# Setup A configuration fault matrix

Status: passed for release; owner accepted representative interruption coverage and waived exhaustive boundaries/explicit driver-failure injection
Type: evidence
Updated: 2026-07-16
Next Action: complete Setup B/media inventory and destructive endurance authorization
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-semantic-configuration-validation-and-recovery.md

## Authority and safety

- Owner authorization for destructive configuration/flash and controlled power
  tests was recorded 2026-07-16.
- The owner confirmed Setup A is a non-process bench unit with disconnected or
  safely simulated loads, independent over-temperature protection, an accessible
  power disconnect, and an available stop operator.
- Fresh program-flash, VEEPROM, and option-memory recovery captures were taken
  before mutation; see `destructive-fault-preflight-20260716.md`.

## Method

Fixtures were derived from the generation-6 SMI7/SLM722 VEEPROM baseline. Valid
fixtures use the R7FS7G27H CRC-32 hardware word-feed order (polynomial
`0x04C11DB7`, seed 0, MSB-first). Each case was programmed and verified, booted
for 20 seconds, inspected through fixed-symbol RAM status, and followed by an
automatic exact-baseline restore and another 20-second boot.

| Case | Expected behavior | Observed result |
| --- | --- | --- |
| Block 0 CRC corruption | Preserve block 1 and repair redundancy | PASS: operational 1, generation 6, event `REDUNDANCY_REPAIRED` |
| Block 1 CRC corruption | Preserve block 0 and repair redundancy | PASS: operational 1, generation 6, event `REDUNDANCY_REPAIRED` |
| Current block plus foreign legacy block | Preserve current block and repair foreign copy | PASS: operational 1, generation 6, event `REDUNDANCY_REPAIRED` |
| Valid block 0 generation 7 plus generation 6 block 1 | Select generation 7 and repair older copy | PASS: RAM selected generation 7, operational 1, event `REDUNDANCY_REPAIRED` |
| Same-generation CRC-valid divergent payloads | Preserve evidence, enter storage recovery, inhibit heat | PASS: operational 0, event `STORAGE_FAILURE`, both heater tick values 0 |
| CRC-valid current SMI with zero I-limit factor | Preserve record, report semantic finding, inhibit heat | PASS: findings `0x14`, one control inhibited, operational 0, both heater tick values 0 |
| Both blocks CRC-corrupt | Install complete clean defaults redundantly | PASS: generation 1, serial/model 0, commissioning 1, event `FACTORY_DEFAULTS` |
| Both blocks CRC-valid legacy/foreign identity | Install complete clean defaults redundantly | PASS: generation 1, serial/model 0, commissioning 1, event `FACTORY_DEFAULTS` |
| Both blocks erased (`0xFF`) | Install complete clean defaults redundantly | PASS: generation 1, serial/model 0, commissioning 1, event `FACTORY_DEFAULTS` |

The clean defaults intentionally retain normal main-temperature operation while
marking the unit Not Configured/commissioning-required. This is the approved
policy already documented in the workpackage and supersedes the stale milestone
wording that implied commissioning state alone must inhibit heat.

## Evidence integrity note

J-Link caches flash content within a programming session. Intermediate
`*-fault-veeprom.bin` files therefore echo the programmed fixture and must not be
treated as independent post-firmware flash captures. Recovery decisions are
supported by RAM status, J-Link's subsequent flash comparison/programming ranges,
and the independent-session final capture. Full J-Link logs are retained for
each case.

## Final restoration

- All nine scripted restore captures matched the baseline hash within their
  sessions.
- A new independent J-Link session captured the final 4 KiB VEEPROM as
  `veeprom-jlink-69664082-20260716-post-config-matrix.bin`.
- Pre/post SHA-256 values are identical:
  `C0AD6BF06D7CA041F36D09A7CBF4205F40E5C762AA736A582AECD080C4B48EFE`.
- Final startup status: `0xC00000FF`.
- Final configuration: operational 1, no findings/events, generation 6,
  SMI7/SLM722 identity preserved.

The target was left running on the exact qualified baseline.

## Transactional interruption results

Three commanded resets exercised distinct commit boundaries:

| Interruption point | Diagnostic | Recovery result |
| --- | --- | --- |
| First-block verified-readback boundary | stage `0x3000`, offset `0x7C0` | PASS: newer verified block selected, redundancy repaired, operational 1 |
| First-block erase loop | stage `0x1002`, offset `0x80` | PASS: untouched block selected, redundancy repaired, operational 1 |
| First-block write loop | stage `0x2007`, offset `0x1C0` | PASS: untouched block selected, redundancy repaired, operational 1 |

Each case completed startup with event `REDUNDANCY_REPAIRED`, then returned to
the exact generation-6 baseline.

## Concurrent-save result

A second save flag was written while the first commit was active at stage
`0x2002`. The first attempt completed, the pending flag was consumed, and a
separate subsequent attempt reached stage `0xFFFF` with no flash error. The flag
was zero afterward, configuration remained operational, and generation advanced.
This passes the hardware pending-request behavior; unrelated normal save requests
may also advance generation, so generation count alone is not used as evidence.

## Physical power-cut result

The first operator cut was inconclusive because disconnecting J-Link resumed the
halted core before power removal. It caused no fault and is not counted.

For the counted case, J-Link remained connected and held the core in the data-
flash write path at stage `0x2002`, offset `0x80`. The waiting J-Link process
exited when target power was physically removed, confirming the target did not
resume before the cut. After the operator restored power:

- J-Link serial `69664082` reconnected at 3.309 V.
- Startup completed (`0xC00000FF`).
- Configuration was operational with no semantic findings.
- Both VEEPROM blocks were CRC-valid, byte-identical, and generation 10.
- Main-temperature control health was normal.

The observed generation is consistent with rejection of the interrupted newer
copy, recovery from the surviving generation-10 copy, and redundancy repair.
The startup event had been cleared by a later normal save-status refresh before
capture, so the event bit is not claimed as direct physical-cut evidence.

Finally, the exact pre-fault generation-6 image was explicitly restored and
verified. `veeprom-jlink-69664082-20260716-final-restored.bin` matches the
pre-fault SHA-256 byte-for-byte:
`C0AD6BF06D7CA041F36D09A7CBF4205F40E5C762AA736A582AECD080C4B48EFE`.

## Owner release disposition

On 2026-07-16, the owner accepted the representative erase-loop, write-loop,
verified-block, concurrent-save, and held physical power-cut coverage for this
release. Exhaustive interruption at every 64-byte boundary and explicit
flash-driver return-error injection are not required release gates. This is a
scope disposition, not a claim that those unexecuted cases passed.

The owner also accepted the executable foreign-layout fixtures plus the
successful hardware legacy/foreign reset cases as sufficient DispTest/DDS
transition coverage for this release. Exact persisted captures from physical
DispTest and DDS units are not required because all records lacking the complete
positive current-SMI fingerprint take the same clean-reset path.

For the media campaign, the owner initially required a separate Setup B and a
temporary one-controller interpretation was recorded. The owner later corrected
the inventory: Setup A is physical controller `1751219`, Setup B is physical
controller `1751136`, and the full matrix must finish on A before switching to
B. The intervening EDGE campaign was therefore controller-A testing and does
not provide controller-B coverage.
