# Controller A cadence promotion and scrub liveness-policy block — 2026-08-04

Status: promotion passed; full-card read passed on target; Pi qualification blocked by an invalid HMI-liveness acceptance predicate
Type: evidence
Updated: 2026-08-04
Next Action: preserve operation `3b04cc35-ce17-4201-88f9-7a885a9300ab`; review and correct the Pi scrub acceptance policy so the periodic controller thread is the required liveness witness and the event-driven HMI delta is informational, then obtain fresh authorization for one new read-only operation
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-hpt-bounded-full-address-read-scrub.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Authorized envelope and identities

The owner authorized the fresh Controller A recovery envelope under reference
`owner-a-cadence-recovery-envelope-20260804`: disposition the pending prior
command without replay, import and bind the exact cadence-mitigated bundle,
program/verify/reset/run Controller A with VEEPROM and option memory preserved,
independently observe complete flash and a fresh CID, then issue one new
read-only baseline scrub command. Any ambiguous or failed attempt consumed its
authority; no retry was authorized.

- Controller A: assembly `1751136`, variant `0`, probe `69664082`, protected
  endpoint port `19120`.
- Card/sample: `F1-A1`, raw CID
  `05000C61736466672200001C8901A34F`; CID-valid and representative-sector-read
  status passed. The card remains uninitialized and unwritten.
- Bundle: `smi-00-05-00-3861b4a2c040-e75e6df95e01-release`.
- Pi canonical bundle manifest/content address:
  `5f8751e2d188ea9dd9adff6384588efc1655ce744ec0f24f3be633783016eb1c`.
- S-record SHA-256:
  `e75e6df95e01c0f4ebf008013929ecc43c3c5d5fd8901e507309ab7536c2e815`.
- Expected expanded 4 MiB flash SHA-256:
  `b1abe4776388b0978a2a1f93473e25a0091af8da535aa54582bb270b2dfcabb3`.
- Fresh Pi campaign: `738c4a65-acf3-4492-8d17-244ade322670`.

## Recovery, promotion, and independent observation

Old operation `fbfb1b52-e79c-4ffc-8e54-d34fd4102659` remained
`INTERRUPTED_UNKNOWN` with its command pending. Read-only reconciliation did
not touch the target or replay the operation. The authorized programming reset
subsequently cleared the stale SRAM command and returned the scrub status to
idle. The Pi then dispositioned the old operation as
`FAILED/FULL_ADDRESS_SCRUB_RECOVERY_RESET_DISPOSITIONED`, explicitly binding
that disposition to the new programming and observation evidence. Historical
operation `e36882de-ebf5-4b35-93ef-698e352a553c` was also never replayed.

Programming operation `f38afdd2-45ee-4cb5-9915-593cb018cd88` passed with
terminal code `PROGRAM_VERIFY_RESET_RUN_COMPLETE`. The complete flash changed
from `2236f68b720dc9824001597860603c91883bdb4636d5c46a5af41d6b3258a166`
to the exact expected `b1abe477...dfcabb3`; VEEPROM remained
`2600c8a339ca0fb6f2106b80620e4a163235d71eee5a3569d5fc92da275c20ed`
and option memory remained
`af9613760f72635fbdb44a5a0a63c39f12af30f950a6ee5c971be188e89c4051`.
The CPU reset and ran. Immutable Pi result SHA-256 is
`46ae511e4087dcde95ad0831e36be4e625f75749b355bf3adabc2fe7b089b015`.

Independent observation `e1d03af3-12e0-4398-a85d-1da6e79ea9e9` passed the
exact complete-flash and mapping checks, running CPU, clean system/driver
status, and the same full CID. The card remained classified as needing
initialization with no replacement request. Immutable Pi result SHA-256 is
`47a04f17a101bd6d07671ecbba523c6ffff1531836208414018af743fb982724`.

## Full-address scrub result

Operation `3b04cc35-ce17-4201-88f9-7a885a9300ab` published the single reviewed
SRAM run word exactly once. It completed the full card in about 11.8 minutes
wall time, compared with the prior one-hour partial run, proving the cadence
mitigation removed the dominant per-slice delay.

The stable target terminal structure reported a firmware-level pass:

| Field | Result |
| --- | ---: |
| State / HPT status | `2` / `0` |
| Block size | `512` bytes |
| Total / completed / next sectors | `15,728,640` / `15,728,640` / `15,728,640` |
| Read attempts | `245,760` |
| Failed sectors | `0` |
| Retry-recovered sectors | `0` |
| Identity mismatch | `0` |
| First / last SSP status | `0` / `0` |
| Maximum read duration | `2` ticks |
| Controller run delta | `1,348` |
| HMI run delta | `0` |

The Pi nevertheless classified the immutable operation
`FAILED/FULL_ADDRESS_SCRUB_FAILED` solely because its adapter requires both
`controller_run_delta > 0` and `hmi_run_delta > 0`. Result SHA-256 is
`f16809c1927d1d29e77a5b9ac79597f152a9b509e4767b6833dc457bc2af79bd`;
transcript SHA-256 is
`4b95b812eaeb6f14dd0207a7ee191dd55c776be9b1e757f73f1325e3286ae788`.

## Method disposition

The HMI predicate was introduced with Pi commit `c86c58f1` on 2026-08-03 as
part of the first one-shot scrub adapter. No design rationale accompanies it;
its unit fixture simply supplies a positive HMI delta. Firmware records the
HMI count for observation, but the established lane and wrap diagnostics
deliberately require only `Thread_Controller` progress. The source explains
that the HMI thread may legitimately remain suspended when no GUI event is
pending, while the periodic chamber-control thread is the required scheduling
liveness witness.

Accordingly, this is a method/automation acceptance failure, not evidence of
an unreadable card, an unresponsive controller scheduler, or a failed firmware
scrub. The immutable Pi result is preserved unchanged. Campaign
`738c4a65-acf3-4492-8d17-244ade322670` is `BLOCKED`, version `3`; Controller A
assignment `9` is `BLOCKED` with failure attribution `method`. Initialization,
bounded-stop testing, power interruption, regression, and card transfer remain
closed. A policy correction and any new scrub operation require review and
fresh owner authorization; the consumed UUID must never be replayed.

## Cleanup

The protected registry was restored to hash
`37710ee75360f148b805d8f9d025cbf74a71a0b002240ca46b30dd79dff87647`.
Controller A remains bound to the new canonical bundle manifest and Controller
B remains unchanged; both are disabled for qualification. Temporary A-only
firewall access and all one-shot programming, observer, and scrub containers
were removed.
