# Controller A candidate program, verify, and observation evidence

Status: complete
Result: complete historical candidate gate; superseded by the Controller A fixed-mailbox promotion pass
Type: evidence
Updated: 2026-08-02
Next Action: use successor `work/evidence/controller-a-bc0b6ce4-program-verify-readonly-identity-pass-20260802.md`
Campaign: 004-produce-and-freeze-corrected-firmware-bundle
Superseded By: work/evidence/controller-a-bc0b6ce4-program-verify-readonly-identity-pass-20260802.md

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackages:

- work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
- work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md

## Outcome

Controller A, assembly `1751136`, hardware variant `0`, J-Link `69664082`, was
programmed with the reviewed Release bundle
`smi-00-05-00-248c1e7b7aab-release`. Complete post-program readback exactly
matched the candidate, VEEPROM and option memory were unchanged, reset/run
proof passed, and a separate read-only observation passed the exact firmware,
mapped-state, SD identity, and representative-sector-read gates.

This is Controller A readiness evidence, not A/B qualification completion,
media approval, or live campaign admission. Controller B, endpoint `19121`,
the installed SD card, every raw block device, the power service, and the T00
USB incident were not accessed.

## Reviewed identities

- Firmware source commit: `248c1e7b7aabe1d0da306e65b03baa5a3e05e67f`.
- Bundle outer manifest SHA-256:
  `2340c9e85e91df24abe5eadeabf9220b1bd8b0b8cdc5de79cff09f1a2dfe0d28`.
- Diagnostic mapping SHA-256:
  `38c1fb7b4052537cc52d35bf620e1acc180e9e0cb3261d821806c23fa9754c44`.
- Release S-record SHA-256:
  `5be1c0919bd08b1f812f4e25618d543a097be2fb3fe4e69a4a3a8da2f4b161ca`.
- Expected complete 4 MiB candidate flash SHA-256:
  `d1babfa7a65610544741c0b329212b0eadfc92b32a8e95b513e2e2ec9ae70556`.
- Authorized pre-change complete flash SHA-256:
  `23428a890890ca40172483a683f2b985c5bfc640650e7b33b977ead15db754ca`.

The S-record contains one erased 16-byte record at `0x40120050`. The programmer
rejected non-erased content outside code flash and constructed an ephemeral
exact 4 MiB code-flash image, so it did not program option memory or VEEPROM.

## Pi implementation and review

`PC-Redemption/sd-qualification` changes were reviewed, Pi-container tested,
merged, and deployed through:

- PR #19 / merge `d4c9d6b99358f8f1d67a36071e808304bea00181`: separately gated,
  code-flash-only programmer with full pre/post readback and rollback;
- PR #20 / merge `49edf5b324f8a46acabcd2deec3fac3d150f16c0`: bounded handling of the
  SEGGER Remote Server post-disconnect readiness window only when the refusal
  occurs before probe identity and before any target command;
- PR #21 / merge `a35ca0e72d9a320804f3decf31822ca2a0933b58`: the same pre-target-only
  readiness handling for the observer's flash and mapped-memory phases.

The successful target operations ran on reviewed release
`controller-observer-a35ca0e`, image
`sha256:894ec831f8f4aadd8cb8ce73fce1898917b809e8657b45c12f6138b48b69cb79`,
at source `a35ca0e72d9a320804f3decf31822ca2a0933b58`. Pi PR #22 subsequently
deployed release `stop-recovery-gate-2b73843`, image
`sha256:623175e6597181ee9e1f5ac24fbb0a3e5cba850a36e588358da962966616c57b`,
at source `2b73843a1bca721b0543ee16b595c9bf70266a0e`. The exact Pi containers passed
all 86 qualification tests. Web and PostgreSQL are healthy; the command and
notification workers are running. Live admission and controller qualification
flags remain false.

## Pre-target connection incident

Operation `db58a330-eb8c-46d6-9cb2-42ae7151999f` captured the authorized
pre-change flash, VEEPROM, option memory, probe, VTref, and running CPU, then
reported `JLINK_PROGRAM_OR_POSTFLIGHT_FAILED_ROLLBACK_FAILED`. Its program and
rollback transcripts both stop at the Remote Server TCP connection refusal.
Neither contains target `connect`, reset, `loadbin`, or `g`; no programming or
rollback command ran. The original `target_changed=true` was a conservative
implementation claim superseded by the transcript and PR #20's exact
pre-target classification.

- Incident result JSON SHA-256:
  `2da07c57314609cb7bb3a983060a9482d439c8750f3b1adb623fc7c004c8b917`.
- Incident transcript SHA-256:
  `890a751927386ebbd67301a63c0d1b90e3614a3ab40b8c8d18726a28ad57dbdb`.

The correction does not retry a controller, firmware, USB, or media command.
It makes at most four total connection attempts separated by 250 ms only for
the exact SEGGER refusal proven to occur before probe identity and before any
target command. Any later failure remains fail-closed without retry.

## Successful programming result

Operation `741d370e-2083-4a8d-a325-332caabef70b` completed with
`PASS/PROGRAM_VERIFY_RESET_RUN_COMPLETE`:

- pre-change complete flash:
  `23428a890890ca40172483a683f2b985c5bfc640650e7b33b977ead15db754ca`;
- post-change complete flash:
  `d1babfa7a65610544741c0b329212b0eadfc92b32a8e95b513e2e2ec9ae70556`;
- pre/post 4 KiB VEEPROM:
  `2600c8a339ca0fb6f2106b80620e4a163235d71eee5a3569d5fc92da275c20ed`;
- pre/post option-memory block:
  `af9613760f72635fbdb44a5a0a63c39f12af30f950a6ee5c971be188e89c4051`;
- probe `69664082`, VTref `3.282 V` before and `3.280 V` after;
- CPU running before and after; rollback not attempted;
- `qualification_outcome_changed=false`.

Result JSON SHA-256 is
`f0da4cb8ff93ec7c1fedd365d34b486ac68ad8ff78f04b7d743ab93d438a9ff7`;
transcript SHA-256 is
`ae4630ed1e14b87d500eab03375dfd2d77285b6eaa45bec76fa0f673473bd818`.

## Post-program read-only observation and CID identity

Operation `19a603d0-d08d-4079-8357-0d88513ea157` independently completed with
`PASS` and `read_only=true`:

- expected and observed complete flash both equal
  `d1babfa7a65610544741c0b329212b0eadfc92b32a8e95b513e2e2ec9ae70556`;
- hardware variant `0`, main system errors `0`;
- SD last status `0`, SD state `6` (`RAW_HPT`);
- HPT state `5` (`HPT_READY`), HPT/SSP status `0/0`, lane mask `7`;
- sector count `15,523,840`, first-error sector `0`, replacement false;
- protocol card status `5`, CID-valid true, representative-sector-read true;
- manufacturer SanDisk / MID `0x03`, OEM/application ID `SD`, product `SS08G`,
  revision `8.0`, serial `2540634244` (`0x976F0084`), manufactured May 2024;
- complete raw CID `035344535330384780976F0084018559`;
- probe `69664082`, VTref `3.282 V`, CPU running before and after;
- `qualification_outcome_changed=false`.

Result JSON SHA-256 is
`141fac4f3621757bc0768fc42da2e4d542d75948df3ad4b412e11bf8278cb993`;
transcript SHA-256 is
`fc2e3ad030bdd90827753750fe4005a32743acf30d2023078b9bdf658c7c0389`.
Generated evidence remains in the Pi application's confined evidence store.

## Final safety state and disposition

Every temporary firewall exception allowed only the dedicated observer bridge
to Controller A TCP port `19120` and was removed immediately afterward. The
final `inet jlink_hub` input chain again contains only the default non-loopback
drop for ports `19120` and `19121`. Controller B was never enabled or contacted.

Controller A now satisfies the exact-candidate read-only identity gate. Stage
5 and the HPT workpackage remain open because Controller B is deliberately
frozen and stop/recovery readiness is incomplete. PR #22 now exposes
`BOUNDED_STOP_RECOVERY_UNSUPPORTED` and machine-readable false capability flags
in the Pi health/readiness/UI; every state-changing profile remains disabled.
The next step requires an owner choice of the first named HPT media 2.0 profile
whose firmware-specific stop, acknowledgement, deadline, terminal proof, and
recovery contract will be designed.
