# Controller B bc0b6ce4 program and verification evidence

Status: complete
Result: complete; exact fixed-mailbox candidate program/verify/reset/run passed, independent read-only CID/HPT gate remains separate
Type: evidence
Updated: 2026-08-02
Next Action: retain with the completed B observation and A promotion evidence; review the separately gated A/B HPT2 stop/recovery measurement plan before enabling commands
Campaign: 004-produce-and-freeze-corrected-firmware-bundle
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Checklist: work/checklists/checklist-promote-bc0b6ce4-fixed-mailbox-candidate.md

## Authorization and boundary

The owner's `authorized` response explicitly authorized the Controller B-only
protected-registry rebind and one-shot program/verify/reset/run slice previously
named in the reviewed promotion checklist. It did not authorize Controller A,
an independent read-only Controller B observation, HPT2 Start/Stop, stop or
recovery measurement, qualification admission, media or power operations, USB
testing, or T00 work.

Only Controller B, assembly `1751219`, hardware variant `1`, J-Link
`69660123`, and protected endpoint port `19121` were in scope.

## Registry transaction

Before mutation, the protected registry SHA-256 was
`39c021d68c0344258fab641acbfb5c2f2ae1bfdd9985dd5a337058e078a49af7`.
The candidate document was validated by the deployed registry parser before an
atomic replacement. It changed only Controller B's bundle binding from
`2340c9e8...0d28` to `5df475bd...176ce`. Controller A retained
`2340c9e8...0d28`; both `enabled_for_qualification` values remained false.

- New protected registry SHA-256:
  `723fcd993b14ae29c8737756a7f6aa5c887c8b68491b06b47d0e06861889a91b`.
- Exact retained pre-promotion registry backup:
  `config/protected/controller-registry.pre-bc0b6ce4-b-promotion-39c021d6.json`.
- Retained backup SHA-256:
  `39c021d68c0344258fab641acbfb5c2f2ae1bfdd9985dd5a337058e078a49af7`.

The live parser reports `CONTROLLER_REGISTRY_READY`. Foundation admission
remains false because the controller entries remain disabled and the external,
live-adapter, and power/media gates remain closed.

## Exact candidate identities

- Bundle: `smi-00-05-00-bc0b6ce4d066-release`.
- Bundle manifest/content address:
  `5df475bd0b2de8792f40bc2bd49efde37fce66f9b80bd24b4bb2e675fc1176ce`.
- Firmware source:
  `bc0b6ce4d0666cacd65e19efd2c3b56add39a50f`.
- Release S-record SHA-256:
  `3cfd2c7c571f32a11a14b28b7c72c0cec36b9861ac87068da47ad4cced1ab391`.
- Expected complete 4 MiB candidate flash SHA-256:
  `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28`.
- Authorized pre-change complete flash SHA-256:
  `23428a890890ca40172483a683f2b985c5bfc640650e7b33b977ead15db754ca`.

The bundle reimport/readback immediately before mutation returned
`already-present`, the same manifest identity, `admitted=false`, and scope
`none`. The S-record contained only one ignored erased 16-byte record outside
code flash at `0x40120050`; no non-erased outside-code content was accepted.

## Programming result

Operation `7d3be985-9de8-4912-ad3a-54556321b1bb` completed
`PASS/PROGRAM_VERIFY_RESET_RUN_COMPLETE`:

- pre-change complete flash: `23428a89...754ca`;
- post-change complete flash: `68029e19...7bb28`;
- pre/post 4 KiB VEEPROM:
  `2bfa8f386c682465de815629f369039f35c8deaecf423363a4ea92b80ad294f5`;
- pre/post option memory:
  `af9613760f72635fbdb44a5a0a63c39f12af30f950a6ee5c971be188e89c4051`;
- probe `69660123`, VTref `3.303 V` before and `3.308 V` after;
- CPU running before and after all phases;
- target changed: true;
- rollback attempted: false; rollback was not required;
- qualification outcome changed: false.

The programmer used only its fixed preflight, code-flash program, reset/run,
and complete postflight readback phases. No second program operation or target
retry was run.

- Result JSON SHA-256:
  `1695c27ae13ab39df785738528cbe9d207f614301596f5179e8626ba7cebc5bc`.
- J-Link transcript SHA-256:
  `3e6faa3be06740f09bf8c4e7c059570a1819410c2c56806323ada0bfbcc0e0bb`.
- Evidence root:
  `foundation/controller-programming/7d3be985-9de8-4912-ad3a-54556321b1bb/`.

## SD card identity block

- Protocol card status: CID unavailable.
- CID-valid status: CID unavailable.
- Representative-sector-read status: CID unavailable.
- Manufacturer/MID: CID unavailable.
- OEM/application ID: CID unavailable.
- Product name/revision: CID unavailable.
- Serial number/manufacturing date: CID unavailable.
- Complete raw 128-bit CID: CID unavailable.

Reason: the authorized programmer proves code flash, VEEPROM, option memory,
probe, VTref, and running CPU only. It does not interpret mapped firmware RAM or
read the SD/CID contract. A new independently authorized read-only observation
must capture the post-program CID and representative-sector state; historical
Controller B CID data is not substituted.

## Final safety state

The temporary rule allowed only the dedicated programmer bridge subnet to TCP
port `19121`. Its exit trap removed the rule after the one-shot container
completed. The final `inet jlink_hub` chain again contains only the default
non-loopback drop for ports `19120` and `19121`; no programmer container
remains and no programming role or endpoint was persisted.

The Pi source checkout is clean and the appliance remains healthy,
fixture-only, `live_admitted=false`,
`state_changing_profiles_enabled=false`, `bounded_stop_supported=false`, and
`recovery_supported=false`. HPT2 roles/endpoints remain empty. Controller A,
all physical media and power services, USB behavior, and T00 were untouched.

Controller B is now running the exact fixed-mailbox candidate, but it is not
yet accepted for promotion: the separate read-only exact-flash, mapped-state,
CID, representative-sector-read, and HPT gate remains open.
