# Controller A baseline scrub read-only reconciliation — 2026-08-05

Status: PASS; the existing baseline scrub is complete and its post-result CID is linked
Type: evidence
Updated: 2026-08-05
Next Action: implement and admit an exact HPT initialization operation, then mint a fresh non-replayable machine intent under the reviewed campaign scope; do not initialize manually
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-hpt-bounded-full-address-read-scrub.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Scope and safety boundary

The restart return path resumed only existing Controller A scrub operation
`6279f027-759c-46be-b3ce-ad70766c5707`. The command word had already been
published once and was never replayed. No reset, programming, power operation,
SD initialization, format, card movement, or target-memory write occurred.

The Pi remained on source `1e62f3363998a353b55c01bd4e5cb33c3e33a678`,
release `authorization-envelopes-1e62f33`, and deployed image
`sha256:505ea42f0bc3ff561da26bcc1382d27073d750ac4aa5d9718174a38bf9f1c730`.
HTTP health passed with database, evidence storage, clock, and both workers
ready. J-Link A serial `69664082` was present on the expected direct USB path.

The first management-command wrapper was rejected before target access because
PowerShell appended a carriage return to the UUID. A second pre-target attempt
was rejected because Controller A remained disabled in the protected registry.
Neither attempt changed the durable operation or contacted the target. The
successful invocation transiently enabled only Controller A and only the
dedicated observer bridge to port `19120`; cleanup restored the protected
registry SHA-256
`37710ee75360f148b805d8f9d025cbf74a71a0b002240ca46b30dd79dff87647`
and the default non-loopback J-Link drop rule.

## Reconciliation result

The dedicated `reconcile_full_address_scrub` path completed one stable,
two-pass fixed-address read and published no target command.

- Durable state: `COMPLETED`.
- Terminal code: `FULL_ADDRESS_SCRUB_PASS`.
- Read-only: `true`.
- Automatic retry performed: `false`.
- Automatic replay allowed: `false`.
- Command word: `0`.
- Total/completed sectors: `15,728,640` / `15,728,640`.
- Block size: `512` bytes.
- Transfer/read attempts: `245,760`.
- Failed sectors: `0`.
- Retry-recovered sectors: `0`.
- Identity mismatch: `0`.
- HPT status: `0`.
- Controller run delta: `1,349`.
- Maximum read time: `2` ticks.

Pi Evidence `26` is the immutable reconciliation transcript, SHA-256
`aca54dc78c9c6d20bbd6822a6366d60f38971948a2016a891fbda389696d8350`.
Pi Evidence `27` is the immutable reconciliation result, SHA-256
`819fce6f6d799ee9de25906b7c8f63c1fcda704aa43f386b3325a5141da77de5`.

## Post-result controller and CID identity

Read-only observation `c59cb0db-1c00-4226-bd6b-8ed60c5c2f67` passed after
the reconciliation and is linked to the same scrub through Pi Evidence `28`
and CID capture `6`. Expected and observed complete 4 MiB flash both equal
`b1abe4776388b0978a2a1f93473e25a0091af8da535aa54582bb270b2dfcabb3`.
The CPU was running before and after, J-Link serial was `69664082`, and VTref
was `3.282 V`.

- Protocol/card status: `DETECTION_NEEDS_INITIALIZATION; SD_UNAVAILABLE; DRIVER_OK`.
- CID-valid status: pass.
- Representative-sector-read status: pass.
- Manufacturer name: `Unknown CID manufacturer (retail brand KEXIN)`.
- MID: `0x05`.
- OEM/application ID: `0x000C`.
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7305 (0x00001C89)`.
- Manufacturing date: `2026-03`.
- Complete raw 128-bit CID: `05000C61736466672200001C8901A34F`.

The observation result SHA-256 is
`39c97c6533c5f9604eb25c975c0068c0992018dd3d3ab9dbe38651cd9cf08ba7`;
its J-Link transcript SHA-256 is
`ed0ded4d7a1f48d364e67356fa443da8d6be274b9c758640d080c5499d6dc894`.
CID is identity evidence, not proof of authenticity.

## New gate

Campaign assignment `11` is now `BASELINE_SCRUB_PASSED`, and Pi event `51`
records the read-only closeout. The deployed appliance intentionally reports
all state-changing profiles disabled and has no admitted HPT initialization
adapter or machine-intent execution path. Manual HMI/service initialization
would bypass the reviewed envelope model. Qualification therefore stops before
the destructive initialization transition; no initialization was attempted.
