# Controller A HPT2 S4 program, baseline, and first-pass evidence — 2026-08-06

Status: pass through first exact S4 observation; remaining identity-local matrix, recovery, and regression continue
Type: evidence
Updated: 2026-08-06
Next Action: collect the remaining Controller A exact-identity S4 matrix, then repeat S0-S3/S5/S6 under this firmware identity before recovery and regression closeout
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md
Canonical Truth: docs/hpt2-measurement-matrix-v1.md

## Authorized scope

The owner explicitly authorized Controller A for programming and the complete
remaining A-local qualification campaign. The owner reconfirmed that both
controllers are isolated lab controls with no machine, heater, or production
load. Campaign event `controller-a.full-run-authorized` records the bounded
scope: programming, baseline scrub, HPT initialization, HPT2 S4, controlled
interrupted-session recovery, representative regression, and post-campaign
scrub. Controller B target access remains unauthorized and disabled. Powered
SD-card removal or insertion remains prohibited.

New campaign `648ba10c-0bc0-4319-8089-78a0cce287ce` binds this execution to the
exact S4 firmware identity. It is non-fixture and `RUNNING`; Controller A
assignment `17` is `HPT_INITIALIZED`, while Controller B assignment `18`
remains `INTAKE` with its protected registry entry disabled.

## Exact firmware and coordinator identity

- Firmware bundle:
  `smi-00-05-00-660433743898-bcf70c2de65c-release`.
- Canonical manifest SHA-256:
  `d5da9437a9498b3ca82f6ee418dde82332159db463d51a1ef7a120abf29162fe`.
- Source commit:
  `1e566bee8bd246f8eb77511966615a79a97a0e6f`.
- S-record SHA-256:
  `bcf70c2de65cd770d8d4ed45597b11f75454e499cd4bce5a2911beaa8208e1fd`.
- Complete expanded code-flash SHA-256:
  `507e5b91d53afeb1b2d9d16442e3f6ff0391dcc7a53cead269cb11396dfcf246`.
- Diagnostic mapping SHA-256:
  `16dd780496778847d2a4996926aad91d7e27c858ca800af379c4de43c53cfbdc`.
- Profile SHA-256:
  `b0d5247f4c2de03b02ab57c5748920a606d4b37cba61b82aeb065777f10fa0e8`.
- Pi release `hpt2-s4-boundary-b586704`, source
  `b586704a69e6e351ce4363e7e21d5cc311021046`, image
  `sha256:4237e644eec42d742be75942a9ff2f8013812ebc309e0f416f306b70aefbd9c7`.

## Programming and independent observation

Pre-program observation `c0d3fe06-311d-4482-aa88-f3b91c274398` passed the
installed prior flash, running CPU, exact Controller A/probe identity, healthy
HPT state, representative-sector read, and unchanged CID.

Programming operation `75840c2a-40c8-4572-80df-73721852fa2d` completed
`PASS/PROGRAM_VERIFY_RESET_RUN_COMPLETE`:

- complete flash changed from
  `862b8122c0c8c9556508130927cc9960e91fc0a2bc4aea5f8d7b457ba4cd7efe`
  to exact candidate `507e5b91...f246`;
- VEEPROM remained
  `2600c8a339ca0fb6f2106b80620e4a163235d71eee5a3569d5fc92da275c20ed`;
- option memory remained
  `af9613760f72635fbdb44a5a0a63c39f12af30f950a6ee5c971be188e89c4051`;
- CPU reset/run, probe `69664082`, and positive VTref passed;
- rollback was not attempted;
- transcript SHA-256:
  `7e27994a63d30af9ebfdc01844333127c72d735d3507a1de013569953bd62451`.

Independent post-program observation
`ad537323-8f77-4ce3-a32f-e608b5ad8358` reverified exact flash, mapping, CPU,
controller/probe, CID, and clean three-lane HPT state. Pi Evidence `1097` and
CID capture `83` bind that result to the new campaign.

## Full-address baseline and HPT initialization

Full-address scrub operation `0e4c4b04-d27f-4660-a2dd-488991e6d41b`
completed `FULL_ADDRESS_SCRUB_PASS`:

| Field | Result |
| --- | ---: |
| Total/completed sectors | `15,728,640 / 15,728,640` |
| Block size | `512` bytes |
| Read attempts | `245,760` |
| Failed sectors | `0` |
| Retry-recovered sectors | `0` |
| Identity mismatch | `0` |
| HPT / first SSP / last SSP status | `0 / 0 / 0` |
| Maximum read duration | `3` ticks |
| Controller/HMI run delta | `1,347 / 0` |

The first post-scrub observer wrapper reached its local five-minute timeout.
It was read-only, published no result, left no container or J-Link client, and
the firewall returned closed. The campaign preserves this as a warning event.
Reviewed read-only repetition `bbe803c9-fee1-4bd4-8dea-8e0d7e1b8d6b` passed;
Pi Evidence `1100` and CID capture `84` bind the post-scrub flash/CID state to
the scrub operation.

HPT initialization operation `fc58f3cb-fb16-426f-be4a-fac175b3ec03`, request
`2c4544b5-79f6-4083-816d-3188ed3616f4`, completed canonical
`HPT_INITIALIZATION_PASS`. It was published once and has automatic replay
disabled. Post-initialization CID capture `85` is the current campaign identity.

## Required CID identity block

- Protocol/card status: `READY; RAW_HPT; DRIVER_OK`.
- CID-valid status: true.
- Representative-sector-read status: true.
- Manufacturer: unknown CID manufacturer; retail brand KEXIN; MID `0x05`.
- OEM/application ID: raw OID `0x000C` (decoded display `??`).
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7305` (`0x00001C89`).
- Manufacturing date: `2026-03`.
- Complete raw 128-bit CID: `05000C61736466672200001C8901A34F`.

CID is identity evidence, not proof of authenticity.

## First exact S4 result

Run `34de725c-7192-4eaa-a7f1-452381493802` passed the exact `1440 / BEFORE`
boundary. Start operation `cd4e0610-a0d6-45c3-ab96-975ff5dae8fe` and Stop
operation `c6d6a047-b82c-4e81-b271-5b692ca4817a` were each acknowledged once
without replay. Firmware held at attempted/committed/verified `1439/1439/1439`
and checkpoint `0`; two stable terminal observations reported
`STOPPED_CLEAN`, reason `0`, proof `0x1F`, boot witness `26B10B1280443248`,
and unchanged CID.

Extended Evidence `1121`, SHA-256
`0cfcb43df2a9e555cb4d33c536e3e19ba6c1f2360a13570e93f11daa9355dbb1`,
credits S4 `1440 / BEFORE`. The stop-to-terminal observation upper bound was
`2037 ms`. There are zero active runs and the default non-loopback firewall
drop remains installed for ports `19120` and `19121`.

## Identity-local continuation rule

The earlier S0-S3/S5/S6 observations remain valid historical evidence for
their prior firmware/profile identity, but they are not relabeled into this
new campaign. Completing Controller A under the S4 candidate therefore
requires the remaining 44 S4 observations and fresh S0-S3/S5/S6 evidence under
this exact bundle before A-local recovery and regression closeout.
