# Controller B exact-candidate read-only identity evidence

Status: complete
Result: complete observation; exact-candidate identity gate blocked on installed firmware mismatch
Type: evidence
Updated: 2026-08-02
Next Action: use the successor programming evidence, then obtain separate authorization for the required independent fixed-mailbox read-only identity/CID/HPT observation
Campaign: 004-produce-and-freeze-corrected-firmware-bundle
Superseded By: work/evidence/controller-b-bc0b6ce4-program-verify-20260802.md

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Authorization and boundary

The owner's `authorize` response was applied as the smallest separately gated
change named by the prior plan: one exact-bundle-bound Controller B read-only
identity observation. It did not authorize programming, reset, power, SD/USB
media operations, HPT2 Start/Stop, stop/recovery measurement, or T00 work.

The observer used `ForceAttachTarget=1`, required the CPU to be running before
and after the phase, read the complete 4 MiB code-flash image, and stopped on
identity mismatch before interpreting mapped RAM. Its command surface contains
no halt, resume, reset, program, erase, target-memory write, power, or raw-media
operation.

## Exact identities

- Controller role: B.
- Assembly serial: `1751219`.
- Hardware variant: `1`.
- J-Link serial: `69660123`.
- Target voltage: `3.306 V`.
- Imported bundle: `smi-00-05-00-248c1e7b7aab-release`.
- Bundle manifest SHA-256:
  `2340c9e85e91df24abe5eadeabf9220b1bd8b0b8cdc5de79cff09f1a2dfe0d28`.
- Diagnostic mapping SHA-256:
  `38c1fb7b4052537cc52d35bf620e1acc180e9e0cb3261d821806c23fa9754c44`.
- Expected complete candidate flash SHA-256:
  `d1babfa7a65610544741c0b329212b0eadfc92b32a8e95b513e2e2ec9ae70556`.
- Observed complete installed flash SHA-256:
  `23428a890890ca40172483a683f2b985c5bfc640650e7b33b977ead15db754ca`.

The observed hash is the preserved pre-candidate Release identity previously
recorded before Controller A candidate programming. Controller B therefore
remains unchanged on that prior Release baseline; it is not running the
imported exact candidate.

## Result

- Operation: `e371bc50-1163-4c70-88ad-2ac1226210df`.
- Classification: `BLOCKED`.
- Blocker: `FIRMWARE_IDENTITY_MISMATCH`.
- Read-only: true.
- CPU running before and after: true.
- Qualification outcome changed: false.
- Snapshot: null; no mapped RAM was interpreted after the flash mismatch.
- Result JSON SHA-256:
  `6da39be562778702d85f040d3a9dbe83614a84ef7e01274852cb20d1f7646423`.
- J-Link transcript SHA-256:
  `8c7d97e52fc99ebd18a0541f43c84f4667e44367c5b3b7f12d21e09c033efaa9`.

Generated evidence remains confined under
`foundation/controller-observations/e371bc50-1163-4c70-88ad-2ac1226210df/`
in the Pi evidence store.

## SD card identity block

- Protocol card status: CID unavailable.
- CID-valid status: CID unavailable.
- Representative-sector-read status: CID unavailable.
- Manufacturer/MID: CID unavailable.
- OEM/application ID: CID unavailable.
- Product name/revision: CID unavailable.
- Serial number/manufacturing date: CID unavailable.
- Complete raw 128-bit CID: CID unavailable.

Reason: the exact complete-flash comparison failed, so the fail-closed observer
did not read or interpret the firmware mapping that carries SD detection, CID,
representative-sector-read, and HPT state. CID unavailability here is an
identity-gate result, not evidence of SD-card failure or absence.

## Final safety state

The observation used ephemeral role-B-only environment values and one temporary
firewall accept rule limited to the observer bridge and TCP port 19121. The rule
was deleted automatically after the one-shot container exited. The final
`inet jlink_hub` input chain again contains only the default non-loopback drop
for ports 19120 and 19121. No observer container remains, protected `.env`
read-only roles/endpoints remain absent, the Controller B remote service is
healthy, and the qualifier remains healthy, fixture-only, and live-blocked.

There is no retry rationale: the operation completed deterministically and
identified the installed firmware. Programming the exact candidate is a new
state-changing action requiring separate explicit authorization and its own
rollback/verification gate.
