# Controller A bc0b6ce4 program, verify, and read-only identity pass evidence

Status: complete
Result: complete; Controller A fixed-mailbox registry, programming, exact-flash, stable-state, CID, and HPT promotion gates pass
Type: evidence
Updated: 2026-08-02
Next Action: retain as completed promotion evidence; review the separately gated A/B HPT2 stop-deadline and recovery measurement plan before enabling any command endpoint
Campaign: 004-produce-and-freeze-corrected-firmware-bundle
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Checklist: work/checklists/checklist-promote-bc0b6ce4-fixed-mailbox-candidate.md

## End-to-end authorization and boundary

The owner authorized the remaining Controller A fixed-mailbox promotion
checklist end-to-end: registry rebind, one-shot program/verify/reset/run with
same-operation rollback if required, independent read-only identity/CID/HPT
observation, cleanup, evidence reconciliation, and Git/GitHub publication.

The authorization did not include HPT2 Start/Stop, command-adapter admission,
stop/recovery measurement, media, power, endurance, fault injection, USB, or
T00 work. Controller B's target and registry entry were not changed.

Only Controller A, assembly `1751136`, hardware variant `0`, J-Link probe
`69664082`, and protected port `19120` were enabled transiently for their named
one-shot operations.

## Preflight and protected registry transaction

- Pi source and all long-running services were exact at clean commit
  `3e13198adafc041d4a6d37ba544dd45c255bffdb`, release
  `observer-vtref-fix-3e13198`, image
  `sha256:e0757fc0bfce085b191b4f02f183ca417fdd07b06c6394ce9599c1eacdda93d8`.
- Appliance health was green and fixture-only; live admission, state-changing
  profiles, bounded stop, and recovery were false.
- The valid, unadmitted, scope-none bundle revalidated as manifest/content
  address `5df475bd...176ce`, S-record `3cfd2c7c...1ab391`, complete 4 MiB
  candidate flash `68029e19...7bb28`, and source `bc0b6ce4...`.
- Pre-change registry SHA-256 was
  `723fcd993b14ae29c8737756a7f6aa5c887c8b68491b06b47d0e06861889a91b`.
- Exact pre-change bytes are retained at
  `config/protected/controller-registry.pre-bc0b6ce4-a-promotion-723fcd99.json`
  with the same SHA-256.
- A candidate registry changed only A's bundle binding from
  `2340c9e8...0d28` to `5df475bd...176ce`. B retained
  `5df475bd...176ce`; assembly, probe, hardware variant, and both
  `enabled_for_qualification=false` values were unchanged.
- The deployed parser returned `CONTROLLER_REGISTRY_READY` before and after
  atomic replacement. Final registry SHA-256 is
  `47f0839ee4265a58929c5b5d45eabf750a642409cc86773ee5eaed249dd83d15`.

## One-shot program/verify/reset/run result

Operation `ae2fe6ff-2993-42fc-a360-c7010ad7545b` completed
`PASS/PROGRAM_VERIFY_RESET_RUN_COMPLETE`.

- Authorized pre-change complete flash:
  `d1babfa7a65610544741c0b329212b0eadfc92b32a8e95b513e2e2ec9ae70556`.
- Final complete flash:
  `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28`.
- Pre/post 4 KiB VEEPROM:
  `2600c8a339ca0fb6f2106b80620e4a163235d71eee5a3569d5fc92da275c20ed`.
- Pre/post option memory:
  `af9613760f72635fbdb44a5a0a63c39f12af30f950a6ee5c971be188e89c4051`.
- Probe `69664082`; VTref 3.282 V before and 3.280 V after; CPU running
  before and after every phase.
- Target changed true; rollback attempted false; qualification outcome changed
  false.
- UTC interval: `2026-08-03T03:33:42.309541+00:00` through
  `2026-08-03T03:34:48.488701+00:00`.
- Result path:
  `foundation/controller-programming/ae2fe6ff-2993-42fc-a360-c7010ad7545b/result.json`.
- Result SHA-256:
  `099b9410538afa7ae091474bc85d7feea320c849df49b898acd2e05c14851cb1`.
- Transcript path:
  `foundation/controller-programming/ae2fe6ff-2993-42fc-a360-c7010ad7545b/jlink-transcript.log`.
- Transcript SHA-256:
  `d3d65c6f07cb4d41b560b96b3585968f56a915c0803de7e33a297dacf60cfece`.

The programmer used only its preflight, one candidate program/reset/run, and
complete postflight readback phases. No target-command retry or second
programming operation occurred.

## Independent read-only observation

Distinct operation `e140c0f2-3b9d-4c1d-bdd1-c9c365c05da1` completed `PASS`
with `read_only=true` and `qualification_outcome_changed=false`.

- Expected and observed complete 4 MiB flash both equal
  `68029e19...7bb28`.
- Assembly `1751136`, variant `0`, probe `69664082`, positive VTref 3.280 V,
  and running CPU match the protected registry.
- Both exact-length mapped passes were byte-identical.
- Main system errors `0`; SD last status `0`; SD state `6` (`RAW_HPT`).
- SD detection state `5` (`READY`); CID-valid true; representative-sector-read
  true.
- UTC interval: `2026-08-03T03:35:23.916048+00:00` through
  `2026-08-03T03:35:46.901538+00:00`.
- Result path:
  `foundation/controller-observations/e140c0f2-3b9d-4c1d-bdd1-c9c365c05da1/result.json`.
- Result SHA-256:
  `aba4f39864a97166ec07b78c4e53bc1c772d5301224a9aca57a0c2f387526a6b`.
- Transcript path:
  `foundation/controller-observations/e140c0f2-3b9d-4c1d-bdd1-c9c365c05da1/jlink-transcript.log`.
- Transcript SHA-256:
  `2bbd2b14609d85f16c0361906e608a729ef8da6e7030bd7acb6be3a8b4f3aa28`.

## Required same-run CID identity block

- Protocol card status: detection state `5` (`READY`); SD state `6`
  (`RAW_HPT`); driver status `0`.
- CID-valid status: true.
- Representative-sector-read status: true.
- Manufacturer: SanDisk; MID `0x03`.
- OEM/application ID: `SD`.
- Product name: `SS08G`.
- Product revision: `8.0`.
- Serial number: `2540634244` (`0x976F0084`).
- Manufacturing date: May 2024; valid true.
- Complete raw 128-bit CID: `035344535330384780976F0084018559`.

This is the fresh post-program A identity and is distinct from Controller B
serial `0x976F0085`. Historical CID was not substituted.

## HPT status and diagnostic-bit disposition

- HPT media state `5` (`HPT_READY`), HPT status `0`, SSP status `0`, first
  error sector `0`, and initialization phase `0` (`IDLE`).
- Sector count `15,523,840`; acknowledged records `3`; iterated records `0`.
- Lane mask `7`; retired segments `[0, 0, 0]`; mismatch `0`; lost `0`;
  replacement request false.
- Diagnostic pass mask `4087` (`0x00000FF7`) and failure mask `8`
  (`0x00000008`) match the already dispositioned B observation. Bit 3 is the
  obsolete `HPT_DIAG_MULTI_BLOCK_REJECTED` predicate; current HPT v0.5
  intentionally supports bounded multi-block reads. All other eleven bits
  pass. The raw masks remain recorded as pre-release diagnostic-contract debt,
  not as a media failure.

All operational system/SD/HPT status fields are non-disqualifying.

## Final safety state and disposition

Each one-shot operation temporarily admitted only the observer/programmer
bridge subnet to A port `19120`; its exit trap removed the rule. The final
firewall contains only the default non-loopback drop for ports `19120` and
`19121`. No observer or programmer container remains; program, read-only, and
HPT2 roles/endpoints are empty.

Both protected registry entries now bind exact fixed-mailbox manifest
`5df475bd...176ce` and remain disabled. The Pi source is clean at `3e13198a`;
the appliance is healthy with `fixture_only=true`, `live_admitted=false`,
`state_changing_profiles_enabled=false`, `bounded_stop_supported=false`, and
`recovery_supported=false`.

The fixed-mailbox promotion checklist is complete: A and B each have immutable
programming and independent read-only exact-flash/state/CID/HPT evidence. This
does not admit HPT2 commands or establish stop/recovery readiness.
