# Campaign 004 corrected firmware bundle freeze

Status: complete
Result: complete; one clean-source Release bundle is hash-verified, byte-reproducible, and ready for SD Qualifier Gate 2 admission
Type: evidence
Updated: 2026-08-17
Next Action: request 005 may admit this exact bundle without programming either controller
Campaign: 004-produce-and-freeze-corrected-firmware-bundle
Manifest Version: 1

## Frozen identity

| Item | Frozen value |
| --- | --- |
| Bundle ID | `smi-00-05-00-cae69f7c7943-75f108d5e2e7-release` |
| Bundle path | `work/evidence/generated/campaign-004-firmware-bundle-20260817/smi-00-05-00-cae69f7c7943-75f108d5e2e7-release` |
| Source commit | `b6aadb53fbdca20d9858bd8bb463b3b504e18284` |
| Source tree | `77c9b4b925b064e1295644052f9f50f4227b8946` |
| Source snapshot SHA-256 | `CAE69F7C79434D81A8C0B1A3811D8FDFB8A3A41A6C36D6CCB0A0026BA7ED79D8` |
| Source state | clean; `clean-git-tree/v1`; dirty `false` |
| Firmware | SMI `00.05.00`; Production; Release |
| Builder | canonical managed e2 rebuild; e2 studio `2024-01.1`; SSP `2.6.1`; GNU Arm Embedded `10.3-2021.10` |
| Qualification profile | `HPT2_ENDURANCE_BASELINE_V1`, version 1; `live_admitted=false` |
| Qualifier contract | `pi-qualification-interface/v0.1` |

The source correction and qualification closeout were reviewed and frozen in
commit `b6aadb53`. A fresh canonical managed Release rebuild completed in 66.8
seconds from that clean commit. Packaging independently validated the clean
source identity, ABI/symbol contracts, profile contract, and every declared
member before making the final bundle files read-only.

## Member manifest

| Member | Bytes | SHA-256 |
| --- | ---: | --- |
| `artifacts/7520553_SMI_FW.elf` | 11,425,680 | `D363218F2BBEAD6B339A86F82F25474BAEB454600AF21365FB32C93572BEEB06` |
| `artifacts/7520553_SMI_FW.map` | 5,458,340 | `6C60B509F6F0F816CA85C302E677550B773ECFD6B74AF8F3B7173501ABFCE411` |
| `artifacts/7520553_SMI_FW.srec` | 8,678,266 | `75F108D5E2E77031E107B2D71852545C9FD246B128085CCB7D4F6E256BC37462` |
| `bundle-manifest.json` | 1,275 | `364ACF583A08F2EBA33A0B67BB75C26D9A1BB277C08FA7900873B7790256B399` |
| `diagnostic-mapping.json` | 28,724 | `6FC42339C0DB5AD94D63F1F1425168D98BC1F8C54F82AC6FCB4916F637FD8519` |
| `firmware-build.json` | 2,064 | `A4B165E88ECB6A59F85BAED4E01EAE2EB739BDE69D4199A2267DC5F40019784D` |
| `profile-contract.json` | 5,915 | `B0D5247F4C2DE03B02AB57C5748920A606D4B37CBA61B82AEB065777F10FA0E8` |

An independent second package at
`work/evidence/generated/campaign-004-repro-check-20260817/smi-00-05-00-cae69f7c7943-75f108d5e2e7-release`
has the same seven relative paths, byte counts, and SHA-256 values. There are
no unexplained nondeterministic fields: the two bundles are byte-identical.

## Correction and regression evidence

The frozen S-record is exactly the successor S-record verified on both
controllers in
`work/evidence/campaign-003-fast-history-route-authorization-and-clean-stop-20260817.md`.
Independent 4 MiB target flash captures matched expanded-image SHA-256
`6EEF5DB83CE2AE71AEB63D598ECAD1CFA7D68475EBFE052301F4FC2A0F97DFC4`.
The same evidence records healthy post-program identities:

| Role | Protocol state | CID valid | Representative read | HPT state/status | System errors | Raw CID |
| --- | ---: | ---: | ---: | --- | ---: | --- |
| A | 6 | 1 | 0 | 5 / 0 | 0 | `05000C61736466672200001C8901A34F` |
| B | 6 | 1 | 0 | 5 / 0 | 0 | `05000C61736466672200001C8201A379` |

The exact successor corrected the stale moving-retention-floor refresh guard.
Campaign 003 measured populated ten-minute exports from million-record stores
at 4.80 seconds on A and 5.03 seconds on B versus 1,177.33 and 693.90 seconds
before correction, within the owner-approved 60-second/8,192-record budget in
`work/evidence/hpt-bounded-export-preimplementation-baseline-and-budget-proposal-20260814.md`.
Near visible-capacity exports completed in 200.01 and 224.33 seconds with no
degraded records, gaps, or fallbacks. Independent reader validation confirmed
the CSV contents, completion trailers, FAT copies, and absence of temporary
publication files.

Fresh frozen-commit checks pass:

- graph-cache invariants `15/15` and model;
- customer-export invariants `40/40` and million-record bounded oracle;
- commissioning invariants `100/100` and lifecycle policy `16/16`;
- USB mass-storage source/configuration checks; and
- USB workflow models `12/12`.

These checks retain the isolated 32 KiB FileX write cap and the standards-based
USB publication path. The fuller software gate is recorded in
`work/evidence/hpt-bounded-export-software-gate-20260814.md`; the completed
ticket is
`work/tickets/ticket-eliminate-full-history-scan-latency-for-bounded-hpt-customer-exports.md`.

## Rollback

The explicit emergency rollback is the immediately preceding reviewed Release
candidate restored and independently verified on both controllers during
Campaign 003:

- S-record SHA-256:
  `D1FBFC257043DFFB04DA9B883F26992DF4D8EE1525089BE63485E43A0519E761`;
- expanded 4 MiB flash SHA-256:
  `6974B370AF81405A66743FA85A229856B3AAF87DA2DC5B12BB3781C7476B1C60`.

Rollback is an emergency recovery identity only. It removes the successor's
moving-retention-floor correction and can reintroduce the stale boundary
behavior; it is not the preferred customer image.

## Known limitations and boundary

- `USB07_32G` retains its accepted pre-existing two-cluster primary-FSInfo
  offset. It was unchanged, not repaired, and is not described as clean.
- The owner deferred destructive physical wrapped-history qualification to
  preserve both million-record SD datasets. The deterministic wrap model
  remains valid, but this bundle freeze does not claim new physical wrap
  evidence.
- CID evidence proves card identity, not authenticity.
- This campaign did not program a controller, move media, import or register
  the bundle, deploy SD Qualifier, push, or externally release anything.
  Request 005 owns admission and keeps controller programming out of scope.

## Disposition

One immutable corrected Release bundle is frozen with exact source, build,
profile, artifact, target, limitation, and rollback identities. SD Qualifier
Gate 2 can consume the named directory without inspecting the worktree or
guessing which firmware candidate is intended.
