Memory-summary controller preparation (host only)

Prepared on 2026-10-04 UTC in worktree /home/jadams/tmp/k230-mainline-uart-progress-memory-controller, branch mainline-uart-progress-memory-controller, base a4d6958d. Owned: the minimal controller, its new focused test, this evidence and only task 5i.4’s preparation note. No build slot or board/UART reservation was taken. Source and fixtures are ready; task 5i.4 stays UNVERIFIED and unchecked until actual NEW matching bundle/dev/source/Image positive preparation passes. No build or hardware action was performed here. Task 5b.5 remains open.

--uart-progress-memory is a typed opt-in requiring --mode minimal, --same-image-shell-pid1 and --uart-progress. It rejects Breadcrumbs/PostSample selectors and the existing clock/shutdown/mode conflicts. Default invocations remain unchanged. After qualifying the original artifact, it adds only k230.uart_progress_memory=1 to the qualified base progress policy. The full literal U-Boot argument command is reconstructed, checked for unsafe/duplicate values and bounded below 512 bytes. Printed arguments and exactly one fresh matching received kernel command-line record remain required before the sole builtin receipt stimulus. A summary never authorizes input. No retry, additional candidate command or candidate reboot follows that one stimulus or unknown completion. Passive capture remains bounded to 180 seconds.

Before UART access, common preparation inspects actual manifest/CRC/load ranges, U-Boot initrd wrapper, archived RISC-V Bash/original systemd and shared ELF loader. Read-only Nix queries require an already-realized kernel.dev config from the same selected kernel derivation, with the six existing required built-in options. Its exact immutable source must contain the reviewed Memory worker SHA256 307d7c0588499dd32826c1d05476e0bf6d46ca0c8939d42e0b4f7180545b98dc. The selected linked Image must contain exactly one complete NUL-terminated format literal and one exact k230.uart_progress_memory= setup key. No implicit build is performed. Actual compressed archive inspection requires a supported host decoder; the previous selected archive uses Python 3.14 native Zstd. Fixture artifacts do not prove NEW linked source/config/archive presence.

Frozen producer format:

\nK230_UMP1 s=%u n=%u m=%02x l=%u w=%u\n

The exact single line uses decimal one-digit fields and two lowercase hex digits for the bitmap. Parser stage rules are:

l must be the highest completed index, or sentinel 6 when the bitmap is zero. w=1 reports that the completion wait returned nonzero and requires terminal stage 4, 5 or 6. It does not imply all six samples completed: stopped and worker creation failure also signal completion. w=0 reports a wait timeout and permits any consistent stage, including terminal publication racing the timeout. These facts remain separate from worker_completed (stage 4 only), receipt and normal recovery. Missing/duplicate/malformed/truncated summaries stay unknown/error.

Capture uses fresh returned pump bytes, not the stale capped session buffer; early records are retained only after fresh candidate identity/arguments match. Record parsing normalizes CRLF pairs only, preserving embedded CR. A corrupted namespace is recognized for error classification, never repaired or accepted. Echoes, alternate grammar, inserted printk, inconsistent stage/index/mask/last, unknown values and duplicates reject the summary. Numeric/Breadcrumbs/PostSample worker output is invalid in selected Memory mode. A primary prompt followed by only the exact summary/newlines in the same pump chunk can qualify readiness.

memory_summary_valid, recorded stage/index/bitmap/last, completion wait outcome, worker completion, receipt and protected normal return are independent fields. An incomplete valid or timed-out summary remains an observed fact, without passing a completed diagnostic or claiming usable root. A terminal timeout race can still record completed work. A completed diagnostic requires valid worker completion and a matching receipt; the command returns success only with the independent exact protected normal postflight. Even that is not ordinary root or glass acceptance. Banners alone cannot establish recovery. Normal services, identities, hashes, registration absence and fresh boot identity are checked by the existing protected pre/post helper; host preparation is not that board check.

The summary describes consistent memory before its final firmware call. Presence does not prove that call returned or identify a firmware/IRQ/scheduler fault. Missing output cannot separate worker, observer, timeout, firmware or serial progress. observed_after_stimulus is host arrival ordering, not measurement causality. Unknown completion requires independent operator recovery with no additional candidate input.

Narrow proof commands (all fixture scratch under ~/tmp):

TMPDIR=$HOME/tmp python3 tests/test_mainline_uart_progress_memory_controller.py
TMPDIR=$HOME/tmp python3 tests/test_mainline_uart_progress_post_sample_controller.py
TMPDIR=$HOME/tmp python3 tests/test_mainline_uart_progress_breadcrumbs_controller.py
TMPDIR=$HOME/tmp python3 tests/test_mainline_uart_progress_controller.py
TMPDIR=$HOME/tmp python3 tests/test_mainline_drm_initrd_shell_trial.py
TMPDIR=$HOME/tmp python3 tests/test_mainline_shell_pid1_comparison.py
TMPDIR=$HOME/tmp python3 tests/test_mainline_drm_system_trial.py
openspec validate the-board-runs-a-mainline-kernel --strict
git diff --check

Twenty new fixtures exercise all stages/masks and wait/terminal races; actual pump splits, prompt-plus-summary batches, CRLF/embedded CR, stale/echo/duplicate/malformed and truncated frames; qualification failure before serial/log creation; exact five-load/CRC/literal command transport; one stimulus and passive unknown result; protected return with incomplete/missing-receipt/bad-normal-identity negatives. Existing 20 PostSample, 18 Breadcrumbs, 20 numeric, 100 minimal, 14 shell and 36 ordinary tests also pass. Counts/times and the actual old-artifact negative gate are recorded in host-results.json. Fixtures replace transport and artifacts; they do not prove firmware execution, hardware RX or new recovery.

The realized previous fjmxf6 PostSample bundle passed common prepare_trial with its protected existing manifest/report, then was rejected at the new Memory worker hash before UART. This is an actual negative artifact gate, not a positive NEW matching artifact or live normal preflight. Protected wrapper identity is anchored to the guarded report and fixed CRC; no additional card readback was performed.

Remaining positive gate, after the NEW exact bundle/dev are already realized:

prepared = trial.prepare_uart_progress(
    trial.prepare_trial(PRIVATE_MANIFEST, NEW_BUNDLE, PRIVATE_NORMAL),
    uart_progress_memory=True)

After review/integration, exact object/full artifact and actual controller gates, and NEW verified protected normal recovery, only the root operator may reserve board/UART and use fresh private outputs:

python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal \
  --same-image-shell-pid1 --uart-progress --uart-progress-memory \
  --bundle NEW_BUNDLE --manifest PRIVATE_MANIFEST \
  --normal-report PRIVATE_NORMAL --log PRIVATE_FRESH_LOG --result PRIVATE_FRESH_RESULT

No hardware acceptance, deployment or physical 5i.5–6 result is claimed here.