# Controller A b845d4b9 program, verify, and baseline scrub evidence

Status: PASS; exact candidate programmed and independently observed, full-address baseline scrub passed, and post-result CID is linked
Type: evidence
Updated: 2026-08-05
Next Action: review this baseline evidence; HPT initialization requires a separate explicit whole-card-erasure authorization and was not performed
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Authorized boundary and exact identities

The owner authorized continuation through the previously identified Controller
A sequence: bind and program the superseding firmware bundle, verify the full
flash and fresh CID, and run its read-only full-address baseline scrub. This
did not authorize HPT initialization or whole-card erasure.

- Controller A: assembly `1751136`, hardware variant `0`, J-Link `69664082`.
- Card/sample: `F1-A1`.
- Bundle: `smi-00-05-00-b845d4b9bcfe-4f37e97877d8-release`.
- Bundle manifest SHA-256:
  `a858c703f1ba4ebd10e2d5c6c804c501bfb22a7480f011d907226bc13da00c94`.
- S-record SHA-256:
  `4f37e97877d851b583db7590ea464a15ccbb9943af1377ffe25d4e686d4a263b`.
- Expected expanded 4 MiB flash SHA-256:
  `aed8fc3f289094c4e7d4c3313268687a31d822d117833527fd6c8e0a7b4dd242`.
- Campaign: `8f3fe483-c783-4170-a720-3c2df3a48fd6`, version `2`.
- Controller A assignment: `13`, stage `BASELINE_SCRUB_PASSED`.

## Baseline identity and programming

Pre-program read-only observation
`46d24a78-570e-4144-80e6-b0afa52f2bf5` passed. It matched the installed prior
flash `b1abe477...fcabb3`, running CPU, exact controller/probe, CID validity,
and representative-sector readability.

Programming operation `64e4ec9c-4d54-4868-aea8-0a2b67949be4` completed
`PASS/PROGRAM_VERIFY_RESET_RUN_COMPLETE`:

- complete flash changed from `b1abe477...fcabb3` to the exact candidate
  `aed8fc3f...dd242`;
- VEEPROM remained
  `2600c8a339ca0fb6f2106b80620e4a163235d71eee5a3569d5fc92da275c20ed`;
- option memory remained
  `af9613760f72635fbdb44a5a0a63c39f12af30f950a6ee5c971be188e89c4051`;
- CPU reset/run and probe/VTref checks passed;
- rollback was not attempted;
- immutable result SHA-256:
  `e9b263c2e2e82cc62e7eab11628a8ff5382c564047c03b2782e55e27fc497884`;
- transcript SHA-256:
  `b58d912ca854a7e4766e82acbe9760bc01459faddb21e5344181a5265ccf2d94`.

Independent post-program observation
`045ecba0-dc6a-4595-801b-81c4220c0d4d` passed the exact full-flash,
mapping, CPU, controller/probe, SD status, and CID gates. Pi Evidence `29`
links the result and CID capture `7`; Pi Evidence `30` links programming.

## Pi scrub-envelope lock correction

The first envelope-creation attempt failed before target access because
PostgreSQL rejects `SELECT FOR UPDATE` against the nullable side of the
campaign-to-bundle outer join. Pi commit
`ec2dd1bb34b6c7ed214d2d956d688acb534cf296` restricts the lock to the campaign
row, matching the already-correct initialization path, and adds a PostgreSQL
regression test.

- Full scrub module: `15/15` pass.
- Broader application suite: `162` pass with the same three documented
  container-environment-only failures (two missing executable HPT temp-mount
  expectations and one host clock-marker expectation).
- Deployed release: `scrub-envelope-lock-ec2dd1b`.
- Deployed image:
  `sha256:a09c41938607c19538986531ff781286c16bd937e35c647a703cb2b9c26ccfe9`.
- Health: green; database, evidence storage, clock, and workers ready;
  fixture-only true and live/state-changing profiles false.

Envelope `23d56551-ff37-4207-9b00-1e96a968fd16` then bound one baseline scrub
to the exact campaign, assignment, bundle manifest, Controller A identities,
and CID. The failed pre-fix transaction published no command and created no
operation.

## Full-address baseline scrub

Operation `abc4be6b-6cde-447b-8b98-1bf7021e8586` published the reviewed SRAM
run word exactly once and completed `FULL_ADDRESS_SCRUB_PASS`.

| Field | Result |
| --- | ---: |
| Total/completed sectors | `15,728,640 / 15,728,640` |
| Block size | `512` bytes |
| Read attempts | `245,760` |
| Failed sectors | `0` |
| Retry-recovered sectors | `0` |
| Identity mismatch | `0` |
| HPT/first SSP/last SSP status | `0 / 0 / 0` |
| Maximum read duration | `2` ticks |
| Controller/HMI run delta | `1,348 / 0` |

The event-driven HMI thread was legitimately idle; the required periodic
controller-thread liveness witness progressed. Automatic replay is false.
Pi Evidence `31` is the transcript, SHA-256
`c435cdbf124a950ca593626389dde1e94d484045f901ff06187823868182e39b`.
Pi Evidence `32` is the terminal result, SHA-256
`74b0418026f2a93992fd6e2936b7a992c47a2bf0298c7a636136b29b6c5bf9b7`.

## Required CID identity block

The post-result independent observation
`adf10a5d-3864-44d5-add8-dc28df91edce` again passed exact flash, CPU, and SD
identity checks. Pi Evidence `33` links result SHA-256
`851e6a6b6230ea980745e43f47e87d1a882842e7c0745b3c52a922bdfd34ea23`
and CID capture `8` to the scrub.

- Protocol/card status: `DETECTION_NEEDS_INITIALIZATION; SD_UNAVAILABLE; DRIVER_OK`.
- CID-valid status: true.
- Representative-sector-read status: true.
- Manufacturer: unknown CID manufacturer; retail brand KEXIN; MID `0x05`.
- OEM/application ID: `0x000C`.
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7305` (`0x00001C89`).
- Manufacturing date: `2026-03`.
- Complete raw 128-bit CID: `05000C61736466672200001C8901A34F`.

CID is identity evidence, not proof of authenticity.

## Final safety state

The protected registry now binds A to the superseding manifest and B to its
unchanged manifest; both remain `enabled_for_qualification=false`. Registry
SHA-256 is
`4e58d3cde61c9430c8673008300c5bd21056de5550ba9aaa48bd298ad38541b0`.
Only the default non-loopback drop for ports `19120` and `19121` remains. No
observer, programmer, scrub, HPT2, or initialization tool container remains.
The card is still uninitialized. No whole-card erase was attempted.
