public-readiness: scrub internal details, split licensing, hosted kernel-build

Preparing the repo to go public (ADR-0007): - CI: kernel-build moves from the self-hosted runner to ubuntu-latest (installs its own cross toolchain + qemu, caches the pristine tarball). On a public repo a registered self-hosted runner is reachable from approved fork-PR workflows — i.e. arbitrary code on private infrastructure — and the build never actually needed the SDK host. ADR-0004 marked superseded-in-part; docs/ci-cd.md rewritten (site specifics now live only in the private deployment log). - Licensing: LICENSE gains the GPL-2.0 carve-out for patches/ and the kernel source excerpts (Linux derivatives; per-driver provenance was already tracked in PROVENANCE.md); patches/README.md states it too. - Scrubbed from the tip: bench-unit dev credentials and its gadget IP (m2-boot notes), the site AP SSID+BSSID and a neighboring AP's BSSID and the device WLAN MAC (wifi bring-up evidence — BSSIDs are geolocatable), the runner mesh IP. NOTE: these remain in git history; decision on a pre-publication history rewrite is separate. - Emoji cleanup across 21 tracked files (kernel port docs, review report, enforce-mcdc.sh) per repo text conventions: status marks became [x]/[wip]/[ ]/OK plain text. - "[maintainer]-gated" process phrasing normalized to "maintainer-gated" (attributions in dated evidence docs kept). Verified: zero emojis tracked; scrub grep clean; patches carry no internal references; ci.yml parses; shellcheck unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
2026-08-30 07:25:57 -06:00
parent fea36faaec
commit 5155224594
33 changed files with 213 additions and 172 deletions
@@ -7,9 +7,10 @@ findings — they worked on the first hardware try.**

 ## The safe test path (A/B slot _b, never touch _a)

-c8a3 is the XPS-connected Warden: eth0 `[bench-ip]` over USB-gadget ([bench-creds],
-dropbear — use `scp -O`, no sftp-server), plus the serial console on xps
-`/dev/ttyUSB2` @115200 and Zigbee power (`plug_cmd.py cycle`). It runs an A/B
+c8a3 is the desk-connected bench Warden: reachable over its USB-gadget ethernet
+(dev-build dropbear; address and bench credentials live in the private
+deployment notes — use `scp -O`, no sftp-server), plus the serial console at
+115200 and remotely switchable power. It runs an A/B
 firmware (boot_a=mmcblk0p5 / boot_b=mmcblk0p6, 32 MiB each; rootfs_a/_b; AvbABData
 in `misc` sector 4 / byte 2048).

@@ -51,7 +52,7 @@ With the correct format, U-Boot loaded my kernel + my DTB and printed my DT mode
 string (`Model: WardenOS 86-Panel (RV1106) — M2 earlycon bring-up`), then
 `Starting kernel ...`.

-## Result: ✅ M2 achieved — the 6.18 kernel boots on hardware
+## Result: [x] M2 achieved — the 6.18 kernel boots on hardware

 Six attempts, each auto-recovering to `_a`, then a clean boot:

@@ -84,7 +85,7 @@ pre-MMU), then fixed:
 CP2102 bench adapter — so the M2 DT pins 115200 for readable bring-up; production
 overrides to 1.5M.

-## M3 (same session): ✅ the full WardenOS runs on the 6.18 kernel
+## M3 (same session): [x] the full WardenOS runs on the 6.18 kernel

 Adding the eMMC `dw_mmc` node (`mmc@ffa90000`, clocks from cru + grf_cru) was the
 only change M3 needed — the mmc/ext4 drivers are already in-config. The kernel
@@ -96,7 +97,8 @@ won't load (vermagic → M5), and there's no backlight/framebuffer yet (→ M4).

 **Console lesson applied:** with `console=ttyS2,115200` the whole boot is readable
 on the CP2102 (the 1.5M vendor rate is garbage on it). Serial login uses the same
-`c8a3_run.py` [bench-creds] helper as the 5.10 firmware — the userspace is unchanged.
+`c8a3_run.py` helper (dev-build bench credentials, see private deployment notes)
+as the 5.10 firmware — the userspace is unchanged.

 Next: M4 (VOP2 display + panel + touch), M5 (AIC8800 SDIO port + our 4 patches),
 M6 (RGA/watchdog/HPMCU/USB-OTG); plus a lean defconfig + Buildroot-on-6.18 cleanup.
@@ -4,44 +4,44 @@ Every block in the vendor SoC DT (`rv1106.dtsi`), classified. Goal: a 6.18 drive
 for every capability the hardware actually has, open-source, verified. Camera/ISP
 is the only whole class deliberately skipped — the 86-Panel has no camera.

-## ✅ Done / at parity (verified on warden-c8a3)
+## Done / at parity (verified on warden-c8a3)
 CRU clk · pinctrl (+ioc/pmuioc) · GIC · arch timer · pl330 DMA · 8250 uart (×3) ·
 dw_mmc eMMC · i2c · dw-wdt · **RTC** · **tsadc** · **RGA** (rga2, hw 3.3.87975) ·
 PWM backlight · **USB host** (dwc3/xhci) + usb2phy · grf/pmu syscons.

-## ✅ Verified this run (2026-08-25) — all on warden-c8a3, self-built 6.18.46
+## Verified this run (2026-08-25) — all on warden-c8a3, self-built 6.18.46
 - **AIC8800 wifi** — wlan0 up, scanned the site AP at −43 dBm (modules; `wifi/VERIFIED-on-c8a3.md`).
 - **TRNG** — /dev/hwrng, real HW entropy (`rng-otp/`).
 - **OTP/nvmem** — rockchip-otp0 reads chip id (`rng-otp/`).
 - **GMAC** — eth0 Link Up 100 Mbps/Full (`gmac/`).
 - **SARADC** — iio:device0 reads 2 ch; the −22 was vref, not clk (`adc/SARADC-FIX.md`).

-## ✅ VOP display — VERIFIED this run (2026-08-25)
+## VOP display — VERIFIED this run (2026-08-25)
 Full WardenOS Dashboard renders on the 86-Panel on 6.18 (`_b`), webcam-verified,
 pixel-identical to stock `_a`. Two VOP driver bugs were the final black-screen
 cause: `rgb_dclk_pol` hardcoded inverted (panel needs 0), and the wrong primary
 scanout window (rv1106 uses **WIN1**, not rv1126's WIN2). Full chain + `_a`-vs-`_b`
 register diff in `display/VERIFIED.md`.

-## ✅ GT911 touch — VERIFIED this run (2026-08-25)
+## GT911 touch — VERIFIED this run (2026-08-25)
 UI responds to taps/swipes on the panel ([maintainer]-confirmed); GT911 detected
 (`ID 911, version 1060`), `/dev/input/event0` held by warden-ui. Fix:
 `CONFIG_TOUCHSCREEN_GOODIX=y` (built-in — the rootfs `goodix.ko` is a 5.10 build
 that can't load on 6.18) + GT911 node on `&i2c3`. Details in `touch/VERIFIED.md`.

-## 🔨 In flight
+## In flight
 - **i2s-tdm** — DAI builds; needs the codec + card (below).
 - **AIC8800 BT** — module built (6.18 vermagic); HCI bring-up not yet exercised.

-## ✅ audio — VERIFIED this run
+## audio — VERIFIED this run
 card `rv1106-acodec` + pcmC0D0p/c (`audio/`); audible test @ bench with display.

 ## Remaining blocks — final status (all real capabilities now verified)
 | Block | verdict | note |
 |---|---|---|
-| **mailbox** (HPMCU) | ✅ VERIFIED | A7↔RISC-V-SCR1 round-trip, 5/5 exact echoes (`mailbox/VERIFIED.md`). Took 3 hardware-found fixes: rv1106 num_chans=1 (1 shared IRQ, not 4), CLK_CORE_MCU IGNORE_UNUSED (6.18 was gating the coprocessor clock), + an open SCR1 echo firmware with A2B_INTEN. The /dev/mem SRAM watchdog stays as a separate dead-man's-switch. |
-| **NPU** (rknpu) | ✅ open driver VERIFIED; compute deferred | open GPL rknpu 0.9.2 driver, /dev/dri/card1, version ioctl PASS (`npu/VERIFIED.md`). Open *compute* (a regcmd compiler) is a from-scratch ~person-year register-RE project — no RV1106 prior art, no public TRM Part 2, mainline accel/rocket+Teflon are RK3588-only. Ship the driver, no blob. |
-| **pvtm** | ✅ VERIFIED | both core+pmu PVT monitors probe; debugfs ring-osc reads (`pvtm/PORT-DONE.md`). |
+| **mailbox** (HPMCU) | VERIFIED | A7↔RISC-V-SCR1 round-trip, 5/5 exact echoes (`mailbox/VERIFIED.md`). Took 3 hardware-found fixes: rv1106 num_chans=1 (1 shared IRQ, not 4), CLK_CORE_MCU IGNORE_UNUSED (6.18 was gating the coprocessor clock), + an open SCR1 echo firmware with A2B_INTEN. The /dev/mem SRAM watchdog stays as a separate dead-man's-switch. |
+| **NPU** (rknpu) | [x] open driver VERIFIED; compute deferred | open GPL rknpu 0.9.2 driver, /dev/dri/card1, version ioctl PASS (`npu/VERIFIED.md`). Open *compute* (a regcmd compiler) is a from-scratch ~person-year register-RE project — no RV1106 prior art, no public TRM Part 2, mainline accel/rocket+Teflon are RK3588-only. Ship the driver, no blob. |
+| **pvtm** | VERIFIED | both core+pmu PVT monitors probe; debugfs ring-osc reads (`pvtm/PORT-DONE.md`). |
 | **crypto-v3** (accel) | deferred (documented) | ~100 KB whole-subsystem replacement of mainline's rk3288 crypto + heavy crypto-API deltas; the **CPU crypto extensions (AES/SHA, batch2 =y) already cover the functional need** — an offload optimization, not a capability gap. |
 | camera/ISP, SPI | N/A | no such hardware on the 86-Panel. |

@@ -51,7 +51,7 @@ deferred item is the crypto *accelerator* (CPU crypto already covers it) and ope
 NPU *compute* (a person-year RE effort, scoped in `npu/OPEN-NPU-PLAN.md`). No
 unexplored gap remains.

-## ❌ Not applicable (no hardware on the 86-Panel)
+## Not applicable (no hardware on the 86-Panel)
 cif · csi2-dphy · mipi-csi2 · rkisp (all camera/ISP) · SPI (no on-board SPI device).

 ## Order (after wifi)
@@ -3,47 +3,47 @@
 Goal: every driver the panel's 5.10 kernel runs must work at ≥ parity on our
 self-built 6.18. Source of truth = the running 5.10 system on warden-c8a3
 (`lsmod` + `/proc/interrupts`, captured 2026-08-24). Verify each on hardware via
-the A/B `_b`-slot loop (`../docs/m2-boot-on-c8a3.md`); ✅ means confirmed on
+the A/B `_b`-slot loop (`../docs/m2-boot-on-c8a3.md`); [x] means confirmed on
 c8a3, not just compiled.

 | Driver / node | 5.10 evidence | mainline? | 6.18 status |
 |---|---|---|---|
-| CRU clock (clk-rv1106) | — | ported | ✅ M2 |
-| pinctrl-rockchip (rv1106) | — | ported | ✅ M2 |
-| GIC-400 / arch_timer | arch_timer | mainline | ✅ M2 |
-| dw_mmc (eMMC) | dw-mci | mainline | ✅ M3 |
-| 8250 uart2 (console) | ttyS2 | mainline | ✅ M2 |
-| GPIO (rockchip, ×5 banks) | gpio-rockchip | mainline | ✅ batch1 (chips 0–4) |
-| DMA (pl330, ff420000) | ff420000.dma-controller | mainline | ✅ batch1 |
-| uart1 / uart4 | ttyS1, ttyS4 | mainline | ✅ batch1 |
-| I2C (dw-apb, ff460000=i2c3) | ff460000.i2c | mainline | ✅ batch1 (i2c-3) |
-| watchdog (dw-wdt, ff5a0000) | ff5a0000.watchdog | mainline | ✅ batch1 (watchdog0) |
-| tsadc thermal (ff3c8000) | rockchip_thermal | ported (data+init+macros) | ✅ soc-thermal reads 39.8°C |
-| SARADC (ff3c0000) | ff3c0000.saradc | ported (2-ch v2 data) | ✅ iio:device0 reads 2ch (adc-keys); fixed -22 via vref-supply |
-| TRNG (rng@ff448000) | rockchip,trngv1 | mainline (rk3588 IP) | ✅ /dev/hwrng, real entropy (`rng-otp/`) |
-| OTP/nvmem (ff3d0000) | rockchip,rv1106-otp | ported (px30_otp_read) | ✅ rockchip-otp0, reads chip id |
-| GMAC (ffa80000) | rockchip,rv1106-gmac | ported (dwmac-rk rv1106_ops) | ✅ eth0 Link Up 100M/Full (`gmac/`) |
-| GPIO_SYSFS (legacy /sys/class/gpio) | — | mainline (config) | ⬜ goodix script needs it |
-| PWM (rockchip) | — | mainline (=m) | ⬜ batch2 =y (backlight) |
-| RTC (rv1106-rtc) | — | ported (vendor driver) | ✅ /dev/rtc0 registers + reads |
-| USB2 phy (inno, rv1106) | rockchip_usb2phy_* | ported (data, no tuning) | ✅ probes → USB up |
-| USB host (DWC3→xhci, ffb00000) | xhci-hcd:usb1 | mainline | ✅ xhci host registered |
-| USB OTG gadget (DWC3, eth0) | eth0 | mainline dwc3 | 🔨 host works; eth0 needs dr_mode=peripheral |
-| crypto (aes/ccm/ctr/arc4) | modules | mainline | ⬜ batch2 (config =y) |
-| PSCI node (removed) | — | — | ✅ deleted (no secure monitor → SMC fault) |
-| VOP display (ff990000) | ff990000.vop | ported (rv1126 sibling) | 🔨 binds+DRM+card0; connector WIP |
-| PWM backlight (pwm1) | — | mainline (rk3328 fallback) | ✅ backlight up (brightness) |
-| RGB666 720×720 panel | — | panel-dpi | 🔨 probes; bus_format + connector WIP |
-| GT911 touch (goodix) | goodix, gt911 | mainline | ⬜ M4 (needs GPIO_SYSFS ✅ + node) |
-| GPIO_SYSFS / crypto / CFG80211 | — | mainline (config) | ✅ =y (batch2) |
-| AIC8800 wifi (bsp/fdrv) | aic8800_* | **out-of-tree** | ✅ M5 — wlan0 up, scanned the site AP at −43dBm (modules, `wifi/VERIFIED-on-c8a3.md`) |
-| AIC8800 BT (btlpm) | aic8800_btlpm | **out-of-tree** | 🔨 module built (6.18 vermagic); HCI bring-up not yet exercised |
-| NPU (rknpu, ff660000) | rknpu, ff660000.npu | **out-of-tree** | 🔨 M6 built, 0 errors/0 warnings, 99 `rknpu`-prefixed symbols in `System.map`, `&npu {status="okay"}` in the dtb — **not yet flashed/probed on hardware** (build-only session; see `npu/PORT-PROGRESS.md`) |
-| RGA 2D (rga2) | rga2 | ported (vendor char-dev) | ✅ /dev/rga, hw 3.3.87975 |
-| I2S audio (i2s-tdm) | i2s | rv1126 fallback (=y) | ✅ cpu DAI registers (part of the card below) |
-| Audio codec (acodec) | rockchip,rv1106-codec | ported (rv1106_codec.c) | ✅ card `rv1106-acodec`, pcmC0D0p/c (`audio/`); audible test @ bench |
-| HPMCU mailbox (ff5c0000) | rockchip,rv1106-mailbox | rk3368 fallback +rv1106 num_chans=1 | ✅ A7<->SCR1 round-trip, 5/5 exact (`mailbox/VERIFIED.md`) |
-| PVTM (core+pmu ring-osc) | rockchip,rv1106-*-pvtm | ported (vendor, no mainline) | ✅ both probe; debugfs reads (`pvtm/`) |
-| FIQ debugger (ttyFIQ0) | fiq_glue | rockchip | ⬜ optional (we use ttyS2) |
+| CRU clock (clk-rv1106) | — | ported | [x] M2 |
+| pinctrl-rockchip (rv1106) | — | ported | [x] M2 |
+| GIC-400 / arch_timer | arch_timer | mainline | [x] M2 |
+| dw_mmc (eMMC) | dw-mci | mainline | [x] M3 |
+| 8250 uart2 (console) | ttyS2 | mainline | [x] M2 |
+| GPIO (rockchip, ×5 banks) | gpio-rockchip | mainline | [x] batch1 (chips 0–4) |
+| DMA (pl330, ff420000) | ff420000.dma-controller | mainline | [x] batch1 |
+| uart1 / uart4 | ttyS1, ttyS4 | mainline | [x] batch1 |
+| I2C (dw-apb, ff460000=i2c3) | ff460000.i2c | mainline | [x] batch1 (i2c-3) |
+| watchdog (dw-wdt, ff5a0000) | ff5a0000.watchdog | mainline | [x] batch1 (watchdog0) |
+| tsadc thermal (ff3c8000) | rockchip_thermal | ported (data+init+macros) | [x] soc-thermal reads 39.8°C |
+| SARADC (ff3c0000) | ff3c0000.saradc | ported (2-ch v2 data) | [x] iio:device0 reads 2ch (adc-keys); fixed -22 via vref-supply |
+| TRNG (rng@ff448000) | rockchip,trngv1 | mainline (rk3588 IP) | [x] /dev/hwrng, real entropy (`rng-otp/`) |
+| OTP/nvmem (ff3d0000) | rockchip,rv1106-otp | ported (px30_otp_read) | [x] rockchip-otp0, reads chip id |
+| GMAC (ffa80000) | rockchip,rv1106-gmac | ported (dwmac-rk rv1106_ops) | [x] eth0 Link Up 100M/Full (`gmac/`) |
+| GPIO_SYSFS (legacy /sys/class/gpio) | — | mainline (config) | [ ] goodix script needs it |
+| PWM (rockchip) | — | mainline (=m) | [ ] batch2 =y (backlight) |
+| RTC (rv1106-rtc) | — | ported (vendor driver) | [x] /dev/rtc0 registers + reads |
+| USB2 phy (inno, rv1106) | rockchip_usb2phy_* | ported (data, no tuning) | [x] probes → USB up |
+| USB host (DWC3→xhci, ffb00000) | xhci-hcd:usb1 | mainline | [x] xhci host registered |
+| USB OTG gadget (DWC3, eth0) | eth0 | mainline dwc3 | [wip] host works; eth0 needs dr_mode=peripheral |
+| crypto (aes/ccm/ctr/arc4) | modules | mainline | [ ] batch2 (config =y) |
+| PSCI node (removed) | — | — | [x] deleted (no secure monitor → SMC fault) |
+| VOP display (ff990000) | ff990000.vop | ported (rv1126 sibling) | [wip] binds+DRM+card0; connector WIP |
+| PWM backlight (pwm1) | — | mainline (rk3328 fallback) | [x] backlight up (brightness) |
+| RGB666 720×720 panel | — | panel-dpi | [wip] probes; bus_format + connector WIP |
+| GT911 touch (goodix) | goodix, gt911 | mainline | [ ] M4 (needs GPIO_SYSFS [x] + node) |
+| GPIO_SYSFS / crypto / CFG80211 | — | mainline (config) | [x] =y (batch2) |
+| AIC8800 wifi (bsp/fdrv) | aic8800_* | **out-of-tree** | [x] M5 — wlan0 up, scanned the site AP at −43dBm (modules, `wifi/VERIFIED-on-c8a3.md`) |
+| AIC8800 BT (btlpm) | aic8800_btlpm | **out-of-tree** | [wip] module built (6.18 vermagic); HCI bring-up not yet exercised |
+| NPU (rknpu, ff660000) | rknpu, ff660000.npu | **out-of-tree** | [wip] M6 built, 0 errors/0 warnings, 99 `rknpu`-prefixed symbols in `System.map`, `&npu {status="okay"}` in the dtb — **not yet flashed/probed on hardware** (build-only session; see `npu/PORT-PROGRESS.md`) |
+| RGA 2D (rga2) | rga2 | ported (vendor char-dev) | [x] /dev/rga, hw 3.3.87975 |
+| I2S audio (i2s-tdm) | i2s | rv1126 fallback (=y) | [x] cpu DAI registers (part of the card below) |
+| Audio codec (acodec) | rockchip,rv1106-codec | ported (rv1106_codec.c) | [x] card `rv1106-acodec`, pcmC0D0p/c (`audio/`); audible test @ bench |
+| HPMCU mailbox (ff5c0000) | rockchip,rv1106-mailbox | rk3368 fallback +rv1106 num_chans=1 | [x] A7<->SCR1 round-trip, 5/5 exact (`mailbox/VERIFIED.md`) |
+| PVTM (core+pmu ring-osc) | rockchip,rv1106-*-pvtm | ported (vendor, no mainline) | [x] both probe; debugfs reads (`pvtm/`) |
+| FIQ debugger (ttyFIQ0) | fiq_glue | rockchip | [ ] optional (we use ttyS2) |

-Legend: ✅ verified on hardware · 🔨 built, not yet verified · ⬜ not started.
+Legend: [x] verified on hardware · [wip] built, not yet verified · [ ] not started.
@@ -4,10 +4,10 @@ Goal ([maintainer]): port/enable **every** remaining RV1106 hardware capability
 self-built Linux 6.18.46, open-source-first, verify on hardware, so the display's
 last mile can start in the morning. Runs on warden-c8a3 (`_b` slot = our 6.18).

-## ✅ Verified on hardware this run
+## Verified on hardware this run
 | Driver | Evidence |
 |---|---|
-| **AIC8800 wifi** (M5) | wlan0 up ([device-mac]), `iw scan` found the site AP −43 dBm + others. Modules (built-in deadlocks the two-stage SDIO bring-up). |
+| **AIC8800 wifi** (M5) | wlan0 up, `iw scan` found the site AP at −43 dBm + others. Modules (built-in deadlocks the two-stage SDIO bring-up). |
 | **TRNG** | `/dev/hwrng`, `rng_current=rockchip-rng`, real entropy. |
 | **OTP/nvmem** | `rockchip-otp0` reads chip id ("MR1"). |
 | **GMAC** (wired eth) | `eth0: Link is Up - 100 Mbps/Full`. |
@@ -20,7 +20,7 @@ from the **vendor 5.10.160** tree, no plan44 code, built with our
 - rv1106's siblings **rv1126/rv1108 exist in both trees**, so their 5.10→6.18 delta is a
  working template for the framework API changes.

-## M1 — clock driver (`clk-rv1106.c`, 1294 lines): ✅ COMPILES CLEAN on 6.18
+## M1 — clock driver (`clk-rv1106.c`, 1294 lines): [x] COMPILES CLEAN on 6.18
 Build-fix loop against 6.18 — `clk-rv1106.o` (85732 bytes) builds with no errors.
 Fixed (captured in `clk/`):
 1. **Kconfig + Makefile hooks** — added `CONFIG_CLK_RV1106` (mirrors CLK_RV1126).
@@ -31,7 +31,7 @@ Fixed (captured in `clk/`):
 4. **`rockchip_clk_register_armclk` signature change** — 5.10 took
   `(num_parents, parent_clk, alt_parent_clk)`; 6.18 takes `(parent_names[], num_parents)`
   and drives the mux from `reg_data.mux_core_main/alt`. Adapted the call to the 6.18 form
-   using a parent-names array (sibling-delta from rv1126). **⚠ PORT-VERIFY**: the mux input
+   using a parent-names array (sibling-delta from rv1126). **PORT-VERIFY**: the mux input
   list `{ "gpll","cpll","apll" }` and the `mux_core_main/alt=2` mapping are a best-effort
   from the 5.10 intent (main=apll) — they set the **CPU clock source**, so they must be
   checked against the RV1106 `CORECLKSEL_CON` register map (TRM) and validated on hardware
@@ -39,9 +39,9 @@ Fixed (captured in `clk/`):

 5. **`CLK_FRAC_DIVIDER_NO_LIMIT`** — Rockchip downstream-only frac-divider flag (6 uses on
   the UART frac clocks); mainline has no min/max opt-out, mapped to 0 (default limit).
-   **⚠ PORT-VERIFY**: UART fractional baud accuracy.
+   **PORT-VERIFY**: UART fractional baud accuracy.

-## M1 — pinctrl (`pinctrl-rockchip.c/.h`): ✅ COMPILES CLEAN on 6.18
+## M1 — pinctrl (`pinctrl-rockchip.c/.h`): [x] COMPILES CLEAN on 6.18
 `pinctrl-rockchip.o` (173688 bytes) builds no-errors. Transplanted from vendor 5.10 (effort S,
 zero API drift — the survey's assessment held): added `RV1106` to the type enum; a 159-line
 block of `RV1106_DRV/PULL/SMT_*` macros + 3 `rv1106_calc_*_reg_and_bit()` functions; `case
@@ -58,12 +58,12 @@ RV1106:` in the 3 pull functions + the RK3568 drive-strength group; `rv1106_pin_
 - **Still PORT-VERIFY:** GPIO4 bank pin-count (`pin_banks` says 24, DT `gpio-ranges` says 32) —
  carried from vendor unchanged; needs TRM/hardware.

-## M1 — mach: ✅ DONE
+## M1 — mach: DONE
 `mach-rockchip` RV1106/RV1103 SoC recognition added as a DT-compat entry (no
 `CPU_RV1106` symbol recreated). Captured as `mach/0001-rv1106-soc-recognition.patch`.
 **M1 is complete: clk + pinctrl + mach all compile clean on 6.18.**

-## M2 — earlycon build: ✅ DONE (boot pending hardware)
+## M2 — earlycon build: DONE (boot pending hardware)
 The first full kernel build with our SoC drivers, 2026-08-24:
 - **`multi_v7_defconfig` + `configs/m2-earlycon.fragment` builds an 11.8 MB zImage**
  with `clk-rv1106.o` (85732 B) and `pinctrl-rockchip.o` (173688 B, our rv1106 data)
@@ -80,7 +80,7 @@ The first full kernel build with our SoC drivers, 2026-08-24:
 console baud (1.5M assumed). A wrong DDR/clock value silently hangs before or just after
 earlycon.

-## M2 — boot: ✅ DONE — "it's alive" on warden-c8a3 (2026-08-24)
+## M2 — boot: DONE — "it's alive" on warden-c8a3 (2026-08-24)
 The self-built **Linux 6.18.46 boots on real RV1106 hardware**, through our ported
 drivers, verified over the serial console. It reaches earlycon, the arch timer
 (BogoMIPS calibrated), **our `clk-rv1106` CRU driver**, pinctrl, and the mainline
@@ -105,7 +105,7 @@ Three bring-up bugs were found and fixed on hardware, all captured in the DT:
 comes up far enough to clock the UART and the arch timer on hardware. A wrong CPU
 mux/PLL would show later (cpufreq / peripheral rates), still to be checked.

-## M3 — rootfs boot: ✅ DONE — the full WardenOS runs on the 6.18 kernel (2026-08-24)
+## M3 — rootfs boot: DONE — the full WardenOS runs on the 6.18 kernel (2026-08-24)
 Adding the eMMC (`dw_mmc`) node to the DT was all M3 needed — the drivers are already
 in the config. On hardware:
 ```
@@ -1,4 +1,4 @@
-# SARADC — ✅ VERIFIED on warden-c8a3 (2026-08-25); the -22 was vref, not clk
+# SARADC — VERIFIED on warden-c8a3 (2026-08-25); the -22 was vref, not clk

 The rockchip_saradc probe failed `-22` NOT at clk_set_rate (no "failed to set
 adc clk rate" ever printed) but at `regulator_get_voltage(info->vref)` — with no
@@ -224,7 +224,7 @@ stuck in `deferred probe pending: asoc-simple-card: parse error`, no card.
 i2s0_8ch node already carries the `rockchip,rv1126-i2s-tdm` fallback compatible +
 `#sound-dai-cells=<0>`, so the mainline driver binds it).

-**✅ VERIFIED on c8a3:** `/proc/asound/cards` → `0 [rv1106acodec]: simple-card -
+**VERIFIED on c8a3:** `/proc/asound/cards` → `0 [rv1106acodec]: simple-card -
 rv1106-acodec`; `aplay -l` → `card 0: rv1106acodec, device 0:
 ffae0000.i2s-rv1106-hifi`; `/dev/snd/` has `controlC0 pcmC0D0p pcmC0D0c` (playback
 + capture). Audible speaker test deferred to the bench (with the display).
@@ -39,7 +39,7 @@ rockchip-drm display-subsystem: bound ff990000.vop
 brightness settable). **The VOP driver port is validated** — the register data,
 version, feature, and resets are right.

-## ✅ RESOLVED — full UI renders on the panel (2026-08-25)
+## RESOLVED — full UI renders on the panel (2026-08-25)

 The connector *and* the deeper black-screen chain that followed it are fixed; the
 86-Panel now draws the full WardenOS Dashboard on 6.18 (`_b`), verified by webcam.
@@ -1,4 +1,4 @@
-# Display (VOP + RGB panel) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# Display (VOP + RGB panel) — VERIFIED on warden-c8a3 (2026-08-25)

 The 86-Panel renders the **full WardenOS Dashboard UI** on our self-built Linux
 6.18.46 (`_b` slot), pixel-identical to the stock 5.10 `_a` slot. Verified by
@@ -1,4 +1,4 @@
-# GMAC (wired 10/100 ethernet) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# GMAC (wired 10/100 ethernet) — VERIFIED on warden-c8a3 (2026-08-25)

 **Result: `eth0: Link is Up - 100Mbps/Full - flow control rx/tx`** on our
 self-built 6.18.46. The 86-Panel's RMII MAC + on-die 10/100 FEPHY works; a real
@@ -1,4 +1,4 @@
-# HPMCU mailbox — ✅ 100% VERIFIED on warden-c8a3 (2026-08-25)
+# HPMCU mailbox — [x] 100% VERIFIED on warden-c8a3 (2026-08-25)

 A fully-open A7 ↔ HPMCU (RISC-V SCR1) hardware-mailbox round-trip on our self-built
 Linux 6.18.46. Open kernel driver + open SCR1 firmware, **zero blobs**.
@@ -7,11 +7,11 @@ Linux 6.18.46. Open kernel driver + open SCR1 firmware, **zero blobs**.
 SCR1 echo firmware running: `DBG_STATE = 0x584F424D` ("MBOX"). Five round-trips,
 Linux → mailbox → SCR1 → mailbox → Linux, **all exact**:
 ```
-sent 0x0000beef/0x600df00d -> B2A 0x0000BEEF/0x600DF00D  e=4  ✓
-sent 0x0000c0de/0x12345678 -> B2A 0x0000C0DE/0x12345678  e=5  ✓
-sent 0x0000face/0xdeadbeef -> B2A 0x0000FACE/0xDEADBEEF  e=6  ✓
-sent 0x00001234/0xcafef00d -> B2A 0x00001234/0xCAFEF00D  e=7  ✓
-sent 0x0000aa55/0x55aa55aa -> B2A 0x0000AA55/0x55AA55AA  e=8  ✓
+sent 0x0000beef/0x600df00d -> B2A 0x0000BEEF/0x600DF00D  e=4  OK
+sent 0x0000c0de/0x12345678 -> B2A 0x0000C0DE/0x12345678  e=5  OK
+sent 0x0000face/0xdeadbeef -> B2A 0x0000FACE/0xDEADBEEF  e=6  OK
+sent 0x00001234/0xcafef00d -> B2A 0x00001234/0xCAFEF00D  e=7  OK
+sent 0x0000aa55/0x55aa55aa -> B2A 0x0000AA55/0x55AA55AA  e=8  OK
 ```
 Echo counter increments 1:1 with sends; both CMD and DAT echo back verbatim.

@@ -8,7 +8,7 @@ target as the rest of this port: **Linux 6.18.46 vanilla**
 (`flare-edge/research/linux-6.18.46/`), forward-ported from vendor 5.10.160, built
 with our `arm-rockchip830-...-gcc 8.3` toolchain — see `../PORT-STATUS.md` and
 `../../docs/bringup.md` for the method and milestones this slots into (M6, listed
-in `../DRIVER-PARITY.md` as "NPU (rknpu, ff660000) | out-of-tree | ⬜ M6").
+in `../DRIVER-PARITY.md` as "NPU (rknpu, ff660000) | out-of-tree | [ ] M6").

 Builds on `warden-sdk/docs/npu-graphics-feasibility.md`, which already read this
 same driver source to answer a narrower question (can the NPU do graphics — no).
@@ -331,6 +331,6 @@ the value of checking the decoded string, not just the ioctl return code.

 ## Also updated this session

-`../DRIVER-PARITY.md`'s NPU row: `⬜ M6 — plan: npu/PORT-PLAN.md` -> `🔨 M6 built,
+`../DRIVER-PARITY.md`'s NPU row: `[ ] M6 — plan: npu/PORT-PLAN.md` -> `[wip] M6 built,
 0 errors/0 warnings, 99 rknpu-prefixed symbols in System.map, &npu
 {status="okay"} in the dtb — not yet flashed/probed on hardware`.
@@ -1,4 +1,4 @@
-# NPU (rknpu) open kernel driver — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# NPU (rknpu) open kernel driver — VERIFIED on warden-c8a3 (2026-08-25)

 The open GPL rknpu kernel driver runs on our self-built Linux 6.18.46. This is the
 achievable open end state (Tier A in `OPEN-NPU-PLAN.md`); open *compute* remains a
@@ -1,4 +1,4 @@
-# PVTM (Process-Voltage-Temperature Monitor) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# PVTM (Process-Voltage-Temperature Monitor) — VERIFIED on warden-c8a3 (2026-08-25)

 Whole-driver port: mainline 6.18 has **no** rockchip pvtm driver; the vendor
 `drivers/soc/rockchip/rockchip_pvtm.c` (GPL-2.0, 1046L) supports rv1106. Copied it in
@@ -294,8 +294,8 @@ implied by this kernel port.
 - **CMA pool sizing** — 10 MiB was sized against the 5.10 image's actual usage (graph
  canvas + scanout mirror at 720×720×4B ≈ 2 MiB each); carry the same size unless a
  future accounting shows it's tight.
- **Driver-parity table** (`../DRIVER-PARITY.md`) should move `RGA 2D (rga2)` from ⬜ to
-  🔨/✅ as these steps land, same convention as every other M-milestone row.
+- **Driver-parity table** (`../DRIVER-PARITY.md`) should move `RGA 2D (rga2)` from [ ] to
+  [wip]/[x] as these steps land, same convention as every other M-milestone row.

 ## Sources

@@ -1,6 +1,6 @@
 # TRNG + OTP port (batch A) — 6.18

-## TRNG (hardware RNG) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+## TRNG (hardware RNG) — VERIFIED on warden-c8a3 (2026-08-25)
 rv1106's `rockchip,trngv1` is the same standalone TRNG_V1 IP as rk3588 (identical
 register map). Mainline `drivers/char/hw_random/rockchip-rng.c` already drives it.

@@ -21,7 +21,7 @@ rv1106's clock/reset names need no special handling.) Kconfig
 `dd if=/dev/hwrng bs=16` → `c697 503d f9db 6b84 50e4 e1ee f232 b2ae` (real HW
 entropy, non-zero). Hardware entropy source for the panel's crypto/keys.

-## OTP / nvmem — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+## OTP / nvmem — VERIFIED on warden-c8a3 (2026-08-25)
 Reads real data: `dd .../rockchip-otp0/nvmem bs=1 count=16 | xxd` →
 `5211 02fe 084d 5231 0000 0000 3b15 0000` (contains "MR1" chip id) — no timeout.
 Mainline `drivers/nvmem/rockchip-otp.c` gains an `rv1106_data` + compatible.
@@ -1,4 +1,4 @@
-# GT911 capacitive touch — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# GT911 capacitive touch — VERIFIED on warden-c8a3 (2026-08-25)

 Touch works on our self-built 6.18.46 (`_b`): the WardenOS UI responds to
 taps/swipes ([maintainer] confirmed on the physical panel). Objective evidence:
@@ -120,7 +120,7 @@ cfg80211.ko → libarc4.ko → ctr.ko → ccm.ko → libaes.ko → aes_generic.k
 see `insmod_wifi.sh:126-137` and `wifi-bluetooth-aic8800.md`); nothing to
 replicate there. The crypto modules (arc4/ctr/ccm/aes) are dependencies of the
 driver's internal key-handling, not aic8800-specific — confirm they're already
-`=y`/reachable in the 6.18 config (crypto is currently listed as "⬜ batch2" in
+`=y`/reachable in the 6.18 config (crypto is currently listed as "[ ] batch2" in
 `../DRIVER-PARITY.md`; flip alongside this work).

 **DT node — correction to the task's framing.** The task description assumed
@@ -295,7 +295,7 @@ No breaking changes found in `sdio_driver`, `sdio_claim_host`/`release_host`,
 `sdio_readb`/`writesb`, `sdio_set_block_size` between 5.10 and 6.18 (low
 research depth on this axis — treat as low-risk, smoke-test rather than
 line-audit). The mainline `dw_mmc`/`dw_mmc-rockchip` host driver is already
-proven on 6.18 for eMMC (`../DRIVER-PARITY.md`: `dw_mmc (eMMC) | mainline | ✅ M3`)
+proven on 6.18 for eMMC (`../DRIVER-PARITY.md`: `dw_mmc (eMMC) | mainline | [x] M3`)
 and `CONFIG_MMC_DW_ROCKCHIP=y` is already in the live `.config` — the SDIO
 *controller* side of this port is de-risked; only the AIC8800 *card driver*
 above the `sdmmc` bus is new work.
@@ -410,7 +410,7 @@ CONFIG_BT_HCIUART_H4=y       # already =y (H4 is the transport this board's BT a
                              #   per hardware-86-panel.md: UART1/ttyS1, hciattach -s 1500000
                              #   ... any 1500000 flow nosleep)
 CONFIG_CRYPTO_ARC4=y CONFIG_CRYPTO_CTR=y CONFIG_CRYPTO_CCM=y CONFIG_CRYPTO_AES=y  # driver's
-                              #   internal key-handling deps, currently "⬜ batch2" in
+                              #   internal key-handling deps, currently "[ ] batch2" in
                              #   ../DRIVER-PARITY.md — confirm =y, not =m, alongside this work
 ```
 Do **not** enable `CONFIG_MAC80211` for this driver — confirmed by source
@@ -537,7 +537,7 @@ Follow the existing A/B `_b`-slot hardware-verification loop
   attaches and `hciattach -s 1500000 /dev/ttyS1 any 1500000 flow nosleep`
   (the known-good invocation) brings up an HCI device.
 8. **Update on landing**: mark the `AIC8800 wifi (bsp/fdrv)` and
-   `AIC8800 BT (btlpm)` rows in `../DRIVER-PARITY.md` ✅, with the same
+   `AIC8800 BT (btlpm)` rows in `../DRIVER-PARITY.md` [x], with the same
   "hardware-verified, not just compiled" bar every other row uses.

 ## Sources
@@ -10,10 +10,10 @@ live RF scan.
  `Start app: 00120000`, BSP_RC=0.
 - `insmod aic8800_fdrv.ko` → `ieee80211 phy0: HT supp 1, VHT supp 1, HE supp 1`,
  FDRV_RC=0.
- `wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> ... link/ether [device-mac]`
- `iw dev wlan0 scan` found real APs:
-  - **the site AP  [bssid]  2412 MHz  −43 dBm**
-  - a neighboring guest AP  [bssid]  2412 MHz  −73 dBm
+- `wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> ... link/ether <device MAC>`
+- `iw dev wlan0 scan` found real APs (SSIDs/BSSIDs redacted for publication):
+  - **the site AP at 2412 MHz, −43 dBm**
+  - a neighboring guest AP at 2412 MHz, −73 dBm
  - +several more, correct signal strengths → RF path fully functional.

 ## Why MODULES, not built-in (=y)