--- ../initramfs-usb1/init	2026-09-30 03:43:03.785764611 +0600
+++ init	2026-09-30 03:50:19.123970771 +0600
@@ -1,5 +1,6 @@
 #!/bin/busybox sh
-# Aurora RAM boot USB1 — diagnostics + USB NCM gadget (static 172.16.42.1/24).
+# Aurora RAM boot EMMC1 — USB1 + internal eMMC READ-ONLY verification.
+# NEVER mounts, fsck's, formats, trims or writes any mmcblk* device.
 # No block devices, no firmware, no radios. Never exits (failures leave the UART shell).
 /bin/busybox mkdir -p /proc /sys /dev /tmp /usr/bin /usr/sbin /sbin
 /bin/busybox --install -s
@@ -9,11 +10,48 @@
 mount -t configfs configfs /sys/kernel/config
 log() { echo "[init] $*"; echo "[init] $*" > /dev/kmsg 2>/dev/null; }
 echo
-echo "=== AURORA RAM BOOT USB1 ==="
+echo "=== AURORA RAM BOOT EMMC1 ==="
 uname -a
 echo "--- model";   cat /proc/device-tree/model; echo
 echo "--- cmdline"; cat /proc/cmdline
-echo "--- block devices (expected: none, eMMC disabled in DT)"; ls /sys/block
+
+emmc_ro() {
+	for i in $(seq 1 100); do [ -b /dev/mmcblk0 ] && break; sleep 0.1; done
+	if [ ! -b /dev/mmcblk0 ]; then log "EMMC: /dev/mmcblk0 did not appear"; return 1; fi
+	sleep 0.5	# let partition nodes settle
+	for d in /dev/mmcblk0 /dev/mmcblk0p* /dev/mmcblk0boot*; do [ -b "$d" ] && blockdev --setro "$d"; done
+	bad=0; n=0
+	for d in /dev/mmcblk0 /dev/mmcblk0p* /dev/mmcblk0boot*; do
+		[ -b "$d" ] || continue; n=$((n+1)); r=$(blockdev --getro "$d")
+		[ "$r" = "1" ] || { bad=1; log "EMMC-RO FAIL $d getro=$r"; }
+	done
+	echo "EMMC-RO-SUMMARY devices=$n all_ro=$([ $bad = 0 ] && echo YES || echo NO)"
+	[ $bad = 0 ] || return 2
+	log "EMMC: all $n block devices read-only (getro=1)"
+}
+emmc_report() {
+	echo "=== EMMC-INFO-BEGIN"
+	C=/sys/class/block/mmcblk0/device
+	for f in name manfid oemid cid date serial type; do echo "$f=$(cat $C/$f 2>/dev/null)"; done
+	echo "size_512=$(cat /sys/class/block/mmcblk0/size) logical_block=$(cat /sys/class/block/mmcblk0/queue/logical_block_size) bytes=$(blockdev --getsize64 /dev/mmcblk0)"
+	cat /proc/partitions
+	echo "=== EMMC-GPT-BEGIN (pN name start_512 size_512 ro)"
+	for p in /sys/class/block/mmcblk0p*; do
+		b=$(basename $p); nm=$(sed -n 's/^PARTNAME=//p' $p/uevent)
+		echo "$b $nm $(cat $p/start) $(cat $p/size) $(cat $p/ro)"
+	done
+	echo "=== EMMC-GPT-END"
+	echo "=== EMMC-SHA-BEGIN"
+	for want in sbl1 rpm DDR sec aboot hyp tz tzbak; do
+		for p in /sys/class/block/mmcblk0p*; do
+			nm=$(sed -n 's/^PARTNAME=//p' $p/uevent)
+			[ "$nm" = "$want" ] && echo "$nm $(basename $p) $(sha256sum /dev/$(basename $p) | cut -d' ' -f1)"
+		done
+	done
+	echo "=== EMMC-SHA-END"
+	echo "=== EMMC-INFO-END"
+}
+emmc_ro && EMMC_RO_OK=1	# RO FIRST, before anything else touches the disk
 
 usb_up() {
 	for i in $(seq 1 50); do
@@ -48,6 +86,8 @@
 	log "network: $ifc 172.16.42.1/24 up (static, no DHCP)"
 }
 usb_up || log "USB/NCM setup incomplete - staying on UART shell"
+
+if [ "$EMMC_RO_OK" = 1 ]; then emmc_report; else log "EMMC: RO not confirmed or device missing - NO further disk access"; fi
 echo "=== entering shell (exit restarts it) ==="
 while true; do
 	setsid cttyhack sh