# Controller B bc0b6ce4 read-only identity, CID, and HPT pass evidence

Status: complete; independently observed exact fixed-mailbox firmware, stable mapped state, fresh CID, and non-disqualifying HPT baseline pass
Type: evidence
Updated: 2026-08-02
Next Action: retain with successor `work/evidence/controller-a-bc0b6ce4-program-verify-readonly-identity-pass-20260802.md`; review the separately gated A/B HPT2 stop/recovery measurement plan before enabling commands
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Checklist: work/checklists/checklist-promote-bc0b6ce4-fixed-mailbox-candidate.md

## Authorization and boundary

The owner's fresh `authorized` response was consumed by exactly one new
Controller B-only read-only observation. Role B alone was temporarily enabled
at `host.docker.internal:19121`; role A and its endpoint remained empty. The
host temporarily admitted only observer bridge `br-e73da0120aa0`, subnet
`192.168.16.0/20`, to B port `19121`, with unconditional cleanup.

The operation did not authorize or perform programming, erase, reset, halt,
target writes, HPT2 Start/Stop, admission, media, power, USB, Controller A, or
T00 work. It ran once and was not retried.

## Preflight

- Pi source and all long-running application containers were exact at clean
  commit `3e13198adafc041d4a6d37ba544dd45c255bffdb`, release
  `observer-vtref-fix-3e13198`, image
  `sha256:e0757fc0bfce085b191b4f02f183ca417fdd07b06c6394ce9599c1eacdda93d8`.
- Appliance health was green and fixture-only; live admission, state-changing
  profiles, bounded stop, and recovery remained false.
- Protected registry SHA-256 was
  `723fcd993b14ae29c8737756a7f6aa5c887c8b68491b06b47d0e06861889a91b`.
  B was uniquely bound as assembly `1751219`, hardware variant `1`, probe
  `69660123`, manifest `5df475bd...176ce`, and disabled for qualification. A
  was unchanged and disabled.
- Bundle `smi-00-05-00-bc0b6ce4d066-release` was valid, unadmitted, scope
  `none`, and stored as exact manifest/content address `5df475bd...176ce`.
- No controller tool container, persisted observer/HPT2 role, or endpoint
  existed. Both J-Link services were active and the host firewall contained
  only its default non-loopback drop for ports `19120` and `19121`.

## Immutable observation result

Operation `a05bc76d-1c48-49eb-9280-cade00058c02` completed `PASS` with
`read_only=true` and `qualification_outcome_changed=false`.

- Result path:
  `foundation/controller-observations/a05bc76d-1c48-49eb-9280-cade00058c02/result.json`.
- Result SHA-256:
  `f6f7b972220450f2b61f232ae21a4a62a7e75a0967d985aa292b1ae02ab5b6e2`.
- Transcript path:
  `foundation/controller-observations/a05bc76d-1c48-49eb-9280-cade00058c02/jlink-transcript.log`.
- Transcript SHA-256:
  `b09e56350cda984c55d601e40fffa33b0d99ae16761271cacb462b1a6a2dcab8`.
- Transcript size: 7,079 bytes.
- UTC interval: `2026-08-03T03:09:56.840008+00:00` through
  `2026-08-03T03:10:20.884575+00:00`.

## Firmware, controller, and stable state

- Expected and observed complete 4 MiB flash SHA-256 both equal
  `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28`.
- Bundle manifest/content address is `5df475bd...176ce`; source is
  `bc0b6ce4d0666cacd65e19efd2c3b56add39a50f`; mapping SHA-256 is
  `0b8b68c32955177a731f55e3dce6637100a3bcaf016ef9da729721295ef24770`.
- Assembly `1751219`, hardware variant `1`, and probe `69660123` match the
  protected registry. VTref was positive at 3.308 V and the CPU was proven
  running before and after both read-only phases.
- Both exact-length mapped passes were byte-identical.
- Main system errors `0`; SD last status `0`; SD state `6` (`RAW_HPT`).
- SD detection state `5` (`READY`); CID-valid true; representative-sector-read
  true.

## Required same-run CID identity block

- Protocol card status: detection state `5` (`READY`); SD state `6`
  (`RAW_HPT`); driver status `0`.
- CID-valid status: true.
- Representative-sector-read status: true.
- Manufacturer: SanDisk; MID `0x03`.
- OEM/application ID: `SD`.
- Product name: `SS08G`.
- Product revision: `8.0`.
- Serial number: `2540634245` (`0x976F0085`).
- Manufacturing date: May 2024; valid true.
- Complete raw 128-bit CID: `035344535330384780976F0085018507`.

This is a distinct same-run B-card identity; historical A or B CID data was not
substituted.

## HPT status and diagnostic-bit disposition

- HPT media state `5` (`HPT_READY`), HPT status `0`, SSP status `0`, first
  error sector `0`, and initialization phase `0` (`IDLE`).
- Sector count `15,523,840`; acknowledged records `36`; iterated records `0`.
- Lane mask `7`; mismatch count `0`; lost count `0`; replacement request false.
- Retired segments `[2, 1, 0]` are retained baseline retirement state. All
  three lanes remain present and the firmware does not request replacement, so
  these counters are not a current identity/readiness failure. They must remain
  part of later endurance and media-health comparisons.
- Diagnostic pass mask is `4087` (`0x00000FF7`) and failure mask is `8`
  (`0x00000008`). Bit 3 is the legacy
  `HPT_DIAG_MULTI_BLOCK_REJECTED` predicate. Current HPT v0.5 intentionally
  supports bounded multi-block reads, so success of that read makes the old
  rejection predicate false. The same sole bit was present in the previously
  accepted Controller A observation; the other eleven diagnostic bits pass.
  This is diagnostic-contract debt, not evidence of HPT I/O, corruption,
  mismatch, loss, or replacement failure. It must be reconciled before final
  firmware release without being mislabeled as a media failure.

The applicable checklist requirement is zero *disqualifying* system/SD/HPT
state. That requirement passes: all operational status/error fields are clean,
the media is ready, and the only diagnostic bit is the obsolete rejection
expectation above.

## Final safety state and disposition

The exit trap removed the temporary B firewall rule. The final firewall again
contains only the default non-loopback drop for J-Link ports `19120` and
`19121`; no observer or programmer container remains; read-only and HPT2 roles
and endpoints are empty. Registry SHA-256 remains `723fcd99...a91b`.

The Pi source is clean at `3e13198a`; the appliance is healthy with
`fixture_only=true`, `live_admitted=false`,
`state_changing_profiles_enabled=false`, `bounded_stop_supported=false`, and
`recovery_supported=false`. Controller A was untouched.

Controller B satisfies the fixed-mailbox programming and independent
read-only identity/CID/HPT promotion gates. The later authorized Controller A
promotion also passed and is recorded in
`work/evidence/controller-a-bc0b6ce4-program-verify-readonly-identity-pass-20260802.md`.
HPT2 measurement remains a separate later gate.
