[tatteredscroll]

Thanks again to Renate for all the help. Here is a write-up with help from AI on how it fixed it. I know people have strong feelings this way or that on AI. I'm thankful that it helped bring this device back to life.

The Note 2 is now up on stock `2024-01-03_07-30_3.5_1b692dcde`. Everything works, bootloader is still unlocked. I used the Universal Android Debloater Next-Gen to disable about 20 "apps", installed Nova Launcher.

## Why the earlier EDL flashes stopped short

We did get 9008, and the recovery write did succeed. `edl /w /precovery`, then `misc-recovery.prc`, then `edl /z` all reported ok, including with the custom recovery. After the reboot there was still no adb and no recovery menu. That part was real. It was not a bad flash and it was not a missing Windows driver.

UART at 115200 showed a normal Qualcomm boot into recovery: PBL, SBL1, ABL, unlocked, then the kernel with `is_recovery_mode: 1`. The misc boot command was `boot-recovery`. `misc-recovery.prc` sets that same command, so every reset was sent into recovery on purpose.

Recovery on this Note 2 starts the eink driver and then goes silent. USB loads and never enumerates. There is no menu to choose "wipe data" from, and adb never appears. Writing another recovery image still boots into that hang.

Clearing `boot-recovery` got one normal boot, and Android put the flag back by itself. Userdata had no ext4 superblock. This firmware treats that as a wiped encryptable data partition and writes `boot-recovery` plus `--wipe_data`. Recovery hung again before it formatted anything. So the usual "force recovery and let it wipe" path cannot finish on this unit. The filesystem has to be created from EDL, and misc has to be left empty.

The first empty ext4 used a 4 MB journal. Kernel 3.18 caps journal credits at `journal_blocks / 8`, which is 128. `installd` wanted 167 and died with error 28. That looks like a full disk. It is the journal refusing the transaction. A 64 MB journal on userdata (16 MB on cache) got past it. The new filesystem also has to be old-ext4: 4K blocks, no `metadata_csum` and no `64bit`.

The boot partition under all of that was still my old Magisk image from 13 Oct 2022. I think of that as the rooted 3.2 system. Wiping data removed `/data/adb`, but `magiskinit` was still there until 3.5 replaced boot. I did not use the on-device updater while that boot was installed. The updater checks the boot hash, and a mismatch writes `boot-recovery` again, which is the hang we already could not use.

## What actually got it to 3.5

EDL pads, same pair as in the photo markup: round gold pad (~1.8 V) and the empty square directly under it (~0 V), left edge of the lower shield, above the screw. Short only those two, and keep the short on through a long power hold. The red blink is 9008, not a low battery. The loader is bkerler's `000460e100290021_cc3153a80293939b_fhprg_peek.bin` . The OEM id in the name does not match this chip. The PK hash does.

From there: clear misc, build userdata and cache from EDL with a large enough journal, then install official 3.5 by writing boot, recovery, splash, vendor, and system. I did not write aboot, sbl1, or rpm. Stock 3.5 boot has no ramdisk, so Magisk is gone. `ro.boot.verifiedbootstate` is still orange.

The battery picture on the panel with USB plugged in is the sleep frame. A few seconds on the power button booted it. The build number matches the 3.5 package. USB debugging is under Apps, the three-line menu, App management. Tapping the build number does nothing.

I put the tablet on a guest SSID that can reach the internet and cannot reach the rest of the LAN. The first handwritten search wanted a network because the MyScript certificate check refuses to start offline. That check is small. The notes themselves stayed on the device. The Play Store was already in the 3.5 image. Once Wi-Fi was up it updated, and I signed in there. I have not created an Onyx account.