[RyanTheTide]

Prepare J616S driver infrastructure while keeping native camera and streaming audio admission closed. The integrated kernel now has build, host-test and bounded ARM64 startup evidence under m1n1's hypervisor. Native peripheral operation of this integrated image remains unqualified; separate diagnostic native USB evidence is distinguished below.

The patch adds checked AOP boot-argument profiles and service retirement, a profile-pinned jack inspection child without PCM registration, checked ADMAC descriptor ranges, and reserved-firmware/IOMMU lifetime handling. ISP preparation adds explicit profile/IPC layouts, buffer ownership and retirement tracking, and checked video quiescence while retaining upstream genpd/syscore ownership and separate suspend/hibernation callbacks. The inherited USB2 PHY verifies bootloader-owned device-mode state without PHY/PIPE writes.

Hardware gates remain closed: there is no T6040 ISP parent OF match or enabled camera/audio DTS; selecting its ISP profile returns -EOPNOTSUPP. Jack inspection requires the machine, firmware/protocol/endpoint profile, provider admission and idle routes, and registers no PCM. USB2 requires explicit inherited handoff and does not qualify host transitions, hotplug, suspend or SuperSpeed. This patch adds no DCP hardware admission.

The branch preserves the preparation history and merges aurora-wip 27178c4 through 2bf2d1c. Commit 1522b0a corrects stale DART KUnit calls for the locked-root deferral API and checks that deferral, strict rejection and invalidation preserve unpublished firmware roots. Production barriers and hardware gates are unchanged.

Validation at this target snapshot:

• Full ARM64 Image and DART object compilation passed with the unchanged boot config. Image SHA256: 7746d86f1aa2d4d5d316a8759fd6f2fe93e4aafa3f33f17fa897f45267faa423; 9,756,680 file bytes and 10,420,224 runtime bytes. DART KUnit is disabled in this boot config, so the final test-only commit does not change the linked Image.

• Separate ARM64 brcmfmac PCIe, message-buffer and common-object compilation passed. This is compile coverage, not working Wi-Fi hardware or an enabled Wi-Fi device in the boot test.

• QEMU x86 ISP/AFK/IOMFB KUnit: 27/27 passed. ARM64 QEMU DART: corrected focused suite 10/10 passed; the unchanged firmware-leaf and 27 companion cases passed in the preceding ARM64 run. Failed x86 ARM-barrier and stale-expectation logs are retained; production barriers were not replaced with shims.

• Relevant host checks passed: 32 allocator/PTE paths, one AOP retirement case, five service-race cases and nine ISP wire fixtures. Previously qualified unaffected harnesses were not repeated. The known upstream Rust dead_code lint-expectation warning remains.

• On J616S, the exact new Image booted Linux 7.1.12+ under the existing 64 MiB RAM-only hypervisor DT/initramfs. CPU 0 reached a BusyBox shell; config SHA256 b73d6e295ea372082ea0b210cf97bac11f4dd147529dca7343995dbc4fe89101 matches the build. Timer IRQ 34 advanced 27→1280 over five seconds with zero interrupt errors, and sleep advanced uptime 5.18→7.18. The complete mount table contained only RAM/pseudo filesystems. This closed DT excludes physical USB, audio, ISP, DCP and Wi-Fi consumers.

• Separate native USB diagnostic evidence: the original pinned diagnostic kernel and initramfs produced two independent fresh-nonce UID0 commands over physical high-speed ACM bulk traffic after adding bank0/SID0 alongside bank1/SID1 to the generated RAM DT. A later diagnostic kernel returned another complete UID0 command with empty-transfer priming omitted, notifications suppressed and custom request deferral disabled, demonstrating its ordinary queue/kick path for one command. Both trials passed fresh ownership gates and natural watchdog recovery. ACM notifications were suppressed; this is not qualification of this PR Image, a sustained shell, normal ACM, ECM or SuperSpeed. Subsequent comparisons with notifications enabled, including the newly working skip-only setup, failed bounded ACM admission and recovered safely; the hardware cause remains unresolved. The binding documentation records both-bank topology and current handoff limits; no enabled production T6040/J616s DTS is added.

• Natural watchdog recovery restored m1n1. Fresh ADT, proxy connectivity and both disabled watchdogs were independently verified before retiring allocations. Installed images, boot policy, partitions and attached storage were preserved.

A 42-artifact manifest and six source pins retain the latest-base evidence under outputs/j616s-linux-latest-merge; the target transcript and recovery proof are under outputs/j616s-linux-latest-merge-hv-comparison. Earlier build and runtime evidence remain separate. Reliable normal native ACM/notifications, sustained USB and ECM, Wi-Fi, audio streaming, camera, display, SuperSpeed and a persistent Linux installation still require hardware validation before leaving draft.

Watchdog ownership follow-up (df475c5): the Apple watchdog now assigns its platform-device parent before registration and applies the configured nowayout policy. The exact two-line driver delta was built as ARM64 Image 7d4c272437e78cd70faebbd4570e5bc7a1170cb48fb0025cd0220f398dfaeaf5 and live-qualified on J616S in RAM-only Linux. Visible sysfs identity resolved to the primary 0x50836c000 watchdog, timeout30/nowayout1/bootfeedN/open10. Three separate bounded trials proved autonomous recovery after owner SIGKILL, deliberate host-heartbeat loss and an independent 20-second hard deadline; each returned to a fresh m1n1 generation with stable NOP/ADT/base and both watchdogs disabled. These trials used high-speed ACM with notifications suppressed and do not qualify normal notifications, a production shell, or SuperSpeed.

[RyanTheTide]

Closing this stale draft. The M4 Pro (J616s/T6040) line landed in integration/aurora through jgoyvaerts' series (#368 to #379, #383 to #387, #396) and the fixups in #392, #398 and #399, and the aurora-wip base is retired. The AOP jack, ISP profile and inherited USB2 pieces stay on j616s/linux-integration-next if we want them as a fresh PR on integration/aurora. Thanks!