# Controller B bc0b6ce4 read-only observer VTref blocker evidence

Status: complete historical blocker; the one authorized observation exposed and mitigated a Pi observer defect, and the freshly authorized successor observation passes
Type: evidence
Updated: 2026-08-02
Next Action: retain as the resolved predecessor to the completed B observation and A promotion evidence; HPT2 stop/recovery measurement remains separately gated
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Superseded By: work/evidence/controller-b-bc0b6ce4-readonly-identity-cid-hpt-pass-20260802.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Checklist: work/checklists/checklist-promote-bc0b6ce4-fixed-mailbox-candidate.md

## Authorization and boundary

The owner's `authorized` response was consumed by exactly one Controller B-only
read-only observation attempt. The transient runtime configuration allowed role
`B` only at `host.docker.internal:19121`; role A and its endpoint were empty.
The temporary host rule admitted only Docker bridge `br-e73da0120aa0`, subnet
`192.168.16.0/20`, to B port `19121` and had unconditional cleanup.

The attempt did not authorize or perform programming, erase, reset, halt,
target writes, HPT2 Start/Stop, admission, media, power, USB, Controller A, or
T00 work. No automatic retry was made.

## Preflight

- Pi source and deployment were clean and exact at `351182d19309...` /
  `hpt2-operator-ui-351182d` before the attempt.
- Protected registry SHA-256 was and remains
  `723fcd993b14ae29c8737756a7f6aa5c887c8b68491b06b47d0e06861889a91b`.
- Role B remained assembly `1751219`, hardware variant `1`, probe `69660123`,
  bundle manifest `5df475bd...176ce`, and
  `enabled_for_qualification=false`; role A was unchanged and disabled.
- The bundle was valid, unadmitted, and scope `none`.
- Appliance health was green, fixture-only, live-unadmitted, and all
  state-changing capability flags were false. No controller tool container,
  persisted observer/HPT2 role, or endpoint existed.
- Both J-Link Remote services were active, while the host firewall contained
  only its default non-loopback drop for ports `19120` and `19121`.

## One-shot result

The one-shot observer completed its 4 MiB flash phase and entered its mapped
memory phase, which its implementation permits only after the observed complete
flash hash equals expected candidate hash `68029e19...7bb28`. It then stopped
fail-closed with:

```text
CommandError: ['The probe identity changed during observation.']
```

This is not qualifying flash evidence: the exception occurred before the
observer constructed and published its immutable result and transcript. The
generated operation UUID was likewise not exposed. No same-run CID or HPT
snapshot was published, so the independent Controller B gate remains open.

## Root cause and mitigation

Each phase independently required exact registered probe serial `69660123` and
positive VTref. After those checks passed, the observer compared the complete
phase dictionaries for equality. Those dictionaries contained both serial and
the floating-point VTref measurement, so ordinary positive VTref drift was
misclassified as a probe-identity change. The earlier programming operation had
already demonstrated normal drift from 3.303 V to 3.308 V.

Pi PR #29 changed the cross-phase identity comparison to the exact probe serial
only. Both phases still independently require the registered serial, positive
VTref, and a running CPU. Regression coverage explicitly accepts 3.303 V versus
3.308 V for the same serial and rejects a different serial.

- Fix commit: `29fd21e`.
- Merged Pi main commit: `3e13198adafc041d4a6d37ba544dd45c255bffdb`.
- Validation: 9 focused observer tests and all 129 application tests pass;
  `git diff --check` passes.
- Deployed release: `observer-vtref-fix-3e13198`.
- Deployed image: `sha256:e0757fc0bfce085b191b4f02f183ca417fdd07b06c6394ce9599c1eacdda93d8`.

The first ordinary Compose update was not accepted as deployment evidence
because the long-running containers still referenced the prior image. Web,
command worker, and notification worker were then explicitly recreated and
verified to use the exact merged image and release identity.

## Required CID identity block

- Protocol card status: CID unavailable; no immutable observation result was
  published.
- CID-valid status: CID unavailable; no immutable observation result was
  published.
- Representative-sector-read status: CID unavailable; no immutable observation
  result was published.
- Manufacturer name and MID: CID unavailable.
- OEM/application ID: CID unavailable.
- Product name/revision: CID unavailable.
- Serial number/manufacturing date: CID unavailable.
- Complete raw 128-bit CID: CID unavailable.

Reason: the observer failed before publication. Historical identity data is not
substituted for the required same-run capture.

## Final safety state and disposition

The exit trap removed the temporary B firewall rule. The final firewall again
contains only the default non-loopback drop for J-Link ports `19120` and
`19121`; no observer or programmer container remains; read-only and HPT2 roles
and endpoints are empty. Registry SHA-256 is unchanged at `723fcd99...a91b`.

The deployed appliance is healthy and exact at clean Pi `main` commit
`3e13198a`, with `fixture_only=true`, `live_admitted=false`,
`state_changing_profiles_enabled=false`, `bounded_stop_supported=false`, and
`recovery_supported=false`. Controller A was untouched.

The consumed attempt is not retried or relabeled PASS. A fresh explicit
authorization was later consumed by distinct successor operation `a05bc76d...`,
which passes in
`work/evidence/controller-b-bc0b6ce4-readonly-identity-cid-hpt-pass-20260802.md`.
Controller A promotion and HPT2 measurement remain separate gates.
