[Milhouse]

By the way, this timeout in cmdline.txt does not affect normal boots, does it? How does this work, just for my understanding?

The "media check" feature (when enabled) will time how long it takes to write a 1MB file to the SD card early in the startup sequence before any partitions are mounted.

Under normal circumstances it should take less than 200ms to write the file so you shouldn't notice any extra delay in the boot sequence. However, when the SD card hasn't initialised properly it will take a lot longer - in my tests, in the region of 30-35 seconds - to write the file and so the Pi will reboot whenever the time taken exceeds the value of iotimeout. You specify this value in cmdline.txt, a value of 0 (or omitting the parameter) disables the feature entirely, a value of 5000 is normally sufficient.

Only when the Pi successfully writes the file without any significant delay will the boot sequence continue. From my testing, an incorrectly initialised SD card is the main cause of ext4 (/dev/mmcblk0p2) partition corruption, and as you found, also file corruption due to system updates.

Personally, I think it's worth the occasional 30 second+reboot delay than to have to restore my entire system (due to ext4 corruption) or waste time resurrecting a non-bootable system after applying an update!

Though I'll make no bones about this, it's a total hack, as you need to write a file to the SD card to provoke the mmc0 timeouts and the only way to detect the presence of the timeout without waiting an unreasonable amount of time for errors to appear in the log, is to time how long it takes to write the file.

However in my numerous tests, this hack has eliminated partition and file corruption on my system. Maybe it will be possible to use a smaller file in future which will reduce the amount of time taken to detect when the SD card is not correctly initialised (eg. a 250KB file may take no more than 10 seconds) but this requires more feedback from people testing this feature - I'll need to know the elapsed time reported on your systems when the delay is detected to determine an optimum size.

Obviously, the ideal solution is to eliminate the cause of the failure to initialise the SD card but that may take a while longer so consider this only a temporary stop-gap measure, and I doubt it will be included in stock OE builds anyway.