source pins recorded for the RAM root path are committed on the default branch.](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/diagnostics/ram-root/pins.json)
 - `device`: [Three receiver runs with one fastboot boot each, plus the V-E read-only failure snapshot, are recorded with host sampling counts and readings transcribed from device photographs. The photo files are not committed to this repository.](https://github.com/mouse233/unixnu-fuxi/blob/1d071dae4618b0676d313cfbe1fc39689e6f139e/diagnostics/ram-root/usb-bulk.md)
   Command: <code>fastboot boot m1-ab-ep0snapshot-v6; python3 scripts/boot-ram-window-once.py</code>. Revision: `1d071dae4618b0676d313cfbe1fc39689e6f139e`.
 

docs/devices/index.md

@@ -13,7 +13,7 @@ Follow [Build and boot](/building), [porting steps](/porting/steps) and [log cap
 | [Xiaomi Redmi K40 \(alioth, M2012K11AC\) \(songchiyu\)](/devices/alioth-songchiyu) | SM8250 | 2 | Record pending | [songchiyu/UniXNU-alioth](https://github.com/songchiyu/UniXNU-alioth) |
 | [Xiaomi Redmi K40 \(alioth, M2012K11AC\) \(yang232138\)](/devices/alioth-yang232138) | SM8250 | 2 | Record pending | [yang232138/UniXNU-alioth](https://github.com/yang232138/UniXNU-alioth) |
 | [Redmi Note 14 Pro+ 5G \(amethyst\)](/devices/amethyst) | SM7635 | 2 | Record pending | [andr0d1v/UniXNU-amethyst](https://github.com/andr0d1v/UniXNU-amethyst) |
-| [Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\)](/devices/amethyst-bluedmc-amethyst) | SM7635 | 2 | Record pending | [BluedMC-Amethyst/UniXNU-amethyst](https://github.com/BluedMC-Amethyst/UniXNU-amethyst) |
+| [Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\) \(IOS4Amethyst\)](/devices/amethyst-bluedmc-amethyst) | SM7635 | 2 | Record pending | [IOS4Amethyst/UniXNU-amethyst](https://github.com/IOS4Amethyst/UniXNU-amethyst) |
 | [Nothing Phone \(3a\) \(asteroids\)](/devices/asteroids) | SM7635 | 2 | Porting record | [rootstockos/UniXNU-asteroids](https://github.com/rootstockos/UniXNU-asteroids) |
 | [BBK/EEBBK A2, X2 and X2P tablet \(ums512\_1h190, Unisoc T610 / UMS512 SharkL5Pro\)](/devices/bbk-a2) | UMS512 | 2 | Record pending | [woshimaniubi8/unixnu-eebbk-a2_x2-ums512](https://github.com/woshimaniubi8/unixnu-eebbk-a2_x2-ums512) |
 | [Brave Ark tablet \(braveark\)](/devices/braveark) | SM8635 | 1 | Device notes | [tattwamashi/UniXNU-braveark](https://github.com/tattwamashi/UniXNU-braveark) |
@@ -108,6 +108,7 @@ Follow [Build and boot](/building), [porting steps](/porting/steps) and [log cap
 | [Xiaomi 17 Pro \(pandora\)](/devices/pandora) | SM8850 | 1 | Device notes | [ShueiTsuki/data-a-live](https://github.com/ShueiTsuki/data-a-live) |
 | [Sony Xperia 1 II \(pdx203\)](/devices/pdx203) | SM8250 | 1 | Device notes | [chardidathing/UniXNU-pdx203](https://github.com/chardidathing/UniXNU-pdx203) |
 | [Redmi Turbo 3 / Poco F6 \(peridot\)](/devices/peridot) | SM8635 | 1 | Device notes | [kvfsrl/UniXNU-peridot](https://github.com/kvfsrl/UniXNU-peridot) |
+| [Xiaomi Poco F6 / Redmi Turbo 3 \(hoshikv\)](/devices/peridot-hoshikv) | SM8635 | 1 | Repository link | [hoshikv/UniXNU-peridot](https://github.com/hoshikv/UniXNU-peridot) |
 | [Poco F6 / Redmi Turbo 3 \(wzy114514sb\)](/devices/peridot-wzy114514sb) | SM8635 | 2 | Record pending | [wzy114514sb/UniXNU-peridot](https://github.com/wzy114514sb/UniXNU-peridot) |
 | [OPPO Find X7 Ultra \(PHY120\)](/devices/phy120) | SM8650 | 1 | Device notes | [peiyuesheng666/UniXNU-PHY120](https://github.com/peiyuesheng666/UniXNU-PHY120) |
 | [Xiaomi Pad 8 Pro \(piano\)](/devices/piano) | SM8750 | 1 | Device notes | [code002-2/UniXNU-piano](https://github.com/code002-2/UniXNU-piano) |
@@ -120,7 +121,8 @@ Follow [Build and boot](/building), [porting steps](/porting/steps) and [log cap
 | [Xiaomi Pad 6 \(xVanTuring\)](/devices/pipa-xvanturing) | SM8250 | 1 | Repository link | [xVanTuring/UniXNU-pipa](https://github.com/xVanTuring/UniXNU-pipa) |
 | [Xiaomi Mi MIX 2S \(polaris\)](/devices/polaris) | SDM845 | 1 | Device notes | [luuu20309/UniXNU-polaris](https://github.com/luuu20309/UniXNU-polaris) |
 | [Xiaomi Mi MIX 2S \(PuszekReksio\)](/devices/polaris-puszekreksio) | SDM845 | 1 | Repository link | [PuszekReksio/UniXNU-judyln](https://github.com/PuszekReksio/UniXNU-judyln) |
-| [Nothing Phone \(2\) \(pong\)](/devices/pong) | SM8475 | 1 | Device notes | [Chengdong-Yu/UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong) |
+| [Nothing Phone \(2\) \(pong\)](/devices/pong) | SM8475 | 2 | Porting record | [Chengdong-Yu/UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong) |
+| [Nothing Phone \(2\): UniXNU UEFI bring-up \(hxzbaka\)](/devices/pong-hxzbaka) | SM8475 | 1 | Repository link | [hxzbaka/UniXNU-pong](https://github.com/hxzbaka/UniXNU-pong) |
 | [Nothing Phone \(2\): UniXNU UEFI bring-up \(Y3d4\)](/devices/pong-y3d4) | SM8475 | 1 | Repository link | [Y3d4/UniXNU-pong-clean](https://github.com/Y3d4/UniXNU-pong-clean) |
 | [Galaxy Z Fold3 \(q2q\)](/devices/q2q) | SM8350 | 1 | Device notes | [agcarbajo/UniXNU-q2q](https://github.com/agcarbajo/UniXNU-q2q) |
 | [QEMU virt](/devices/qemu) | QEMU virt | 1 | Device notes | [xVanTuring/UniXNU-qemu](https://github.com/xVanTuring/UniXNU-qemu) |

docs/devices/oneplus13t.md

@@ -6,7 +6,7 @@
 
 OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, CPU reg=8 online=8 T=ff I=ff, RAM 4096 MiB; Clutch single-pset, read-only UFS root; cross-core stress and long-term stability unqualified.
 
-Source record: [porting.toml](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/porting.toml), `e1436a2dd4c231f4c5184b6851a2c1192e56b012`.
+Source record: [porting.toml](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/porting.toml), `cdd273d72a1e3a08f118e1fb69b39ed18c3bc929`.
 
 This page is generated from the device record.
 
@@ -96,70 +96,72 @@ Components: `PaganiArmDTPlatform`, `NativeAES`, `NativeKeyStoreEvents`.
 
 ### Evidence
 
-- `device`: [Build-63 user feedback confirms system startup and normal touch with CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096. This is tied to the recorded image and exact build-source pins; no runtime code or configuration changed after the test.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The device feed and lock pin SoC b79d675, and upstream.rev pins main b962645 with the matching Sm8750Platform catalog revision. Local profile resolution found 18 selected components; a clean remote fetch remains for cloud CI.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/feeds.toml)
+  Command: <code>./unixnu status -D ../UniXNU-Pagani_SM8750 --local-module soc:sm8750=../UniXNU-sm8750-common</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [Build-63 user feedback confirms system startup and normal touch with CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096. This is tied to the recorded image and exact build-source pins; no runtime code or configuration changed after the test.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The matching build-63 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.791s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The matching build-63 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.791s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [Build 63 passed all cloud contracts, original/compiled ABI checks and full kernel link/prelink in 17m00s. Device 3c39baf, main 52560be, drivers 14f50fc and SoC 37ccfbe match the downloaded inputs. No new device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `source`: [The display-timeout candidate pins drivers 14f50fc and main 52560be. The full patch chain, 18 component contracts, eight-affinity ADT, actual reset/resume assembly and Clutch single-pset regression pass locally. The touch implementation and 4 GiB window are retained. Full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The matching build-62 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.671s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The display-timeout candidate pins drivers 14f50fc and main 52560be. The full patch chain, 18 component contracts, eight-affinity ADT, actual reset/resume assembly and Clutch single-pset regression pass locally. The touch implementation and 4 GiB window are retained. Full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The matching build-62 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.671s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 passed all cloud contracts, original/compiled ABI checks and full kernel link/prelink in 21m29s. Device c87bced, main d967069, drivers 3ba7f19 and SoC 37ccfbe match the downloaded inputs. The macOS fixture correction passes; no new device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 61 stopped before kernel compilation because the new host fixture redefined the macOS SDK \_\_unused macro under -Werror. The test now keeps an existing system definition with \#ifndef; the actual single-pset kernel correction is unchanged. A fresh full build is required.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505475023)
   Command: <code>Actions build 61 configuration contracts; inspect failed log</code>. Revision: `0922d28d807f5c4f2cba2d361136c482240cfd50`.
-- `source`: [The candidate pins SoC 37ccfbe and main d967069 for the Clutch single-pset policy. All eight CPU affinities, two hardware clusters and the 4 GiB owned window are retained. The selected-source regression reproduces the old double lock and passes the correction. The full patch chain, 18 component contracts, eight-core ADT, actual reset/resume assembly and nine kernel-source checks pass; full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The build-60 image passed local assembly/readback and fastboot accepted the user-authorized temporary launch in 2.659s without flashing. Runtime behavior and the new CPU panic trace await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The candidate pins SoC 37ccfbe and main d967069 for the Clutch single-pset policy. All eight CPU affinities, two hardware clusters and the 4 GiB owned window are retained. The selected-source regression reproduces the old double lock and passes the correction. The full patch chain, 18 component contracts, eight-core ADT, actual reset/resume assembly and nine kernel-source checks pass; full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The build-60 image passed local assembly/readback and fastboot accepted the user-authorized temporary launch in 2.659s without flashing. Runtime behavior and the new CPU panic trace await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 passed all cloud contracts, nine source-kernel regressions, production object/ABI checks and full kernel link/prelink in 11m49s. The exact device faa6aa2, main 13cc99b, drivers 3ba7f19 and SoC 76fb502 inputs are downloaded and verified. No build-60 image or device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `source`: [Build-59 user feedback confirms a scheduler ticket-lock panic on MPIDR affinity 0x200 after the accepted temporary boot. The next device-only diagnostic patch retains the eight-core policy and adds lock identity plus a bounded call trace; full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The matching build-59 boot image passed local assembly/readback, including eight actual ADT CPU affinities and all SMP arguments. Fastboot accepted the user-authorized temporary launch in 2.680s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Build-59 user feedback confirms a scheduler ticket-lock panic on MPIDR affinity 0x200 after the accepted temporary boot. The next device-only diagnostic patch retains the eight-core policy and adds lock identity plus a bounded call trace; full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The matching build-59 boot image passed local assembly/readback, including eight actual ADT CPU affinities and all SMP arguments. Fastboot accepted the user-authorized temporary launch in 2.680s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 passed all host contracts, actual reset/resume assembly checks, production object/ABI checks and full kernel link/prelink in 21m38s. Source pins are device 859dbce, main 13cc99b, drivers 3ba7f19 and SoC 76fb502. The kernel and paired inputs are downloaded and locally verified; no new boot image or device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Build 58 failed during bootstrap start.s assembly because HAS\_CLUSTER exposed Apple-only CPU\_OVRD accesses. The corrected SoC profile sets NO\_CPU\_OVRD=1. A regression compiling actual reset/resume assembly with the selected board header reproduces the old failure and passes after the fix; the full patch chain and 18 component/ADT contracts pass. Full recompilation and eight-core hardware validation remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 58 failed during bootstrap start.s assembly because HAS\_CLUSTER exposed Apple-only CPU\_OVRD accesses. The corrected SoC profile sets NO\_CPU\_OVRD=1. A regression compiling actual reset/resume assembly with the selected board header reproduces the old failure and passes after the fix; the full patch chain and 18 component/ADT contracts pass. Full recompilation and eight-core hardware validation remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py with actual ARM64 reset/resume assembly</code>. Revision: `19e9b8114df32c45b0b36fc32c187db24bf521c6`.
-- `source`: [The next candidate selects eight SM8750 CPU affinities and the platform status overlay, disables the touch overlay and retains the 4 GiB owned window. The full patch chain, 18 component contracts, actual XNU topology lookup, 21 ARM64 assembly blocks, eight kernel-source checks and console/peripheral regressions pass locally. Cloud compilation and device validation are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [After the build-57 temporary boot, the user confirmed that touch is working. Basic touch response is now device-observed for source ad6ed2d and the recorded build-57 image; detailed gesture and stability qualification remains incomplete.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The next candidate selects eight SM8750 CPU affinities and the platform status overlay, disables the touch overlay and retains the 4 GiB owned window. The full patch chain, 18 component contracts, actual XNU topology lookup, 21 ARM64 assembly blocks, eight kernel-source checks and console/peripheral regressions pass locally. Cloud compilation and device validation are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [After the build-57 temporary boot, the user confirmed that touch is working. Basic touch response is now device-observed for source ad6ed2d and the recorded build-57 image; detailed gesture and stability qualification remains incomplete.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-57 fastboot boot; user confirmed touch is working</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `host`: [After the user connected fastboot, the matching build-57 image passed assembly and readback. Fastboot Sending and Booting returned OKAY in 2.706s without flashing. System startup and touch behavior await hardware feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [After the user connected fastboot, the matching build-57 image passed assembly and readback. Fastboot Sending and Booting returned OKAY in 2.706s without flashing. System startup and touch behavior await hardware feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 passed all 18 component contracts, host regressions, original/compiled ABI checks and full kernel link/prelink in 17m11s. Source pins are device ad6ed2d, main 5ae8fe4, drivers 6038f39 and SoC a06a072. The kernel and paired inputs are downloaded and locally verified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [The next candidate pins drivers 6038f39 and main 5ae8fe4, with a standalone 13/4 touch descriptor, product-scoped event-driver matching and qualified 21H461 event dispatch. Host regressions and original ABI checks pass; full compilation and download are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build-56 hardware feedback confirms a valid S3910 identification header and successful kernel HID submissions \(r=0, observed n=430\), with a nonzero contact mask on press and zero on release. Lock-screen swipes and tapping Cancel in the power menu remain unresponsive. UI touch is not qualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The next candidate pins drivers 6038f39 and main 5ae8fe4, with a standalone 13/4 touch descriptor, product-scoped event-driver matching and qualified 21H461 event dispatch. Host regressions and original ABI checks pass; full compilation and download are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build-56 hardware feedback confirms a valid S3910 identification header and successful kernel HID submissions \(r=0, observed n=430\), with a nonzero contact mask on press and zero on release. Lock-screen swipes and tapping Cancel in the power menu remain unresponsive. UI touch is not qualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [After the user connected fastboot, the matching build-56 image passed local assembly and readback. Sending and Booting returned OKAY for fastboot boot, with no partition flash. Runtime touch/power feedback is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [After the user connected fastboot, the matching build-56 image passed local assembly and readback. Sending and Booting returned OKAY for fastboot boot, with no partition flash. Runtime touch/power feedback is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 passed all 18 component contracts, regressions, original/compiled ABI checks and full kernel link/prelink in 20m13s. Source pins: device 3a12121, main ca164eb, drivers cab2d4d, SoC a06a072. The kernel and paired inputs are downloaded and locally verified; no image assembly or device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [The next touch candidate adds board-owned RPMh resource names/voltages and SPI delays, with shared checked controller operations. Actual-adapter, power fault, transport and overlay regressions pass. Build 56 passed full cloud compilation and downloaded-artifact checks; this round ended without a device boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [A read-only Android 16 baseline on the local 6.6.118 kernel confirms enabled 1.8 V/3.1 V touch rails and retained SPI logs with valid a5 frames. The OnePlus driver uses cs\_clk\_delay=50 and inter\_words\_delay=0; this port does not explicitly program SE\_SPI\_DELAY\_COUNTERS. No runtime code or build-55 image changed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The next touch candidate adds board-owned RPMh resource names/voltages and SPI delays, with shared checked controller operations. Actual-adapter, power fault, transport and overlay regressions pass. Build 56 passed full cloud compilation and downloaded-artifact checks; this round ended without a device boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [A read-only Android 16 baseline on the local 6.6.118 kernel confirms enabled 1.8 V/3.1 V touch rails and retained SPI logs with valid a5 frames. The OnePlus driver uses cs\_clk\_delay=50 and inter\_words\_delay=0; this port does not explicitly program SE\_SPI\_DELAY\_COUNTERS. No runtime code or build-55 image changed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Read-only ADB root capture of Android regulator, GPIO, clock and existing SPI IPC logs; compare OnePlus touch and GENI source</code>. Revision: `bdeec6693f1b8488a3286446f0b93c13c02d6785`.
-- `device`: [Build-55 hardware feedback confirms a completed four-byte SE DMA read with TX/RX length-in 4 and idle GENI state, but all RX bytes are zero. Touch still fails with -71 before HID startup. The next investigation compares stock Android power and SPI state.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build-55 hardware feedback confirms a completed four-byte SE DMA read with TX/RX length-in 4 and idle GENI state, but all RX bytes are zero. Touch still fails with -71 before HID startup. The next investigation compares stock Android power and SPI state.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-55 temporary boot; user transcribed TOUCH and both SPI rows, then confirmed return code b9</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 55 passed all 18 component contracts, regressions, original/compiled ABI checks, full compilation/link/prelink and matching image readback. Source pins: device 664530f, main b689e9a, drivers 339d4df, SoC b6706a5. Fastboot accepted the temporary boot; first-read diagnostic values and touch behavior await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40437346840)
   Command: <code>Actions build 55; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 54 passed all component contracts, regressions, full compilation/link/prelink and image readback. Source pins: device fba1472, main 1397e2d, drivers 26a32f5, SoC b6706a5. Fastboot accepted the temporary boot; hardware DMA/touch feedback is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `host`: [Build 53 passed all 18 component contracts, full C/C++ compilation, early-console runtime checks, kernel link/prelink and matching image readback. Sending and Booting returned OKAY; SPI snapshot observations are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 passed all 18 component contracts, full C/C++ compilation, early-console runtime checks, kernel link/prelink and matching image readback. Sending and Booting returned OKAY; SPI snapshot observations are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 51 passed all 18 component contracts, full C/C++ compilation, kernel link/prelink and matching image readback. Sending and Booting returned OKAY; touch behavior awaits observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 passed all 18 component contracts, full C/C++ compilation, kernel link/prelink and matching image readback. Sending and Booting returned OKAY; touch behavior awaits observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 50 passed all 18 component contracts, full kernel compilation/link/prelink, matching image assembly and actual payload readback. Sending and Booting returned OKAY; system UI and peripheral behavior await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 passed all 18 component contracts, full kernel compilation/link/prelink, matching image assembly and actual payload readback. Sending and Booting returned OKAY; system UI and peripheral behavior await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py; test-stage6.py; ./unixnu kernel -j 3; ./unixnu payload; ./unixnu bootimg; FAT readback</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
 - `host`: [All 18 selected components resolved at their pinned revisions; archive ordering, ADT checks, full kernel link and prelink passed. Downloaded kernel and report agree at 127778816 bytes; hardware remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
   Command: <code>test-format2.py; ./unixnu status --json; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [Four layers, 15 pinned components, complete archive order and matching required ADT properties passed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-format2.py; ./unixnu status --json</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## Firmware and boot {#firmware}
 
@@ -214,44 +216,44 @@ Components: `PaganiDarwinBoot`.
 
 ### Evidence
 
-- `device`: [The user-confirmed build-63 system startup verifies the existing embedded-payload boot route with the recorded unchanged 3 MiB UEFI and matching payload. The standard initrd route was not separately exercised and no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user-confirmed build-63 system startup verifies the existing embedded-payload boot route with the recorded unchanged 3 MiB UEFI and matching payload. The standard initrd route was not separately exercised and no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-63 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB FAT containing the matching kernel, trust cache and RAM Data. Readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-63 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB FAT containing the matching kernel, trust cache and RAM Data. Readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-62 Android v4 image embeds the unchanged 3 MiB UEFI plus a 160 MiB FAT with the matching kernel, trust cache and RAM Data. Readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-62 Android v4 image embeds the unchanged 3 MiB UEFI plus a 160 MiB FAT with the matching kernel, trust cache and RAM Data. Readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The build-60 Android v4 image embeds the unchanged 3 MiB UEFI plus 160 MiB payload containing the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-60 Android v4 image embeds the unchanged 3 MiB UEFI plus 160 MiB payload containing the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `host`: [The build-59 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB payload with the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-59 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB payload with the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [The build-57 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB FAT with the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted the temporary boot; no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-57 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB FAT with the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted the temporary boot; no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 is downloaded with matching inputs; no boot image was assembled, no firmware changed and no device boot or flash was performed. The existing build-56 boot configuration is preserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [The HID candidate retains build-56 GENI firmware, SE DMA, touch power and SPI timing. No firmware change, image assembly or device boot is part of this build round.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build 56 reaches valid TouchComm v1 identification and parsed touch reports through retained GENI microcode and SE DMA. The first header is a5 10 1c 00 and the captured SPI delay register is 0xc800; no firmware image or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The HID candidate retains build-56 GENI firmware, SE DMA, touch power and SPI timing. No firmware change, image assembly or device boot is part of this build round.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build 56 reaches valid TouchComm v1 identification and parsed touch reports through retained GENI microcode and SE DMA. The first header is a5 10 1c 00 and the captured SPI delay register is 0xc800; no firmware image or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [The build-56 Android v4 image embeds the unchanged UEFI and a 160 MiB payload containing the matching kernel, trust cache and RAM Data. Local readback passed; fastboot accepted the user-authorized temporary boot without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-56 Android v4 image embeds the unchanged UEFI and a 160 MiB payload containing the matching kernel, trust cache and RAM Data. Local readback passed; fastboot accepted the user-authorized temporary boot without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 is downloaded with its matching inputs. Firmware and the build-55 boot image remain unchanged; no build-56 boot image, temporary boot or flash was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [Android command DB confirms ldob4 at 0x40800 and ldob16 at 0x41900. The candidate now explicitly enables those touch rails through apps DRV-2 before reset, while retaining GENI microcode. The firmware image is unchanged; no flash or temporary boot is authorized in this build round.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Android regulator state reports pm\_humu\_l4 enabled at 1.8 V for spi0.0-vdd and pm\_humu\_l16 enabled at 3.1 V for spi0.0-vcc. This is a software power-state baseline, not a physical voltage measurement or evidence that the rails remain enabled under XNU. The read-only capture used the existing debugfs mount and changed no firmware or device configuration.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Android command DB confirms ldob4 at 0x40800 and ldob16 at 0x41900. The candidate now explicitly enables those touch rails through apps DRV-2 before reset, while retaining GENI microcode. The firmware image is unchanged; no flash or temporary boot is authorized in this build round.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Android regulator state reports pm\_humu\_l4 enabled at 1.8 V for spi0.0-vdd and pm\_humu\_l16 enabled at 3.1 V for spi0.0-vcc. This is a software power-state baseline, not a physical voltage measurement or evidence that the rails remain enabled under XNU. The read-only capture used the existing debugfs mount and changed no firmware or device configuration.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Read-only ADB root capture of Android regulator, GPIO, clock and existing SPI IPC logs; compare OnePlus touch and GENI source</code>. Revision: `bdeec6693f1b8488a3286446f0b93c13c02d6785`.
 - `host`: [Build 55 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. Actual kernel, trust cache and volatile Data match this build. Sending and Booting returned OKAY without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40437346840)
   Command: <code>Actions build 55; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 54 reused the unchanged UEFI and passed complete embedded-payload readback. The same-build kernel, trust cache and RAM Data were temporarily booted without flashing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `host`: [Build 53 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. The verified image was temporarily booted without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. The verified image was temporarily booted without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 51 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. The verified image was temporarily booted without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. The verified image was temporarily booted without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 50 reused the unchanged UEFI and passed Android v4, empty ramdisk, embedded FD/FAT and stock DTB packaging checks. fastboot boot returned OKAY without flashing a partition; this is not a runtime qualification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 reused the unchanged UEFI and passed Android v4, empty ramdisk, embedded FD/FAT and stock DTB packaging checks. fastboot boot returned OKAY without flashing a partition; this is not a runtime qualification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `host`: [AARCH64 DEBUG package and 3145728-byte FD built locally, including UniXNURamDiskDxe and the retained embedded payload path; hardware boot remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/MIGRATION.md)
+- `host`: [AARCH64 DEBUG package and 3145728-byte FD built locally, including UniXNURamDiskDxe and the retained embedded payload path; hardware boot remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/MIGRATION.md)
   Command: <code>./unixnu build package; ./unixnu firmware</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## CPU and interrupts {#cpu}
 
@@ -304,36 +306,38 @@ Components: `PaganiArmCpu`.
 
 ### Evidence
 
-- `device`: [The user reported CPU reg=8 online=8 T=ff I=ff after the build-63 temporary boot. All eight CPUs are registered and online, and every per-core timer and SGI/IPI counter is nonzero. IPI coverage may include the enabled self-test; cross-core stress, sustained interrupt progress, CPU frequency control and long-term stability remain unqualified. Clutch still uses one pset.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The resource-only DTS candidate retains all eight CPU affinities in ADT and the verified build-63 kernel. This boot confirmed system UI and touch, but supplied no new CPU counters or directed cross-core stress result.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>Android/FAT/ADT readback of stage7-gpu-resources/boot.img</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [The user reported CPU reg=8 online=8 T=ff I=ff after the build-63 temporary boot. All eight CPUs are registered and online, and every per-core timer and SGI/IPI counter is nonzero. IPI coverage may include the enabled self-test; cross-core stress, sustained interrupt progress, CPU frequency control and long-term stability remain unqualified. Clutch still uses one pset.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The actual build-63 image retains eight CPU affinities, both hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the binary-verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-63 image retains eight CPU affinities, both hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the binary-verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [The actual build-63 Clutch table retains multiple\_psets\_enabled=0 and the expected steal callbacks. All eight affinities and SMP arguments remain selected. Online counts and runtime stability are still unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `device`: [Build-62 user feedback reports a display slot-345 panic, not the preceding scheduler ticket-lock trace. No registered/online or timer/IPI values were supplied, so all-eight-core operation and scheduler stability remain unqualified. The single-pset policy is retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build-62 user feedback reports a display slot-345 panic, not the preceding scheduler ticket-lock trace. No registered/online or timer/IPI values were supplied, so all-eight-core operation and scheduler stability remain unqualified. The single-pset policy is retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>User-reported build-62 panic photograph and confirmed slot/caller</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The actual build-62 image retains all eight CPU affinities, two hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-62 image retains all eight CPU affinities, two hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [The actual build-62 Clutch dispatch table has multiple\_psets\_enabled=0, compared with 1 in build 60, with both steal callbacks still matching their symbols. The existing pset\_create gate shares the boot pset across all eight CPUs while retaining both hardware clusters. Selected-source regression and full compilation pass; eight-core online counts, interrupt coverage and runtime stability remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `source`: [Build-60 hardware trace has CPU 2, ctid=owner=f1d34, tickets=b0ae0144 and thread\_select+0x84c reacquiring pset0 after Clutch steal. The selected callback returns without unlocking; two hardware clusters had enabled two psets and exposed that stub. The SoC correction disables Clutch multiple\_psets\_enabled, using the existing pset\_create gate to share pset0 across all eight CPUs while preserving real hardware cluster IDs. The selected-source regression reproduces the old failure and passes this policy; hardware validation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The actual build-60 image retains all eight affinities, PSCI SMC, remote GICR and self-IPI policy and includes the new ticket-lock call trace. Fastboot accepted the temporary launch; no new CPU counts, interrupt coverage or panic backtrace have been observed yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Build-60 hardware trace has CPU 2, ctid=owner=f1d34, tickets=b0ae0144 and thread\_select+0x84c reacquiring pset0 after Clutch steal. The selected callback returns without unlocking; two hardware clusters had enabled two psets and exposed that stub. The SoC correction disables Clutch multiple\_psets\_enabled, using the existing pset\_create gate to share pset0 across all eight CPUs while preserving real hardware cluster IDs. The selected-source regression reproduces the old failure and passes this policy; hardware validation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The actual build-60 image retains all eight affinities, PSCI SMC, remote GICR and self-IPI policy and includes the new ticket-lock call trace. Fastboot accepted the temporary launch; no new CPU counts, interrupt coverage or panic backtrace have been observed yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 compiles the preserved ticket ownership assertion with logical CPU, compact current/owner IDs, ticket state and eight bounded return addresses. It retains the build-59 eight-core startup policy. The scheduler panic remains unresolved until a new hardware trace identifies the caller.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [The build-59 photograph reports a ticket ownership assertion at lock\_ticket.c:143 on MPIDR 0x80000200. The matching kernel resolves the lock to pset0+0x100 \(sched\_lock\). The root cause is unresolved; eight online CPUs and sustained timer/IPI operation are not qualified. The next panic records compact IDs, ticket state and up to eight return addresses without changing lock checks.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The build-59 photograph reports a ticket ownership assertion at lock\_ticket.c:143 on MPIDR 0x80000200. The matching kernel resolves the lock to pset0+0x100 \(sched\_lock\). The root cause is unresolved; eight online CPUs and sustained timer/IPI operation are not qualified. The next panic records compact IDs, ticket state and up to eight return addresses without changing lock checks.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [The actual build-59 image contains all eight captured affinities, PSCI SMC and the requested SMP/GIC/self-IPI arguments. Fastboot Sending and Booting succeeded; processor counts and timer/IPI masks have not yet been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-59 image contains all eight captured affinities, PSCI SMC and the requested SMP/GIC/self-IPI arguments. Fastboot Sending and Booting succeeded; processor counts and timer/IPI masks have not yet been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 compiles and links all eight-affinity support with NO\_CPU\_OVRD=1 and the secondary-vector correction. Downloaded boot policy, source pins and CPU status strings match. Eight online CPUs, per-core timer/IPI coverage and sustained UI use remain unverified on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Build 58 failed during bootstrap start.s assembly because HAS\_CLUSTER exposed Apple-only CPU\_OVRD accesses. The corrected SoC profile sets NO\_CPU\_OVRD=1. A regression compiling actual reset/resume assembly with the selected board header reproduces the old failure and passes after the fix; the full patch chain and 18 component/ADT contracts pass. Full recompilation and eight-core hardware validation remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 58 failed during bootstrap start.s assembly because HAS\_CLUSTER exposed Apple-only CPU\_OVRD accesses. The corrected SoC profile sets NO\_CPU\_OVRD=1. A regression compiling actual reset/resume assembly with the selected board header reproduces the old failure and passes after the fix; the full patch chain and 18 component/ADT contracts pass. Full recompilation and eight-core hardware validation remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py with actual ARM64 reset/resume assembly</code>. Revision: `19e9b8114df32c45b0b36fc32c187db24bf521c6`.
-- `source`: [The candidate enables all eight captured affinities with PSCI SMC, Aff1 core/Aff2 cluster mapping, eight CPU/two cluster capacity and full-affinity reset/lookup checks. Secondary CPUs install normal XNU exception vectors after MMU setup. Shared counters are atomic; remote redistributor preparation and self IPI are enabled. Host topology and console tests are required; eight-core timer/IPI operation remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The candidate enables all eight captured affinities with PSCI SMC, Aff1 core/Aff2 cluster mapping, eight CPU/two cluster capacity and full-affinity reset/lookup checks. Secondary CPUs install normal XNU exception vectors after MMU setup. Shared counters are atomic; remote redistributor preparation and self IPI are enabled. Host topology and console tests are required; eight-core timer/IPI operation remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 - `host`: [Eight source-kernel regressions and production ARM64 assembly checks passed; the enabled CPU0 code linked successfully. IRQ/IPI behavior was not tested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-kernel-source.py; test-stage6.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## Memory and DMA {#memory}
 
@@ -382,29 +386,31 @@ Components: `Sm8750Platform`.
 
 ### Evidence
 
-- `device`: [The user reported RAM MiB=4096 free=24 avail=2368; free and available values change dynamically. This confirms the current 4 GiB XNU window, not full use of the reported 12 GB physical RAM or any larger UEFI allocation. The free-page snapshot alone does not establish memory pressure.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The GPU resource DTS nodes remain disabled and are omitted from ADT. The image retains the eight CPU affinities, 4 GiB owned window, root volume and matching RAM Data; no larger allocation or new DMA mapping was tested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>Android/FAT/ADT readback of stage7-gpu-resources/boot.img</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [The user reported RAM MiB=4096 free=24 avail=2368; free and available values change dynamically. This confirms the current 4 GiB XNU window, not full use of the reported 12 GB physical RAM or any larger UEFI allocation. The free-page snapshot alone does not establish memory pressure.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The actual build-63 ADT requests 4 GiB and its packed RAM Data matches UUID 1726EAC0-2168-4118-AFD6-19E12FE306E7. Same-build payload checks pass. Temporary launch was accepted; live RAM counters and larger allocations remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-63 ADT requests 4 GiB and its packed RAM Data matches UUID 1726EAC0-2168-4118-AFD6-19E12FE306E7. Same-build payload checks pass. Temporary launch was accepted; live RAM counters and larger allocations remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The actual build-62 ADT requests 4 GiB. Its packed RAM Data matches UUID 9E72E6D9-AC74-428E-A275-E8A25FD3264C and all same-build payload checks. The temporary launch was accepted; live RAM/free/available counters and any larger allocation remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-62 ADT requests 4 GiB. Its packed RAM Data matches UUID 9E72E6D9-AC74-428E-A275-E8A25FD3264C and all same-build payload checks. The temporary launch was accepted; live RAM/free/available counters and any larger allocation remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 retains the 4 GiB owned window and a verified matching volatile RAM Data image. No larger UEFI allocation or live memory measurement was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The actual build-60 ADT requests 4 GiB and its packed RAM Data matches UUID E81D6D67-C2F6-4CAC-9FF9-100EDFF76900. Temporary launch was accepted; live memory readings and larger allocations remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-60 ADT requests 4 GiB and its packed RAM Data matches UUID E81D6D67-C2F6-4CAC-9FF9-100EDFF76900. Temporary launch was accepted; live memory readings and larger allocations remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 retains the 4 GiB owned window and matching volatile RAM Data. No larger allocation or live memory measurement was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [Build 59 panicked before live RAM/free/available readings were obtained. The owned window remains 4 GiB while CPU diagnosis continues; no larger window has been tested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 59 panicked before live RAM/free/available readings were obtained. The owned window remains 4 GiB while CPU diagnosis continues; no larger window has been tested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [The actual build-59 ADT requests 4 GiB. Packed RAM Data matches the build-59 UUID and payload checks. The temporary launch was accepted, but live RAM/free/available counters and any larger allocation remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-59 ADT requests 4 GiB. Packed RAM Data matches the build-59 UUID and payload checks. The temporary launch was accepted, but live RAM/free/available counters and any larger allocation remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 retains the 4 GiB owned window. The downloaded sparse RAM Data and embedded UUID match; no larger UEFI allocation was attempted. The Android snapshot contains the documented contiguous 9 GiB interval, which does not prove current UEFI availability.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `source`: [The captured DDR regions total 12 GiB as 2+4+6 GiB. The high 4 GiB and 6 GiB regions are adjacent; merged Android memory/reg entries describe 9 GiB at 0x8c0000000-0xb00000000. That snapshot does not establish current UEFI free memory. The current kernel manages a single 4 GiB contiguous owned window. The loader accepts a separate 5 GiB trial \(owned\_memory\_size=0x140000000\) only if actual UEFI ConventionalMemory can satisfy it. This CPU candidate retains 4 GiB; no fresh UEFI free map or larger allocation has been observed. RAM Data has sparse 1 GiB logical capacity, not a fixed 1 GiB physical reservation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The captured DDR regions total 12 GiB as 2+4+6 GiB. The high 4 GiB and 6 GiB regions are adjacent; merged Android memory/reg entries describe 9 GiB at 0x8c0000000-0xb00000000. That snapshot does not establish current UEFI free memory. The current kernel manages a single 4 GiB contiguous owned window. The loader accepts a separate 5 GiB trial \(owned\_memory\_size=0x140000000\) only if actual UEFI ConventionalMemory can satisfy it. This CPU candidate retains 4 GiB; no fresh UEFI free map or larger allocation has been observed. RAM Data has sparse 1 GiB logical capacity, not a fixed 1 GiB physical reservation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 - `host`: [DTS/ADT memory and GIC contracts and RAMBlock handoff address bounds passed on the host. DMA behavior was not tested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-format2.py; test-stage6.py</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## Storage and root {#storage}
 
@@ -451,22 +457,22 @@ Components: `NativeUfs`, `NativeVirtioBlock`, `NativeRamBlock`, `PaganiVerifiedR
 
 - `host`: [Build 54 passed UFS and SMMU regressions with the shared explicit-extent API, then compiled and linked the existing storage driver. No new hardware storage qualification is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `host`: [Build 53 passed storage regressions. Independent APFS readback confirmed five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes. Packed Data logical hash, kernel Data UUID and embedded seed matched; physical writes remain disabled.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 passed storage regressions. Independent APFS readback confirmed five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes. Packed Data logical hash, kernel Data UUID and embedded seed matched; physical writes remain disabled.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 51 passed UFS regressions; APFS readback confirmed the five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes. Packed Data logical hash, kernel Data UUID and embedded seed matched; no persistent writes were enabled.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 passed UFS regressions; APFS readback confirmed the five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes. Packed Data logical hash, kernel Data UUID and embedded seed matched; no persistent writes were enabled.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 50 passed UFS regressions and full kernel compilation. Independent APFS readback confirmed all five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes; packed Data logical hash, kernel UUID and embedded seed matched.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 passed UFS regressions and full kernel compilation. Independent APFS readback confirmed all five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes; packed Data logical hash, kernel UUID and embedded seed matched.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py; test-stage6.py; ./unixnu kernel -j 3; ./unixnu payload; ./unixnu bootimg; FAT readback</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [Read-only partition bounds, root-window contracts, RAM Data preparation and original storage ABI qualification passed; UFS, Virtio and RAMBlock linked successfully.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-stage6.py; test-root-audit.py; test-ram-data.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## Display {#display}
 
@@ -533,65 +539,65 @@ Components: `NativeMobileDisplay`, `PaganiPanel`.
 
 ### Evidence
 
-- `device`: [The user confirmed entry into the system after the build-63 display handoff and timing-query fixes. The prior display panic did not prevent this observed startup. This does not isolate contention as its sole cause or establish long-term swap reliability, physical vblank timing or brightness behavior.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user confirmed entry into the system after the build-63 display handoff and timing-query fixes. The prior display panic did not prevent this observed startup. This does not isolate contention as its sole cause or establish long-term swap reliability, physical vblank timing or brightness behavior.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The verified build-63 image includes the logical slot-345 query and console-contention handoff retry. Fastboot accepted its temporary launch. Resolution of the prior swap timeout and sustained UI interaction await hardware observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The verified build-63 image includes the logical slot-345 query and console-contention handoff retry. Fastboot accepted its temporary launch. Resolution of the prior swap timeout and sustained UI interaction await hardware observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [Build 63 passes the original boolean call-site checks and compiled 358-slot vtable checks. The actual final vtable slot 345 points to isTimingEnabled and the old opaque345 guard is absent. The compiled handoff includes its contention retry. These checks do not establish that the hardware swap timeout is resolved; this build has not been booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The user confirmed build-62 slot 345, object 0xfffffff9e67f9000, caller 0xfffffff00578c1cc. Original code calls this boolean TimingEnable query after a five-second swap wait timeout. A deterministic test reproduces lost handoff on console contention; the fix waits for the bounded writer and exits immediately on panic. The qualified query reports logical display state. Actual hardware contention was not captured and other timeout causes remain possible; full compilation and runtime validation are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The user confirmed build-62 slot 345, object 0xfffffff9e67f9000, caller 0xfffffff00578c1cc. Original code calls this boolean TimingEnable query after a five-second swap wait timeout. A deterministic test reproduces lost handoff on console contention; the fix waits for the bounded writer and exits immediately on panic. The qualified query reports logical display state. Actual hardware contention was not captured and other timeout causes remain possible; full compilation and runtime validation are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>ASan/UBSan console and display regressions; exact original slot-345 ABI checks</code>. Revision: `14f50fce9778a8bb19ec6b0b7dc199863526c996`.
-- `host`: [Fastboot accepted the build-62 temporary launch with the existing CPU framebuffer path. System UI behavior and sustained interaction under eight-core scheduling await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Fastboot accepted the build-62 temporary launch with the existing CPU framebuffer path. System UI behavior and sustained interaction under eight-core scheduling await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 passes existing display, console and original/compiled ABI checks. This build has not been booted; sustained UI behavior under eight-core scheduling remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The build-60 temporary launch was accepted with the existing CPU presentation path and expanded panic trace. System UI, stability and displayed trace values await user observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-60 temporary launch was accepted with the existing CPU presentation path and expanded panic trace. System UI, stability and displayed trace values await user observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 passes existing production display/ABI checks. The actual panic renderer displays all eight trace addresses without clipping at 1216x2640 with full stage history and fault fields in the host ASan/UBSan check. System UI under SMP remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [The build-59 user photograph confirms the panic renderer works on secondary affinity 0x200. System UI and sustained presentation under SMP are not qualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The build-59 user photograph confirms the panic renderer works on secondary affinity 0x200. System UI and sustained presentation under SMP are not qualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Fastboot accepted the build-59 temporary launch with the existing CPU presentation path. Reaching the system UI and its performance under SMP await user feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Fastboot accepted the build-59 temporary launch with the existing CPU presentation path. Reaching the system UI and its performance under SMP await user feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 passes production display object/ABI checks and retains CPU framebuffer presentation with the 60 Hz software timer. UI performance and frame presentation under the eight-core candidate remain untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `device`: [The user reports working touch after build 57. This adds basic interactive feedback to the existing CPU display path; it does not qualify brightness, full-screen coordinate calibration or display timing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user reports working touch after build 57. This adds basic interactive feedback to the existing CPU display path; it does not qualify brightness, full-screen coordinate calibration or display timing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-57 fastboot boot; user confirmed touch is working</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `host`: [The build-57 image passed ADT identity, embedded-payload integrity and peripheral-argument checks, then was accepted for temporary boot. Display state, event coordinates and edge calibration await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-57 image passed ADT identity, embedded-payload integrity and peripheral-argument checks, then was accepted for temporary boot. Display state, event coordinates and edge calibration await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 compiled the console-derived 48-pixel edge band and passed overlay bounds/panic regressions. Coordinates, edge calibration and UI reception remain untested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [The HID edge band uses 48 pixels normalized against the actual unrotated console dimensions. Existing rendering and panic precedence are preserved; hardware coordinate calibration is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [On build 56, bottom-up and top-down swipes do not move the lock screen; the power menu opens via the physical key, but its Cancel button does not respond to touch. The static SPI rows intentionally retain the first successful read. Brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The HID edge band uses 48 pixels normalized against the actual unrotated console dimensions. Existing rendering and panic precedence are preserved; hardware coordinate calibration is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [On build 56, bottom-up and top-down swipes do not move the lock screen; the power menu opens via the physical key, but its Cancel button does not respond to touch. The static SPI rows intentionally retain the first successful read. Brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [Build 56 was temporarily booted after image readback. The new SPI delay or PWR diagnostic rows await user observation; this does not establish system-UI entry, brightness or panel behavior.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 56 was temporarily booted after image readback. The new SPI delay or PWR diagnostic rows await user observation; this does not establish system-UI entry, brightness or panel behavior.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 passed display object/ABI and early-console checks with the new power/timing diagnostics in the existing rows. The downloaded binary contains both PWR formats and the SPI dly field; panel hardware and brightness remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [The existing two SPI diagnostic rows now retain the delay register or an RPMh failure snapshot. No rows are added; display-boundary and panic-preservation tests pass. Panel brightness work remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build-55 user-transcribed SPI RX and SPI dma rows confirm that the retained success snapshot is visible alongside TOUCH. This is diagnostic-overlay evidence only; brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The existing two SPI diagnostic rows now retain the delay register or an RPMh failure snapshot. No rows are added; display-boundary and panic-preservation tests pass. Panel brightness work remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build-55 user-transcribed SPI RX and SPI dma rows confirm that the retained success snapshot is visible alongside TOUCH. This is diagnostic-overlay evidence only; brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-55 temporary boot; user transcribed TOUCH and both SPI rows, then confirmed return code b9</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 55 passed early-console runtime and diagnostic-row/panic checks plus original/compiled backlight ABI checks. The final kernel contains both first-success SPI formats in the existing rows. Brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40437346840)
   Command: <code>Actions build 55; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 54 passed the actual early-console runtime checks, diagnostic-row/panic regressions and compiled backlight ABI checks. DMA/SMMU diagnostic strings are present in the final kernel; brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `host`: [Build 53 passed the actual early-console runtime/FP checks after reducing the status snapshot to one 80-byte row. Diagnostic drawing, panic protection, compiled backlight ABI and full link/prelink passed. No new hardware brightness result is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 passed the actual early-console runtime/FP checks after reducing the status snapshot to one 80-byte row. Diagnostic drawing, panic protection, compiled backlight ABI and full link/prelink passed. No new hardware brightness result is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 51 passed diagnostic-row drawing and panic-protection tests, original/compiled backlight ABI checks and full kernel link/prelink. The status rows moved below the camera; no new hardware brightness result is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 passed diagnostic-row drawing and panic-protection tests, original/compiled backlight ABI checks and full kernel link/prelink. The status rows moved below the camera; no new hardware brightness result is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 50 passed display/status drawing regressions, C/C++ compilation, original and compiled backlight ABI checks, final kernel link/prelink and image readback. Physical brightness, blanking and the PANEL row await runtime observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 passed display/status drawing regressions, C/C++ compilation, original and compiled backlight ABI checks, final kernel link/prelink and image readback. Physical brightness, blanking and the PANEL row await runtime observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [Display timer and DSI transport checks passed. The owned panel object passed the original/compiled ABI audit, entered the display archive and linked into the prelinked kernel; no hardware result claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
   Command: <code>test-stage7.py; test-peripherals.py; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
-- `source`: [DSI command transport, genuine backlight ancestry, timer PM integration and explicit runtime limits; not a complete-kernel or device result.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/drivers/PaganiPanel/README.md)
+- `source`: [DSI command transport, genuine backlight ancestry, timer PM integration and explicit runtime limits; not a complete-kernel or device result.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/drivers/PaganiPanel/README.md)
 - `host`: [Display lifecycle checks and original Legacy ABI qualification passed; the CPU presentation archive compiled and linked. The migrated framebuffer has not been observed on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-stage7.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## Input {#input}
 
@@ -660,68 +666,70 @@ Components: `PaganiInput`, `QcomGeniSpi`.
 
 ### Evidence
 
-- `device`: [The user confirmed normal touch after the build-63 eight-core temporary boot. Basic UI touch now has device evidence under SMP, in addition to build 57. Detailed multi-touch, coordinate calibration, edge gestures, sleep/wake and long-term stability still require focused validation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user confirmed system UI and normal basic touch with the resource-only GPU candidate. The DTS changes were committed after this test; multi-touch, edge gestures and sleep/wake were not tested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [The user confirmed normal touch after the build-63 eight-core temporary boot. Basic UI touch now has device evidence under SMP, in addition to build 57. Detailed multi-touch, coordinate calibration, edge gestures, sleep/wake and long-term stability still require focused validation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-63 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-63 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-62 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-62 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 passes existing touch/HID contracts and original/compiled ABI checks without changing the touch implementation. Build 57 remains the confirmed basic-touch baseline; touch under SMP awaits hardware testing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The build-60 image preserves the build-57 touch implementation and disables touch diagnostic rows. Fastboot accepted temporary launch; touch under SMP remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-60 image preserves the build-57 touch implementation and disables touch diagnostic rows. Fastboot accepted temporary launch; touch under SMP remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 passes existing touch/HID regressions and production ABI checks without changing the touch implementation. Build 57 remains the basic-touch hardware baseline; touch under SMP remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [Build 59 stopped with a scheduler ticket-lock panic while the last recorded stage was IOHIDEventDriver matching. That stage does not identify the locking caller. Touch under SMP is unqualified; build 57 remains the basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 59 stopped with a scheduler ticket-lock panic while the last recorded stage was IOHIDEventDriver matching. That stage does not identify the locking caller. Touch under SMP is unqualified; build 57 remains the basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [The build-59 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch behavior under SMP awaits feedback; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-59 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch behavior under SMP awaits feedback; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 preserves the build-57 touch implementation and passes transport, HID and original/compiled ABI regressions. Its default boot policy disables touch diagnostics and enables CPU/RAM rows. Touch under the new SMP configuration has not been tested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `source`: [After confirmed basic touch in build 57, the candidate removes pagani-peripheral-status=1 from default boot arguments. Touch transport, HID binding and coordinate handling are unchanged.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [The user confirmed that touch is working after the build-57 temporary boot. This is hardware evidence of basic touch response beyond build-56 accepted HID reports. No HID/XY readings or separate multi-touch, coordinate-calibration, edge-gesture, sleep/wake or long-duration results were supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [After confirmed basic touch in build 57, the candidate removes pagani-peripheral-status=1 from default boot arguments. Touch transport, HID binding and coordinate handling are unchanged.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [The user confirmed that touch is working after the build-57 temporary boot. This is hardware evidence of basic touch response beyond build-56 accepted HID reports. No HID/XY readings or separate multi-touch, coordinate-calibration, edge-gesture, sleep/wake or long-duration results were supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-57 fastboot boot; user confirmed touch is working</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `host`: [The user-authorized build-57 temporary boot returned Sending/Booting OKAY. Lock-screen state, ordinary taps, swipes and the TOUCH/HID/XY rows are requested; event binding and UI delivery remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The user-authorized build-57 temporary boot returned Sending/Booting OKAY. Lock-screen state, ordinary taps, swipes and the TOUCH/HID/XY rows are requested; event binding and UI delivery remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 compiled and linked the standalone touch descriptor, product-scoped event-driver matching, qualified per-instance dispatch and edge-origin lifecycle. The downloaded kernel contains binding/event/X/Y diagnostics and matches the pinned sources. No hardware boot was performed; binding, coordinates, ordinary taps and system gestures remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [Following the input guide, the candidate separates touchscreen Usage 13/4 from buttons, installs a Pagani S3910 SPI-only IOHIDEventDriver personality, and requires actual driver/ABI/usage/collection binding before sending. A per-instance qualified dispatch wrapper preserves edge-origin 0x800 through release and observes event counts and X/Y. Descriptor, personality, contact/edge lifecycle, bounds and existing transport/power tests pass. Ordinary taps and system gestures remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build 56 shows TOUCH HID report r=0 with count increasing \(observed 430\); v is nonzero while pressed and returns to zero on release. Valid protocol and parsed contact activity now reach the kernel HID API, while UI swipes and an ordinary Cancel tap fail. Current code does not observe event-driver attachment or digitizer dispatch; keyboard-first identity, downstream matching, coordinates and release delivery require investigation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Following the input guide, the candidate separates touchscreen Usage 13/4 from buttons, installs a Pagani S3910 SPI-only IOHIDEventDriver personality, and requires actual driver/ABI/usage/collection binding before sending. A per-instance qualified dispatch wrapper preserves edge-origin 0x800 through release and observes event counts and X/Y. Descriptor, personality, contact/edge lifecycle, bounds and existing transport/power tests pass. Ordinary taps and system gestures remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build 56 shows TOUCH HID report r=0 with count increasing \(observed 430\); v is nonzero while pressed and returns to zero on release. Valid protocol and parsed contact activity now reach the kernel HID API, while UI swipes and an ordinary Cancel tap fail. Current code does not observe event-driver attachment or digitizer dispatch; keyboard-first identity, downstream matching, coordinates and release delivery require investigation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [The matching build-56 image was sent with fastboot boot after the user connected the device. Sending/Booting returned OKAY; touch response and the TOUCH, SPI RX/dly or PWR diagnostic values await hardware feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The matching build-56 image was sent with fastboot boot after the user connected the device. Sending/Booting returned OKAY; touch response and the TOUCH, SPI RX/dly or PWR diagnostic values await hardware feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 compiled and linked the explicit 1800/3100 mV touch requests, 200 ms power wait and checked SPI delays of 50/0. The downloaded kernel contains the new diagnostics and matches all source pins and its RAM Data UUID. No XNU hardware test was performed; valid S3910 traffic and UI touch remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [A synchronized Android gesture capture contains 40 complete press/release cycles over 18.793234 seconds, 726 frames and 51 overlapping valid SPI RX records. Following the hummer S3910 power diagnosis, the candidate validates the 13T command DB resources, requests 1800/3100 mV, waits 200 ms, and sets checked CS/word delays to 50/0 before reset. First-read diagnostics include dly; power failures preserve resource, RSC, TCS and acknowledgement state. Host regressions pass; SE DMA and protocol validation are unchanged, and XNU touch remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [The Android baseline uses the OnePlus HBP driver on the local 6.6.118 kernel. Retained GPI logs show ff TX, a5 23 ca 05 RX, CS delay 50 and inter-word delay 0. Idle RESET/ATTN are high and SPI is runtime suspended; live sampling captured no gesture or active interval. The current port omits an explicit SE\_SPI\_DELAY\_COUNTERS write, but its inherited value and XNU rail state remain unknown, so timing is a candidate cause rather than a confirmed diagnosis.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [A synchronized Android gesture capture contains 40 complete press/release cycles over 18.793234 seconds, 726 frames and 51 overlapping valid SPI RX records. Following the hummer S3910 power diagnosis, the candidate validates the 13T command DB resources, requests 1800/3100 mV, waits 200 ms, and sets checked CS/word delays to 50/0 before reset. First-read diagnostics include dly; power failures preserve resource, RSC, TCS and acknowledgement state. Host regressions pass; SE DMA and protocol validation are unchanged, and XNU touch remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [The Android baseline uses the OnePlus HBP driver on the local 6.6.118 kernel. Retained GPI logs show ff TX, a5 23 ca 05 RX, CS delay 50 and inter-word delay 0. Idle RESET/ATTN are high and SPI is runtime suspended; live sampling captured no gesture or active interval. The current port omits an explicit SE\_SPI\_DELAY\_COUNTERS write, but its inherited value and XNU rail state remain unknown, so timing is a candidate cause rather than a confirmed diagnosis.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Read-only ADB root capture of Android regulator, GPIO, clock and existing SPI IPC logs; compare OnePlus touch and GENI source</code>. Revision: `bdeec6693f1b8488a3286446f0b93c13c02d6785`.
-- `device`: [Build 55 reports TOUCH T0 00 header r=ffffffb9 v=0 n=0; SPI RX n=4 h=00000000 a=0/0 rst=3; SPI dma=1 ti=4 ri=4 st=0. The RX canary is replaced by zeros and both DMA length-in readings are 4, but no valid sensor header or UI touch is obtained. ATTN is low before/after; RESET input and output latch are high. Stock Android explicitly enables ldob4 at 1.8 V and ldob16 at 3.1 V; this port still adopts retained rails, whose XNU state is unknown.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 55 reports TOUCH T0 00 header r=ffffffb9 v=0 n=0; SPI RX n=4 h=00000000 a=0/0 rst=3; SPI dma=1 ti=4 ri=4 st=0. The RX canary is replaced by zeros and both DMA length-in readings are 4, but no valid sensor header or UI touch is obtained. ATTN is low before/after; RESET input and output latch are high. Stock Android explicitly enables ldob4 at 1.8 V and ldob16 at 3.1 V; this port still adopts retained rails, whose XNU state is unknown.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-55 temporary boot; user transcribed TOUCH and both SPI rows, then confirmed return code b9</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 55 passed actual-adapter first-success retention and zero-header rejection tests, protocol/contact/button/PIO/SE DMA regressions, C/C++ compilation and original/compiled HID ABI checks. Both first-read diagnostic formats are present in the final kernel. The matching image passed readback and fastboot boot; raw RX/GPIO/counter values and usable touch remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40437346840)
   Command: <code>Actions build 55; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
-- `device`: [TOUCH T0 00 header r=ffffffb9 v=0 n=0. SPI returned success but the protocol parser rejected a zero header; touch setup stopped before HID start. No SPI error rows appeared. Valid sensor data and UI touch remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [TOUCH T0 00 header r=ffffffb9 v=0 n=0. SPI returned success but the protocol parser rejected a zero header; touch setup stopped before HID start. No SPI error rows appeared. Valid sensor data and UI touch remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-54 temporary boot; user transcribed TOUCH row and absent SPI rows</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
 - `host`: [Build 54 compiled the DMA allocation/cache/SMMU adapter against the original kernel ABI and passed transport/contact/button regressions. The matching image passed local readback and fastboot boot. Whether the QUP stream is available and SE DMA works on the phone remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `device`: [First four-byte SPI read still times out. fw=102 if=1 st=41 irq=0; FIFO tx=0 rx=0. FIFO interface disabled is observed; successful DMA and touch are not established.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [First four-byte SPI read still times out. fw=102 if=1 st=41 irq=0; FIFO tx=0 rx=0. FIFO interface disabled is observed; successful DMA and touch are not established.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-53 temporary boot; user transcribed TOUCH and SPI rows</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 53 passed actual SPI callback/snapshot and protocol/contact/button regressions, C/C++ compilation and original/compiled HID ABI checks. The final image contains both SPI status formats and was temporarily booted; hardware register values are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 passed actual SPI callback/snapshot and protocol/contact/button regressions, C/C++ compilation and original/compiled HID ABI checks. The final image contains both SPI status formats and was temporarily booted; hardware register values are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `device`: [Touch remains unresponsive. TOUCH T0 00 header r=ffffff92 v=0 n=0 locates the timeout in the first SPI transfer, before protocol identification. No GENI register snapshot was visible in build 51.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Touch remains unresponsive. TOUCH T0 00 header r=ffffff92 v=0 n=0 locates the timeout in the first SPI transfer, before protocol identification. No GENI register snapshot was visible in build 51.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-51 temporary boot; user transcribed TOUCH status</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 51 passed actual SPI read callback tests, v1/v2 protocol and contact/button/SPMI/GENI regressions, C/C++ compilation and original/compiled HID ABI checks. The matching image was temporarily booted; touch behavior and protocol status await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 passed actual SPI read callback tests, v1/v2 protocol and contact/button/SPMI/GENI regressions, C/C++ compilation and original/compiled HID ABI checks. The matching image was temporarily booted; touch behavior and protocol status await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `device`: [Lock screen after skipping Setup; short power presses switch the screen off/on, long press opens shutdown UI. Volume presses advance the key-report counter. Touch has no response: TouchComm start r=ffffffb9, n=0, raw value hidden by camera.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Lock screen after skipping Setup; short power presses switch the screen off/on, long press opens shutdown UI. Volume presses advance the key-report counter. Touch has no response: TouchComm start r=ffffffb9, n=0, raw value hidden by camera.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-50 temporary boot; photo and user observation</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `host`: [Build 50 passed actual HID descriptor parsing, TouchComm/contact/button/SPMI/GENI tests, C/C++ compilation and original/compiled HID ABI checks. The matching image was temporarily booted; touch/key response and KEYS/TOUCH rows await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 passed actual HID descriptor parsing, TouchComm/contact/button/SPMI/GENI tests, C/C++ compilation and original/compiled HID ABI checks. The matching image was temporarily booted; touch/key response and KEYS/TOUCH rows await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [TouchComm, contact lifecycle, key debounce/failure, SPMI and GENI tests passed. The HID object passed ABI checks and the S3910/GENI sources compiled as C; all three objects linked into the prelinked kernel. Hardware input remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
   Command: <code>test-peripherals.py; test-stage7.py; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
-- `source`: [Physical HID adapters, bounded TouchComm/SPMI paths, contact and key lifecycle tests; no hardware result claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/drivers/PaganiInput/README.md)
+- `source`: [Physical HID adapters, bounded TouchComm/SPMI paths, contact and key lifecycle tests; no hardware result claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/drivers/PaganiInput/README.md)
 
 ## GPU {#gpu}
 
@@ -729,21 +737,27 @@ Components: `PaganiInput`, `QcomGeniSpi`.
 
 ### Hardware and dependencies
 
-- Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected.
+- PKX110 Android runtime DTB SHA-256 d00767f2068d0df73fc2a077de750bba66a5420c77414db1441ff09f6f3ec223, recorded in proprietary-files.txt. It reports Adreno830v2, chip ID 0x44050001, GPU registers 0x3d00000/0x40000, GMU registers 0x3d37000/0x68000, GPUCC 0x3d90000/0x9800, GPU SMMU 0x3da0000/0x40000 and ZAP reserved memory 0x9b09a000/0x2000.
+- GPU IRQs are SPI 300 and 80; GMU HFI/GMU IRQs are SPI 304 and 305. The stock GPU SMMU uses stream IDs 0 \(user\), 1 \(LPAC\), 2 \(secure\) and 5 \(GMU\).
+- The stock DTB has six GPU power-level bins; the active speed bin and its voltage/bandwidth policy need measurement before power-up.
+- A related OnePlus SM8750 Android device repository lists gen80000\_gmu.bin, gen80000\_sqe.fw, gen80000\_aqe.fw and gen80000\_zap.mbn. PKX110 paths and bytes remain unverified.
+- Adreno 830/SM8750 requires a Gen8 backend; catalog Adreno740 is scoped to A740/SM8550 and cannot be selected as the 13T GPU driver.
 
 ### Configuration
 
-- No driver is enabled for this subsystem.
+- The shared SM8750 DTSI describes GPU, GMU, GPUCC and GPU SMMU resources with status=disabled. The board DTS supplies the observed chip ID and model. board.toml selects no GPU or Metal component; CPU framebuffer presentation stays active.
 
 ### Procedure
 
-- Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component.
+- Validate the shared and board GPU nodes against the captured runtime DTB, including register extents, interrupts and stream IDs.
+- Extract PKX110 GMU, SQE, AQE and signed ZAP firmware from the matching stock image; record paths, sizes and SHA-256 pins in proprietary-files.txt without committing blobs.
+- Implement and qualify an A830 power/GMU/HFI backend, then SMMU mappings, CP submission and a bounded fence before selecting a Metal frontend.
 
 ### Development findings
 
-- Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected.
-- The SpringBoard/input candidate selects no GPU driver or bridge. Updated upstream Adreno submodules are outside the OnePlus 13T component selection; UI presentation still uses the CPU framebuffer.
-- The eight-core candidate continues to present through CPU framebuffer copies. CPU topology changes do not establish GPU/Metal acceleration.
+- The stock DTB names the GPU Adreno830v2 but advertises qcom,adreno-gpu-gen8-0-1; the two strings are preserved as observed, without inferring a different GPU revision.
+- The disabled DTS nodes record four GPU windows, two GMU windows, GPUCC and the separate GPU SMMU. No clock, power, firmware, SMMU or command operation is activated.
+- The SpringBoard/input and eight-core candidates continue to use CPU framebuffer copies. Their hardware observations do not establish GPU/Metal acceleration.
 
 ### Completion criteria
 
@@ -751,15 +765,18 @@ Components: `PaganiInput`, `QcomGeniSpi`.
 
 ### Current limits
 
-- No implemented or hardware-verified path is available for this subsystem.
+- The PKX110 GPU firmware files, hashes and active speed bin have not been captured. The A830 power sequence, SMMU ownership, submission ABI and Turnip/Metal integration have no 13T host or hardware qualification.
 
 ### Next action
 
-- Capture SM8750 GPU/GMU resources and the firmware manifest; qualify a matching implementation before enabling GPU components.
+- Capture and pin firmware from the stock PKX110 image, then implement an opt-in read-only GPUCC/SMMU probe before any power or GMU writes.
 
 ### Evidence
 
-Collect evidence using the next action.
+- `device`: [The resource-only candidate reached the system UI with normal basic touch. Its GPU nodes remain disabled and were omitted from ADT, so this test provides no GPU power-up or rendering evidence. The DTS changes were committed after this test.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `source`: [The recorded Android runtime DTB hash identifies the source for the disabled GPU/GMU/GPUCC/SMMU resource nodes and board chip ID.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/proprietary-files.txt)
+- `source`: [Related SM8750 stock firmware list supplies candidate Gen8 filenames; PKX110 firmware is not pinned.](https://github.com/jjpprrrr/android_device_oneplus_sm8750-common/blob/l23.2/proprietary-files.txt)
 
 ## Network {#network}
 
@@ -881,22 +898,22 @@ Components: `ShengPlatformPower`.
 
 ### Evidence
 
-- `host`: [The build-57 image was temporarily booted with the retained build-56 touch power sequence. New hardware power or runtime acknowledgement values have not been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-57 image was temporarily booted with the retained build-56 touch power sequence. New hardware power or runtime acknowledgement values have not been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 retains the checked build-56 touch power and SPI timing. Host power fault regressions and production compilation pass; this round adds no hardware power observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [The HID candidate preserves the build-56 checked RPMh requests, 200 ms power wait and SPI timing. No new power-management behavior or physical voltage claim is introduced.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Reaching build-56 HID report submission implies that the checked RPMh requests and protocol initialization completed along the current control flow. This is not a physical rail-voltage measurement and does not isolate the contributions of the power and SPI-timing changes.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The HID candidate preserves the build-56 checked RPMh requests, 200 ms power wait and SPI timing. No new power-management behavior or physical voltage claim is introduced.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Reaching build-56 HID report submission implies that the checked RPMh requests and protocol initialization completed along the current control flow. This is not a physical rail-voltage measurement and does not isolate the contributions of the power and SPI-timing changes.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [The user-authorized build-56 temporary boot was accepted by fastboot. RPMh acknowledgement values and effective touch rail state under XNU remain unobserved; no power-management completion claim is made.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The user-authorized build-56 temporary boot was accepted by fastboot. RPMh acknowledgement values and effective touch rail state under XNU remain unobserved; no power-management completion claim is made.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 passed production compilation/linking and host fault regressions for the checked touch-only RPMh path. The kernel is downloaded, but no RPMh acknowledgement or physical rail state has yet been observed under XNU.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [The new touch-only RPMh path validates command DB bounds, unique VRM resources and captured board addresses before any rail write. It uses only an idle ACTIVE TCS, verifies register readback and all three voltage/mode/enable acknowledgements, and preserves unrelated TCSes and IRQ bits. Timeout retains the armed slot with its IRQ masked. Shared rail votes remain enabled on cleanup. This establishes a tested host implementation, not measured rail voltage or XNU hardware success.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The new touch-only RPMh path validates command DB bounds, unique VRM resources and captured board addresses before any rail write. It uses only an idle ACTIVE TCS, verifies register readback and all three voltage/mode/enable acknowledgements, and preserves unrelated TCSes and IRQ bits. Timeout retains the armed slot with its IRQ masked. Shared rail votes remain enabled on cleanup. This establishes a tested host implementation, not measured rail voltage or XNU hardware success.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 - `host`: [The PMGR builder qualified the pinned original imports/provider dispatch and linked its archive. Physical power transitions, battery and frequency control remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## Image assembly {#packaging}
 
@@ -942,7 +959,7 @@ Components: `NativePrelink`.
 
 ### Current limits
 
-- Build 63 is device-observed through temporary boot. This does not qualify partition flashing, persistence or future images.
+- Build 63 and the resource-only GPU candidate are device-observed through temporary boot. This does not qualify partition flashing, persistence or later images.
 
 ### Next action
 
@@ -950,41 +967,43 @@ Components: `NativePrelink`.
 
 ### Evidence
 
-- `device`: [The user-confirmed build-63 system startup used boot.img SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149, 87957504 bytes, with the recorded same-build kernel/trust/Data and unchanged UEFI. The temporary boot route is device-observed; no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The resource-only image is 87957504 bytes, SHA-256 34b8738bf6ad044df6045039971936644d32690fa354c524478aed51719e0a22. Fastboot Sending and Booting returned OKAY in 2.656s without partition flash; the user confirmed system UI and normal touch. The DTS additions were committed after this test.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [The user-confirmed build-63 system startup used boot.img SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149, 87957504 bytes, with the recorded same-build kernel/trust/Data and unchanged UEFI. The temporary boot route is device-observed; no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [Build-63 boot.img is 87957504 bytes with SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149 at out/oneplus13t/boot/stage7-run-63/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted temporary launch in 2.791s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-63 boot.img is 87957504 bytes with SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149 at out/oneplus13t/boot/stage7-run-63/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted temporary launch in 2.791s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [Build-63 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-63/ with 127803392 bytes and SHA-256 076c87c95bf3a1496722f4bddf7538b4be336cc80908e4ef3a15eeb4b0f64540. Paired RAM Data UUID is 1726EAC0-2168-4118-AFD6-19E12FE306E7. Source pins, actual display vtable, Clutch policy, packed/raw Data integrity and UUID embedding pass. No build-63 boot image was assembled or booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `source`: [The verified build-62 temporary boot subsequently panicked at display slot 345. No replacement image has been assembled or booted; its kernel, trust cache and RAM Data remain the current local packaging inputs, and earlier images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [Build-62 boot.img is 87957504 bytes with SHA-256 d15c0f5fca06ad13047e653aeaa778b1d3b5c6610448113143d5aa6ab7f1bd2b at out/oneplus13t/boot/stage7-run-62/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.671s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The verified build-62 temporary boot subsequently panicked at display slot 345. No replacement image has been assembled or booted; its kernel, trust cache and RAM Data remain the current local packaging inputs, and earlier images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [Build-62 boot.img is 87957504 bytes with SHA-256 d15c0f5fca06ad13047e653aeaa778b1d3b5c6610448113143d5aa6ab7f1bd2b at out/oneplus13t/boot/stage7-run-62/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.671s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build-62 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-62/ with 127803392 bytes and SHA-256 671d5cc0c9b60b594b481914d3a5874d88e78ebac906834e78577618cfe6629e. Paired RAM Data UUID is 9E72E6D9-AC74-428E-A275-E8A25FD3264C. Source pins, actual Clutch policy, panic strings, packed/raw Data integrity and UUID embedding pass. No build-62 boot image was assembled or booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [Build-60 boot.img is 87957504 bytes with SHA-256 fddce67146aca4ce607975264689f3cac014f712f7409c00d5f4de923315b4bf at out/oneplus13t/boot/stage7-run-60/boot.img. Android v4, unchanged UEFI, FAT inputs, eight-affinity ADT and same-build kernel/trust/Data checks pass. Fastboot Sending/Booting returned OKAY in 2.659s without flashing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-60 boot.img is 87957504 bytes with SHA-256 fddce67146aca4ce607975264689f3cac014f712f7409c00d5f4de923315b4bf at out/oneplus13t/boot/stage7-run-60/boot.img. Android v4, unchanged UEFI, FAT inputs, eight-affinity ADT and same-build kernel/trust/Data checks pass. Fastboot Sending/Booting returned OKAY in 2.659s without flashing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build-60 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-60/ with 127803392 bytes and SHA-256 422074400f8eff7b9be51dfec3e895a207f304deb678ba527dcaf23da2eeea35. Its paired RAM Data UUID is E81D6D67-C2F6-4CAC-9FF9-100EDFF76900. Source pins, selected diagnostic patch, actual panic strings, packed/raw Data integrity and UUID embedding pass; no build-60 boot image was assembled or booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [The verified build-59 image was temporarily loaded successfully, then panicked in the kernel. The next image must use the diagnostic kernel and its matching trust/Data inputs; previous images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The verified build-59 image was temporarily loaded successfully, then panicked in the kernel. The next image must use the diagnostic kernel and its matching trust/Data inputs; previous images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Build-59 boot.img is 87957504 bytes with SHA-256 a58808d933c713e5a32c068f36791d09d2917d2216c7b788250a5a8bafcca349 at out/oneplus13t/boot/stage7-run-59/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.680s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-59 boot.img is 87957504 bytes with SHA-256 a58808d933c713e5a32c068f36791d09d2917d2216c7b788250a5a8bafcca349 at out/oneplus13t/boot/stage7-run-59/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.680s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build-59 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-59/ with 127803392 bytes and SHA-256 2f501babd1daf3a60700588d21b1ff90394d471fd82751158c726ebaf1033400. Its paired RAM Data UUID is 2B2FB879-4530-4537-8CBD-50692F3F0CA0. Source pins, packed/raw Data integrity and UUID embedding pass; no build-59 boot image has been assembled or booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Build-57 boot.img is 87957504 bytes, SHA-256 33ad1883076f25b944ccde4fd89776e28c9576589eb0cc6fb8e6df10aeee8b55, at out/oneplus13t/boot/stage7-run-57/boot.img. Android v4, empty ramdisk, unchanged UEFI and actual FAT kernel/trust/Data/ADT passed readback. Fastboot accepted the user-requested temporary boot without flashing; earlier images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-57 boot.img is 87957504 bytes, SHA-256 33ad1883076f25b944ccde4fd89776e28c9576589eb0cc6fb8e6df10aeee8b55, at out/oneplus13t/boot/stage7-run-57/boot.img. Android v4, empty ramdisk, unchanged UEFI and actual FAT kernel/trust/Data/ADT passed readback. Fastboot accepted the user-requested temporary boot without flashing; earlier images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py; test-stage6.py; ./unixnu kernel -j 3; ./unixnu payload; ./unixnu bootimg; FAT readback</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
-- `host`: [The build-48 boot image passed Android v4, embedded payload and stock-DTB round-trip checks. FAT readback matched the cloud kernel, trust cache and Data seed; all three pagani peripheral arguments and the 4 GiB DarwinBoot, root UUID and PackedRAMDisk/TrustCache handoff properties passed. Hardware remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/README.md)
+- `host`: [The build-48 boot image passed Android v4, embedded payload and stock-DTB round-trip checks. FAT readback matched the cloud kernel, trust cache and Data seed; all three pagani peripheral arguments and the 4 GiB DarwinBoot, root UUID and PackedRAMDisk/TrustCache handoff properties passed. Hardware remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/README.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; mcopy FAT readback and input hash checks</code>. Revision: `fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac`.
-- `host`: [Kernel/prelink, 160 MiB FAT payload and 87928832-byte Android v4 boot image succeeded. Extracted ADT and payload kernel hashes match the reports; no GPU addon is supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/MIGRATION.md)
+- `host`: [Kernel/prelink, 160 MiB FAT payload and 87928832-byte Android v4 boot image succeeded. Extracted ADT and payload kernel hashes match the reports; no GPU addon is supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/MIGRATION.md)
   Command: <code>./unixnu kernel -j 3; ./unixnu build package; ./unixnu firmware; ./unixnu payload; ./unixnu bootimg</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## Diagnostics {#diagnostics}
 
@@ -1045,51 +1064,51 @@ Components: `BootProgress`, `Stage7Probe`.
 
 ### Evidence
 
-- `device`: [The user read CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096 free=24 avail=2368 from the build-63 overlay. The masks show historical nonzero per-core timer/IPI counts, not rate or cross-core stress coverage. The memory counters are dynamic snapshots.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user read CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096 free=24 avail=2368 from the build-63 overlay. The masks show historical nonzero per-core timer/IPI counts, not rate or cross-core stress coverage. The memory counters are dynamic snapshots.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-63 image retains CPU/RAM status rows and the bounded ticket-lock trace while disabling touch status rows. Actual CPU counts, timer/IPI masks or a new panic trace await user feedback after the accepted temporary launch.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-63 image retains CPU/RAM status rows and the bounded ticket-lock trace while disabling touch status rows. Actual CPU counts, timer/IPI masks or a new panic trace await user feedback after the accepted temporary launch.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [Build 63 passes actual-code console contention and panic regressions with ASan/UBSan, including handoff success after the other writer releases and immediate failure when a panic owner exists. The normal log try-lock and first-panic retention remain unchanged. Hardware contention was not captured in the build-62 photograph.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [Normal SMP diagnostics retain try-lock behavior. Display ownership handoff now retries contention and aborts on panic ownership; the actual-code regression fails before the fix and passes after it with ASan/UBSan. Panic remains independent of a stopped console-lock owner. The slot-345 method is qualified against exact original instructions and its timeout format.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Normal SMP diagnostics retain try-lock behavior. Display ownership handoff now retries contention and aborts on panic ownership; the actual-code regression fails before the fix and passes after it with ASan/UBSan. Panic remains independent of a stopped console-lock owner. The slot-345 method is qualified against exact original instructions and its timeout format.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>ASan/UBSan console and display regressions; exact original slot-345 ABI checks</code>. Revision: `14f50fce9778a8bb19ec6b0b7dc199863526c996`.
-- `host`: [The build-62 image retains the CPU/RAM status rows and bounded ticket-lock trace while disabling touch status rows. Runtime CPU counts, timer/IPI masks or a new panic trace await user feedback after the accepted temporary launch.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-62 image retains the CPU/RAM status rows and bounded ticket-lock trace while disabling touch status rows. Runtime CPU counts, timer/IPI masks or a new panic trace await user feedback after the accepted temporary launch.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 retains the ticket ownership assertion, logical CPU/compact thread IDs, raw ticket state and eight bounded return addresses. Existing source and console tests pass, and the actual kernel contains the expected formats. Hardware verification of the scheduler correction remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `device`: [The build-60 photo provides all eight return addresses. Its own symbols and call instructions locate thread\_select after Clutch steal on the thread termination path; current and owner compact IDs both equal f1d34. This identifies the recursive pset0 lock mechanism. The ownership assertion and bounded backtrace remain enabled for the correction.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The build-60 photo provides all eight return addresses. Its own symbols and call instructions locate thread\_select after Clutch steal on the thread termination path; current and owner compact IDs both equal f1d34. This identifies the recursive pset0 lock mechanism. The ownership assertion and bounded backtrace remain enabled for the correction.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-60 panic photo; matching kernel llvm-nm and llvm-objdump; selected scheduler source comparison</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `host`: [The matching build-60 image was temporarily launched. If the lock panic repeats, capture cpu/ctid/owner/tickets and all BT 0-7 addresses for symbolication against this exact kernel. No new device trace has been recorded yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The matching build-60 image was temporarily launched. If the lock panic repeats, capture cpu/ctid/owner/tickets and all BT 0-7 addresses for symbolication against this exact kernel. No new device trace has been recorded yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 contains the CPU/compact-ID/ticket and BT 0-7 formats in the actual linked kernel. The real diagnostic function passes 0-8-frame and unchanged-lock checks, and the actual renderer keeps all eight addresses visible. Hardware capture and the panic root cause remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `source`: [The build-59 panic identifies pset0+0x100 on secondary affinity 0x200 but lacks a call trace. The device patch preserves the ownership assertion and appends compact IDs, ticket state and an eight-frame XNU backtrace. The host regression covers 0-8 frames, zero-filled unused entries, formatting and unchanged lock state; full compilation and hardware trace capture are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The build-59 image enables the two CPU/RAM status rows and disables touch status rows. The user has been asked to transcribe registered/online CPU counts, timer/IPI masks and RAM MiB after the accepted temporary launch; no runtime values are recorded yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The build-59 panic identifies pset0+0x100 on secondary affinity 0x200 but lacks a call trace. The device patch preserves the ownership assertion and appends compact IDs, ticket state and an eight-frame XNU backtrace. The host regression covers 0-8 frames, zero-filled unused entries, formatting and unchanged lock state; full compilation and hardware trace capture are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The build-59 image enables the two CPU/RAM status rows and disables touch status rows. The user has been asked to transcribe registered/online CPU counts, timer/IPI masks and RAM MiB after the accepted temporary launch; no runtime values are recorded yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 compiles the SMP console, passes first-panic ownership and contention tests, and contains the CPU registered/online, timer/IPI and RAM status formats. The actual runtime values have not yet been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `source`: [Normal console writers use a nonblocking cross-CPU lock after VM setup; contended observations are skipped and a first-writer panic owner prevents another CPU from replacing its message. The opted-in platform overlay reports processor\_count, processor\_avail\_count, timer/IPI bitmaps and RAM/free/available MiB in two rows. Touch status is disabled by default.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build-57 user feedback confirms working touch, but the HID binding/event counters and XY rows have not been transcribed. Preserve the verified image as the basic-touch baseline; detailed counters and gesture behavior remain unmeasured.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Normal console writers use a nonblocking cross-CPU lock after VM setup; contended observations are skipped and a first-writer panic owner prevents another CPU from replacing its message. The opted-in platform overlay reports processor\_count, processor\_avail\_count, timer/IPI bitmaps and RAM/free/available MiB in two rows. Touch status is disabled by default.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build-57 user feedback confirms working touch, but the HID binding/event counters and XY rows have not been transcribed. Preserve the verified image as the basic-touch baseline; detailed counters and gesture behavior remain unmeasured.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-57 fastboot boot; user confirmed touch is working</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `host`: [Build-57 image readback verified the matching kernel and Data UUID ADDC2464-BA09-47F6-B71E-EA117F2C0F73. Fastboot Sending/Booting returned OKAY in 2.706s. The image directory contains fastboot-boot.log; TOUCH/HID/XY or SPI/PWR readings await user observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-57 image readback verified the matching kernel and Data UUID ADDC2464-BA09-47F6-B71E-EA117F2C0F73. Fastboot Sending/Booting returned OKAY in 2.706s. The image directory contains fastboot-boot.log; TOUCH/HID/XY or SPI/PWR readings await user observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build-57 kernel is 127803392 bytes with SHA-256 42dd53a4341d47ac5da894ae4ad1df02f7f5e5b5d7de5ee3b58ed07f0b744a87. Source pins, actual HID/XY/wait/bind strings, packed/raw Data integrity and UUID ADDC2464-BA09-47F6-B71E-EA117F2C0F73 passed local checks. Hardware readings await a separate boot instruction.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [After valid touch parsing, two existing rows show HID binding bits, usage, dispatch/digitizer counts, edge starts, input/event X/Y and event mask. Protocol/SPI failure snapshots and panic freeze remain intact. Full binding is 0x1f; accepted reports and dispatched events remain separate from UI delivery.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build-56 readings are SPI RX n=4 h=001c10a5 a=0/0 rst=3 and SPI dma=1 ti=4 ri=4 st=0 dly=c800. These are fixed first-read snapshots. TOUCH v is the contact-ID mask and n counts accepted handleReport calls, not UI events. Add downstream binding/dispatch and X/Y observation in the next candidate.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [After valid touch parsing, two existing rows show HID binding bits, usage, dispatch/digitizer counts, edge starts, input/event X/Y and event mask. Protocol/SPI failure snapshots and panic freeze remain intact. Full binding is 0x1f; accepted reports and dispatched events remain separate from UI delivery.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build-56 readings are SPI RX n=4 h=001c10a5 a=0/0 rst=3 and SPI dma=1 ti=4 ri=4 st=0 dly=c800. These are fixed first-read snapshots. TOUCH v is the contact-ID mask and n counts accepted handleReport calls, not UI events. Add downstream binding/dispatch and X/Y observation in the next candidate.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [Build-56 boot.img is 87953408 bytes, SHA-256 66aebc977d9558905f25851b8753e06556bb64f29df25a8d5feab3e970e3b5fd. Android header, embedded UEFI/FAT, matching kernel/trust/Data and ADT arguments passed readback. Fastboot Sending/Booting returned OKAY in 2.683s, without flashing; runtime diagnostics await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-56 boot.img is 87953408 bytes, SHA-256 66aebc977d9558905f25851b8753e06556bb64f29df25a8d5feab3e970e3b5fd. Android header, embedded UEFI/FAT, matching kernel/trust/Data and ADT arguments passed readback. Fastboot Sending/Booting returned OKAY in 2.683s, without flashing; runtime diagnostics await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build-56 kernel size is 127799296 bytes and SHA-256 is 42500cf7b10de6ef3f51c1114de5f31f7652c1697e4844d53d40d77bf0848121. Local checks passed for source pins, actual PWR/dly strings, packed/raw RAM Data integrity and matching UUID E9CAF07B-447E-4020-AF28-0E4B3A0B1296. Hardware readings await a separately authorized boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [Power failures retain PWR address/hardware/slot and status/command snapshots in the existing two diagnostic rows. Successful first-read diagnostics add the actual SPI delay register. Host tests verify formatting, retained first-read evidence and frozen panic output; kernel compilation passed in build 56, while hardware readings remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Power failures retain PWR address/hardware/slot and status/command snapshots in the existing two diagnostic rows. Successful first-read diagnostics add the actual SPI delay register. Host tests verify formatting, retained first-read evidence and frozen panic output; kernel compilation passed in build 56, while hardware readings remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [Source-kernel regressions, early console compilation and panic-entry contract passed in CI; runtime checkpoints still require a hardware boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-kernel-source.py; drivers/BootProgress/Test/panic-entry.py</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 </div>

docs/devices/peridot-hoshikv.md

@@ -0,0 +1 @@
+[hoshikv/UniXNU-peridot](https://github.com/hoshikv/UniXNU-peridot)

docs/devices/pong-hxzbaka.md

@@ -0,0 +1 @@
+[hxzbaka/UniXNU-pong](https://github.com/hxzbaka/UniXNU-pong)

docs/devices/pong.md

@@ -1,26 +1,523 @@
-# Nothing Phone (2) (pong)
+# Nothing Phone \(2\) \(pong\)
 
-pong is the Nothing Phone (2) with the SM8475 SoC. The port below is an independent community project. The UniXNU organization does not maintain it. The target is iOS 16.6.1 (20G81) with the iPad7,1 / J120 identity.
+[Chengdong-Yu/UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong)
 
-| Repository | Maintainer | State |
-| --- | --- | --- |
-| [UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong) | [Chengdong-Yu](https://github.com/Chengdong-Yu) | iOS 16.6.1 home screen; display and touch work |
-| [uefi-pong](https://github.com/Chengdong-Yu/uefi-pong) | [Chengdong-Yu](https://github.com/Chengdong-Yu) | Mu-Silicium firmware with `pongPkg` |
+<div v-pre>
 
-## State
+Nothing Phone \(2\), iPadOS18 Darwin24 local format2 migration and board adaptation
 
-| Area | State |
+Source record: [porting.toml](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/porting.toml), `ffdad781cb16b42a1fb5c984f77998253b821d8c`.
+
+This page is generated from the device record.
+
+| Area | Status |
 | --- | --- |
-| iOS 16.6.1 boot | reaches the home screen |
-| Display | system UI visible on the 1080x2412 panel |
-| Touch and buttons | the Pong touch path works; power and volume keys work |
-| UFS and APFS | the native UFS and APFS boot path is connected; some mount paths are still in progress |
-| Writable Data | a local userdata root-image builder is provided; the image is generated on the host |
-| Adreno 730 and Metal | driver and Metal sources are included; hardware acceleration is not confirmed |
-| Wi-Fi, Bluetooth, camera, audio, sensors | not implemented |
+| [Configuration](#configuration) | `implemented` |
+| [Firmware and boot](#firmware) | `implemented` |
+| [CPU and interrupts](#cpu) | `implemented` |
+| [Memory and DMA](#memory) | `implemented` |
+| [Storage and root](#storage) | `implemented` |
+| [Display](#display) | `implemented` |
+| [Input](#input) | `implemented` |
+| [GPU](#gpu) | `implemented` |
+| [Network](#network) | `implemented` |
+| [Audio](#audio) | `implemented` |
+| [Power](#power) | `implemented` |
+| [Image assembly](#packaging) | `implemented` |
+| [Diagnostics](#diagnostics) | `implemented` |
 
-The device repository fetches only the needed iOS 16.6.1 components from the restore image by HTTP range. Apple restore files, generated userdata images and GPU firmware stay outside the repository.
+## Configuration {#configuration}
 
-## Maintenance
+`implemented`
 
-The maintainer owns the repositories and their release decisions. UniXNU documentation lists the port and its state; it does not take over maintenance.
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- 选择 ARM64、SM8475、22H374 和 Pong 四层配置，数组完整列出。
+
+### Development findings
+
+- 格式2解析、DTS编译、Darwin24内核及启动镜像构建成功；公开源固定版本已补齐。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- SM8475公共层与Pong聚合源码分目录固定；平台组件进一步拆分待完成。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [格式2解析、DTS、内核和启动镜像已构建；services73未安装或启动。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## Firmware and boot {#firmware}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- 复用 Pong UEFI，DarwinBoot24 接管真实可分配区间并使用 PSCI。
+
+### Development findings
+
+- 现有设备可进入桌面，物理内存与可分配内存分别记录。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 固件输入与UEFI源码在独立仓库。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [现有设备可进入桌面，物理内存与可分配内存分别记录。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## CPU and interrupts {#cpu}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- 使用 0x000..0x700 affinity、GICv3 和 19.2 MHz timer。
+
+### Development findings
+
+- CPU 4/3/1 拓扑保持 SM8475；受管内存沿用已启动实现。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 没有声明新的多核稳定性测试结果。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [CPU 4/3/1 拓扑保持 SM8475；受管内存沿用已启动实现。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## Memory and DMA {#memory}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- 从实际不连续 DRAM 和保留区接管已取得所有权的 RAM。
+
+### Development findings
+
+- 物理容量12GiB；此前受管容量9728MiB，不能将物理空洞分配给VM。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 尚未接通全部物理内存。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [物理容量12GiB；此前受管容量9728MiB，不能将物理空洞分配给VM。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## Storage and root {#storage}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- 原生 UFS + 22H374 IOStorageFamily，独立 OS/SystemOS/Data 窗口。
+
+### Development findings
+
+- 8GiB可写UFS Data已有启动记录；本轮只准备本机OS更新，未写入手机。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 分区与镜像输入本地保存。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [本机OS中init及音频策略已更新，设备仍保留services72。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## Display {#display}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- Pong 1080x2412、stride4320；DCS背光和原有显示服务。
+
+### Development findings
+
+- 桌面与壁纸已有显示；120Hz是请求值，不代表测得帧率。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 实际高刷新率和背光仍需设备反馈。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [桌面与壁纸已有显示；120Hz是请求值，不代表测得帧率。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## Input {#input}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- Goodix Berlin-D，PM8350实体按键转HID/原生音量控制。
+
+### Development findings
+
+- services72真实音量press/release到达SBVolumeControl，电源down到达Consumer HID；本轮核对22H374事件接口，未新增虚构设备。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 音量实际生效及独立电源按下/释放后的锁屏动作尚未确认。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [services72已观察真实输入事件，系统动作仍需设备结果。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## GPU {#gpu}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- SM8475 A730、实际固件、SMMU、Turnip与22H374 Metal ABI。
+
+### Development findings
+
+- 已有桌面硬件渲染记录，保留此前高RAM BO和copy分配修补。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 复杂壁纸和长时间稳定性没有新增结论。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [已有桌面硬件渲染记录，保留此前高RAM BO和copy分配修补。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## Network {#network}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- Pong PCIe0/QCA6490，82项PHY序列、GPIO80/94/95/96/204、RPMh。
+
+### Development findings
+
+- services72 PCIe link/BAR及128MiB散页DMA建表成功，停在SMMU context readback；services73按SM8475实现修正先TCR2/TCR后TTBR，编译通过。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 本轮未启动；SMMU启用、QMI固件、扫描与联网仍未确认。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [services72日志定位SMMU写序；services73复用ArmSmmu4K公共编程原语，未实机启动。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## Audio {#audio}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- ADSP/GPR/APM、TFA9873双扬声器、MI2S LPAIF0 tertiary/SD0。
+
+### Development findings
+
+- services72 APM、功放和现代HAL初始化成功；audiomxd因独立AirPlay路由RPC超时退出。services73在launchd前选择原生集成音频provider，运行时已编译。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 尚无StartIO、PCM完成或实际出声证据；不公开麦克风。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [services72的audiomxd堆栈定位CoreMedia路由等待，services73策略与launchd服务门控保持一致。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## Power {#power}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- SM8475 ADSP/RPMh、PMIC battery管理和Pong电源策略。
+
+### Development findings
+
+- DSP readiness和电池协议已有日志；控制器值保持Pong板级来源。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 系统挂起恢复尚未完成。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [DSP readiness和电池协议已有日志；控制器值保持Pong板级来源。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## Image assembly {#packaging}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- Darwin24/XNU11417与22H374原始组件，格式2硬件输入与固定ABI。
+
+### Development findings
+
+- services73使用匹配22H374的IOStorage/IOGPU导入；内核43834376字节，启动镜像102514688字节，构建完成。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- Apple镜像、固件和ABI二进制均需本机准备。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [内核、运行时与启动镜像已构建，产物留在本机；未安装、未启动。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## Diagnostics {#diagnostics}
+
+`implemented`
+
+Components: `PongPlatform24`.
+
+### Hardware and dependencies
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### Configuration
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### Procedure
+
+- 保留屏幕启动日志和ramoops，REC抓取完整console。
+
+### Development findings
+
+- services72的REC日志与audiomxd超时堆栈已分析，services73修补只构建、未启动。
+
+### Completion criteria
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### Current limits
+
+- 本轮未启动，SMMU、联网、PCM声音和按键动作仍需设备结果确认。
+
+### Next action
+
+- 读取本轮启动日志并继续完成板级接口
+
+### Evidence
+
+- `source`: [services72的REC日志与audiomxd超时堆栈已分析，services73修补只构建、未启动。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+</div>

docs/devices/sirius-huajifruit.md

@@ -6,7 +6,7 @@
 
 Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: entry, MMU, timer, PSCI, platform expert and the boot-progress console work on hardware; IOKit is blocked on AppleARMCPU claiming /cpus.
 
-Source record: [porting.toml](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/porting.toml), `86fe9ffbc700915e006fce11474b0d277f0d7dc3`.
+Source record: [porting.toml](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/porting.toml), `06a72d58315e45e7f830a429d683861d2fc536d9`.
 
 This page is generated from the device record.
 
@@ -60,6 +60,15 @@ Components: `ArmDTPlatform`, `DarwinBoot`.
 - Format 2 replaced the hand-written ADT generator of the legacy port \(scripts/make-sirius-adt.py\) with a board DTS: the payload step compiles the tree and derives kernel.macho.adt from it.
 - The arm-io base is derived from the exported nodes, not written by hand: the GIC at 0x17a00000 makes the window start at 0x17000000, which XNU reads as the SoC base.
 - The legacy port set ipad\_identity = true; in format 2 the same identity is the OS profile's \[adt\] tables, so the board only states its deviations.
+- configs/sirius\_defconfig keeps the ARM64 profile's CONFIG\_XNU\_NATIVE\_PAN=y: Kryo 360 implements PAN and SCTLR\_EL1 leaves SPAN clear, so every exception entry sets PSTATE.PAN, and only the PAN build clears it around copyin/copyout \(see the diagnostics area\).
+- CONFIG\_XNU\_NATIVE\_CS\_HASH\_CACHE=y is back on: iPadOS signs code in 16 KiB pages, and this 4 KiB kernel accepts the dyld shared cache's signature only through the native 4K hash cache.
+- The SystemOS cryptex mount \(OWNER\_CACHE\_MOUNT, OWNER\_CACHE\_STARTUP, OWNER\_UNION\_SYSTEMOS\) builds in the bring-up mode BRINGUP\_OWNER\_CACHE, as the uke port does, and its volume is authorized by the boot argument sirius-allow-unverified=1, not by an owner root policy.
+- sirius\_emmc\_hs=3 lets the eMMC driver climb to 25, 50 and 100 MHz, each step proven against blocks read at 400 kHz; the card settles at 50 MHz \(HS\_TIMING 1\).
+- The Data volume: OWNER\_DATA\_MOUNT with SIRIUS\_DATA\_SEED \(NativeEmmc serves the seed instead of RamBlock\) and CONFIG\_XNU\_OWNER\_DATA\_VOLUME\_UUID = EB6CBBA0-ECB9-4556-A483-4B60D54D4306, the volume of the seed that .github/workflows/data-seed.yml built; \[payload.adt\] owned\_memory\_size gives the kernel a 1 GiB window to hold the seed. On the phone the window lands below 4 GiB \(seed at 0xa3cc1000\), the seed is published as the Data window and the kernel mounts its volume \(disk3s1, OwnerData\) at /private/var before launchd.
+- With the Data volume mounted, launchd's mount -P 1 still exits 66: apfs logs 'DT\_get\_fstab\_entries: failed to get filesystem entry at: /filesystems/fstab', and the uke port traced the fatal error to the missing /chosen/boot-manifest-hash. \[adt.chosen.bytes\] boot-manifest-hash now carries uke's explicit bring-up boot-set identity \(SHA-384 of 'UkeBringup.BootSet.v1\\0'\), as asteroids does. On the phone mount-phase-1 and mount-phase-2 then pass and launchd reports 'Early boot complete. Continuing system boot.'
+- Past early boot the 32 MiB Data volume runs out of space \(ENOSPC\) and watchdogd traps \(brk \#1\), which panics the boot. kernel\_args now pass sheng-disable-watchdogd=1 and sheng-lite=1 to package/BootWatchdogPolicy.c \(already linked and called after the Data mount\), which disables watchdogd and the network/iCloud/photo daemons through launchd's disabled.plist, and the seed workflow grows the container to size\_mib \(256 MiB, held in RAM inside the 1 GiB window\); the volume UUID stays across the grow. Not yet booted.
+- Each seed workflow run formats a new volume, so the 256 MiB seed \(run 40621149780, owner-data.cdr 48a10f78...\) has UUID E06A21C1-6686-49B8-B242-ED82B00F4AF8, which the defconfig now names; with the seed inside, the payload files take 306 MiB, so \[payload\] size\_mib is 512 \(the vendor partition holds 3 GiB\).
+- Persistent Data configuration: kernel\_args now passes sirius-data-write=1 so NativeEmmc publishes the persistent Data container behind the root image in userdata read-write; \[payload\] size\_mib is reset to 256 MiB because the Data container no longer travels in the vendor payload volume; .github/workflows/data-seed.yml default container size is updated to 8192 MiB.
 
 ### Completion criteria
 
@@ -69,7 +78,8 @@ Components: `ArmDTPlatform`, `DarwinBoot`.
 ### Current limits
 
 - The SoC profile is new: only the GIC, PSCI, counter and the timer INTID are shared, everything else is still board-local.
-- No device-verified configuration has been recorded against a commit of this repository yet; the evidence is the legacy port's handoff document.
+- The Data seed holds files from the IPSW, so the workflow uploads it encrypted \(ARTIFACT\_PASSPHRASE\) and the payload step takes it from a local path; a new seed has a new volume UUID that the defconfig must follow.
+- The 1 GiB window must start below 4 GiB for the eMMC's 32-bit ADMA2; whether this unit's memory map offers one such run is not yet observed.
 
 ### Next action
 
@@ -78,7 +88,13 @@ Components: `ArmDTPlatform`, `DarwinBoot`.
 
 ### Evidence
 
-- `source`: [Hardware values, the boot chain and the bring-up history of the legacy port, from which this configuration is carried over.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Hardware values, the boot chain and the bring-up history of the legacy port, from which this configuration is carried over.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
+- `device`: [With CONFIG\_XNU\_NATIVE\_PAN=y the driver reads PAN as 4194304, all eight CPUs pass the init copyout and launchd's first syscalls return.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-pan.log)
+  Command: <code>fastboot flash vendor payload-E-pan-noclear.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420</code>. Revision: `b1a11c4f4eb0bfd28b2dd3dfc59b3c7e3a3e742f`.
+- `device`: [With the SystemOS mount, the 4K hash cache and sirius\_emmc\_hs=3 the shared cache is verified in about 104 s at 50 MHz and dyld maps it.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-fast-emmc.log)
+  Command: <code>fastboot flash vendor payload-H-fast.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 900</code>. Revision: `1163990229f446753ef006126e55922aa23bda6a`.
+- `host`: [Run 40615426205 built owner-data-32.cdr \(33554432 bytes, sha256 5679d2cf59eba99aa048be0c0e253581aa5bfb1fdff7ff431ed9e91c2bd58c63\) with APFS volume EB6CBBA0-ECB9-4556-A483-4B60D54D4306.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/.github/workflows/data-seed.yml)
+  Command: <code>gh workflow run data-seed.yml -R HuajiFruit/UniXNU-sirius --ref main</code>. Revision: `9562de8b362e6bbae9844052826c609996866aed`.
 
 ## Firmware and boot {#firmware}
 
@@ -124,7 +140,7 @@ Components: `DarwinBoot`.
 
 ### Evidence
 
-- `source`: [Boot-chain diagram, the marker-file boot rule and the DarwinBoot GIC pre-configuration rationale.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Boot-chain diagram, the marker-file boot rule and the DarwinBoot GIC pre-configuration rationale.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## CPU and interrupts {#cpu}
 
@@ -169,7 +185,7 @@ Components: `ArmCpu`.
 
 ### Evidence
 
-- `source`: [Timer INTID measurement, the TOPO checkpoint and the AppleARMCPU panic analysis.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Timer INTID measurement, the TOPO checkpoint and the AppleARMCPU panic analysis.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## Memory and DMA {#memory}
 
@@ -208,7 +224,7 @@ Components: `ArmCpu`.
 
 ### Evidence
 
-- `source`: [DRAM split, framebuffer address and the memory-map checkpoint.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [DRAM split, framebuffer address and the memory-map checkpoint.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## Storage and root {#storage}
 
@@ -250,6 +266,18 @@ Components: `ArmCpu`.
 - The init exec returns 0 and then nothing asks the driver for another block: reads stop at 0x10D \(269 requests, 0x98F blocks\) while the heartbeat keeps counting, so the wait is past the storage stack. The caller side is now instrumented \(sirius-post-exec-trace.patch\): the exec thread-switch state, every new user thread start at thread\_bootstrap\_return, the first pid 1 syscalls with their returns, each bsd\_ast for pid 1 and the first user faults after the exec, all written to the same USB ring and summarised by the heartbeat.
 - The caller-side probe closes that question: the pid 1 thread stays in load\_init\_program\_at\_path, inside copyout\(\) of the launchd path, and takes 62.6 million faults in about a minute. The stall is a fault loop in the exec path, not a storage wait.
 - That fault loop was PAN \(see the diagnostics area\). With CONFIG\_XNU\_NATIVE\_PAN=y and the driver no longer clearing PAN, all eight CPUs pass the copyout, the exec returns 0 and launchd issues its first syscalls, every one of them returning: 74, 372, 294, 20, 427, 381, 5, 90, 4 and 202. Syscall 294 \(shared\_region\_check\_np\) returns ENOMEM with 'vm\_shared\_region\_start\_address\(\) failed', i.e. dyld finds no shared cache mapped; afterwards the launchd thread waits and the read count stays at 0x113.
+- The shared cache is in the SystemOS cryptex. Building the ARM64 series' owner SystemOS mount \(OWNER\_CACHE\_MOUNT, OWNER\_CACHE\_STARTUP, OWNER\_UNION\_SYSTEMOS, with BRINGUP\_OWNER\_CACHE as the uke port has it\) and answering its two block hooks from NativeEmmc \(sirius-allow-unverified=1\) mounts disk4s1 \(SystemCryptex, 8846FE78-2910-4297-AF97-D59BB6F8FC16\) as a union over / before launchd starts; dyld then opens the cache, fstats it and preads its header.
+- Registering the cache's code signature \(fcntl, syscall 92\) then returned 85 \(EBADEXEC\): iPadOS signs code in 16 KiB pages, and this 4 KiB kernel only accepts that through native-4k-signature-hash-cache.patch, which the first-console configuration had off. With CONFIG\_XNU\_NATIVE\_CS\_HASH\_CACHE=y the call returns 0 after the kernel reads the whole cache once, and dyld maps it \(197 and 73 return 0\).
+- The block driver ran at the 400 kHz identification clock all along: sirius\_emmc\_prepare\(\) reprogrammed it after the probe's 25 MHz switch, and every 512-byte block was its own CMD17 with five ring lines. On this 8-bit bus that is about 770 blocks/s, and the 2.81 GiB cache took two hours. Multi-block reads \(CMD18 with Auto-CMD12, 256 blocks per command through an ADMA2 table\) and a clock ladder proven against blocks read at 400 kHz bring it to 50 MHz: EXT\_CSD reports rev 8, width 2 \(8-bit\), HS\_TIMING 1 and DEVICE\_TYPE 0x57, runs pass with EIS 0, and the whole cache is read in about 104 s \(27 MiB/s on average, 30 MiB/s peak\).
+- Past the shared cache launchd runs its boot tasks: mount \(pid 3\) exits with status 66 \(EX\_NOINPUT\) and the boot panics with 'mount\[3\] exited'. There is no Data volume yet, which is the mount it needs.
+- NativeEmmc serves the Data seed itself instead of RamBlock: the payload's /chosen/memory-map/RAMDisk becomes a read-write RAM window named Data, and the driver answers the two RamBlock entry points kern\_exec.c calls once its seed path is compiled in, native\_ram\_block\_volume\_seed\(\) \(the Data volume on that window\) and native\_ram\_block\_gpu\_addon\(\) \(none on this board; the first link failed on it as an undefined symbol although its declaration is weak\). IOMaximumBlockCountRead is 2048 blocks now that transfers run in 256-block commands.
+- Once userland read in parallel, APFS reported data hash mismatches on the sealed SystemOS volume \(disk6s1\). The block driver drains requests on their callers' threads through one shared bounce buffer, and released the transport lock between the read into it and the copy out of it, so a second reader could refill it first and the first request received the other one's blocks. The copy now happens under the lock \(the request's memory is wired for the I/O, so it cannot fault back into the driver\). Not yet booted.
+- native\_ram\_block\_volume\_seed\(\) takes the one APFS volume on the RAM window instead of looking the kernel's UUID up, since a Data seed can only be there and every seed build has a new UUID; a differing UUID is reported, not refused, so a new seed no longer needs a new kernel.
+- With the copy under the lock, a 256 MiB seed, sheng-disable-watchdogd=1 and sheng-lite=1, the boot runs without a panic for the whole capture \(heartbeat at 336 s\): no data hash mismatch is reported, the watchdog policy disables watchdogd, early boot completes at 170 s and only liveactivitiesd crashes. The Data volume then fills about a minute after early boot; containermanagerd \(first-boot data containers\), launchd, analyticsd and APFS itself hit ENOSPC.
+- Persistent Data write path and fences: package/sirius\_emmc.c implements block writes via CMD24/CMD25 with Auto-CMD12 over ADMA2, polls CMD13 until the card exits programming state with error checking, and issues CMD6 FLUSH\_CACHE when EXT\_CSD CACHE\_CTRL is active. Writes are strictly fenced twice: once to the single window opened by sirius\_emmc\_set\_write\_window\(\), and globally to the userdata partition boundary minus its first MiB \(protecting the SHNGROOT manifest\).
+- Persistent Data container window: package/NativeEmmc.cpp implements prepareDataWindow\(\), locating the first MiB boundary behind the root image \(userdata LBA 35627008\) and verifying the NXSB APFS superblock before publishing a read-write eMMC block device when sirius-data-write=1. Writes are drained through the software queue keeping the bounce buffer under the transport lock in both directions, doSynchronizeCache flushes the eMMC write cache, and native\_ram\_block\_volume\_seed\(\) resolves the Data volume on whichever window exists.
+- scripts/make-data-window-image.py converts the grown 8 GiB APFS Data container into a fastboot sparse image for userdata: a DONT\_CARE chunk leaves the root image untouched, RAW chunks write nonzero blocks, and FILL chunks write zero blocks so free space reads as zero on device.
+- Persistent Data volume verified on hardware: with sirius-data-write=1 and the 8 GiB container flashed via data-window.simg behind the root image, NativeEmmc opens the write window at LBA 35627008 \(16777216 blocks\), mounts disk3s1 \(OwnerData, 0C28586B-...\), early boot completes at 159.6 s, and APFS commits transactions up to xid 85 with 0 ENOSPC errors across the entire capture.
 
 ### Completion criteria
 
@@ -257,30 +285,44 @@ Components: `ArmCpu`.
 
 ### Current limits
 
-- Read-only: the transfer path has no write command and reportWriteProtection\(\) says so.
-- After launchd's first syscalls the driver receives no further requests \(reads stay at 0x113\): dyld finds no shared region and the launchd thread then waits; the probe logs only the first 24 pid 1 syscalls, so the call it waits in is not recorded yet.
-- The card clock is still the identification rate \(400 kHz, about 550 blocks/s measured\); nothing raises it to high speed yet.
+- Writes are strictly fenced to the persistent Data window on userdata \(LBA 35627008, 8 GiB\); the rest of the card remains read-only.
+- The card runs at 50 MHz in high-speed SDR on 8 bits \(about 30 MiB/s\). It supports DDR52 and HS200 \(DEVICE\_TYPE 0x57\), but DDR needs the host's DDR mode and HS200 needs tuning, and neither is implemented; 100 MHz is only tried when the boot chain already left HS200 timing.
+- The SystemOS volume is authorized by a bring-up boot argument \(sirius-allow-unverified=1\), not by an owner root policy.
 - The exec policy no longer needs a boot argument: the payload carries the original trust-cache bundle and the kernel initialises its runtime at startup. The sirius-skip-cs bypass is kept in the patch series, unused, in case a future image falls outside the bundle.
 
 ### Next action
 
-- Verify the 25 MHz switch \(sirius\_emmc\_hs=1\) reads the GPT signature back and measure the new block rate; then decide whether the CMD6 high-speed switch to 50 MHz is worth it.
+- Display driver: U-Boot leaves a 1080x2240 splash framebuffer at 0x9c000000; bind GopFramebuffer or NativeLegacyDisplay to get screen output past SpringBoard.
+- Touch driver: Synaptics S3706 adapter from the fajita reference.
 - Keep the trust-cache bundle in step with the OS build when the IPSW changes \(its sha256 is pinned in board.toml \[payload\] trust\_cache\_sha256\).
-- Find how dyld gets the shared cache: the OS profile's working ports \(tb128fu, asteroids\) map it after the same exec, so compare their SystemOS cryptex handling with this board's.
-- Raise the pid 1 syscall log beyond 24 entries and mirror launchd's stderr writes into the USB ring, so the call launchd waits in and dyld's own message are recorded.
-- Raise the SDCC1 clock out of identification speed \(GCC root clock plus the card's high-speed mode\).
+- Raise the pid 1 syscall log beyond 24 entries and mirror launchd's stderr writes into the USB ring, so later boot-task failures name their call and message.
+- For more storage speed: DDR52 \(8-bit DDR at 52 MHz, no tuning\) roughly doubles the rate; HS200 needs the msm tuning sequence.
 
 ### Evidence
 
-- `device`: [NativeEmmc starts from bsd\_init, publishes 0x747BFDF blocks of 512 bytes, and IOStorageFamily reads block 0, block 1 and block 2 with 21 sectors \(the 84 GPT entries\) through doAsyncReadWrite; the heartbeat keeps ticking with the transfer count fixed at seven, so the boot ends at the root-device wait. Log in docs/HANDOFF.zh-CN.md.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `device`: [kernel.macho 66d0319c718f6faf894d1d713759b5d82d8da010c3bd2ad2c2c13bd195574a88, payload c0d2e62c0738d6c851eeeebccf0236a310bcd14194df0ea1735efaef647420e6: EMMC write window opened at LBA 35627008 \(16777216 blocks, 8 GiB\), NativeEmmc discovers NXSB container and mounts persistent Data volume disk3s1 \(OwnerData, 0C28586B-...\), early boot complete at 159.6 s, APFS transactions commit through xid 85 with 0 ENOSPC errors up to 280 s.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-pdata.log)
+  Command: <code>fastboot -S 512M flash userdata data-window.simg; fastboot flash vendor payload-M-pdata.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `e73a8ecda8998ec36573c5bd2a9d7b6389305b2d`.
+- `device`: [NativeEmmc starts from bsd\_init, publishes 0x747BFDF blocks of 512 bytes, and IOStorageFamily reads block 0, block 1 and block 2 with 21 sectors \(the 84 GPT entries\) through doAsyncReadWrite; the heartbeat keeps ticking with the transfer count fixed at seven, so the boot ends at the root-device wait. Log in docs/HANDOFF.zh-CN.md.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
   Command: <code>fastboot flash vendor sirius-obs.img; fastboot reboot; capture-usb-console.py --duration 240</code>. Revision: `d867b1d6498dc4d0f4ae4e18060762dcae6c5847`.
-- `host`: [The kernel links with NativeEmmc in the image \(kernel.macho sha256 372820eb1b2cd9ecee15d769d1296771d0c8141c2681626d54651a62473446b8\); the GitHub macOS runner builds the same archive \(kernel workflow run 40386710258\).](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `host`: [The kernel links with NativeEmmc in the image \(kernel.macho sha256 372820eb1b2cd9ecee15d769d1296771d0c8141c2681626d54651a62473446b8\); the GitHub macOS runner builds the same archive \(kernel workflow run 40386710258\).](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
   Command: <code>./scripts/xnu-container.sh run bash -lc './unixnu build kernel --skip-setup -D ../sirius'</code>. Revision: `a47f0d6b4615c3cdebf92102400a1bc302eb6d73`.
-- `device`: [APFS mounts disk0/disk1s1/disk2s1, bsd\_init completes, execve of /sbin/launchd prints activate enter, namei 0, 'exec policy answered 1, skipped by boot arg' and finally 'execve activate 0'; the driver then has no transfer in flight and the read count stops at 0x10D, so the remaining wait is past storage.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `device`: [APFS mounts disk0/disk1s1/disk2s1, bsd\_init completes, execve of /sbin/launchd prints activate enter, namei 0, 'exec policy answered 1, skipped by boot arg' and finally 'execve activate 0'; the driver then has no transfer in flight and the read count stops at 0x10D, so the remaining wait is past storage.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
   Command: <code>fastboot flash vendor sirius-if.img; fastboot reboot; capture-usb-console.py --duration 220</code>. Revision: `bb812428dccd1f676455813ad198ed2bee4a8e3e`.
-- `device`: [kernel.macho 6f0d59b13e4ac3861c902962df8043c3bccac959cffcd859c5f965f697194d17, payload 00c8f4d7feba7982c1fcdcb2f072121d6b7a227fc38ebc0edd229bbd00b5bb08, eight CPUs: PAN reads 4194304, init path copyout 0, execve activate 0, two user thread starts, then launchd syscalls 74 372 294 20 427 381 5 90 4 202 all return; 294 returns 12 with 'vm\_shared\_region\_start\_address\(\) failed' and reads stay at 0x113.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/evidence/sirius-usb-console-20261027-pan.log)
+- `device`: [kernel.macho 6f0d59b13e4ac3861c902962df8043c3bccac959cffcd859c5f965f697194d17, payload 00c8f4d7feba7982c1fcdcb2f072121d6b7a227fc38ebc0edd229bbd00b5bb08, eight CPUs: PAN reads 4194304, init path copyout 0, execve activate 0, two user thread starts, then launchd syscalls 74 372 294 20 427 381 5 90 4 202 all return; 294 returns 12 with 'vm\_shared\_region\_start\_address\(\) failed' and reads stay at 0x113.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-pan.log)
   Command: <code>fastboot flash vendor payload-E-pan-noclear.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420</code>. Revision: `b1a11c4f4eb0bfd28b2dd3dfc59b3c7e3a3e742f`.
-- `source`: [SDCC1 bring-up, the ADMA2 read path and the GPT parse.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/package/sirius_emmc.c)
+- `device`: [kernel.macho 5d045f1a6d6ddad44331a7e6ea8b1cc74a8c84058916287a83603ab912a66038, payload 6b6c562c1e8c91eb2c776fc6ef5f58227fd9eb000872ddb6e2fff6844886515a: NEMMC owner volume /dev/disk4s1, disk4s1 \(SystemCryptex, 8846FE78-...\) mount-complete before launchd; dyld opens, fstats and preads the cache, then fcntl \(92\) returns 85.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-systemos.log)
+  Command: <code>fastboot flash vendor payload-F-systemos.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420</code>. Revision: `24f6094010c728ecfdf3e3bbacd0effaeec60fb5`.
+- `device`: [kernel.macho a10c51aa4fab72faf86912e1ca6736c0d068432ceff1b233f47948197848b8c4, payload 8402424eb1d9d4126cfe19ab2eb3742aad40d7ba5149267534ae94a7e745c2ce: fcntl \(92\) no longer fails and stays in the kernel's whole-file hash check, reading about 770 blocks/s \(400 kHz on 8 bits\) with the pid 1 fault count flat.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-systemos.log)
+  Command: <code>fastboot flash vendor payload-G-cshash.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 1800</code>. Revision: `86fe9ffbc700915e006fce11474b0d277f0d7dc3`.
+- `device`: [kernel.macho 3452714ae8b3ef3b775bed9cde5f93c11fc2d147e0375eec22430fb0dcf70999, payload 24118c6275d90fba6dd3e684353d4525640c7d627042092868a413609686f110: ext\_csd rev 8 width 2 timing 1 type 0x57, multi=ok eis 0, 25 and 50 MHz ok; 5898655 blocks \(2.81 GiB\) in about 104 s; fcntl 92, mmap 197 and munmap 73 return 0, then 'mount\[3\] exited ... exit status 66' panics the boot.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-fast-emmc.log)
+  Command: <code>fastboot flash vendor payload-H-fast.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 900</code>. Revision: `1163990229f446753ef006126e55922aa23bda6a`.
+- `device`: [kernel.macho 2e6e1ddc51b1f8b2d58c607477f81b0327d95f301382d8d4c1180096b402408a, payload 2bd98aa417ab6007b8c95c2071f4907dee5b4afcd09ac3899604e73dc9d21bff: NEMMC data seed at 0xa3cc1000 \(33554432 bytes\), Data volume disk3s1 \(OwnerData, EB6CBBA0-...\) mount-complete before launchd, shared cache verified; at 157.7 s mount \(pid 3\) exits 66 after 'DT\_get\_fstab\_entries: failed to get filesystem entry at: /filesystems/fstab'.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-data.log)
+  Command: <code>fastboot flash vendor payload-I-data.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `33509e84db86517ff9bf349408dc66ab39c43d18`.
+- `device`: [kernel.macho 2e6e1ddc51b1f8b2d58c607477f81b0327d95f301382d8d4c1180096b402408a, payload aa917c707d2f0a8f46ae44e635b838e7e3892822c115c0233bdb5bd3e2bae323: launchd runs every boot task through mount-phase-2 and logs 'Early boot complete' at 161.5 s; driverkitd, MobileGestaltHelper, mobileassetd and SpringBoard start; the Data volume reaches ENOSPC at 175.6 s, APFS reports three data hash mismatches on disk6s1, and watchdogd's brk \#1 exit panics the boot at 191.9 s.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-early-boot.log)
+  Command: <code>fastboot flash vendor payload-J-bmh.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `09096e3738c618bb18a51af50cdfbc7f6431aa59`.
+- `device`: [kernel.macho dd22531c552b5e87208268f3faf793b7acd2516961d45f44e82d3e15b9d86e8c, payload f93d3f9b72b45bb4a4248bd7637e0e8d616472eb28da2d4d5cf479c3574f36b6: seed of 268435456 bytes at 0xa3cc1000, Data volume disk3s1, watchdogd policy applied, early boot complete at 170 s, no hash mismatch, no panic up to 336 s; ENOSPC on disk3s1 from 230 s.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-data256.log)
+  Command: <code>fastboot flash vendor payload-L-data256.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `396fdab90dc5b94a830e5a43e5a9084313796683`.
+- `source`: [SDCC1 bring-up, the ADMA2 read path and the GPT parse.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/package/sirius_emmc.c)
 
 ## Display {#display}
 
@@ -321,7 +363,7 @@ Components: `ArmCpu`.
 
 ### Evidence
 
-- `source`: [Boot-progress panel behaviour, the panic snapshot fix and the geometry of the U-Boot framebuffer.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Boot-progress panel behaviour, the panic snapshot fix and the geometry of the U-Boot framebuffer.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## Input {#input}
 
@@ -505,7 +547,7 @@ Collect evidence using the next action.
 
 ### Evidence
 
-- `source`: [PSCI reset evidence and the reason sleep is disabled.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [PSCI reset evidence and the reason sleep is disabled.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## Image assembly {#packaging}
 
@@ -561,7 +603,7 @@ Components: `XnuPrelink`.
 
 ### Evidence
 
-- `source`: [Build and deploy loop, the CI kernel artifact and the payload layout on the vendor partition.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Build and deploy loop, the CI kernel artifact and the payload layout on the vendor partition.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## Diagnostics {#diagnostics}
 
@@ -597,6 +639,13 @@ Components: `XnuPrelink`.
 - The loop is not limited to the copyout: with the trust-cache bundle back in the payload the exec completes \(execve activate 0, AMFI answers nothing\) and the exec'd thread enters userland at pc 0x100924e50, where it takes 92 million instruction aborts in about a minute on three addresses \(ESR 0x82000007, level-3 translation faults\) without ever issuing a syscall or a single block read; the entry point is right, the code pages are simply not visible to the CPU.
 - Both loops have the same shape: vm\_fault opens the page in thread-&gt;map's pmap and returns KERN\_SUCCESS, while the CPU keeps taking the fault. AT S1E1W and pmap\_find\_phys disagree about the physical page behind 0x1000, which points at the CPU running with a pmap that is not the thread's after the exec task switch.
 - A payload built without --trust-cache leaves the ring reporting no external trust caches found and AMFI kills launchd with namespace 9 \(OS\_REASON\_EXEC\) code 8; the same kernel with the bundle present reaches execve activate 0 without an exec-policy line, so that panic is a build-argument slip, not a regression.
+- The console can be captured on Windows: usbser.sys binds it as a COM port \(USB\\VID\_1209&amp;PID\_0001, serial SIRIUS01\) and capture-usb-console.py opens it with plain Win32 calls, because the gadget does not answer SET\_LINE\_CODING and SetCommState \(and pyserial\) fail with error 121.
+- The ring has no timestamps and is replayed whole on every poke, so capture-usb-console.py --timeline records when each distinct line first arrives; a timed boot shows 51 s from fastboot reboot to the eMMC driver, the shared-cache check until about 168 s and the mount panic at 171.7 s. A hard panic stops the kernel before the heartbeat mirrors its text, so --idle-stop ends a capture after a silence instead.
+- NativeEmmc reports the Data seed as 'NEMMC data seed at/bytes' when it publishes the RAM window and 'NEMMC data volume /dev/...' when the owner Data mount asks for it, or 'NEMMC data volume not found on the seed'.
+- When the seed's volume UUID differs from CONFIG\_XNU\_OWNER\_DATA\_VOLUME\_UUID the driver logs 'NEMMC data volume is &lt;seed UUID&gt;, the kernel names &lt;configured UUID&gt;' and mounts it anyway.
+- capture-usb-console.py --duration counts from the script's start: counted from the port, which a boot brings up after about a minute, a 280 s capture ran about 5.6 minutes.
+- Persistent Data diagnostics: the driver logs 'EMMC write window lba=... blocks=... cache=...' on window configuration, reports EXT\_CSD CACHE\_CTRL in the probe, logs fallback to single-block writes if a multi-block write command fails, logs 'NEMMC data window lba=... blocks=...' when the persistent container is discovered, logs 'NEMMC data volume \(eMMC\) ...' or 'NEMMC data volume \(RAM\) ...' when resolved, and logs 'NEMMC write failed lba ...' on write errors.
+- With the persistent 8 GiB Data volume, the entire boot capture runs past early boot \(159.6 s\) up to 280 s with zero ENOSPC lines \(vs 187 on the 256 MiB RAM seed\); containermanagerd, launchd, and analyticsd write without running out of disk space; APFS transaction flushes advance through xid 85; SpringBoard \(pid 118\) and liveactivitiesd \(pid 128\) crash for want of a display/framebuffer driver.
 
 ### Completion criteria
 
@@ -612,9 +661,15 @@ Components: `XnuPrelink`.
 
 ### Evidence
 
-- `source`: [Entry probe, panic screen, panel rows and the evidence convention of the port.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
-- `device`: [3813 bytes of kernel log read from /dev/ttyACM0 over the DWC3 CDC console.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/evidence/sirius-usb-console-20261026-1605.log)
+- `source`: [Entry probe, panic screen, panel rows and the evidence convention of the port.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
+- `device`: [3813 bytes of kernel log read from /dev/ttyACM0 over the DWC3 CDC console.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261026-1605.log)
   Command: <code>sudo python3 scripts/capture-usb-console.py --wait 60 --duration 190 --output /tmp/boot.log</code>. Revision: `366abe2948fdb0c1554f7e0b89b731160f4527a4`.
+- `device`: [Captured on Windows \(COM7\) with --timeline: the Data seed and both owner volumes appear at 52 s after fastboot reboot, the mount panic text at 158.3 s, and the capture stopped on its marker after 5.4 MB.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-data.log)
+  Command: <code>python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/I-data.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `33509e84db86517ff9bf349408dc66ab39c43d18`.
+- `device`: [launchd's own \[System Event\] boot-task lines reach the USB ring, so the timeline shows each task as it starts; the heartbeat mirrored watchdogd's panic text at 191.9 s and the capture stopped on it.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-early-boot.log)
+  Command: <code>python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/J-bmh.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `09096e3738c618bb18a51af50cdfbc7f6431aa59`.
+- `device`: [Timeline capture of the 8 GiB persistent eMMC Data volume: write window logged at 44.8 s, Data volume disk3s1 \(eMMC\) mounted at 45.0 s, early boot complete at 159.6 s, tx\_flush commits through xid 85, no ENOSPC or panics up to 280 s.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-pdata.log)
+  Command: <code>python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/M-pdata.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `e73a8ecda8998ec36573c5bd2a9d7b6389305b2d`.
 
 ## boot-chain {#boot-chain}
 
@@ -665,7 +720,7 @@ Components: `XnuPrelink`.
 
 ### Evidence
 
-- `source`: [The build recipe, the four environment lines that add the UniXNU chain, and the two partition/short-scan traps.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/uboot/README.md)
-- `source`: [Provenance of the vendored EDK II package \(framework commit f85b5a6\) and what the payload takes from it.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/efi/README.md)
+- `source`: [The build recipe, the four environment lines that add the UniXNU chain, and the two partition/short-scan traps.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/uboot/README.md)
+- `source`: [Provenance of the vendored EDK II package \(framework commit f85b5a6\) and what the payload takes from it.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/efi/README.md)
 
 </div>

docs/zh/devices/alioth.md

@@ -6,7 +6,7 @@
 
 Device template. Complete each area with board-specific inputs and evidence.
 
-源记录: [porting.toml](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/porting.toml), `695a35bd11337a27473a1ef6687977c0527b6878`.
+源记录: [porting.toml](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/porting.toml), `0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d`.
 
 本页按设备记录自动生成。
 
@@ -14,11 +14,11 @@ Device template. Complete each area with board-specific inputs and evidence.
 | --- | --- |
 | [配置](#configuration) | `planned` |
 | [固件与启动](#firmware) | `planned` |
-| [CPU 与中断](#cpu) | `planned` |
+| [CPU 与中断](#cpu) | `implemented` |
 | [内存与 DMA](#memory) | `planned` |
 | [存储与根卷](#storage) | `device-verified` |
 | [显示](#display) | `implemented` |
-| [输入](#input) | `planned` |
+| [输入](#input) | `implemented` |
 | [GPU](#gpu) | `planned` |
 | [网络](#network) | `planned` |
 | [音频](#audio) | `planned` |
@@ -102,23 +102,25 @@ Device template. Complete each area with board-specific inputs and evidence.
 
 ## CPU 与中断 {#cpu}
 
-`planned`
+`implemented`
 
 ### 硬件与依赖
 
-- Identify the cpu and interrupts hardware, resources and existing component interfaces for this board.
+- kona: four Cortex-A55 \(cpu0-3\) and four Cortex-A77 \(cpu4-7\), MPIDR core number in Affinity1 so phys ids are 0x000-0x700. Interrupts and timers come from the ArmCpu component; secondary start is PSCI CPU\_ON over smc.
 
 ### 配置
 
-- Record the board.toml fields, DTS properties and defconfig values used for cpu and interrupts.
+- board.toml: sheng-smp=1 starts secondary CPUs, armcpu-spi-ipi=1 routes IPIs through software-pended SPIs, armcpu-self-ipi=1 makes each core signal itself so XNU enables its IPI \(a component argument, not one of the documented boot arguments\), armcpu-diagnostics=1 reports the bring-up. dts: unixnu,cluster-type E on cpu0-3 and P on cpu4-7.
 
 ### 操作步骤
 
-- Follow the cpu and interrupts stage in the porting guide and record the actual commands.
+- Apply both SoC patches \(native-smp-secondary, native-smp-type-clusters\) through the SoC repository's patch series, then build kernel, payload and boot image and boot over USB. Verify in the build tree that MAX\_CPUS is 8 in the BCM2837 block, MAX\_CPU\_CLUSTERS is 2 and \_\_ARM\_AMP\_\_ survives the later \#undef.
 
 ### 开发经验
 
-- Collect the first cpu and interrupts observation, its cause when established, and the resulting implementation decision.
+- Without native-smp-secondary.patch the reset vector masks MPIDR with 0xFF, which is Aff0 and is zero for every kona core, so every secondary core picked the boot CPU's cpu\_data and reset handler. The boot either panicked with Invalid kernel stack pointer or hard-locked with interrupts off in early initialisation.
+- unixnu,cluster-type must never ship without native-smp-type-clusters.patch. With MAX\_CPU\_CLUSTERS still 1 the topology parser takes phys\_cluster\_id = \(cluster\_type == P\), which is 1, and writes cluster\_phys\_to\_logical\[1\] past the end of a one-element stack array. Release builds do not assert: the kernel dies before the console comes up. scripts/check-smp-topology.py refuses that combination.
+- Both patches are private to UniXNU-pipa, not present in UniXNU/UniXNU. They live in the SM8250 SoC repository because the topology they describe is a property of the SoC, which is why the pins differ from the SM8550 device's.
 
 ### 完成条件
 
@@ -126,15 +128,16 @@ Device template. Complete each area with board-specific inputs and evidence.
 
 ### 当前范围
 
-- Hardware inputs and implementation are pending for this example board.
+- Secondary CPUs have not been brought up on hardware yet. The two patches are applied only in the build feed checkout, not yet committed to FFT-infra/UniXNU-sm8250-common, so a fetch or tree refresh loses them.
+- unixnu,cluster-type is still declared in the board DTS rather than the SoC DTSI.
 
 ### 下一步
 
-- Inventory the required cpu and interrupts inputs before implementation.
+- Boot the image carrying both patches and read SMP run count, armcpu\_smp\_step, psci\_rc and the boot time.
 
 ### 证据
 
-按下一步操作收集证据。
+- `source`: [Refuses a device tree that declares cluster-type without the cluster patch applied and MAX\_CPU\_CLUSTERS >= 2, the combination that killed three boots silently.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/scripts/check-smp-topology.py)
 
 ## 内存与 DMA {#memory}
 
@@ -216,7 +219,7 @@ Device template. Complete each area with board-specific inputs and evidence.
 
 ### 证据
 
-- `device`: [The kernel reports cryptexd aborting with mkdirat ENOSPC while the Data volume reports 31 MiB free, which places the failing write on a mount other than /private/var.](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/docs/evidence/2026-10-27-boot-diagnostics.md)
+- `device`: [The kernel reports cryptexd aborting with mkdirat ENOSPC while the Data volume reports 31 MiB free, which places the failing write on a mount other than /private/var.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/docs/evidence/2026-10-27-boot-diagnostics.md)
   Command: <code>read /dev/tty.usbmodem&lt;N&gt; at 115200 8N1 and collect EXITLOG records</code>. Revision: `24d127c47217eb580dbe3f3a94c32ad25cbaae00`.
 
 ## 显示 {#display}
@@ -259,28 +262,32 @@ Device template. Complete each area with board-specific inputs and evidence.
 
 ### 证据
 
-- `device`: [DISPLAY stage=10 with CLIENT calls=4 class=IOMobileFramebufferUserClient, and SWAP calls=0: a client connects but no frame is submitted.](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/docs/evidence/2026-10-27-boot-diagnostics.md)
+- `device`: [DISPLAY stage=10 with CLIENT calls=4 class=IOMobileFramebufferUserClient, and SWAP calls=0: a client connects but no frame is submitted.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/docs/evidence/2026-10-27-boot-diagnostics.md)
   Command: <code>read the diagnostic page and the USB console after booting the image</code>. Revision: `24d127c47217eb580dbe3f3a94c32ad25cbaae00`.
 
 ## 输入 {#input}
 
-`planned`
+`implemented`
+
+组件: `QcomGeniSpi`, `ShengHidInput`, `ShengNovatekTouch`.
 
 ### 硬件与依赖
 
-- Identify the input hardware, resources and existing component interfaces for this board.
+- FocalTech FT5652 on GENI SE4 \(QUPv3 wrapper 0\), per alioth-sm8250.dtsi: spi-max-frequency 6000000, interrupts &lt;39 0x2008&gt;, reset GPIO 33, irq GPIO 39, vdd L10C, vcc\_i2c L1C, display-coords 0 0 8640 19200, max-touch-number 10.
 
 ### 配置
 
-- Record the board.toml fields, DTS properties and defconfig values used for input.
+- board.toml: native-touch=1 starts kits/alioth-touch, sheng-touch-hid=1 enables the publication path in ShengHidInput, native-touch-diag=1 is a measurement-only round and must be removed for release images. SPI clock is the device tree's 6 MHz; the source is TCXO 19.2 MHz on DFS level 0.
 
 ### 操作步骤
 
-- Follow the input stage in the porting guide and record the actual commands.
+- Build with component ShengHidInput selected and the board display recipe, which invokes build-sheng-hid-input.py and archives NativeHidInput.late.o plus hid-original-bindings.o into the force-loaded libNativeLegacyDisplay.late.a. Then build payload and boot image, verify the payload carries the built kernel, and boot over USB.
 
 ### 开发经验
 
-- Collect the first input observation, its cause when established, and the resulting implementation decision.
+- The part answers register reads \(ID 0x5652\) and returns a CRC-correct all-0xFF buffer while it has no report; an earlier version of FocalTouchProtocol.c treated that buffer as a successful empty frame, which is why every image reported frames=valid with contacts=0.
+- Frame reads gated on GPIO 39 going low produced real contacts: at t=100 s two contacts, low count 284, raw 0002805f4598; the part's interrupt counter 0x8F rose from 01 to e0 and its work counter 0x91 advances 60 per second, so the sensor, the SPI link, the CRC and the interrupt line are all working.
+- The HID publisher was never in the kernel: ShengHidInput compiles NativeHidInput.cpp but nothing archived it, and an object with no inbound reference is dropped from a plain archive. Selected as a component and archived by the display recipe, as UniXNU-sheng does, it links.
 
 ### 完成条件
 
@@ -288,15 +295,16 @@ Device template. Complete each area with board-specific inputs and evidence.
 
 ### 当前范围
 
-- Hardware inputs and implementation are pending for this example board.
+- No HID report has reached the OS yet: native\_touch\_hid\_reports stays 0 while contacts arrive, so the remaining work is the publication path, not the sensor.
+- Buttons are not implemented on this board.
 
 ### 下一步
 
-- Inventory the required input inputs before implementation.
+- Boot the image that carries the archived HID objects and confirm native\_touch\_hid\_reports rises and the UI responds to a swipe.
 
 ### 证据
 
-按下一步操作收集证据。
+- `source`: [Frame parsing treats an all-0xFF payload as no data, decodes 15-bit coordinates with the low bits in the pressure byte, and records the CRC it compared so 'passed' is visible rather than inferred.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/kits/alioth-touch/FocalTouchProtocol.c)
 
 ## GPU {#gpu}
 
@@ -500,6 +508,7 @@ Device template. Complete each area with board-specific inputs and evidence.
 - ./unixnu build kernel, then build payload and bootimg, then fastboot flash boot\_b.
 - Read the console at /dev/tty.usbmodem&lt;N&gt; with a raw 115200 8N1 tty; the dock's SN234567892 node is not the phone.
 - Control frames are SXNU1 &lt;16 hex session&gt; &lt;8 hex seq&gt; &lt;VERB&gt; &lt;8 hex crc32&gt;, HELLO first to learn the session.
+- One unattended round is scripts/run-sheng-unattended.sh &lt;image&gt; \[timeout\]: fastboot boot the image, wait for the board's own return, boot the reader from slot a, read and decode into build/sheng-logs/&lt;tag&gt;-&lt;boot id&gt;/, then restore the slot. Fail-closed, and the timeout must exceed sheng-autoreset by 60 s.
 
 ### 开发经验
 
@@ -509,6 +518,10 @@ Device template. Complete each area with board-specific inputs and evidence.
 - printf and kprintf both fail to reach the console: a DEVELOPMENT kernel leaves disable\_kprintf\_output true without -enable\_kprintf\_spam, and printf's console path did not reach the \_cnputs tee either. qcom\_usb\_debug\_write\(\) is the entry point that works.
 - Exit records measured over 420 s: 180 xpcproxy exits with status=0 \(normal fork and exit\), 13 cryptexd SIGABRT with ns=18 code=2 \(OS\_REASON\_LIBSYSTEM\_CODE\_FAULT\), 11 liveactivitiesd SIGTRAP, 2 lsd SIGSEGV. Each process crashes at one fixed PC repeated, so the fault is deterministic rather than a race.
 - A software REBOOT via the control channel is acknowledged \(state=queued\) but does not reach fastboot: the worker calls reboot\_kernel\(0, NULL\), an orderly restart that unmounts every filesystem and returns through UEFI. Entering fastboot needs the ABL IMEM handshake, whose address is not measured here.
+- The persistent log writer runs: boot-usb101 recorded 273 rounds over 546 s with zero write errors after the console had already stopped, so the medium is the only record past the link's death.
+- Returning to fastboot works with sheng-log=1 and sheng-autoreset=&lt;seconds&gt; together: boot-usb102 rebooted at 153 s and boot-usb103 at 120 s, both landing in the board's own bootloader with the PON spare cell written \('pon: subtype 04 shift 1 spare 00 -&gt; 04 want 04 rc=0 ok pon\_rc=0'\) and IMEM reading the reason back \(known=1\). PSCI alone cannot do it: SYSTEM\_RESET, SYSTEM\_RESET2\(32\) and SYSTEM\_RESET2\(64\) all report NOT\_SUPPORTED, so PS\_HOLD is the path that works.
+- The reader must seek relative to the partition: /dev/block/by-name/userdata starts at LBA 0x2a8000, so the window's last 8192 blocks are skip=59086843, not the absolute LBA 61872123 the header records. Passing the absolute value reads nothing at all and looks like a hung read.
+- The console's death is a latch, not a transient: dwc3\_poll\(\) returns -1 forever once d-&gt;failed is set \(Dwc3.c:570/581/584\), and nothing in the driver clears it, so the worker's retry path cannot revive the link.
 
 ### 完成条件
 
@@ -523,14 +536,15 @@ Device template. Complete each area with board-specific inputs and evidence.
 
 ### 下一步
 
+- Make the console survive its first error: clear d-&gt;failed and re-initialise the controller from the worker, with backoff, and draw the worker's retry and error counters on the diagnostic page so the failure is readable without the link it is about.
 - Attribute cryptexd's fault, then decide whether the fix is a stub, a mount change, or accepting the crash.
 - Wait for the MAC refusal to reproduce and read the ip\_mac\_return value it now prints.
 
 ### 证据
 
-- `device`: [Console enumerated as 1209:316d named QcomXnuUsbDebug; STATUS returned usb=3 er=0 with the worker polling, so the port is live in both directions.](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/docs/evidence/2026-10-27-boot-diagnostics.md)
+- `device`: [Console enumerated as 1209:316d named QcomXnuUsbDebug; STATUS returned usb=3 er=0 with the worker polling, so the port is live in both directions.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/docs/evidence/2026-10-27-boot-diagnostics.md)
   Command: <code>read /dev/tty.usbmodem&lt;N&gt; at 115200 8N1 and send SXNU1 ... HELLO / STATUS</code>. Revision: `15a15d7cc526262a64531ff56b3a33bdbc46379c`.
-- `device`: [215 exit records captured. 180 xpcproxy status=0 \(normal\), 13 cryptexd ns=18 code=2, 11 liveactivitiesd sig5, 2 lsd sig11; each process repeats one fixed crash PC, so the faults are deterministic.](https://github.com/FFT-infra/UniXNU-alioth/blob/695a35bd11337a27473a1ef6687977c0527b6878/docs/evidence/2026-10-27-serial-exit-records.log)
+- `device`: [215 exit records captured. 180 xpcproxy status=0 \(normal\), 13 cryptexd ns=18 code=2, 11 liveactivitiesd sig5, 2 lsd sig11; each process repeats one fixed crash PC, so the faults are deterministic.](https://github.com/FFT-infra/UniXNU-alioth/blob/0f43345bf8f9bc766cf501a0d4a7bf59933bcd0d/docs/evidence/2026-10-27-serial-exit-records.log)
   Command: <code>./unixnu build kernel; ./unixnu bootimg; fastboot flash boot_b; read the CDC-ACM console for 420 s</code>. Revision: `15a15d7cc526262a64531ff56b3a33bdbc46379c`.
 
 </div>

docs/zh/devices/amethyst-bluedmc-amethyst.md

@@ -1,5 +1,5 @@
-# Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\)
+# Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\) \(IOS4Amethyst\)
 
-[BluedMC-Amethyst/UniXNU-amethyst](https://github.com/BluedMC-Amethyst/UniXNU-amethyst)
+[IOS4Amethyst/UniXNU-amethyst](https://github.com/IOS4Amethyst/UniXNU-amethyst)
 
 在设备仓库补齐并校验 [porting.toml](/zh/porting/records)，随后生成各部分的适配记录。

docs/zh/devices/asteroids.md

@@ -6,7 +6,7 @@
 
 Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UFS userdata partition, with shared SM7635 support and board-owned storage, GPU, input and power integration. Bring-up runs as numbered staged tests; their results are in docs/asteroids-gpu-gen8.md and docs/asteroids-touch.md of rootstockos/iosonandng.
 
-源记录: [porting.toml](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/porting.toml), `2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b`.
+源记录: [porting.toml](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/porting.toml), `bd618af4eb9377dafaa512a07c2991c8e2469444`.
 
 本页按设备记录自动生成。
 
@@ -22,7 +22,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 | [GPU](#gpu) | `implemented` |
 | [clock](#clock) | `device-verified` |
 | [网络](#network) | `planned` |
-| [音频](#audio) | `planned` |
+| [音频](#audio) | `implemented` |
 | [电源](#power) | `implemented` |
 | [镜像组装](#packaging) | `implemented` |
 | [诊断](#diagnostics) | `implemented` |
@@ -71,7 +71,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `source`: [Format 2 board configuration with the SM7635 SoC and 21H461 OS profiles.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `source`: [Format 2 board configuration with the SM7635 SoC and 21H461 OS profiles.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
 
 ## 固件与启动 {#firmware}
 
@@ -111,7 +111,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `source`: [\[bootimg\] and \[firmware\] select uefi-asteroids and the payload in the kernel image.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `source`: [\[bootimg\] and \[firmware\] select uefi-asteroids and the payload in the kernel image.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
 
 ## CPU 与中断 {#cpu}
 
@@ -152,7 +152,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `source`: [EPSS CPU governor with touch boost and frame floor.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/CpuFreqProbe.cpp)
+- `source`: [EPSS CPU governor with touch boost and frame floor.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/CpuFreqProbe.cpp)
 
 ## 内存与 DMA {#memory}
 
@@ -189,7 +189,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `source`: [Memory node for the XNU window's DRAM bank.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/dts/asteroids.dts)
+- `source`: [Memory node for the XNU window's DRAM bank.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/dts/asteroids.dts)
 
 ## 存储与根卷 {#storage}
 
@@ -229,7 +229,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `device`: [T29 booted iPadOS 17.7.11 from the UFS root with persistent Data to the first picture.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `device`: [T29 booted iPadOS 17.7.11 from the UFS root with persistent Data to the first picture.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
   Command: <code>fastboot boot local/unixnu-asteroids-t29-boot.img</code>. Revision: `adf900cf453a6b318864913757f588c9f661596f`.
 
 ## 显示 {#display}
@@ -257,6 +257,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 - The CPU copy \(143-285 ms a frame\) mapped the surfaces cacheable without invalidation and showed stale patches; the GPU copy removes both.
 - GopFramebuffer 33e941a's direct scanout needs ShengUfs's display SMMU window \(native\_ufs\_dpu\_map\); our NativeUfs fork has none, so package/LegacyDisplayStubs.c supplies weak zero stand-ins that keep it off.
 - T40c \(2026-10-27\): BootProgress.c's cpu0\_park defaults off \(see cpu\).
+- T40k-T42 \(2026-10-27\): zero copy on the 3a. NativeUfs sheng-dpu-linux=1 sets the display bank up as Linux does: CBA2R and CBAR written \(the apps SMMU is qcom,virt-smmu and the hypervisor attaches the bank on that write\), TCR2 with the ASID size and SEP, cached inner-shareable walks with T0SZ 28, TTBR0 with an ASID. The bank then took stage 1 without a fault \(T40k\), where every earlier setup faulted at level 0, even with blocks lacking the access flag \(T40i-af\). T41: 1018 direct flips, 4.4 ms mean latch, once startDirect waited for the bank \(40 ms\); frames showed half drawn \(the wallpaper without the app\), so T42 flips only once the GPU's completed fence reaches the newest fence submitted at the swap.
 
 ### 完成条件
 
@@ -272,7 +273,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `device`: [T34b: GPU copy to the panel, no tearing or stale patches, stable.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `device`: [T34b: GPU copy to the panel, no tearing or stale patches, stable.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
   Command: <code>fastboot boot local/unixnu-asteroids-t34b-boot.img</code>. Revision: `e022e84a9721ea6408ea12665b5a23e9b89fc5f6`.
 
 ## 输入 {#input}
@@ -313,7 +314,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `device`: [Touch input works on the desktop \(stage 6\).](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/AsteroidsTouchProbe.cpp)
+- `device`: [Touch input works on the desktop \(stage 6\).](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/AsteroidsTouchProbe.cpp)
   Command: <code>fastboot boot local/unixnu-asteroids-t34b-boot.img</code>. Revision: `e022e84a9721ea6408ea12665b5a23e9b89fc5f6`.
 
 ## GPU {#gpu}
@@ -358,7 +359,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `device`: [GPU compositing and the GPU panel copy run stable.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/GpuPowerProbe.cpp)
+- `device`: [GPU compositing and the GPU panel copy run stable.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/GpuPowerProbe.cpp)
   Command: <code>fastboot boot local/unixnu-asteroids-t34b-boot.img</code>. Revision: `e022e84a9721ea6408ea12665b5a23e9b89fc5f6`.
 
 ## clock {#clock}
@@ -399,7 +400,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `device`: [T39e: the time set in Settings survived a restart; Settings &gt; Date &amp; Time opens.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/board.toml)
+- `device`: [T39e: the time set in Settings survived a restart; Settings &gt; Date &amp; Time opens.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/board.toml)
   Command: <code>fastboot boot local/unixnu-asteroids-t39e-boot.img</code>. Revision: `e4d1092cc3d051617ee88858b153ed2ba0d456fd`.
 
 ## 网络 {#network}
@@ -440,24 +441,35 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ## 音频 {#audio}
 
-`planned`
+`implemented`
 
 ### 硬件与依赖
 
-- The audio DSP and its firmware; sheng's ADSP, GLINK and QRTR stack is the reference.
+- The audio DSP and its firmware; sheng's ADSP, GLINK, QRTR, GPR and AudioReach stack is the reference.
+- The 3a's amplifier settings container \(vendor/firmware/tfa98xx.cnt, proprietary-files.txt\), turned into build/asteroids-tfa/AsteroidsTfaConfig.h by scripts/prepare-asteroids-tfa.py.
 
 ### 配置
 
-- None yet.
+- sheng-audio takes bits \(sheng-adsp=2 is required, the default\): any nonzero value serves the audio service, 2 plays a 1.5 s 750 Hz test tone at boot, 8 runs the lock sound test.
+- sheng-audio-pa moves the DSP period buffer \(default 0xe6200000, the splash region's tail\); sheng-audio-tone-ms and sheng-audio-atten set the tone.
+- asteroids-audio-i2s = interface \| data lines &lt;&lt; 8 \| bits &lt;&lt; 16 \(default primary MI2S, SD1, 32-bit: the amplifiers take their data on gpio17\); asteroids-audio-prm bits \(default 3\): 1 LPASS core vote, 2 MI2S bit clock request.
+- asteroids-mic=&lt;stage&gt; \(default 0, with sheng-audio\) brings up the WCD9378 microphone path in stages: 1 rails \(ldob7, ldob8\) and codec reset \(gpio162\), 2 PRM votes and VA/TX core clocks, 3 LPI SoundWire pins and VA/TX macro clocks, 4 VA SoundWire master \(0x33b0000, v1.7\) and enumeration, 5 codec init \(SCP setup, io\_init, SDCA class load\), 6 capture path \(ports, micbias 1, SmartMIC0 sequencer, TX decimator 0\), 7 DSP capture graphs and a 2 s capture test, 8 capture for the plug-in. asteroids-mic-port = sample interval \| offset1 &lt;&lt; 8 \| lane &lt;&lt; 16 \(default 1 \| 1 &lt;&lt; 8\). asteroids-mic-mux=1 switches the VA macro to its own core clock \(0x3420000 = 1\) as the vendor clock manager does \(default off\).
+- The GPU addon carries sheng's audio server plug-in as audio/ShengAudio.driver \(scripts/build-asteroids-metal-plugin.py builds it with scripts/build-sheng-audio-hal.py unless --no-audio, and adds its CDHash to the owner trust module\); patches/xnu/zzyd-board-audio-addon-mount.patch mounts audio/ over /System/Library/Audio/Plug-Ins/HAL.
 
 ### 操作步骤
 
-- Boot the ADSP from its firmware partition as sheng does.
+- Read the \[audio\] and \[amps\] rows: stage, DSP status, amplifiers found \(amps=3: both\), clocks stable \(lock=\), errors, SMMU result, I2C engine, PRM results \(bus= second word\), I2C failures.
+- Run scripts/check-audioreach-host.py after changing the graph commands.
 
 ### 开发经验
 
-- No audio path yet.
 - T38 ports sheng's audio DSP bring-up \(AdspProbe.cpp, sheng-adsp=1 survey, 2 start\) with the 3a's IPCC \(0x405000\), carveouts \(0x99300000, 0x99280000\) and crash-reason partition; the firmware comes from modem\_a \(LUN 4\) through NativeUfs's native\_ufs\_part\_find/read \(rootstockos/NativeUfs efa8271, from UniXNU's ShengUfs\).
+- T41: speakers are two NXP TFA9873 \(P 0x34 slot 0, S 0x35 slot 1\) on QUPv3 wrapper 1 SE6 \(SE13, 0x898000, gpio59/60\), reset gpio141/142 \(active high\), fed by primary MI2S \(gpio15-18, function 2\) as two 32-bit slots at 48 kHz. The container carries no amplifier firmware \(a dummy patch\), only bitfield settings.
+- T41: the microphone is AMIC1 of a WCD9378 \(mixer\_paths handset-mic: ADC1, MIC BIAS1 by the card routing, ADC\_LP, volume 6\) on the VA macro's SoundWire master; the handset mic back end is CODEC\_DMA-LPAIF\_RXTX-TX-3 as on sheng. The codec register recipe is the July 2026 LKML WCD9378 TX driver \(v2, paged SDCA registers, built-in power sequencers\); the master is v1.7 \(apps command FIFO at 0x31c\).
+- T41: package/AsteroidsAudioProbe.cpp is sheng's AudioProbe.cpp with the 3a's board steps and the TFA9873 programs \(AsteroidsTfa9873.c\) in place of the CS35L43's; the speaker device runs 32-bit while the stream stays 16-bit \(the playback converter widens it\). The amplifiers power up after the graphs start, since they wait for the bit clock. No microphone path.
+- T40k \(2026-10-27\): the speaker path ran end to end \(DSP graphs, the service, the plug-in, a 48 kHz stream without gaps; both TFA9873 rev B found, clocks and PLL locked\) but was silent: on I2S0 SD0 the amplifiers got the clocks and no data. T40k-spk-sd1 \(asteroids-audio-i2s=0x200200\) played the boot tone and iOS sound through both speakers: the amplifiers take their data on SD1 \(gpio17\), the default since T41.
+- T41: TFA9873 STATUS0 bits 1, 2 and 4 \(DCOCPOK, OTDS, UVDS\) are ok flags in NXP's field list, not alarms; \[audio\] err= counts real alarms only \(OCDS, MANALARM, NOCLK, TDMERR or a missing ok flag\).
+- T41, T41-mux: mic stage 4 fails. The rails are voted, the PRM grants the macro and codec votes and the VA/TX core clocks, the LPI pins and macro clocks are set \(VA SWR\_CONTROL 1\) and the master \(v1.7\) keeps its settings, but COMP\_STATUS never shows the link up, no interrupt fires and no device attaches. With asteroids-mic-mux=1 \(the VA clock source switch\) the master's registers read back 0, so the switch stays off. T42 adds \[mic extra\]: the codec reset pin read back, COMP\_STATUS over time and, with asteroids-mic-pmic=1, the codec's LDOs from the PMIC.
 
 ### 完成条件
 
@@ -465,15 +477,19 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 当前范围
 
-- No audio.
+- The microphone does not work yet: stage 4 \(SoundWire enumeration\) fails, so the plug-in's input stream stays silent.
+- The master's port timing is not taken from the vendor driver \(not in the published tree\): asteroids-mic-port tunes it.
 
 ### 下一步
 
-- Port the ADSP start after the battery work.
+- Boot T42 with asteroids-mic=4 and asteroids-mic-pmic=1 and read \[mic extra\]: whether the codec's LDOs are on and its reset is released tells whether stage 4 waits on the codec's power or on the bus.
 
 ### 证据
 
-按下一步操作收集证据。
+- `host`: [PASS: 207 AudioReach packet checks, including the 3a's primary MI2S port and the 32-bit speaker device format.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/scripts/check-audioreach-host.py)
+  Command: <code>python3 scripts/check-audioreach-host.py</code>. Revision: `b1621b32a2513ba8e2c4c599d4f4baf602a7369a`.
+- `device`: [T40k-spk-sd1: the boot tone and iOS sounds played through both speakers; \[amps\] showed the boost converters active and \[audio-io\] 8.3 M frames without gaps in 494 s.](https://github.com/rootstockos/UniXNU-asteroids/commit/b1621b32a2513ba8e2c4c599d4f4baf602a7369a)
+  Command: <code>fastboot boot with boot args sheng-audio=3 asteroids-audio-i2s=0x200200 sheng-audio-tone-ms=4000</code>. Revision: `49ec1ccb18fd6b7ddd23b25b2c4ae96cd084ad1a`.
 
 ## 电源 {#power}
 
@@ -512,7 +528,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `device`: [T29: with the stand-in, SpringBoard boots to the first picture.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/KeyStoreProbe.cpp)
+- `device`: [T29: with the stand-in, SpringBoard boots to the first picture.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/KeyStoreProbe.cpp)
   Command: <code>fastboot boot local/unixnu-asteroids-t29-boot.img</code>. Revision: `adf900cf453a6b318864913757f588c9f661596f`.
 
 ## 镜像组装 {#packaging}
@@ -549,7 +565,7 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `source`: [Board patch series after the arch, SoC and OS series.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/patches/xnu/series)
+- `source`: [Board patch series after the arch, SoC and OS series.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/patches/xnu/series)
 
 ## 诊断 {#diagnostics}
 
@@ -586,6 +602,6 @@ Nothing Phone \(3a\) runs the unchanged iPad7,1 iPadOS 17.7.11 image from its UF
 
 ### 证据
 
-- `source`: [Live page and banner rows.](https://github.com/rootstockos/UniXNU-asteroids/blob/2b7e5f9bc7ca01eaa1f36f44b0de3485e5998b6b/package/BootProgress.c)
+- `source`: [Live page and banner rows.](https://github.com/rootstockos/UniXNU-asteroids/blob/bd618af4eb9377dafaa512a07c2991c8e2469444/package/BootProgress.c)
 
 </div>

docs/zh/devices/fuxi-mouse233.md

@@ -6,7 +6,7 @@
 
 Xiaomi 13 \(fuxi\). XNU for iPad7,1 iPadOS 17.7.11 boots from RAM: a UEFI USB bulk receiver takes the payload into DRAM, the UniXNU menu starts DarwinBoot, and XNU switches its root from the RAM block device to the APFS system volume.
 
-源记录: [porting.toml](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/porting.toml), `b8fc5d3af5d25b8b2b13059aaa90181b8299bcea`.
+源记录: [porting.toml](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/porting.toml), `0e24b939f906b898cfe009fb7ec962cefd896ce9`.
 
 本页按设备记录自动生成。
 
@@ -80,7 +80,7 @@ Xiaomi 13 \(fuxi\). XNU for iPad7,1 iPadOS 17.7.11 boots from RAM: a UEFI USB bu
 
 ### 证据
 
-- `source`: [Parses with schema\_version = 2 and keeps the format 1 tables \(ipsw, userdata, kernel, firmware, payload\), so the board's own scripts and the pre-format-2 driver keep working.](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/board.toml)
+- `source`: [Parses with schema\_version = 2 and keeps the format 1 tables \(ipsw, userdata, kernel, firmware, payload\), so the board's own scripts and the pre-format-2 driver keep working.](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/board.toml)
 - `source`: [Recorded source pins for xnu and edk2 that the candidate builds resolve.](https://github.com/mouse233/unixnu-fuxi/blob/d67e18aec56a21b2e2e81f647b8444f3222ec53d/unixnu.lock)
 - `host`: [Exits 0 with the board resolved to fuxi and every driver and kit listed at base.](https://github.com/mouse233/unixnu-fuxi/commit/e5a7d450c159ae662e7d5785eef19d1ba4cb5fec)
   Command: <code>./unixnu status -D ../UniXNU-fuxi</code>. Revision: `e5a7d450c159ae662e7d5785eef19d1ba4cb5fec`.
@@ -226,7 +226,7 @@ Xiaomi 13 \(fuxi\). XNU for iPad7,1 iPadOS 17.7.11 boots from RAM: a UEFI USB bu
 
 - `device`: [Records the SID 60 0 to 1 transition and the final SCTLR=0, CBAR=10000, CBA2R=1, GFSR=0 and FSR=400 snapshot for the M1 native UFS receiver run.](https://github.com/mouse233/unixnu-fuxi/blob/9644d94e6bb050e4bde5f50f94312dd10cd3f416/diagnostics/ram-root/usb-bulk.md)
   Command: <code>python3 scripts/test-usb-ram-full.py --expected-sha256 &lt;image-sha&gt; --output out/&lt;candidate&gt;/attempt-NN</code>. Revision: `9644d94e6bb050e4bde5f50f94312dd10cd3f416`.
-- `source`: [The probe that reports context bank state is in the device package and builds with the receiver image.](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/package/ArmSmmu4KProbe.c)
+- `source`: [The probe that reports context bank state is in the device package and builds with the receiver image.](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/package/ArmSmmu4KProbe.c)
 
 ## 存储与根卷 {#storage}
 
@@ -559,7 +559,7 @@ Xiaomi 13 \(fuxi\). XNU for iPad7,1 iPadOS 17.7.11 boots from RAM: a UEFI USB bu
 
 - `host`: [Delivered image v47 hashes recorded above, with eighteen checks at run\_id 20261025T074819.554188Z exiting 0 and bound to that image and source.](https://github.com/mouse233/unixnu-fuxi/blob/283834986151e0911a88ffcb3d5fe8531558f8a7/diagnostics/ram-root/README.md)
   Command: <code>PYTHONDONTWRITEBYTECODE=1 python3 scripts/check-fuxi-usb-ram-image.py --uefi ../uefi-fuxi --output out/usb-system-mount-v47 &amp;&amp; PYTHONDONTWRITEBYTECODE=1 python3 scripts/check-usb-ram.py --uefi ../uefi-fuxi --report out/usb-system-mount-v47/host-tests.json</code>. Revision: `283834986151e0911a88ffcb3d5fe8531558f8a7`.
-- `source`: [The packaging entry that writes the tagged payload volume used by the firmware boot entry.](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/scripts/package-sheng-xnu-boot.py)
+- `source`: [The packaging entry that writes the tagged payload volume used by the firmware boot entry.](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/scripts/package-sheng-xnu-boot.py)
 
 ## 诊断 {#diagnostics}
 
@@ -615,7 +615,7 @@ Xiaomi 13 \(fuxi\). XNU for iPad7,1 iPadOS 17.7.11 boots from RAM: a UEFI USB bu
   Command: <code>python3 scripts/test-usb-ram-full.py --boot-profile usb-system --expected-sha256 &lt;image-sha&gt; --output out/&lt;candidate&gt;/attempt-NN</code>. Revision: `9644d94e6bb050e4bde5f50f94312dd10cd3f416`.
 - `host`: [Linux host checks run in the WSL workspace with real exit codes recorded for the rebuild.](https://github.com/mouse233/unixnu-fuxi/blob/0e9eb2196efc5974feed2817e6f56e080e6c68be/diagnostics/ram-root/wsl-linux-rebuild.md)
   Command: <code>PYTHONDONTWRITEBYTECODE=1 python3 scripts/check-usb-smmu-audit.py --uefi ../uefi-fuxi --report out/&lt;candidate&gt;/smmu-tests.json</code>. Revision: `0e9eb2196efc5974feed2817e6f56e080e6c68be`.
-- `source`: [Component and source pins recorded for the RAM root path are committed on the default branch.](https://github.com/mouse233/unixnu-fuxi/blob/b8fc5d3af5d25b8b2b13059aaa90181b8299bcea/diagnostics/ram-root/pins.json)
+- `source`: [Component and source pins recorded for the RAM root path are committed on the default branch.](https://github.com/mouse233/unixnu-fuxi/blob/0e24b939f906b898cfe009fb7ec962cefd896ce9/diagnostics/ram-root/pins.json)
 - `device`: [Three receiver runs with one fastboot boot each, plus the V-E read-only failure snapshot, are recorded with host sampling counts and readings transcribed from device photographs. The photo files are not committed to this repository.](https://github.com/mouse233/unixnu-fuxi/blob/1d071dae4618b0676d313cfbe1fc39689e6f139e/diagnostics/ram-root/usb-bulk.md)
   Command: <code>fastboot boot m1-ab-ep0snapshot-v6; python3 scripts/boot-ram-window-once.py</code>. Revision: `1d071dae4618b0676d313cfbe1fc39689e6f139e`.
 

docs/zh/devices/index.md

@@ -13,7 +13,7 @@
 | [Xiaomi Redmi K40 \(alioth, M2012K11AC\) \(songchiyu\)](/zh/devices/alioth-songchiyu) | SM8250 | 2 | 记录待补齐 | [songchiyu/UniXNU-alioth](https://github.com/songchiyu/UniXNU-alioth) |
 | [Xiaomi Redmi K40 \(alioth, M2012K11AC\) \(yang232138\)](/zh/devices/alioth-yang232138) | SM8250 | 2 | 记录待补齐 | [yang232138/UniXNU-alioth](https://github.com/yang232138/UniXNU-alioth) |
 | [Redmi Note 14 Pro+ 5G（amethyst）](/zh/devices/amethyst) | SM7635 | 2 | 记录待补齐 | [andr0d1v/UniXNU-amethyst](https://github.com/andr0d1v/UniXNU-amethyst) |
-| [Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\)](/zh/devices/amethyst-bluedmc-amethyst) | SM7635 | 2 | 记录待补齐 | [BluedMC-Amethyst/UniXNU-amethyst](https://github.com/BluedMC-Amethyst/UniXNU-amethyst) |
+| [Xiaomi Redmi Note 14 Pro+ 5G \(BluedMC-Amethyst\) \(IOS4Amethyst\)](/zh/devices/amethyst-bluedmc-amethyst) | SM7635 | 2 | 记录待补齐 | [IOS4Amethyst/UniXNU-amethyst](https://github.com/IOS4Amethyst/UniXNU-amethyst) |
 | [Nothing Phone \(3a\)（asteroids）](/zh/devices/asteroids) | SM7635 | 2 | 适配记录 | [rootstockos/UniXNU-asteroids](https://github.com/rootstockos/UniXNU-asteroids) |
 | [BBK/EEBBK A2, X2 and X2P tablet \(ums512\_1h190, Unisoc T610 / UMS512 SharkL5Pro\)](/zh/devices/bbk-a2) | UMS512 | 2 | 记录待补齐 | [woshimaniubi8/unixnu-eebbk-a2_x2-ums512](https://github.com/woshimaniubi8/unixnu-eebbk-a2_x2-ums512) |
 | [Brave Ark 平板（braveark）](/zh/devices/braveark) | SM8635 | 1 | 设备说明 | [tattwamashi/UniXNU-braveark](https://github.com/tattwamashi/UniXNU-braveark) |
@@ -108,6 +108,7 @@
 | [小米 17 Pro（pandora）](/zh/devices/pandora) | SM8850 | 1 | 设备说明 | [ShueiTsuki/data-a-live](https://github.com/ShueiTsuki/data-a-live) |
 | [Sony Xperia 1 II（pdx203）](/zh/devices/pdx203) | SM8250 | 1 | 设备说明 | [chardidathing/UniXNU-pdx203](https://github.com/chardidathing/UniXNU-pdx203) |
 | [Redmi Turbo 3 / Poco F6（peridot）](/zh/devices/peridot) | SM8635 | 1 | 设备说明 | [kvfsrl/UniXNU-peridot](https://github.com/kvfsrl/UniXNU-peridot) |
+| [Xiaomi Poco F6 / Redmi Turbo 3 \(hoshikv\)](/zh/devices/peridot-hoshikv) | SM8635 | 1 | 仓库链接 | [hoshikv/UniXNU-peridot](https://github.com/hoshikv/UniXNU-peridot) |
 | [Poco F6 / Redmi Turbo 3 \(wzy114514sb\)](/zh/devices/peridot-wzy114514sb) | SM8635 | 2 | 记录待补齐 | [wzy114514sb/UniXNU-peridot](https://github.com/wzy114514sb/UniXNU-peridot) |
 | [OPPO Find X7 Ultra（PHY120）](/zh/devices/phy120) | SM8650 | 1 | 设备说明 | [peiyuesheng666/UniXNU-PHY120](https://github.com/peiyuesheng666/UniXNU-PHY120) |
 | [小米平板 8 Pro（piano）](/zh/devices/piano) | SM8750 | 1 | 设备说明 | [code002-2/UniXNU-piano](https://github.com/code002-2/UniXNU-piano) |
@@ -120,7 +121,8 @@
 | [Xiaomi Pad 6 \(xVanTuring\)](/zh/devices/pipa-xvanturing) | SM8250 | 1 | 仓库链接 | [xVanTuring/UniXNU-pipa](https://github.com/xVanTuring/UniXNU-pipa) |
 | [小米 MIX 2S（polaris）](/zh/devices/polaris) | SDM845 | 1 | 设备说明 | [luuu20309/UniXNU-polaris](https://github.com/luuu20309/UniXNU-polaris) |
 | [Xiaomi Mi MIX 2S \(PuszekReksio\)](/zh/devices/polaris-puszekreksio) | SDM845 | 1 | 仓库链接 | [PuszekReksio/UniXNU-judyln](https://github.com/PuszekReksio/UniXNU-judyln) |
-| [Nothing Phone \(2\)（pong）](/zh/devices/pong) | SM8475 | 1 | 设备说明 | [Chengdong-Yu/UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong) |
+| [Nothing Phone \(2\)（pong）](/zh/devices/pong) | SM8475 | 2 | 适配记录 | [Chengdong-Yu/UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong) |
+| [Nothing Phone \(2\): UniXNU UEFI bring-up \(hxzbaka\)](/zh/devices/pong-hxzbaka) | SM8475 | 1 | 仓库链接 | [hxzbaka/UniXNU-pong](https://github.com/hxzbaka/UniXNU-pong) |
 | [Nothing Phone \(2\): UniXNU UEFI bring-up \(Y3d4\)](/zh/devices/pong-y3d4) | SM8475 | 1 | 仓库链接 | [Y3d4/UniXNU-pong-clean](https://github.com/Y3d4/UniXNU-pong-clean) |
 | [Galaxy Z Fold3（q2q）](/zh/devices/q2q) | SM8350 | 1 | 设备说明 | [agcarbajo/UniXNU-q2q](https://github.com/agcarbajo/UniXNU-q2q) |
 | [QEMU virt](/zh/devices/qemu) | QEMU virt | 1 | 设备说明 | [xVanTuring/UniXNU-qemu](https://github.com/xVanTuring/UniXNU-qemu) |

docs/zh/devices/oneplus13t.md

@@ -6,7 +6,7 @@
 
 OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, CPU reg=8 online=8 T=ff I=ff, RAM 4096 MiB; Clutch single-pset, read-only UFS root; cross-core stress and long-term stability unqualified.
 
-源记录: [porting.toml](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/porting.toml), `e1436a2dd4c231f4c5184b6851a2c1192e56b012`.
+源记录: [porting.toml](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/porting.toml), `cdd273d72a1e3a08f118e1fb69b39ed18c3bc929`.
 
 本页按设备记录自动生成。
 
@@ -96,70 +96,72 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `device`: [Build-63 user feedback confirms system startup and normal touch with CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096. This is tied to the recorded image and exact build-source pins; no runtime code or configuration changed after the test.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The device feed and lock pin SoC b79d675, and upstream.rev pins main b962645 with the matching Sm8750Platform catalog revision. Local profile resolution found 18 selected components; a clean remote fetch remains for cloud CI.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/feeds.toml)
+  Command: <code>./unixnu status -D ../UniXNU-Pagani_SM8750 --local-module soc:sm8750=../UniXNU-sm8750-common</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [Build-63 user feedback confirms system startup and normal touch with CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096. This is tied to the recorded image and exact build-source pins; no runtime code or configuration changed after the test.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The matching build-63 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.791s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The matching build-63 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.791s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [Build 63 passed all cloud contracts, original/compiled ABI checks and full kernel link/prelink in 17m00s. Device 3c39baf, main 52560be, drivers 14f50fc and SoC 37ccfbe match the downloaded inputs. No new device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `source`: [The display-timeout candidate pins drivers 14f50fc and main 52560be. The full patch chain, 18 component contracts, eight-affinity ADT, actual reset/resume assembly and Clutch single-pset regression pass locally. The touch implementation and 4 GiB window are retained. Full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The matching build-62 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.671s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The display-timeout candidate pins drivers 14f50fc and main 52560be. The full patch chain, 18 component contracts, eight-affinity ADT, actual reset/resume assembly and Clutch single-pset regression pass locally. The touch implementation and 4 GiB window are retained. Full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The matching build-62 image passed assembly/readback and fastboot accepted the user-authorized temporary launch in 2.671s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 passed all cloud contracts, original/compiled ABI checks and full kernel link/prelink in 21m29s. Device c87bced, main d967069, drivers 3ba7f19 and SoC 37ccfbe match the downloaded inputs. The macOS fixture correction passes; no new device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 61 stopped before kernel compilation because the new host fixture redefined the macOS SDK \_\_unused macro under -Werror. The test now keeps an existing system definition with \#ifndef; the actual single-pset kernel correction is unchanged. A fresh full build is required.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505475023)
   Command: <code>Actions build 61 configuration contracts; inspect failed log</code>. Revision: `0922d28d807f5c4f2cba2d361136c482240cfd50`.
-- `source`: [The candidate pins SoC 37ccfbe and main d967069 for the Clutch single-pset policy. All eight CPU affinities, two hardware clusters and the 4 GiB owned window are retained. The selected-source regression reproduces the old double lock and passes the correction. The full patch chain, 18 component contracts, eight-core ADT, actual reset/resume assembly and nine kernel-source checks pass; full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The build-60 image passed local assembly/readback and fastboot accepted the user-authorized temporary launch in 2.659s without flashing. Runtime behavior and the new CPU panic trace await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The candidate pins SoC 37ccfbe and main d967069 for the Clutch single-pset policy. All eight CPU affinities, two hardware clusters and the 4 GiB owned window are retained. The selected-source regression reproduces the old double lock and passes the correction. The full patch chain, 18 component contracts, eight-core ADT, actual reset/resume assembly and nine kernel-source checks pass; full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The build-60 image passed local assembly/readback and fastboot accepted the user-authorized temporary launch in 2.659s without flashing. Runtime behavior and the new CPU panic trace await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 passed all cloud contracts, nine source-kernel regressions, production object/ABI checks and full kernel link/prelink in 11m49s. The exact device faa6aa2, main 13cc99b, drivers 3ba7f19 and SoC 76fb502 inputs are downloaded and verified. No build-60 image or device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `source`: [Build-59 user feedback confirms a scheduler ticket-lock panic on MPIDR affinity 0x200 after the accepted temporary boot. The next device-only diagnostic patch retains the eight-core policy and adds lock identity plus a bounded call trace; full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The matching build-59 boot image passed local assembly/readback, including eight actual ADT CPU affinities and all SMP arguments. Fastboot accepted the user-authorized temporary launch in 2.680s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Build-59 user feedback confirms a scheduler ticket-lock panic on MPIDR affinity 0x200 after the accepted temporary boot. The next device-only diagnostic patch retains the eight-core policy and adds lock identity plus a bounded call trace; full compilation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The matching build-59 boot image passed local assembly/readback, including eight actual ADT CPU affinities and all SMP arguments. Fastboot accepted the user-authorized temporary launch in 2.680s without flashing. System startup and CPU/RAM observations await feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 passed all host contracts, actual reset/resume assembly checks, production object/ABI checks and full kernel link/prelink in 21m38s. Source pins are device 859dbce, main 13cc99b, drivers 3ba7f19 and SoC 76fb502. The kernel and paired inputs are downloaded and locally verified; no new boot image or device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Build 58 failed during bootstrap start.s assembly because HAS\_CLUSTER exposed Apple-only CPU\_OVRD accesses. The corrected SoC profile sets NO\_CPU\_OVRD=1. A regression compiling actual reset/resume assembly with the selected board header reproduces the old failure and passes after the fix; the full patch chain and 18 component/ADT contracts pass. Full recompilation and eight-core hardware validation remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 58 failed during bootstrap start.s assembly because HAS\_CLUSTER exposed Apple-only CPU\_OVRD accesses. The corrected SoC profile sets NO\_CPU\_OVRD=1. A regression compiling actual reset/resume assembly with the selected board header reproduces the old failure and passes after the fix; the full patch chain and 18 component/ADT contracts pass. Full recompilation and eight-core hardware validation remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py with actual ARM64 reset/resume assembly</code>. Revision: `19e9b8114df32c45b0b36fc32c187db24bf521c6`.
-- `source`: [The next candidate selects eight SM8750 CPU affinities and the platform status overlay, disables the touch overlay and retains the 4 GiB owned window. The full patch chain, 18 component contracts, actual XNU topology lookup, 21 ARM64 assembly blocks, eight kernel-source checks and console/peripheral regressions pass locally. Cloud compilation and device validation are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [After the build-57 temporary boot, the user confirmed that touch is working. Basic touch response is now device-observed for source ad6ed2d and the recorded build-57 image; detailed gesture and stability qualification remains incomplete.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The next candidate selects eight SM8750 CPU affinities and the platform status overlay, disables the touch overlay and retains the 4 GiB owned window. The full patch chain, 18 component contracts, actual XNU topology lookup, 21 ARM64 assembly blocks, eight kernel-source checks and console/peripheral regressions pass locally. Cloud compilation and device validation are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [After the build-57 temporary boot, the user confirmed that touch is working. Basic touch response is now device-observed for source ad6ed2d and the recorded build-57 image; detailed gesture and stability qualification remains incomplete.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-57 fastboot boot; user confirmed touch is working</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `host`: [After the user connected fastboot, the matching build-57 image passed assembly and readback. Fastboot Sending and Booting returned OKAY in 2.706s without flashing. System startup and touch behavior await hardware feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [After the user connected fastboot, the matching build-57 image passed assembly and readback. Fastboot Sending and Booting returned OKAY in 2.706s without flashing. System startup and touch behavior await hardware feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 passed all 18 component contracts, host regressions, original/compiled ABI checks and full kernel link/prelink in 17m11s. Source pins are device ad6ed2d, main 5ae8fe4, drivers 6038f39 and SoC a06a072. The kernel and paired inputs are downloaded and locally verified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [The next candidate pins drivers 6038f39 and main 5ae8fe4, with a standalone 13/4 touch descriptor, product-scoped event-driver matching and qualified 21H461 event dispatch. Host regressions and original ABI checks pass; full compilation and download are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build-56 hardware feedback confirms a valid S3910 identification header and successful kernel HID submissions \(r=0, observed n=430\), with a nonzero contact mask on press and zero on release. Lock-screen swipes and tapping Cancel in the power menu remain unresponsive. UI touch is not qualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The next candidate pins drivers 6038f39 and main 5ae8fe4, with a standalone 13/4 touch descriptor, product-scoped event-driver matching and qualified 21H461 event dispatch. Host regressions and original ABI checks pass; full compilation and download are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build-56 hardware feedback confirms a valid S3910 identification header and successful kernel HID submissions \(r=0, observed n=430\), with a nonzero contact mask on press and zero on release. Lock-screen swipes and tapping Cancel in the power menu remain unresponsive. UI touch is not qualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [After the user connected fastboot, the matching build-56 image passed local assembly and readback. Sending and Booting returned OKAY for fastboot boot, with no partition flash. Runtime touch/power feedback is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [After the user connected fastboot, the matching build-56 image passed local assembly and readback. Sending and Booting returned OKAY for fastboot boot, with no partition flash. Runtime touch/power feedback is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 passed all 18 component contracts, regressions, original/compiled ABI checks and full kernel link/prelink in 20m13s. Source pins: device 3a12121, main ca164eb, drivers cab2d4d, SoC a06a072. The kernel and paired inputs are downloaded and locally verified; no image assembly or device boot was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [The next touch candidate adds board-owned RPMh resource names/voltages and SPI delays, with shared checked controller operations. Actual-adapter, power fault, transport and overlay regressions pass. Build 56 passed full cloud compilation and downloaded-artifact checks; this round ended without a device boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [A read-only Android 16 baseline on the local 6.6.118 kernel confirms enabled 1.8 V/3.1 V touch rails and retained SPI logs with valid a5 frames. The OnePlus driver uses cs\_clk\_delay=50 and inter\_words\_delay=0; this port does not explicitly program SE\_SPI\_DELAY\_COUNTERS. No runtime code or build-55 image changed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The next touch candidate adds board-owned RPMh resource names/voltages and SPI delays, with shared checked controller operations. Actual-adapter, power fault, transport and overlay regressions pass. Build 56 passed full cloud compilation and downloaded-artifact checks; this round ended without a device boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [A read-only Android 16 baseline on the local 6.6.118 kernel confirms enabled 1.8 V/3.1 V touch rails and retained SPI logs with valid a5 frames. The OnePlus driver uses cs\_clk\_delay=50 and inter\_words\_delay=0; this port does not explicitly program SE\_SPI\_DELAY\_COUNTERS. No runtime code or build-55 image changed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Read-only ADB root capture of Android regulator, GPIO, clock and existing SPI IPC logs; compare OnePlus touch and GENI source</code>. Revision: `bdeec6693f1b8488a3286446f0b93c13c02d6785`.
-- `device`: [Build-55 hardware feedback confirms a completed four-byte SE DMA read with TX/RX length-in 4 and idle GENI state, but all RX bytes are zero. Touch still fails with -71 before HID startup. The next investigation compares stock Android power and SPI state.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build-55 hardware feedback confirms a completed four-byte SE DMA read with TX/RX length-in 4 and idle GENI state, but all RX bytes are zero. Touch still fails with -71 before HID startup. The next investigation compares stock Android power and SPI state.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-55 temporary boot; user transcribed TOUCH and both SPI rows, then confirmed return code b9</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 55 passed all 18 component contracts, regressions, original/compiled ABI checks, full compilation/link/prelink and matching image readback. Source pins: device 664530f, main b689e9a, drivers 339d4df, SoC b6706a5. Fastboot accepted the temporary boot; first-read diagnostic values and touch behavior await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40437346840)
   Command: <code>Actions build 55; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 54 passed all component contracts, regressions, full compilation/link/prelink and image readback. Source pins: device fba1472, main 1397e2d, drivers 26a32f5, SoC b6706a5. Fastboot accepted the temporary boot; hardware DMA/touch feedback is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `host`: [Build 53 passed all 18 component contracts, full C/C++ compilation, early-console runtime checks, kernel link/prelink and matching image readback. Sending and Booting returned OKAY; SPI snapshot observations are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 passed all 18 component contracts, full C/C++ compilation, early-console runtime checks, kernel link/prelink and matching image readback. Sending and Booting returned OKAY; SPI snapshot observations are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 51 passed all 18 component contracts, full C/C++ compilation, kernel link/prelink and matching image readback. Sending and Booting returned OKAY; touch behavior awaits observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 passed all 18 component contracts, full C/C++ compilation, kernel link/prelink and matching image readback. Sending and Booting returned OKAY; touch behavior awaits observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 50 passed all 18 component contracts, full kernel compilation/link/prelink, matching image assembly and actual payload readback. Sending and Booting returned OKAY; system UI and peripheral behavior await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 passed all 18 component contracts, full kernel compilation/link/prelink, matching image assembly and actual payload readback. Sending and Booting returned OKAY; system UI and peripheral behavior await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py; test-stage6.py; ./unixnu kernel -j 3; ./unixnu payload; ./unixnu bootimg; FAT readback</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
 - `host`: [All 18 selected components resolved at their pinned revisions; archive ordering, ADT checks, full kernel link and prelink passed. Downloaded kernel and report agree at 127778816 bytes; hardware remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
   Command: <code>test-format2.py; ./unixnu status --json; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [Four layers, 15 pinned components, complete archive order and matching required ADT properties passed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-format2.py; ./unixnu status --json</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## 固件与启动 {#firmware}
 
@@ -214,44 +216,44 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `device`: [The user-confirmed build-63 system startup verifies the existing embedded-payload boot route with the recorded unchanged 3 MiB UEFI and matching payload. The standard initrd route was not separately exercised and no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user-confirmed build-63 system startup verifies the existing embedded-payload boot route with the recorded unchanged 3 MiB UEFI and matching payload. The standard initrd route was not separately exercised and no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-63 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB FAT containing the matching kernel, trust cache and RAM Data. Readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-63 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB FAT containing the matching kernel, trust cache and RAM Data. Readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-62 Android v4 image embeds the unchanged 3 MiB UEFI plus a 160 MiB FAT with the matching kernel, trust cache and RAM Data. Readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-62 Android v4 image embeds the unchanged 3 MiB UEFI plus a 160 MiB FAT with the matching kernel, trust cache and RAM Data. Readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The build-60 Android v4 image embeds the unchanged 3 MiB UEFI plus 160 MiB payload containing the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-60 Android v4 image embeds the unchanged 3 MiB UEFI plus 160 MiB payload containing the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `host`: [The build-59 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB payload with the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-59 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB payload with the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted temporary launch; no firmware or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [The build-57 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB FAT with the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted the temporary boot; no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-57 Android v4 image embeds the unchanged 3 MiB UEFI and a 160 MiB FAT with the matching kernel, trust cache and RAM Data. Local readback passed and fastboot accepted the temporary boot; no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 is downloaded with matching inputs; no boot image was assembled, no firmware changed and no device boot or flash was performed. The existing build-56 boot configuration is preserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [The HID candidate retains build-56 GENI firmware, SE DMA, touch power and SPI timing. No firmware change, image assembly or device boot is part of this build round.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build 56 reaches valid TouchComm v1 identification and parsed touch reports through retained GENI microcode and SE DMA. The first header is a5 10 1c 00 and the captured SPI delay register is 0xc800; no firmware image or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The HID candidate retains build-56 GENI firmware, SE DMA, touch power and SPI timing. No firmware change, image assembly or device boot is part of this build round.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build 56 reaches valid TouchComm v1 identification and parsed touch reports through retained GENI microcode and SE DMA. The first header is a5 10 1c 00 and the captured SPI delay register is 0xc800; no firmware image or partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [The build-56 Android v4 image embeds the unchanged UEFI and a 160 MiB payload containing the matching kernel, trust cache and RAM Data. Local readback passed; fastboot accepted the user-authorized temporary boot without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-56 Android v4 image embeds the unchanged UEFI and a 160 MiB payload containing the matching kernel, trust cache and RAM Data. Local readback passed; fastboot accepted the user-authorized temporary boot without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 is downloaded with its matching inputs. Firmware and the build-55 boot image remain unchanged; no build-56 boot image, temporary boot or flash was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [Android command DB confirms ldob4 at 0x40800 and ldob16 at 0x41900. The candidate now explicitly enables those touch rails through apps DRV-2 before reset, while retaining GENI microcode. The firmware image is unchanged; no flash or temporary boot is authorized in this build round.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Android regulator state reports pm\_humu\_l4 enabled at 1.8 V for spi0.0-vdd and pm\_humu\_l16 enabled at 3.1 V for spi0.0-vcc. This is a software power-state baseline, not a physical voltage measurement or evidence that the rails remain enabled under XNU. The read-only capture used the existing debugfs mount and changed no firmware or device configuration.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Android command DB confirms ldob4 at 0x40800 and ldob16 at 0x41900. The candidate now explicitly enables those touch rails through apps DRV-2 before reset, while retaining GENI microcode. The firmware image is unchanged; no flash or temporary boot is authorized in this build round.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Android regulator state reports pm\_humu\_l4 enabled at 1.8 V for spi0.0-vdd and pm\_humu\_l16 enabled at 3.1 V for spi0.0-vcc. This is a software power-state baseline, not a physical voltage measurement or evidence that the rails remain enabled under XNU. The read-only capture used the existing debugfs mount and changed no firmware or device configuration.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Read-only ADB root capture of Android regulator, GPIO, clock and existing SPI IPC logs; compare OnePlus touch and GENI source</code>. Revision: `bdeec6693f1b8488a3286446f0b93c13c02d6785`.
 - `host`: [Build 55 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. Actual kernel, trust cache and volatile Data match this build. Sending and Booting returned OKAY without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40437346840)
   Command: <code>Actions build 55; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 54 reused the unchanged UEFI and passed complete embedded-payload readback. The same-build kernel, trust cache and RAM Data were temporarily booted without flashing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `host`: [Build 53 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. The verified image was temporarily booted without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. The verified image was temporarily booted without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 51 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. The verified image was temporarily booted without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 reused the unchanged UEFI and passed Android v4, empty ramdisk and embedded FD/FAT checks. The verified image was temporarily booted without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 50 reused the unchanged UEFI and passed Android v4, empty ramdisk, embedded FD/FAT and stock DTB packaging checks. fastboot boot returned OKAY without flashing a partition; this is not a runtime qualification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 reused the unchanged UEFI and passed Android v4, empty ramdisk, embedded FD/FAT and stock DTB packaging checks. fastboot boot returned OKAY without flashing a partition; this is not a runtime qualification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `host`: [AARCH64 DEBUG package and 3145728-byte FD built locally, including UniXNURamDiskDxe and the retained embedded payload path; hardware boot remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/MIGRATION.md)
+- `host`: [AARCH64 DEBUG package and 3145728-byte FD built locally, including UniXNURamDiskDxe and the retained embedded payload path; hardware boot remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/MIGRATION.md)
   Command: <code>./unixnu build package; ./unixnu firmware</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## CPU 与中断 {#cpu}
 
@@ -304,36 +306,38 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `device`: [The user reported CPU reg=8 online=8 T=ff I=ff after the build-63 temporary boot. All eight CPUs are registered and online, and every per-core timer and SGI/IPI counter is nonzero. IPI coverage may include the enabled self-test; cross-core stress, sustained interrupt progress, CPU frequency control and long-term stability remain unqualified. Clutch still uses one pset.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The resource-only DTS candidate retains all eight CPU affinities in ADT and the verified build-63 kernel. This boot confirmed system UI and touch, but supplied no new CPU counters or directed cross-core stress result.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>Android/FAT/ADT readback of stage7-gpu-resources/boot.img</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [The user reported CPU reg=8 online=8 T=ff I=ff after the build-63 temporary boot. All eight CPUs are registered and online, and every per-core timer and SGI/IPI counter is nonzero. IPI coverage may include the enabled self-test; cross-core stress, sustained interrupt progress, CPU frequency control and long-term stability remain unqualified. Clutch still uses one pset.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The actual build-63 image retains eight CPU affinities, both hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the binary-verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-63 image retains eight CPU affinities, both hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the binary-verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [The actual build-63 Clutch table retains multiple\_psets\_enabled=0 and the expected steal callbacks. All eight affinities and SMP arguments remain selected. Online counts and runtime stability are still unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `device`: [Build-62 user feedback reports a display slot-345 panic, not the preceding scheduler ticket-lock trace. No registered/online or timer/IPI values were supplied, so all-eight-core operation and scheduler stability remain unqualified. The single-pset policy is retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build-62 user feedback reports a display slot-345 panic, not the preceding scheduler ticket-lock trace. No registered/online or timer/IPI values were supplied, so all-eight-core operation and scheduler stability remain unqualified. The single-pset policy is retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>User-reported build-62 panic photograph and confirmed slot/caller</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The actual build-62 image retains all eight CPU affinities, two hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-62 image retains all eight CPU affinities, two hardware clusters, PSCI SMC and SMP/GIC/self-IPI arguments, with the verified Clutch single-pset kernel. Fastboot Sending and Booting succeeded; registered/online counts and timer/IPI masks remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [The actual build-62 Clutch dispatch table has multiple\_psets\_enabled=0, compared with 1 in build 60, with both steal callbacks still matching their symbols. The existing pset\_create gate shares the boot pset across all eight CPUs while retaining both hardware clusters. Selected-source regression and full compilation pass; eight-core online counts, interrupt coverage and runtime stability remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `source`: [Build-60 hardware trace has CPU 2, ctid=owner=f1d34, tickets=b0ae0144 and thread\_select+0x84c reacquiring pset0 after Clutch steal. The selected callback returns without unlocking; two hardware clusters had enabled two psets and exposed that stub. The SoC correction disables Clutch multiple\_psets\_enabled, using the existing pset\_create gate to share pset0 across all eight CPUs while preserving real hardware cluster IDs. The selected-source regression reproduces the old failure and passes this policy; hardware validation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The actual build-60 image retains all eight affinities, PSCI SMC, remote GICR and self-IPI policy and includes the new ticket-lock call trace. Fastboot accepted the temporary launch; no new CPU counts, interrupt coverage or panic backtrace have been observed yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Build-60 hardware trace has CPU 2, ctid=owner=f1d34, tickets=b0ae0144 and thread\_select+0x84c reacquiring pset0 after Clutch steal. The selected callback returns without unlocking; two hardware clusters had enabled two psets and exposed that stub. The SoC correction disables Clutch multiple\_psets\_enabled, using the existing pset\_create gate to share pset0 across all eight CPUs while preserving real hardware cluster IDs. The selected-source regression reproduces the old failure and passes this policy; hardware validation is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The actual build-60 image retains all eight affinities, PSCI SMC, remote GICR and self-IPI policy and includes the new ticket-lock call trace. Fastboot accepted the temporary launch; no new CPU counts, interrupt coverage or panic backtrace have been observed yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 compiles the preserved ticket ownership assertion with logical CPU, compact current/owner IDs, ticket state and eight bounded return addresses. It retains the build-59 eight-core startup policy. The scheduler panic remains unresolved until a new hardware trace identifies the caller.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [The build-59 photograph reports a ticket ownership assertion at lock\_ticket.c:143 on MPIDR 0x80000200. The matching kernel resolves the lock to pset0+0x100 \(sched\_lock\). The root cause is unresolved; eight online CPUs and sustained timer/IPI operation are not qualified. The next panic records compact IDs, ticket state and up to eight return addresses without changing lock checks.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The build-59 photograph reports a ticket ownership assertion at lock\_ticket.c:143 on MPIDR 0x80000200. The matching kernel resolves the lock to pset0+0x100 \(sched\_lock\). The root cause is unresolved; eight online CPUs and sustained timer/IPI operation are not qualified. The next panic records compact IDs, ticket state and up to eight return addresses without changing lock checks.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [The actual build-59 image contains all eight captured affinities, PSCI SMC and the requested SMP/GIC/self-IPI arguments. Fastboot Sending and Booting succeeded; processor counts and timer/IPI masks have not yet been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-59 image contains all eight captured affinities, PSCI SMC and the requested SMP/GIC/self-IPI arguments. Fastboot Sending and Booting succeeded; processor counts and timer/IPI masks have not yet been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 compiles and links all eight-affinity support with NO\_CPU\_OVRD=1 and the secondary-vector correction. Downloaded boot policy, source pins and CPU status strings match. Eight online CPUs, per-core timer/IPI coverage and sustained UI use remain unverified on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Build 58 failed during bootstrap start.s assembly because HAS\_CLUSTER exposed Apple-only CPU\_OVRD accesses. The corrected SoC profile sets NO\_CPU\_OVRD=1. A regression compiling actual reset/resume assembly with the selected board header reproduces the old failure and passes after the fix; the full patch chain and 18 component/ADT contracts pass. Full recompilation and eight-core hardware validation remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 58 failed during bootstrap start.s assembly because HAS\_CLUSTER exposed Apple-only CPU\_OVRD accesses. The corrected SoC profile sets NO\_CPU\_OVRD=1. A regression compiling actual reset/resume assembly with the selected board header reproduces the old failure and passes after the fix; the full patch chain and 18 component/ADT contracts pass. Full recompilation and eight-core hardware validation remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py with actual ARM64 reset/resume assembly</code>. Revision: `19e9b8114df32c45b0b36fc32c187db24bf521c6`.
-- `source`: [The candidate enables all eight captured affinities with PSCI SMC, Aff1 core/Aff2 cluster mapping, eight CPU/two cluster capacity and full-affinity reset/lookup checks. Secondary CPUs install normal XNU exception vectors after MMU setup. Shared counters are atomic; remote redistributor preparation and self IPI are enabled. Host topology and console tests are required; eight-core timer/IPI operation remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The candidate enables all eight captured affinities with PSCI SMC, Aff1 core/Aff2 cluster mapping, eight CPU/two cluster capacity and full-affinity reset/lookup checks. Secondary CPUs install normal XNU exception vectors after MMU setup. Shared counters are atomic; remote redistributor preparation and self IPI are enabled. Host topology and console tests are required; eight-core timer/IPI operation remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 - `host`: [Eight source-kernel regressions and production ARM64 assembly checks passed; the enabled CPU0 code linked successfully. IRQ/IPI behavior was not tested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-kernel-source.py; test-stage6.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## 内存与 DMA {#memory}
 
@@ -382,29 +386,31 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `device`: [The user reported RAM MiB=4096 free=24 avail=2368; free and available values change dynamically. This confirms the current 4 GiB XNU window, not full use of the reported 12 GB physical RAM or any larger UEFI allocation. The free-page snapshot alone does not establish memory pressure.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The GPU resource DTS nodes remain disabled and are omitted from ADT. The image retains the eight CPU affinities, 4 GiB owned window, root volume and matching RAM Data; no larger allocation or new DMA mapping was tested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>Android/FAT/ADT readback of stage7-gpu-resources/boot.img</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [The user reported RAM MiB=4096 free=24 avail=2368; free and available values change dynamically. This confirms the current 4 GiB XNU window, not full use of the reported 12 GB physical RAM or any larger UEFI allocation. The free-page snapshot alone does not establish memory pressure.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The actual build-63 ADT requests 4 GiB and its packed RAM Data matches UUID 1726EAC0-2168-4118-AFD6-19E12FE306E7. Same-build payload checks pass. Temporary launch was accepted; live RAM counters and larger allocations remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-63 ADT requests 4 GiB and its packed RAM Data matches UUID 1726EAC0-2168-4118-AFD6-19E12FE306E7. Same-build payload checks pass. Temporary launch was accepted; live RAM counters and larger allocations remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The actual build-62 ADT requests 4 GiB. Its packed RAM Data matches UUID 9E72E6D9-AC74-428E-A275-E8A25FD3264C and all same-build payload checks. The temporary launch was accepted; live RAM/free/available counters and any larger allocation remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-62 ADT requests 4 GiB. Its packed RAM Data matches UUID 9E72E6D9-AC74-428E-A275-E8A25FD3264C and all same-build payload checks. The temporary launch was accepted; live RAM/free/available counters and any larger allocation remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 retains the 4 GiB owned window and a verified matching volatile RAM Data image. No larger UEFI allocation or live memory measurement was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The actual build-60 ADT requests 4 GiB and its packed RAM Data matches UUID E81D6D67-C2F6-4CAC-9FF9-100EDFF76900. Temporary launch was accepted; live memory readings and larger allocations remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-60 ADT requests 4 GiB and its packed RAM Data matches UUID E81D6D67-C2F6-4CAC-9FF9-100EDFF76900. Temporary launch was accepted; live memory readings and larger allocations remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 retains the 4 GiB owned window and matching volatile RAM Data. No larger allocation or live memory measurement was performed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [Build 59 panicked before live RAM/free/available readings were obtained. The owned window remains 4 GiB while CPU diagnosis continues; no larger window has been tested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 59 panicked before live RAM/free/available readings were obtained. The owned window remains 4 GiB while CPU diagnosis continues; no larger window has been tested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [The actual build-59 ADT requests 4 GiB. Packed RAM Data matches the build-59 UUID and payload checks. The temporary launch was accepted, but live RAM/free/available counters and any larger allocation remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The actual build-59 ADT requests 4 GiB. Packed RAM Data matches the build-59 UUID and payload checks. The temporary launch was accepted, but live RAM/free/available counters and any larger allocation remain unobserved.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 retains the 4 GiB owned window. The downloaded sparse RAM Data and embedded UUID match; no larger UEFI allocation was attempted. The Android snapshot contains the documented contiguous 9 GiB interval, which does not prove current UEFI availability.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `source`: [The captured DDR regions total 12 GiB as 2+4+6 GiB. The high 4 GiB and 6 GiB regions are adjacent; merged Android memory/reg entries describe 9 GiB at 0x8c0000000-0xb00000000. That snapshot does not establish current UEFI free memory. The current kernel manages a single 4 GiB contiguous owned window. The loader accepts a separate 5 GiB trial \(owned\_memory\_size=0x140000000\) only if actual UEFI ConventionalMemory can satisfy it. This CPU candidate retains 4 GiB; no fresh UEFI free map or larger allocation has been observed. RAM Data has sparse 1 GiB logical capacity, not a fixed 1 GiB physical reservation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The captured DDR regions total 12 GiB as 2+4+6 GiB. The high 4 GiB and 6 GiB regions are adjacent; merged Android memory/reg entries describe 9 GiB at 0x8c0000000-0xb00000000. That snapshot does not establish current UEFI free memory. The current kernel manages a single 4 GiB contiguous owned window. The loader accepts a separate 5 GiB trial \(owned\_memory\_size=0x140000000\) only if actual UEFI ConventionalMemory can satisfy it. This CPU candidate retains 4 GiB; no fresh UEFI free map or larger allocation has been observed. RAM Data has sparse 1 GiB logical capacity, not a fixed 1 GiB physical reservation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 - `host`: [DTS/ADT memory and GIC contracts and RAMBlock handoff address bounds passed on the host. DMA behavior was not tested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-format2.py; test-stage6.py</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## 存储与根卷 {#storage}
 
@@ -451,22 +457,22 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 - `host`: [Build 54 passed UFS and SMMU regressions with the shared explicit-extent API, then compiled and linked the existing storage driver. No new hardware storage qualification is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `host`: [Build 53 passed storage regressions. Independent APFS readback confirmed five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes. Packed Data logical hash, kernel Data UUID and embedded seed matched; physical writes remain disabled.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 passed storage regressions. Independent APFS readback confirmed five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes. Packed Data logical hash, kernel Data UUID and embedded seed matched; physical writes remain disabled.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 51 passed UFS regressions; APFS readback confirmed the five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes. Packed Data logical hash, kernel Data UUID and embedded seed matched; no persistent writes were enabled.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 passed UFS regressions; APFS readback confirmed the five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes. Packed Data logical hash, kernel Data UUID and embedded seed matched; no persistent writes were enabled.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 50 passed UFS regressions and full kernel compilation. Independent APFS readback confirmed all five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes; packed Data logical hash, kernel UUID and embedded seed matched.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 passed UFS regressions and full kernel compilation. Independent APFS readback confirmed all five skip-Setup preference groups, migration, UID/GID 501 and 0600 modes; packed Data logical hash, kernel UUID and embedded seed matched.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py; test-stage6.py; ./unixnu kernel -j 3; ./unixnu payload; ./unixnu bootimg; FAT readback</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [Read-only partition bounds, root-window contracts, RAM Data preparation and original storage ABI qualification passed; UFS, Virtio and RAMBlock linked successfully.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-stage6.py; test-root-audit.py; test-ram-data.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## 显示 {#display}
 
@@ -533,65 +539,65 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `device`: [The user confirmed entry into the system after the build-63 display handoff and timing-query fixes. The prior display panic did not prevent this observed startup. This does not isolate contention as its sole cause or establish long-term swap reliability, physical vblank timing or brightness behavior.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user confirmed entry into the system after the build-63 display handoff and timing-query fixes. The prior display panic did not prevent this observed startup. This does not isolate contention as its sole cause or establish long-term swap reliability, physical vblank timing or brightness behavior.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The verified build-63 image includes the logical slot-345 query and console-contention handoff retry. Fastboot accepted its temporary launch. Resolution of the prior swap timeout and sustained UI interaction await hardware observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The verified build-63 image includes the logical slot-345 query and console-contention handoff retry. Fastboot accepted its temporary launch. Resolution of the prior swap timeout and sustained UI interaction await hardware observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [Build 63 passes the original boolean call-site checks and compiled 358-slot vtable checks. The actual final vtable slot 345 points to isTimingEnabled and the old opaque345 guard is absent. The compiled handoff includes its contention retry. These checks do not establish that the hardware swap timeout is resolved; this build has not been booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The user confirmed build-62 slot 345, object 0xfffffff9e67f9000, caller 0xfffffff00578c1cc. Original code calls this boolean TimingEnable query after a five-second swap wait timeout. A deterministic test reproduces lost handoff on console contention; the fix waits for the bounded writer and exits immediately on panic. The qualified query reports logical display state. Actual hardware contention was not captured and other timeout causes remain possible; full compilation and runtime validation are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The user confirmed build-62 slot 345, object 0xfffffff9e67f9000, caller 0xfffffff00578c1cc. Original code calls this boolean TimingEnable query after a five-second swap wait timeout. A deterministic test reproduces lost handoff on console contention; the fix waits for the bounded writer and exits immediately on panic. The qualified query reports logical display state. Actual hardware contention was not captured and other timeout causes remain possible; full compilation and runtime validation are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>ASan/UBSan console and display regressions; exact original slot-345 ABI checks</code>. Revision: `14f50fce9778a8bb19ec6b0b7dc199863526c996`.
-- `host`: [Fastboot accepted the build-62 temporary launch with the existing CPU framebuffer path. System UI behavior and sustained interaction under eight-core scheduling await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Fastboot accepted the build-62 temporary launch with the existing CPU framebuffer path. System UI behavior and sustained interaction under eight-core scheduling await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 passes existing display, console and original/compiled ABI checks. This build has not been booted; sustained UI behavior under eight-core scheduling remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The build-60 temporary launch was accepted with the existing CPU presentation path and expanded panic trace. System UI, stability and displayed trace values await user observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-60 temporary launch was accepted with the existing CPU presentation path and expanded panic trace. System UI, stability and displayed trace values await user observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 passes existing production display/ABI checks. The actual panic renderer displays all eight trace addresses without clipping at 1216x2640 with full stage history and fault fields in the host ASan/UBSan check. System UI under SMP remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [The build-59 user photograph confirms the panic renderer works on secondary affinity 0x200. System UI and sustained presentation under SMP are not qualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The build-59 user photograph confirms the panic renderer works on secondary affinity 0x200. System UI and sustained presentation under SMP are not qualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Fastboot accepted the build-59 temporary launch with the existing CPU presentation path. Reaching the system UI and its performance under SMP await user feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Fastboot accepted the build-59 temporary launch with the existing CPU presentation path. Reaching the system UI and its performance under SMP await user feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 passes production display object/ABI checks and retains CPU framebuffer presentation with the 60 Hz software timer. UI performance and frame presentation under the eight-core candidate remain untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `device`: [The user reports working touch after build 57. This adds basic interactive feedback to the existing CPU display path; it does not qualify brightness, full-screen coordinate calibration or display timing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user reports working touch after build 57. This adds basic interactive feedback to the existing CPU display path; it does not qualify brightness, full-screen coordinate calibration or display timing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-57 fastboot boot; user confirmed touch is working</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `host`: [The build-57 image passed ADT identity, embedded-payload integrity and peripheral-argument checks, then was accepted for temporary boot. Display state, event coordinates and edge calibration await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-57 image passed ADT identity, embedded-payload integrity and peripheral-argument checks, then was accepted for temporary boot. Display state, event coordinates and edge calibration await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 compiled the console-derived 48-pixel edge band and passed overlay bounds/panic regressions. Coordinates, edge calibration and UI reception remain untested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [The HID edge band uses 48 pixels normalized against the actual unrotated console dimensions. Existing rendering and panic precedence are preserved; hardware coordinate calibration is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [On build 56, bottom-up and top-down swipes do not move the lock screen; the power menu opens via the physical key, but its Cancel button does not respond to touch. The static SPI rows intentionally retain the first successful read. Brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The HID edge band uses 48 pixels normalized against the actual unrotated console dimensions. Existing rendering and panic precedence are preserved; hardware coordinate calibration is pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [On build 56, bottom-up and top-down swipes do not move the lock screen; the power menu opens via the physical key, but its Cancel button does not respond to touch. The static SPI rows intentionally retain the first successful read. Brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [Build 56 was temporarily booted after image readback. The new SPI delay or PWR diagnostic rows await user observation; this does not establish system-UI entry, brightness or panel behavior.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 56 was temporarily booted after image readback. The new SPI delay or PWR diagnostic rows await user observation; this does not establish system-UI entry, brightness or panel behavior.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 passed display object/ABI and early-console checks with the new power/timing diagnostics in the existing rows. The downloaded binary contains both PWR formats and the SPI dly field; panel hardware and brightness remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [The existing two SPI diagnostic rows now retain the delay register or an RPMh failure snapshot. No rows are added; display-boundary and panic-preservation tests pass. Panel brightness work remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build-55 user-transcribed SPI RX and SPI dma rows confirm that the retained success snapshot is visible alongside TOUCH. This is diagnostic-overlay evidence only; brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The existing two SPI diagnostic rows now retain the delay register or an RPMh failure snapshot. No rows are added; display-boundary and panic-preservation tests pass. Panel brightness work remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build-55 user-transcribed SPI RX and SPI dma rows confirm that the retained success snapshot is visible alongside TOUCH. This is diagnostic-overlay evidence only; brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-55 temporary boot; user transcribed TOUCH and both SPI rows, then confirmed return code b9</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 55 passed early-console runtime and diagnostic-row/panic checks plus original/compiled backlight ABI checks. The final kernel contains both first-success SPI formats in the existing rows. Brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40437346840)
   Command: <code>Actions build 55; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 54 passed the actual early-console runtime checks, diagnostic-row/panic regressions and compiled backlight ABI checks. DMA/SMMU diagnostic strings are present in the final kernel; brightness remains deferred.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `host`: [Build 53 passed the actual early-console runtime/FP checks after reducing the status snapshot to one 80-byte row. Diagnostic drawing, panic protection, compiled backlight ABI and full link/prelink passed. No new hardware brightness result is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 passed the actual early-console runtime/FP checks after reducing the status snapshot to one 80-byte row. Diagnostic drawing, panic protection, compiled backlight ABI and full link/prelink passed. No new hardware brightness result is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 51 passed diagnostic-row drawing and panic-protection tests, original/compiled backlight ABI checks and full kernel link/prelink. The status rows moved below the camera; no new hardware brightness result is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 passed diagnostic-row drawing and panic-protection tests, original/compiled backlight ABI checks and full kernel link/prelink. The status rows moved below the camera; no new hardware brightness result is claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 50 passed display/status drawing regressions, C/C++ compilation, original and compiled backlight ABI checks, final kernel link/prelink and image readback. Physical brightness, blanking and the PANEL row await runtime observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 passed display/status drawing regressions, C/C++ compilation, original and compiled backlight ABI checks, final kernel link/prelink and image readback. Physical brightness, blanking and the PANEL row await runtime observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [Display timer and DSI transport checks passed. The owned panel object passed the original/compiled ABI audit, entered the display archive and linked into the prelinked kernel; no hardware result claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
   Command: <code>test-stage7.py; test-peripherals.py; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
-- `source`: [DSI command transport, genuine backlight ancestry, timer PM integration and explicit runtime limits; not a complete-kernel or device result.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/drivers/PaganiPanel/README.md)
+- `source`: [DSI command transport, genuine backlight ancestry, timer PM integration and explicit runtime limits; not a complete-kernel or device result.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/drivers/PaganiPanel/README.md)
 - `host`: [Display lifecycle checks and original Legacy ABI qualification passed; the CPU presentation archive compiled and linked. The migrated framebuffer has not been observed on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-stage7.py; ./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## 输入 {#input}
 
@@ -660,68 +666,70 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `device`: [The user confirmed normal touch after the build-63 eight-core temporary boot. Basic UI touch now has device evidence under SMP, in addition to build 57. Detailed multi-touch, coordinate calibration, edge gestures, sleep/wake and long-term stability still require focused validation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user confirmed system UI and normal basic touch with the resource-only GPU candidate. The DTS changes were committed after this test; multi-touch, edge gestures and sleep/wake were not tested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [The user confirmed normal touch after the build-63 eight-core temporary boot. Basic UI touch now has device evidence under SMP, in addition to build 57. Detailed multi-touch, coordinate calibration, edge gestures, sleep/wake and long-term stability still require focused validation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-63 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-63 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-62 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-62 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch under SMP awaits observation; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 passes existing touch/HID contracts and original/compiled ABI checks without changing the touch implementation. Build 57 remains the confirmed basic-touch baseline; touch under SMP awaits hardware testing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [The build-60 image preserves the build-57 touch implementation and disables touch diagnostic rows. Fastboot accepted temporary launch; touch under SMP remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-60 image preserves the build-57 touch implementation and disables touch diagnostic rows. Fastboot accepted temporary launch; touch under SMP remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 passes existing touch/HID regressions and production ABI checks without changing the touch implementation. Build 57 remains the basic-touch hardware baseline; touch under SMP remains unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [Build 59 stopped with a scheduler ticket-lock panic while the last recorded stage was IOHIDEventDriver matching. That stage does not identify the locking caller. Touch under SMP is unqualified; build 57 remains the basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 59 stopped with a scheduler ticket-lock panic while the last recorded stage was IOHIDEventDriver matching. That stage does not identify the locking caller. Touch under SMP is unqualified; build 57 remains the basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [The build-59 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch behavior under SMP awaits feedback; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-59 temporary launch was accepted with unchanged touch implementation and touch diagnostic rows disabled. Touch behavior under SMP awaits feedback; build 57 remains the confirmed basic-touch baseline.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 preserves the build-57 touch implementation and passes transport, HID and original/compiled ABI regressions. Its default boot policy disables touch diagnostics and enables CPU/RAM rows. Touch under the new SMP configuration has not been tested on hardware.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `source`: [After confirmed basic touch in build 57, the candidate removes pagani-peripheral-status=1 from default boot arguments. Touch transport, HID binding and coordinate handling are unchanged.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [The user confirmed that touch is working after the build-57 temporary boot. This is hardware evidence of basic touch response beyond build-56 accepted HID reports. No HID/XY readings or separate multi-touch, coordinate-calibration, edge-gesture, sleep/wake or long-duration results were supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [After confirmed basic touch in build 57, the candidate removes pagani-peripheral-status=1 from default boot arguments. Touch transport, HID binding and coordinate handling are unchanged.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [The user confirmed that touch is working after the build-57 temporary boot. This is hardware evidence of basic touch response beyond build-56 accepted HID reports. No HID/XY readings or separate multi-touch, coordinate-calibration, edge-gesture, sleep/wake or long-duration results were supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-57 fastboot boot; user confirmed touch is working</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `host`: [The user-authorized build-57 temporary boot returned Sending/Booting OKAY. Lock-screen state, ordinary taps, swipes and the TOUCH/HID/XY rows are requested; event binding and UI delivery remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The user-authorized build-57 temporary boot returned Sending/Booting OKAY. Lock-screen state, ordinary taps, swipes and the TOUCH/HID/XY rows are requested; event binding and UI delivery remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 compiled and linked the standalone touch descriptor, product-scoped event-driver matching, qualified per-instance dispatch and edge-origin lifecycle. The downloaded kernel contains binding/event/X/Y diagnostics and matches the pinned sources. No hardware boot was performed; binding, coordinates, ordinary taps and system gestures remain unqualified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [Following the input guide, the candidate separates touchscreen Usage 13/4 from buttons, installs a Pagani S3910 SPI-only IOHIDEventDriver personality, and requires actual driver/ABI/usage/collection binding before sending. A per-instance qualified dispatch wrapper preserves edge-origin 0x800 through release and observes event counts and X/Y. Descriptor, personality, contact/edge lifecycle, bounds and existing transport/power tests pass. Ordinary taps and system gestures remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build 56 shows TOUCH HID report r=0 with count increasing \(observed 430\); v is nonzero while pressed and returns to zero on release. Valid protocol and parsed contact activity now reach the kernel HID API, while UI swipes and an ordinary Cancel tap fail. Current code does not observe event-driver attachment or digitizer dispatch; keyboard-first identity, downstream matching, coordinates and release delivery require investigation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Following the input guide, the candidate separates touchscreen Usage 13/4 from buttons, installs a Pagani S3910 SPI-only IOHIDEventDriver personality, and requires actual driver/ABI/usage/collection binding before sending. A per-instance qualified dispatch wrapper preserves edge-origin 0x800 through release and observes event counts and X/Y. Descriptor, personality, contact/edge lifecycle, bounds and existing transport/power tests pass. Ordinary taps and system gestures remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build 56 shows TOUCH HID report r=0 with count increasing \(observed 430\); v is nonzero while pressed and returns to zero on release. Valid protocol and parsed contact activity now reach the kernel HID API, while UI swipes and an ordinary Cancel tap fail. Current code does not observe event-driver attachment or digitizer dispatch; keyboard-first identity, downstream matching, coordinates and release delivery require investigation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [The matching build-56 image was sent with fastboot boot after the user connected the device. Sending/Booting returned OKAY; touch response and the TOUCH, SPI RX/dly or PWR diagnostic values await hardware feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The matching build-56 image was sent with fastboot boot after the user connected the device. Sending/Booting returned OKAY; touch response and the TOUCH, SPI RX/dly or PWR diagnostic values await hardware feedback.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 compiled and linked the explicit 1800/3100 mV touch requests, 200 ms power wait and checked SPI delays of 50/0. The downloaded kernel contains the new diagnostics and matches all source pins and its RAM Data UUID. No XNU hardware test was performed; valid S3910 traffic and UI touch remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [A synchronized Android gesture capture contains 40 complete press/release cycles over 18.793234 seconds, 726 frames and 51 overlapping valid SPI RX records. Following the hummer S3910 power diagnosis, the candidate validates the 13T command DB resources, requests 1800/3100 mV, waits 200 ms, and sets checked CS/word delays to 50/0 before reset. First-read diagnostics include dly; power failures preserve resource, RSC, TCS and acknowledgement state. Host regressions pass; SE DMA and protocol validation are unchanged, and XNU touch remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [The Android baseline uses the OnePlus HBP driver on the local 6.6.118 kernel. Retained GPI logs show ff TX, a5 23 ca 05 RX, CS delay 50 and inter-word delay 0. Idle RESET/ATTN are high and SPI is runtime suspended; live sampling captured no gesture or active interval. The current port omits an explicit SE\_SPI\_DELAY\_COUNTERS write, but its inherited value and XNU rail state remain unknown, so timing is a candidate cause rather than a confirmed diagnosis.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [A synchronized Android gesture capture contains 40 complete press/release cycles over 18.793234 seconds, 726 frames and 51 overlapping valid SPI RX records. Following the hummer S3910 power diagnosis, the candidate validates the 13T command DB resources, requests 1800/3100 mV, waits 200 ms, and sets checked CS/word delays to 50/0 before reset. First-read diagnostics include dly; power failures preserve resource, RSC, TCS and acknowledgement state. Host regressions pass; SE DMA and protocol validation are unchanged, and XNU touch remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [The Android baseline uses the OnePlus HBP driver on the local 6.6.118 kernel. Retained GPI logs show ff TX, a5 23 ca 05 RX, CS delay 50 and inter-word delay 0. Idle RESET/ATTN are high and SPI is runtime suspended; live sampling captured no gesture or active interval. The current port omits an explicit SE\_SPI\_DELAY\_COUNTERS write, but its inherited value and XNU rail state remain unknown, so timing is a candidate cause rather than a confirmed diagnosis.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Read-only ADB root capture of Android regulator, GPIO, clock and existing SPI IPC logs; compare OnePlus touch and GENI source</code>. Revision: `bdeec6693f1b8488a3286446f0b93c13c02d6785`.
-- `device`: [Build 55 reports TOUCH T0 00 header r=ffffffb9 v=0 n=0; SPI RX n=4 h=00000000 a=0/0 rst=3; SPI dma=1 ti=4 ri=4 st=0. The RX canary is replaced by zeros and both DMA length-in readings are 4, but no valid sensor header or UI touch is obtained. ATTN is low before/after; RESET input and output latch are high. Stock Android explicitly enables ldob4 at 1.8 V and ldob16 at 3.1 V; this port still adopts retained rails, whose XNU state is unknown.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 55 reports TOUCH T0 00 header r=ffffffb9 v=0 n=0; SPI RX n=4 h=00000000 a=0/0 rst=3; SPI dma=1 ti=4 ri=4 st=0. The RX canary is replaced by zeros and both DMA length-in readings are 4, but no valid sensor header or UI touch is obtained. ATTN is low before/after; RESET input and output latch are high. Stock Android explicitly enables ldob4 at 1.8 V and ldob16 at 3.1 V; this port still adopts retained rails, whose XNU state is unknown.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-55 temporary boot; user transcribed TOUCH and both SPI rows, then confirmed return code b9</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
 - `host`: [Build 55 passed actual-adapter first-success retention and zero-header rejection tests, protocol/contact/button/PIO/SE DMA regressions, C/C++ compilation and original/compiled HID ABI checks. Both first-read diagnostic formats are present in the final kernel. The matching image passed readback and fastboot boot; raw RX/GPIO/counter values and usable touch remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40437346840)
   Command: <code>Actions build 55; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `664530f8de814569c8255d07b67c7e2f6d6db3bd`.
-- `device`: [TOUCH T0 00 header r=ffffffb9 v=0 n=0. SPI returned success but the protocol parser rejected a zero header; touch setup stopped before HID start. No SPI error rows appeared. Valid sensor data and UI touch remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [TOUCH T0 00 header r=ffffffb9 v=0 n=0. SPI returned success but the protocol parser rejected a zero header; touch setup stopped before HID start. No SPI error rows appeared. Valid sensor data and UI touch remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-54 temporary boot; user transcribed TOUCH row and absent SPI rows</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
 - `host`: [Build 54 compiled the DMA allocation/cache/SMMU adapter against the original kernel ABI and passed transport/contact/button regressions. The matching image passed local readback and fastboot boot. Whether the QUP stream is available and SE DMA works on the phone remains unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40369222494)
   Command: <code>Actions build 54; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback; fastboot boot</code>. Revision: `fba147283bead8e3e9f7c3ce9edc36f012bb1ec9`.
-- `device`: [First four-byte SPI read still times out. fw=102 if=1 st=41 irq=0; FIFO tx=0 rx=0. FIFO interface disabled is observed; successful DMA and touch are not established.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [First four-byte SPI read still times out. fw=102 if=1 st=41 irq=0; FIFO tx=0 rx=0. FIFO interface disabled is observed; successful DMA and touch are not established.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-53 temporary boot; user transcribed TOUCH and SPI rows</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `host`: [Build 53 passed actual SPI callback/snapshot and protocol/contact/button regressions, C/C++ compilation and original/compiled HID ABI checks. The final image contains both SPI status formats and was temporarily booted; hardware register values are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 53 passed actual SPI callback/snapshot and protocol/contact/button regressions, C/C++ compilation and original/compiled HID ABI checks. The final image contains both SPI status formats and was temporarily booted; hardware register values are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 53; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `c5edbf3617dd5effd63b74f915218539adca1476`.
-- `device`: [Touch remains unresponsive. TOUCH T0 00 header r=ffffff92 v=0 n=0 locates the timeout in the first SPI transfer, before protocol identification. No GENI register snapshot was visible in build 51.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Touch remains unresponsive. TOUCH T0 00 header r=ffffff92 v=0 n=0 locates the timeout in the first SPI transfer, before protocol identification. No GENI register snapshot was visible in build 51.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-51 temporary boot; user transcribed TOUCH status</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `host`: [Build 51 passed actual SPI read callback tests, v1/v2 protocol and contact/button/SPMI/GENI regressions, C/C++ compilation and original/compiled HID ABI checks. The matching image was temporarily booted; touch behavior and protocol status await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 51 passed actual SPI read callback tests, v1/v2 protocol and contact/button/SPMI/GENI regressions, C/C++ compilation and original/compiled HID ABI checks. The matching image was temporarily booted; touch behavior and protocol status await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 51; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `9d9726f53038aa5d090dd13502064de9b4c94128`.
-- `device`: [Lock screen after skipping Setup; short power presses switch the screen off/on, long press opens shutdown UI. Volume presses advance the key-report counter. Touch has no response: TouchComm start r=ffffffb9, n=0, raw value hidden by camera.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Lock screen after skipping Setup; short power presses switch the screen off/on, long press opens shutdown UI. Volume presses advance the key-report counter. Touch has no response: TouchComm start r=ffffffb9, n=0, raw value hidden by camera.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-50 temporary boot; photo and user observation</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `host`: [Build 50 passed actual HID descriptor parsing, TouchComm/contact/button/SPMI/GENI tests, C/C++ compilation and original/compiled HID ABI checks. The matching image was temporarily booted; touch/key response and KEYS/TOUCH rows await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 50 passed actual HID descriptor parsing, TouchComm/contact/button/SPMI/GENI tests, C/C++ compilation and original/compiled HID ABI checks. The matching image was temporarily booted; touch/key response and KEYS/TOUCH rows await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Actions build 50; ./unixnu payload; ./unixnu bootimg; APFS/FAT readback</code>. Revision: `1e98cc4c10c86904d7cafc6cb98dc4a29538628d`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [TouchComm, contact lifecycle, key debounce/failure, SPMI and GENI tests passed. The HID object passed ABI checks and the S3910/GENI sources compiled as C; all three objects linked into the prelinked kernel. Hardware input remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40183635568)
   Command: <code>test-peripherals.py; test-stage7.py; ./unixnu kernel -j 3</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
-- `source`: [Physical HID adapters, bounded TouchComm/SPMI paths, contact and key lifecycle tests; no hardware result claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/drivers/PaganiInput/README.md)
+- `source`: [Physical HID adapters, bounded TouchComm/SPMI paths, contact and key lifecycle tests; no hardware result claimed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/drivers/PaganiInput/README.md)
 
 ## GPU {#gpu}
 
@@ -729,21 +737,27 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 硬件与依赖
 
-- Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected.
+- PKX110 Android runtime DTB SHA-256 d00767f2068d0df73fc2a077de750bba66a5420c77414db1441ff09f6f3ec223, recorded in proprietary-files.txt. It reports Adreno830v2, chip ID 0x44050001, GPU registers 0x3d00000/0x40000, GMU registers 0x3d37000/0x68000, GPUCC 0x3d90000/0x9800, GPU SMMU 0x3da0000/0x40000 and ZAP reserved memory 0x9b09a000/0x2000.
+- GPU IRQs are SPI 300 and 80; GMU HFI/GMU IRQs are SPI 304 and 305. The stock GPU SMMU uses stream IDs 0 \(user\), 1 \(LPAC\), 2 \(secure\) and 5 \(GMU\).
+- The stock DTB has six GPU power-level bins; the active speed bin and its voltage/bandwidth policy need measurement before power-up.
+- A related OnePlus SM8750 Android device repository lists gen80000\_gmu.bin, gen80000\_sqe.fw, gen80000\_aqe.fw and gen80000\_zap.mbn. PKX110 paths and bytes remain unverified.
+- Adreno 830/SM8750 requires a Gen8 backend; catalog Adreno740 is scoped to A740/SM8550 and cannot be selected as the 13T GPU driver.
 
 ### 配置
 
-- No driver is enabled for this subsystem.
+- The shared SM8750 DTSI describes GPU, GMU, GPUCC and GPU SMMU resources with status=disabled. The board DTS supplies the observed chip ID and model. board.toml selects no GPU or Metal component; CPU framebuffer presentation stays active.
 
 ### 操作步骤
 
-- Follow the subsystem guide to identify hardware, firmware and ABI inputs before enabling a component.
+- Validate the shared and board GPU nodes against the captured runtime DTB, including register extents, interrupts and stream IDs.
+- Extract PKX110 GMU, SQE, AQE and signed ZAP firmware from the matching stock image; record paths, sizes and SHA-256 pins in proprietary-files.txt without committing blobs.
+- Implement and qualify an A830 power/GMU/HFI backend, then SMMU mappings, CP submission and a bounded fence before selecting a Metal frontend.
 
 ### 开发经验
 
-- Adreno 830/SM8750 differs from the catalog A740/SM8550 implementation; no GPU component is selected.
-- The SpringBoard/input candidate selects no GPU driver or bridge. Updated upstream Adreno submodules are outside the OnePlus 13T component selection; UI presentation still uses the CPU framebuffer.
-- The eight-core candidate continues to present through CPU framebuffer copies. CPU topology changes do not establish GPU/Metal acceleration.
+- The stock DTB names the GPU Adreno830v2 but advertises qcom,adreno-gpu-gen8-0-1; the two strings are preserved as observed, without inferring a different GPU revision.
+- The disabled DTS nodes record four GPU windows, two GMU windows, GPUCC and the separate GPU SMMU. No clock, power, firmware, SMMU or command operation is activated.
+- The SpringBoard/input and eight-core candidates continue to use CPU framebuffer copies. Their hardware observations do not establish GPU/Metal acceleration.
 
 ### 完成条件
 
@@ -751,15 +765,18 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 当前范围
 
-- No implemented or hardware-verified path is available for this subsystem.
+- The PKX110 GPU firmware files, hashes and active speed bin have not been captured. The A830 power sequence, SMMU ownership, submission ABI and Turnip/Metal integration have no 13T host or hardware qualification.
 
 ### 下一步
 
-- Capture SM8750 GPU/GMU resources and the firmware manifest; qualify a matching implementation before enabling GPU components.
+- Capture and pin firmware from the stock PKX110 image, then implement an opt-in read-only GPUCC/SMMU probe before any power or GMU writes.
 
 ### 证据
 
-按下一步操作收集证据。
+- `device`: [The resource-only candidate reached the system UI with normal basic touch. Its GPU nodes remain disabled and were omitted from ADT, so this test provides no GPU power-up or rendering evidence. The DTS changes were committed after this test.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `source`: [The recorded Android runtime DTB hash identifies the source for the disabled GPU/GMU/GPUCC/SMMU resource nodes and board chip ID.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/proprietary-files.txt)
+- `source`: [Related SM8750 stock firmware list supplies candidate Gen8 filenames; PKX110 firmware is not pinned.](https://github.com/jjpprrrr/android_device_oneplus_sm8750-common/blob/l23.2/proprietary-files.txt)
 
 ## 网络 {#network}
 
@@ -881,22 +898,22 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `host`: [The build-57 image was temporarily booted with the retained build-56 touch power sequence. New hardware power or runtime acknowledgement values have not been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-57 image was temporarily booted with the retained build-56 touch power sequence. New hardware power or runtime acknowledgement values have not been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build 57 retains the checked build-56 touch power and SPI timing. Host power fault regressions and production compilation pass; this round adds no hardware power observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [The HID candidate preserves the build-56 checked RPMh requests, 200 ms power wait and SPI timing. No new power-management behavior or physical voltage claim is introduced.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Reaching build-56 HID report submission implies that the checked RPMh requests and protocol initialization completed along the current control flow. This is not a physical rail-voltage measurement and does not isolate the contributions of the power and SPI-timing changes.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The HID candidate preserves the build-56 checked RPMh requests, 200 ms power wait and SPI timing. No new power-management behavior or physical voltage claim is introduced.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Reaching build-56 HID report submission implies that the checked RPMh requests and protocol initialization completed along the current control flow. This is not a physical rail-voltage measurement and does not isolate the contributions of the power and SPI-timing changes.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [The user-authorized build-56 temporary boot was accepted by fastboot. RPMh acknowledgement values and effective touch rail state under XNU remain unobserved; no power-management completion claim is made.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The user-authorized build-56 temporary boot was accepted by fastboot. RPMh acknowledgement values and effective touch rail state under XNU remain unobserved; no power-management completion claim is made.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build 56 passed production compilation/linking and host fault regressions for the checked touch-only RPMh path. The kernel is downloaded, but no RPMh acknowledgement or physical rail state has yet been observed under XNU.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [The new touch-only RPMh path validates command DB bounds, unique VRM resources and captured board addresses before any rail write. It uses only an idle ACTIVE TCS, verifies register readback and all three voltage/mode/enable acknowledgements, and preserves unrelated TCSes and IRQ bits. Timeout retains the armed slot with its IRQ masked. Shared rail votes remain enabled on cleanup. This establishes a tested host implementation, not measured rail voltage or XNU hardware success.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The new touch-only RPMh path validates command DB bounds, unique VRM resources and captured board addresses before any rail write. It uses only an idle ACTIVE TCS, verifies register readback and all three voltage/mode/enable acknowledgements, and preserves unrelated TCSes and IRQ bits. Timeout retains the armed slot with its IRQ masked. Shared rail votes remain enabled on cleanup. This establishes a tested host implementation, not measured rail voltage or XNU hardware success.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 - `host`: [The PMGR builder qualified the pinned original imports/provider dispatch and linked its archive. Physical power transitions, battery and frequency control remain unverified.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>./unixnu kernel -j 3</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## 镜像组装 {#packaging}
 
@@ -942,7 +959,7 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 当前范围
 
-- Build 63 is device-observed through temporary boot. This does not qualify partition flashing, persistence or future images.
+- Build 63 and the resource-only GPU candidate are device-observed through temporary boot. This does not qualify partition flashing, persistence or later images.
 
 ### 下一步
 
@@ -950,41 +967,43 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `device`: [The user-confirmed build-63 system startup used boot.img SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149, 87957504 bytes, with the recorded same-build kernel/trust/Data and unchanged UEFI. The temporary boot route is device-observed; no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The resource-only image is 87957504 bytes, SHA-256 34b8738bf6ad044df6045039971936644d32690fa354c524478aed51719e0a22. Fastboot Sending and Booting returned OKAY in 2.656s without partition flash; the user confirmed system UI and normal touch. The DTS additions were committed after this test.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+  Command: <code>fastboot boot out/oneplus13t/boot/stage7-gpu-resources/boot.img; user observed UI and touch</code>. Revision: `830e21446dd45a1b8c0c7b350221ce60e87c2379`.
+- `device`: [The user-confirmed build-63 system startup used boot.img SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149, 87957504 bytes, with the recorded same-build kernel/trust/Data and unchanged UEFI. The temporary boot route is device-observed; no partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [Build-63 boot.img is 87957504 bytes with SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149 at out/oneplus13t/boot/stage7-run-63/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted temporary launch in 2.791s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-63 boot.img is 87957504 bytes with SHA-256 af6090c46e4b56a5d83d201273a2bb67466bd13457c44921a3d9e56cd7b41149 at out/oneplus13t/boot/stage7-run-63/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted temporary launch in 2.791s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [Build-63 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-63/ with 127803392 bytes and SHA-256 076c87c95bf3a1496722f4bddf7538b4be336cc80908e4ef3a15eeb4b0f64540. Paired RAM Data UUID is 1726EAC0-2168-4118-AFD6-19E12FE306E7. Source pins, actual display vtable, Clutch policy, packed/raw Data integrity and UUID embedding pass. No build-63 boot image was assembled or booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `source`: [The verified build-62 temporary boot subsequently panicked at display slot 345. No replacement image has been assembled or booted; its kernel, trust cache and RAM Data remain the current local packaging inputs, and earlier images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [Build-62 boot.img is 87957504 bytes with SHA-256 d15c0f5fca06ad13047e653aeaa778b1d3b5c6610448113143d5aa6ab7f1bd2b at out/oneplus13t/boot/stage7-run-62/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.671s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The verified build-62 temporary boot subsequently panicked at display slot 345. No replacement image has been assembled or booted; its kernel, trust cache and RAM Data remain the current local packaging inputs, and earlier images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [Build-62 boot.img is 87957504 bytes with SHA-256 d15c0f5fca06ad13047e653aeaa778b1d3b5c6610448113143d5aa6ab7f1bd2b at out/oneplus13t/boot/stage7-run-62/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.671s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build-62 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-62/ with 127803392 bytes and SHA-256 671d5cc0c9b60b594b481914d3a5874d88e78ebac906834e78577618cfe6629e. Paired RAM Data UUID is 9E72E6D9-AC74-428E-A275-E8A25FD3264C. Source pins, actual Clutch policy, panic strings, packed/raw Data integrity and UUID embedding pass. No build-62 boot image was assembled or booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `host`: [Build-60 boot.img is 87957504 bytes with SHA-256 fddce67146aca4ce607975264689f3cac014f712f7409c00d5f4de923315b4bf at out/oneplus13t/boot/stage7-run-60/boot.img. Android v4, unchanged UEFI, FAT inputs, eight-affinity ADT and same-build kernel/trust/Data checks pass. Fastboot Sending/Booting returned OKAY in 2.659s without flashing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-60 boot.img is 87957504 bytes with SHA-256 fddce67146aca4ce607975264689f3cac014f712f7409c00d5f4de923315b4bf at out/oneplus13t/boot/stage7-run-60/boot.img. Android v4, unchanged UEFI, FAT inputs, eight-affinity ADT and same-build kernel/trust/Data checks pass. Fastboot Sending/Booting returned OKAY in 2.659s without flashing.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build-60 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-60/ with 127803392 bytes and SHA-256 422074400f8eff7b9be51dfec3e895a207f304deb678ba527dcaf23da2eeea35. Its paired RAM Data UUID is E81D6D67-C2F6-4CAC-9FF9-100EDFF76900. Source pins, selected diagnostic patch, actual panic strings, packed/raw Data integrity and UUID embedding pass; no build-60 boot image was assembled or booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `device`: [The verified build-59 image was temporarily loaded successfully, then panicked in the kernel. The next image must use the diagnostic kernel and its matching trust/Data inputs; previous images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The verified build-59 image was temporarily loaded successfully, then panicked in the kernel. The next image must use the diagnostic kernel and its matching trust/Data inputs; previous images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-59 temporary boot; user panic photograph and matching-kernel symbol lookup</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Build-59 boot.img is 87957504 bytes with SHA-256 a58808d933c713e5a32c068f36791d09d2917d2216c7b788250a5a8bafcca349 at out/oneplus13t/boot/stage7-run-59/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.680s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-59 boot.img is 87957504 bytes with SHA-256 a58808d933c713e5a32c068f36791d09d2917d2216c7b788250a5a8bafcca349 at out/oneplus13t/boot/stage7-run-59/boot.img. Android v4, unchanged UEFI, actual FAT inputs, eight-affinity ADT and boot arguments passed readback. Fastboot accepted the temporary launch in 2.680s without flashing a partition.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build-59 kernel/kernel.macho is downloaded at out/oneplus13t/actions/run-59/ with 127803392 bytes and SHA-256 2f501babd1daf3a60700588d21b1ff90394d471fd82751158c726ebaf1033400. Its paired RAM Data UUID is 2B2FB879-4530-4537-8CBD-50692F3F0CA0. Source pins, packed/raw Data integrity and UUID embedding pass; no build-59 boot image has been assembled or booted.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `host`: [Build-57 boot.img is 87957504 bytes, SHA-256 33ad1883076f25b944ccde4fd89776e28c9576589eb0cc6fb8e6df10aeee8b55, at out/oneplus13t/boot/stage7-run-57/boot.img. Android v4, empty ramdisk, unchanged UEFI and actual FAT kernel/trust/Data/ADT passed readback. Fastboot accepted the user-requested temporary boot without flashing; earlier images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-57 boot.img is 87957504 bytes, SHA-256 33ad1883076f25b944ccde4fd89776e28c9576589eb0cc6fb8e6df10aeee8b55, at out/oneplus13t/boot/stage7-run-57/boot.img. Android v4, empty ramdisk, unchanged UEFI and actual FAT kernel/trust/Data/ADT passed readback. Fastboot accepted the user-requested temporary boot without flashing; earlier images are retained.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build 49 passed configuration, UFS regressions, complete kernel link/prelink and matching boot-image assembly/readback. The UFS completion recheck is included; hardware retest remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>test-format2.py; test-stage6.py; ./unixnu kernel -j 3; ./unixnu payload; ./unixnu bootimg; FAT readback</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
-- `host`: [The build-48 boot image passed Android v4, embedded payload and stock-DTB round-trip checks. FAT readback matched the cloud kernel, trust cache and Data seed; all three pagani peripheral arguments and the 4 GiB DarwinBoot, root UUID and PackedRAMDisk/TrustCache handoff properties passed. Hardware remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/README.md)
+- `host`: [The build-48 boot image passed Android v4, embedded payload and stock-DTB round-trip checks. FAT readback matched the cloud kernel, trust cache and Data seed; all three pagani peripheral arguments and the 4 GiB DarwinBoot, root UUID and PackedRAMDisk/TrustCache handoff properties passed. Hardware remains untested.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/README.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; mcopy FAT readback and input hash checks</code>. Revision: `fcab49e2ea2f9ddfaa08ee6e8109ba7ed67029ac`.
-- `host`: [Kernel/prelink, 160 MiB FAT payload and 87928832-byte Android v4 boot image succeeded. Extracted ADT and payload kernel hashes match the reports; no GPU addon is supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/MIGRATION.md)
+- `host`: [Kernel/prelink, 160 MiB FAT payload and 87928832-byte Android v4 boot image succeeded. Extracted ADT and payload kernel hashes match the reports; no GPU addon is supplied.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/MIGRATION.md)
   Command: <code>./unixnu kernel -j 3; ./unixnu build package; ./unixnu firmware; ./unixnu payload; ./unixnu bootimg</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 ## 诊断 {#diagnostics}
 
@@ -1045,51 +1064,51 @@ OnePlus 13T PKX110: build 63 device-confirmed system startup and normal touch, C
 
 ### 证据
 
-- `device`: [The user read CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096 free=24 avail=2368 from the build-63 overlay. The masks show historical nonzero per-core timer/IPI counts, not rate or cross-core stress coverage. The memory counters are dynamic snapshots.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The user read CPU reg=8 online=8 T=ff I=ff and RAM MiB=4096 free=24 avail=2368 from the build-63 overlay. The masks show historical nonzero per-core timer/IPI counts, not rate or cross-core stress coverage. The memory counters are dynamic snapshots.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot boot stage7-run-63/boot.img; user-observed system, touch and CPU/RAM overlay</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [The build-63 image retains CPU/RAM status rows and the bounded ticket-lock trace while disabling touch status rows. Actual CPU counts, timer/IPI masks or a new panic trace await user feedback after the accepted temporary launch.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-63 image retains CPU/RAM status rows and the bounded ticket-lock trace while disabling touch status rows. Actual CPU counts, timer/IPI masks or a new panic trace await user feedback after the accepted temporary launch.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
 - `host`: [Build 63 passes actual-code console contention and panic regressions with ASan/UBSan, including handoff success after the other writer releases and immediate failure when a panic owner exists. The normal log try-lock and first-panic retention remain unchanged. Hardware contention was not captured in the build-62 photograph.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40520726310)
   Command: <code>Actions build 63; download; actual display-vtable, Clutch-policy and paired Data checks</code>. Revision: `3c39bafed673ce1233f533e5b8193a1436d894a3`.
-- `host`: [Normal SMP diagnostics retain try-lock behavior. Display ownership handoff now retries contention and aborts on panic ownership; the actual-code regression fails before the fix and passes after it with ASan/UBSan. Panic remains independent of a stopped console-lock owner. The slot-345 method is qualified against exact original instructions and its timeout format.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Normal SMP diagnostics retain try-lock behavior. Display ownership handoff now retries contention and aborts on panic ownership; the actual-code regression fails before the fix and passes after it with ASan/UBSan. Panic remains independent of a stopped console-lock owner. The slot-345 method is qualified against exact original instructions and its timeout format.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>ASan/UBSan console and display regressions; exact original slot-345 ABI checks</code>. Revision: `14f50fce9778a8bb19ec6b0b7dc199863526c996`.
-- `host`: [The build-62 image retains the CPU/RAM status rows and bounded ticket-lock trace while disabling touch status rows. Runtime CPU counts, timer/IPI masks or a new panic trace await user feedback after the accepted temporary launch.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The build-62 image retains the CPU/RAM status rows and bounded ticket-lock trace while disabling touch status rows. Runtime CPU counts, timer/IPI masks or a new panic trace await user feedback after the accepted temporary launch.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
 - `host`: [Build 62 retains the ticket ownership assertion, logical CPU/compact thread IDs, raw ticket state and eight bounded return addresses. Existing source and console tests pass, and the actual kernel contains the expected formats. Hardware verification of the scheduler correction remains pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40505777459)
   Command: <code>Actions build 62; download; source-pin, linked Clutch policy and paired Data verification</code>. Revision: `c87bced3d8fba74f11c9f91ed6494fb741f29f90`.
-- `device`: [The build-60 photo provides all eight return addresses. Its own symbols and call instructions locate thread\_select after Clutch steal on the thread termination path; current and owner compact IDs both equal f1d34. This identifies the recursive pset0 lock mechanism. The ownership assertion and bounded backtrace remain enabled for the correction.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [The build-60 photo provides all eight return addresses. Its own symbols and call instructions locate thread\_select after Clutch steal on the thread termination path; current and owner compact IDs both equal f1d34. This identifies the recursive pset0 lock mechanism. The ownership assertion and bounded backtrace remain enabled for the correction.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-60 panic photo; matching kernel llvm-nm and llvm-objdump; selected scheduler source comparison</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `host`: [The matching build-60 image was temporarily launched. If the lock panic repeats, capture cpu/ctid/owner/tickets and all BT 0-7 addresses for symbolication against this exact kernel. No new device trace has been recorded yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [The matching build-60 image was temporarily launched. If the lock panic repeats, capture cpu/ctid/owner/tickets and all BT 0-7 addresses for symbolication against this exact kernel. No new device trace has been recorded yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
 - `host`: [Build 60 contains the CPU/compact-ID/ticket and BT 0-7 formats in the actual linked kernel. The real diagnostic function passes 0-8-frame and unchanged-lock checks, and the actual renderer keeps all eight addresses visible. Hardware capture and the panic root cause remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40499765573)
   Command: <code>Actions build 60; download; source-pin, panic-format and paired Data verification</code>. Revision: `faa6aa2cbd8d0a005f85cb2ad6749c769df6e586`.
-- `source`: [The build-59 panic identifies pset0+0x100 on secondary affinity 0x200 but lacks a call trace. The device patch preserves the ownership assertion and appends compact IDs, ticket state and an eight-frame XNU backtrace. The host regression covers 0-8 frames, zero-filled unused entries, formatting and unchanged lock state; full compilation and hardware trace capture are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `host`: [The build-59 image enables the two CPU/RAM status rows and disables touch status rows. The user has been asked to transcribe registered/online CPU counts, timer/IPI masks and RAM MiB after the accepted temporary launch; no runtime values are recorded yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [The build-59 panic identifies pset0+0x100 on secondary affinity 0x200 but lacks a call trace. The device patch preserves the ownership assertion and appends compact IDs, ticket state and an eight-frame XNU backtrace. The host regression covers 0-8 frames, zero-filled unused entries, formatting and unchanged lock state; full compilation and hardware trace capture are pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `host`: [The build-59 image enables the two CPU/RAM status rows and disables touch status rows. The user has been asked to transcribe registered/online CPU counts, timer/IPI masks and RAM MiB after the accepted temporary launch; no runtime values are recorded yet.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT/ADT readback; fastboot boot</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
 - `host`: [Build 59 compiles the SMP console, passes first-panic ownership and contention tests, and contains the CPU registered/online, timer/IPI and RAM status formats. The actual runtime values have not yet been observed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40483050380)
   Command: <code>Actions build 59; download; source-pin and paired Data verification</code>. Revision: `859dbce9a793d194f48399633353073df1dc880f`.
-- `source`: [Normal console writers use a nonblocking cross-CPU lock after VM setup; contended observations are skipped and a first-writer panic owner prevents another CPU from replacing its message. The opted-in platform overlay reports processor\_count, processor\_avail\_count, timer/IPI bitmaps and RAM/free/available MiB in two rows. Touch status is disabled by default.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build-57 user feedback confirms working touch, but the HID binding/event counters and XY rows have not been transcribed. Preserve the verified image as the basic-touch baseline; detailed counters and gesture behavior remain unmeasured.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Normal console writers use a nonblocking cross-CPU lock after VM setup; contended observations are skipped and a first-writer panic owner prevents another CPU from replacing its message. The opted-in platform overlay reports processor\_count, processor\_avail\_count, timer/IPI bitmaps and RAM/free/available MiB in two rows. Touch status is disabled by default.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build-57 user feedback confirms working touch, but the HID binding/event counters and XY rows have not been transcribed. Preserve the verified image as the basic-touch baseline; detailed counters and gesture behavior remain unmeasured.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-57 fastboot boot; user confirmed touch is working</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `host`: [Build-57 image readback verified the matching kernel and Data UUID ADDC2464-BA09-47F6-B71E-EA117F2C0F73. Fastboot Sending/Booting returned OKAY in 2.706s. The image directory contains fastboot-boot.log; TOUCH/HID/XY or SPI/PWR readings await user observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-57 image readback verified the matching kernel and Data UUID ADDC2464-BA09-47F6-B71E-EA117F2C0F73. Fastboot Sending/Booting returned OKAY in 2.706s. The image directory contains fastboot-boot.log; TOUCH/HID/XY or SPI/PWR readings await user observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
 - `host`: [Build-57 kernel is 127803392 bytes with SHA-256 42dd53a4341d47ac5da894ae4ad1df02f7f5e5b5d7de5ee3b58ed07f0b744a87. Source pins, actual HID/XY/wait/bind strings, packed/raw Data integrity and UUID ADDC2464-BA09-47F6-B71E-EA117F2C0F73 passed local checks. Hardware readings await a separate boot instruction.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40461298553)
   Command: <code>Actions build 57; gh run download; kernel/source-pin and packed/raw Data verification</code>. Revision: `ad6ed2d5dcb0a12e7d0b24108440b265df33a477`.
-- `source`: [After valid touch parsing, two existing rows show HID binding bits, usage, dispatch/digitizer counts, edge starts, input/event X/Y and event mask. Protocol/SPI failure snapshots and panic freeze remain intact. Full binding is 0x1f; accepted reports and dispatched events remain separate from UI delivery.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Build-56 readings are SPI RX n=4 h=001c10a5 a=0/0 rst=3 and SPI dma=1 ti=4 ri=4 st=0 dly=c800. These are fixed first-read snapshots. TOUCH v is the contact-ID mask and n counts accepted handleReport calls, not UI events. Add downstream binding/dispatch and X/Y observation in the next candidate.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [After valid touch parsing, two existing rows show HID binding bits, usage, dispatch/digitizer counts, edge starts, input/event X/Y and event mask. Protocol/SPI failure snapshots and panic freeze remain intact. Full binding is 0x1f; accepted reports and dispatched events remain separate from UI delivery.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Build-56 readings are SPI RX n=4 h=001c10a5 a=0/0 rst=3 and SPI dma=1 ti=4 ri=4 st=0 dly=c800. These are fixed first-read snapshots. TOUCH v is the contact-ID mask and n counts accepted handleReport calls, not UI events. Add downstream binding/dispatch and X/Y observation in the next candidate.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>Build-56 temporary boot; user transcribed TOUCH/SPI rows and tested press/release, both edge swipes and power-menu Cancel</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `host`: [Build-56 boot.img is 87953408 bytes, SHA-256 66aebc977d9558905f25851b8753e06556bb64f29df25a8d5feab3e970e3b5fd. Android header, embedded UEFI/FAT, matching kernel/trust/Data and ADT arguments passed readback. Fastboot Sending/Booting returned OKAY in 2.683s, without flashing; runtime diagnostics await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `host`: [Build-56 boot.img is 87953408 bytes, SHA-256 66aebc977d9558905f25851b8753e06556bb64f29df25a8d5feab3e970e3b5fd. Android header, embedded UEFI/FAT, matching kernel/trust/Data and ADT arguments passed readback. Fastboot Sending/Booting returned OKAY in 2.683s, without flashing; runtime diagnostics await observation.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>./unixnu payload; ./unixnu bootimg; Android/FAT readback; fastboot boot</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
 - `host`: [Build-56 kernel size is 127799296 bytes and SHA-256 is 42500cf7b10de6ef3f51c1114de5f31f7652c1697e4844d53d40d77bf0848121. Local checks passed for source pins, actual PWR/dly strings, packed/raw RAM Data integrity and matching UUID E9CAF07B-447E-4020-AF28-0E4B3A0B1296. Hardware readings await a separately authorized boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40448445357)
   Command: <code>Actions build 56; gh run download; local kernel/source-pin and packed/raw Data verification</code>. Revision: `3a12121d3ef9fdee1636500665c5cbb4baf5b83c`.
-- `source`: [Power failures retain PWR address/hardware/slot and status/command snapshots in the existing two diagnostic rows. Successful first-read diagnostics add the actual SPI delay register. Host tests verify formatting, retained first-read evidence and frozen panic output; kernel compilation passed in build 56, while hardware readings remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
-- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Power failures retain PWR address/hardware/slot and status/command snapshots in the existing two diagnostic rows. Successful first-read diagnostics add the actual SPI delay register. Host tests verify formatting, retained first-read evidence and frozen panic output; kernel compilation passed in build 56, while hardware readings remain pending.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
+- `device`: [Sending and Booting returned OKAY. The user reported no repeat panic during the test, while touch, volume/power keys and brightness remained unusable. Test duration was not specified; this does not qualify long-term stability or input.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot stage7-run-49/boot.img; user observation</code>. Revision: `be18db0025fbde66ffd0a55302f9c1bc0fe3c122`.
-- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `device`: [Build 48 briefly reached the UI. Touch, volume/power keys and brightness did not respond; a UFS read timed out after 297989 reads. The screenshot shows one busy sample, elapsed time beyond the deadline and a later completed DMA snapshot. No partition was flashed.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
   Command: <code>fastboot -s 3B15BB01BAT00000 boot out/oneplus13t/boot/stage7-run-48/boot.img</code>. Revision: `e6435b2bda6e91431f3bc0c442d1ff9c47be1451`.
 - `host`: [Source-kernel regressions, early console compilation and panic-entry contract passed in CI; runtime checkpoints still require a hardware boot.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/actions/runs/40174199304)
   Command: <code>test-kernel-source.py; drivers/BootProgress/Test/panic-entry.py</code>. Revision: `af2ba2975a5f0f6dcedfdcc719a1c646876f5804`.
-- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/board.toml)
-- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/e1436a2dd4c231f4c5184b6851a2c1192e56b012/STAGE6.md)
+- `source`: [Current format-2 selection and board policy.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/board.toml)
+- `source`: [Historical PKX110 observations through build 39; no claim of migrated-image hardware verification.](https://github.com/IssacL04/UniXNU-Pagani_SM8750/blob/cdd273d72a1e3a08f118e1fb69b39ed18c3bc929/STAGE6.md)
 
 </div>

docs/zh/devices/peridot-hoshikv.md

@@ -0,0 +1 @@
+[hoshikv/UniXNU-peridot](https://github.com/hoshikv/UniXNU-peridot)

docs/zh/devices/pong-hxzbaka.md

@@ -0,0 +1 @@
+[hxzbaka/UniXNU-pong](https://github.com/hxzbaka/UniXNU-pong)

docs/zh/devices/pong.md

@@ -1,26 +1,523 @@
-# Nothing Phone (2)（pong）
+# Nothing Phone \(2\)（pong）
 
-pong 是搭载 SM8475 的 Nothing Phone (2)。下面的移植是独立的社区项目，UniXNU 组织不维护它。目标是 iOS 16.6.1（20G81），使用 iPad7,1 / J120 身份。
+[Chengdong-Yu/UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong)
 
-| 仓库 | 维护者 | 状态 |
-| --- | --- | --- |
-| [UniXNU-pong](https://github.com/Chengdong-Yu/UniXNU-pong) | [Chengdong-Yu](https://github.com/Chengdong-Yu) | 已进入 iOS 16.6.1 主屏幕；显示、触控、UFS/APFS 启动、UFS Data 挂载及 Adreno 730 硬件加速与 Metal 已接通 |
-| [uefi-pong](https://github.com/Chengdong-Yu/uefi-pong) | [Chengdong-Yu](https://github.com/Chengdong-Yu) | 带 `pongPkg` 的 Mu-Silicium 固件 |
+<div v-pre>
 
-## 状态
+Nothing Phone \(2\), iPadOS18 Darwin24 local format2 migration and board adaptation
 
-| 区域 | 状态 |
+源记录: [porting.toml](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/porting.toml), `ffdad781cb16b42a1fb5c984f77998253b821d8c`.
+
+本页按设备记录自动生成。
+
+| 部分 | 状态 |
 | --- | --- |
-| iOS 16.6.1 启动 | 已进入主屏幕 |
-| 显示 | 1080x2412 面板显示系统界面 |
-| 触控和按键 | Pong 触控路径、电源键和音量键已接通 |
-| UFS 和 APFS | 原生 UFS 和 APFS 启动路径已接通，Data 在 UFS 上正常挂载，部分挂载能力仍在完善 |
-| 可写 Data | Data 在 UFS 上正常挂载 |
-| Adreno 730 和 Metal | Adreno 730 硬件加速与 Metal 渲染已接通 |
-| Wi-Fi、蓝牙、相机、音频、传感器 | 尚未完成设备适配 |
+| [配置](#configuration) | `implemented` |
+| [固件与启动](#firmware) | `implemented` |
+| [CPU 与中断](#cpu) | `implemented` |
+| [内存与 DMA](#memory) | `implemented` |
+| [存储与根卷](#storage) | `implemented` |
+| [显示](#display) | `implemented` |
+| [输入](#input) | `implemented` |
+| [GPU](#gpu) | `implemented` |
+| [网络](#network) | `implemented` |
+| [音频](#audio) | `implemented` |
+| [电源](#power) | `implemented` |
+| [镜像组装](#packaging) | `implemented` |
+| [诊断](#diagnostics) | `implemented` |
 
-设备仓库按 HTTP Range 从恢复镜像中只获取需要的 iOS 16.6.1 组件。Apple 恢复文件、生成的 userdata 镜像和 GPU 固件不进入仓库。
+## 配置 {#configuration}
 
-## 维护
+`implemented`
 
-维护者拥有仓库和发布决定。UniXNU 文档记录移植及其状态，不接管维护。
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- 选择 ARM64、SM8475、22H374 和 Pong 四层配置，数组完整列出。
+
+### 开发经验
+
+- 格式2解析、DTS编译、Darwin24内核及启动镜像构建成功；公开源固定版本已补齐。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- SM8475公共层与Pong聚合源码分目录固定；平台组件进一步拆分待完成。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [格式2解析、DTS、内核和启动镜像已构建；services73未安装或启动。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## 固件与启动 {#firmware}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- 复用 Pong UEFI，DarwinBoot24 接管真实可分配区间并使用 PSCI。
+
+### 开发经验
+
+- 现有设备可进入桌面，物理内存与可分配内存分别记录。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 固件输入与UEFI源码在独立仓库。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [现有设备可进入桌面，物理内存与可分配内存分别记录。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## CPU 与中断 {#cpu}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- 使用 0x000..0x700 affinity、GICv3 和 19.2 MHz timer。
+
+### 开发经验
+
+- CPU 4/3/1 拓扑保持 SM8475；受管内存沿用已启动实现。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 没有声明新的多核稳定性测试结果。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [CPU 4/3/1 拓扑保持 SM8475；受管内存沿用已启动实现。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## 内存与 DMA {#memory}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- 从实际不连续 DRAM 和保留区接管已取得所有权的 RAM。
+
+### 开发经验
+
+- 物理容量12GiB；此前受管容量9728MiB，不能将物理空洞分配给VM。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 尚未接通全部物理内存。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [物理容量12GiB；此前受管容量9728MiB，不能将物理空洞分配给VM。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## 存储与根卷 {#storage}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- 原生 UFS + 22H374 IOStorageFamily，独立 OS/SystemOS/Data 窗口。
+
+### 开发经验
+
+- 8GiB可写UFS Data已有启动记录；本轮只准备本机OS更新，未写入手机。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 分区与镜像输入本地保存。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [本机OS中init及音频策略已更新，设备仍保留services72。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## 显示 {#display}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- Pong 1080x2412、stride4320；DCS背光和原有显示服务。
+
+### 开发经验
+
+- 桌面与壁纸已有显示；120Hz是请求值，不代表测得帧率。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 实际高刷新率和背光仍需设备反馈。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [桌面与壁纸已有显示；120Hz是请求值，不代表测得帧率。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## 输入 {#input}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- Goodix Berlin-D，PM8350实体按键转HID/原生音量控制。
+
+### 开发经验
+
+- services72真实音量press/release到达SBVolumeControl，电源down到达Consumer HID；本轮核对22H374事件接口，未新增虚构设备。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 音量实际生效及独立电源按下/释放后的锁屏动作尚未确认。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [services72已观察真实输入事件，系统动作仍需设备结果。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## GPU {#gpu}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- SM8475 A730、实际固件、SMMU、Turnip与22H374 Metal ABI。
+
+### 开发经验
+
+- 已有桌面硬件渲染记录，保留此前高RAM BO和copy分配修补。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 复杂壁纸和长时间稳定性没有新增结论。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [已有桌面硬件渲染记录，保留此前高RAM BO和copy分配修补。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## 网络 {#network}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- Pong PCIe0/QCA6490，82项PHY序列、GPIO80/94/95/96/204、RPMh。
+
+### 开发经验
+
+- services72 PCIe link/BAR及128MiB散页DMA建表成功，停在SMMU context readback；services73按SM8475实现修正先TCR2/TCR后TTBR，编译通过。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 本轮未启动；SMMU启用、QMI固件、扫描与联网仍未确认。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [services72日志定位SMMU写序；services73复用ArmSmmu4K公共编程原语，未实机启动。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## 音频 {#audio}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- ADSP/GPR/APM、TFA9873双扬声器、MI2S LPAIF0 tertiary/SD0。
+
+### 开发经验
+
+- services72 APM、功放和现代HAL初始化成功；audiomxd因独立AirPlay路由RPC超时退出。services73在launchd前选择原生集成音频provider，运行时已编译。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 尚无StartIO、PCM完成或实际出声证据；不公开麦克风。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [services72的audiomxd堆栈定位CoreMedia路由等待，services73策略与launchd服务门控保持一致。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## 电源 {#power}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- SM8475 ADSP/RPMh、PMIC battery管理和Pong电源策略。
+
+### 开发经验
+
+- DSP readiness和电池协议已有日志；控制器值保持Pong板级来源。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 系统挂起恢复尚未完成。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [DSP readiness和电池协议已有日志；控制器值保持Pong板级来源。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+## 镜像组装 {#packaging}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- Darwin24/XNU11417与22H374原始组件，格式2硬件输入与固定ABI。
+
+### 开发经验
+
+- services73使用匹配22H374的IOStorage/IOGPU导入；内核43834376字节，启动镜像102514688字节，构建完成。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- Apple镜像、固件和ABI二进制均需本机准备。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [内核、运行时与启动镜像已构建，产物留在本机；未安装、未启动。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/ipados18/services73-smmu-audio.md)
+
+## 诊断 {#diagnostics}
+
+`implemented`
+
+组件: `PongPlatform24`.
+
+### 硬件与依赖
+
+- Pong live Android DT、NothingOSS SM8475源码与匹配22H374 restore
+
+### 配置
+
+- board.toml、pong\_ipados18\_defconfig 与对应板级配置
+
+### 操作步骤
+
+- 保留屏幕启动日志和ramoops，REC抓取完整console。
+
+### 开发经验
+
+- services72的REC日志与audiomxd超时堆栈已分析，services73修补只构建、未启动。
+
+### 完成条件
+
+- 在设备上观察该接口的实际工作结果并保存对应日志
+
+### 当前范围
+
+- 本轮未启动，SMMU、联网、PCM声音和按键动作仍需设备结果确认。
+
+### 下一步
+
+- 读取本轮启动日志并继续完成板级接口
+
+### 证据
+
+- `source`: [services72的REC日志与audiomxd超时堆栈已分析，services73修补只构建、未启动。](https://github.com/Chengdong-Yu/UniXNU-pong/blob/ffdad781cb16b42a1fb5c984f77998253b821d8c/migration/format2/README.zh.md)
+
+</div>

docs/zh/devices/sirius-huajifruit.md

@@ -6,7 +6,7 @@
 
 Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: entry, MMU, timer, PSCI, platform expert and the boot-progress console work on hardware; IOKit is blocked on AppleARMCPU claiming /cpus.
 
-源记录: [porting.toml](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/porting.toml), `86fe9ffbc700915e006fce11474b0d277f0d7dc3`.
+源记录: [porting.toml](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/porting.toml), `06a72d58315e45e7f830a429d683861d2fc536d9`.
 
 本页按设备记录自动生成。
 
@@ -60,6 +60,15 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 - Format 2 replaced the hand-written ADT generator of the legacy port \(scripts/make-sirius-adt.py\) with a board DTS: the payload step compiles the tree and derives kernel.macho.adt from it.
 - The arm-io base is derived from the exported nodes, not written by hand: the GIC at 0x17a00000 makes the window start at 0x17000000, which XNU reads as the SoC base.
 - The legacy port set ipad\_identity = true; in format 2 the same identity is the OS profile's \[adt\] tables, so the board only states its deviations.
+- configs/sirius\_defconfig keeps the ARM64 profile's CONFIG\_XNU\_NATIVE\_PAN=y: Kryo 360 implements PAN and SCTLR\_EL1 leaves SPAN clear, so every exception entry sets PSTATE.PAN, and only the PAN build clears it around copyin/copyout \(see the diagnostics area\).
+- CONFIG\_XNU\_NATIVE\_CS\_HASH\_CACHE=y is back on: iPadOS signs code in 16 KiB pages, and this 4 KiB kernel accepts the dyld shared cache's signature only through the native 4K hash cache.
+- The SystemOS cryptex mount \(OWNER\_CACHE\_MOUNT, OWNER\_CACHE\_STARTUP, OWNER\_UNION\_SYSTEMOS\) builds in the bring-up mode BRINGUP\_OWNER\_CACHE, as the uke port does, and its volume is authorized by the boot argument sirius-allow-unverified=1, not by an owner root policy.
+- sirius\_emmc\_hs=3 lets the eMMC driver climb to 25, 50 and 100 MHz, each step proven against blocks read at 400 kHz; the card settles at 50 MHz \(HS\_TIMING 1\).
+- The Data volume: OWNER\_DATA\_MOUNT with SIRIUS\_DATA\_SEED \(NativeEmmc serves the seed instead of RamBlock\) and CONFIG\_XNU\_OWNER\_DATA\_VOLUME\_UUID = EB6CBBA0-ECB9-4556-A483-4B60D54D4306, the volume of the seed that .github/workflows/data-seed.yml built; \[payload.adt\] owned\_memory\_size gives the kernel a 1 GiB window to hold the seed. On the phone the window lands below 4 GiB \(seed at 0xa3cc1000\), the seed is published as the Data window and the kernel mounts its volume \(disk3s1, OwnerData\) at /private/var before launchd.
+- With the Data volume mounted, launchd's mount -P 1 still exits 66: apfs logs 'DT\_get\_fstab\_entries: failed to get filesystem entry at: /filesystems/fstab', and the uke port traced the fatal error to the missing /chosen/boot-manifest-hash. \[adt.chosen.bytes\] boot-manifest-hash now carries uke's explicit bring-up boot-set identity \(SHA-384 of 'UkeBringup.BootSet.v1\\0'\), as asteroids does. On the phone mount-phase-1 and mount-phase-2 then pass and launchd reports 'Early boot complete. Continuing system boot.'
+- Past early boot the 32 MiB Data volume runs out of space \(ENOSPC\) and watchdogd traps \(brk \#1\), which panics the boot. kernel\_args now pass sheng-disable-watchdogd=1 and sheng-lite=1 to package/BootWatchdogPolicy.c \(already linked and called after the Data mount\), which disables watchdogd and the network/iCloud/photo daemons through launchd's disabled.plist, and the seed workflow grows the container to size\_mib \(256 MiB, held in RAM inside the 1 GiB window\); the volume UUID stays across the grow. Not yet booted.
+- Each seed workflow run formats a new volume, so the 256 MiB seed \(run 40621149780, owner-data.cdr 48a10f78...\) has UUID E06A21C1-6686-49B8-B242-ED82B00F4AF8, which the defconfig now names; with the seed inside, the payload files take 306 MiB, so \[payload\] size\_mib is 512 \(the vendor partition holds 3 GiB\).
+- Persistent Data configuration: kernel\_args now passes sirius-data-write=1 so NativeEmmc publishes the persistent Data container behind the root image in userdata read-write; \[payload\] size\_mib is reset to 256 MiB because the Data container no longer travels in the vendor payload volume; .github/workflows/data-seed.yml default container size is updated to 8192 MiB.
 
 ### 完成条件
 
@@ -69,7 +78,8 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 ### 当前范围
 
 - The SoC profile is new: only the GIC, PSCI, counter and the timer INTID are shared, everything else is still board-local.
-- No device-verified configuration has been recorded against a commit of this repository yet; the evidence is the legacy port's handoff document.
+- The Data seed holds files from the IPSW, so the workflow uploads it encrypted \(ARTIFACT\_PASSPHRASE\) and the payload step takes it from a local path; a new seed has a new volume UUID that the defconfig must follow.
+- The 1 GiB window must start below 4 GiB for the eMMC's 32-bit ADMA2; whether this unit's memory map offers one such run is not yet observed.
 
 ### 下一步
 
@@ -78,7 +88,13 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [Hardware values, the boot chain and the bring-up history of the legacy port, from which this configuration is carried over.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Hardware values, the boot chain and the bring-up history of the legacy port, from which this configuration is carried over.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
+- `device`: [With CONFIG\_XNU\_NATIVE\_PAN=y the driver reads PAN as 4194304, all eight CPUs pass the init copyout and launchd's first syscalls return.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-pan.log)
+  Command: <code>fastboot flash vendor payload-E-pan-noclear.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420</code>. Revision: `b1a11c4f4eb0bfd28b2dd3dfc59b3c7e3a3e742f`.
+- `device`: [With the SystemOS mount, the 4K hash cache and sirius\_emmc\_hs=3 the shared cache is verified in about 104 s at 50 MHz and dyld maps it.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-fast-emmc.log)
+  Command: <code>fastboot flash vendor payload-H-fast.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 900</code>. Revision: `1163990229f446753ef006126e55922aa23bda6a`.
+- `host`: [Run 40615426205 built owner-data-32.cdr \(33554432 bytes, sha256 5679d2cf59eba99aa048be0c0e253581aa5bfb1fdff7ff431ed9e91c2bd58c63\) with APFS volume EB6CBBA0-ECB9-4556-A483-4B60D54D4306.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/.github/workflows/data-seed.yml)
+  Command: <code>gh workflow run data-seed.yml -R HuajiFruit/UniXNU-sirius --ref main</code>. Revision: `9562de8b362e6bbae9844052826c609996866aed`.
 
 ## 固件与启动 {#firmware}
 
@@ -124,7 +140,7 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [Boot-chain diagram, the marker-file boot rule and the DarwinBoot GIC pre-configuration rationale.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Boot-chain diagram, the marker-file boot rule and the DarwinBoot GIC pre-configuration rationale.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## CPU 与中断 {#cpu}
 
@@ -169,7 +185,7 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [Timer INTID measurement, the TOPO checkpoint and the AppleARMCPU panic analysis.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Timer INTID measurement, the TOPO checkpoint and the AppleARMCPU panic analysis.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## 内存与 DMA {#memory}
 
@@ -208,7 +224,7 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [DRAM split, framebuffer address and the memory-map checkpoint.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [DRAM split, framebuffer address and the memory-map checkpoint.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## 存储与根卷 {#storage}
 
@@ -250,6 +266,18 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 - The init exec returns 0 and then nothing asks the driver for another block: reads stop at 0x10D \(269 requests, 0x98F blocks\) while the heartbeat keeps counting, so the wait is past the storage stack. The caller side is now instrumented \(sirius-post-exec-trace.patch\): the exec thread-switch state, every new user thread start at thread\_bootstrap\_return, the first pid 1 syscalls with their returns, each bsd\_ast for pid 1 and the first user faults after the exec, all written to the same USB ring and summarised by the heartbeat.
 - The caller-side probe closes that question: the pid 1 thread stays in load\_init\_program\_at\_path, inside copyout\(\) of the launchd path, and takes 62.6 million faults in about a minute. The stall is a fault loop in the exec path, not a storage wait.
 - That fault loop was PAN \(see the diagnostics area\). With CONFIG\_XNU\_NATIVE\_PAN=y and the driver no longer clearing PAN, all eight CPUs pass the copyout, the exec returns 0 and launchd issues its first syscalls, every one of them returning: 74, 372, 294, 20, 427, 381, 5, 90, 4 and 202. Syscall 294 \(shared\_region\_check\_np\) returns ENOMEM with 'vm\_shared\_region\_start\_address\(\) failed', i.e. dyld finds no shared cache mapped; afterwards the launchd thread waits and the read count stays at 0x113.
+- The shared cache is in the SystemOS cryptex. Building the ARM64 series' owner SystemOS mount \(OWNER\_CACHE\_MOUNT, OWNER\_CACHE\_STARTUP, OWNER\_UNION\_SYSTEMOS, with BRINGUP\_OWNER\_CACHE as the uke port has it\) and answering its two block hooks from NativeEmmc \(sirius-allow-unverified=1\) mounts disk4s1 \(SystemCryptex, 8846FE78-2910-4297-AF97-D59BB6F8FC16\) as a union over / before launchd starts; dyld then opens the cache, fstats it and preads its header.
+- Registering the cache's code signature \(fcntl, syscall 92\) then returned 85 \(EBADEXEC\): iPadOS signs code in 16 KiB pages, and this 4 KiB kernel only accepts that through native-4k-signature-hash-cache.patch, which the first-console configuration had off. With CONFIG\_XNU\_NATIVE\_CS\_HASH\_CACHE=y the call returns 0 after the kernel reads the whole cache once, and dyld maps it \(197 and 73 return 0\).
+- The block driver ran at the 400 kHz identification clock all along: sirius\_emmc\_prepare\(\) reprogrammed it after the probe's 25 MHz switch, and every 512-byte block was its own CMD17 with five ring lines. On this 8-bit bus that is about 770 blocks/s, and the 2.81 GiB cache took two hours. Multi-block reads \(CMD18 with Auto-CMD12, 256 blocks per command through an ADMA2 table\) and a clock ladder proven against blocks read at 400 kHz bring it to 50 MHz: EXT\_CSD reports rev 8, width 2 \(8-bit\), HS\_TIMING 1 and DEVICE\_TYPE 0x57, runs pass with EIS 0, and the whole cache is read in about 104 s \(27 MiB/s on average, 30 MiB/s peak\).
+- Past the shared cache launchd runs its boot tasks: mount \(pid 3\) exits with status 66 \(EX\_NOINPUT\) and the boot panics with 'mount\[3\] exited'. There is no Data volume yet, which is the mount it needs.
+- NativeEmmc serves the Data seed itself instead of RamBlock: the payload's /chosen/memory-map/RAMDisk becomes a read-write RAM window named Data, and the driver answers the two RamBlock entry points kern\_exec.c calls once its seed path is compiled in, native\_ram\_block\_volume\_seed\(\) \(the Data volume on that window\) and native\_ram\_block\_gpu\_addon\(\) \(none on this board; the first link failed on it as an undefined symbol although its declaration is weak\). IOMaximumBlockCountRead is 2048 blocks now that transfers run in 256-block commands.
+- Once userland read in parallel, APFS reported data hash mismatches on the sealed SystemOS volume \(disk6s1\). The block driver drains requests on their callers' threads through one shared bounce buffer, and released the transport lock between the read into it and the copy out of it, so a second reader could refill it first and the first request received the other one's blocks. The copy now happens under the lock \(the request's memory is wired for the I/O, so it cannot fault back into the driver\). Not yet booted.
+- native\_ram\_block\_volume\_seed\(\) takes the one APFS volume on the RAM window instead of looking the kernel's UUID up, since a Data seed can only be there and every seed build has a new UUID; a differing UUID is reported, not refused, so a new seed no longer needs a new kernel.
+- With the copy under the lock, a 256 MiB seed, sheng-disable-watchdogd=1 and sheng-lite=1, the boot runs without a panic for the whole capture \(heartbeat at 336 s\): no data hash mismatch is reported, the watchdog policy disables watchdogd, early boot completes at 170 s and only liveactivitiesd crashes. The Data volume then fills about a minute after early boot; containermanagerd \(first-boot data containers\), launchd, analyticsd and APFS itself hit ENOSPC.
+- Persistent Data write path and fences: package/sirius\_emmc.c implements block writes via CMD24/CMD25 with Auto-CMD12 over ADMA2, polls CMD13 until the card exits programming state with error checking, and issues CMD6 FLUSH\_CACHE when EXT\_CSD CACHE\_CTRL is active. Writes are strictly fenced twice: once to the single window opened by sirius\_emmc\_set\_write\_window\(\), and globally to the userdata partition boundary minus its first MiB \(protecting the SHNGROOT manifest\).
+- Persistent Data container window: package/NativeEmmc.cpp implements prepareDataWindow\(\), locating the first MiB boundary behind the root image \(userdata LBA 35627008\) and verifying the NXSB APFS superblock before publishing a read-write eMMC block device when sirius-data-write=1. Writes are drained through the software queue keeping the bounce buffer under the transport lock in both directions, doSynchronizeCache flushes the eMMC write cache, and native\_ram\_block\_volume\_seed\(\) resolves the Data volume on whichever window exists.
+- scripts/make-data-window-image.py converts the grown 8 GiB APFS Data container into a fastboot sparse image for userdata: a DONT\_CARE chunk leaves the root image untouched, RAW chunks write nonzero blocks, and FILL chunks write zero blocks so free space reads as zero on device.
+- Persistent Data volume verified on hardware: with sirius-data-write=1 and the 8 GiB container flashed via data-window.simg behind the root image, NativeEmmc opens the write window at LBA 35627008 \(16777216 blocks\), mounts disk3s1 \(OwnerData, 0C28586B-...\), early boot completes at 159.6 s, and APFS commits transactions up to xid 85 with 0 ENOSPC errors across the entire capture.
 
 ### 完成条件
 
@@ -257,30 +285,44 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 当前范围
 
-- Read-only: the transfer path has no write command and reportWriteProtection\(\) says so.
-- After launchd's first syscalls the driver receives no further requests \(reads stay at 0x113\): dyld finds no shared region and the launchd thread then waits; the probe logs only the first 24 pid 1 syscalls, so the call it waits in is not recorded yet.
-- The card clock is still the identification rate \(400 kHz, about 550 blocks/s measured\); nothing raises it to high speed yet.
+- Writes are strictly fenced to the persistent Data window on userdata \(LBA 35627008, 8 GiB\); the rest of the card remains read-only.
+- The card runs at 50 MHz in high-speed SDR on 8 bits \(about 30 MiB/s\). It supports DDR52 and HS200 \(DEVICE\_TYPE 0x57\), but DDR needs the host's DDR mode and HS200 needs tuning, and neither is implemented; 100 MHz is only tried when the boot chain already left HS200 timing.
+- The SystemOS volume is authorized by a bring-up boot argument \(sirius-allow-unverified=1\), not by an owner root policy.
 - The exec policy no longer needs a boot argument: the payload carries the original trust-cache bundle and the kernel initialises its runtime at startup. The sirius-skip-cs bypass is kept in the patch series, unused, in case a future image falls outside the bundle.
 
 ### 下一步
 
-- Verify the 25 MHz switch \(sirius\_emmc\_hs=1\) reads the GPT signature back and measure the new block rate; then decide whether the CMD6 high-speed switch to 50 MHz is worth it.
+- Display driver: U-Boot leaves a 1080x2240 splash framebuffer at 0x9c000000; bind GopFramebuffer or NativeLegacyDisplay to get screen output past SpringBoard.
+- Touch driver: Synaptics S3706 adapter from the fajita reference.
 - Keep the trust-cache bundle in step with the OS build when the IPSW changes \(its sha256 is pinned in board.toml \[payload\] trust\_cache\_sha256\).
-- Find how dyld gets the shared cache: the OS profile's working ports \(tb128fu, asteroids\) map it after the same exec, so compare their SystemOS cryptex handling with this board's.
-- Raise the pid 1 syscall log beyond 24 entries and mirror launchd's stderr writes into the USB ring, so the call launchd waits in and dyld's own message are recorded.
-- Raise the SDCC1 clock out of identification speed \(GCC root clock plus the card's high-speed mode\).
+- Raise the pid 1 syscall log beyond 24 entries and mirror launchd's stderr writes into the USB ring, so later boot-task failures name their call and message.
+- For more storage speed: DDR52 \(8-bit DDR at 52 MHz, no tuning\) roughly doubles the rate; HS200 needs the msm tuning sequence.
 
 ### 证据
 
-- `device`: [NativeEmmc starts from bsd\_init, publishes 0x747BFDF blocks of 512 bytes, and IOStorageFamily reads block 0, block 1 and block 2 with 21 sectors \(the 84 GPT entries\) through doAsyncReadWrite; the heartbeat keeps ticking with the transfer count fixed at seven, so the boot ends at the root-device wait. Log in docs/HANDOFF.zh-CN.md.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `device`: [kernel.macho 66d0319c718f6faf894d1d713759b5d82d8da010c3bd2ad2c2c13bd195574a88, payload c0d2e62c0738d6c851eeeebccf0236a310bcd14194df0ea1735efaef647420e6: EMMC write window opened at LBA 35627008 \(16777216 blocks, 8 GiB\), NativeEmmc discovers NXSB container and mounts persistent Data volume disk3s1 \(OwnerData, 0C28586B-...\), early boot complete at 159.6 s, APFS transactions commit through xid 85 with 0 ENOSPC errors up to 280 s.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-pdata.log)
+  Command: <code>fastboot -S 512M flash userdata data-window.simg; fastboot flash vendor payload-M-pdata.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `e73a8ecda8998ec36573c5bd2a9d7b6389305b2d`.
+- `device`: [NativeEmmc starts from bsd\_init, publishes 0x747BFDF blocks of 512 bytes, and IOStorageFamily reads block 0, block 1 and block 2 with 21 sectors \(the 84 GPT entries\) through doAsyncReadWrite; the heartbeat keeps ticking with the transfer count fixed at seven, so the boot ends at the root-device wait. Log in docs/HANDOFF.zh-CN.md.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
   Command: <code>fastboot flash vendor sirius-obs.img; fastboot reboot; capture-usb-console.py --duration 240</code>. Revision: `d867b1d6498dc4d0f4ae4e18060762dcae6c5847`.
-- `host`: [The kernel links with NativeEmmc in the image \(kernel.macho sha256 372820eb1b2cd9ecee15d769d1296771d0c8141c2681626d54651a62473446b8\); the GitHub macOS runner builds the same archive \(kernel workflow run 40386710258\).](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `host`: [The kernel links with NativeEmmc in the image \(kernel.macho sha256 372820eb1b2cd9ecee15d769d1296771d0c8141c2681626d54651a62473446b8\); the GitHub macOS runner builds the same archive \(kernel workflow run 40386710258\).](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
   Command: <code>./scripts/xnu-container.sh run bash -lc './unixnu build kernel --skip-setup -D ../sirius'</code>. Revision: `a47f0d6b4615c3cdebf92102400a1bc302eb6d73`.
-- `device`: [APFS mounts disk0/disk1s1/disk2s1, bsd\_init completes, execve of /sbin/launchd prints activate enter, namei 0, 'exec policy answered 1, skipped by boot arg' and finally 'execve activate 0'; the driver then has no transfer in flight and the read count stops at 0x10D, so the remaining wait is past storage.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `device`: [APFS mounts disk0/disk1s1/disk2s1, bsd\_init completes, execve of /sbin/launchd prints activate enter, namei 0, 'exec policy answered 1, skipped by boot arg' and finally 'execve activate 0'; the driver then has no transfer in flight and the read count stops at 0x10D, so the remaining wait is past storage.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
   Command: <code>fastboot flash vendor sirius-if.img; fastboot reboot; capture-usb-console.py --duration 220</code>. Revision: `bb812428dccd1f676455813ad198ed2bee4a8e3e`.
-- `device`: [kernel.macho 6f0d59b13e4ac3861c902962df8043c3bccac959cffcd859c5f965f697194d17, payload 00c8f4d7feba7982c1fcdcb2f072121d6b7a227fc38ebc0edd229bbd00b5bb08, eight CPUs: PAN reads 4194304, init path copyout 0, execve activate 0, two user thread starts, then launchd syscalls 74 372 294 20 427 381 5 90 4 202 all return; 294 returns 12 with 'vm\_shared\_region\_start\_address\(\) failed' and reads stay at 0x113.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/evidence/sirius-usb-console-20261027-pan.log)
+- `device`: [kernel.macho 6f0d59b13e4ac3861c902962df8043c3bccac959cffcd859c5f965f697194d17, payload 00c8f4d7feba7982c1fcdcb2f072121d6b7a227fc38ebc0edd229bbd00b5bb08, eight CPUs: PAN reads 4194304, init path copyout 0, execve activate 0, two user thread starts, then launchd syscalls 74 372 294 20 427 381 5 90 4 202 all return; 294 returns 12 with 'vm\_shared\_region\_start\_address\(\) failed' and reads stay at 0x113.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-pan.log)
   Command: <code>fastboot flash vendor payload-E-pan-noclear.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420</code>. Revision: `b1a11c4f4eb0bfd28b2dd3dfc59b3c7e3a3e742f`.
-- `source`: [SDCC1 bring-up, the ADMA2 read path and the GPT parse.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/package/sirius_emmc.c)
+- `device`: [kernel.macho 5d045f1a6d6ddad44331a7e6ea8b1cc74a8c84058916287a83603ab912a66038, payload 6b6c562c1e8c91eb2c776fc6ef5f58227fd9eb000872ddb6e2fff6844886515a: NEMMC owner volume /dev/disk4s1, disk4s1 \(SystemCryptex, 8846FE78-...\) mount-complete before launchd; dyld opens, fstats and preads the cache, then fcntl \(92\) returns 85.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-systemos.log)
+  Command: <code>fastboot flash vendor payload-F-systemos.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 420</code>. Revision: `24f6094010c728ecfdf3e3bbacd0effaeec60fb5`.
+- `device`: [kernel.macho a10c51aa4fab72faf86912e1ca6736c0d068432ceff1b233f47948197848b8c4, payload 8402424eb1d9d4126cfe19ab2eb3742aad40d7ba5149267534ae94a7e745c2ce: fcntl \(92\) no longer fails and stays in the kernel's whole-file hash check, reading about 770 blocks/s \(400 kHz on 8 bits\) with the pid 1 fault count flat.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-systemos.log)
+  Command: <code>fastboot flash vendor payload-G-cshash.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 1800</code>. Revision: `86fe9ffbc700915e006fce11474b0d277f0d7dc3`.
+- `device`: [kernel.macho 3452714ae8b3ef3b775bed9cde5f93c11fc2d147e0375eec22430fb0dcf70999, payload 24118c6275d90fba6dd3e684353d4525640c7d627042092868a413609686f110: ext\_csd rev 8 width 2 timing 1 type 0x57, multi=ok eis 0, 25 and 50 MHz ok; 5898655 blocks \(2.81 GiB\) in about 104 s; fcntl 92, mmap 197 and munmap 73 return 0, then 'mount\[3\] exited ... exit status 66' panics the boot.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261027-fast-emmc.log)
+  Command: <code>fastboot flash vendor payload-H-fast.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 180 --duration 900</code>. Revision: `1163990229f446753ef006126e55922aa23bda6a`.
+- `device`: [kernel.macho 2e6e1ddc51b1f8b2d58c607477f81b0327d95f301382d8d4c1180096b402408a, payload 2bd98aa417ab6007b8c95c2071f4907dee5b4afcd09ac3899604e73dc9d21bff: NEMMC data seed at 0xa3cc1000 \(33554432 bytes\), Data volume disk3s1 \(OwnerData, EB6CBBA0-...\) mount-complete before launchd, shared cache verified; at 157.7 s mount \(pid 3\) exits 66 after 'DT\_get\_fstab\_entries: failed to get filesystem entry at: /filesystems/fstab'.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-data.log)
+  Command: <code>fastboot flash vendor payload-I-data.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `33509e84db86517ff9bf349408dc66ab39c43d18`.
+- `device`: [kernel.macho 2e6e1ddc51b1f8b2d58c607477f81b0327d95f301382d8d4c1180096b402408a, payload aa917c707d2f0a8f46ae44e635b838e7e3892822c115c0233bdb5bd3e2bae323: launchd runs every boot task through mount-phase-2 and logs 'Early boot complete' at 161.5 s; driverkitd, MobileGestaltHelper, mobileassetd and SpringBoard start; the Data volume reaches ENOSPC at 175.6 s, APFS reports three data hash mismatches on disk6s1, and watchdogd's brk \#1 exit panics the boot at 191.9 s.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-early-boot.log)
+  Command: <code>fastboot flash vendor payload-J-bmh.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `09096e3738c618bb18a51af50cdfbc7f6431aa59`.
+- `device`: [kernel.macho dd22531c552b5e87208268f3faf793b7acd2516961d45f44e82d3e15b9d86e8c, payload f93d3f9b72b45bb4a4248bd7637e0e8d616472eb28da2d4d5cf479c3574f36b6: seed of 268435456 bytes at 0xa3cc1000, Data volume disk3s1, watchdogd policy applied, early boot complete at 170 s, no hash mismatch, no panic up to 336 s; ENOSPC on disk3s1 from 230 s.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-data256.log)
+  Command: <code>fastboot flash vendor payload-L-data256.img; fastboot reboot; python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `396fdab90dc5b94a830e5a43e5a9084313796683`.
+- `source`: [SDCC1 bring-up, the ADMA2 read path and the GPT parse.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/package/sirius_emmc.c)
 
 ## 显示 {#display}
 
@@ -321,7 +363,7 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [Boot-progress panel behaviour, the panic snapshot fix and the geometry of the U-Boot framebuffer.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Boot-progress panel behaviour, the panic snapshot fix and the geometry of the U-Boot framebuffer.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## 输入 {#input}
 
@@ -505,7 +547,7 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [PSCI reset evidence and the reason sleep is disabled.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [PSCI reset evidence and the reason sleep is disabled.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## 镜像组装 {#packaging}
 
@@ -561,7 +603,7 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [Build and deploy loop, the CI kernel artifact and the payload layout on the vendor partition.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
+- `source`: [Build and deploy loop, the CI kernel artifact and the payload layout on the vendor partition.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
 
 ## 诊断 {#diagnostics}
 
@@ -597,6 +639,13 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 - The loop is not limited to the copyout: with the trust-cache bundle back in the payload the exec completes \(execve activate 0, AMFI answers nothing\) and the exec'd thread enters userland at pc 0x100924e50, where it takes 92 million instruction aborts in about a minute on three addresses \(ESR 0x82000007, level-3 translation faults\) without ever issuing a syscall or a single block read; the entry point is right, the code pages are simply not visible to the CPU.
 - Both loops have the same shape: vm\_fault opens the page in thread-&gt;map's pmap and returns KERN\_SUCCESS, while the CPU keeps taking the fault. AT S1E1W and pmap\_find\_phys disagree about the physical page behind 0x1000, which points at the CPU running with a pmap that is not the thread's after the exec task switch.
 - A payload built without --trust-cache leaves the ring reporting no external trust caches found and AMFI kills launchd with namespace 9 \(OS\_REASON\_EXEC\) code 8; the same kernel with the bundle present reaches execve activate 0 without an exec-policy line, so that panic is a build-argument slip, not a regression.
+- The console can be captured on Windows: usbser.sys binds it as a COM port \(USB\\VID\_1209&amp;PID\_0001, serial SIRIUS01\) and capture-usb-console.py opens it with plain Win32 calls, because the gadget does not answer SET\_LINE\_CODING and SetCommState \(and pyserial\) fail with error 121.
+- The ring has no timestamps and is replayed whole on every poke, so capture-usb-console.py --timeline records when each distinct line first arrives; a timed boot shows 51 s from fastboot reboot to the eMMC driver, the shared-cache check until about 168 s and the mount panic at 171.7 s. A hard panic stops the kernel before the heartbeat mirrors its text, so --idle-stop ends a capture after a silence instead.
+- NativeEmmc reports the Data seed as 'NEMMC data seed at/bytes' when it publishes the RAM window and 'NEMMC data volume /dev/...' when the owner Data mount asks for it, or 'NEMMC data volume not found on the seed'.
+- When the seed's volume UUID differs from CONFIG\_XNU\_OWNER\_DATA\_VOLUME\_UUID the driver logs 'NEMMC data volume is &lt;seed UUID&gt;, the kernel names &lt;configured UUID&gt;' and mounts it anyway.
+- capture-usb-console.py --duration counts from the script's start: counted from the port, which a boot brings up after about a minute, a 280 s capture ran about 5.6 minutes.
+- Persistent Data diagnostics: the driver logs 'EMMC write window lba=... blocks=... cache=...' on window configuration, reports EXT\_CSD CACHE\_CTRL in the probe, logs fallback to single-block writes if a multi-block write command fails, logs 'NEMMC data window lba=... blocks=...' when the persistent container is discovered, logs 'NEMMC data volume \(eMMC\) ...' or 'NEMMC data volume \(RAM\) ...' when resolved, and logs 'NEMMC write failed lba ...' on write errors.
+- With the persistent 8 GiB Data volume, the entire boot capture runs past early boot \(159.6 s\) up to 280 s with zero ENOSPC lines \(vs 187 on the 256 MiB RAM seed\); containermanagerd, launchd, and analyticsd write without running out of disk space; APFS transaction flushes advance through xid 85; SpringBoard \(pid 118\) and liveactivitiesd \(pid 128\) crash for want of a display/framebuffer driver.
 
 ### 完成条件
 
@@ -612,9 +661,15 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [Entry probe, panic screen, panel rows and the evidence convention of the port.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/HANDOFF.zh-CN.md)
-- `device`: [3813 bytes of kernel log read from /dev/ttyACM0 over the DWC3 CDC console.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/docs/evidence/sirius-usb-console-20261026-1605.log)
+- `source`: [Entry probe, panic screen, panel rows and the evidence convention of the port.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/HANDOFF.zh-CN.md)
+- `device`: [3813 bytes of kernel log read from /dev/ttyACM0 over the DWC3 CDC console.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261026-1605.log)
   Command: <code>sudo python3 scripts/capture-usb-console.py --wait 60 --duration 190 --output /tmp/boot.log</code>. Revision: `366abe2948fdb0c1554f7e0b89b731160f4527a4`.
+- `device`: [Captured on Windows \(COM7\) with --timeline: the Data seed and both owner volumes appear at 52 s after fastboot reboot, the mount panic text at 158.3 s, and the capture stopped on its marker after 5.4 MB.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-data.log)
+  Command: <code>python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/I-data.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `33509e84db86517ff9bf349408dc66ab39c43d18`.
+- `device`: [launchd's own \[System Event\] boot-task lines reach the USB ring, so the timeline shows each task as it starts; the heartbeat mirrored watchdogd's panic text at 191.9 s and the capture stopped on it.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-early-boot.log)
+  Command: <code>python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/J-bmh.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `09096e3738c618bb18a51af50cdfbc7f6431aa59`.
+- `device`: [Timeline capture of the 8 GiB persistent eMMC Data volume: write window logged at 44.8 s, Data volume disk3s1 \(eMMC\) mounted at 45.0 s, early boot complete at 159.6 s, tx\_flush commits through xid 85, no ENOSPC or panics up to 280 s.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/docs/evidence/sirius-usb-console-20261028-pdata.log)
+  Command: <code>python scripts/capture-usb-console.py --follow --wait 120 --duration 280 --timeline out/M-pdata.timeline --match 'NEMMC PANIC TEXT END' --idle-stop 20</code>. Revision: `e73a8ecda8998ec36573c5bd2a9d7b6389305b2d`.
 
 ## boot-chain {#boot-chain}
 
@@ -665,7 +720,7 @@ Xiaomi Mi 8 SE running the UniXNU source kernel through its own U-Boot UEFI: ent
 
 ### 证据
 
-- `source`: [The build recipe, the four environment lines that add the UniXNU chain, and the two partition/short-scan traps.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/uboot/README.md)
-- `source`: [Provenance of the vendored EDK II package \(framework commit f85b5a6\) and what the payload takes from it.](https://github.com/HuajiFruit/UniXNU-sirius/blob/86fe9ffbc700915e006fce11474b0d277f0d7dc3/efi/README.md)
+- `source`: [The build recipe, the four environment lines that add the UniXNU chain, and the two partition/short-scan traps.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/uboot/README.md)
+- `source`: [Provenance of the vendored EDK II package \(framework commit f85b5a6\) and what the payload takes from it.](https://github.com/HuajiFruit/UniXNU-sirius/blob/06a72d58315e45e7f830a429d683861d2fc536d9/efi/README.md)
 
 </div>