# Promote the bc0b6ce4 fixed-mailbox candidate Checklist

Status: complete
Result: complete; both controllers pass fixed-mailbox programming and independent read-only identity/CID/HPT promotion gates
Type: checklist
Updated: 2026-08-02
Next Action: none; retain with the A/B immutable promotion evidence and continue through the separately gated stop/recovery workpackage
Campaign: 004-produce-and-freeze-corrected-firmware-bundle
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Authorization disposition

The owner separately authorized the reviewed B-only registry/programming slice,
one B-only observation that stopped on the observer's exact-VTref comparison
defect, and one fresh B-only observation after PR #29 corrected and deployed the
defect. Each authorization was consumed once and neither observation was
automatically retried. The fresh operation `a05bc76d...` passes exact flash,
stable mapped state, CID, and HPT readiness. The owner then authorized the
remaining A promotion end-to-end; programming operation `ae2fe6ff...` and
independent observation `e140c0f2...` pass without retry or rollback.

## Exact identities

| Identity | Reviewed value |
| --- | --- |
| Candidate bundle | `smi-00-05-00-bc0b6ce4d066-release` |
| Candidate source | `bc0b6ce4d0666cacd65e19efd2c3b56add39a50f` |
| Candidate manifest/content address | `5df475bd0b2de8792f40bc2bd49efde37fce66f9b80bd24b4bb2e675fc1176ce` |
| Candidate S-record SHA-256 | `3cfd2c7c571f32a11a14b28b7c72c0cec36b9861ac87068da47ad4cced1ab391` |
| Candidate complete 4 MiB flash SHA-256 | `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28` |
| Candidate mapping SHA-256 | `0b8b68c32955177a731f55e3dce6637100a3bcaf016ef9da729721295ef24770` |
| Candidate profile SHA-256 | `945ebbc67c1673ecef3d8d185de415a4613bd6050d13e1b0f1d12d260e434e00` |
| Current registry SHA-256 | `47f0839ee4265a58929c5b5d45eabf750a642409cc86773ee5eaed249dd83d15` |
| Controller B pre-promotion flash | `23428a890890ca40172483a683f2b985c5bfc640650e7b33b977ead15db754ca` |
| Controller B current flash | `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28` |
| Controller A pre-promotion flash | `d1babfa7a65610544741c0b329212b0eadfc92b32a8e95b513e2e2ec9ae70556` |
| Controller A current flash | `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28` |

The Pi independently derived both candidate flash hashes from the stored
S-record using the deployed programmer's erased-space expansion. The S-record
contains only one ignored erased 16-byte record outside code flash at
`0x40120050`; it contains no non-erased data outside the 4 MiB code-flash
region.

The firmware delta from the registry-bound `248c1e7b...` candidate to
`bc0b6ce4...` changes the HPT2 SD-service ABI, its contract/model/packaging
support, and build artifacts. It does not change `Thread_Usb_entry.c` or USBX.
This promotion therefore neither resolves nor reopens T00 and introduces no
USB retry, delay, reset, lifecycle, or specimen-specific rule.

## Controller B first slice

### Pre-mutation gates

- [x] Confirm central and Pi source worktrees are clean and the Pi appliance is
  healthy, fixture-only, and live-unadmitted.
- [x] Revalidate the imported bundle and idempotent stored-member readback as
  manifest `5df475bd...176ce`, with `admitted=false` and scope `none`.
- [x] Capture the current protected registry bytes and verify SHA-256
  `39c021d6...a49af7` before editing.
- [x] Prepare a candidate registry document that changes only Controller B's
  `bundle_manifest_sha256` to `5df475bd...176ce`. Preserve both assembly,
  probe, and hardware-variant identities; preserve Controller A's older bundle
  binding; keep both `enabled_for_qualification=false`.
- [x] Validate the candidate registry with the deployed registry parser before
  atomically replacing the protected file. Retain the exact old bytes for
  registry rollback.
- [x] Confirm HPT2 roles and endpoints remain empty. Candidate promotion does
  not authorize Start/Stop or live admission.
- [x] Configure only `SDQ_PROGRAM_CONTROLLER_ROLES=B` and Controller B's
  protected program endpoint. Leave Controller A absent.
- [x] Open only the previously reviewed temporary firewall path from the
  programmer tools network to Controller B port `19121`; arrange unconditional
  cleanup.

### One-shot program operation

- [x] Invoke exactly one `program_controller_candidate B` operation with:
  bundle `smi-00-05-00-bc0b6ce4d066-release`, authorized S-record
  `3cfd2c7c...1ab391`, and authorized current flash
  `23428a89...754ca`.
- [x] Require assembly `1751219`, probe `69660123`, hardware variant `1`,
  positive VTref, and a running CPU before mutation.
- [x] Require the programmer's complete preflight capture of 4 MiB code flash,
  4 KiB VEEPROM, and option memory before `loadbin`.
- [x] Do not retry after any target command. The existing bounded reconnect
  window applies only to the exact SEGGER refusal proven to occur before probe
  or target access.
- [x] PASS only on complete candidate flash `68029e19...7bb28`, byte-identical
  pre/post VEEPROM and option memory, and a running CPU after the fixed
  program/verify/reset/run sequence.
- [x] If program or postflight verification fails after mutation, allow only
  the programmer's same-operation rollback to the captured pre-change code
  image and require complete rollback readback. A rollback result is not PASS.
- [x] Remove the temporary firewall rule and all program roles/endpoints after
  the one-shot container exits, regardless of result. Confirm no programmer
  container remains.

### Independent Controller B observation

- [x] Proceed only after programming returns
  `PASS/PROGRAM_VERIFY_RESET_RUN_COMPLETE`.
- [x] Invoke one separately bounded read-only Controller B observation against
  bundle `5df475bd...176ce`. The consumed attempt stopped pre-publication on the
  Pi observer's exact-VTref comparison defect and is not an identity-gate PASS.
- [x] Correct the observer to compare the exact registered serial across phases
  while independently requiring positive VTref in both phases; pass 9 focused
  and all 129 application tests, merge Pi PR #29, and deploy exact clean release
  `observer-vtref-fix-3e13198` with all controller roles/endpoints empty.
- [x] Obtain fresh authorization and invoke exactly one new bounded B-only
  observation; do not treat the deployed fix as authority or automatically
  retry the consumed attempt.
- [x] Require complete flash `68029e19...7bb28`, two stable passes of every
  mapped object, hardware variant `1`, zero disqualifying system/SD/HPT status,
  and a running CPU before and after.
- [x] Capture the complete same-run SD identity block: protocol card state,
  CID-valid state, representative-sector-read state, manufacturer/MID,
  OEM/application ID, product/revision, serial/manufacturing date, and raw
  128-bit CID. Do not substitute historical CID data.
- [x] Remove the observer firewall rule and role/endpoint after each consumed
  observation and confirm fixture-only/live-blocked health.
- [x] Stop after Controller B. Any BLOCKED, FAILED, INDETERMINATE, rollback, CID
  unavailability, mapped-state mismatch, or cleanup failure prohibits
  Controller A promotion and HPT2 measurement.

## Later Controller A slice

Controller A promotion was executed under the owner's explicit end-to-end
authorization after B's programming and independent observation passed.

- [x] Change only Controller A's registry bundle binding to
  `5df475bd...176ce`, retaining both qualification flags false. At this point
  both roles bind the fixed-mailbox bundle.
- [x] Configure only Controller A programming and port `19120` access.
- [x] Program from authorized current flash `d1babfa7...70556` to candidate
  flash `68029e19...7bb28` using S-record `3cfd2c7c...1ab391`.
- [x] Apply the same complete flash/VEEPROM/option-memory/CPU PASS and automatic
  same-operation rollback requirements used for Controller B.
- [x] Run a separate read-only exact-firmware/mapped-state/CID/HPT observation
  and capture a fresh complete Controller A CID identity block.
- [x] Remove all temporary roles, endpoints, firewall rules, and tool
  containers. Keep both protected controller entries
  `enabled_for_qualification=false`.

## Promotion exit and later gates

Candidate promotion is complete only when both controllers independently pass
the fixed-mailbox read-only identity/CID/HPT gate and the Pi holds immutable,
hash-linked programming and observation results for each role. A PASS does not
enable qualification or prove HPT2 stop/recovery.

After promotion:

- HPT2 roles/endpoints remain empty and live admission remains false;
- the stop deadline remains unset until separately authorized A/B measurement;
- no physical card, power, fault-injection, endurance, calibration, or USB test
  begins from this checklist;
- T00 remains unresolved no-action architecture evidence; and
- representative release regression remains required before a firmware release
  claim, but the promotion itself adds no USB-specific exception or lifecycle.
