# Controller A integrated 00.05.00 load and read-only gate

Status: pass; service-467 and service-514 fixed-range screens confirmed
Type: evidence
Updated: 2026-07-24
Next Action: continue with controller-a-calibration-matrix.md
Campaign Reason: Historical record from campaign 010-qualify-firmware-negative-and-recovery-behavior; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-smi-firmware-mitigation-hardware-qualification.md

## Candidate identity

- Controller: A, assembly `1751136`, hardware version `0`.
- J-Link: serial `69664082` through `srv-rpi00.local`, target voltage `3.298 V`.
- Branch: `codex/firmware-00-05-00-hpt-filesystem`.
- Source commit: `809362d8`.
- Artifact commit: `c7a20522`.
- Programmed artifact: `Debug/7520553_SMI_FW_00_05_00.srec`.
- Programmed S-record SHA-256:
  `BA2CF3DB7A52C1487A28C1F274D7DBF0D60F17F3A2E014DE015ADE4508FAF15C`.

The hostname-only `program-bench.ps1` path selected J-Link `69664082`.
SEGGER reported three affected code-flash ranges, 2,867,200 bytes, and completed
`Program & Verify`. Option memory already matched. The script reset the target,
started it, and detached with the CPU running. Controller B was not programmed.

## Configuration and calibration preservation

- Pre/post 4 KiB VEEPROM captures are byte-identical:
  `E5AABD742D00C7E65B90D6C017553E2041A2947EC77A5F1C4AF3BE489DE8A186`.
- Pre/post option memory is byte-identical:
  `80A76A18ACF8CB64FEC3A659FFC4BAB4A87CD9A6FDE4DAB2161A8751D136C9D2`.
- Both VEEPROM blocks remain CRC-valid, byte-identical, generation `191`.
- Identity remains serial `7162026`, model `3`, part ID `SLM622`.
- Stored main-temperature offset remains `+0.3000 C`.
- Live RTD sample after load: raw `22.4196 C`, adjusted `22.7196 C`.
- Main configuration semantic findings, changes, inhibited controls,
  commissioning-required flag, and startup events are all zero.
- Main system error bits: `0x00000000`.

## SD/HPT and CID identity

- Protocol card state: `READY`.
- CID valid: yes.
- Representative-sector read valid: yes.
- Driver status: `0x00000000`.
- Manufacturer-reported identity: MID `0x03`, OEM `SD`, product `SS08G`,
  revision `8.0`, serial `0x976F0084`, May 2024.
- Raw CID: `035344535330384780976F0084018559`.
- Raw CID exactly matches the pre-flash baseline.
- Production SD state: raw HPT.
- HPT media state: ready.
- HPT/SSP status: both zero.
- Sector count: `15,523,840`.
- Diagnostics passed mask: `0x00000FFF`; failed mask: zero.
- Last lane mask: `0x00000007`.
- Retired segments: `0 / 0 / 0`.
- Mismatch/lost counts: `0 / 0`.
- Replace-media request: `0`.

CID is identity evidence, not proof of authenticity.

## Evidence files

- `setup-a/program-c7a20522.log`
- `setup-a/postflash-capture.log`
- `setup-a/postflash-veeprom.bin`
- `setup-a/postflash-option.bin`
- `setup-a/postflash-ram.bin`

The first remaining gate is visual/operator-facing. No claim is made yet about
the service-467 layout, service-514 fixed interval, calibration boundary
messages, or other screen behavior.

## Operator confirmation

On 2026-07-24 the owner reviewed operator service 467 on Controller A and
confirmed the complete SD status/CID screen. This closes the post-load visual
identity/status gate for the frozen candidate.

The owner then opened service 514, confirmed its displayed range is `-10.0 C`
to `+10.0 C`, and left the stored value at `+0.3 C`. This passes the range
presentation and non-mutating exit check. Subsequent endpoint review established
that decrement reaches `-10.0 C`, but increment stops at `+9.9 C`. The endpoint
defect and the corrected primary qualification scope (Temperature Setup ->
Calibrate) are tracked in `controller-a-calibration-matrix.md`.
