# B8F cache write — preflight (2026-10-03)

## Candidate
`cache-extlinux-b8f.img` **857c9c30…** (134217728 B, ext2, label aurora-b8f), built on 480s by `mkfs-cache-b8f.sh` = exact B7C recipe
(only kernel/fdt/initrd files, label, UUIDs differ). Rebuild bit-identical; `e2fsck -fn` clean. **Contains the AP PSK (initramfs) — never publish.**

| file | B7C (current, 14fe453a) | B8F (candidate) |
|---|---|---|
| Image.gz-dtb | 0ff9c802 golden mm1 (bam1 kernel + mm1 DTB) | 50d63488 = B8D (b8d kernel be30b1fa: bam1 + WCNSS_PIL + WLAN/CFG80211/MAC80211/WCN36XX) + B8B DTB |
| fdt | aurora-mm1.dtb a10056c5 | aurora-b8f.dtb cc74b57d (= B8B: wcnss okay, wcnss_mem 0x8b600000/6 MiB, iris wcn3620) |
| initrd | initramfs-b7c f219b04d | initramfs-b8f abb3bd67 = B8D initramfs (B7C + NV c6b71825 + iw/libnl) + overlay b5a6b087 |
| append | `earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init` | identical |

Overlay: `/init` (T4 13721ca5 + 2 lines: aurora-wifi autostart under the same RO gates, +1 comment line), `/usr/sbin/aurora-wifi`,
`/etc/init.d/aurora-wifi`, `/etc/aurora/wifi.conf` (0600, PSK from private/), `/usr/libexec/aurora/wifi/{hostapd,lib/*}` (B8E bundle).

## Evidence before the write
- RAM pre-test `aurora-b8f.img` 355cc3bb (same kernel/DTB/initramfs as the candidate) via fastboot, ram1 class A: START OK 82.2 s,
  autostart `AP ENABLED` 86.5 s, SNTP +0.37 s, phone WPA2/CCMP connected and held 204+ s, Pronto crash 0, LTE OK, eMMC w=0.
- lk2nd emulator: S5 regression on current flash (B7C) == b7/b7c emu; S6 candidate: "Trying to boot 'b8f'", kernel be30b1fa (23955464 B,
  image_size 0x1760000, end DDR+0x1760000), DTB cc74b57d @DDR+0x20AA000, ramdisk abb3bd67 @DDR+0x22AA000 — no overlap; F1/F3/F10 → android boot (emmc1).

## Write / rollback
`B8F-write.sh` = B7C-write.sh with only image/hashes/rollback refs/log dir changed (diff in session). Gates: loader, candidate sha+size,
rollback image b7c 14fe453a + B7C readback backup, 9008, identity/geometry, GPT==A3, boot==emmc1, aboot==lk1st-autoboot, **live cache == B7C 14fe453a**
(pre-write readback saved as `logs/b8/b8f/W/pre-cache.bin` = backup). Write cache only → readback cmp → verify all other partitions → B8F_WRITE_VERIFIED.
Rollback: `B8F-rollback.sh` → B7C cache (HW EDL). Entry: HW EDL (battery on, D+→GND, plug USB, release).

## After the write
3 normal cold boots (no RESET), each: power off ≥ 90 s → normal power-on → `b8f-boot.sh K cold` → phone connects to `aurora-b8f`.