# Incident: Controller B false configuration-invalid warning

Status: completed
Type: incident
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 010-qualify-firmware-negative-and-recovery-behavior; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-operator-warning-truth-and-false-positive-prevention.md

## Impact

Controller B presented a critical configuration warning immediately after an
operator changed the temperature setpoint. The warning said configuration was
invalid or could not be saved and heating was disabled. At the time of the
read-only capture, none of those claims was true. The event interrupted
operation and risked degrading confidence in future safety warnings.

## Timeline

- 2026-07-26: operator changed the Controller B setpoint.
- The Home screen opened the combined configuration-invalid/save-failed modal.
- Before OK was pressed, read-only J-Link evidence was captured.
- The capture showed system errors 0, operational 1, findings 0, controls
  inhibited 0, save request 0, and final commit success.
- Commit diagnostic attempt 2 ended at `0xFFFF` with error 0.
- RAM and both 2 KiB persisted blocks were identical, CRC-valid, generation
  165, and carried the complete current-SMI fingerprint.
- The operator was told OK was safe; firmware prevention work began before
  resuming graph review.

## Cause

The configuration save path treated a storage attempt failure as immediately
non-operational and scheduled an automatic retry. The Home screen polled only
`AppConfigIsOperational()`, latched a one-shot boolean, and opened a modal
without distinguishing semantic invalidity, an intermediate storage retry, or
the final result. A retry could therefore commit successfully after the HMI
had latched the warning. The final commit diagnostic overwrote the first
failure, hiding its stage/error.

The old diagnostic structure could not identify the initiating error. The new
retained diagnostic reproduced it on every non-destructive A/B save exercise:
stage `0x00001100`, error `0x000001F5` (`SSP_ERR_CMD_LOCKED`). Attempt 2 then
committed successfully.

## Recovery

No configuration repair was needed. The automatic second attempt had already
restored durable, redundant state before the capture. Acknowledging the stale
modal was safe.

## Prevention

Configuration persistence must publish a bounded transaction with non-terminal
save/retry states, terminal reason, attempt count, first and final diagnostic,
recovery marker, and actual heating-inhibit state. The HMI must warn only from
a terminal snapshot, re-read it immediately before display, use reason-specific
wording, and key acknowledgement to the transaction.

The same terminal/revalidation policy applies to SD/HPT and export warnings.

## Follow-Up

- [x] Preserve the pre-acknowledgement capture at
  `work/evidence/hpt-log-store-circular-mirror/controller-b/config-invalid-before-ok-20260726/`.
- [x] Define canonical warning-truth policy.
- [x] Implement bounded terminal configuration status and retained diagnostics.
- [x] Migrate high-risk HMI warnings and add enforcement tests.
- [x] Program and prove B first without formatting, then A.
- [x] Record exact candidate hash, CID, save behavior, graph readiness, and
  cache timing.

## Closeout

Candidate
`944BEA28BFD6DE5604A5BE1B03F4F5690CA84213B2BD923940ED27D193844501`
passed the clean build, all 19 repository checks, and exact setpoint
save/restore exercises on A and B. Each first attempt reproduced
`SSP_ERR_CMD_LOCKED`, each second attempt committed, neither control latched a
warning transaction, both remained operational, and the exact original
configuration was restored redundantly. Controller B retained its abnormal
lane layout without formatting. Full evidence is in
`work/evidence/operator-warning-truth-and-target-proof-20260726.md`.

## Owner-directed reconciliation — 2026-09-23

Reconcile stale active lifecycle to the previously documented completed disposition; no new test or broader acceptance claim.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: complete; reproduced cause corrected and target-proven
> Next Action: none; physical negative-fault qualification remains separately governed

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
