diff --git a/images/build-emmc.sh b/images/build-emmc.sh
new file mode 100755
index 0000000..231be6a
--- /dev/null
+++ b/images/build-emmc.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+# Сборка emmc.img = Boot1 + Boot2 + RPMB + User. WIP без orig FFU.
+set -e
+BOOT_MB=${BOOT_MB:-4}
+RPMB_MB=${RPMB_MB:-4}
+USER_MB=${USER_MB:-7456}
+OUT=${1:-images/emmc.img}
+FW_DIR=fw
+
+usage() { echo "usage: $0 [--help] [out.img]"; echo "  Нужны fw/orig.ffu или fw/dump.bin. Без них — нулевой WIP-образ для проверки геометрии."; }
+
+if [ "$1" == "--help" ] || [ "$1" == "-h" ]; then usage; exit 0; fi
+mkdir -p "$(dirname "$OUT")"
+
+# WIP: пока нет orig FFU (2GB не влезет в 4.1G на сервере) — строим нулевой образ верной геометрии
+# Boot1/Boot2 кратно 128K, одинаковые. User кратно 512B.
+echo "[build-emmc] WIP: orig FFU не найден в $FW_DIR — строю нулевой образ геометрии"
+echo "[build-emmc] Положи в fw/orig.ffu и перезапусти для реальной GPT40"
+echo "[build-emmc] Boot=${BOOT_MB}M RPMB=${RPMB_MB}M User=${USER_MB}M -> $OUT"
+
+BOOT_KB=$((BOOT_MB*1024)); RPMB_KB=$((RPMB_MB*1024)); USER_KB=$((USER_MB*1024))
+TOTAL_KB=$((BOOT_KB*2+RPMB_KB+USER_KB))
+dd if=/dev/zero of="$OUT" bs=1K count=1024 status=none
+truncate -s "${TOTAL_KB}K" "$OUT"
+echo "[build-emmc] OK: $OUT ($(du -h "$OUT" | cut -f1)) — НУЛЕВОЙ, не шить в прод!"
+echo "[build-emmc] TODO: mkemmc.sh + ffureader GPT + CID Samsung + EXT_CSD REV5"
diff --git a/qemu/launch-wsl.sh b/qemu/launch-wsl.sh
new file mode 100755
index 0000000..130421c
--- /dev/null
+++ b/qemu/launch-wsl.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+# Запуск эмулятора под linux/amd64 (WSL). WIP: проверяет окружение, показывает команду.
+set -e
+if [ "$1" == "--help" ] || [ "$1" == "-h" ] || [ $# -eq 0 ]; then
+  cat <<'EOF'
+usage: ./qemu/launch-wsl.sh [--check|--dry-run]
+  --check    проверить qemu-system-arm, WSLg, образ
+  --dry-run  показать команду запуска (по умолчанию)
+Мобильное окно: portrait 720x1280, mouse=touch absolute, GTK.
+thor2/WDRT только из Windows-хоста через usbip (см. compat/).
+EOF
+  exit 0
+fi
+IMG=images/emmc.img
+echo "[launch] WIP dry-run:"
+echo "qemu-system-arm -M none -cpu cortex-a7 -m 1024 \\"
+echo "  -kernel qemu/pbl_stub.py \\"
+echo "  -drive file=$IMG,if=none,format=raw,id=emmc \\"
+echo "  -device sdhci-pci -device sd-card,drive=emmc \\"
+echo "  -serial stdio -display gtk,window-close=off"
+echo "[launch] ВНИМАНИЕ: -M none/saimaa еще нет, sdhci-pci временный (нужен platform 0x07824000)."
+echo "[launch] Видео WIP: ramfb 0x83000000, без virtio-gpu (палится)."
+if [ "$1" == "--check" ]; then ../lumia-emu/tools/check-env.sh 2>/dev/null || ./tools/check-env.sh; fi
diff --git a/qemu/lumia550.dts b/qemu/lumia550.dts
new file mode 100644
index 0000000..46417b8
--- /dev/null
+++ b/qemu/lumia550.dts
@@ -0,0 +1,100 @@
+/dts-v1/;
+
+/ {
+	model = "Microsoft Lumia 550 Saimaa RM-1127";
+	compatible = "microsoft,saimaa", "qcom,msm8909";
+	qcom,msm-id = <245 0>;
+	qcom,board-id = <0 0>;
+
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "earlycon console=ttyMSM0,115200n8";
+	};
+
+	memory@80000000 {
+		device_type = "memory";
+		reg = <0x80000000 0x40000000>; /* 1GB, верх обрезан HLOS */
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		qseecom@87a00000 { reg = <0x87a00000 0x200000>; no-map; };
+		modem_adsp@88000000 { reg = <0x88000000 0x5500000>; no-map; }; /* WIP: stub */
+		peripheral@8d500000 { reg = <0x8d500000 0x500000>; no-map; };
+		splash@83000000 { reg = <0x83000000 0xc00000>; no-map; };
+	};
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		cpu@0 { compatible = "arm,cortex-a7"; reg = <0>; };
+		cpu@1 { compatible = "arm,cortex-a7"; reg = <1>; };
+		cpu@2 { compatible = "arm,cortex-a7"; reg = <2>; };
+		cpu@3 { compatible = "arm,cortex-a7"; reg = <3>; };
+	};
+
+	soc {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "simple-bus";
+		ranges = <0 0 0 0xffffffff>;
+
+		tlmm: pinctrl@1000000 {
+			compatible = "qcom,msm8909-tlmm";
+			reg = <0x1000000 0x300000>;
+		};
+
+		imem@8600000 {
+			compatible = "qcom,msm-imem";
+			reg = <0x08600000 0x1000>;
+		};
+
+		sdhc_1: sdhci@7824000 {
+			compatible = "qcom,sdhci-msm";
+			reg = <0x07824900 0x11c>, <0x07824000 0x800>;
+			qcom,bus-width = <8>;
+			non-removable;
+			status = "okay"; /* eMMC User, Boot1/2 нули WIP */
+		};
+
+		sdhc_2: sdhci@7864000 {
+			compatible = "qcom,sdhci-msm";
+			reg = <0x07864900 0x11c>, <0x07864000 0x800>;
+			qcom,bus-width = <4>;
+			status = "okay"; /* microSD */
+		};
+
+		serial0: serial@78af000 {
+			compatible = "qcom,msm-uartdm-v1.4";
+			reg = <0x78af000 0x200>;
+			status = "okay";
+		};
+
+		usb@78d9000 {
+			compatible = "qcom,hsusb-otg";
+			reg = <0x78d9000 0x400>;
+			qcom,hsusb-otg-mode = <1>;
+			status = "okay"; /* 05C6:9008 / 045E:9006 см. compat/ */
+		};
+
+		spmi@200f000 {
+			compatible = "qcom,spmi-pmic-arb";
+			reg = <0x200f000 0x1000>;
+			status = "okay"; /* PM8909 WIP-stub */
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+		vol-up { label = "Volume Up"; gpios = <&tlmm 90 1>; linux,code = <115>; };
+		cam-focus { label = "Camera Focus"; gpios = <&tlmm 91 1>; linux,code = <528>; };
+		cam-snap { label = "Camera Snapshot"; gpios = <&tlmm 92 1>; linux,code = <766>; };
+		/* PWR/VolDown через pm8909_pon: 116/114 */
+	};
+};
diff --git a/qemu/pbl_stub.py b/qemu/pbl_stub.py
new file mode 100644
index 0000000..53bb68c
--- /dev/null
+++ b/qemu/pbl_stub.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+"""PBL-stub WIP: имитирует PBL MSM8909 для эмуляции.
+Оригинал ROM 0x00100000 сверяет SBL1 по PK_HASH и уходит в EDL при ошибке.
+Стуб: читает SBL1 из emmc User LBA 32768, кладет в IMEM-макет, прыгает.
+EDL cookie 0x193D100 bit0 -> Sahara-Hello заглушка.
+WIP: SecureBoot скипнут! Для 1:1 нужен QFPROM/PK_HASH из живого дампа.
+"""
+import struct, sys
+
+PBL_ADDR = 0x00100000
+IMEM_ADDR = 0x08600000
+SBL1_LBA = 32768
+EDL_COOKIE_ADDR = 0x193D100
+
+def main(img="images/emmc.img"):
+    print(f"[pbl-stub] PBL @0x{PBL_ADDR:08X} (WIP, SecureBoot SKIPPED)")
+    print(f"[pbl-stub] check EDL cookie @0x{EDL_COOKIE_ADDR:08X} ... 0 (boot normal)")
+    print(f"[pbl-stub] would load SBL1 from User LBA {SBL1_LBA} -> IMEM 0x{IMEM_ADDR:08X}")
+    print("[pbl-stub] WIP: нужен fw/SBL1.bin из ffureader. Пока только лог.")
+    print("[pbl-stub] Sahara-Hello stub: 05C6:9008 ready (см. compat/)")
+
+if __name__ == "__main__":
+    main(sys.argv[1] if len(sys.argv) > 1 else "images/emmc.img")