B7: add network time bootstrap and persistent B7C cache

B7A: QMI DMS time vs VNIIFTRI NTP (DMS = UTC - 0.28 s, sigma 1 ms; NITZ = DMS truncated to 1 s). B7B: a 1970 -> 2026 date -s step is harmless for the modem stack. B7C: aurora-modem probes DMS/NITZ along the start flow and steps CLOCK_REALTIME once at the first valid sample (REG registered/attached), never RTC; background SNTP check (query only) after START OK. 3/3 class-A cold boots PASS (residual +0.04/+0.36/+0.84 s), cache 14fe453a written (B7C_WRITE_VERIFIED) and verified by a normal power-on (V1, +0.26 s). Also publishes the prerequisite R2 (boot-hang / lk eMMC investigation, T4 telnet baseline that B7C builds on) and R3 (autonomous cold boot, NCM loss) material, and extends tools/publish-sanitize.py to r2/, r3/, b7/. Binary images, initramfs, busybox and raw logs stay out (see b7/*/SHA256SUMS).
2026-10-02 20:18:25 +03:00 · 2026-10-02 20:18:25 +03:00 · 8d7721c775
commit 8d7721c775
parent 325adef03e
352 changed files with 382054 additions and 1 deletions
--- a/NOTES.md
+++ b/NOTES.md
@ -1184,3 +1184,109 @@ clean stop, rmtfs last). Validation: 3/3 RAM candidate boots, 3/3 cold boots fro
 Safety: eMMC writes 0; NV partitions unchanged.
 Known issues: early boot hangs before Linux (SBL1 DDR-init / after SBL1 End / lk target_init); possible battery/contact instability (UVLO reset during modem stop, pc2);
 fast MSS restart re-attach needs investigation; single unreproduced cases (pc1 no RX, 22:00 stall after online SET); marginal Beeline RF at the install location.
+
+# Session 32 — R2 early bootchain hang investigation (2026-10-01, read-only) — report `r2/R2-REPORT.md`
+- 96 SBL1 starts from 41 UART logs classified (r2/table.txt). Nothing written, no reboots; live reads on pc6 boot (PMIC regmap, APSS WDT via devmem, read-only).
+- SBL1 telemetry is bimodal: class B (pm_device_init ~11.75 ms, PBL ~157 ms; all PON=USB boots, all warm reboot -f) vs class A (~11.25 ms, PBL ~123 ms; PON unknown).
+- "SBL1 End → no lk" hangs: 3/9 class-A starts on the new chain (15:41:10, **18:00:31 — previously unlogged**, 23:40:50) vs 0/5 on stock chain; only class-B one (23:26:59) had anomalous PMIC timings.
+- Warm reboot -f (mainline): 3/9 fail (2× lk MMC-init hang + self-reset ~15 s, 1× SBL1 DDR hang); stock warm restarts 0/~9.
+- APSS WDT EN=0 (not in DT); watchdog0 = PMIC PON WD, disabled (0x857=0). batt_voltage 4183–4202 mV at all failures. UVLO in POFF also appears after plain user power cuts.
+- Verdict: power/contact transients = trigger; new chain (DB410c TZ/qhypstub) hangs on non-POR restarts instead of recovering; warm reboot separate SW issue. Next: T1–T3 (user hands).
+
+# Session 32b — R2/T1 startup-class capture (2026-10-01 00:14–01:03, read-only; watcher r2/t1-watch.sh, logs logs/r2/t1/)
+- Battery pulled 0.5 s with USB present: no reset (uptime continued); only MISC 0x909 06→0e latched.
+- Battery-only + short power key: no start. 3 s key hold: started (board runs on battery), but UART gave nothing until USB
+  was plugged → CH340 GND was not tied to the board (common ground only via USB). Floating RX fed garbage into the root console
+  (XOFF, then after XON a TX→RX echo loop ran ~5 min executing junk: only "not found"/"Permission denied"/ed errors). Stopped with XOFF.
+  User then tied GND. NV check on the next good boot: modemst1/2, fsg, fsc, persist == A3 (637a71d1/9bb10190/b0a3b7e4/5f70bf18/ee48a843).
+- **Class C (new):** battery inserted, no USB, 00:53:49 → pm_device_init 17110, cdt 25467, pm_driver_init 13969, SBL1 Δ 208834 → hang after SBL1 End.
+  Same signature as 15:45:06 (DDR hang) and 23:26:59 (after SBL1 End hang) → class C = 3/3 hang.
+- **Class A captured:** USB connected first, then battery → 00:58:41 sblS 122945, pm_device_init 11285 (A) → lk target_init hang →
+  self-reset 00:58:57 → class B start (11803) → Linux. PON on that boot: 0808=10 (USB), 080a=02 (PS_HOLD warm reset), 080c=00, 080d=00, 0807=c8.
+  ⇒ the lk-hang self-reset is a PS_HOLD (SoC-side) warm reset, not a PMIC key/WD reset; PON_REASON (retained over warm reset) = USB for the A power-on.
+- Working hypothesis (1 sample each): start class is set by power-source order — B: battery present, USB inserted; A: USB present, battery inserted; C: battery only.
+
+# Session 32c — R2/T2 series B (battery first, 5 s, then USB), 2026-10-01 01:07–01:12; UART logs/uart/r2t2-20261001-010713.log, results logs/r2/t2/results.tsv
+- B1–B4: class B, PASS (pm_device_init 11773–11803, PBL 158–160 ms, SBL1 Δ ~190.3 ms, batt 4197–4198); PON 0807=c8 0808=10 080a=00 080c=00 080d=20; RTC continued (557/631/688/751 s).
+- B5 (same procedure): **class A, PASS** (sblS 125141, pm_device_init 11285, SBL1 Δ 187972). PON diff vs B: **0807=18** (c8 in B), **080d=00** (20 in B); 0808=10 (USB) same.
+  **RTC at boot = 3 s → PMIC RTC was reset.**
+- ⇒ **Class A = full PMIC POR** (retained domain — RTC, POFF reasons, 0807 bits 7/6 — lost); class B = power-on with PMIC retained domain alive.
+  Confirmed on old logs: 22:05:25 A → RTC 2 s; RTC back-calculation puts RTC resets exactly at 23:40:50 (A) and 23:26:59 (C).
+  Power-off gap (last console line → start) was ~13 s for B5 vs 13–17 s for B1–B4 → off-time alone doesn't explain it (proxy only).
+
+# Session 32d — R2/T2-DURATION (60 s full power-off, battery → 5 s → USB), 2026-10-01 01:17–01:25; results logs/r2/t2d/results.tsv
+- D1: class A, PASS, RTC 3 s, PON 0807=c8 0808=10 080a=00 080c=00 080d=00.
+- D2: class A → lk target_init **panic: "Failure getting card's CID number" / "mmc init failed!"** (eMMC not answering lk) → PS_HOLD reset 14.8 s after panic
+  → follow-up class B start → PASS (RTC 18 s, 080a=02). ⇒ the earlier "lk target_init hangs" are this lk panic (text was lost on UART before).
+- D3a: class A → hang after SBL1 End, no reset in 120 s (GND wire detached during this attempt → confounded). D3b (repeat, GND re-soldered): class A, PASS, RTC 3 s, 080d=00, 0909=0e.
+- **Verdict: 60 s off → class A on every start (4/4 incl. D3a)**, vs ~13–17 s off → B 4/5. Off-time decides whether the PMIC retained domain survives.
+  0807 is not a class marker (18 in B5, c8 in D1/D3b); markers of A = RTC reset + 080d=00.
+- Class A outcomes on the new chain so far (T2+T2D): PASS 3 (B5, D1, D3b), lk eMMC panic 1 (D2), SBL1-End hang 1 (D3a, confounded).
+
+# Session 32e — R2/T2 USB-FIRST (full-off, USB → 5 s → battery), 2026-10-01 01:29–01:42; results logs/r2/t2u/results.tsv (+ *-lk.txt per start)
+- U1: class B PASS, RTC 346 (continued) — log shows board alive until 34.4 s before start → full-off ≤ ~29 s: protocol deviation, not a 60 s sample.
+- U2: class B PASS, RTC 485 (continued, lost 9.4 s), full-off ≤ ~52.6 s (borderline). 080d=20.
+- U3/U4/U5 (user-timed 70 s, log bounds ≤109/84/93 s — valid): class B PASS ×3; RTC continued (lost 23.3/20.4/22.9 s during off); 0807=d8; 080d=00.
+  lk every time: "MMC card: H4G2a …" → "Jumping to kernel via monitor"; only the normal slot2 SD-probe errors; no panic, no reset.
+- Comparison ≥60 s off: battery-first (D1, D2, D3b) → class A 3/3 (RTC reset), outcomes PASS 2, lk eMMC-CID panic 1 (auto-reset 14.8 s → B PASS);
+  USB-first (U3–U5) → class B 3/3 (RTC survived), PASS 3/3.
+- ⇒ Power-on order changes the class itself: with VBUS present first, the PMIC retained domain (RTC etc.) survives ≥70 s off; battery-first after ≥60 s off gives a full PMIC reset.
+  So "hang/panic probability at equal class A vs order" could not be measured — USB-first never produced class A. B5 (battery-first, ≤8 s off → A) stays unexplained.
+- RTC keeps its value during off but loses time (~20–23 s per 70 s off) — backup-powered, degraded.
+
+# Session 33 — R2/T3 (2026-10-01 01:45 → 2026-10-02 10:31): class-A repro, lk eMMC audit, UART backfeed test
+- T3B source audit (lk2nd 23.1 e9c8b217): r2/T3B-LK-EMMC-AUDIT.md. Failure = CMD2 ALL_SEND_CID timeout after CMD0/CMD1 OK in mmc_identify_card;
+  no CMD2 retry, no slot1 re-init, no RST_n/VCC cycle → ASSERT(0) in target_sdc_init. eMMC code identical to JZ02 lk1st (8b46487); upstream has no later fix.
+  lk1st PANIC_REBOOT_MODE=EMERGENCY_DLOAD, but the panic dump stops after "irq r13" and a PS_HOLD reset comes ~15 s later (source unknown; lk arms no WDT on msm8916).
+- T3A (battery-first, ≥70 s off, CH340 TX connected): A5, A6 → class B (RTC survived, 0807=98) → battery-first ≥60 s does NOT reliably give class A.
+- T3C UART backfeed test (CH340 TX → board RX disconnected; RX/GND kept; 90 s off; battery → 5 s → USB): C1/C2/C3 = **class A 3/3, PASS 3/3, RTC 3 s each**
+  (PBL ~125.5 ms, pm_device_init 11285, pm_driver_init 10.8–10.9 ms at batt ~3995 mV). ⇒ backfeed from CH340 TX kept the PMIC retained domain alive (class B);
+  without it a ≥60 s off gives a full PMIC reset. UART also became clean (garbled SBL1/lk lines 137 → 0); new lk lines visible: "SDHC Running in HS200 mode",
+  "Done initialization of the card", "pm8x41_get_is_cold_boot: cold boot", "lk2nd_init()".
+- Valid class-A starts so far: B5, D1, D2, D3b, C1, C2, C3 = 7 → eMMC CID panic 1/7 (D2). No new failure type. PON regs not read in T3C (no input channel).
+- Logistics: CH340 replugs kill tools/uartlog.py (restart it); never run minicom while the logger runs; board NCM moved to enp60s0u1u2u1 without 172.16.42.2.
+- T3C2 (2026-10-02 10:34–10:42): C4/C5/C6 class A, PASS, RTC 3 s (TX disconnected, 90 s off). Final class-A sample = 10 (B5, D1, D2, D3b, C1–C6):
+  PASS 9/10, CMD2/CID panic 1/10 (D2). lk output of C1–C6 identical up to "Done initialization"; first PASS/FAIL divergence = first line after target_init(). r2/T3-CLASS-A-SUMMARY.md.
+- T4 (2026-10-02 10:55): read-only eMMC snapshot NOT run — no command channel (UART RX-only, no NCM shell, host lacks 172.16.42.2 without sudo).
+  From the C1–C6 UART kernel log: HS200 every boot, 0 mmc/sdhci error/timeout/CRC/re-tune lines. logs/r2/t4/T4-partial.txt.
+- T4-A (2026-10-02 11:02–11:10): UART input to the board does not work (0 bytes back for echo/XON; board TX→host RX OK). Unexpected class-A cold boot 11:03:48
+  (RTC 3 s, PASS, batt 4019 mV) during the user's wiring check — whether TX was attached then is unconfirmed. UART log logs/uart/r2t4a-20261002-110229.
+- T4-B build (user GO "путь 2"): r2/t4/build-telnet.sh → r2/t4/out/aurora-mm1-t4telnet.img 6db01841 (B6P image 18a25e39 reproduced bit-for-bit, + 3rd cpio
+  member with /init = B6P init + devpts + `telnetd -l /bin/sh -b 172.16.42.1 -p 23`). Kernel/cmdline identical to B6P. For `fastboot boot` only; NOTHING written.
+  Offline checks: layered /init = T4 (13721ca5), sh -n OK, busybox 1.37.0 telnetd runs under qemu, CONFIG_UNIX98_PTYS=y. Copied to 480s r2/t4/out/.
+- T4-B (2026-10-02 11:24–11:28): `fastboot boot` of the T4 telnet image → `T4: telnetd started on 172.16.42.1:23`. Host NM auto-profile "Wired connection 2" (DHCP) kept flushing
+  172.16.42.2 → user created NM profile **aurora-ncm** (static 172.16.42.2/24, never-default, ifname enp60s0u1u2u1; "Wired connection 2" autoconnect=no).
+  ping OK, telnet root shell (/dev/pts/1) OK **with CH340 TX disconnected** → UART input no longer needed (while this RAM image runs).
+- T4 snapshot: logs/r2/t4/T4-RESULT.md. EXT_CSD rev 6 (eMMC 4.5): PRE_EOL/LIFE_TIME undefined (0x00) → no health data; RST_n_FUNCTION=0x01 (permanently enabled);
+  err_stats all 0, no mmc errors in dmesg, HS200 8-bit 1.8 V. Hypothesis (unproven): RST_n glitch between CMD1 and CMD2 would match D2.
+- T4-C (2026-10-02, user GO "готовь cache с telnetd, но без записи") — **NOTHING WRITTEN**. r2/t4/mkfs-cache-t4.sh (= b6p recipe; toolchain re-proved: B6P cache 9fea693a
+  reproduced bit-for-bit) → r2/t4/cache-extlinux-t4.img **9d3bc890…** (deterministic; e2fsck clean; Image.gz-dtb/DTB/cmdline == B6P, initrd = initramfs-t4 db47835b, label t4).
+  lk2nd emulator (r2/t4/emu): T4 → boot_linux reached, kernel/dtb/cmdline identical to B6P regression (S3 == b6p/emu), only ramdisk differs; F1/F3/F10 → revert to android boot (boot=emmc1).
+  Prepared, not run: r2/t4/T4-write.sh (diff vs B6P-write.sh = image/hashes/log dir only; old cache must be 9fea693a), r2/t4/T4-rollback.sh (→ B6P 9fea693a).
+- T4-W (2026-10-02, user GO "запись", HW EDL): r2/t4/T4-write.sh → all gates passed (old cache == B6P 9fea693a, boot/aboot/GPT unchanged), **CACHE_MATCH 9d3bc890**,
+  sbl1/rpm/tz/hyp/recovery/modemst1/2/fsg/fsc/persist == A3, modem/system/userdata == A4pre → **T4_WRITE_VERIFIED**. Logs logs/r2/t4/W/. Rollback: r2/t4/T4-rollback.sh (→ 9fea693a).
+- T4-V (2026-10-02 11:42, first normal power-on after T4-W, TX disconnected): SBL1 OK (batt 4078 mV, pm_driver_init 7594 µs, RTC 568 s → class B), lk eMMC OK,
+  extlinux "Trying to boot 't4'", EMMC-RO 30/30, `T4: telnetd started`, B1_OK=1. Host aurora-ncm auto-up 172.16.42.2; ping OK; telnet root shell OK (/dev/pts/0).
+  aurora-modem: START OK in 71.2 s (Beeline home, wwan0 bearer) — first boot without the "usb0 ping lost" rollback. **TX CH340 no longer needed for control.**
+
+# Session 34 — R3 autonomous operation (2026-10-02) — **CLOSED, sufficiently verified**
+- R3A PASS: class-A cold boot (RTC 3 s, TX disconnected, battery → USB, ~2 min off), no input → t4 → NCM (~12 s after SBL1) → telnetd → aurora-modem START OK in 66.0 s
+  (~77 s power-on → LTE), Beeline home, wwan0 ping 77.88.8.8 / 1.1.1.1 3/3, DNS 10.10.22.3 OK. logs/r3/r3a/R3A-RESULT.md.
+- R3B PASS: aurora-ncm `nmcli con down` 60 s in steady state → controller does not notice (usb0 ping check lives only in start/reg_sm; controller exits after START OK);
+  bearer/LTE ping 88/88 kept, no MM/rmtfs restart; `con up` → host IP, ping, telnet back at once. logs/r3/r3b/R3B-RESULT.md.
+- Open (not run): R3B2 = NCM loss during start (rollback, no auto retry). Secondary bearer DNS 194.186.191.1 times out.
+
+# Session 35 — B7A time sources vs VNIIFTRI NTP (2026-10-02, measurement only) — logs/b7/b7a/B7A-RESULT.md
+- DMS System time (ms/1000 + 315964800) = UTC − 280.2 ms (σ 1.0 ms, 18 samples, range −281.6…−278.1); no GPS leap offset. NITZ = DMS truncated to 1 s (−1.16…−0.36 s).
+- ntp1/2/3.vniiftri.ru = 89.109.251.21/22/23, agree ≤ 7.7 ms; reached via temporary /32 routes on wwan0 (removed). Board clock untouched.
+- Debian busybox-static has no ntpd; Alpine busybox-static 1.37.0-r20 (signature-verified) does (`ntpd -w -d`). Board busybox `date` has no %N → use `adjtimex`.
+- B7B PASS (2026-10-02): live modem, validated DMS (6 gates) → one `date -u -s @N` step 1970 → 2026 at a DMS second boundary, no RTC (adjtimex stays UNSYNC).
+  MM/rmtfs/qmi-proxy/telnetd PIDs unchanged, bearer up, LTE ping 36/36 over 182 s, no new dmesg/lifecycle lines. ntp1.vniiftri.ru: clock −0.292 s (= DMS bias −0.28 + 12 ms step latency).
+  logs/b7/b7b/B7B-RESULT.md, script b7/b7b/b7b-run.sh. Board `qmicli --dms-get-time` line format: "System time: '<ms> (ms): <date>'".
+- B7C PASS (2026-10-02): RAM image b7/b7c/out/aurora-mm1-b7c.img (d0c4cc00) with controller time bootstrap (aurora-modem 932c9ff2). 3/3 class-A cold boots (c5/c6/c7r):
+  DMS before registration = modem uptime from 1980 (rejected), valid at REG registered/attached → one date -s at uptime 24–70 s; residual vs VNIIFTRI +0.04/+0.36/+0.84 s.
+  Bogus NITZ 1980-01-06 seen before registration (rejected). No cache/eMMC write. logs/b7/b7c/B7C-RESULT.md. Persistent cache: separate GO.
+- B7C-W (2026-10-02, user GO "запись", HW EDL): b7/b7c/cache/B7C-write.sh → all gates passed (old cache == T4 9d3bc890), **CACHE_MATCH 14fe453a**, everything else == A3/A4pre
+  → **B7C_WRITE_VERIFIED**. Logs logs/b7/b7c/W/. Rollback: b7/b7c/cache/B7C-rollback.sh (→ T4 9d3bc890).
+- B7C-V1 PASS (2026-10-02 17:00 UTC): normal power-on (class A, RTC 3 s) → lk "Trying to boot 'b7c'" → TIME SET at uptime 21.44 s (REG registered/attached) → START OK 73.9 s,
+  SNTP residual +0.262 s vs VNIIFTRI. **B7C is now the operational baseline** (cache 14fe453a). logs/b7/b7c/cV1/.
--- a/b7/b7a/SHA256SUMS
+++ b/b7/b7a/SHA256SUMS
@ -0,0 +1,2 @@
+a6bb1e6e349cbdfa690a78cd0017413c5446bdae02ee003ceb682d4ae1a004ff  busybox.static
+ee469aee2958feffd7f64dd96655704025ff60af614f77a1d7323dc237c34da2  busybox-static-1.37.0-r20.apk
--- a/b7/b7a/apkverify.py
+++ b/b7/b7a/apkverify.py
@ -0,0 +1,21 @@
+import zlib, sys, hashlib, base64, subprocess, tarfile, io
+def members(b):
+    out=[]; pos=0
+    while pos < len(b):
+        d=zlib.decompressobj(31); data=d.decompress(b[pos:]); used=len(b)-pos-len(d.unused_data)
+        out.append((b[pos:pos+used], data)); pos+=used
+    return out
+def verify(path, key):
+    b=open(path,'rb').read(); m=members(b)
+    sigtar=tarfile.open(fileobj=io.BytesIO(m[0][1])); sm=[x for x in sigtar.getmembers() if x.name.startswith('.SIGN.RSA')][0]
+    sig=sigtar.extractfile(sm).read(); open('sig.bin','wb').write(sig); open('signed.bin','wb').write(m[1][0])
+    r=subprocess.run(['openssl','dgst','-sha1','-verify',key,'-signature','sig.bin','signed.bin'],capture_output=True,text=True)
+    print(path, sm.name, r.stdout.strip() or r.stderr.strip())
+    return m
+idx=verify('APKINDEX.tar.gz','keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub')
+m=verify(sys.argv[1],'keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub')
+print('control Q1:', 'Q1'+base64.b64encode(hashlib.sha1(m[1][0]).digest()).decode())
+pk=tarfile.open(fileobj=io.BytesIO(m[1][1])).extractfile('.PKGINFO').read().decode()
+dh=[l for l in pk.splitlines() if l.startswith('datahash')][0].split('=')[1].strip()
+print('datahash pkginfo', dh, 'actual', hashlib.sha256(m[2][0] if len(m)==3 else b''.join(x[0] for x in m[2:])).hexdigest())
+tarfile.open(fileobj=io.BytesIO(b''.join(x[1] for x in m[2:]))).extractall('alp', filter='tar') if False else None
--- a/b7/b7a/b7a-analyze.py
+++ b/b7/b7a/b7a-analyze.py
@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+# B7A analysis: offsets of DMS / NITZ / NTP(vniiftri 1..3) vs the board's free-running CLOCK_REALTIME (1970-based), then DMS/NITZ - NTP.
+import re, sys, datetime, statistics as st
+L = open(sys.argv[1]).read().splitlines(); GPS = 315964800
+dms, nitz, ntp = [], [], []
+for l in L:
+    m = re.match(r'r(\d) DMS\d up=([\d.]+) t0=([\d.]+) t1=([\d.]+) (\d+)$', l)
+    if m: r,u,a,b,ms = int(m[1]),float(m[2]),float(m[3]),float(m[4]),int(m[5]); dms.append((r,u,(a+b)/2,(b-a)/2, ms/1000+GPS-(a+b)/2)); continue
+    m = re.match(r'r(\d) NITZ\d up=([\d.]+) t0=([\d.]+) t1=([\d.]+) (\S+) (\S+) tz=(\d+)', l)
+    if m:
+        r,u,a,b = int(m[1]),float(m[2]),float(m[3]),float(m[4])
+        e = datetime.datetime.fromisoformat(m[5]+'T'+m[6]+'+00:00').timestamp(); nitz.append((r,u,(a+b)/2,(b-a)/2,e-(a+b)/2)); continue
+    m = re.match(r'r(\d) NTP(\d) up=([\d.]+) t0=([\d.]+) t1=([\d.]+)', l)
+    if m: cur = (int(m[1]),int(m[2]),float(m[3]),float(m[4])); continue
+    m = re.match(r'r(\d) NTP(\d) ntpd: reply from \S+: offset:([+-][\d.]+) delay:([\d.]+)', l)
+    if m: ntp.append((int(m[1]),int(m[2]),float(m[3]),float(m[4])))
+# NTP: best (min delay) reply per round/server; local time of the run start t0 approximates sample time (8 s window)
+starts = {}
+for l in L:
+    m = re.match(r'r(\d) NTP(\d) up=([\d.]+) t0=([\d.]+) t1=([\d.]+)', l)
+    if m: starts[(int(m[1]),int(m[2]))] = (float(m[4])+float(m[5]))/2
+best = {}
+for r,s,o,d in ntp:
+    if (r,s) not in best or d < best[(r,s)][1]: best[(r,s)] = (o,d)
+# linear fit of NTP offset vs local time (all best samples, all servers) -> local clock drift
+xs = [starts[k] for k in best]; ys = [best[k][0] for k in best]
+mx, my = st.mean(xs), st.mean(ys); slope = sum((x-mx)*(y-my) for x,y in zip(xs,ys))/sum((x-mx)**2 for x in xs)
+ntp_at = lambda t: my + slope*(t-mx)
+print(f"NTP samples: {len(ntp)} replies, best per round/server: {len(best)}; local clock drift vs NTP: {slope*1e6:+.2f} ppm")
+print("\nPer-round NTP best offsets (s, relative to board clock) and server spread:")
+print("round  ntp1(delay)                 ntp2(delay)                 ntp3(delay)                 spread_ms  resid_vs_fit_ms")
+for r in sorted({k[0] for k in best}):
+    row = [best.get((r,s)) for s in (1,2,3)]
+    os_ = [x[0] for x in row if x]
+    res = [ (best[(r,s)][0]-ntp_at(starts[(r,s)]))*1e3 for s in (1,2,3) if (r,s) in best]
+    print(f"r{r}  " + "  ".join(f"{x[0]:.6f}({x[1]*1e3:5.1f}ms)" if x else "-" for x in row) + f"  {(max(os_)-min(os_))*1e3:7.2f}  " + " ".join(f"{v:+.2f}" for v in res))
+print("\nTable: uptime / DMS / NITZ / ntp1 / ntp2 / ntp3 (UTC at the sample's local midpoint; NTP = board clock + NTP offset at that instant)")
+def utc(t): return datetime.datetime.fromtimestamp(t, datetime.timezone.utc).strftime('%H:%M:%S.%f')[:-3]
+print("round uptime   DMS_UTC        NITZ_UTC   ntp1           ntp2           ntp3           DMS-NTP_ms  qmi_halfwin_ms")
+dd = []
+for r in sorted({x[0] for x in dms}):
+    d = [x for x in dms if x[0]==r]; n = [x for x in nitz if x[0]==r]
+    for x in d:
+        t = x[2]; diff = (x[4]-ntp_at(t))*1e3; dd.append((diff, x[3]*1e3))
+        no = [best[(r,s)][0] for s in (1,2,3) if (r,s) in best]
+        cols = [utc(t+best[(r,s)][0]) if (r,s) in best else '-' for s in (1,2,3)]
+        print(f"r{r}   {x[1]:8.2f}  {utc(t+x[4])}  {utc(t+n[0][4])[:8] if n else '-':10} {cols[0]}  {cols[1]}  {cols[2]}  {diff:+8.1f}    {x[3]*1e3:5.1f}")
+nd = [((x[4]-ntp_at(x[2]))*1e3, x[3]*1e3) for x in nitz]
+print("\nDMS - NTP (ms): n=%d mean %+.1f median %+.1f min %+.1f max %+.1f stdev %.1f ; max |DMS-NTP| %.1f ms; qmicli half-window max %.1f ms" % (
+    len(dd), st.mean(v for v,_ in dd), st.median(v for v,_ in dd), min(v for v,_ in dd), max(v for v,_ in dd), st.pstdev([v for v,_ in dd]), max(abs(v) for v,_ in dd), max(h for _,h in dd)))
+print("NITZ - NTP (ms, NITZ truncated to 1 s => expected in (-1000, 0]): n=%d min %+.1f max %+.1f" % (len(nd), min(v for v,_ in nd), max(v for v,_ in nd)))
+for x in nitz: pass
+print("NTP server spread (max-min of best offsets within a round): max %.2f ms" % max((max(best[(r,s)][0] for s in (1,2,3) if (r,s) in best)-min(best[(r,s)][0] for s in (1,2,3) if (r,s) in best))*1e3 for r in {k[0] for k in best}))
+print("DMS formula check: Unix UTC = DMS_ms/1000 + 315964800 -> DMS-NTP mean above (0 = formula exact; ~ +18000 ms would mean GPS time without leap correction)")
--- a/b7/b7a/b7a-measure.sh
+++ b/b7/b7a/b7a-measure.sh
@ -0,0 +1,22 @@
+#!/bin/sh
+# B7A board-side MEASUREMENT ONLY (no clock set, no RTC, no eMMC). Raw output -> /tmp/b7/raw. Local timestamps: busybox adjtimex time.tv_sec/usec (CLOCK_REALTIME, µs).
+trap '' HUP; B=/tmp/b7/busybox; R=/tmp/b7/raw; mkdir -p $R; Q="qmicli -p -d /dev/wwan0qmi0"; N=${1:-6}
+ts() { $B adjtimex | awk '/time.tv_sec/{s=$2} /time.tv_usec/{u=$2} END{printf "%d.%06d", s, u}'; }
+up() { cut -d' ' -f1 /proc/uptime; }
+echo "BEGIN $(ts) up=$(up)" > $R/log
+for r in $(seq 1 $N); do
+	for k in 1 2 3; do
+		a=$(ts); u=$(up); timeout 15 $Q --dms-get-time > $R/r$r-dms$k.txt 2>&1; b=$(ts)
+		echo "r$r DMS$k up=$u t0=$a t1=$b $(grep -o "System time: '[0-9]*" $R/r$r-dms$k.txt | grep -o '[0-9]*$')" >> $R/log
+	done
+	for k in 1 2; do
+		a=$(ts); u=$(up); timeout 15 $Q --nas-get-network-time > $R/r$r-nitz$k.txt 2>&1; b=$(ts)
+		echo "r$r NITZ$k up=$u t0=$a t1=$b $(sed -n "s/.*3GPP Date: *'\(.*\)'/\1/p" $R/r$r-nitz$k.txt) $(sed -n "s/.*3GPP Time: *'\(.*\)'/\1/p" $R/r$r-nitz$k.txt) tz=$(sed -n "s/.*3GPP Timezone Offset: *'\(.*\)'.*/\1/p" $R/r$r-nitz$k.txt)" >> $R/log
+	done
+	for n in 1 2 3; do ip=89.109.251.2$n
+		a=$(ts); u=$(up); timeout 9 $B ntpd -w -d -p $ip > $R/r$r-ntp$n.txt 2>&1; b=$(ts)
+		echo "r$r NTP$n up=$u t0=$a t1=$b $ip" >> $R/log
+		grep "reply from" $R/r$r-ntp$n.txt | sed "s/^/r$r NTP$n /" >> $R/log
+	done
+done
+echo "END $(ts) up=$(up)" >> $R/log
--- a/b7/b7b/b7b-run.sh
+++ b/b7/b7b/b7b-run.sh
@ -0,0 +1,82 @@
+#!/bin/sh
+# B7B board-side: validate QMI DMS time -> ONE system clock step 1970 -> DMS UTC (date -u -s @N, aligned to a whole second; NO RTC, NO eMMC)
+# -> post snapshot -> observe OBS s -> temporary /32 route to ONE VNIIFTRI server, ntpd -w (query only), route removed.
+trap '' HUP
+B=/tmp/b7/busybox; O=/tmp/b7b; mkdir -p $O; Q="qmicli -p -d /dev/wwan0qmi0"; D=/run/aurora-modem
+FLOOR=1790928541		# t4 initramfs build time 2026-10-02T08:09:01Z
+Y2026=1767225600; CEIL=$((FLOOR + 5*365*86400)); GPS=315964800; NTPIP=89.109.251.21; OBS=${1:-180}
+ts() { $B adjtimex | awk '/time.tv_sec/{s=$2} /time.tv_usec/{u=$2} END{printf "%d.%06d", s, u}'; }
+up() { cut -d' ' -f1 /proc/uptime; }
+A=$O/b7b-actions.txt; act() { echo "[up $(up) clk $(ts)] $*" >> $A; echo "<5>[b7b] $*" > /dev/kmsg; }
+mm() { mmcli "$@" 2>&1 | tr -d '\033' | sed 's/\[[0-9;]*m//g'; }
+snap() {
+	{ echo "=== uptime"; cat /proc/uptime; echo "=== date -u"; date -u; echo "=== adjtimex"; $B adjtimex
+	echo "=== rtc (read only)"; cat /sys/class/rtc/rtc0/since_epoch /sys/class/rtc/rtc0/date /sys/class/rtc/rtc0/time
+	echo "=== dms"; $Q --dms-get-time; echo "=== nitz"; $Q --nas-get-network-time
+	echo "=== mmcli -m any"; mm -m any; echo "=== mmcli -b 1"; mm -b 1
+	echo "=== ip"; ip -4 addr show wwan0; ip -4 addr show usb0; ip route
+	echo "=== pids"; echo "MM=$(pidof ModemManager) rmtfs=$(pidof rmtfs) qmi-proxy=$(pidof qmi-proxy) telnetd=$(pidof telnetd) udevd=$(pidof udevd) dbus=$(pidof dbus-daemon) polkitd=$(pidof polkitd)"; ps
+	echo "=== state"; cat $D/state; echo "=== aurora-modem status"; /etc/init.d/aurora-modem status
+	echo "=== lifecycle.log (lines $(wc -l < $D/lifecycle.log))"; tail -n 12 $D/lifecycle.log; echo "=== service.log"; tail -n 4 $D/service.log
+	echo "=== mm-0.log tail"; tail -n 15 $D/mm-0.log
+	echo "=== dmesg (lines $(dmesg | wc -l)) tail"; dmesg | tail -n 30; } > $1 2>&1; }
+dms_sample() { a=$(ts); r=$($Q --dms-get-time 2>&1); b=$(ts); echo "$r" >> $O/dms-raw.txt
+	echo "$a $b $(echo "$r" | sed -n "s/.*System time: '\([0-9]*\).*/\1/p")"; }
+: > $A; act "B7B BEGIN obs=${OBS}s floor=$FLOOR ntp=$NTPIP"
+$B usleep 1 2>/dev/null && act "usleep ok" || act "usleep missing"
+# 1. baseline
+snap $O/b7b-pre.txt; act "pre snapshot done"
+# 2. time-source validation
+T=$O/b7b-time-source.txt; : > $T
+for k in 1 2 3; do echo "DMS$k $(dms_sample)" >> $T; done
+a=$(ts); r=$($Q --nas-get-network-time 2>&1); b=$(ts); echo "$r" > $O/nitz-raw.txt
+nd=$(echo "$r" | sed -n "s/.*3GPP Date: *'\(.*\)'/\1/p"); nt=$(echo "$r" | sed -n "s/.*3GPP Time: *'\(.*\)'/\1/p")
+ne=$(date -u -d "$nd $nt" +%s 2>/dev/null); echo "NITZ $a $b $nd $nt epoch=$ne" >> $T
+awk -v F=$FLOOR -v Y=$Y2026 -v C=$CEIL -v G=$GPS -v NE="$ne" '
+	/^DMS/ { n++; if ($4 !~ /^[0-9]+$/) bad="DMS"n" no value"; u=$4/1000+G; m=($2+$3)/2; o[n]=u-m; w[n]=$3-$2; uu[n]=u
+		printf "DMS%d utc=%.3f window=%.1fms offset_vs_clock=%.3f\n", n, u, w[n]*1000, o[n] }
+	/^NITZ/ { nm=($2+$3)/2; no=(NE+0)-nm; if (NE !~ /^[0-9]+$/) bad="NITZ no value"; printf "NITZ epoch=%s offset_vs_clock=%.3f\n", NE, no }
+	END { b=1; for (i=2;i<=n;i++) if (w[i]<w[b]) b=i
+		mn=o[1]; mx=o[1]; for (i=2;i<=n;i++) { if (o[i]<mn) mn=o[i]; if (o[i]>mx) mx=o[i] }
+		c1=(n==3 && bad==""); c2=(uu[b]>=F); c3=(uu[b]>=Y); c4=(uu[b]<C); c5=((mx-mn)<0.05); d=o[b]-no; c6=(d<2 && d>-2)
+		printf "CHECK all values present: %s %s\n", c1?"PASS":"FAIL", bad
+		printf "CHECK DMS >= image build 2026-10-02T08:09:01Z (%d): %s\n", F, c2?"PASS":"FAIL"
+		printf "CHECK year >= 2026: %s\n", c3?"PASS":"FAIL"
+		printf "CHECK not garbage (< build + 5 y; 1980/2017 excluded by floor): %s\n", c4?"PASS":"FAIL"
+		printf "CHECK 3 DMS samples consistent (spread %.1f ms < 50): %s\n", (mx-mn)*1000, c5?"PASS":"FAIL"
+		printf "CHECK |DMS - NITZ| = %.3f s < 2: %s\n", (d<0?-d:d), c6?"PASS":"FAIL"
+		printf "BEST DMS%d offset=%.6f\n", b, o[b]
+		print ((c1&&c2&&c3&&c4&&c5&&c6) ? "VERDICT=GO" : "VERDICT=STOP") }' $T > $T.eval
+cat $T.eval >> $T
+grep -q "VERDICT=GO" $T || { act "time source checks FAILED - STOP, clock not changed"; exit 2; }
+OFF=$(sed -n 's/^BEST DMS[0-9] offset=//p' $T); act "checks PASS, DMS offset vs clock $OFF s"
+[ "$2" = dry ] && { act "DRY RUN: stop before clock step"; exit 0; }
+# 3. one clock step, aligned so that the new clock lands on a whole UTC second
+DN0=$(dmesg | wc -l); RTC0=$(cat /sys/class/rtc/rtc0/since_epoch)
+L=$(ts); N=$(awk -v l=$L -v o=$OFF 'BEGIN{printf "%d", int(l+o)+2}'); W=$(awk -v n=$N -v o=$OFF -v l=$(ts) 'BEGIN{w=(n-o)-l-0.004; printf "%d", (w>0?w*1e6:0)}')
+act "step plan: N=$N ($(date -u -d @$N)) local_target=$(awk -v n=$N -v o=$OFF 'BEGIN{printf "%.6f", n-o}') wait_us=$W"
+$B usleep $W; c0=$(ts); date -u -s @$N > $O/date-s.out 2>&1; rc=$?; c1=$(ts)
+act "date -u -s @$N rc=$rc out='$(cat $O/date-s.out)' clk_before=$c0 clk_after=$c1 (no hwclock, RTC untouched)"
+# 4. immediate post snapshot + DMS re-check against the new clock
+snap $O/b7b-post.txt
+for k in 1 2 3; do s=$(dms_sample); echo "$s" | awk -v G=$GPS -v k=$k '{u=$3/1000+G; m=($1+$2)/2; printf "POST DMS%d utc=%.3f clock_mid=%.6f DMS-clock=%+.1f ms window=%.1f ms\n", k, u, m, (u-m)*1000, ($2-$1)*1000}' >> $O/b7b-post.txt; done
+act "post snapshot done; RTC since_epoch before step $RTC0, now $(cat /sys/class/rtc/rtc0/since_epoch)"
+# 5. observe
+V=$O/b7b-observe.txt; echo "# every 5 s: up clock pids state wwan0 lte_ping host_ping lifecycle_lines dmesg_lines rtc; every 15 s mm" > $V
+i=0; while [ $i -lt $OBS ]; do
+	l="up=$(up) clk=$(date -u +%T) MM=$(pidof ModemManager) rmtfs=$(pidof rmtfs) qp=$(pidof qmi-proxy) tel=$(pidof telnetd) state=$(cat $D/state) wwan0=$(ip -4 -o addr show wwan0 | awk '{print $4}')"
+	l="$l lte=$(ping -c1 -W2 -I wwan0 77.88.8.8 >/dev/null 2>&1 && echo ok || echo FAIL) host=$(ping -c1 -W1 172.16.42.2 >/dev/null 2>&1 && echo up || echo DOWN)"
+	l="$l lc=$(wc -l < $D/lifecycle.log) dmesg=$(dmesg | wc -l) rtc=$(cat /sys/class/rtc/rtc0/since_epoch)"
+	[ $((i % 15)) = 0 ] && l="$l mm=$(mm -m any | grep -E '\| +(state|registration): ' | awk -F': ' '{print $2}' | tr -d ' ' | tr '\n' '/') bearer1=$(mm -b 1 | grep -m1 'connected:' | awk -F': ' '{print $2}')"
+	echo "$l" >> $V; sleep 5; i=$((i+5)); done
+echo "=== dmesg since step (from line $DN0)" >> $V; dmesg | tail -n +$((DN0+1)) >> $V
+echo "=== mm-0.log since step (grep time|clock|timeout|error|warn)" >> $V; grep -iE "time|clock|error|warn" $D/mm-0.log | tail -n 40 >> $V
+act "observe done"
+# 6-9. NTP check (query only)
+C=$O/b7b-ntp-check.txt; SRC=$(ip -4 -o addr show wwan0 | awk '{print $4}' | cut -d/ -f1)
+{ echo "route add $NTPIP/32 dev wwan0 src $SRC"; ip route add $NTPIP/32 dev wwan0 src $SRC && echo ROUTE-ADD-OK; ip route
+  echo "clock before: $(ts) $(date -u)"; timeout 14 $B ntpd -w -d -p $NTPIP 2>&1; echo "clock after: $(ts) $(date -u)"
+  for k in 1 2 3; do dms_sample | awk -v G=$GPS -v k=$k '{u=$3/1000+G; m=($1+$2)/2; printf "DMS%d DMS-clock=%+.1f ms\n", k, (u-m)*1000}'; done
+  ip route del $NTPIP/32 dev wwan0 && echo ROUTE-DEL-OK; ip route; } > $C 2>&1
+act "ntp check done: $(grep 'reply from' $C | awk '{print $5, $6}' | tr '\n' ';')"
+act "B7B END"
--- a/b7/b7c/B7C-AUDIT.md
+++ b/b7/b7c/B7C-AUDIT.md
@ -0,0 +1,42 @@
+# B7C audit + proposed patch (not built, nothing written)
+
+Live board files == b6p/rootfs (aurora-modem 6e922dec…, init.d 533f47ea…, modem.conf 6ffb206e…) + r2/t4/rootfs/init (13721ca5…).
+
+## Clock usage in the current controller / init
+| Mechanism | Clock | Affected by a REALTIME step? |
+|---|---|---|
+| now(), since(), wait_for deadlines, reg_sm T_REG deadline, log timestamps, diag file names | /proc/uptime (CLOCK_BOOTTIME) | no |
+| `sleep N` / `sleep 0.2` (busybox, nanosleep) | relative | no |
+| `timeout N` (busybox) | relative | no |
+| `ping -W`, `udevadm settle --timeout` | relative/monotonic | no |
+| qmicli / mmcli / ModemManager timeouts | GLib monotonic | no (B7B: no reaction) |
+| /init: only `sleep` loops | relative | no |
+| wall clock (`date`) | not used anywhere today | — |
+Conclusion: no change needed for timeouts; the patch itself uses only uptime for waits/alignment.
+
+## Kernel
+out-bam1 .config: CONFIG_RTC_HCTOSYS=y, CONFIG_RTC_SYSTOHC=y (rtc0 = rtc-pm8xxx, DT without allow-set-time).
+SYSTOHC writes the RTC every 11 min only while STA_UNSYNC is cleared (NTP-disciplined). `date -s` keeps STA_UNSYNC (B7B: status 64).
+→ The SNTP stage must never discipline/slew (busybox ntpd without -w would clear UNSYNC): query-only `ntpd -w`, step via `date -s` only if |offset| ≥ 1 s.
+
+## Insertion points (fresh start path)
+QMI_READY (first moment DMS answers) → SIM_READY → RADIO_ONLINE (before reg_sm) → each reg_sm state transition → REGISTERED (before killall qmi-proxy)
+→ BEARER_CONNECTED (after START OK) + background SNTP. Each probe: 2 qmicli calls (~40 ms each), raw kept in /run/aurora-modem/time-probe-N.{dms,nitz},
+table /run/aurora-modem/time.tsv, one lifecycle/kmsg line. Set happens at most once ($D/time-set), only while the clock is before the build floor.
+Policy in the test image: TIME_REQUIRE_NITZ=1 (DMS without NITZ is logged as INVALID(no-nitz), i.e. plausible but not yet trusted) — this still answers
+"when is DMS first valid"; relax only after evidence.
+
+## Patch
+b7/b7c/aurora-modem-b7c.diff (b6p → b7c, +55 lines), patched controller sha 932c9ff2… Locally tested under busybox sh with stubbed qmicli/date
+(real B7A outputs): VALID → one date -s, second probe no re-set; 1980 → INVALID(year<2026); no NITZ → INVALID(no-nitz); SNTP/nslookup parsers on real outputs.
+
+## Planned RAM image (after GO)
+initramfs-t4.cpio.gz (unchanged) + appended overlay: /usr/sbin/aurora-modem (patched), /etc/aurora/build-epoch (build time),
+/usr/libexec/aurora/busybox (Alpine busybox-static 1.37.0-r20 aarch64, static, 1115944 B, sha a6bb1e6e…, used only as `busybox ntpd -w`).
+/init, init.d, modem.conf unchanged. Boot: RESET-held power-on → lk1st fastboot → `fastboot boot`. No cache/eMMC write.
+
+## Build (2026-10-02, GO "сборка")
+b7/b7c/build-b7c.sh: T4 initramfs db47835b verified, mkbootimg reproduces T4 bit-for-bit, overlay (aurora-modem 932c9ff2, build-epoch 1790935600 = 2026-10-02T10:06:40Z,
+/usr/libexec/aurora/busybox a6bb1e6e) → out/aurora-mm1-b7c.img **d0c4cc00…** (21291008 B; ramdisk 12628896 B in the image == initramfs-b7c f219b04d).
+Layer extraction check: final /usr/sbin/aurora-modem, build-epoch, busybox = overlay; /init, init.d, modem.conf = T4. ntpd applet runs (qemu --help).
+Copied to 480s, `sha256sum -c SHA256SUMS` OK. Host driver for one cold boot: b7/b7c/b7c-boot.sh K (not run yet).
--- a/b7/b7c/SHA256SUMS
+++ b/b7/b7c/SHA256SUMS
@ -0,0 +1,8 @@
+9a6bffd7cc175bbd29c0cd4fd327c10cbdca456a053784e407a98c501f27e071  build-b7c.sh
+30029b787c8f906be9f8e1911752714f406653c931d972b7787dbd7c3f6f687a  aurora-modem-b7c.diff
+a6bb1e6e349cbdfa690a78cd0017413c5446bdae02ee003ceb682d4ae1a004ff  busybox-ntp.static
+932c9ff2d7176d7fd656c2f8de139edad418985da39eb24240f332692ab95424  rootfs/usr/sbin/aurora-modem
+25a8a2484c55806054af11cfd4c1b226fe467e945667c371935e9520538e6e93  rootfs/etc/aurora/build-epoch
+d0c4cc0011ba9d463dbdc9cc5ca4ca1753912ae2f319a37cdfb33a0867412815  out/aurora-mm1-b7c.img
+f219b04d539faf34cd096eaacf6bcf048c3639fa57c076d40a2812bd3ff74699  out/initramfs-b7c.cpio.gz
+a46736c2a9d400e253e6428feb2b308ff4a8b76ed7676b192c3d40bde1d91c4a  out/overlay-b7c.cpio.gz
--- a/b7/b7c/aurora-modem-b7c.diff
+++ b/b7/b7c/aurora-modem-b7c.diff
@ -0,0 +1,130 @@
+--- b6p/rootfs/usr/sbin/aurora-modem	2026-09-30 22:24:42.244902667 +0600
+++ b7/b7c/rootfs/usr/sbin/aurora-modem	2026-10-02 16:02:56.501057243 +0600
+@@ -8,6 +8,10 @@
+ #   stop:       disconnect -> stop MM (+qmi-proxy) -> BAM-DMUX suspended -> SIGTERM rmtfs (rmtfs writes 'stop' -> MSS offline) -> rmtfs exits last.
+ # Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; refuses to start unless modemst1/2, fsc, fsg, persist, mmcblk0 are getro=1 and /firmware is ro.
+ # Does not need a valid wall clock (all timing from /proc/uptime). No automatic MSS/rmtfs retry.
+# B7C: time bootstrap. At fixed points of start (QMI_READY, SIM_READY, RADIO_ONLINE, each REG transition, REGISTERED, BEARER_CONNECTED) logs QMI DMS
+#   + 3GPP NITZ. The first valid DMS (>= 2026, >= image build, plausible, |DMS-NITZ| < 2 s; NITZ required unless TIME_REQUIRE_NITZ=0) steps
+#   CLOCK_REALTIME once with date -s (never backwards, never RTC). After START OK, a background SNTP check (VNIIFTRI, query only) logs the residual
+#   and steps only if |offset| >= TIME_NTP_STEP s. No slew/discipline: STA_UNSYNC stays set, so the kernel RTC_SYSTOHC 11-min RTC write never engages.
+ # Exit: 0 ok, 1 failure/timeout (start rolls back with a full stop unless MODEM_KEEP_ON_FAIL=1), 2 usage/config error.
+ 
+ CONF=${MODEM_CONF:-/etc/aurora/modem.conf}
+@@ -21,6 +25,7 @@
+ T_RMTFS=5 T_MSS=60 T_QMI_DEV=30 T_QMI=45 T_SIM=60 T_ONLINE=30 T_REG=180 T_MM_DETECT=150 T_MM_REG=60 T_CONNECT=150
+ T_DISCONNECT=60 T_DISABLE=30 T_MM_EXIT=30 T_BAM_IDLE=15 T_MSS_STOP=30 T_RMTFS_EXIT=15
+ APN= USER= PASSWORD= AUTH= IP_TYPE=ipv4 REG_TIMEOUT=600 ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
+TIME_BOOTSTRAP=1 TIME_REQUIRE_NITZ=1 TIME_MAX_DMS_NITZ=2 TIME_NTP="ntp1.vniiftri.ru ntp2.vniiftri.ru ntp3.vniiftri.ru" TIME_NTP_STEP=1
+ [ -f "$CONF" ] && . "$CONF"
+ MODEM_APN=$APN MODEM_USER=$USER MODEM_PASSWORD=$PASSWORD MODEM_AUTH=$AUTH MODEM_IP_TYPE=${IP_TYPE:-ipv4} MODEM_TEST_ROUTES=$ROUTES T_REG=${REG_TIMEOUT:-600}
+ MODEM_KEEP_ON_FAIL=${MODEM_KEEP_ON_FAIL:-$KEEP}
+@@ -90,7 +95,7 @@
+ 				"$(qv 'EUTRA Absolute RF Channel Number' $D/qmi-cl.txt)" "$(qv 'Serving Cell ID' $D/qmi-cl.txt)" "$SIT" "$SIE" \
+ 				"$(qv 'Tracking Area Code' $D/qmi-cl.txt)" "$(qv 'Global Cell ID' $D/qmi-cl.txt)" "$(qv RSRP $D/qmi-sig.txt)" "$(qv RSRQ $D/qmi-sig.txt)" "$(qv SNR $D/qmi-sig.txt)" >> $T
+ 			log "REG t+$(since $t0)s: $RG / PS $PS / $ST ($TS, $DM) $PL pci=$(qv 'Serving Cell ID' $D/qmi-cl.txt) si=$SIT/$SIE cl=$(qv 'Tracking Area Code' $D/qmi-cl.txt)/$(qv 'Global Cell ID' $D/qmi-cl.txt)"
+-			last=$key
+			last=$key; tprobe "REG:$RG/$PS"
+ 		fi
+ 		echo $nd > $D/reg-denied-count
+ 		[ "$RG" = registered ] && [ "$PS" = attached ] && return 0
+@@ -100,6 +105,55 @@
+ }
+ bearer_field() { awk -F': ' -v k="$1" '$1 ~ " "k"$" {gsub(/ /,"",$2); print $2; exit}' $BEARER.txt; }
+ 
+# --- B7C time bootstrap. Variables are _t-prefixed: tprobe runs inside reg_sm (n, T, last, t0 belong to it).
+NTPBB=/usr/libexec/aurora/busybox; GPS_EPOCH=315964800; Y2026=1767225600
+time_floor() { _tf=$(cat /etc/aurora/build-epoch 2>/dev/null); case "$_tf" in ''|*[!0-9]*) _tf=$Y2026;; esac; [ $_tf -lt $Y2026 ] && _tf=$Y2026; echo $_tf; }
+# tprobe PHASE: read DMS + NITZ (raw kept in $D/time-probe-N.*), validate, log; first VALID sample while the clock is still pre-build -> tset
+tprobe() {
+	[ "$TIME_BOOTSTRAP" = 1 ] || return 0
+	_tn=$(( $(cat $D/time-probes 2>/dev/null || echo 0) + 1 )); echo $_tn > $D/time-probes; _tp=$D/time-probe-$_tn
+	_u0=$(now); timeout 5 $Q --dms-get-time > $_tp.dms 2>&1; _u1=$(now); timeout 5 $Q --nas-get-network-time > $_tp.nitz 2>&1; _u2=$(now)
+	_ms=$(sed -n "s/.*System time: '\([0-9]*\).*/\1/p" $_tp.dms); _nd=$(qv '3GPP Date' $_tp.nitz); _nt=$(qv '3GPP Time' $_tp.nitz)
+	_ne=; [ -n "$_nd" ] && [ -n "$_nt" ] && _ne=$(date -u -d "$_nd $_nt" +%s 2>/dev/null); _clk=$(date -u +%s)
+	# -> "VERDICT dms_utc dms_uptime dms-nitz reason"; dms-nitz compares DMS projected to the NITZ read instant with whole-second NITZ
+	_v=$(awk -v ms="$_ms" -v g=$GPS_EPOCH -v u0=$_u0 -v u1=$_u1 -v u2=$_u2 -v ne="$_ne" -v fl=$(time_floor) -v y=$Y2026 -v rn=$TIME_REQUIRE_NITZ -v mx=$TIME_MAX_DMS_NITZ 'BEGIN{
+		if (ms !~ /^[0-9]+$/) { print "INVALID - - - dms-unreadable"; exit }
+		dms=ms/1000+g; at=(u0+u1)/2; r="ok"; d="-"
+		if (dms < y) r="year<2026"; else if (dms < fl) r="before-build"; else if (dms > fl+5*365*86400) r="implausible"
+		if (ne ~ /^[0-9]+$/) { dd=dms+((u1+u2)/2-at)-ne; d=sprintf("%+.2f", dd); if (r=="ok" && (dd<-mx || dd>mx)) r="dms-nitz-mismatch" }
+		else if (r=="ok" && rn==1) r="no-nitz"
+		printf "%s %.3f %.2f %s %s\n", (r=="ok" ? "VALID" : "INVALID"), dms, at, d, r }')
+	set -- "$1" $_v
+	printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $_tn "$1" $_u0 "${_ms:--}" "$3" "${_nd:--}T${_nt:--}" "$5" $_clk "$2/$6" >> $D/time.tsv
+	log "TIME probe $_tn [$1]: dms_ms=${_ms:-none} dms_utc=$3 nitz=${_nd:-none} ${_nt} dms-nitz=$5 clock=$_clk -> $2 ($6)"
+	[ "$2" = VALID ] && [ ! -f $D/time-set ] && [ $_clk -lt $(time_floor) ] && tset "$1" $3 $4 $5
+	return 0; }
+# tset PHASE DMS_UTC DMS_UPTIME DIFF: step CLOCK_REALTIME once, landing on a whole UTC second (uptime-based wait, no fixed bias correction)
+tset() {
+	_N=$(awk -v d=$2 -v a=$3 -v u=$(now) 'BEGIN{printf "%d", int(d+(u-a))+1}')
+	_w=$(awk -v N=$_N -v d=$2 -v a=$3 -v u=$(now) 'BEGIN{w=N-(d+(u-a)); printf "%.3f", (w>0 ? w : 0)}')
+	sleep $_w; _old=$(date -u +%s); [ $_N -gt $_old ] || { log "TIME SET skipped: target $_N not after clock $_old (never backwards)"; return 0; }
+	date -u -s @$_N > /dev/null 2>&1; _rc=$?
+	[ $_rc = 0 ] && echo "$_N $(now) $1 qmi-dms" > $D/time-set
+	log "TIME SET rc=$_rc source=qmi-dms phase=$1 old=$_old ($(date -u -d @$_old '+%F %T')) new=$_N ($(date -u '+%F %T')) uptime=$(now) dms-nitz=$4 validation=VALID rtc=untouched"; }
+# after START OK, background: resolve VNIIFTRI via bearer DNS, /32 routes via addroute (removed by stop/disconnect), ntpd -w (query only)
+time_sntp() {
+	[ "$TIME_BOOTSTRAP" = 1 ] && [ -x $NTPBB ] && [ -n "$TIME_NTP" ] || { log "SNTP: skipped (bootstrap=$TIME_BOOTSTRAP bin=$([ -x $NTPBB ] && echo yes || echo no))"; return 0; }
+	. $D/ipcfg 2>/dev/null || return 0; _dns=${DNS%%,*}; _ips=
+	for _h in $TIME_NTP; do _ip=$(nslookup $_h $_dns 2>/dev/null | awk '/^Name:/{f=1} f && /^Address/{print $2; exit}')
+		case "$_ip" in [0-9]*.[0-9]*.[0-9]*.[0-9]*) addroute $_ip && _ips="$_ips $_ip";; *) log "SNTP: $_h not resolved via $_dns";; esac; done
+	[ -n "$_ips" ] || return 0
+	_a=; for _ip in $_ips; do _a="$_a -p $_ip"; done
+	timeout 15 $NTPBB ntpd -w -d $_a > $D/sntp.txt 2>&1
+	_b=$(awk '/reply from/{o="";d=""; for(i=1;i<=NF;i++){ if($i~/^offset:/) o=substr($i,8); if($i~/^delay:/) d=substr($i,7) } if(o!="" && (bd=="" || d+0<bd+0)){b=o; bd=d; s=$4}}
+		END{ if (b!="") print b, bd, s }' $D/sntp.txt)
+	log "SNTP check ($_ips): $(grep -c 'reply from' $D/sntp.txt) replies; best offset delay server: ${_b:-none} (offset > 0 = clock behind)"
+	[ -n "$_b" ] || return 0
+	if [ "$(awk -v o=${_b%% *} -v s=$TIME_NTP_STEP 'BEGIN{print (o>=s || o<=-s)}')" = 1 ]; then
+		_old=$(date -u +%s); _N=$(awk -v c=$_old -v o=${_b%% *} 'BEGIN{printf "%d", c+o+0.5}'); date -u -s @$_N > /dev/null 2>&1
+		log "SNTP STEP rc=$? old=$_old new=$_N (|offset| >= ${TIME_NTP_STEP}s) rtc=untouched"
+	else log "SNTP: |offset| < ${TIME_NTP_STEP}s - clock kept (no slew: STA_UNSYNC stays, RTC_SYSTOHC never engages)"; fi; }
+
+ check_safety() {
+ 	for p in modemst1 modemst2 fsc fsg persist; do
+ 		d=/dev/disk/by-partlabel/$p; [ -e $d ] || return 1
+@@ -171,9 +225,9 @@
+ 		setstate QMI_READY
+ 	else
+ 		t=$(now); wait_for $T_QMI 1 qmi_ok || fail_start "QMI DMS not answering after ${T_QMI}s"
+-		setstate QMI_READY; log "DMS $(grep -o "Mode: '[^']*'" $D/qmi-mode.txt) after $(since $t)s"
+		setstate QMI_READY; log "DMS $(grep -o "Mode: '[^']*'" $D/qmi-mode.txt) after $(since $t)s"; tprobe QMI_READY
+ 		t=$(now); wait_for $T_SIM 1 sim_ready || fail_start "SIM/USIM not ready after ${T_SIM}s ($(grep -E "Card state|Application state" $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' '))"
+-		setstate SIM_READY; log "UIM card present, USIM app ready after $(since $t)s"
+		setstate SIM_READY; log "UIM card present, USIM app ready after $(since $t)s"; tprobe SIM_READY
+ 		if ! grep -q "Mode: 'online'" $D/qmi-mode.txt; then
+ 			log "SET: $Q --dms-set-operating-mode=online (retried only on DeviceNotReady, <= ${T_ONLINE}s)"
+ 			rm -f $D/qmi-set.err; t=$(now); wait_for $T_ONLINE 1 set_online || fail_start "SET online: DeviceNotReady for ${T_ONLINE}s"
+@@ -181,13 +235,13 @@
+ 			qmi_ok && grep -q "Mode: 'online'" $D/qmi-mode.txt || fail_start "mode not online after SET"
+ 			log "DMS online after $(since $t)s"
+ 		fi
+-		setstate RADIO_ONLINE
+		setstate RADIO_ONLINE; tprobe RADIO_ONLINE
+ 		t=$(now); reg_sm $t; rr=$?
+ 		[ $rr = 2 ] && fail_start "LOCAL FAILURE during registration: $(cat $D/reg-fail)"
+ 		[ $rr = 1 ] && fail_start "$(cat $D/reg-fail)"
+ 
+ 		log "registered: $(grep -oE "(MCC|MNC|Description): '[^']*'" $D/qmi-ss.txt | tr '\n' ' ')after $(since $t)s"
+-		setstate REGISTERED
+		setstate REGISTERED; tprobe REGISTERED
+ 		killall qmi-proxy 2>/dev/null; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'
+ 	fi
+ 
+@@ -237,6 +291,7 @@
+ 	ip route | grep -q "^default" && log "WARNING: a default route exists (not created by us)"
+ 	setstate BEARER_CONNECTED
+ 	log "=== START OK in $(since $T0)s ($IF $A/$PF, routes: $(tr '\n' ' ' < $ROUTES))"
+	tprobe BEARER_CONNECTED; ( time_sntp ) &
+ }
+ 
+ do_stop() {
+@@ -324,6 +379,7 @@
+ 	echo "bam-dmux:   $(bam_pm) active_ms=$(cat $BAM/power/runtime_active_time 2>/dev/null) suspended_ms=$(cat $BAM/power/runtime_suspended_time 2>/dev/null) control=$(cat $BAM/power/control 2>/dev/null)"
+ 	echo "usb0:       $(ip -4 addr show usb0 | awk '/inet /{print $2}') route-to-host: $(ip route get 172.16.42.2 2>&1 | head -1)"
+ 	echo "emmc:       $(awk '{print "writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat)"
+	echo "time:       $(date -u '+%F %T') UTC; set: $(cat $D/time-set 2>/dev/null || echo no); probes: $(cat $D/time-probes 2>/dev/null || echo 0)"
+ 	echo "dmesg-errs: $(dmesg | grep -cE 'Failed to resume|Resource temporarily|crash detected|fatal error|[Ww]atchdog|Oops|Kernel panic|Unable to handle')"
+ }
+ 
--- a/b7/b7c/b7c-boot.sh
+++ b/b7/b7c/b7c-boot.sh
@ -0,0 +1,47 @@
+#!/bin/sh
+# 480s side, B7C RAM cold boot K. Board: full power-off >= 90 s, then RESET held at power-on (battery -> USB) -> lk1st fastboot.
+# This script: new UART log -> wait fastboot <EMMC_SERIAL> -> fastboot boot b7c image -> passive waits -> read-only collection over telnet.
+# No input on the boot path except `fastboot boot`; nothing is written to eMMC/cache.
+K=$1; MODE=$2; [ -n "$K" ] || { echo "usage: $0 K [collect|now]"; exit 2; }   # collect = skip uartlog/fastboot, only wait + collect; now = boot a board already sitting in fastboot (NOT a cold boot)
+cd ~/doc/modem/jz08-aurora; O=logs/b7/b7c/c$K; mkdir -p $O; IMG=b7/b7c/out/aurora-mm1-b7c.img
+A=$O/host-actions.txt; act() { echo "$(date -u +%H:%M:%S.%3N) $*" | tee -a $A; }
+tn() { { sleep 1; sed "s/\$/\r/" "$1"; sleep $2; } | ncat 172.16.42.1 23 | tr -d "\000\r"; }
+echo "d0c4cc0011ba9d463dbdc9cc5ca4ca1753912ae2f319a37cdfb33a0867412815  $IMG" | sha256sum -c || exit 1
+if [ "$MODE" != collect ]; then
+OLD=$(ps -eo pid,cmd | grep "[u]artlog.py /dev/ttyUSB0" | awk '{print $1}'); [ -n "$OLD" ] && kill $OLD; sleep 1
+U=logs/uart/b7c$K-$(date +%Y%m%d-%H%M%S); setsid nohup python3 tools/uartlog.py /dev/ttyUSB0 $U > $U.stderr 2>&1 < /dev/null &
+act "B7C c$K: uartlog PID $! -> $U.log; waiting for fastboot <EMMC_SERIAL> (power off >= 90 s, then RESET held + battery -> USB)"
+# require a real power-off: if the board already sits in fastboot, first wait until it disappears (power removed)
+if [ "$MODE" != now ] && fastboot devices 2>/dev/null | grep -q <EMMC_SERIAL>; then act "board already in fastboot - waiting for it to disappear (power-off) first"
+	until ! fastboot devices 2>/dev/null | grep -q <EMMC_SERIAL>; do sleep 1; done; act "fastboot device gone (power removed)"; fi
+i=0; until fastboot devices 2>/dev/null | grep -q <EMMC_SERIAL>; do i=$((i+1)); [ $i -ge 600 ] && { act "ABORT: no fastboot in 20 min"; exit 1; }; sleep 2; done
+act "fastboot device present"; { fastboot boot $IMG 2>&1; echo "rc=$?"; } | tee -a $A
+else U=$(ls -t logs/uart/b7c$K-*.log | head -1); U=${U%.log}; act "collect-only mode, UART $U.log"; fi
+i=0; until ping -c1 -W1 172.16.42.1 >/dev/null 2>&1; do i=$((i+1)); [ $i -ge 90 ] && { act "ABORT: NCM not up after ~180 s - nothing touched, collect UART only"; cp $U.log $O/uart.log; exit 1; }; sleep 1; done; act "NCM ping 172.16.42.1 ok"
+R=$(grep -a "rtc-pm8xxx.*setting system clock" $U.log | tail -1 | sed -n 's/.*(\([0-9]*\)).*/\1/p'); C=B; [ -n "$R" ] && [ "$R" -lt 40 ] && C=A
+act "PM8916 RTC at Linux boot = ${R:-?} s -> class $C (A = PMIC POR; <40 s allows for the lk fastboot wait)"
+printf 'grep -E "START OK|FAIL in|rollback" /run/aurora-modem/lifecycle.log | tail -1\n' > $O/.w
+i=0; until tn $O/.w 3 | grep -qE "^\[[0-9.]+\] .*(=== START OK|FAIL in|rollback)"; do i=$((i+1)); [ $i -ge 80 ] && { act "no START OK/FAIL after ~12 min"; break; }; sleep 6; done
+act "controller end: $(tn $O/.w 3 | grep -E '^\[[0-9.]+\] .*(=== START OK|FAIL in|rollback)' | tail -1)"
+printf 'grep -E "SNTP (check|STEP|: )" /run/aurora-modem/lifecycle.log | tail -2\n' > $O/.s
+i=0; until tn $O/.s 3 | grep -qE "^\[[0-9.]+\] SNTP"; do i=$((i+1)); [ $i -ge 15 ] && break; sleep 4; done; act "sntp: $(tn $O/.s 3 | grep -E '^\[[0-9.]+\] SNTP' | tail -2 | tr '\n' ' ')"
+cat > $O/.c <<'C'
+echo B7C-SNAP-BEGIN; cat /proc/uptime; date -u; /usr/libexec/aurora/busybox adjtimex | grep -E "status|offset|time.tv"
+dmesg | grep -E "rtc-pm8xxx|setting system clock"; cat /sys/class/rtc/rtc0/since_epoch /sys/class/rtc/rtc0/date /sys/class/rtc/rtc0/time
+sha256sum /usr/sbin/aurora-modem /usr/libexec/aurora/busybox; cat /etc/aurora/build-epoch
+/etc/init.d/aurora-modem status
+echo ---time.tsv; cat /run/aurora-modem/time.tsv; echo ---time-set; cat /run/aurora-modem/time-set
+echo ---lifecycle; cat /run/aurora-modem/lifecycle.log
+echo ---sntp; cat /run/aurora-modem/sntp.txt
+echo ---routes; ip route; cat /run/aurora-modem/routes
+echo ---ping; ping -c3 -W3 -I wwan0 77.88.8.8 | tail -2
+echo ---ntp-verify; timeout 12 /usr/libexec/aurora/busybox ntpd -w -d -p 89.109.251.22 2>&1 | grep "reply from"
+echo ---dmesg-err; dmesg | grep -ciE "error|fail|oops|watchdog"; dmesg | grep -E "aurora-modem\] (TIME|SNTP)"
+echo ---emmc; awk "{print \"w=\"\$5\" s=\"\$7}" /sys/block/mmcblk0/stat
+echo B7C-SNAP-END
+C
+tn $O/.c 30 > $O/snapshot.txt; act "snapshot: $(grep -c B7C-SNAP-END $O/snapshot.txt) end markers"
+printf 'cd /run/aurora-modem && tar cf /tmp/b7c-run.tar . 2>/dev/null; sha256sum /tmp/b7c-run.tar; nc -l -p 9938 < /tmp/b7c-run.tar &\n' > $O/.t
+tn $O/.t 3 | grep b7c-run.tar > $O/run-tar.sha; sleep 1; ncat --recv-only 172.16.42.1 9938 > $O/run-aurora-modem.tar; sha256sum $O/run-aurora-modem.tar | tee -a $A
+cp $U.log $O/uart.log; grep -aE "SBL1, Start|pm_device_init, Delta|pm_driver_init, Delta|MMC card|Done initialization|CID|Linux version|EMMC-RO|B1_OK|T4:|aurora-modem\] (STATE|TIME|SNTP|REG t|registered|=== START)|FAIL" $U.log | cut -c1-230 > $O/uart-markers.txt
+act "B7C c$K END"
--- a/b7/b7c/b7c-verify.sh
+++ b/b7/b7c/b7c-verify.sh
@ -0,0 +1,10 @@
+#!/bin/sh
+# 480s side: verification of the persistent B7C cache. Normal power-on (no RESET, no fastboot). New UART log, wait for lk + Linux, then read-only collect.
+K=${1:-V1}; cd ~/doc/modem/jz08-aurora; mkdir -p logs/b7/b7c/$K
+OLD=$(ps -eo pid,cmd | grep "[u]artlog.py /dev/ttyUSB0" | awk '{print $1}'); [ -n "$OLD" ] && kill $OLD; sleep 1
+U=logs/uart/b7c$K-$(date +%Y%m%d-%H%M%S); setsid nohup python3 tools/uartlog.py /dev/ttyUSB0 $U > $U.stderr 2>&1 < /dev/null &
+echo "$(date -u +%T) uartlog -> $U.log; waiting for a new SBL1 + lk 'Trying to boot'"
+i=0; until grep -aq "Trying to boot" $U.log 2>/dev/null; do i=$((i+1)); [ $i -ge 900 ] && { echo "no lk boot line in 30 min"; exit 1; }; sleep 2; done
+echo "$(date -u +%T) lk: $(grep -a "Trying to boot" $U.log | tail -1)"; echo "$(date -u +%T) SBL1 starts: $(grep -ac 'SBL1, Start' $U.log)"
+i=0; until ping -c1 -W1 172.16.42.1 >/dev/null 2>&1; do i=$((i+1)); [ $i -ge 120 ] && { echo "NCM not up"; exit 1; }; sleep 1; done
+exec sh b7/b7c/b7c-boot.sh $K collect
--- a/b7/b7c/build-b7c.sh
+++ b/b7/b7c/build-b7c.sh
@ -0,0 +1,25 @@
+#!/bin/sh
+# B7C RAM test image: exact T4 initramfs (db47835b) + appended overlay: patched /usr/sbin/aurora-modem (time bootstrap), /etc/aurora/build-epoch,
+# /usr/libexec/aurora/busybox (Alpine busybox-static 1.37.0-r20, used only as `busybox ntpd -w`). Kernel/DTB/cmdline = golden mm1 (same as B6P/T4).
+# For `fastboot boot` only - never flash.
+set -e; cd "$(dirname "$0")"; B=../../b6p; T=../../r2/t4; O=out; GEN=../../linux/out/usr/gen_init_cpio; TS=1790726400
+G=../../linux/artifacts/ramboot-mm1; BUILD=${BUILD_EPOCH:-$(date -u +%s)}; mkdir -p $O rootfs/etc/aurora
+echo "db47835b9286617c306cf78960cac592940c795fe91f45f072fa8622165869a6  $T/out/initramfs-t4.cpio.gz" | sha256sum -c
+echo "6db01841170b5e1203fe904d81f9abfb7ed35e68ad0beeae17e5ad865800e4ad  $T/out/aurora-mm1-t4telnet.img" | sha256sum -c
+echo "a6bb1e6e349cbdfa690a78cd0017413c5446bdae02ee003ceb682d4ae1a004ff  busybox-ntp.static" | sha256sum -c
+# prove the writer reproduces the T4 image bit-for-bit
+python3 $B/mkbootimg.py $B/out/golden-unpack/kernel $T/out/initramfs-t4.cpio.gz $G/cmdline.txt $O/t4-rebuilt.img
+cmp $O/t4-rebuilt.img $T/out/aurora-mm1-t4telnet.img && echo "mkbootimg: T4 reproduced bit-for-bit"
+echo $BUILD > rootfs/etc/aurora/build-epoch; echo "build-epoch $BUILD ($(date -u -d @$BUILD +%FT%TZ))"
+cat > $O/overlay-b7c.list <<L
+file /usr/sbin/aurora-modem rootfs/usr/sbin/aurora-modem 0755 0 0
+file /etc/aurora/build-epoch rootfs/etc/aurora/build-epoch 0644 0 0
+dir /usr/libexec/aurora 0755 0 0
+file /usr/libexec/aurora/busybox busybox-ntp.static 0755 0 0
+L
+$GEN -t $TS $O/overlay-b7c.list > $O/overlay-b7c.cpio
+gzip -9 -n -c $O/overlay-b7c.cpio > $O/overlay-b7c.cpio.gz
+cat $T/out/initramfs-t4.cpio.gz $O/overlay-b7c.cpio.gz > $O/initramfs-b7c.cpio.gz
+python3 $B/mkbootimg.py $B/out/golden-unpack/kernel $O/initramfs-b7c.cpio.gz $G/cmdline.txt $O/aurora-mm1-b7c.img
+sha256sum rootfs/usr/sbin/aurora-modem rootfs/etc/aurora/build-epoch busybox-ntp.static $O/overlay-b7c.cpio.gz $O/initramfs-b7c.cpio.gz $O/aurora-mm1-b7c.img > $O/SHA256SUMS
+cat $O/SHA256SUMS; ls -l $O/aurora-mm1-b7c.img $T/out/aurora-mm1-t4telnet.img
--- a/b7/b7c/cache/B7C-PREFLIGHT.md
+++ b/b7/b7c/cache/B7C-PREFLIGHT.md
@ -0,0 +1,23 @@
+# B7C cache write — preflight (prepared 2026-10-02, NOT written)
+
+## Candidate
+cache-extlinux-b7c.img **14fe453a…** (134217728 B, ext2, label aurora-b7c), built on 480s by mkfs-cache-b7c.sh = exact T4 recipe
+(r2/t4/mkfs-cache-t4.sh → 9d3bc890) with only initrd/label/UUID changed. Rebuild is bit-identical (reproducible). e2fsck clean.
+Content: Image.gz-dtb + aurora-mm1.dtb + cmdline = b5b/components (sha-checked, identical to T4), initramfs-b7c.cpio.gz **f219b04d…**
+= the RAM image that passed B7C 3/3 class A (aurora-mm1-b7c.img d0c4cc00 carries the same ramdisk). extlinux: `default b7c` / `label b7c`.
+
+## lk2nd emulator (emu/)
+- S4 regression on the current flash (T4 9d3bc890): "Trying to boot 't4'", HARNESS lines == r2/t4/emu (emulator unchanged).
+- S5 candidate: "Trying to boot 'b7c'", boot_linux reached, ramdisk sha f219b04d (12628896 B); kernel/dtb/cmdline HARNESS lines identical to T4.
+- Fault variants (no extlinux.conf, no initrd, zeroed cache): "Bootable file system not found. Reverting to android boot" → boot = emmc1 fallback (as for T4).
+
+## Write (B7C-write.sh, derived 1:1 from T4-write.sh)
+Gates: loader sha; candidate sha+size; rollback image r2/t4/cache-extlinux-t4.img == 9d3bc890; T4 readback backup == 9d3bc890; 9008 present;
+identity (Sahara serial <SAHARA_SERIAL>), cache geometry (0x4118c000 / 0x8000000); GPT primary == A3; boot == emmc1 (e9579f33); aboot == lk1st-autoboot (3b8cd266);
+**current cache == T4 9d3bc890**. Write cache only → readback cmp → CACHE_MATCH → verify GPT p/b, tzbak, boot, aboot, sbl1/rpm/tz/hyp/recovery/modemst1/2/fsg/fsc/persist == A3,
+modem/system/userdata == A4pre → B7C_WRITE_VERIFIED. Logs logs/b7/b7c/W/. Nothing else is written.
+Entry: HW EDL (battery on, D+ → GND, plug USB, release) — operator's hands. Rollback: B7C-rollback.sh → T4 cache 9d3bc890 (also via HW EDL).
+
+## After the write (proposal)
+Full power-off (USB, then battery), ≥ 90 s, normal power-on (no RESET): expect lk "Trying to boot 'b7c'", Linux, NCM, telnetd, TIME SET at REG registered/attached,
+START OK, SNTP check < 1 s. One verification boot; more only with a GO.
--- a/b7/b7c/cache/B7C-rollback.sh
+++ b/b7/b7c/cache/B7C-rollback.sh
@ -0,0 +1,12 @@
+#!/bin/bash
+# B7C rollback — restore the T4 cache (9d3bc890, operational since 2026-10-02: B6P + telnetd). Needs 9008 via HW EDL (D+->GND). boot/aboot untouched.
+# Deeper rollback: r2/t4/T4-rollback.sh (B6P 9fea693a), b6p/B6P-rollback.sh (B5b golden mm1, 409bbb11).
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin ; O=logs/b7/b7c/rollback ; mkdir -p $O
+B=r2/t4/cache-extlinux-t4.img
+[ "$(sha256sum $B | cut -d' ' -f1)" = 9d3bc8900ab4b4ec26cfb16d2a0e83a8b3f8f4b74793e842bccfd366263368b7 ] || { echo "STOP: rollback image hash"; exit 1; }
+lsusb | grep -q 05c6:9008 || { echo "STOP: no 9008"; exit 1; }
+edl --loader=$L printgpt > $O/00-printgpt.log 2>&1
+edl --loader=$L w cache $B > $O/cache-w.log 2>&1
+edl --loader=$L r cache $O/cache-rb.bin > /dev/null 2>&1 ; cmp $B $O/cache-rb.bin && echo CACHE_RESTORED_T4
+sha256sum $B $O/cache-rb.bin
--- a/b7/b7c/cache/B7C-write.sh
+++ b/b7/b7c/cache/B7C-write.sh
@ -0,0 +1,48 @@
+#!/bin/bash
+# B7C — the ONLY write: cache := ext2 extlinux -> B7C candidate (T4 + time bootstrap: aurora-modem 932c9ff2, build-epoch, busybox ntpd). Run on 480s ONLY after explicit GO.
+# Derived from r2/t4/T4-write.sh (T4 write, CACHE_MATCH + T4_WRITE_VERIFIED 2026-10-02); only image, expected hashes and log dir changed.
+# Entry: HW EDL (battery on, D+->GND, plug USB, release). Never `edl reset`. Stops at first failed gate.
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin
+O=logs/b7/b7c/W ; A3=logs/b5a/A3 ; P=logs/b5a/A4pre ; mkdir -p $O
+NEW=b7/b7c/cache/cache-extlinux-b7c.img     ; NEW_SHA=14fe453af6e94d414044c1c6da9eebe5c325fad842ddc5e17d09ba6b421a74cb
+OLD_SHA=9d3bc8900ab4b4ec26cfb16d2a0e83a8b3f8f4b74793e842bccfd366263368b7   # current cache = T4 extlinux
+BOOT_SHA=e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff
+ABOOT_SHA=3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85
+die(){ echo "STOP: $*"; exit 1; }
+sha(){ sha256sum "$1" | cut -d" " -f1; }
+E(){ edl --loader=$L "$@"; }
+echo "== G0 inputs"
+[ "$(sha $L)" = 53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca ] || die loader
+[ "$(sha $NEW)" = $NEW_SHA ] && [ $(stat -c %s $NEW) = 134217728 ] || die candidate
+[ "$(sha r2/t4/cache-extlinux-t4.img)" = $OLD_SHA ] || die rollback-image
+[ "$(sha logs/r2/t4/W/11-cache-readback.bin)" = $OLD_SHA ] || die t4-readback-backup
+lsusb | grep -q 05c6:9008 || die "no 9008"
+echo "== G1 identity + geometry + baseline"
+E printgpt > $O/00-printgpt.log 2>&1 || die printgpt
+grep -aq "Serial: *0x<SAHARA_SERIAL>" $O/00-printgpt.log || grep -aq "Mode detected: firehose" $O/00-printgpt.log || die serial
+grep -a "^cache:" $O/00-printgpt.log | grep -q "Offset 0x000000004118c000, Length 0x0000000008000000" || die cache-geometry
+E rs 0 34 $O/pre-gptp.bin >/dev/null 2>&1; cmp $O/pre-gptp.bin $A3/gpt-primary-34.bin || die gpt-changed
+E r boot  $O/pre-boot.bin  >/dev/null 2>&1; [ "$(sha $O/pre-boot.bin)"  = $BOOT_SHA ]  || die boot-not-emmc1
+E r aboot $O/pre-aboot.bin >/dev/null 2>&1; [ "$(sha $O/pre-aboot.bin)" = $ABOOT_SHA ] || die aboot-not-autoboot
+E r cache $O/pre-cache.bin >/dev/null 2>&1; [ "$(sha $O/pre-cache.bin)" = $OLD_SHA ]  || die cache-not-backup
+echo "== W cache := candidate (LBA 2133088, 262144 sectors)"
+E w cache $NEW > $O/10-cache-write.log 2>&1; echo "rc=$?"; grep -a "Wrote" $O/10-cache-write.log
+E r cache $O/11-cache-readback.bin > $O/11-cache-readback.log 2>&1 || die readback-rc
+sha256sum $NEW $O/11-cache-readback.bin
+cmp $NEW $O/11-cache-readback.bin || die "CACHE READBACK MISMATCH — do NOT reboot; run b7/b7c/cache/B7C-rollback.sh"
+echo CACHE_MATCH
+echo "== V everything else unchanged"
+E rs 0 34        $O/post-gptp.bin  >/dev/null 2>&1; cmp $O/post-gptp.bin  $A3/gpt-primary-34.bin || die gptp
+E rs 7634911 33  $O/post-gptb.bin  >/dev/null 2>&1; cmp $O/post-gptb.bin  $A3/gpt-backup-33.bin  || die gptb
+E rs 305184 1024 $O/post-tzbak.bin >/dev/null 2>&1; cmp $O/post-tzbak.bin $A3/tzbak-305184.bin   || die tzbak
+E r boot  $O/post-boot.bin  >/dev/null 2>&1; [ "$(sha $O/post-boot.bin)"  = $BOOT_SHA ]  || die boot
+E r aboot $O/post-aboot.bin >/dev/null 2>&1; [ "$(sha $O/post-aboot.bin)" = $ABOOT_SHA ] || die aboot
+for p in sbl1 rpm tz hyp recovery modemst1 modemst2 fsg fsc persist; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $A3/$p.bin || die "$p changed"; echo "$p == A3"
+done
+for p in modem system userdata; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $P/$p.bin || die "$p changed"; echo "$p == A4pre"; rm -f $O/post-$p.bin
+done
+(cd $O && sha256sum *.bin > SHA256SUMS)
+echo "B7C_WRITE_VERIFIED — power off fully (USB, then battery) before first boot"
--- a/b7/b7c/cache/SHA256SUMS
+++ b/b7/b7c/cache/SHA256SUMS
@ -0,0 +1,6 @@
+087b46ecfd8010c5dff83cf2669daa0427605bed89bc86c39dba0deaf1116e91  mkfs-cache-b7c.sh
+e87c6070386b3317afc98816c5535058e98690edd66f5c71f8535f95685d0e68  B7C-write.sh
+3e29668b5dca2d689bf65eee9f18983d95c3fb003f47485dc1f5e22b0b27743b  B7C-rollback.sh
+3b241cc06c3c83b1af7fca313988ec06d0f94dcf93acb208e7f1aaed6515a330  emu/run-emu-b7c.sh
+ee7d966f36e90092afd6341511e03929b6a0f6c7fcb58e3fd7998412e57ee60a  extlinux-b7c.conf
+14fe453af6e94d414044c1c6da9eebe5c325fad842ddc5e17d09ba6b421a74cb  cache-extlinux-b7c.img
--- a/b7/b7c/cache/emu/F1-no-conf.out
+++ b/b7/b7c/cache/emu/F1-no-conf.out
@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 45568
--- a/b7/b7c/cache/emu/F10-zeroed-cache.out
+++ b/b7/b7c/cache/emu/F10-zeroed-cache.out
@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 28160
--- a/b7/b7c/cache/emu/F3-no-initrd.out
+++ b/b7/b7c/cache/emu/F3-no-initrd.out
@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Initramfs /wrp0p24//initramfs-b7c.cpio.gz does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 57856
--- a/b7/b7c/cache/emu/S4-t4-regression.out
+++ b/b7/b7c/cache/emu/S4-t4-regression.out
@ -0,0 +1,40 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Trying to boot 't4'
+[lk] Decompressing the kernel...
+HARNESS: boot_linux reached: kernel @DDR+0x0 tags @DDR+0x2498000 ramdisk @DDR+0x2698000 (11958633) boot_type 0
+HARNESS: kernel magic 0x644d5241 image_size 0x1680000 end @DDR+0x1680000
+HARNESS: cmdline 'earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init'
+HARNESS: kernel   sha256 4603b02f8ae36dcf14582a00198715e7cf64fb18bfc5c3212ef464e9ecd20032 (23015432 bytes)
+HARNESS: dtb      sha256 a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b (65769 bytes)
+HARNESS: ramdisk  sha256 db47835b9286617c306cf78960cac592940c795fe91f45f072fa8622165869a6 (11958633 bytes)
--- a/b7/b7c/cache/emu/S5-b7c-candidate.out
+++ b/b7/b7c/cache/emu/S5-b7c-candidate.out
@ -0,0 +1,40 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Trying to boot 'b7c'
+[lk] Decompressing the kernel...
+HARNESS: boot_linux reached: kernel @DDR+0x0 tags @DDR+0x23f4000 ramdisk @DDR+0x25f4000 (12628896) boot_type 0
+HARNESS: kernel magic 0x644d5241 image_size 0x1680000 end @DDR+0x1680000
+HARNESS: cmdline 'earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init'
+HARNESS: kernel   sha256 4603b02f8ae36dcf14582a00198715e7cf64fb18bfc5c3212ef464e9ecd20032 (23015432 bytes)
+HARNESS: dtb      sha256 a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b (65769 bytes)
+HARNESS: ramdisk  sha256 f219b04d539faf34cd096eaacf6bcf048c3639fa57c076d40a2812bd3ff74699 (12628896 bytes)
--- a/b7/b7c/cache/emu/map-F1-no-conf.txt
+++ b/b7/b7c/cache/emu/map-F1-no-conf.txt
@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/tmp.UecFGisACL/F1-no-conf.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b7/b7c/cache/emu/map-F10-zeroed-cache.txt
+++ b/b7/b7c/cache/emu/map-F10-zeroed-cache.txt
@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/tmp.UecFGisACL/F10-zeroed-cache.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b7/b7c/cache/emu/map-F3-no-initrd.txt
+++ b/b7/b7c/cache/emu/map-F3-no-initrd.txt
@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/tmp.UecFGisACL/F3-no-initrd.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b7/b7c/cache/emu/map-S4-t4-regression.txt
+++ b/b7/b7c/cache/emu/map-S4-t4-regression.txt
@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /home/q/doc/modem/jz08-aurora/r2/t4/cache-extlinux-t4.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b7/b7c/cache/emu/map-S5-b7c-candidate.txt
+++ b/b7/b7c/cache/emu/map-S5-b7c-candidate.txt
@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /home/q/doc/modem/jz08-aurora/b7/b7c/cache/cache-extlinux-b7c.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b7/b7c/cache/emu/run-emu-b7c.sh
+++ b/b7/b7c/cache/emu/run-emu-b7c.sh
@ -0,0 +1,12 @@
+#!/bin/bash
+# lk2nd-23.1 extlinux emulator (b5b/emu) on: S4 (T4 cache = current flash, regression vs r2/t4/emu), B7C cache candidate, and B7C fault variants. Offline, 480s.
+cd ~/doc/modem/jz08-aurora/b7/b7c/cache/emu; E=../../../../b5b/emu; GPT=../../../../logs/b5a/A3/gpt-primary-34.bin; C=/home/q/doc/modem/jz08-aurora/b7/b7c/cache/cache-extlinux-b7c.img
+run() { python3 $E/mkmap.py $2 > map-$1.txt; $E/lk2nd-scan-emu map-$1.txt $GPT > $1.out 2>&1; echo "== $1 rc=$? :: $(grep -E "Trying to boot|Reverting|boot_linux reached|ramdisk  sha256|Could not" $1.out | tr '\n' ' ' | cut -c1-260)"; }
+run S4-t4-regression /home/q/doc/modem/jz08-aurora/r2/t4/cache-extlinux-t4.img
+cmp <(grep HARNESS S4-t4-regression.out) <(grep HARNESS ../../../../r2/t4/emu/S4-t4-candidate.out) && echo "   S4 HARNESS lines == r2/t4/emu/S4-t4-candidate.out"
+run S5-b7c-candidate $C; grep HARNESS S5-b7c-candidate.out
+D=$(mktemp -d); v(){ cp $C $D/$1.img; chmod u+w $D/$1.img; }
+v F3-no-initrd; /sbin/debugfs -w -R "rm /initramfs-b7c.cpio.gz" $D/F3-no-initrd.img >/dev/null 2>&1
+v F1-no-conf;   /sbin/debugfs -w -R "rm /extlinux/extlinux.conf" $D/F1-no-conf.img >/dev/null 2>&1
+head -c 134217728 /dev/zero > $D/F10-zeroed-cache.img
+for f in $D/F*.img; do run $(basename $f .img) $f; done; rm -rf $D
--- a/b7/b7c/cache/extlinux-b7c.conf
+++ b/b7/b7c/cache/extlinux-b7c.conf
@ -0,0 +1,6 @@
+default b7c
+label b7c
+	linux /Image.gz-dtb
+	fdt /aurora-mm1.dtb
+	initrd /initramfs-b7c.cpio.gz
+	append earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init
--- a/b7/b7c/cache/mkfs-cache-b7c.sh
+++ b/b7/b7c/cache/mkfs-cache-b7c.sh
@ -0,0 +1,22 @@
+#!/bin/bash
+# B7C cache candidate: exact recipe of r2/t4/mkfs-cache-t4.sh (9d3bc890); only the initrd = B7C initramfs (T4 + time bootstrap overlay),
+# its file name, the extlinux label, the fs label and UUIDs differ. Runs on 480s (mke2fs 1.47.2). Offline only; writes nothing to the board.
+set -e
+cd ~/doc/modem/jz08-aurora/b7/b7c/cache
+OUT=${1:-cache-extlinux-b7c.img}; B5=../../../b5b/components
+(cd ../../../b6p && sha256sum -c cache-components.sha256 | grep -v initramfs)
+echo "f219b04d539faf34cd096eaacf6bcf048c3639fa57c076d40a2812bd3ff74699  ../out/initramfs-b7c.cpio.gz" | sha256sum -c
+ST=$(mktemp -d); mkdir -p $ST/extlinux
+cp $B5/Image.gz-dtb $B5/aurora-mm1.dtb $ST/; cp ../out/initramfs-b7c.cpio.gz $ST/
+printf "default b7c\nlabel b7c\n\tlinux /Image.gz-dtb\n\tfdt /aurora-mm1.dtb\n\tinitrd /initramfs-b7c.cpio.gz\n\tappend %s\n" "$(cat $B5/cmdline.txt)" > $ST/extlinux/extlinux.conf
+cp $ST/extlinux/extlinux.conf extlinux-b7c.conf
+chmod 0644 $ST/*.* $ST/extlinux/extlinux.conf; chmod 0755 $ST $ST/extlinux
+find $ST -exec touch -h -d @1790726400 {} +
+rm -f $OUT; truncate -s 134217728 $OUT
+E2FSPROGS_FAKE_TIME=1790726400 /sbin/mke2fs -F -q -t ext2 -O none,filetype,sparse_super \
+  -b 4096 -I 128 -N 64 -m 0 -L aurora-b7c -U 4a5a3038-b6f0-4000-8000-00000000b7c0 \
+  -E root_owner=0:0,hash_seed=4a5a3038-b6f0-4000-8000-00000000b7c1 -d $ST $OUT 32768
+rm -rf $ST
+for f in / /lost+found /extlinux /extlinux/extlinux.conf /Image.gz-dtb /aurora-mm1.dtb /initramfs-b7c.cpio.gz; do for t in atime ctime mtime; do echo "sif $f $t @1790726400"; done; done > /tmp/b7c-sif.$$
+/sbin/debugfs -w -f /tmp/b7c-sif.$$ $OUT >/dev/null 2>&1; rm -f /tmp/b7c-sif.$$
+stat -c "%n %s" $OUT; sha256sum $OUT
--- a/b7/b7c/out/SHA256SUMS
+++ b/b7/b7c/out/SHA256SUMS
@ -0,0 +1,6 @@
+932c9ff2d7176d7fd656c2f8de139edad418985da39eb24240f332692ab95424  rootfs/usr/sbin/aurora-modem
+25a8a2484c55806054af11cfd4c1b226fe467e945667c371935e9520538e6e93  rootfs/etc/aurora/build-epoch
+a6bb1e6e349cbdfa690a78cd0017413c5446bdae02ee003ceb682d4ae1a004ff  busybox-ntp.static
+a46736c2a9d400e253e6428feb2b308ff4a8b76ed7676b192c3d40bde1d91c4a  out/overlay-b7c.cpio.gz
+f219b04d539faf34cd096eaacf6bcf048c3639fa57c076d40a2812bd3ff74699  out/initramfs-b7c.cpio.gz
+d0c4cc0011ba9d463dbdc9cc5ca4ca1753912ae2f319a37cdfb33a0867412815  out/aurora-mm1-b7c.img
--- a/b7/b7c/out/overlay-b7c.list
+++ b/b7/b7c/out/overlay-b7c.list
@ -0,0 +1,4 @@
+file /usr/sbin/aurora-modem rootfs/usr/sbin/aurora-modem 0755 0 0
+file /etc/aurora/build-epoch rootfs/etc/aurora/build-epoch 0644 0 0
+dir /usr/libexec/aurora 0755 0 0
+file /usr/libexec/aurora/busybox busybox-ntp.static 0755 0 0
--- a/b7/b7c/rootfs/etc/aurora/build-epoch
+++ b/b7/b7c/rootfs/etc/aurora/build-epoch
@ -0,0 +1 @@
+1790935600
--- a/b7/b7c/rootfs/usr/sbin/aurora-modem
+++ b/b7/b7c/rootfs/usr/sbin/aurora-modem
@ -0,0 +1,395 @@
+#!/bin/sh
+# Aurora (JZ08AU, MSM8916) modem lifecycle controller - B6P production build of the B6N-proven controller (b6j/aurora-modem).
+#   aurora-modem start | disconnect | stop | status | addroute <ipv4>
+#   start:      [rmtfs -r -P -s -v -> MSS -> wwan0qmi0 (+2 s port-race guard) -> SIM ready -> DMS online (one SET, retried only on DeviceNotReady)
+#               -> registration state machine (registered + PS attached, deadline REG_TIMEOUT, default 600 s)]  (skipped when rmtfs+MSS already run)
+#               -> udevd/dbus/polkitd/ModemManager (reused if running) -> ONE simple-connect -> bearer IPv4 on wwanN + /32 routes only (no default route).
+#   disconnect: simple-disconnect, our routes, flush+down all wwan*, wait BAM-DMUX suspended. MSS, rmtfs, MM and radio stay up; 'start' reconnects.
+#   stop:       disconnect -> stop MM (+qmi-proxy) -> BAM-DMUX suspended -> SIGTERM rmtfs (rmtfs writes 'stop' -> MSS offline) -> rmtfs exits last.
+# Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; refuses to start unless modemst1/2, fsc, fsg, persist, mmcblk0 are getro=1 and /firmware is ro.
+# Does not need a valid wall clock (all timing from /proc/uptime). No automatic MSS/rmtfs retry.
+# B7C: time bootstrap. At fixed points of start (QMI_READY, SIM_READY, RADIO_ONLINE, each REG transition, REGISTERED, BEARER_CONNECTED) logs QMI DMS
+#   + 3GPP NITZ. The first valid DMS (>= 2026, >= image build, plausible, |DMS-NITZ| < 2 s; NITZ required unless TIME_REQUIRE_NITZ=0) steps
+#   CLOCK_REALTIME once with date -s (never backwards, never RTC). After START OK, a background SNTP check (VNIIFTRI, query only) logs the residual
+#   and steps only if |offset| >= TIME_NTP_STEP s. No slew/discipline: STA_UNSYNC stays set, so the kernel RTC_SYSTOHC 11-min RTC write never engages.
+# Exit: 0 ok, 1 failure/timeout (start rolls back with a full stop unless MODEM_KEEP_ON_FAIL=1), 2 usage/config error.
+
+CONF=${MODEM_CONF:-/etc/aurora/modem.conf}
+D=/run/aurora-modem; mkdir -p $D
+LOG=$D/lifecycle.log; STATE=$D/state; ROUTES=$D/routes; BEARER=$D/bearer
+RPNAME=4080000.remoteproc
+BAM=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
+Q="qmicli -p -d /dev/wwan0qmi0"
+
+# --- timeouts (s); override in $CONF
+T_RMTFS=5 T_MSS=60 T_QMI_DEV=30 T_QMI=45 T_SIM=60 T_ONLINE=30 T_REG=180 T_MM_DETECT=150 T_MM_REG=60 T_CONNECT=150
+T_DISCONNECT=60 T_DISABLE=30 T_MM_EXIT=30 T_BAM_IDLE=15 T_MSS_STOP=30 T_RMTFS_EXIT=15
+APN= USER= PASSWORD= AUTH= IP_TYPE=ipv4 REG_TIMEOUT=600 ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
+TIME_BOOTSTRAP=1 TIME_REQUIRE_NITZ=1 TIME_MAX_DMS_NITZ=2 TIME_NTP="ntp1.vniiftri.ru ntp2.vniiftri.ru ntp3.vniiftri.ru" TIME_NTP_STEP=1
+[ -f "$CONF" ] && . "$CONF"
+MODEM_APN=$APN MODEM_USER=$USER MODEM_PASSWORD=$PASSWORD MODEM_AUTH=$AUTH MODEM_IP_TYPE=${IP_TYPE:-ipv4} MODEM_TEST_ROUTES=$ROUTES T_REG=${REG_TIMEOUT:-600}
+MODEM_KEEP_ON_FAIL=${MODEM_KEEP_ON_FAIL:-$KEEP}
+
+mmc() { mmcli "$@" 2>/dev/null | tr -d '\033' | sed 's/\[[0-9;]*m//g'; }	# mmcli colours values even without a tty
+now() { cut -d' ' -f1 /proc/uptime; }
+log() { m="[$(now)] $*"; echo "$m" >> $LOG; echo "$m"; echo "<5>[aurora-modem] $*" > /dev/kmsg 2>/dev/null; }
+setstate() { o=$(cat $STATE 2>/dev/null); echo "$1" > $STATE; log "STATE ${o:-OFF} -> $1"; }
+die() { log "FAIL: $*"; exit 1; }
+# wait_for TIMEOUT INTERVAL cmd... : poll a real condition, no blind sleeps
+wait_for() { _to=$1; _iv=$2; shift 2; _t0=$(now)
+	while :; do "$@" && return 0
+		[ "$(awk -v a="$(now)" -v b="$_t0" -v t="$_to" 'BEGIN{print (a-b>=t)}')" = 1 ] && return 1
+		sleep $_iv; done; }
+since() { awk -v a="$(now)" -v b="$1" 'BEGIN{printf "%.1f", a-b}'; }
+
+rp() { for r in /sys/class/remoteproc/remoteproc*; do [ "$(cat $r/name 2>/dev/null)" = $RPNAME ] && echo $r && return; done; }
+mss_state() { r=$(rp); [ -n "$r" ] && cat $r/state || echo none; }
+mss_is() { [ "$(mss_state)" = "$1" ]; }
+rmtfs_pid() { pidof rmtfs; }
+mm_pid() { pidof ModemManager; }
+bam_pm() { cat $BAM/power/runtime_status 2>/dev/null || echo none; }
+bam_suspended() { [ "$(bam_pm)" = suspended ]; }
+qmi_dev() { [ -e /dev/wwan0qmi0 ] && [ -e /sys/class/net/wwan0 ]; }
+link_up() { [ $(( $(cat /sys/class/net/$1/flags) & 1 )) -ne 0 ]; }
+mm_idx() { mmc -L | grep -oE "Modem/[0-9]+" | head -1 | cut -d/ -f2; }
+mm_has_modem() { [ -n "$(mm_idx)" ]; }
+mm_state() { mmc -m "$(mm_idx)" | awk -F': ' '/\| +state: /{gsub(/ /,"",$2); print $2; exit}'; }
+# MM initialized: proven session 22 pass 1 connected from 'disabled' (Simple.Connect enables the modem itself)
+mm_usable() { case "$(mm_state)" in disabled|enabling|enabled|searching|registered|connected|connecting) return 0;; esac; return 1; }
+qmi_ok() { timeout 20 $Q --dms-get-operating-mode > $D/qmi-mode.txt 2>&1 && grep -q "Mode:" $D/qmi-mode.txt; }
+qmi_reg() { timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
+	grep -q "Registration state: 'registered'" $D/qmi-ss.txt && grep -q "PS: 'attached'" $D/qmi-ss.txt; }
+sim_ready() { timeout 20 $Q --uim-get-card-status > $D/qmi-uim.txt 2>&1
+	grep -q "Card state: 'present'" $D/qmi-uim.txt && grep -q "Application state: 'ready'" $D/qmi-uim.txt; }
+set_online() { timeout 20 $Q --dms-set-operating-mode=online > $D/qmi-set.txt 2>&1; r=$?; cat $D/qmi-set.txt >> $LOG
+	[ $r = 0 ] && return 0; grep -q "DeviceNotReady" $D/qmi-set.txt || { echo hard > $D/qmi-set.err; return 0; }; return 1; }
+# this mmcli has no --list-bearers ("no actions specified"); use 'Bearer | paths:' of mmcli -m, not the initial (attach) bearer
+bearers() { mmc -m "$(mm_idx)" | grep -v "initial bearer" | grep -oE "Bearer/[0-9]+" | cut -d/ -f2; }
+any_bearer_connected() { for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && return 0; done; return 1; }
+qv() { grep -m1 -oE "$1: *'[^']*'" $2 2>/dev/null | sed -E "s/.*'([^']*)'/\1/"; }
+# B6M registration state machine. rc 0 = registered+PS attached, 1 = REGISTRATION_TIMEOUT, 2 = local failure (reason in $D/reg-fail)
+reg_sm() {
+	T=$D/reg-trans.tsv; t0=$1; last=; n=0; nd=0; rm -f $D/reg-fail; D0=$(dmesg | wc -l)
+	printf 'uptime	t_online	reg	ps	status	true_status	domain	plmn	earfcn	pci	si_tac	si_eci	cl_tac	cl_eci	rsrp	rsrq	snr
+' > $T
+	lf() { echo "$*" > $D/reg-fail; return 2; }
+	while :; do n=$((n+1))
+		mss_is running || { lf "MSS state $(mss_state)"; return 2; }
+		[ -e /dev/wwan0qmi0 ] || { lf "wwan0qmi0 disappeared"; return 2; }
+		[ -n "$(rmtfs_pid)" ] || { lf "rmtfs died"; return 2; }
+		[ "$(bam_pm)" = error ] && { lf "BAM-DMUX runtime_status=error"; return 2; }
+		dmesg | tail -n +$((D0+1)) | grep -qE 'crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|Failed to resume' && { lf "dmesg: $(dmesg | tail -n +$((D0+1)) | grep -m1 -E 'crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|Failed to resume')"; return 2; }
+		if [ $((n % 5)) = 1 ]; then
+			sim_ready || { lf "SIM not ready: $(grep -E 'Card state|Application state' $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' ')"; return 2; }
+			ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 || { sleep 1; ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 || { lf "USB management (usb0 ping) lost"; return 2; }; }
+		fi
+		timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
+		timeout 20 $Q --nas-get-system-info > $D/qmi-si-all.txt 2>&1; sed -n '/LTE service:/,/SIM reject/p' $D/qmi-si-all.txt > $D/qmi-si.txt
+		RG=$(qv 'Registration state' $D/qmi-ss.txt); PS=$(qv PS $D/qmi-ss.txt); ST=$(qv Status $D/qmi-si.txt); TS=$(qv 'True Status' $D/qmi-si.txt)
+		DM=$(qv Domain $D/qmi-si.txt); PL=$(qv MCC $D/qmi-si.txt)-$(qv MNC $D/qmi-si.txt); SIT=$(qv 'Tracking Area Code' $D/qmi-si.txt); SIE=$(qv 'Cell ID' $D/qmi-si.txt)
+		key="$RG|$PS|$ST|$TS|$DM|$PL|$SIT|$SIE"
+		if [ "$key" != "$last" ]; then
+			timeout 20 $Q --nas-get-cell-location-info > $D/qmi-cl.txt 2>&1; timeout 20 $Q --nas-get-signal-info > $D/qmi-sig.txt 2>&1
+			[ "$RG" = registration-denied ] && [ "${last%%|*}" != registration-denied ] && nd=$((nd+1))
+			printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $(now) $(since $t0) "$RG" "$PS" "$ST" "$TS" "$DM" "$PL" \
+				"$(qv 'EUTRA Absolute RF Channel Number' $D/qmi-cl.txt)" "$(qv 'Serving Cell ID' $D/qmi-cl.txt)" "$SIT" "$SIE" \
+				"$(qv 'Tracking Area Code' $D/qmi-cl.txt)" "$(qv 'Global Cell ID' $D/qmi-cl.txt)" "$(qv RSRP $D/qmi-sig.txt)" "$(qv RSRQ $D/qmi-sig.txt)" "$(qv SNR $D/qmi-sig.txt)" >> $T
+			log "REG t+$(since $t0)s: $RG / PS $PS / $ST ($TS, $DM) $PL pci=$(qv 'Serving Cell ID' $D/qmi-cl.txt) si=$SIT/$SIE cl=$(qv 'Tracking Area Code' $D/qmi-cl.txt)/$(qv 'Global Cell ID' $D/qmi-cl.txt)"
+			last=$key; tprobe "REG:$RG/$PS"
+		fi
+		echo $nd > $D/reg-denied-count
+		[ "$RG" = registered ] && [ "$PS" = attached ] && return 0
+		[ "$(awk -v a="$(now)" -v b="$t0" -v t="$T_REG" 'BEGIN{print (a-b>=t)}')" = 1 ] && { lf "REGISTRATION_TIMEOUT after ${T_REG}s ($RG, PS $PS)"; return 1; }
+		sleep 3
+	done
+}
+bearer_field() { awk -F': ' -v k="$1" '$1 ~ " "k"$" {gsub(/ /,"",$2); print $2; exit}' $BEARER.txt; }
+
+# --- B7C time bootstrap. Variables are _t-prefixed: tprobe runs inside reg_sm (n, T, last, t0 belong to it).
+NTPBB=/usr/libexec/aurora/busybox; GPS_EPOCH=315964800; Y2026=1767225600
+time_floor() { _tf=$(cat /etc/aurora/build-epoch 2>/dev/null); case "$_tf" in ''|*[!0-9]*) _tf=$Y2026;; esac; [ $_tf -lt $Y2026 ] && _tf=$Y2026; echo $_tf; }
+# tprobe PHASE: read DMS + NITZ (raw kept in $D/time-probe-N.*), validate, log; first VALID sample while the clock is still pre-build -> tset
+tprobe() {
+	[ "$TIME_BOOTSTRAP" = 1 ] || return 0
+	_tn=$(( $(cat $D/time-probes 2>/dev/null || echo 0) + 1 )); echo $_tn > $D/time-probes; _tp=$D/time-probe-$_tn
+	_u0=$(now); timeout 5 $Q --dms-get-time > $_tp.dms 2>&1; _u1=$(now); timeout 5 $Q --nas-get-network-time > $_tp.nitz 2>&1; _u2=$(now)
+	_ms=$(sed -n "s/.*System time: '\([0-9]*\).*/\1/p" $_tp.dms); _nd=$(qv '3GPP Date' $_tp.nitz); _nt=$(qv '3GPP Time' $_tp.nitz)
+	_ne=; [ -n "$_nd" ] && [ -n "$_nt" ] && _ne=$(date -u -d "$_nd $_nt" +%s 2>/dev/null); _clk=$(date -u +%s)
+	# -> "VERDICT dms_utc dms_uptime dms-nitz reason"; dms-nitz compares DMS projected to the NITZ read instant with whole-second NITZ
+	_v=$(awk -v ms="$_ms" -v g=$GPS_EPOCH -v u0=$_u0 -v u1=$_u1 -v u2=$_u2 -v ne="$_ne" -v fl=$(time_floor) -v y=$Y2026 -v rn=$TIME_REQUIRE_NITZ -v mx=$TIME_MAX_DMS_NITZ 'BEGIN{
+		if (ms !~ /^[0-9]+$/) { print "INVALID - - - dms-unreadable"; exit }
+		dms=ms/1000+g; at=(u0+u1)/2; r="ok"; d="-"
+		if (dms < y) r="year<2026"; else if (dms < fl) r="before-build"; else if (dms > fl+5*365*86400) r="implausible"
+		if (ne ~ /^[0-9]+$/) { dd=dms+((u1+u2)/2-at)-ne; d=sprintf("%+.2f", dd); if (r=="ok" && (dd<-mx || dd>mx)) r="dms-nitz-mismatch" }
+		else if (r=="ok" && rn==1) r="no-nitz"
+		printf "%s %.3f %.2f %s %s\n", (r=="ok" ? "VALID" : "INVALID"), dms, at, d, r }')
+	set -- "$1" $_v
+	printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $_tn "$1" $_u0 "${_ms:--}" "$3" "${_nd:--}T${_nt:--}" "$5" $_clk "$2/$6" >> $D/time.tsv
+	log "TIME probe $_tn [$1]: dms_ms=${_ms:-none} dms_utc=$3 nitz=${_nd:-none} ${_nt} dms-nitz=$5 clock=$_clk -> $2 ($6)"
+	[ "$2" = VALID ] && [ ! -f $D/time-set ] && [ $_clk -lt $(time_floor) ] && tset "$1" $3 $4 $5
+	return 0; }
+# tset PHASE DMS_UTC DMS_UPTIME DIFF: step CLOCK_REALTIME once, landing on a whole UTC second (uptime-based wait, no fixed bias correction)
+tset() {
+	_N=$(awk -v d=$2 -v a=$3 -v u=$(now) 'BEGIN{printf "%d", int(d+(u-a))+1}')
+	_w=$(awk -v N=$_N -v d=$2 -v a=$3 -v u=$(now) 'BEGIN{w=N-(d+(u-a)); printf "%.3f", (w>0 ? w : 0)}')
+	sleep $_w; _old=$(date -u +%s); [ $_N -gt $_old ] || { log "TIME SET skipped: target $_N not after clock $_old (never backwards)"; return 0; }
+	date -u -s @$_N > /dev/null 2>&1; _rc=$?
+	[ $_rc = 0 ] && echo "$_N $(now) $1 qmi-dms" > $D/time-set
+	log "TIME SET rc=$_rc source=qmi-dms phase=$1 old=$_old ($(date -u -d @$_old '+%F %T')) new=$_N ($(date -u '+%F %T')) uptime=$(now) dms-nitz=$4 validation=VALID rtc=untouched"; }
+# after START OK, background: resolve VNIIFTRI via bearer DNS, /32 routes via addroute (removed by stop/disconnect), ntpd -w (query only)
+time_sntp() {
+	[ "$TIME_BOOTSTRAP" = 1 ] && [ -x $NTPBB ] && [ -n "$TIME_NTP" ] || { log "SNTP: skipped (bootstrap=$TIME_BOOTSTRAP bin=$([ -x $NTPBB ] && echo yes || echo no))"; return 0; }
+	. $D/ipcfg 2>/dev/null || return 0; _dns=${DNS%%,*}; _ips=
+	for _h in $TIME_NTP; do _ip=$(nslookup $_h $_dns 2>/dev/null | awk '/^Name:/{f=1} f && /^Address/{print $2; exit}')
+		case "$_ip" in [0-9]*.[0-9]*.[0-9]*.[0-9]*) addroute $_ip && _ips="$_ips $_ip";; *) log "SNTP: $_h not resolved via $_dns";; esac; done
+	[ -n "$_ips" ] || return 0
+	_a=; for _ip in $_ips; do _a="$_a -p $_ip"; done
+	timeout 15 $NTPBB ntpd -w -d $_a > $D/sntp.txt 2>&1
+	_b=$(awk '/reply from/{o="";d=""; for(i=1;i<=NF;i++){ if($i~/^offset:/) o=substr($i,8); if($i~/^delay:/) d=substr($i,7) } if(o!="" && (bd=="" || d+0<bd+0)){b=o; bd=d; s=$4}}
+		END{ if (b!="") print b, bd, s }' $D/sntp.txt)
+	log "SNTP check ($_ips): $(grep -c 'reply from' $D/sntp.txt) replies; best offset delay server: ${_b:-none} (offset > 0 = clock behind)"
+	[ -n "$_b" ] || return 0
+	if [ "$(awk -v o=${_b%% *} -v s=$TIME_NTP_STEP 'BEGIN{print (o>=s || o<=-s)}')" = 1 ]; then
+		_old=$(date -u +%s); _N=$(awk -v c=$_old -v o=${_b%% *} 'BEGIN{printf "%d", c+o+0.5}'); date -u -s @$_N > /dev/null 2>&1
+		log "SNTP STEP rc=$? old=$_old new=$_N (|offset| >= ${TIME_NTP_STEP}s) rtc=untouched"
+	else log "SNTP: |offset| < ${TIME_NTP_STEP}s - clock kept (no slew: STA_UNSYNC stays, RTC_SYSTOHC never engages)"; fi; }
+
+check_safety() {
+	for p in modemst1 modemst2 fsc fsg persist; do
+		d=/dev/disk/by-partlabel/$p; [ -e $d ] || return 1
+		[ "$(blockdev --getro $(readlink -f $d))" = 1 ] || { log "SAFETY: $p not RO"; return 1; }
+	done
+	[ "$(blockdev --getro /dev/mmcblk0)" = 1 ] || { log "SAFETY: mmcblk0 not RO"; return 1; }
+	grep -q " /firmware .* ro," /proc/mounts || { log "SAFETY: /firmware not mounted ro"; return 1; }
+	[ "$(cat /sys/module/firmware_class/parameters/path)" = /firmware/image ] || { log "SAFETY: firmware path"; return 1; }
+	return 0
+}
+connect_args() {
+	for v in "$MODEM_APN" "$MODEM_USER" "$MODEM_PASSWORD" "$MODEM_AUTH" "$MODEM_IP_TYPE"; do
+		case "$v" in *[,\"\'=]*) echo "BAD"; return;; esac; done
+	a="apn=$MODEM_APN"
+	[ -n "$MODEM_USER" ] && a="$a,user=$MODEM_USER"
+	[ -n "$MODEM_PASSWORD" ] && a="$a,password=$MODEM_PASSWORD"
+	[ -n "$MODEM_AUTH" ] && a="$a,allowed-auth=$MODEM_AUTH"
+	echo "$a,ip-type=$MODEM_IP_TYPE"
+}
+addroute() { # /32 via the bearer interface, recorded so stop removes exactly what we added
+	ip=$1; . $D/ipcfg 2>/dev/null || { echo "no bearer ipcfg"; return 1; }
+	grep -qx "$ip" $ROUTES 2>/dev/null && return 0
+	ip route add $ip/32 dev $IF src $A && echo $ip >> $ROUTES
+}
+diag() { # snapshot before rollback
+	{ echo "### diag $(now) state=$(cat $STATE 2>/dev/null) mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm)"
+	  [ -n "$(mm_pid)" ] && { mmc -L; mmc -m "$(mm_idx)"; }
+	  cat $D/qmi-mode.txt $D/qmi-ss.txt 2>/dev/null; dmesg | tail -40; } > $D/diag-$(now).txt 2>&1
+}
+fail_start() { log "FAIL in $(cat $STATE 2>/dev/null): $*"; diag
+	if [ "$MODEM_KEEP_ON_FAIL" = 1 ]; then log "MODEM_KEEP_ON_FAIL=1: leaving stack as is"
+	else log "rollback: full stop"; do_stop; fi
+	exit 1; }
+
+do_start() {
+	T0=$(now); log "=== START (conf $CONF, apn '${MODEM_APN}', ip-type $MODEM_IP_TYPE)"
+	[ -n "$MODEM_APN" ] || { log "config: MODEM_APN empty - refusing (no APN guessing)"; exit 2; }
+	CA=$(connect_args); [ "$CA" = BAD ] && { log "config: forbidden character in APN/user/password/auth"; exit 2; }
+	check_safety || { log "FAIL: safety gate (RO) - nothing started"; exit 1; }
+	[ -n "$(rp)" ] || { log "FAIL: remoteproc $RPNAME not found"; exit 1; }
+
+	# OFF -> RMTFS_READY -> MPSS_BOOTING -> MPSS_RUNNING
+	if [ -n "$(rmtfs_pid)" ] && mss_is running; then log "rmtfs $(rmtfs_pid) + MSS running already - reuse"
+	elif [ -n "$(rmtfs_pid)" ] || ! mss_is offline; then
+		log "FAIL: inconsistent (rmtfs='$(rmtfs_pid)' MSS=$(mss_state)); run stop first"; exit 1
+	else
+		: > $ROUTES; rm -f $D/ipcfg
+		n0=$(grep -c 'registering services' $D/rmtfs.log 2>/dev/null)
+		LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -s -v >> $D/rmtfs.log 2>&1 &
+		echo $! > $D/rmtfs.pid
+		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && [ \$(grep -c 'registering services' $D/rmtfs.log) -gt ${n0:-0} ]" \
+			|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
+		setstate RMTFS_READY
+		setstate MPSS_BOOTING
+		t=$(now); wait_for $T_MSS 0.2 mss_is running || fail_start "MSS not running after ${T_MSS}s (state $(mss_state))"
+		log "MSS running after $(since $t)s"
+	fi
+	setstate MPSS_RUNNING
+
+	# -> QMI_READY
+	t=$(now); wait_for $T_QMI_DEV 0.2 qmi_dev || fail_start "wwan0qmi0/wwan0 missing after ${T_QMI_DEV}s"
+	log "wwan0qmi0 + wwan0 present after $(since $t)s; +2 s (JZ02 rpmsg_wwan_ctrl port-race guard, proven start_post)"
+	sleep 2
+	[ "$(bam_pm)" = error ] && fail_start "BAM-DMUX runtime_status=error"
+
+	# -> RADIO_ONLINE -> REGISTERED  (Aurora-proven: qmicli online + NAS poll before ModemManager)
+	if [ -n "$(mm_pid)" ]; then
+		log "ModemManager already running - skip qmicli, use MM state"
+		setstate QMI_READY
+	else
+		t=$(now); wait_for $T_QMI 1 qmi_ok || fail_start "QMI DMS not answering after ${T_QMI}s"
+		setstate QMI_READY; log "DMS $(grep -o "Mode: '[^']*'" $D/qmi-mode.txt) after $(since $t)s"; tprobe QMI_READY
+		t=$(now); wait_for $T_SIM 1 sim_ready || fail_start "SIM/USIM not ready after ${T_SIM}s ($(grep -E "Card state|Application state" $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' '))"
+		setstate SIM_READY; log "UIM card present, USIM app ready after $(since $t)s"; tprobe SIM_READY
+		if ! grep -q "Mode: 'online'" $D/qmi-mode.txt; then
+			log "SET: $Q --dms-set-operating-mode=online (retried only on DeviceNotReady, <= ${T_ONLINE}s)"
+			rm -f $D/qmi-set.err; t=$(now); wait_for $T_ONLINE 1 set_online || fail_start "SET online: DeviceNotReady for ${T_ONLINE}s"
+			[ -f $D/qmi-set.err ] && fail_start "SET online failed: $(grep -i error $D/qmi-set.txt | head -1)"
+			qmi_ok && grep -q "Mode: 'online'" $D/qmi-mode.txt || fail_start "mode not online after SET"
+			log "DMS online after $(since $t)s"
+		fi
+		setstate RADIO_ONLINE; tprobe RADIO_ONLINE
+		t=$(now); reg_sm $t; rr=$?
+		[ $rr = 2 ] && fail_start "LOCAL FAILURE during registration: $(cat $D/reg-fail)"
+		[ $rr = 1 ] && fail_start "$(cat $D/reg-fail)"
+
+		log "registered: $(grep -oE "(MCC|MNC|Description): '[^']*'" $D/qmi-ss.txt | tr '\n' ' ')after $(since $t)s"
+		setstate REGISTERED; tprobe REGISTERED
+		killall qmi-proxy 2>/dev/null; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'
+	fi
+
+	# -> MM_READY  (mm-up order: udevd, trigger, settle, dbus, polkitd, ModemManager)
+	pidof udevd >/dev/null || { udevd --daemon; udevadm trigger --action=add; udevadm settle --timeout=15; log "udevd started"; }
+	if ! pidof dbus-daemon >/dev/null; then
+		mkdir -p /run/dbus /var/lib/dbus /var/lib/polkit; rm -f /run/dbus/pid; dbus-uuidgen --ensure
+		dbus-daemon --system --fork || fail_start "dbus-daemon"; log "dbus started"; fi
+	pidof polkitd >/dev/null || { /usr/lib/polkit-1/polkitd --no-debug >> $D/polkitd.log 2>&1 & log "polkitd started"; }
+	if [ -z "$(mm_pid)" ]; then
+		N=$(ls $D/mm-*.log 2>/dev/null | wc -l)
+		ModemManager --debug > $D/mm-$N.log 2>&1 &
+		echo $! > $D/mm.pid; log "ModemManager started pid $! (log mm-$N.log)"
+	fi
+	t=$(now); wait_for $T_MM_DETECT 2 mm_has_modem || fail_start "MM: no modem after ${T_MM_DETECT}s"
+	log "MM modem $(mm_idx) detected after $(since $t)s"
+	mmc -m "$(mm_idx)" > $D/mm-modem.txt
+	grep -q "plugin: qcom-soc" $D/mm-modem.txt || fail_start "MM plugin is not qcom-soc"
+	grep -q "primary port: wwan0qmi0" $D/mm-modem.txt || fail_start "MM primary port is not wwan0qmi0"
+	setstate MM_READY
+	t=$(now); wait_for $T_MM_REG 2 mm_usable || fail_start "MM state '$(mm_state)' not usable after ${T_MM_REG}s"
+	log "MM state $(mm_state) after $(since $t)s"
+
+	# -> BEARER_CONNECTED  (exactly one simple-connect)
+	if any_bearer_connected; then log "bearer already connected - reuse"
+	else
+		log "mmcli -m $(mm_idx) --simple-connect=\"$(echo "$CA" | sed 's/password=[^,]*/password=***/')\""
+		timeout $T_CONNECT mmcli -m "$(mm_idx)" --simple-connect="$CA" >> $LOG 2>&1 || fail_start "simple-connect failed/timeout"
+	fi
+	BR=; for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && BR=$b; done
+	[ -n "$BR" ] || fail_start "no connected bearer after simple-connect"
+	mmc -m "$(mm_idx)" > $D/mm-modem.txt
+	grep -qE "registration: (home|roaming)" $D/mm-modem.txt || fail_start "MM registration not home/roaming after connect"
+	log "MM state $(mm_state), $(grep -oE "registration: [a-z]+" $D/mm-modem.txt)"
+	mmc -b $BR > $BEARER.txt
+	IF=$(bearer_field interface); A=$(bearer_field address); PF=$(bearer_field prefix); GW=$(bearer_field gateway)
+	DNS=$(bearer_field dns); MTU=$(bearer_field mtu)
+	echo "$IF" | grep -qE '^wwan[0-7]$' && [ -n "$A" ] && [ -n "$PF" ] || fail_start "bearer $BR bad ipv4 config IF=$IF A=$A PF=$PF"
+	printf 'BR=%s\nIF=%s\nA=%s\nPF=%s\nGW=%s\nDNS=%s\nMTU=%s\n' "$BR" "$IF" "$A" "$PF" "$GW" "$DNS" "$MTU" > $D/ipcfg
+	log "bearer $BR: $IF $A/$PF gw $GW dns $DNS mtu $MTU"
+	ip addr flush dev $IF; ip addr add $A/$PF dev $IF || fail_start "ip addr add"
+	[ -n "$MTU" ] && ip link set $IF mtu $MTU
+	ip link set $IF up || fail_start "ip link set $IF up (bam-dmux runtime PM?)"
+	link_up $IF || fail_start "$IF not UP"
+	for h in $(echo "$DNS" | tr ',' ' ') $MODEM_TEST_ROUTES; do addroute $h || fail_start "route $h"; done
+	ip route get 172.16.42.2 2>&1 | grep -q "dev usb0" || fail_start "management route no longer via usb0"
+	ip route | grep -q "^default" && log "WARNING: a default route exists (not created by us)"
+	setstate BEARER_CONNECTED
+	log "=== START OK in $(since $T0)s ($IF $A/$PF, routes: $(tr '\n' ' ' < $ROUTES))"
+	tprobe BEARER_CONNECTED; ( time_sntp ) &
+}
+
+do_stop() {
+	T0=$(now); log "=== STOP (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"
+	rc=0
+	# 1. disconnect bearer(s)
+	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+		timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+		wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "WARNING: bearer still connected"; rc=1; }
+	fi
+	# 2. our /32 routes, 3. flush + DOWN every wwan*
+	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
+		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
+	rm -f $D/ipcfg
+	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
+	log "wwan links down, addresses/routes removed"
+	[ -n "$(cat $STATE 2>/dev/null)" ] && setstate WWAN_DOWN
+	# 4. stop ModemManager (+ its qmi-proxy)
+	if [ -n "$(mm_pid)" ]; then
+		kill -TERM $(mm_pid); wait_for $T_MM_EXIT 0.5 sh -c '! pidof ModemManager >/dev/null' \
+			|| { log "MM did not exit in ${T_MM_EXIT}s - SIGKILL"; kill -KILL $(mm_pid) 2>/dev/null; rc=1; }
+		log "ModemManager stopped"
+	fi
+	pidof qmi-proxy >/dev/null && { killall qmi-proxy; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'; log "qmi-proxy stopped"; }
+	setstate MM_STOPPED
+	# 5. BAM-DMUX idle
+	if [ -e $BAM ] && ! mss_is offline; then
+		t=$(now); if wait_for $T_BAM_IDLE 0.5 bam_suspended; then log "BAM-DMUX suspended after $(since $t)s"
+		else log "ERROR: BAM-DMUX '$(bam_pm)' not suspended after ${T_BAM_IDLE}s - NOT stopping MSS"; exit 1; fi
+	fi
+	# 6. MSS stop via rmtfs -s (SIGTERM -> pwrite "stop" to remoteproc state -> exit), 7. rmtfs exits last
+	P=$(rmtfs_pid)
+	if [ -n "$P" ]; then
+		t=$(now); kill -TERM $P; log "SIGTERM rmtfs $P (rmtfs stops MSS, then exits)"
+		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $(kill -0 $P 2>/dev/null && echo yes || echo no))" \
+			|| { log "ERROR: MSS '$(mss_state)' after ${T_MSS_STOP}s"; rc=1; }
+		setstate MPSS_STOPPED
+		wait_for $T_RMTFS_EXIT 0.2 sh -c "! kill -0 $P 2>/dev/null" && log "rmtfs exited after $(since $t)s" \
+			|| { log "rmtfs still alive - second SIGTERM"; kill -TERM $P; wait_for 5 0.2 sh -c "! kill -0 $P 2>/dev/null" || { kill -KILL $P; rc=1; }; }
+	elif ! mss_is offline && [ -n "$(rp)" ]; then
+		log "MSS $(mss_state) without rmtfs - echo stop > state"; echo stop > $(rp)/state
+		wait_for $T_MSS_STOP 0.2 mss_is offline || rc=1
+	fi
+	mss_is offline || mss_is none || { log "ERROR: MSS state $(mss_state)"; rc=1; }
+	setstate OFF
+	log "=== STOP done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' bam=$(bam_pm))"
+	return $rc
+}
+
+do_disconnect() { # B6N: bearer down only; MSS, rmtfs, MM (and DMS radio) stay up. Next 'start' reuses them and only simple-connects.
+	T0=$(now); log "=== DISCONNECT (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"; rc=0
+	[ -n "$(mm_pid)" ] && mm_has_modem || { log "DISCONNECT: no MM modem"; return 1; }
+	timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+	wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "ERROR: bearer still connected"; rc=1; }
+	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
+		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
+	rm -f $D/ipcfg
+	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
+	t=$(now); wait_for $T_BAM_IDLE 0.5 bam_suspended && log "BAM-DMUX suspended after $(since $t)s" || { log "ERROR: BAM-DMUX '$(bam_pm)' not suspended"; rc=1; }
+	setstate MM_IDLE
+	log "=== DISCONNECT done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' mm_state=$(mm_state) bam=$(bam_pm))"
+	return $rc
+}
+
+do_status() {
+	r=$(rp)
+	echo "controller: $(cat $STATE 2>/dev/null || echo OFF)"
+	echo "remoteproc: $RPNAME $(mss_state) ($r) fw=$(cat $r/firmware 2>/dev/null)"
+	echo "rmtfs:      pid='$(rmtfs_pid)' writes_logged=$(grep -c 'write ' $D/rmtfs.log 2>/dev/null)"
+	echo "qmi dev:    $(ls /dev/wwan0qmi0 2>/dev/null || echo absent)  qmi-proxy='$(pidof qmi-proxy)'"
+	echo "daemons:    udevd='$(pidof udevd)' dbus='$(pidof dbus-daemon)' polkitd='$(pidof polkitd)' ModemManager='$(mm_pid)'"
+	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+		mmc -m "$(mm_idx)" | grep -E "\| +(state|power state|registration|operator name|access tech|signal quality|plugin|primary port): " \
+			| sed -E 's/^[^|]*\| */  mm /'
+		for b in $(bearers); do echo "  bearer $b: $(mmc -b $b | grep -E 'connected:|interface:|address:' | tr -s ' |' ' ' | tr '\n' ';')"; done
+	else echo "  mm: n/a"; fi
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		link_up $w && echo "wwan:       $w UP $(ip -4 addr show $w | awk '/inet /{print $2}')"; done
+	echo "wwan up:    $(n=0; for d in /sys/class/net/wwan*; do [ -e $d ] && link_up ${d##*/} && n=$((n+1)); done; echo $n) of $(ls -d /sys/class/net/wwan* 2>/dev/null | wc -l)"
+	echo "routes:     $(ip route | grep ' dev wwan' | tr '\n' ';')"
+	echo "bam-dmux:   $(bam_pm) active_ms=$(cat $BAM/power/runtime_active_time 2>/dev/null) suspended_ms=$(cat $BAM/power/runtime_suspended_time 2>/dev/null) control=$(cat $BAM/power/control 2>/dev/null)"
+	echo "usb0:       $(ip -4 addr show usb0 | awk '/inet /{print $2}') route-to-host: $(ip route get 172.16.42.2 2>&1 | head -1)"
+	echo "emmc:       $(awk '{print "writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat)"
+	echo "time:       $(date -u '+%F %T') UTC; set: $(cat $D/time-set 2>/dev/null || echo no); probes: $(cat $D/time-probes 2>/dev/null || echo 0)"
+	echo "dmesg-errs: $(dmesg | grep -cE 'Failed to resume|Resource temporarily|crash detected|fatal error|[Ww]atchdog|Oops|Kernel panic|Unable to handle')"
+}
+
+case "$1" in
+	start) do_start;;
+	stop) do_stop; exit $?;;
+	disconnect) do_disconnect; exit $?;;
+	status) do_status;;
+	addroute) [ -n "$2" ] || exit 2; addroute "$2";;
+	_anyconn) any_bearer_connected;;
+	_mmstate) mm_state;;
+	*) echo "usage: $0 start|stop|status|addroute <ipv4>"; exit 2;;
+esac
--- a/logs/b7/b7a/B7A-RESULT.md
+++ b/logs/b7/b7a/B7A-RESULT.md
@ -0,0 +1,38 @@
+# B7A — QMI time vs VNIIFTRI NTP (measurement only): QMI DMS time is usable as a pre-IP bootstrap (error ≈ −0.28 s)
+
+2026-10-02, same boot as R3A/R3B (uptime ≈ 2290–2424 s, Beeline LTE PCI 55). Board clock was NOT changed (still 1970, adjtimex status UNSYNC, offset 0 after the test);
+no RTC write, no eMMC write (writes 0), no cache/rootfs change. Only RAM files in /tmp/b7 and three temporary /32 routes via wwan0, removed afterwards (route table back to the original).
+
+## Tools
+- ntpd: Alpine v3.22 busybox-static 1.37.0-r20 (signature-verified, sha256 a6bb1e6e…), in /tmp/b7/busybox, `ntpd -w -d` = query only. Debian busybox-static has no ntpd (b7a-provenance.txt).
+- Names via bearer DNS 10.10.22.3: ntp1/2/3.vniiftri.ru = 89.109.251.21/22/23 (stratum 1, refid "IRTF").
+- Board timestamps: busybox `adjtimex` time.tv_sec/usec (CLOCK_REALTIME, µs) taken right before and after every query; offset = value − midpoint.
+
+## Run
+6 rounds × (DMS ×3, NITZ ×2, ntp1/ntp2/ntp3 × ~4 replies each), 72 NTP replies; per round/server the min-delay reply (57–76 ms RTT).
+Board clock drift vs NTP fit: +1.70 ppm; residuals ≤ 4.7 ms. NTP servers agree with each other within ≤ 7.7 ms per round.
+
+## Results
+| | n | DMS/NITZ − NTP |
+|---|---|---|
+| **DMS System time** (`Unix = ms/1000 + 315964800`) | 18 | mean **−280.2 ms**, median −280.3, range −281.6 … −278.1, **σ 1.0 ms** |
+| **3GPP NITZ** (`--nas-get-network-time`, 1 s resolution) | 12 | −1161.6 … −359.6 ms |
+
+- Max observed deviation: **DMS 281.6 ms** behind NTP; **NITZ 1.16 s** behind NTP.
+- qmicli round trip 33–42 ms (half-window ≤ 20.9 ms), i.e. the 280 ms is not command latency: it is a constant modem-side bias (σ 1 ms over 137 s, no drift).
+- DMS formula: the GPS-epoch constant 315964800 is right and there is no 18 s GPS–UTC leap offset (that would show as ≈ +18000 ms). With the formula, DMS = UTC − 0.28 s on 18/18 samples.
+  The formula is confirmed **to within the constant −0.28 s bias**, on this boot/cell only.
+- NITZ seconds equal DMS truncated to whole seconds (NITZ − NTP lies in (−1280, −280] ms, matching floor(DMS)). It adds no information beyond DMS. Its only use is as a "network time was received" flag and as a cross-check.
+- Full table (uptime / DMS / NITZ / ntp1 / ntp2 / ntp3): b7a-analysis.txt.
+
+## Conclusion
+QMI DMS System time can be used as the time bootstrap before IP is up. It needs no USB host and no DNS, it is ready as soon as wwan0qmi0 exists, and it is ≈ 0.28 s slow.
+That is far inside what TLS certificate checks and logs need. Recommendations for B7B/B7C (not done):
+- Use DMS, cross-check it against NITZ (|DMS − NITZ| < 2 s) and a sanity floor (≥ image build date). Do not add a fixed +0.28 s correction yet, because the bias is measured on one boot/cell only.
+- Refine with SNTP to VNIIFTRI over wwan0 once the bearer is up (needs an ntpd binary in the image: busybox in rootfs lacks it).
+- Not known yet: whether DMS time is valid **before** registration/NITZ on a class-A cold boot (it might be free-running from 1980/2017). Measure that in B7B/B7C from the controller log.
+
+## Files (logs/b7/b7a/)
+b7a-provenance.txt, b7a-01-prep-raw.txt (sha, --help, nslookup), b7a-02-trial-raw.txt (routes add + trial ntpd), raw/ (log + every qmicli/ntpd raw output r1..r6),
+b7a-raw.tar (sha 16f0bac7…), measure.out, b7a-03-pack.txt, b7a-04-cleanup-raw.txt (routes del, clock untouched, bearer OK), b7a-analysis.txt.
+Scripts: b7/b7a/b7a-measure.sh, b7a-analyze.py; busybox.static + apk + apkverify.py + SHA256SUMS.
--- a/logs/b7/b7a/b7a-01-prep-raw.txt
+++ b/logs/b7/b7a/b7a-01-prep-raw.txt
@ -0,0 +1,48 @@
+
+~ # [6nsha256sum /tmp/b7/bb; chmod 755 /tmp/b7/bb; /tmp/b7/bb ntpd --help 2>&1 | he
+ad -12
+a6bb1e6e349cbdfa690a78cd0017413c5446bdae02ee003ceb682d4ae1a004ff  /tmp/b7/bb
+bb: applet not found
+~ # for n in 1 2 3; do echo "--- ntp$n"; nslookup ntp$n.vniiftri.ru 10.10.22.3; 
+done
+--- ntp1
+Server:         10.10.22.3
+Address:        10.10.22.3:53
+
+Non-authoritative answer:
+Name:   ntp1.vniiftri.ru
+Address: 89.109.251.21
+
+Non-authoritative answer:
+
+--- ntp2
+Server:         10.10.22.3
+Address:        10.10.22.3:53
+
+Non-authoritative answer:
+Name:   ntp2.vniiftri.ru
+Address: 89.109.251.22
+
+Non-authoritative answer:
+
+--- ntp3
+Server:         10.10.22.3
+Address:        10.10.22.3:53
+
+Non-authoritative answer:
+Name:   ntp3.vniiftri.ru
+Address: 89.109.251.23
+
+Non-authoritative answer:
+
+~ # date +%s.%N; /tmp/b7/bb adjtimex | grep time.tv; ip route; echo B7A1-END
+2219.%N
+bb: applet not found
+1.1.1.1 dev wwan0 scope link  src 10.41.212.24 
+10.10.22.3 dev wwan0 scope link  src 10.41.212.24 
+10.41.212.16/28 dev wwan0 scope link  src 10.41.212.24 
+77.88.8.8 dev wwan0 scope link  src 10.41.212.24 
+172.16.42.0/24 dev usb0 scope link  src 172.16.42.1 
+194.186.191.1 dev wwan0 scope link  src 10.41.212.24 
+B7A1-END
+~ # [6n
--- a/logs/b7/b7a/b7a-02-trial-raw.txt
+++ b/logs/b7/b7a/b7a-02-trial-raw.txt
@ -0,0 +1,37 @@
+
+~ # [6nmv /tmp/b7/bb /tmp/b7/busybox; B=/tmp/b7/busybox; $B ntpd --help 2>&1 | head
+ -6; $B adjtimex | grep time.tv
+BusyBox v1.37.0 (2025-11-21 22:40:56 UTC) multi-call binary.
+
+Usage: ntpd [-dnqNwl] [-I IFACE] [-S PROG] [-k KEYFILE] [-p [keyno:N:]PEER]...
+
+NTP client/server
+
+    time.tv_sec:  2240
+    time.tv_usec: 784967
+~ # for ip in 89.109.251.21 89.109.251.22 89.109.251.23; do ip route add $ip/32 
+dev wwan0 src 10.41.212.24 && echo "ROUTE-ADD $ip ok"; done; ip route | grep 89.
+109
+ROUTE-ADD 89.109.251.21 ok
+ROUTE-ADD 89.109.251.22 ok
+ROUTE-ADD 89.109.251.23 ok
+89.109.251.21 dev wwan0 scope link  src 10.41.212.24 
+89.109.251.22 dev wwan0 scope link  src 10.41.212.24 
+89.109.251.23 dev wwan0 scope link  src 10.41.212.24 
+~ # $B adjtimex | grep time.tv; timeout 15 $B ntpd -w -d -p 89.109.251.21 2>&1; 
+$B adjtimex | grep time.tv; echo B7A2-END
+    time.tv_sec:  2240
+    time.tv_usec: 820330
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.382626 delay:0.191516 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.320223 delay:0.060780 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.319707 delay:0.059867 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.324549 delay:0.067331 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
+    time.tv_sec:  2255
+    time.tv_usec: 838301
+B7A2-END
+~ # [6n
--- a/logs/b7/b7a/b7a-03-pack.txt
+++ b/logs/b7/b7a/b7a-03-pack.txt
@ -0,0 +1,4 @@
+
+~ # [6ncd /tmp/b7 && tar cf /tmp/b7/raw.tar raw measure.out && sha256sum raw.tar &&
+ nc -l -p 9934 < /tmp/b7/raw.tar &
+~ # [6n16f0bac7a619d564a1facc5d1e85d7bfad143c12592e29de511b9192f60413e7  raw.tar
--- a/logs/b7/b7a/b7a-04-cleanup-raw.txt
+++ b/logs/b7/b7a/b7a-04-cleanup-raw.txt
@ -0,0 +1,30 @@
+
+~ # [6nfor ip in 89.109.251.21 89.109.251.22 89.109.251.23; do ip route del $ip/32 
+dev wwan0 && echo "ROUTE-DEL $ip ok"; done
+ROUTE-DEL 89.109.251.21 ok
+ROUTE-DEL 89.109.251.22 ok
+ROUTE-DEL 89.109.251.23 ok
+~ # ip route; /tmp/b7/busybox adjtimex | grep -E "time.tv_sec|status|offset"; da
+te -u; cat /proc/uptime; /etc/init.d/aurora-modem status | grep -E "controller|m
+m state|bearer|dmesg-errs|emmc"
+1.1.1.1 dev wwan0 scope link  src 10.41.212.24 
+10.10.22.3 dev wwan0 scope link  src 10.41.212.24 
+10.41.212.16/28 dev wwan0 scope link  src 10.41.212.24 
+77.88.8.8 dev wwan0 scope link  src 10.41.212.24 
+172.16.42.0/24 dev usb0 scope link  src 172.16.42.1 
+194.186.191.1 dev wwan0 scope link  src 10.41.212.24 
+-o  offset:       0 us
+    status:       64 (UNSYNC)
+    time.tv_sec:  2477
+Thu Jan  1 00:41:17 UTC 1970
+2474.88 9817.73
+controller: BEARER_CONNECTED
+  mm state: connected
+  bearer 1:  Status connected: yes; interface: wwan0; address: 10.41.212.24;
+emmc:       writes_completed=0 sectors_written=0
+dmesg-errs: 0
+~ # timeout 5 ping -c2 -W2 -I wwan0 77.88.8.8 | tail -2; echo B7A4-END
+2 packets transmitted, 2 packets received, 0% packet loss
+round-trip min/avg/max = 58.756/115.745/172.735 ms
+B7A4-END
+~ # [6n
--- a/logs/b7/b7a/b7a-analysis.txt
+++ b/logs/b7/b7a/b7a-analysis.txt
@ -0,0 +1,36 @@
+NTP samples: 72 replies, best per round/server: 18; local clock drift vs NTP: +1.70 ppm
+
+Per-round NTP best offsets (s, relative to board clock) and server spread:
+round  ntp1(delay)                 ntp2(delay)                 ntp3(delay)                 spread_ms  resid_vs_fit_ms
+r1  1790931373.325233( 68.5ms)  1790931373.327086( 73.7ms)  1790931373.323854( 67.1ms)     3.23  +1.10 +2.94 -0.31
+r2  1790931373.323892( 66.0ms)  1790931373.325250( 70.6ms)  1790931373.325805( 71.2ms)     1.91  -0.29 +1.06 +1.60
+r3  1790931373.319700( 57.7ms)  1790931373.321981( 62.2ms)  1790931373.324088( 68.3ms)     4.39  -4.53 -2.26 -0.17
+r4  1790931373.321446( 60.7ms)  1790931373.325700( 69.0ms)  1790931373.321714( 63.6ms)     4.25  -2.83 +1.41 -2.59
+r5  1790931373.323808( 65.1ms)  1790931373.328886( 74.6ms)  1790931373.325714( 70.6ms)     5.08  -0.51 +4.55 +1.37
+r6  1790931373.322036( 59.4ms)  1790931373.321430( 63.0ms)  1790931373.329130( 76.0ms)     7.70  -2.33 -2.95 +4.73
+
+Table: uptime / DMS / NITZ / ntp1 / ntp2 / ntp3 (UTC at the sample's local midpoint; NTP = board clock + NTP offset at that instant)
+round uptime   DMS_UTC        NITZ_UTC   ntp1           ntp2           ntp3           DMS-NTP_ms  qmi_halfwin_ms
+r1    2287.40  09:34:23.383  09:34:22   09:34:23.664  09:34:23.666  09:34:23.663    -280.7     17.5
+r1    2287.45  09:34:23.428  09:34:22   09:34:23.707  09:34:23.709  09:34:23.706    -278.6     18.8
+r1    2287.49  09:34:23.469  09:34:22   09:34:23.751  09:34:23.752  09:34:23.749    -280.9     17.2
+r2    2314.72  09:34:50.704  09:34:49   09:34:50.982  09:34:50.984  09:34:50.984    -279.0     19.2
+r2    2314.77  09:34:50.746  09:34:49   09:34:51.026  09:34:51.028  09:34:51.028    -281.0     17.7
+r2    2314.81  09:34:50.787  09:34:49   09:34:51.068  09:34:51.069  09:34:51.070    -281.6     17.0
+r3    2342.02  09:35:18.007  09:35:17   09:35:18.280  09:35:18.282  09:35:18.284    -278.1     20.9
+r3    2342.07  09:35:18.052  09:35:17   09:35:18.327  09:35:18.329  09:35:18.331    -279.8     18.5
+r3    2342.12  09:35:18.093  09:35:17   09:35:18.369  09:35:18.371  09:35:18.374    -281.2     16.8
+r4    2369.33  09:35:45.308  09:35:44   09:35:45.584  09:35:45.588  09:35:45.584    -279.3     18.9
+r4    2369.37  09:35:45.350  09:35:44   09:35:45.627  09:35:45.631  09:35:45.627    -280.4     17.2
+r4    2369.41  09:35:45.390  09:35:44   09:35:45.668  09:35:45.672  09:35:45.668    -281.5     16.4
+r5    2396.63  09:36:12.613  09:36:11   09:36:12.891  09:36:12.896  09:36:12.893    -279.4     19.0
+r5    2396.68  09:36:12.658  09:36:11   09:36:12.937  09:36:12.942  09:36:12.939    -280.0     18.4
+r5    2396.72  09:36:12.701  09:36:11   09:36:12.980  09:36:12.986  09:36:12.982    -280.4     17.9
+r6    2423.97  09:36:39.952  09:36:39   09:36:40.229  09:36:40.228  09:36:40.236    -279.3     19.1
+r6    2424.02  09:36:39.996  09:36:39   09:36:40.273  09:36:40.273  09:36:40.280    -280.1     18.1
+r6    2424.06  09:36:40.037  09:36:39   09:36:40.316  09:36:40.315  09:36:40.323    -281.5     16.7
+
+DMS - NTP (ms): n=18 mean -280.2 median -280.3 min -281.6 max -278.1 stdev 1.0 ; max |DMS-NTP| 281.6 ms; qmicli half-window max 20.9 ms
+NITZ - NTP (ms, NITZ truncated to 1 s => expected in (-1000, 0]): n=12 min -1161.6 max -359.6
+NTP server spread (max-min of best offsets within a round): max 7.70 ms
+DMS formula check: Unix UTC = DMS_ms/1000 + 315964800 -> DMS-NTP mean above (0 = formula exact; ~ +18000 ms would mean GPS time without leap correction)
--- a/logs/b7/b7a/b7a-provenance.txt
+++ b/logs/b7/b7a/b7a-provenance.txt
@ -0,0 +1,5 @@
+busybox for B7A: Debian trixie busybox-static 1:1.37.0-6+b9 arm64 (InRelease gpgv Good, Packages sha OK, deb sha OK) has NO ntpd applet -> rejected.
+Used: Alpine v3.22 main/aarch64 busybox-static-1.37.0-r20.apk: APKINDEX signature Verified OK (key 616ae350), apk signature Verified OK,
+  control hash Q10U6+dH5XvOE6YyrB8ttqRK9soeo= == APKINDEX C:, datahash 067803d6... == actual. Binary bin/busybox.static sha256 a6bb1e6e349cbdfa690a78cd0017413c5446bdae02ee003ceb682d4ae1a004ff.
+  Applets present: ntpd (-w = query only, implies -n), adjtimex, date, nslookup, timeout. Local qemu run of ntpd printed nothing (not conclusive).
+Local reachability check (dev host, python SNTP): 89.109.251.21/22/23 stratum 1.
--- a/logs/b7/b7a/measure.out
+++ b/logs/b7/b7a/measure.out
--- a/logs/b7/b7a/raw/log
+++ b/logs/b7/b7a/raw/log
@ -0,0 +1,122 @@
+BEGIN 2290.315165 up=2287.40
+r1 DMS1 up=2287.40 t0=2290.322126 t1=2290.357091 1474968863383
+r1 DMS2 up=2287.45 t0=2290.363675 t1=2290.401365 1474968863428
+r1 DMS3 up=2287.49 t0=2290.408623 t1=2290.442989 1474968863469
+r1 NITZ1 up=2287.53 t0=2290.450299 t1=2290.492457 2026-10-02 09:34:23 tz=180
+r1 NITZ2 up=2287.59 t0=2290.506248 t1=2290.550540 2026-10-02 09:34:23 tz=180
+r1 NTP1 up=2287.65 t0=2290.567423 t1=2299.583957 89.109.251.21
+r1 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.411719 delay:0.246163 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r1 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.326073 delay:0.069712 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r1 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.325233 delay:0.068509 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r1 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.329765 delay:0.077368 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r1 NTP2 up=2296.67 t0=2299.591291 t1=2308.607918 89.109.251.22
+r1 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.327086 delay:0.073702 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r1 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.328830 delay:0.077616 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r1 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.330559 delay:0.080462 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r1 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.328758 delay:0.075912 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r1 NTP3 up=2305.70 t0=2308.615337 t1=2317.632469 89.109.251.23
+r1 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.325062 delay:0.070563 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r1 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.323854 delay:0.067130 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r1 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329894 delay:0.077937 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r1 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329257 delay:0.076282 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r2 DMS1 up=2314.72 t0=2317.639611 t1=2317.678089 1474968890704
+r2 DMS2 up=2314.77 t0=2317.685137 t1=2317.720460 1474968890746
+r2 DMS3 up=2314.81 t0=2317.727420 t1=2317.761369 1474968890787
+r2 NITZ1 up=2314.85 t0=2317.768694 t1=2317.806614 2026-10-02 09:34:50 tz=180
+r2 NITZ2 up=2314.90 t0=2317.819374 t1=2317.855438 2026-10-02 09:34:50 tz=180
+r2 NTP1 up=2314.95 t0=2317.868546 t1=2326.884480 89.109.251.21
+r2 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.325064 delay:0.068259 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r2 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.323892 delay:0.065992 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r2 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.325567 delay:0.069785 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r2 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.328997 delay:0.077833 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r2 NTP2 up=2323.97 t0=2326.891721 t1=2335.908726 89.109.251.22
+r2 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.326539 delay:0.072404 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r2 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.325250 delay:0.070587 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r2 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.329585 delay:0.077110 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r2 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.328824 delay:0.078408 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r2 NTP3 up=2333.00 t0=2335.915865 t1=2344.932545 89.109.251.23
+r2 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329850 delay:0.081115 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r2 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.323579 delay:0.084755 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r2 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.325805 delay:0.071227 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r2 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329044 delay:0.077505 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r3 DMS1 up=2342.02 t0=2344.939969 t1=2344.981729 1474968918007
+r3 DMS2 up=2342.07 t0=2344.989168 t1=2345.026084 1474968918052
+r3 DMS3 up=2342.12 t0=2345.033161 t1=2345.066741 1474968918093
+r3 NITZ1 up=2342.16 t0=2345.073749 t1=2345.108223 2026-10-02 09:35:18 tz=180
+r3 NITZ2 up=2342.20 t0=2345.121763 t1=2345.157883 2026-10-02 09:35:18 tz=180
+r3 NTP1 up=2342.25 t0=2345.171835 t1=2354.188756 89.109.251.21
+r3 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.319700 delay:0.057665 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r3 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.322508 delay:0.066819 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r3 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.329494 delay:0.078697 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r3 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.324247 delay:0.065740 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r3 NTP2 up=2351.28 t0=2354.195906 t1=2363.212886 89.109.251.22
+r3 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.330744 delay:0.080098 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r3 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.329975 delay:0.078562 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r3 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.333668 delay:0.084620 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r3 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.321981 delay:0.062169 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r3 NTP3 up=2360.30 t0=2363.219867 t1=2372.236890 89.109.251.23
+r3 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.324088 delay:0.068281 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r3 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.328512 delay:0.075076 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r3 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.325074 delay:0.069214 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r3 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.326014 delay:0.069400 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r4 DMS1 up=2369.33 t0=2372.244103 t1=2372.281888 1474968945308
+r4 DMS2 up=2369.37 t0=2372.288996 t1=2372.323347 1474968945350
+r4 DMS3 up=2369.41 t0=2372.330800 t1=2372.363675 1474968945390
+r4 NITZ1 up=2369.45 t0=2372.370602 t1=2372.406014 2026-10-02 09:35:45 tz=180
+r4 NITZ2 up=2369.50 t0=2372.419360 t1=2372.457816 2026-10-02 09:35:45 tz=180
+r4 NTP1 up=2369.55 t0=2372.472162 t1=2381.488463 89.109.251.21
+r4 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.324163 delay:0.066528 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r4 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.320110 delay:0.075904 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r4 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.321446 delay:0.060687 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r4 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.329221 delay:0.074052 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r4 NTP2 up=2378.58 t0=2381.495637 t1=2390.512673 89.109.251.22
+r4 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.325932 delay:0.069248 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r4 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.325155 delay:0.069764 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r4 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.325700 delay:0.069018 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r4 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.329125 delay:0.076860 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r4 NTP3 up=2387.60 t0=2390.519939 t1=2399.538884 89.109.251.23
+r4 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.331901 delay:0.082277 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r4 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.321714 delay:0.063626 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r4 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.328710 delay:0.075428 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r4 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329321 delay:0.077377 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r5 DMS1 up=2396.63 t0=2399.549002 t1=2399.587100 1474968972613
+r5 DMS2 up=2396.68 t0=2399.595279 t1=2399.632145 1474968972658
+r5 DMS3 up=2396.72 t0=2399.639196 t1=2399.675032 1474968972701
+r5 NITZ1 up=2396.76 t0=2399.682443 t1=2399.720245 2026-10-02 09:36:12 tz=180
+r5 NITZ2 up=2396.81 t0=2399.732770 t1=2399.780750 2026-10-02 09:36:12 tz=180
+r5 NTP1 up=2396.89 t0=2399.803163 t1=2408.828163 89.109.251.21
+r5 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.323808 delay:0.065090 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r5 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.328945 delay:0.077896 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r5 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.330328 delay:0.077581 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r5 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.328657 delay:0.075348 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r5 NTP2 up=2405.92 t0=2408.835350 t1=2417.852647 89.109.251.22
+r5 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.332738 delay:0.081850 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r5 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.328886 delay:0.074589 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r5 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.329384 delay:0.077445 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r5 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.330549 delay:0.077484 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r5 NTP3 up=2414.94 t0=2417.860170 t1=2426.880697 89.109.251.23
+r5 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.326382 delay:0.072783 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r5 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.330350 delay:0.076288 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r5 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329988 delay:0.078483 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r5 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.325714 delay:0.070595 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r6 DMS1 up=2423.97 t0=2426.887871 t1=2426.926056 1474968999952
+r6 DMS2 up=2424.02 t0=2426.933612 t1=2426.969870 1474968999996
+r6 DMS3 up=2424.06 t0=2426.977371 t1=2427.010828 1474969000037
+r6 NITZ1 up=2424.10 t0=2427.018436 t1=2427.051994 2026-10-02 09:36:40 tz=180
+r6 NITZ2 up=2424.15 t0=2427.065167 t1=2427.098955 2026-10-02 09:36:40 tz=180
+r6 NTP1 up=2424.19 t0=2427.111038 t1=2436.126891 89.109.251.21
+r6 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.328989 delay:0.074611 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r6 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.322036 delay:0.059406 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r6 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.329394 delay:0.078338 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r6 NTP1 ntpd: reply from 89.109.251.21: offset:+1790931373.329222 delay:0.077183 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r6 NTP2 up=2433.22 t0=2436.134413 t1=2445.151365 89.109.251.22
+r6 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.321430 delay:0.063038 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r6 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.327628 delay:0.073739 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r6 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.325634 delay:0.069996 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r6 NTP2 ntpd: reply from 89.109.251.22: offset:+1790931373.328373 delay:0.076160 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+r6 NTP3 up=2442.24 t0=2445.158937 t1=2454.175067 89.109.251.23
+r6 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329836 delay:0.077828 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+r6 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329112 delay:0.076710 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+r6 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.325833 delay:0.087144 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+r6 NTP3 ntpd: reply from 89.109.251.23: offset:+1790931373.329130 delay:0.075974 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+END 2454.182650 up=2451.27
--- a/logs/b7/b7a/raw/r1-dms1.txt
+++ b/logs/b7/b7a/raw/r1-dms1.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975090706 (x 1.25ms): 2017-05-28 02:51:30'
+	Time source: 'device'
+	System time: '1474968863383 (ms): 2026-10-02 09:34:23'
+	User time: '2277637 (ms): 1980-01-06 00:37:57'
--- a/logs/b7/b7a/raw/r1-dms2.txt
+++ b/logs/b7/b7a/raw/r1-dms2.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975090742 (x 1.25ms): 2017-05-28 02:51:30'
+	Time source: 'device'
+	System time: '1474968863428 (ms): 2026-10-02 09:34:23'
+	User time: '2277682 (ms): 1980-01-06 00:37:57'
--- a/logs/b7/b7a/raw/r1-dms3.txt
+++ b/logs/b7/b7a/raw/r1-dms3.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975090775 (x 1.25ms): 2017-05-28 02:51:30'
+	Time source: 'device'
+	System time: '1474968863469 (ms): 2026-10-02 09:34:23'
+	User time: '2277723 (ms): 1980-01-06 00:37:57'
--- a/logs/b7/b7a/raw/r1-nitz1.txt
+++ b/logs/b7/b7a/raw/r1-nitz1.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:34:23'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r1-nitz2.txt
+++ b/logs/b7/b7a/raw/r1-nitz2.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:34:23'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r1-ntp1.txt
+++ b/logs/b7/b7a/raw/r1-ntp1.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.411719 delay:0.246163 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.326073 delay:0.069712 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.325233 delay:0.068509 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.329765 delay:0.077368 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r1-ntp2.txt
+++ b/logs/b7/b7a/raw/r1-ntp2.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.327086 delay:0.073702 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.328830 delay:0.077616 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.330559 delay:0.080462 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.328758 delay:0.075912 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r1-ntp3.txt
+++ b/logs/b7/b7a/raw/r1-ntp3.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.325062 delay:0.070563 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.323854 delay:0.067130 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329894 delay:0.077937 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329257 delay:0.076282 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r2-dms1.txt
+++ b/logs/b7/b7a/raw/r2-dms1.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975112563 (x 1.25ms): 2017-05-28 02:51:52'
+	Time source: 'device'
+	System time: '1474968890704 (ms): 2026-10-02 09:34:50'
+	User time: '2304958 (ms): 1980-01-06 00:38:24'
--- a/logs/b7/b7a/raw/r2-dms2.txt
+++ b/logs/b7/b7a/raw/r2-dms2.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975112597 (x 1.25ms): 2017-05-28 02:51:52'
+	Time source: 'device'
+	System time: '1474968890746 (ms): 2026-10-02 09:34:50'
+	User time: '2305000 (ms): 1980-01-06 00:38:25'
--- a/logs/b7/b7a/raw/r2-dms3.txt
+++ b/logs/b7/b7a/raw/r2-dms3.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975112629 (x 1.25ms): 2017-05-28 02:51:52'
+	Time source: 'device'
+	System time: '1474968890787 (ms): 2026-10-02 09:34:50'
+	User time: '2305041 (ms): 1980-01-06 00:38:25'
--- a/logs/b7/b7a/raw/r2-nitz1.txt
+++ b/logs/b7/b7a/raw/r2-nitz1.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:34:50'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r2-nitz2.txt
+++ b/logs/b7/b7a/raw/r2-nitz2.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:34:50'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r2-ntp1.txt
+++ b/logs/b7/b7a/raw/r2-ntp1.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.325064 delay:0.068259 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.323892 delay:0.065992 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.325567 delay:0.069785 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.328997 delay:0.077833 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r2-ntp2.txt
+++ b/logs/b7/b7a/raw/r2-ntp2.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.326539 delay:0.072404 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.325250 delay:0.070587 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.329585 delay:0.077110 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.328824 delay:0.078408 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r2-ntp3.txt
+++ b/logs/b7/b7a/raw/r2-ntp3.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329850 delay:0.081115 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.323579 delay:0.084755 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.325805 delay:0.071227 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329044 delay:0.077505 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r3-dms1.txt
+++ b/logs/b7/b7a/raw/r3-dms1.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975134405 (x 1.25ms): 2017-05-28 02:52:14'
+	Time source: 'device'
+	System time: '1474968918007 (ms): 2026-10-02 09:35:18'
+	User time: '2332261 (ms): 1980-01-06 00:38:52'
--- a/logs/b7/b7a/raw/r3-dms2.txt
+++ b/logs/b7/b7a/raw/r3-dms2.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975134441 (x 1.25ms): 2017-05-28 02:52:14'
+	Time source: 'device'
+	System time: '1474968918052 (ms): 2026-10-02 09:35:18'
+	User time: '2332306 (ms): 1980-01-06 00:38:52'
--- a/logs/b7/b7a/raw/r3-dms3.txt
+++ b/logs/b7/b7a/raw/r3-dms3.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975134474 (x 1.25ms): 2017-05-28 02:52:14'
+	Time source: 'device'
+	System time: '1474968918093 (ms): 2026-10-02 09:35:18'
+	User time: '2332347 (ms): 1980-01-06 00:38:52'
--- a/logs/b7/b7a/raw/r3-nitz1.txt
+++ b/logs/b7/b7a/raw/r3-nitz1.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:35:18'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r3-nitz2.txt
+++ b/logs/b7/b7a/raw/r3-nitz2.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:35:18'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r3-ntp1.txt
+++ b/logs/b7/b7a/raw/r3-ntp1.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.319700 delay:0.057665 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.322508 delay:0.066819 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.329494 delay:0.078697 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.324247 delay:0.065740 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r3-ntp2.txt
+++ b/logs/b7/b7a/raw/r3-ntp2.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.330744 delay:0.080098 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.329975 delay:0.078562 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.333668 delay:0.084620 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.321981 delay:0.062169 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r3-ntp3.txt
+++ b/logs/b7/b7a/raw/r3-ntp3.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.324088 delay:0.068281 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.328512 delay:0.075076 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.325074 delay:0.069214 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.326014 delay:0.069400 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r4-dms1.txt
+++ b/logs/b7/b7a/raw/r4-dms1.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975156246 (x 1.25ms): 2017-05-28 02:52:36'
+	Time source: 'device'
+	System time: '1474968945308 (ms): 2026-10-02 09:35:45'
+	User time: '2359562 (ms): 1980-01-06 00:39:19'
--- a/logs/b7/b7a/raw/r4-dms2.txt
+++ b/logs/b7/b7a/raw/r4-dms2.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975156279 (x 1.25ms): 2017-05-28 02:52:36'
+	Time source: 'device'
+	System time: '1474968945350 (ms): 2026-10-02 09:35:45'
+	User time: '2359604 (ms): 1980-01-06 00:39:19'
--- a/logs/b7/b7a/raw/r4-dms3.txt
+++ b/logs/b7/b7a/raw/r4-dms3.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975156312 (x 1.25ms): 2017-05-28 02:52:36'
+	Time source: 'device'
+	System time: '1474968945390 (ms): 2026-10-02 09:35:45'
+	User time: '2359644 (ms): 1980-01-06 00:39:19'
--- a/logs/b7/b7a/raw/r4-nitz1.txt
+++ b/logs/b7/b7a/raw/r4-nitz1.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:35:45'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r4-nitz2.txt
+++ b/logs/b7/b7a/raw/r4-nitz2.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:35:45'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r4-ntp1.txt
+++ b/logs/b7/b7a/raw/r4-ntp1.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.324163 delay:0.066528 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.320110 delay:0.075904 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.321446 delay:0.060687 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.329221 delay:0.074052 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r4-ntp2.txt
+++ b/logs/b7/b7a/raw/r4-ntp2.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.325932 delay:0.069248 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.325155 delay:0.069764 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.325700 delay:0.069018 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.329125 delay:0.076860 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r4-ntp3.txt
+++ b/logs/b7/b7a/raw/r4-ntp3.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.331901 delay:0.082277 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.321714 delay:0.063626 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.328710 delay:0.075428 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329321 delay:0.077377 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r5-dms1.txt
+++ b/logs/b7/b7a/raw/r5-dms1.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975178090 (x 1.25ms): 2017-05-28 02:52:58'
+	Time source: 'device'
+	System time: '1474968972613 (ms): 2026-10-02 09:36:12'
+	User time: '2386867 (ms): 1980-01-06 00:39:46'
--- a/logs/b7/b7a/raw/r5-dms2.txt
+++ b/logs/b7/b7a/raw/r5-dms2.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975178126 (x 1.25ms): 2017-05-28 02:52:58'
+	Time source: 'device'
+	System time: '1474968972658 (ms): 2026-10-02 09:36:12'
+	User time: '2386912 (ms): 1980-01-06 00:39:46'
--- a/logs/b7/b7a/raw/r5-dms3.txt
+++ b/logs/b7/b7a/raw/r5-dms3.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975178160 (x 1.25ms): 2017-05-28 02:52:58'
+	Time source: 'device'
+	System time: '1474968972701 (ms): 2026-10-02 09:36:12'
+	User time: '2386955 (ms): 1980-01-06 00:39:46'
--- a/logs/b7/b7a/raw/r5-nitz1.txt
+++ b/logs/b7/b7a/raw/r5-nitz1.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:36:12'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r5-nitz2.txt
+++ b/logs/b7/b7a/raw/r5-nitz2.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:36:12'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r5-ntp1.txt
+++ b/logs/b7/b7a/raw/r5-ntp1.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.323808 delay:0.065090 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.328945 delay:0.077896 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.330328 delay:0.077581 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.328657 delay:0.075348 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r5-ntp2.txt
+++ b/logs/b7/b7a/raw/r5-ntp2.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.332738 delay:0.081850 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.328886 delay:0.074589 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.329384 delay:0.077445 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.330549 delay:0.077484 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r5-ntp3.txt
+++ b/logs/b7/b7a/raw/r5-ntp3.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.326382 delay:0.072783 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.330350 delay:0.076288 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329988 delay:0.078483 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.325714 delay:0.070595 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r6-dms1.txt
+++ b/logs/b7/b7a/raw/r6-dms1.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975199961 (x 1.25ms): 2017-05-28 02:53:19'
+	Time source: 'device'
+	System time: '1474968999952 (ms): 2026-10-02 09:36:39'
+	User time: '2414206 (ms): 1980-01-06 00:40:14'
--- a/logs/b7/b7a/raw/r6-dms2.txt
+++ b/logs/b7/b7a/raw/r6-dms2.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975199996 (x 1.25ms): 2017-05-28 02:53:19'
+	Time source: 'device'
+	System time: '1474968999996 (ms): 2026-10-02 09:36:39'
+	User time: '2414250 (ms): 1980-01-06 00:40:14'
--- a/logs/b7/b7a/raw/r6-dms3.txt
+++ b/logs/b7/b7a/raw/r6-dms3.txt
@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975200029 (x 1.25ms): 2017-05-28 02:53:20'
+	Time source: 'device'
+	System time: '1474969000037 (ms): 2026-10-02 09:36:40'
+	User time: '2414291 (ms): 1980-01-06 00:40:14'
--- a/logs/b7/b7a/raw/r6-nitz1.txt
+++ b/logs/b7/b7a/raw/r6-nitz1.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:36:40'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r6-nitz2.txt
+++ b/logs/b7/b7a/raw/r6-nitz2.txt
@ -0,0 +1,7 @@
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:36:40'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
--- a/logs/b7/b7a/raw/r6-ntp1.txt
+++ b/logs/b7/b7a/raw/r6-ntp1.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.328989 delay:0.074611 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.322036 delay:0.059406 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.329394 delay:0.078338 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+1790931373.329222 delay:0.077183 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r6-ntp2.txt
+++ b/logs/b7/b7a/raw/r6-ntp2.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.321430 delay:0.063038 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.327628 delay:0.073739 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.325634 delay:0.069996 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.22
+ntpd: reply from 89.109.251.22: offset:+1790931373.328373 delay:0.076160 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7a/raw/r6-ntp3.txt
+++ b/logs/b7/b7a/raw/r6-ntp3.txt
@ -0,0 +1,9 @@
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329836 delay:0.077828 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329112 delay:0.076710 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.325833 delay:0.087144 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.23
+ntpd: reply from 89.109.251.23: offset:+1790931373.329130 delay:0.075974 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
--- a/logs/b7/b7b/B7B-RESULT.md
+++ b/logs/b7/b7b/B7B-RESULT.md
@ -0,0 +1,33 @@
+# B7B — one system clock step 1970 → QMI DMS UTC on the live modem: **PASS**
+
+2026-10-02, same boot as R3A/R3B/B7A (uptime ≈ 2925–3130 s). No eMMC write (writes 0), no RTC write, image unchanged, no reboot. Only RAM files in /tmp/b7b
+and one temporary /32 route to ntp1.vniiftri.ru (89.109.251.21), removed afterwards. Script b7/b7b/b7b-run.sh (sha 58ed0d00…), detached on the board.
+
+## Time-source checks (b7b-time-source.txt)
+3 DMS samples + 1 NITZ, each bracketed by `adjtimex` µs timestamps. All PASS → VERDICT=GO:
+values present; DMS ≥ image build 2026-10-02T08:09:01Z; year ≥ 2026; < build + 5 y (1980/2017 excluded); 3 samples consistent (spread 0.8 ms); |DMS − NITZ| = 0.54 s < 2.
+Dry runs first (logs dry/): run 1 was stopped by the gate itself, because my parser bug gave DMS = 1980-01-06 → STOP, clock not touched. Fixed, run 2 = GO (dry).
+
+## Step (b7b-actions.txt)
+`date -u -s @1790934303` (09:45:03 UTC), started at a local instant chosen so that the new clock lands on a whole DMS second (usleep 1.386 s), rc=0.
+Clock 2929.968714 → 1790934303.002845. No hwclock. adjtimex stays `status 64 (UNSYNC)`, offset 0, so the kernel 11-min RTC sync does not engage.
+RTC since_epoch kept counting from boot (2926 → 2929 → … 3112): **RTC untouched**.
+Right after the step: DMS − clock = +14.5/+14.2/+14.0 ms (date -s exec ran ≈ 12 ms after the target instant).
+
+## Stack after the step (b7b-post.txt, b7b-observe.txt, b7b-host-checks.txt)
+- PIDs unchanged pre/post/all of the observation: ModemManager 1655, rmtfs 1056, qmi-proxy 1701, telnetd 615, udevd 1613, dbus 1640, polkitd 1644.
+- 36 samples over 182 s (every 5 s): state BEARER_CONNECTED, wwan0 10.41.212.24/28, **LTE ping 77.88.8.8 36/36 ok**, host 172.16.42.2 up 36/36;
+  mm `connected/home`, bearer1 connected=yes in all 13 mmcli samples.
+- lifecycle.log 35 lines before and after (no FAIL/rollback/error). dmesg: only the three `[b7b]` marker lines after the step, no kernel message.
+  ModemManager log: no new lines at all after the step. dmesg-errs 0.
+- Host: telnet + ping 172.16.42.1 OK on 15/15 checks during the run.
+
+## Residual vs NTP (b7b-ntp-check.txt, ntpd -w query only, ntp1.vniiftri.ru)
+4 replies: offset **+0.2922 / +0.3001 / +0.3002 / +0.2985 s** (RTT 60–75 ms). Best (min delay) = +0.292 s: the system clock is 0.29 s slow.
+That matches B7A: DMS bias −0.280 s plus the ≈ 0.013 s step latency (DMS − clock = +13…14 ms at the end too, so no drift in 200 s).
+Route removed, table identical to before.
+
+## Verdict
+PASS on every criterion: the clock is current (2026-10-02, −0.29 s vs VNIIFTRI), the modem stack did not react to the 56-year forward step,
+bearer/wwan0 stayed up, MM/rmtfs were not restarted, LTE ping worked, no new FAIL/rollback/error, residual ≈ 0.3 s as expected.
+Not covered (B7C): DMS validity before registration on a class-A cold boot; ntpd in the image; integrating the step into the boot flow.
--- a/logs/b7/b7b/b7b-actions.txt
+++ b/logs/b7/b7b/b7b-actions.txt
@ -0,0 +1,10 @@
+[up 2924.52 clk 2927.442468] B7B BEGIN obs=180s floor=1790928541 ntp=89.109.251.21
+[up 2924.53 clk 2927.450470] usleep ok
+[up 2925.42 clk 2928.340809] pre snapshot done
+[up 2925.62 clk 2928.548052] checks PASS, DMS offset vs clock 1790931373.043399 s
+[up 2925.65 clk 2928.576558] step plan: N=1790934303 (Fri Oct  2 09:45:03 UTC 2026) local_target=2929.956601 wait_us=1385635
+[up 2927.06 clk 1790934303.013178] date -u -s @1790934303 rc=0 out='Fri Oct  2 09:45:03 UTC 2026' clk_before=2929.968714 clk_after=1790934303.002845 (no hwclock, RTC untouched)
+[up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930
+[up 3115.36 clk 1790934491.308056] observe done
+[up 3129.54 clk 1790934505.488905] ntp check done: offset:+0.292232 delay:0.059935;offset:+0.300078 delay:0.073133;offset:+0.300242 delay:0.075249;offset:+0.298480 delay:0.069950;
+[up 3129.54 clk 1790934505.496966] B7B END
--- a/logs/b7/b7b/b7b-host-checks.txt
+++ b/logs/b7/b7b/b7b-host-checks.txt
@ -0,0 +1,16 @@
+09:44:59 host-start
+09:45:02 host_ping=ok TEL-OK 2927.52 09:45:03 [up 2927.06 clk 1790934303.013178] date -u -s @1790934303 rc=0 out='Fri Oct  2 09:45:03 UTC 2026' clk_before=2929.968714 clk_after=1790934303.002845 (no hwclock, RTC untouched) 
+09:45:17 host_ping=ok TEL-OK 2942.53 09:45:18 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:45:32 host_ping=ok TEL-OK 2957.55 09:45:33 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:45:47 host_ping=ok TEL-OK 2972.56 09:45:48 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:46:02 host_ping=ok TEL-OK 2987.57 09:46:03 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:46:17 host_ping=ok TEL-OK 3002.59 09:46:18 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:46:32 host_ping=ok TEL-OK 3017.61 09:46:33 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:46:47 host_ping=ok TEL-OK 3032.63 09:46:48 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:47:02 host_ping=ok TEL-OK 3047.64 09:47:03 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:47:17 host_ping=ok TEL-OK 3062.66 09:47:18 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:47:32 host_ping=ok TEL-OK 3077.67 09:47:33 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:47:47 host_ping=ok TEL-OK 3092.69 09:47:48 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:48:02 host_ping=ok TEL-OK 3107.70 09:48:03 [up 2928.07 clk 1790934304.022053] post snapshot done; RTC since_epoch before step 2928, now 2930 
+09:48:17 host_ping=ok TEL-OK 3122.72 09:48:18 [up 3115.36 clk 1790934491.308056] observe done 
+09:48:32 host_ping=ok TEL-OK 3137.73 09:48:33 [up 3129.54 clk 1790934505.496966] B7B END 
--- a/logs/b7/b7b/b7b-ntp-check.txt
+++ b/logs/b7/b7b/b7b-ntp-check.txt
@ -0,0 +1,30 @@
+route add 89.109.251.21/32 dev wwan0 src 10.41.212.24
+ROUTE-ADD-OK
+1.1.1.1 dev wwan0 scope link  src 10.41.212.24 
+10.10.22.3 dev wwan0 scope link  src 10.41.212.24 
+10.41.212.16/28 dev wwan0 scope link  src 10.41.212.24 
+77.88.8.8 dev wwan0 scope link  src 10.41.212.24 
+89.109.251.21 dev wwan0 scope link  src 10.41.212.24 
+172.16.42.0/24 dev usb0 scope link  src 172.16.42.1 
+194.186.191.1 dev wwan0 scope link  src 10.41.212.24 
+clock before: 1790934491.320572 Fri Oct  2 09:48:11 UTC 2026
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+0.292232 delay:0.059935 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x01
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+0.300078 delay:0.073133 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x03
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+0.300242 delay:0.075249 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x07
+ntpd: sending query to 89.109.251.21
+ntpd: reply from 89.109.251.21: offset:+0.298480 delay:0.069950 status:0x24 strat:1 refid:0x49525446 rootdelay:0.000000 reach:0x0f
+Terminated
+clock after: 1790934505.339636 Fri Oct  2 09:48:25 UTC 2026
+DMS1 DMS-clock=+14.2 ms
+DMS2 DMS-clock=+13.5 ms
+DMS3 DMS-clock=+13.0 ms
+ROUTE-DEL-OK
+1.1.1.1 dev wwan0 scope link  src 10.41.212.24 
+10.10.22.3 dev wwan0 scope link  src 10.41.212.24 
+10.41.212.16/28 dev wwan0 scope link  src 10.41.212.24 
+77.88.8.8 dev wwan0 scope link  src 10.41.212.24 
+172.16.42.0/24 dev usb0 scope link  src 172.16.42.1 
+194.186.191.1 dev wwan0 scope link  src 10.41.212.24 
--- a/logs/b7/b7b/b7b-observe.txt
+++ b/logs/b7/b7b/b7b-observe.txt
@ -0,0 +1,82 @@
+# every 5 s: up clock pids state wwan0 lte_ping host_ping lifecycle_lines dmesg_lines rtc; every 15 s mm
+up=2928.08 clk=09:45:04 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2930 mm=connected/home/ bearer1=yes
+up=2933.48 clk=09:45:09 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2936
+up=2938.64 clk=09:45:14 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2941
+up=2943.79 clk=09:45:19 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2946 mm=connected/home/ bearer1=yes
+up=2949.06 clk=09:45:25 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2951
+up=2954.21 clk=09:45:30 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2956
+up=2959.38 clk=09:45:35 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2961 mm=connected/home/ bearer1=yes
+up=2964.64 clk=09:45:40 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2967
+up=2969.80 clk=09:45:45 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2972
+up=2974.95 clk=09:45:50 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2977 mm=connected/home/ bearer1=yes
+up=2980.21 clk=09:45:56 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2982
+up=2985.37 clk=09:46:01 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2987
+up=2990.54 clk=09:46:06 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2993 mm=connected/home/ bearer1=yes
+up=2995.80 clk=09:46:11 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=2998
+up=3000.95 clk=09:46:16 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3003
+up=3006.11 clk=09:46:22 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3008 mm=connected/home/ bearer1=yes
+up=3011.36 clk=09:46:27 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3013
+up=3016.51 clk=09:46:32 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3019
+up=3021.67 clk=09:46:37 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3024 mm=connected/home/ bearer1=yes
+up=3026.93 clk=09:46:42 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3029
+up=3032.08 clk=09:46:48 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3034
+up=3037.24 clk=09:46:53 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3039 mm=connected/home/ bearer1=yes
+up=3042.49 clk=09:46:58 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3045
+up=3047.65 clk=09:47:03 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3050
+up=3052.79 clk=09:47:08 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3055 mm=connected/home/ bearer1=yes
+up=3058.05 clk=09:47:14 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3060
+up=3063.21 clk=09:47:19 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3065
+up=3068.38 clk=09:47:24 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3070 mm=connected/home/ bearer1=yes
+up=3073.64 clk=09:47:29 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3076
+up=3078.79 clk=09:47:34 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3081
+up=3083.95 clk=09:47:39 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3086 mm=connected/home/ bearer1=yes
+up=3089.22 clk=09:47:45 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3091
+up=3094.37 clk=09:47:50 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3096
+up=3099.55 clk=09:47:55 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3102 mm=connected/home/ bearer1=yes
+up=3104.81 clk=09:48:00 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3107
+up=3109.96 clk=09:48:05 MM=1655 rmtfs=1056 qp=1701 tel=615 state=BEARER_CONNECTED wwan0=10.41.212.24/28 lte=ok host=up lc=35 dmesg=312 rtc=3112
+=== dmesg since step (from line 309)
+[ 2925.810641] [b7b] step plan: N=1790934303 (Fri Oct  2 09:45:03 UTC 2026) local_target=2929.956601 wait_us=1385635
+[ 2927.218618] [b7b] date -u -s @1790934303 rc=0 out='Fri Oct  2 09:45:03 UTC 2026' clk_before=2929.968714 clk_after=1790934303.002845 (no hwclock, RTC untouched)
+[ 2928.227351] [b7b] post snapshot done; RTC since_epoch before step 2928, now 2930
+=== mm-0.log since step (grep time|clock|timeout|error|warn)
+[1655]: <dbg> [000000037.794541] [plugin-manager] task 0: extra probing time elapsed
+[1655]: <wrn> [000000042.136055] [location-cache] Error loading cached location from /var/lib/ModemManager/location.ini: No such file or directory
+[1655]: <dbg> [000000048.917039] [modem0] couldn't load carrier config: Operation timed out
+[1655]: <dbg> [000000050.018452] [modem0] slot status retrieval failed: QMI protocol error (94): 'NotSupported'
+[1655]: <dbg> [000000051.552255] [modem0/sim0] couldn't load GID1: Couldn't read data from UIM: QMI protocol error (16): 'NotProvisioned'
+[1655]: <dbg> [000000051.558170] [modem0/sim0] couldn't load GID2: Couldn't read data from UIM: QMI protocol error (16): 'NotProvisioned'
+[1655]: <dbg> [000000051.941247] [modem0] couldn't load list of own numbers: Couldn't get MSISDN: QMI protocol error (16): 'NotProvisioned'
+<<<<<<   message     = "Get Network Time" (0x007D)
+<<<<<<   message     = "Get Network Time" (0x007D)
+<<<<<<   type       = "3GPP Time" (0x11)
+<<<<<<   translated = [ universal_time = '[ year = '2026' month = '10' day = '2' hour = '8' minute = '57' second = '7' day_of_week = 'friday' ]' timezone_offset = '12' daylight_savings_adjustment = 'none' radio_interface = 'lte' ]
+<<<<<<   translated = inject-time-request, inject-position-request
+[1655]: <dbg> [000000069.372680] [modem0] couldn't enable unsolicited profile management events: QMI protocol error (71): 'InvalidQmiCommand'
+[1655]: <dbg> [000000070.417738] [modem0] couldn't read SMS messages: QMI protocol error (17): 'MissingArgument'
+[1655]: <dbg> [000000070.423116] [modem0] couldn't read SMS messages: QMI protocol error (52): 'DeviceNotReady'
+[1655]: <dbg> [000000070.772808] [modem0] couldn't read SMS messages: QMI protocol error (48): 'InvalidArgument'
+[1655]: <dbg> [000000071.112502] [modem0] couldn't read SMS messages: QMI protocol error (48): 'InvalidArgument'
+[1655]: <dbg> [000000071.118144] [modem0] couldn't read SMS messages: QMI protocol error (17): 'MissingArgument'
+[1655]: <dbg> [000000071.461339] [modem0] couldn't read SMS messages: QMI protocol error (52): 'DeviceNotReady'
+[1655]: <dbg> [000000071.811082] [modem0] couldn't read SMS messages: QMI protocol error (48): 'InvalidArgument'
+[1655]: <dbg> [000000071.817169] [modem0] couldn't read SMS messages: QMI protocol error (48): 'InvalidArgument'
+[1655]: <dbg> [000000071.821993] [modem0/wwan0at1/at] <-- '<CR><LF>+CMS ERROR: 303<CR><LF>'
+[1655]: <dbg> [000000071.927544] [modem0/wwan0at0/at] <-- '<CR><LF>+CMS ERROR: 303<CR><LF>'
+[1655]: <dbg> [000000071.939381] [modem0] modem has time capabilities, enabling the Time interface...
+[1655]: <dbg> [000000072.289994] [modem0] cleaning up extended signal information thresholds: interface enabled, rssi threshold 0 dBm, error rate threshold disabled
+[1655]: <dbg> [000000073.689709] [modem0] network timezone polling started
+<<<<<<   message     = "Get Network Time" (0x007D)
+<<<<<<   message     = "Get Network Time" (0x007D)
+<<<<<<   type       = "3GPP Time" (0x11)
+<<<<<<   translated = [ universal_time = '[ year = '2026' month = '10' day = '2' hour = '8' minute = '57' second = '31' day_of_week = 'friday' ]' timezone_offset = '12' daylight_savings_adjustment = 'none' radio_interface = 'lte' ]
+[1655]: <inf> [000001262.938932] [modem0] processing user request to load network time...
+<<<<<<   message     = "Get Network Time" (0x007D)
+<<<<<<   message     = "Get Network Time" (0x007D)
+<<<<<<   type       = "3GPP Time" (0x11)
+<<<<<<   translated = [ universal_time = '[ year = '2026' month = '10' day = '2' hour = '9' minute = '17' second = '15' day_of_week = 'friday' ]' timezone_offset = '12' daylight_savings_adjustment = 'none' radio_interface = 'lte' ]
+[1655]: <inf> [000001355.111653] [modem0] processing user request to load network time...
+<<<<<<   message     = "Get Network Time" (0x007D)
+<<<<<<   message     = "Get Network Time" (0x007D)
+<<<<<<   type       = "3GPP Time" (0x11)
+<<<<<<   translated = [ universal_time = '[ year = '2026' month = '10' day = '2' hour = '9' minute = '18' second = '48' day_of_week = 'friday' ]' timezone_offset = '12' daylight_savings_adjustment = 'none' radio_interface = 'lte' ]
--- a/logs/b7/b7b/b7b-post.txt
+++ b/logs/b7/b7b/b7b-post.txt
@ -0,0 +1,348 @@
+=== uptime
+2927.07 11616.68
+=== date -u
+Fri Oct  2 09:45:03 UTC 2026
+=== adjtimex
+    mode:         0
+-o  offset:       0 us
+-f  freq.adjust:  0 (65536 = 1ppm)
+    maxerror:     16000000
+    esterror:     16000000
+    status:       64 (UNSYNC)
+-p  timeconstant: 2
+    precision:    1 us
+    tolerance:    32768000
+-t  tick:         10000 us
+    time.tv_sec:  1790934303
+    time.tv_usec: 22829
+    return value: 5 (clock not synchronized)
+=== rtc (read only)
+2929
+1970-01-01
+00:48:49
+=== dms
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975602447 (x 1.25ms): 2017-05-28 03:00:02'
+	Time source: 'device'
+	System time: '1474969503060 (ms): 2026-10-02 09:45:03'
+	User time: '2917314 (ms): 1980-01-06 00:48:37'
+=== nitz
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:45:03'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
+=== mmcli -m any
+  ----------------------------------
+  General  |                   path: /org/freedesktop/ModemManager1/Modem/0
+           |              device id: 7eea3e62ab14a18d5de1cf97053b7b043d75d6db
+  ----------------------------------
+  Hardware |           manufacturer: QUALCOMM INCORPORATED
+           |                  model: 0
+           |      firmware revision: MPSS.DPM.1.0.c7-00193-M8916EAAAANVZM-1  1  [Sep 09 2015 10:00:00]
+           |           h/w revision: 10000
+           |              supported: gsm-umts, lte
+           |                current: gsm-umts, lte
+           |           equipment id: <IMEI>
+  ----------------------------------
+  System   |                 device: qcom-soc
+           |                physdev: /sys/devices/platform/soc@0/4080000.remoteproc/4080000.remoteproc:bam-dmux
+           |                drivers: bam-dmux, qcom-q6v5-mss, rpmsg_ctrl
+           |                 plugin: qcom-soc
+           |           primary port: wwan0qmi0
+           |                  ports: wwan0 (net), wwan0at0 (at), wwan0at1 (at), wwan0qmi0 (qmi), 
+           |                         wwan1 (net), wwan2 (net), wwan3 (net), wwan4 (net), wwan5 (net), 
+           |                         wwan6 (net), wwan7 (net)
+           |          ignored ports: rpmsg_ctrl1 (unknown)
+  ----------------------------------
+  Status   |                   lock: sim-pin2
+           |         unlock retries: sim-pin (3), sim-puk (10), sim-pin2 (1), sim-puk2 (10)
+           |                  state: connected
+           |            power state: on
+           |            access tech: lte
+           |         signal quality: 68% (recent)
+  ----------------------------------
+  Modes    |              supported: allowed: 2g; preferred: none
+           |                         allowed: 3g; preferred: none
+           |                         allowed: 4g; preferred: none
+           |                         allowed: 2g, 3g; preferred: 3g
+           |                         allowed: 2g, 3g; preferred: 2g
+           |                         allowed: 2g, 4g; preferred: 4g
+           |                         allowed: 2g, 4g; preferred: 2g
+           |                         allowed: 3g, 4g; preferred: 4g
+           |                         allowed: 3g, 4g; preferred: 3g
+           |                         allowed: 2g, 3g, 4g; preferred: 4g
+           |                         allowed: 2g, 3g, 4g; preferred: 3g
+           |                         allowed: 2g, 3g, 4g; preferred: 2g
+           |                current: allowed: 4g; preferred: none
+  ----------------------------------
+  Bands    |              supported: egsm, dcs, pcs, g850, utran-1, utran-3, utran-5, utran-8, 
+           |                         utran-2, eutran-1, eutran-2, eutran-3, eutran-5, eutran-7, eutran-8, 
+           |                         eutran-20, eutran-39, eutran-40
+           |                current: egsm, dcs, utran-1, utran-5, utran-8, eutran-1, eutran-3, 
+           |                         eutran-5, eutran-7, eutran-8, eutran-20, eutran-40
+  ----------------------------------
+  IP       |              supported: ipv4, ipv6, ipv4v6
+  ----------------------------------
+  3GPP     |                   imei: <IMEI>
+           |          enabled locks: fixed-dialing
+           |            operator id: 25099
+           |          operator name: Beeline
+           |           registration: home
+           |   packet service state: attached
+  ----------------------------------
+  3GPP EPS |   ue mode of operation: ps-2
+           |    initial bearer path: /org/freedesktop/ModemManager1/Bearer/0
+           | initial bearer ip type: ipv4v6
+  ----------------------------------
+  SIM      |       primary sim path: /org/freedesktop/ModemManager1/SIM/0
+  ----------------------------------
+  Bearer   |                  paths: /org/freedesktop/ModemManager1/Bearer/1
+=== mmcli -b 1
+  ----------------------------------------
+  General            |               path: /org/freedesktop/ModemManager1/Bearer/1
+                     |               type: default
+  ----------------------------------------
+  Status             |          connected: yes
+                     | disconnect request: no
+                     |          suspended: no
+                     |        multiplexed: no
+                     |          interface: wwan0
+                     |         ip timeout: 20
+  ----------------------------------------
+  Properties         |                apn: internet.beeline.ru
+                     |            roaming: allowed
+                     |            ip type: ipv4
+                     |       allowed-auth: pap
+                     |               user: beeline
+                     |           password: beeline
+  ----------------------------------------
+  IPv4 configuration |             method: static
+                     |            address: 10.41.212.24
+                     |             prefix: 28
+                     |            gateway: 10.41.212.25
+                     |                dns: 10.10.22.3, 194.186.191.1
+                     |                mtu: 1500
+  ----------------------------------------
+  Statistics         |         start date: 1970-01-01T00:01:17Z
+                     |           duration: 2850
+                     |           bytes rx: 18649
+                     |           bytes tx: 18475
+                     |           attempts: 1
+                     |     total-duration: 2850
+                     |     total-bytes rx: 18649
+                     |     total-bytes tx: 18475
+=== ip
+4: wwan0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
+    inet 10.41.212.24/28 scope global wwan0
+       valid_lft forever preferred_lft forever
+3: usb0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
+    inet 172.16.42.1/24 scope global usb0
+       valid_lft forever preferred_lft forever
+1.1.1.1 dev wwan0 scope link  src 10.41.212.24 
+10.10.22.3 dev wwan0 scope link  src 10.41.212.24 
+10.41.212.16/28 dev wwan0 scope link  src 10.41.212.24 
+77.88.8.8 dev wwan0 scope link  src 10.41.212.24 
+172.16.42.0/24 dev usb0 scope link  src 172.16.42.1 
+194.186.191.1 dev wwan0 scope link  src 10.41.212.24 
+=== pids
+MM=1655 rmtfs=1056 qmi-proxy=1701 telnetd=615 udevd=1613 dbus=1640 polkitd=1644
+PID   USER     COMMAND
+    1 root     {init} /bin/busybox sh /init
+    2 root     [kthreadd]
+    3 root     [pool_workqueue_]
+    4 root     [kworker/R-rcu_g]
+    5 root     [kworker/R-sync_]
+    6 root     [kworker/R-kvfre]
+    7 root     [kworker/R-slub_]
+    8 root     [kworker/R-netns]
+    9 root     [kworker/0:0-eve]
+   11 root     [kworker/0:0H-mm]
+   13 root     [kworker/R-mm_pe]
+   14 root     [ksoftirqd/0]
+   15 root     [rcu_preempt]
+   16 root     [rcu_exp_par_gp_]
+   17 root     [rcu_exp_gp_kthr]
+   18 root     [migration/0]
+   19 root     [cpuhp/0]
+   20 root     [cpuhp/1]
+   21 root     [migration/1]
+   22 root     [ksoftirqd/1]
+   24 root     [kworker/1:0H-kb]
+   25 root     [cpuhp/2]
+   26 root     [migration/2]
+   27 root     [ksoftirqd/2]
+   29 root     [kworker/2:0H-kb]
+   30 root     [cpuhp/3]
+   31 root     [migration/3]
+   32 root     [ksoftirqd/3]
+   33 root     [kworker/3:0-dev]
+   34 root     [kworker/3:0H-kb]
+   35 root     [kdevtmpfs]
+   36 root     [kworker/R-inet_]
+   37 root     [kworker/u17:0]
+   38 root     [oom_reaper]
+   39 root     [kworker/R-write]
+   40 root     [kcompactd0]
+   41 root     [ksmd]
+   42 root     [kworker/R-kbloc]
+   43 root     [kworker/R-kinte]
+   44 root     [kworker/R-tpm_d]
+   45 root     [kworker/R-edac-]
+   46 root     [kworker/R-devfr]
+   47 root     [watchdogd]
+   49 root     [kworker/R-quota]
+   50 root     [kworker/1:1-mm_]
+   51 root     [kworker/u16:1-e]
+   52 root     [kswapd0]
+   53 root     [kworker/1:2-rcu]
+   54 root     [kworker/R-ipmi-]
+   56 root     [kworker/2:1-eve]
+   58 root     [kworker/R-nbd0-]
+   59 root     [kworker/R-nbd1-]
+   60 root     [kworker/R-nbd2-]
+   61 root     [kworker/R-nbd3-]
+   62 root     [kworker/R-nbd4-]
+   63 root     [kworker/R-nbd5-]
+   64 root     [kworker/R-nbd6-]
+   65 root     [kworker/R-nbd7-]
+   66 root     [kworker/R-nbd8-]
+   67 root     [kworker/R-nbd9-]
+   68 root     [kworker/R-nbd10]
+   69 root     [kworker/R-nbd11]
+   70 root     [kworker/R-nbd12]
+   71 root     [kworker/R-nbd13]
+   72 root     [kworker/R-nbd14]
+   73 root     [kworker/R-nbd15]
+   74 root     [irq/23-pm8941_p]
+   75 root     [irq/27-200f000.]
+   76 root     [kworker/R-mld]
+   77 root     [kworker/R-ipv6_]
+   79 root     [irq/29-smp2p-he]
+   80 root     [irq/30-smp2p-wc]
+   81 root     [irq/31-smsm]
+   82 root     [irq/32-smsm]
+   83 root     [irq/33-4a9000.t]
+   84 root     [sugov:0]
+   86 root     [kworker/2:4-mm_]
+   88 root     [kworker/0:2-eve]
+   90 root     [irq/36-q6v5 wdo]
+   91 root     [kworker/3:2-eve]
+   95 root     [irq/43-7824900.]
+   96 root     [kworker/R-sdhci]
+   97 root     [irq/35-mmc0]
+   98 root     [kworker/u16:6-p]
+   99 root     [kworker/R-ci_ot]
+  100 root     [kworker/R-mmc_c]
+  102 root     [kworker/0:1H-mm]
+  431 root     [kworker/3:2H-kb]
+  528 root     [kworker/1:1H-kb]
+  615 root     telnetd -l /bin/sh -b 172.16.42.1 -p 23
+ 1024 root     sh
+ 1056 root     rmtfs -r -P -s -v
+ 1613 root     udevd --daemon
+ 1632 root     [kworker/2:2H]
+ 1640 messageb dbus-daemon --system --fork
+ 1644 polkitd  /usr/lib/polkit-1/polkitd --no-debug
+ 1655 root     ModemManager --debug
+ 1701 root     /usr/libexec/qmi-proxy
+ 2355 root     /bin/sh
+ 6277 root     [kworker/u16:0-e]
+ 7395 root     sh /tmp/b7b/run.sh 180
+ 7679 root     /bin/sh
+ 7727 root     {ps} sh /tmp/b7b/run.sh 180
+=== state
+BEARER_CONNECTED
+=== aurora-modem status
+service: idle
+controller: BEARER_CONNECTED
+remoteproc: 4080000.remoteproc running (/sys/class/remoteproc/remoteproc0) fw=mba.mbn
+rmtfs:      pid='1056' writes_logged=1
+qmi dev:    /dev/wwan0qmi0  qmi-proxy='1701'
+daemons:    udevd='1613' dbus='1640' polkitd='1644' ModemManager='1655'
+  mm plugin: qcom-soc
+  mm primary port: wwan0qmi0
+  mm state: connected
+  mm power state: on
+  mm access tech: lte
+  mm signal quality: 68% (recent)
+  mm operator name: Beeline
+  mm registration: home
+  bearer 1:  Status connected: yes; interface: wwan0; address: 10.41.212.24;
+wwan:       wwan0 UP 10.41.212.24/28
+wwan up:    1 of 8
+routes:     1.1.1.1 dev wwan0 scope link  src 10.41.212.24 ;10.10.22.3 dev wwan0 scope link  src 10.41.212.24 ;10.41.212.16/28 dev wwan0 scope link  src 10.41.212.24 ;77.88.8.8 dev wwan0 scope link  src 10.41.212.24 ;194.186.191.1 dev wwan0 scope link  src 10.41.212.24 ;
+bam-dmux:   suspended active_ms=253147 suspended_ms=2673865 control=auto
+usb0:       172.16.42.1/24 route-to-host: 172.16.42.2 dev usb0  src 172.16.42.1 
+emmc:       writes_completed=0 sectors_written=0
+dmesg-errs: 0
+=== lifecycle.log (lines 35)
+[23.78] dbus started
+[23.79] polkitd started
+[23.81] ModemManager started pid 1655 (log mm-0.log)
+[64.08] MM modem 0 detected after 40.3s
+[64.19] STATE REGISTERED -> MM_READY
+[64.39] MM state disabled after 0.2s
+[64.54] mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=***,allowed-auth=pap,ip-type=ipv4"
+successfully connected the modem at bearer /org/freedesktop/ModemManager1/Bearer/1
+[75.03] MM state connected, registration: home
+[75.12] bearer 1: wwan0 10.41.212.24/28 gw 10.41.212.25 dns 10.10.22.3,194.186.191.1 mtu 1500
+[75.18] STATE MM_READY -> BEARER_CONNECTED
+[75.19] === START OK in 66.0s (wwan0 10.41.212.24/28, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+=== service.log
+[75.12] bearer 1: wwan0 10.41.212.24/28 gw 10.41.212.25 dns 10.10.22.3,194.186.191.1 mtu 1500
+[75.18] STATE MM_READY -> BEARER_CONNECTED
+[75.19] === START OK in 66.0s (wwan0 10.41.212.24/28, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+=== service start rc=0 75.20
+=== mm-0.log tail
+<<<<<<   type       = "Result" (0x02)
+<<<<<<   length     = 4
+<<<<<<   value      = 00:00:00:00
+<<<<<<   translated = SUCCESS
+<<<<<< TLV:
+<<<<<<   type       = "Rx Bytes Ok" (0x1a)
+<<<<<<   length     = 8
+<<<<<<   value      = <qmi-hex-redacted>
+<<<<<<   translated = 18649
+<<<<<< TLV:
+<<<<<<   type       = "Tx Bytes Ok" (0x19)
+<<<<<<   length     = 8
+<<<<<<   value      = <qmi-hex-redacted>
+<<<<<<   translated = 18475
+
+=== dmesg (lines 311) tail
+[   23.932827] [aurora-modem] dbus started
+[   23.947416] [aurora-modem] polkitd started
+[   23.967962] [aurora-modem] ModemManager started pid 1655 (log mm-0.log)
+[   64.238698] [aurora-modem] MM modem 0 detected after 40.3s
+[   64.344390] [aurora-modem] STATE REGISTERED -> MM_READY
+[   64.541211] [aurora-modem] MM state disabled after 0.2s
+[   64.691746] [aurora-modem] mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=***,allowed-auth=pap,ip-type=ipv4"
+[   75.186676] [aurora-modem] MM state connected, registration: home
+[   75.274432] [aurora-modem] bearer 1: wwan0 10.41.212.24/28 gw 10.41.212.25 dns 10.10.22.3,194.186.191.1 mtu 1500
+[   75.333458] [aurora-modem] STATE MM_READY -> BEARER_CONNECTED
+[   75.344271] [aurora-modem] === START OK in 66.0s (wwan0 10.41.212.24/28, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+[  705.308687] [r3b-obs] 704.75 host=up lte=ok state=BEARER_CONNECTED wwan0=unknown,10.41.212.24/28 usb0=172.16.42.1/24,c1 mm=1655 rmtfs=1056 am=0 lc=35
+[  813.987553] [r3b-obs] 813.46 host=up lte=ok state=BEARER_CONNECTED wwan0=unknown,10.41.212.24/28 usb0=172.16.42.1/24,c1 mm=1655 rmtfs=1056 am=0 lc=35
+[  858.212885] [r3b-obs] 856.82 host=DOWN lte=ok state=BEARER_CONNECTED wwan0=unknown,10.41.212.24/28 usb0=172.16.42.1/24,c1 mm=1655 rmtfs=1056 am=0 lc=35
+[  917.169032] [r3b-obs] 916.87 host=up lte=ok state=BEARER_CONNECTED wwan0=unknown,10.41.212.24/28 usb0=172.16.42.1/24,c1 mm=1655 rmtfs=1056 am=0 lc=35
+[ 2843.198629] [b7b] B7B BEGIN obs=180s floor=1790928541 ntp=89.109.251.21
+[ 2843.205875] [b7b] usleep ok
+[ 2844.069262] [b7b] pre snapshot done
+[ 2844.274504] [b7b] time source checks FAILED - STOP, clock not changed
+[ 2882.926846] [b7b] B7B BEGIN obs=180s floor=1790928541 ntp=89.109.251.21
+[ 2882.934696] [b7b] usleep ok
+[ 2883.796954] [b7b] pre snapshot done
+[ 2884.007841] [b7b] checks PASS, DMS offset vs clock 1790931373.043243 s
+[ 2884.014221] [b7b] DRY RUN: stop before clock step
+[ 2924.676568] [b7b] B7B BEGIN obs=180s floor=1790928541 ntp=89.109.251.21
+[ 2924.684406] [b7b] usleep ok
+[ 2925.574846] [b7b] pre snapshot done
+[ 2925.782243] [b7b] checks PASS, DMS offset vs clock 1790931373.043399 s
+[ 2925.810641] [b7b] step plan: N=1790934303 (Fri Oct  2 09:45:03 UTC 2026) local_target=2929.956601 wait_us=1385635
+[ 2927.218618] [b7b] date -u -s @1790934303 rc=0 out='Fri Oct  2 09:45:03 UTC 2026' clk_before=2929.968714 clk_after=1790934303.002845 (no hwclock, RTC untouched)
+POST DMS1 utc=1790934303.905 clock_mid=1790934303.890509 DMS-clock=+14.5 ms window=35.2 ms
+POST DMS2 utc=1790934303.952 clock_mid=1790934303.937780 DMS-clock=+14.2 ms window=35.1 ms
+POST DMS3 utc=1790934303.998 clock_mid=1790934303.984017 DMS-clock=+14.0 ms window=35.6 ms
--- a/logs/b7/b7b/b7b-pre.txt
+++ b/logs/b7/b7b/b7b-pre.txt
@ -0,0 +1,346 @@
+=== uptime
+2924.53 11607.98
+=== date -u
+Thu Jan  1 00:48:47 UTC 1970
+=== adjtimex
+    mode:         0
+-o  offset:       0 us
+-f  freq.adjust:  0 (65536 = 1ppm)
+    maxerror:     16000000
+    esterror:     16000000
+    status:       64 (UNSYNC)
+-p  timeconstant: 2
+    precision:    1 us
+    tolerance:    32768000
+-t  tick:         10000 us
+    time.tv_sec:  2927
+    time.tv_usec: 457583
+    return value: 5 (clock not synchronized)
+=== rtc (read only)
+2926
+1970-01-01
+00:48:46
+=== dms
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975600416 (x 1.25ms): 2017-05-28 03:00:00'
+	Time source: 'device'
+	System time: '1474969500521 (ms): 2026-10-02 09:45:00'
+	User time: '2914775 (ms): 1980-01-06 00:48:34'
+=== nitz
+[/dev/wwan0qmi0] Successfully got network time:
+	3GPP Date:                            '2026-10-02'
+	3GPP Time:                            '09:45:00'
+	3GPP Day-of-Week:                     'friday'
+	3GPP Timezone Offset:                 '180' minutes
+	3GPP Daylight Saving Time Adjustment: '0' hours
+	3GPP Radio Interface:                 'lte'
+=== mmcli -m any
+  ----------------------------------
+  General  |                   path: /org/freedesktop/ModemManager1/Modem/0
+           |              device id: 7eea3e62ab14a18d5de1cf97053b7b043d75d6db
+  ----------------------------------
+  Hardware |           manufacturer: QUALCOMM INCORPORATED
+           |                  model: 0
+           |      firmware revision: MPSS.DPM.1.0.c7-00193-M8916EAAAANVZM-1  1  [Sep 09 2015 10:00:00]
+           |           h/w revision: 10000
+           |              supported: gsm-umts, lte
+           |                current: gsm-umts, lte
+           |           equipment id: <IMEI>
+  ----------------------------------
+  System   |                 device: qcom-soc
+           |                physdev: /sys/devices/platform/soc@0/4080000.remoteproc/4080000.remoteproc:bam-dmux
+           |                drivers: bam-dmux, qcom-q6v5-mss, rpmsg_ctrl
+           |                 plugin: qcom-soc
+           |           primary port: wwan0qmi0
+           |                  ports: wwan0 (net), wwan0at0 (at), wwan0at1 (at), wwan0qmi0 (qmi), 
+           |                         wwan1 (net), wwan2 (net), wwan3 (net), wwan4 (net), wwan5 (net), 
+           |                         wwan6 (net), wwan7 (net)
+           |          ignored ports: rpmsg_ctrl1 (unknown)
+  ----------------------------------
+  Status   |                   lock: sim-pin2
+           |         unlock retries: sim-pin (3), sim-puk (10), sim-pin2 (1), sim-puk2 (10)
+           |                  state: connected
+           |            power state: on
+           |            access tech: lte
+           |         signal quality: 68% (recent)
+  ----------------------------------
+  Modes    |              supported: allowed: 2g; preferred: none
+           |                         allowed: 3g; preferred: none
+           |                         allowed: 4g; preferred: none
+           |                         allowed: 2g, 3g; preferred: 3g
+           |                         allowed: 2g, 3g; preferred: 2g
+           |                         allowed: 2g, 4g; preferred: 4g
+           |                         allowed: 2g, 4g; preferred: 2g
+           |                         allowed: 3g, 4g; preferred: 4g
+           |                         allowed: 3g, 4g; preferred: 3g
+           |                         allowed: 2g, 3g, 4g; preferred: 4g
+           |                         allowed: 2g, 3g, 4g; preferred: 3g
+           |                         allowed: 2g, 3g, 4g; preferred: 2g
+           |                current: allowed: 4g; preferred: none
+  ----------------------------------
+  Bands    |              supported: egsm, dcs, pcs, g850, utran-1, utran-3, utran-5, utran-8, 
+           |                         utran-2, eutran-1, eutran-2, eutran-3, eutran-5, eutran-7, eutran-8, 
+           |                         eutran-20, eutran-39, eutran-40
+           |                current: egsm, dcs, utran-1, utran-5, utran-8, eutran-1, eutran-3, 
+           |                         eutran-5, eutran-7, eutran-8, eutran-20, eutran-40
+  ----------------------------------
+  IP       |              supported: ipv4, ipv6, ipv4v6
+  ----------------------------------
+  3GPP     |                   imei: <IMEI>
+           |          enabled locks: fixed-dialing
+           |            operator id: 25099
+           |          operator name: Beeline
+           |           registration: home
+           |   packet service state: attached
+  ----------------------------------
+  3GPP EPS |   ue mode of operation: ps-2
+           |    initial bearer path: /org/freedesktop/ModemManager1/Bearer/0
+           | initial bearer ip type: ipv4v6
+  ----------------------------------
+  SIM      |       primary sim path: /org/freedesktop/ModemManager1/SIM/0
+  ----------------------------------
+  Bearer   |                  paths: /org/freedesktop/ModemManager1/Bearer/1
+=== mmcli -b 1
+  ----------------------------------------
+  General            |               path: /org/freedesktop/ModemManager1/Bearer/1
+                     |               type: default
+  ----------------------------------------
+  Status             |          connected: yes
+                     | disconnect request: no
+                     |          suspended: no
+                     |        multiplexed: no
+                     |          interface: wwan0
+                     |         ip timeout: 20
+  ----------------------------------------
+  Properties         |                apn: internet.beeline.ru
+                     |            roaming: allowed
+                     |            ip type: ipv4
+                     |       allowed-auth: pap
+                     |               user: beeline
+                     |           password: beeline
+  ----------------------------------------
+  IPv4 configuration |             method: static
+                     |            address: 10.41.212.24
+                     |             prefix: 28
+                     |            gateway: 10.41.212.25
+                     |                dns: 10.10.22.3, 194.186.191.1
+                     |                mtu: 1500
+  ----------------------------------------
+  Statistics         |         start date: 1970-01-01T00:01:17Z
+                     |           duration: 2820
+                     |           bytes rx: 18649
+                     |           bytes tx: 18475
+                     |           attempts: 1
+                     |     total-duration: 2820
+                     |     total-bytes rx: 18649
+                     |     total-bytes tx: 18475
+=== ip
+4: wwan0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
+    inet 10.41.212.24/28 scope global wwan0
+       valid_lft forever preferred_lft forever
+3: usb0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
+    inet 172.16.42.1/24 scope global usb0
+       valid_lft forever preferred_lft forever
+1.1.1.1 dev wwan0 scope link  src 10.41.212.24 
+10.10.22.3 dev wwan0 scope link  src 10.41.212.24 
+10.41.212.16/28 dev wwan0 scope link  src 10.41.212.24 
+77.88.8.8 dev wwan0 scope link  src 10.41.212.24 
+172.16.42.0/24 dev usb0 scope link  src 172.16.42.1 
+194.186.191.1 dev wwan0 scope link  src 10.41.212.24 
+=== pids
+MM=1655 rmtfs=1056 qmi-proxy=1701 telnetd=615 udevd=1613 dbus=1640 polkitd=1644
+PID   USER     COMMAND
+    1 root     {init} /bin/busybox sh /init
+    2 root     [kthreadd]
+    3 root     [pool_workqueue_]
+    4 root     [kworker/R-rcu_g]
+    5 root     [kworker/R-sync_]
+    6 root     [kworker/R-kvfre]
+    7 root     [kworker/R-slub_]
+    8 root     [kworker/R-netns]
+    9 root     [kworker/0:0-eve]
+   11 root     [kworker/0:0H-mm]
+   13 root     [kworker/R-mm_pe]
+   14 root     [ksoftirqd/0]
+   15 root     [rcu_preempt]
+   16 root     [rcu_exp_par_gp_]
+   17 root     [rcu_exp_gp_kthr]
+   18 root     [migration/0]
+   19 root     [cpuhp/0]
+   20 root     [cpuhp/1]
+   21 root     [migration/1]
+   22 root     [ksoftirqd/1]
+   24 root     [kworker/1:0H-kb]
+   25 root     [cpuhp/2]
+   26 root     [migration/2]
+   27 root     [ksoftirqd/2]
+   29 root     [kworker/2:0H-kb]
+   30 root     [cpuhp/3]
+   31 root     [migration/3]
+   32 root     [ksoftirqd/3]
+   33 root     [kworker/3:0-dev]
+   34 root     [kworker/3:0H-kb]
+   35 root     [kdevtmpfs]
+   36 root     [kworker/R-inet_]
+   37 root     [kworker/u17:0]
+   38 root     [oom_reaper]
+   39 root     [kworker/R-write]
+   40 root     [kcompactd0]
+   41 root     [ksmd]
+   42 root     [kworker/R-kbloc]
+   43 root     [kworker/R-kinte]
+   44 root     [kworker/R-tpm_d]
+   45 root     [kworker/R-edac-]
+   46 root     [kworker/R-devfr]
+   47 root     [watchdogd]
+   49 root     [kworker/R-quota]
+   50 root     [kworker/1:1-eve]
+   51 root     [kworker/u16:1-e]
+   52 root     [kswapd0]
+   53 root     [kworker/1:2-rcu]
+   54 root     [kworker/R-ipmi-]
+   56 root     [kworker/2:1-eve]
+   58 root     [kworker/R-nbd0-]
+   59 root     [kworker/R-nbd1-]
+   60 root     [kworker/R-nbd2-]
+   61 root     [kworker/R-nbd3-]
+   62 root     [kworker/R-nbd4-]
+   63 root     [kworker/R-nbd5-]
+   64 root     [kworker/R-nbd6-]
+   65 root     [kworker/R-nbd7-]
+   66 root     [kworker/R-nbd8-]
+   67 root     [kworker/R-nbd9-]
+   68 root     [kworker/R-nbd10]
+   69 root     [kworker/R-nbd11]
+   70 root     [kworker/R-nbd12]
+   71 root     [kworker/R-nbd13]
+   72 root     [kworker/R-nbd14]
+   73 root     [kworker/R-nbd15]
+   74 root     [irq/23-pm8941_p]
+   75 root     [irq/27-200f000.]
+   76 root     [kworker/R-mld]
+   77 root     [kworker/R-ipv6_]
+   79 root     [irq/29-smp2p-he]
+   80 root     [irq/30-smp2p-wc]
+   81 root     [irq/31-smsm]
+   82 root     [irq/32-smsm]
+   83 root     [irq/33-4a9000.t]
+   84 root     [sugov:0]
+   86 root     [kworker/2:4-mm_]
+   88 root     [kworker/0:2-eve]
+   90 root     [irq/36-q6v5 wdo]
+   91 root     [kworker/3:2-eve]
+   95 root     [irq/43-7824900.]
+   96 root     [kworker/R-sdhci]
+   97 root     [irq/35-mmc0]
+   98 root     [kworker/u16:6-e]
+   99 root     [kworker/R-ci_ot]
+  100 root     [kworker/R-mmc_c]
+  102 root     [kworker/0:1H-mm]
+  431 root     [kworker/3:2H-kb]
+  528 root     [kworker/1:1H-kb]
+  615 root     telnetd -l /bin/sh -b 172.16.42.1 -p 23
+ 1024 root     sh
+ 1056 root     rmtfs -r -P -s -v
+ 1613 root     udevd --daemon
+ 1632 root     [kworker/2:2H]
+ 1640 messageb dbus-daemon --system --fork
+ 1644 polkitd  /usr/lib/polkit-1/polkitd --no-debug
+ 1655 root     ModemManager --debug
+ 1701 root     /usr/libexec/qmi-proxy
+ 2355 root     /bin/sh
+ 6277 root     [kworker/u16:0-e]
+ 7393 root     /bin/sh
+ 7394 root     [setsid]
+ 7395 root     sh /tmp/b7b/run.sh 180
+ 7442 root     {ps} sh /tmp/b7b/run.sh 180
+=== state
+BEARER_CONNECTED
+=== aurora-modem status
+service: idle
+controller: BEARER_CONNECTED
+remoteproc: 4080000.remoteproc running (/sys/class/remoteproc/remoteproc0) fw=mba.mbn
+rmtfs:      pid='1056' writes_logged=1
+qmi dev:    /dev/wwan0qmi0  qmi-proxy='1701'
+daemons:    udevd='1613' dbus='1640' polkitd='1644' ModemManager='1655'
+  mm plugin: qcom-soc
+  mm primary port: wwan0qmi0
+  mm state: connected
+  mm power state: on
+  mm access tech: lte
+  mm signal quality: 68% (recent)
+  mm operator name: Beeline
+  mm registration: home
+  bearer 1:  Status connected: yes; interface: wwan0; address: 10.41.212.24;
+wwan:       wwan0 UP 10.41.212.24/28
+wwan up:    1 of 8
+routes:     1.1.1.1 dev wwan0 scope link  src 10.41.212.24 ;10.10.22.3 dev wwan0 scope link  src 10.41.212.24 ;10.41.212.16/28 dev wwan0 scope link  src 10.41.212.24 ;77.88.8.8 dev wwan0 scope link  src 10.41.212.24 ;194.186.191.1 dev wwan0 scope link  src 10.41.212.24 ;
+bam-dmux:   suspended active_ms=253147 suspended_ms=2671352 control=auto
+usb0:       172.16.42.1/24 route-to-host: 172.16.42.2 dev usb0  src 172.16.42.1 
+emmc:       writes_completed=0 sectors_written=0
+dmesg-errs: 0
+=== lifecycle.log (lines 35)
+[23.78] dbus started
+[23.79] polkitd started
+[23.81] ModemManager started pid 1655 (log mm-0.log)
+[64.08] MM modem 0 detected after 40.3s
+[64.19] STATE REGISTERED -> MM_READY
+[64.39] MM state disabled after 0.2s
+[64.54] mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=***,allowed-auth=pap,ip-type=ipv4"
+successfully connected the modem at bearer /org/freedesktop/ModemManager1/Bearer/1
+[75.03] MM state connected, registration: home
+[75.12] bearer 1: wwan0 10.41.212.24/28 gw 10.41.212.25 dns 10.10.22.3,194.186.191.1 mtu 1500
+[75.18] STATE MM_READY -> BEARER_CONNECTED
+[75.19] === START OK in 66.0s (wwan0 10.41.212.24/28, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+=== service.log
+[75.12] bearer 1: wwan0 10.41.212.24/28 gw 10.41.212.25 dns 10.10.22.3,194.186.191.1 mtu 1500
+[75.18] STATE MM_READY -> BEARER_CONNECTED
+[75.19] === START OK in 66.0s (wwan0 10.41.212.24/28, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+=== service start rc=0 75.20
+=== mm-0.log tail
+<<<<<<   type       = "Result" (0x02)
+<<<<<<   length     = 4
+<<<<<<   value      = 00:00:00:00
+<<<<<<   translated = SUCCESS
+<<<<<< TLV:
+<<<<<<   type       = "Rx Bytes Ok" (0x1a)
+<<<<<<   length     = 8
+<<<<<<   value      = <qmi-hex-redacted>
+<<<<<<   translated = 18649
+<<<<<< TLV:
+<<<<<<   type       = "Tx Bytes Ok" (0x19)
+<<<<<<   length     = 8
+<<<<<<   value      = <qmi-hex-redacted>
+<<<<<<   translated = 18475
+
+=== dmesg (lines 307) tail
+[   23.514939] udevd[1612]: specified group 'disk' unknown
+[   23.519851] udevd[1612]: specified group 'cdrom' unknown
+[   23.551312] udevd[1613]: starting eudev-3.2.14
+[   23.903741] [aurora-modem] udevd started
+[   23.932827] [aurora-modem] dbus started
+[   23.947416] [aurora-modem] polkitd started
+[   23.967962] [aurora-modem] ModemManager started pid 1655 (log mm-0.log)
+[   64.238698] [aurora-modem] MM modem 0 detected after 40.3s
+[   64.344390] [aurora-modem] STATE REGISTERED -> MM_READY
+[   64.541211] [aurora-modem] MM state disabled after 0.2s
+[   64.691746] [aurora-modem] mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=***,allowed-auth=pap,ip-type=ipv4"
+[   75.186676] [aurora-modem] MM state connected, registration: home
+[   75.274432] [aurora-modem] bearer 1: wwan0 10.41.212.24/28 gw 10.41.212.25 dns 10.10.22.3,194.186.191.1 mtu 1500
+[   75.333458] [aurora-modem] STATE MM_READY -> BEARER_CONNECTED
+[   75.344271] [aurora-modem] === START OK in 66.0s (wwan0 10.41.212.24/28, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+[  705.308687] [r3b-obs] 704.75 host=up lte=ok state=BEARER_CONNECTED wwan0=unknown,10.41.212.24/28 usb0=172.16.42.1/24,c1 mm=1655 rmtfs=1056 am=0 lc=35
+[  813.987553] [r3b-obs] 813.46 host=up lte=ok state=BEARER_CONNECTED wwan0=unknown,10.41.212.24/28 usb0=172.16.42.1/24,c1 mm=1655 rmtfs=1056 am=0 lc=35
+[  858.212885] [r3b-obs] 856.82 host=DOWN lte=ok state=BEARER_CONNECTED wwan0=unknown,10.41.212.24/28 usb0=172.16.42.1/24,c1 mm=1655 rmtfs=1056 am=0 lc=35
+[  917.169032] [r3b-obs] 916.87 host=up lte=ok state=BEARER_CONNECTED wwan0=unknown,10.41.212.24/28 usb0=172.16.42.1/24,c1 mm=1655 rmtfs=1056 am=0 lc=35
+[ 2843.198629] [b7b] B7B BEGIN obs=180s floor=1790928541 ntp=89.109.251.21
+[ 2843.205875] [b7b] usleep ok
+[ 2844.069262] [b7b] pre snapshot done
+[ 2844.274504] [b7b] time source checks FAILED - STOP, clock not changed
+[ 2882.926846] [b7b] B7B BEGIN obs=180s floor=1790928541 ntp=89.109.251.21
+[ 2882.934696] [b7b] usleep ok
+[ 2883.796954] [b7b] pre snapshot done
+[ 2884.007841] [b7b] checks PASS, DMS offset vs clock 1790931373.043243 s
+[ 2884.014221] [b7b] DRY RUN: stop before clock step
+[ 2924.676568] [b7b] B7B BEGIN obs=180s floor=1790928541 ntp=89.109.251.21
+[ 2924.684406] [b7b] usleep ok
--- a/logs/b7/b7b/b7b-time-source.txt
+++ b/logs/b7/b7b/b7b-time-source.txt
@ -0,0 +1,16 @@
+DMS1 2928.345208 2928.380753 1474969501406
+DMS2 2928.389913 2928.425289 1474969501451
+DMS3 2928.434283 2928.469983 1474969501496
+NITZ 2928.479445 2928.514873 2026-10-02 09:45:01 epoch=1790934301
+DMS1 utc=1790934301.406 window=35.5ms offset_vs_clock=1790931373.043
+DMS2 utc=1790934301.451 window=35.4ms offset_vs_clock=1790931373.043
+DMS3 utc=1790934301.496 window=35.7ms offset_vs_clock=1790931373.044
+NITZ epoch=1790934301 offset_vs_clock=1790931372.503
+CHECK all values present: PASS 
+CHECK DMS >= image build 2026-10-02T08:09:01Z (1790928541): PASS
+CHECK year >= 2026: PASS
+CHECK not garbage (< build + 5 y; 1980/2017 excluded by floor): PASS
+CHECK 3 DMS samples consistent (spread 0.8 ms < 50): PASS
+CHECK |DMS - NITZ| = 0.541 s < 2: PASS
+BEST DMS2 offset=1790931373.043399
+VERDICT=GO
--- a/logs/b7/b7b/date-s.out
+++ b/logs/b7/b7b/date-s.out
@ -0,0 +1 @@
+Fri Oct  2 09:45:03 UTC 2026
--- a/logs/b7/b7b/dms-raw.txt
+++ b/logs/b7/b7b/dms-raw.txt
@ -0,0 +1,45 @@
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975601124 (x 1.25ms): 2017-05-28 03:00:01'
+	Time source: 'device'
+	System time: '1474969501406 (ms): 2026-10-02 09:45:01'
+	User time: '2915660 (ms): 1980-01-06 00:48:35'
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975601160 (x 1.25ms): 2017-05-28 03:00:01'
+	Time source: 'device'
+	System time: '1474969501451 (ms): 2026-10-02 09:45:01'
+	User time: '2915705 (ms): 1980-01-06 00:48:35'
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975601196 (x 1.25ms): 2017-05-28 03:00:01'
+	Time source: 'device'
+	System time: '1474969501496 (ms): 2026-10-02 09:45:01'
+	User time: '2915750 (ms): 1980-01-06 00:48:35'
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975603124 (x 1.25ms): 2017-05-28 03:00:03'
+	Time source: 'device'
+	System time: '1474969503905 (ms): 2026-10-02 09:45:03'
+	User time: '2918159 (ms): 1980-01-06 00:48:38'
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975603161 (x 1.25ms): 2017-05-28 03:00:03'
+	Time source: 'device'
+	System time: '1474969503952 (ms): 2026-10-02 09:45:03'
+	User time: '2918206 (ms): 1980-01-06 00:48:38'
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975603198 (x 1.25ms): 2017-05-28 03:00:03'
+	Time source: 'device'
+	System time: '1474969503998 (ms): 2026-10-02 09:45:03'
+	User time: '2918252 (ms): 1980-01-06 00:48:38'
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975764301 (x 1.25ms): 2017-05-28 03:02:44'
+	Time source: 'device'
+	System time: '1474969705377 (ms): 2026-10-02 09:48:25'
+	User time: '3119631 (ms): 1980-01-06 00:51:59'
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975764336 (x 1.25ms): 2017-05-28 03:02:44'
+	Time source: 'device'
+	System time: '1474969705420 (ms): 2026-10-02 09:48:25'
+	User time: '3119674 (ms): 1980-01-06 00:51:59'
+[/dev/wwan0qmi0] Time retrieved:
+	Time count: '1179975764370 (x 1.25ms): 2017-05-28 03:02:44'
+	Time source: 'device'
+	System time: '1474969705462 (ms): 2026-10-02 09:48:25'
+	User time: '3119716 (ms): 1980-01-06 00:51:59'
--- a/Show more
+++ b/Show more