# Integrated 00.05.00 pre-flash baseline

Status: complete
Type: evidence
Updated: 2026-07-24
Next Action: continue with controller-a-load-and-readonly-gate.md
Parent: work/checklists/checklist-smi-firmware-mitigation-hardware-qualification.md

## Scope and method

This is the read-only baseline immediately before loading the integrated
calibration and code-review candidate. Both serial-bound J-Link endpoints were
resolved through `srv-rpi00.local`; no numeric host address was used.

Each target was briefly halted for fixed-address code flash, VEEPROM, option
memory, and RAM reads, then resumed before detach. No reset, erase, program,
configuration save, SD write, USB operation, or power cut occurred.

The generic hub inventory passed with exactly:

- Controller A: assembly `1751136`, hardware version `0`, J-Link `69664082`,
  direct USB path `3-2`, target voltage `3.298 V`.
- Controller B: assembly `1751219`, hardware version `1`, J-Link `69660123`,
  direct USB path `1-2`, target voltage `3.303 V`.

## Controller A

- Live image: firmware `00.05.00`; code bytes exactly match committed Debug
  artifact `072d5d1f`.
- Full 4 MiB program-flash capture SHA-256:
  `946C1F9D0E1BF631D457EBA08895F151F0BAF819924AD753B34F156F215A91E0`.
- VEEPROM capture SHA-256:
  `E5AABD742D00C7E65B90D6C017553E2041A2947EC77A5F1C4AF3BE489DE8A186`.
- Option-memory capture SHA-256:
  `80A76A18ACF8CB64FEC3A659FFC4BAB4A87CD9A6FDE4DAB2161A8751D136C9D2`.
- Both 2 KiB VEEPROM blocks are CRC-valid, byte-identical, and generation `191`.
- Configuration identity: serial `7162026`, model `3`, part ID `SLM622`.
- Main temperature: enabled/control enabled/alarm enabled; setpoint
  `22.9001 C`; stored offset `+0.3000 C`; raw `22.6833 C`; adjusted
  `22.9833 C`; active sensor `MAX31865 RTD`.
- Alarm window: `3.0 C` above/below, delay `1` minute.
- System errors: `0x00000000`.
- Configuration semantic findings/changes/inhibited controls/commissioning:
  all zero.

### Controller A SD/CID identity

- Protocol state: `READY` (`5`).
- CID valid: yes.
- Representative-sector read valid: yes.
- Driver status: `0x00000000`.
- Manufacturer: SanDisk-reported MID `0x03`.
- OEM/application ID: `SD`.
- Product name: `SS08G`.
- Product revision: `8.0`.
- Serial number: `0x976F0084`.
- Manufacturing date: May 2024.
- Raw 128-bit CID: `035344535330384780976F0084018559`.

CID is identity evidence only and is not treated as proof of authenticity.

## Controller B

- Live image: firmware `00.04.13`; the full code capture does not byte-match the
  later committed 00.04.13 artifact, so no exact source commit is claimed.
- Full 4 MiB program-flash capture SHA-256:
  `8BE940A3380DF4BA1E180BE93958EFAADB87E5134BF0B89205EF98D2268F85CF`.
- VEEPROM capture SHA-256:
  `C1494C433996A590DECAC6169B24D9033A94637C04BEA1E7B03F5CEFDCDF9ACB`.
- Option-memory capture SHA-256:
  `80A76A18ACF8CB64FEC3A659FFC4BAB4A87CD9A6FDE4DAB2161A8751D136C9D2`.
- Both 2 KiB VEEPROM blocks are CRC-valid, byte-identical, and generation `153`.
- Configuration identity: serial `112233`, model `5`, part ID `SLM722`.
- Main temperature: enabled/control enabled/alarm enabled; setpoint
  `24.5000 C`; stored offset `0.0000 C`; raw and adjusted `24.6952 C`.
  The nonzero RTD fields and zero LM73 fields identify the active reading as
  RTD; the older unfrozen image's private sensor-state symbol was not used as
  authoritative evidence.
- Alarm window: `3.0 C` above/below, delay `1` minute.
- System errors: `0x00000000`.
- Configuration semantic findings/changes/inhibited controls/commissioning:
  all zero.

### Controller B SD/CID identity

`CID unavailable`: the running 00.04.13 image predates the protocol/CID status
structure and operator service-467 identity screen. This is a firmware
observation limitation, not evidence that the installed card failed to respond.
The required CID block must be captured immediately after the frozen 00.05.00
candidate is eventually loaded on Controller B.

## Preserved files

The setup-specific directories contain the complete binary captures, J-Link
command files, and connection logs. These baselines are recovery/evidence
inputs and must not be overwritten by post-load captures.
