# B9C cache write — preflight (2026-10-03)

## Candidate
`cache-extlinux-b9c.img` **b9ce13c9…** (134217728 B, ext2, label aurora-b9c). Built on 480s by `mkfs-cache-b9c.sh` = exact B8F recipe;
only the kernel/fdt/initrd files, the append line, label and UUIDs differ. The rebuild is bit-identical and `e2fsck -fn` is clean.
**Contains the AP PSK (B8F initramfs) — never publish.** Component diff: `cache-diff-b8f-vs-b9c.txt`.

## Evidence before the write
- RAM pretest `aurora-b9c.img` fa855e1c uses the same kernel/DTB/initramfs/cmdline as the candidate. Run: fastboot, ram1, class A (RTC 6 s).
  - fbcon `21x16` (6x8) took over and the panel pipe came up by itself; `aurora-display` did no unblank, backlight on → DISPLAY READY at 8.0 s.
  - getty on tty1 (pid 624); hostname aurora; `/dev/console` = ttyMSM0 (console active `tty0 ttyMSM0`); UART shell on ttyMSM0.
  - START OK 69.2 s, AP ENABLED 73.5 s, MPSS/WCNSS running, display errors 0, eMMC w=0.
  - Operator: text visible and readable, orientation correct, no clipping; backlight OFF→ON via sysfs confirmed.
  - The login prompt scrolls away under later kernel messages (ignore_loglevel) — accepted (option A).
- lk2nd emulator (`emu/`):
  - S6 regression on the live B8F cache == the B8F emu run.
  - S7 candidate: "Trying to boot 'b9c'", kernel 3afc6c77 (24686600 B, image_size 0x1820000, ends at DDR+0x1820000),
    DTB 7ca9cc79 @DDR+0x20A9000, ramdisk ac518e27 @DDR+0x22A9000 — no overlap.
  - Fault variants F1/F3/F10 → android boot (emmc1 fallback).

## Write / rollback
`B9C-write.sh` = B8F-write.sh with only the image, expected hashes, rollback references and log dir changed.
Gates, in order:
- loader;
- candidate sha + size;
- rollback image B8F 857c9c30 and the B8F readback backup;
- 9008 present; identity/geometry;
- GPT == A3; boot == emmc1; aboot == lk1st-autoboot;
- **live cache == B8F 857c9c30** — the pre-write readback is saved as `logs/b9/b9c/W/pre-cache.bin` (backup).

Then: write cache only → readback cmp → verify every other partition → `B9C_WRITE_VERIFIED`.
Rollback: `B9C-rollback.sh` → B8F cache (via HW EDL). Entry: HW EDL (battery on, D+→GND, plug USB, release).

## After the write
3 normal class-A cold boots (no RESET, no fastboot, no UART input): power off ≥ 90 s → normal power-on → `b9c-boot.sh K cold`.
In one of them, check backlight ON → OFF → ON visually via `aurora-display bl` (sysfs).