# Controller A read-only bundle identity and snapshot evidence

Status: complete
Result: complete historical pre-program evidence; candidate identity blocked before mapped RAM access
Type: evidence
Updated: 2026-08-02
Next Action: none; superseded by the authorized candidate installation and passing observation
Campaign: 004-produce-and-freeze-corrected-firmware-bundle
Superseded By: work/evidence/controller-a-candidate-program-verify-and-observation-20260802.md

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackages:

- work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
- work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md

## Scope and safety boundary

The owner authorized a bounded physical read-only stage. Only Controller A,
assembly `1751136`, hardware variant `0`, J-Link `69664082`, endpoint `19120`
was contacted. Every observation used J-Link `ForceAttachTarget=1`; CPU state
was proven running before and after each phase. No halt, resume, reset,
programming, erase, target-memory write, power operation, block-device access,
SD movement, or media write occurred. Controller B, its endpoint, and the T00
USB incident were not accessed.

The Pi's default host policy rejects both J-Link ports outside loopback. For the
single appliance observation, a temporary rule allowed only the dedicated
observer bridge to Controller A port `19120`. The rule was removed immediately
afterward. The final policy again rejects non-loopback access to both `19120`
and `19121`.

## Firmware release and bundle identity

- Adopted portable source: HPT v0.5.0 tag commit
  `d7b1dbe88917e6e8afb59ca2104f6fb411b16d8d`.
- Portable release archive SHA-256:
  `361b06270f1b5ccac4afd2c8e565b6b7d7fc15bbab9c76a7c5c3db90c0801431`.
- SMI adoption commit: `fae4404f9f8df3b91171a3c04910c3b60a7f760c`.
- SMI bundle-packager/source commit:
  `248c1e7b7aabe1d0da306e65b03baa5a3e05e67f`.
- Bundle ID: `smi-00-05-00-248c1e7b7aab-release`.
- Outer canonical manifest SHA-256:
  `2340c9e85e91df24abe5eadeabf9220b1bd8b0b8cdc5de79cff09f1a2dfe0d28`.
- Diagnostic mapping SHA-256:
  `38c1fb7b4052537cc52d35bf620e1acc180e9e0cb3261d821806c23fa9754c44`.
- Candidate Release S-record file SHA-256:
  `5be1c0919bd08b1f812f4e25618d543a097be2fb3fe4e69a4a3a8da2f4b161ca`.
- Candidate complete 4 MiB erased-space flash SHA-256:
  `d1babfa7a65610544741c0b329212b0eadfc92b32a8e95b513e2e2ec9ae70556`.

Managed Debug and Release rebuilds, packaging, static/invariant gates, the
triple-circular model, the 141-cut recovery model, scrub model, and export model
passed before publication. The Pi imported the bundle valid but unadmitted;
import did not authorize controller access or programming.

## Installed Controller A identity

Independent fixed-address fingerprints and a complete 4 MiB readback identify
the installed image as the Release build from source commit
`ca6f573a8d30c264ecd6de084786b12696c63d81` (`Validate USB BOT command status
wrappers`). The complete flash SHA-256 is:

`23428a890890ca40172483a683f2b985c5bfc640650e7b33b977ead15db754ca`

It exactly matches the tracked Release S-record semantic image. Installed
artifact identities are:

- ELF SHA-256:
  `68ac029578be8edb7cd3f5b39254c8a4b5351a5e9161e87dde7a1d2dc6ecf0a9`;
- S-record file SHA-256:
  `6907f88fb91d5dc58ebf15a918c3993fde3a076afae9daefb099899f55932581`.

The prior inventory claim that the `35B020FD...` Debug image was current was
therefore stale and is superseded by this complete flash match.

## Exact installed-image RAM snapshot

Two exact-length passes over the installed Release mapping were byte-identical.
The snapshot is identity and health evidence, not qualification approval:

- hardware variant `0`; system errors `0`;
- SD last status `0`, state `6` (`RAW_HPT`);
- HPT state `5` (`HPT_READY`), HPT/SSP status `0/0`, first-error sector `0`;
- sector count `15,523,840`;
- acknowledged/iterated records `1,685/0`;
- diagnostics passed/failed `4,087/8`;
- active lane mask `7`, retired segments `0/0/0`;
- mismatch/lost counts `0/0`, replacement false, initialization phase `0`;
- protocol detection state `5`, CID valid, representative-sector read valid;
- raw CID `035344535330384780976F0084018559`;
- MID `0x03`, OEM/application ID `SD`, product `SS08G`, revision `8.0`,
  serial `0x976F0084`, manufacturing date May 2024.

## Pi observer implementation and terminal result

`PC-Redemption/sd-qualification` PR #18 merged as
`7efbad70ede0dcb79f0a5f84e52810c707dea07e` and is deployed healthy as release
`controller-observer-7efbad7`. The app remains fixture-only,
`live_admitted=false`; both protected controller entries have
`enabled_for_qualification=false`. Role B was negatively tested and blocked
before endpoint access.

Authorized Controller A operation
`ce3c5f3c-47b8-4b37-9beb-61925a58bbad` produced:

- classification `BLOCKED`;
- blocker `FIRMWARE_IDENTITY_MISMATCH`;
- CPU running before and after;
- expected candidate flash
  `d1babfa7a65610544741c0b329212b0eadfc92b32a8e95b513e2e2ec9ae70556`;
- observed installed flash
  `23428a890890ca40172483a683f2b985c5bfc640650e7b33b977ead15db754ca`;
- `snapshot: null`, proving no mapped RAM interpretation after mismatch;
- `qualification_outcome_changed=false`.

The J-Link transcript contained only `exec`, `connect`, two `ishalted`,
`savebin`, and `exit` commands. Its SHA-256 is
`dd2d4360c9605e5e69f3a01ca02079e21d0f08a5c1aacc73fe7784bcf9ad0392`.
The result JSON SHA-256 is
`3f1e4fe25681820bb1354c25a33e61ba9de429483d8a4f189455be53017fd0aa`.
Generated evidence remains in the Pi application's confined evidence store.

## Disposition

This was the correct pre-program disposition. It is superseded for current
Controller A state by
`work/evidence/controller-a-candidate-program-verify-and-observation-20260802.md`.

The read-only adapter boundary was proven for Controller A and failed closed on
exact firmware mismatch. At capture time it did not establish exact-candidate
target readiness because Controller A still ran the older `ca6f...` Release
image. The then-next target-changing step was the separately authorized
Controller A-only program/verify/reset followed by the observer gate; that
successor is recorded in the superseding evidence above. Controller B remained
frozen and outside that request.
