# Controller B recovery baseline

Status: passed; recovery prerequisites captured, normal control restored
Type: evidence
Updated: 2026-07-27
Next Action: run Controller B normally during qualification; use the captured
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
non-heating state only as bounded recovery evidence or when an exact case
explicitly requires it
Parent: work/decisions/decision-remaining-qualification-authorization.md

## Scope and result

Tool Shed task 1 is complete for Controller B. Configuration/calibration and
option-memory backups exist, the exact known-good program image is locally
available and matches a fresh four-MiB target readback, the serial-bound J-Link
program/recovery route has passed, and an intentional non-heating configuration
survived a normal reset. After that bounded proof, normal temperature control
was restored and verified across another normal reset.

This result closes only the Controller B recovery-baseline prerequisite. It
does not by itself authorize firmware-update interruption, destructive media
testing, unattended heating, or any other case whose operation-specific entry
gate has not passed.

## Bound identity

- Controller assembly: `1751219`
- Hardware variant: `1`
- J-Link: `69660123`, `srv-rpi00.local:19121`
- Source commit: `2f4d872495920027651d5b18e893df8484000831`
- Branch: `codex/firmware-00-05-00-hpt-filesystem`
- Debug S-record SHA-256:
  `30C98F00E8712BB1C9CF4C9FC144F20A84692C1C416CE09BEF5AF20E2AADF649`
- Debug ELF SHA-256:
  `F53A6E1C15142936F90A6BF99D55A9B5D31009C465705B0431D7693C23952821`

## Recovery image and probe

- A fresh read-only four-MiB internal-flash capture has SHA-256
  `6C0DBDB31E30AAD13993CA3D49BA0141BEDCC8FF2E4C38BC33743D9FA7389D4B`.
- `script/compare-srec-internal-flash.py` reconstructed the exact four-MiB
  image from the current S-record and reported the same hash with
  `internal_flash_matches_srec=true`.
- The current candidate's B-first program log records J-Link `69660123`
  loading the exact local S-record, `O.K.` program/verify, reset, and run:
  `work/evidence/imx-program-b-32k.stdout.log`, SHA-256
  `D01CEC4E271D804B1D0A365B2DE0F56DC188244F5868B88BA7F2FB0F0461B0B0`.
- A fresh normal reset, run, and post-reset J-Link reacquisition passed during
  this baseline. The target reported valid power and identified as the expected
  Cortex-M4/R7FS7G27H route.

These checks establish an exact known-good program recovery image and a working
serial-bound recovery path without unnecessarily reprogramming an already
exact target.

## Configuration and calibration recovery

Before changing the live control state, the following read-only backups were
captured under
`work/evidence/generated/controller-b-recovery-baseline-20260727/`:

| Capture | Bytes | SHA-256 |
| --- | ---: | --- |
| `veeprom-pre-disable.bin` | 4,096 | `CA76738C2AF0E97D2D452B1E53B25D678BC40CC1F2D80306001464E8CBC2E08E` |
| `ram-config-pre-disable.bin` | 1,436 | `641ED737C8F755D7CF1F7FD08EAE76806E0E24AEBE2232CCAC1FFD5E34B8965B` |
| `option-memory.bin` | 48 | `80A76A18ACF8CB64FEC3A659FFC4BAB4A87CD9A6FDE4DAB2161A8751D136C9D2` |

The pre-change configuration had main temperature enabled, main-temperature
control enabled, setpoint bits `0x41D599B7`, and offset bits `0x00000000`.
Only the main-temperature control-enabled field was changed from `1` to `0`.
The normal generation/readback-verified persistence path then saved the
configuration. No calibration, setpoint, identity, model, or unrelated
configuration field was intentionally changed.

The saved non-heating copies are:

| Capture | SHA-256 |
| --- | --- |
| RAM configuration | `4E96BB6E96353FAD497D4148C884B2CBCB38FF3B1BAEB2AC83C4D80F9E5DB73F` |
| Redundant VEEPROM blocks | `4F933BAF857BDB2C0EC589574C0B6C3D2DDDC79830900BEFA341A8957FE9A8BD` |

After reset, RAM and VEEPROM reproduced those exact hashes. Both redundant
VEEPROM blocks are byte-identical. The post-reset configuration is operational,
has zero semantic findings, has no pending save, and reports terminal committed
generation `174/174`. `last_commit_succeeded` is zero after boot because that
runtime event flag is reinitialized; the persistent terminal state, matching
generations, identical redundant blocks, and exact RAM/VEEPROM hashes prove the
saved transaction.

## Safe non-heating state

Before reset and again after reset:

- main-temperature control enabled: `0`;
- `gMainHeaterOnTicks`: `0`;
- `gSmiMainHeaterOnTicks`: `0`;
- `gIsHighHeatCycleRunning`: `0`;
- system errors: `0`;
- `R_IOPORT2->PCNTR1`: `0x00000008`, with heater output bit 19 clear.

The recovery-baseline post-reset J-Link read is preserved as
`work/evidence/generated/controller-b-recovery-baseline-20260727/post-reset-safe-state-jlink.log`,
SHA-256
`DC22A4EE67DB04777DFA222387E0C043E004373ABAA69EE4158A0E2F24358709`.
This was a bounded recovery-state proof, not the intended endurance operating
configuration.

Electronic non-heating proof is not a substitute for independent physical
protection, an accessible disconnect, or attended monitoring when a later test
requires those controls.

## Normal control restored for qualification

At the owner's direction, Controller B was returned to its original normal
control mode after the recovery baseline:

- main-temperature enabled: `1`, unchanged;
- main-temperature control enabled: restored from `0` to `1`;
- setpoint bits: `0x41D599B7`, unchanged;
- calibration offset bits: `0x00000000`, unchanged;
- configuration generation: terminal committed `175/175`;
- configuration operational with zero semantic findings and no pending save;
- redundant VEEPROM blocks byte-identical;
- post-reset RAM configuration SHA-256:
  `6959424675F8716B9160AA116E336F9E16357C5DF28E9A7D60BE70C673BE07EE`;
- post-reset redundant VEEPROM SHA-256:
  `0AE94E3E0F0997F8A1637008488CBB27D06ABC1124D10FD6CFAC4FB72FB7F943`.

Byte-for-byte comparison with the original pre-disable RAM backup found only
one changed byte: generation `173` became generation `175` at offset `0x004`.
All remaining `1,435` bytes match, including control enable, setpoint,
calibration, alarm, model, and other configuration fields.

After reboot, active heater demand was observed at `479` ticks. Subsequent
500 ms samples reported demand `467/467/454/454`, while physical heater-output
bit 19 toggled on/off/on/off. This demonstrates that normal controller
temperature-control output is active rather than inhibited.

The post-reset configuration summary is
`work/evidence/hpt-log-store-circular-mirror/controller-b/normal-control-restored-20260727/post-reset/config-semantic-status.json`,
SHA-256
`61D2E1235D2FA6A26532B58FEB905E5E3BBE81C3E1DF5D9B75411BBA82704527`.
The output sampling log is
`work/evidence/generated/controller-b-recovery-baseline-20260727/restore-normal-control-output-sampling-jlink.log`,
SHA-256
`1B4D12DD43A655ED25EEB2B90DE5FA923B7C2945C9785E1736AE32B301B8CBD2`.

Post-reset system errors and dropped logs are zero, the graph cache is ready
with real data, and the complete SD identity remains unchanged. Controller B
is now left in normal operating mode for full-function qualification.

## SD-card identity at baseline and after reset

The 44-byte identity structures captured immediately before and after reset are
byte-identical with SHA-256
`0BAD1857E7BFF8EA4D4BF8166EDEDED3EC0DCADBFD2DF05A957249074A406F0D`.
The post-reset decoded record is
`work/evidence/hpt-log-store-circular-mirror/controller-b/recovery-baseline-post-reset-20260727/sd-card-identity.json`.

| Field | Value |
| --- | --- |
| Protocol card status | `6` |
| CID-valid status | `1` |
| Representative-sector-read status | `0` / success |
| HPT media state/status | `5` / `0` |
| Manufacturer | SanDisk/WD |
| MID | `0x03` |
| OEM/application ID | `SD` |
| Product name | `SS08G` |
| Product revision | `8.0` |
| Serial number | `2540634245` |
| Manufacturing date | `2024-05` |
| Raw 128-bit CID | `035344535330384780976F0085018507` |

No SD format, initialization, removal, insertion, or replacement occurred.
Post-reset logging had zero drops, the HPT store had zero mismatch/lost counts,
and the graph cache returned ready with real data.

## Raw evidence handling

Large binary and transient J-Link outputs remain under ignored generated
evidence paths. This small versioned record carries their hashes and decoded
results, avoiding raw generated-evidence diffs.
