Sources: where the evidence comes from, and how to read it

Compiled 2026-11-04, 1:59 PM ET from the research and recon notes, and from the 2026-11-04 session’s lookups. This is an index: each claim lives in the note that cites it (last column), and a new finding goes there, not here. Primary sources only. News coverage of the Googlebook exists in recon notes, but it is never the authority for a claim (CLAUDE.md, “Docs conventions”).

How to read them

Source	Works	Blocked or flaky, and the way round
Kernel source and docs at the pin	the local tree `~/.cache/gbook/linux-a804c57` (cite `file:line`); github.com/torvalds/linux at `a804c5742bff`; the GitHub compare API for “is X after the pin”	git.kernel.org sits behind a bot check (Anubis)
LKML threads	lkml.rescloud.iu.edu and lists.infradead.org pipermail; keep the lore Message-ID	lore.kernel.org sits behind Anubis (README, “Reading upstream”)
Patch state (series, versions, review)	the patchwork REST API: `https://patchwork.kernel.org/api/series/<id>/`, `/api/patches/?msgid=<id>` (read 2026-11-04 for 0002-0006 and 0008)	the patchwork web UI sits behind Anubis
Mesa	the GitLab API: `https://gitlab.freedesktop.org/api/v4/projects/176/merge_requests/<n>`; release notes at docs.mesa3d.org/relnotes
Debian packages	qa.debian.org/madison.php, sources.debian.org API, snapshot.debian.org and its `API` file, metasnap.debian.net; manpages.debian.org and raw files on salsa.debian.org (apt, devscripts)	snapshot.debian.org answered 503/504 three times on 2026-11-04 (m3-rootfs); keep a local `.deb` cache. At 3:33 PM ET [20:33 UTC] the same day snapshot.debian.org answered and snapshot-cloudflare.debian.org gave 503 through the same Varnish/Fastly chain (rootfs-pinning). Debian publishes no limit figures; `snapshot.debian.org/news/` and `/doc/api/` are 404 (the front page and the salsa `API` file hold that content)
GNU manuals	gnu.org/software/tar/manual	answered 429 three times on 2026-11-04; `tar --help` on the build host gives the option semantics (rootfs-pinning)
Arch and Omarchy packages	`pacman -Si` / `pacman -Qi` live on the build host; pkgs.omarchy.org (aarch64); omacom/omarchy-pkgs PKGBUILDs	no dated archive for Arch Linux ARM (m3-rootfs)
GitHub repos and releases	`gh api repos/<o>/<r>/releases/latest`, `gh api repos/<o>/<r> --jq .license.spdx_id`
Busybox in the initramfs	Debian’s busybox config: salsa.debian.org installer-team/busybox, `debian/config/pkg/static`
Valve’s SteamOS ARM (Steam Frame) sources (2026-11-05 lookups)	`gitlab.steamos.cloud` through its API: `https://gitlab.steamos.cloud/api/v4/projects/<id>/repository/{tree,files/<path>/raw,commits}` (public projects, no token); the package servers’ directory listings and pacman databases: `holo-packages.steamos.cloud/archlinux-deckard/archlinux/main/{core,extra}/os/aarch64/*.db.tar.xz` and `.files.tar.xz`, `archlinux-deckard-hotfixes/` (Valve’s own packages, one repo per merge request); `steamdeck-images.steamos.cloud/recovery/` (the Frame repair image and the QDL package, 4 GB each, not downloaded); release-note bodies from the Steam news API `api.steampowered.com/ISteamNews/GetNewsForApp/v2/?appid=4165890&maxlength=0` (the store pages render by JS); Valve’s private kernel tree’s commits resolve through GitHub’s fork network: `gh api repos/torvalds/linux/commits/<sha>` and `compare/v7.2...<sha>`; `partner.steamgames.com` pages through firecrawl	GitLab blob search needs a token (401); the package servers’ roots answer 401 (go straight to the repo paths); `steamdeck-packages` is x86_64 only; GitHub’s `search/commits?q=hash:` does not find fork-network commits; the downloaded `atomupd` and `custom` packages carry a CI credential and Valve’s RAUC certificate, so nothing from them goes into the repo (gitleaks passed on the note)
Nura (postmarketOS) and its GitLab (2026-11-05 lookups)	`gitlab.postmarketos.org` redirects (308) to `gitlab.nura.eco`; pmaports is project 226 there: `https://gitlab.nura.eco/api/v4/projects/226/merge_requests/<n>`, `/repository/files/<path>/raw?ref=`; the wiki pages (`wiki.postmarketos.org`) by title; Anton Bambura’s kernel tree on gitlab.com: `https://gitlab.com/api/v4/projects/jenneron%2Flinux/repository/commits/<sha>` and `/files/<path>/raw?ref=<sha>`	`projects/postmarketOS%2Fpmaports` answers a 301 to the id; use the id
The Googlebook itself	live reads through the `gbook` skill (adb, SuzyQ consoles), dated in `docs/recon/`

By topic

Topic	Primary sources	Cited in
Boot chain: depthcharge, FIT, vboot, GPT	chromium.googlesource.com, chromium.org developer library, depthcharge-tools	chromeos-boot-path, fit-packaging, el2-handoff
Recovery image, stock OS	dl.google.com/device/recovery, support.google.com/googlebook, source.android.com	stock-dtb, ADR 0001
Hardware and sibling boards	Dell XPS 13 9345 manuals, mainline `x1e80100-dell-xps13-9345.dts`, Linaro arm64-laptops, aarch64-laptops, jglathe/linux_ms_dev_kit, dwhinham/linux-surface-pro-11	9345-dts-diff, console-kernel-config
SCMI, CPUCP, idle	the kernel source at the pin; LKML threads by Message-ID (Johan Hovold, Sibi Sankar)	scmi-cpucp-timeouts, scmi-cpucp-stall-report, ADR 0009
Qualcomm downstream audio drivers (CodeLinaro `audio-kernel-ar`)	the GitLab API: `https://git.codelinaro.org/api/v4/projects/clo%2Fla%2Fplatform%2Fvendor%2Fqcom%2Fopensource%2Faudio-kernel-ar/repository/files/soc%2F<file>/raw?ref=audio-kernel.lnx.6.0.r67-rel` (`/repository/tree?path=soc&ref=…` lists a folder); save downloads in their own scratch folder and read them with `sed -n` or `rtk rg`	the `-/raw/` web URLs answered 429 on 2026-11-05
Is there an upstream fix for a driver (quick read)	patchwork’s search: `https://patchwork.kernel.org/api/patches/?q=soundwire%3A+qcom&order=-date&per_page=40` (`/api/patches/<id>/` holds `content` and `diff`); a file’s torvalds history: `gh api 'repos/torvalds/linux/commits?path=drivers/soundwire/qcom.c&per_page=10'` (read 2026-11-05 for patch 0010)	both miss a fix that is only in a maintainer tree’s `next` branch (git.kernel.org sits behind Anubis)
Local patches’ upstream state	patchwork API; omacom/omarchy-pkgs `linux-omarchy-aarch64`	line 1 of each `kernel/patches/*.patch`, ADR 0007
Kernel process, versions, milestones	`Documentation/process/*` at the pin (`submitting-patches.rst`, `coding-assistants.rst`, `maintainer-soc.rst`); semver.org, calver.org, keepachangelog.com; Asahi feature support; Nura (postmarketOS) docs	milestones-versioning, ADR 0010, ADR 0011
Rootfs, Mesa, userspace (M3)	Mesa MRs and release notes; Debian, Ubuntu and Fedora package pages; ghostty.org docs, Ghostty release tarballs; Omarchy’s aarch64 repo	m3-rootfs
Pinned, reproducible rootfs builds (M3)	snapshot.debian.org and metasnap; the Debian man pages for mmdebstrap, debsnap, debootsnap, debrebuild, apt, dpkg-query, dpkg-scanpackages, apt-ftparchive, diffoscope, mke2fs; the mmdebstrap script; apt and devscripts source on salsa; tytso/e2fsprogs source and release notes; reproducible-builds.org (SOURCE_DATE_EPOCH spec, system images), reproduce.debian.net; Isar, Debusine, live-build, debos, ELBE and meta-debian docs; the isar-users list	rootfs-pinning
Reaching the booted rootfs (M3)	the build host’s man pages for openssh 10.6p1 and systemd 262.1 (the sid arm64 versions; Debian’s copies at manpages.debian.org/unstable): sshd_config, sshd, ssh_config, ssh, ssh-keygen, systemd-journal-upload, systemd-journal-remote, journal-upload.conf, journal-remote.conf, journalctl, journald.conf, machine-id, systemd.unit, systemd.socket, systemd-ssh-generator, systemd.system-credentials; Debian packaging on salsa (ssh-team/openssh `debian/systemd/*`, `openssh-server.postinst`, `rules`, `patches/debian-config.patch`; systemd-team/systemd `debian/systemd.postinst`); systemd/systemd at `v262` (`src/ssh-generator/ssh-generator.c`, `src/core/main.c`, `src/core/manager.c`, `src/basic/initrd-util.c`) and `v259` (`src/core/import-creds.c`); the mmdebstrap script (cleanup list); madison and the packages.debian.org file lists; the pinned kernel tree (`Documentation/usb/gadget_configfs.rst`, `gadget-testing.rst`, `bindings/usb/usb-drd.yaml`, `drivers/usb/dwc3/`, `x1e001de-devkit.dts`) and the built `.config`; live reads on the build host (`ss -ltn`, `systemctl cat`, `modinfo`)	rootfs-access
Terminal tools on the build host (2026-11-04 lookups)	TerminalTextEffects and its docs; Omarchy’s `ttfx` (omacom/ttfx, `pacman -Qi ttfx`); gum with colorprofile (NO_COLOR handling); no-color.org; fastfetch; Ghostty about / libghostty; Quickshell and quickshell.org	this file; the decisions are in the running log (the `follow` colour guard, check 36)
SteamOS on ARM, the Steam Frame (ideas for M4 and the rootfs)	Valve’s GitHub and gitlab.steamos.cloud projects, the package servers (pacman databases, ten packages read), the mainline `sm8650-valve-deckard.dts`, Valve’s kernel commits through GitHub, Steamworks partner docs and Steam Support pages, the Steam news API, Mesa and FEX upstream	steamos-arm.md
M4 return to stock, slot policy (planning)	the repo’s own notes at `firmware-bluey-16702.B` (fit-packaging.md section 5, chromeos-boot-path.md sections 2 to 6), ADRs 0001 to 0003 and 0010, the first-boot runbook, the unlock-day ticket, the project log’s relock and stick-tries rows	m4-recovery-matrix.md
Publishing the project (guide, site, wiki)	the repo’s own docs; Nura wiki device-page conventions and pmaports; aarch64-laptops, jhovold and jglathe repos; diataxis.fr; adr.github.io (MADR); creativecommons.org; each tool’s docs and release list (mdBook, MkDocs, Zola, Hugo, Quartz, Wiki.js, GitHub Pages, Forgejo, Codeberg)	public-writeup.md
Closed Case Debugging, the SuzyQ consoles	the GSC’s own `version` and `ccdstate` reads on the build host, the EC log, ChromiumOS CCD documentation	ccd-gsc.md
A silent first boot: ramoops, the firmware framebuffer, EC console, LED codes	depthcharge and coreboot source at their pins, AOSP, the stock DT	silent-boot-observation.md
Per-boot debug tools: SCMI and I2C trace, dyndbg, `attempt.sh trace`	the kernel tree at the pin (`Documentation/trace/`, the drivers’ trace points)	debug-tools.md
ASoC, SoundWire and audioreach debugging	the kernel tree at the pin (`sound/soc/`, `drivers/soundwire/`), CodeLinaro’s downstream `audio-kernel-ar`	asoc-debug-tools.md
Cloudflare for the public site and release artefacts (2026-11-05 lookups)	developers.cloudflare.com: every page also serves plain Markdown at `<page>/index.md`, and each product has an index at `<product>/llms.txt` (`/usr/bin/curl` into a scratch folder, then `rtk rg`); the API reference pages under `/api/resources/` name the permission groups each endpoint accepts; the Cloudflare blog for dated announcements (2025-04-08 on Pages and Workers, 2020-12-09 on Web Analytics); cloudflare.com/plans/sase-zero-trust for the Zero Trust seats; docs.github.com for the Pages custom-domain, HTTPS, verification, limits and releases pages	cloudflare.md

Keeping it current

A new research or recon note that relies on a new kind of source adds one row here, in the same commit.
A source that becomes blocked, or a new way round, is recorded in “How to read them”, with the date.

Keyboard shortcuts

gbook: mainline Linux on the Dell XPS Googlebook (mica)

Sources: where the evidence comes from, and how to read it

How to read them

By topic

Keeping it current