Memory controller with no candidate stimulus

This host-only change implements group 5j.1. The optional typed --uart-progress-memory-no-stimulus requires minimal mode and all of --same-image-shell-pid1 --uart-progress --uart-progress-memory. Existing Memory source/config/Image/initrd qualification, boot arguments, five protected loads/CRCs, and literal U-Boot transport are unchanged. No kernel argument is added by the new selector. Other modes retain their previous behavior.

After bootm, this policy sends zero candidate bytes: no receipt, carriage return, interrupt, command, retry, guard or reboot. It records receipt status NOT_REQUESTED, zero stimulus attempts and RX NOT_TESTED. Fresh Bash readiness is a historical observation; it cannot authorize input. The capture remains passive for at most 180 seconds, including missing/malformed output, read errors and unknown completion. Strict summary validity, worker completion, completion-wait timeout, readiness and protected recovery remain independent. A valid complete summary can qualify this diagnostic without a receipt only when this explicit policy is selected; it proves neither RX delivery nor usable root/touch acceptance. Missing output does not identify a worker, firmware, scheduler or hardware fault.

The only later host writes permitted are protected normal postflight helpers following ordered fresh SPL, exact normal 6.6.36 banner, login and normal prompt. Candidate normal-looking text cannot authorize them. Exact normal identities, fresh boot ID, eight protected hashes, three services and registration-marker absence still require independent guarded verification. Otherwise operator recovery remains required. There is no candidate reboot path in this mode.

Host fixture proof on 2026-10-04 UTC (Python 3.14, TMPDIR=$HOME/tmp):

• python3 tests/test_mainline_uart_progress_memory_no_stimulus_controller.py: 15 tests passed. Real PrivateSession.pump and write spies cover split/same-batch readiness and summary, CRLF, stale/echo/duplicate/truncated/interleaved/embedded CR output, absent/wrong/duplicate arguments, no prompt, read error, overflow, timeout, typed pre-open rejection and guarded independent normal return. The full mocked boot protocol checks five loads/CRCs, exact identical default and no-stimulus boot commands, and zero candidate writes after boot.
• python3 -m unittest discover -s tests -p 'test_mainline_uart_progress*controller.py': 93 tests passed (15 new plus 78 previous progress-controller tests).
• Existing minimal, Bash-PID1 and ordinary controllers: 100, 14 and 36 tests passed respectively (243 total across these commands).
• Independent read-only source review by mainline_boot_path: PASS; the reviewer repeated all 15 focused tests and checked unchanged transport and no-input boundaries.

Fixture evidence is separate from actual archive/artifact preparation. Actual group 5j.2 host preparation passed on controller c62ad389 using TMPDIR=$HOME/tmp python3 "$HOME/tmp/k230-mainline-uart-memory-no-stimulus-host-qualification/qualify.py". The safe receipt preserves command/time/hash identities; the exact executed qualifier preserves fail-closed checks. Its private expected-root-revision.txt contained the reviewed original full build revision 7af8f7b8b5849c75df61d39ee772c2cc8f38542c. The actual build receipt returned zero and both selected bundle and matching dev output already existed. No implicit build or UART action occurred.

The qualifier ran actual prepare_trial and prepare_uart_progress(..., uart_progress_memory=True), accepted the same protected manifest, and verified exact equality with previous Memory source, Image, linked summary/gate, config, archive, system, DT and arguments. The selected policy adds zero kernel tokens and retains the exact 381-byte literal transport. Preparation functions/constants are AST-identical to both the frozen build controller and reviewed 5j base 136dbf91. The receipt’s legacy prior_literal_transport_bytes=353 is the progress-only parent comparison; the one-stimulus Memory command and zero-stimulus command are both 381 bytes. The immutable selected kernel/dev derive from the same exact kernel derivation:

• Kernel: /nix/store/zk5rbsrgqgp40bk1314mj0i50qhn260m-linux-riscv64-unknown-linux-gnu-7.3.0-rc5.
• Dev: /nix/store/1pvqbm4r3gqcvsabgkz5wvrpxfbk5k1v-linux-riscv64-unknown-linux-gnu-7.3.0-rc5-dev.
• Source: /nix/store/f7xg031sjb9dy3bswm5s3qjr9xwx1g02-linux-mainline-k230-uart-progress-memory-src, worker SHA256 307d7c0588499dd32826c1d05476e0bf6d46ca0c8939d42e0b4f7180545b98dc.

Actual wrapped initrd inspection verified archived Bash, original systemd and common dynamic loader; Image byte identity and compiled unique summary/setup were verified separately from .config. The historical protected normal report and existing wrapper CRC anchored this host-only preparation; the previous verified board readback is not a new host wrapper readback or current preflight. Registration absence is asserted by the future pre/post helper, not performed on hardware by this qualifier. Python 3.14 native Zstd supports the actual archive inspection. All raw/prepared baseline material remains in a protected private directory. Physical zero-stimulus comparison and new protected recovery remain UNVERIFIED. The preceding Memory trial still needs its newly requested operator reset. Task 5b.5 remains open.

After protected normal recovery, the sole board operator may run the reviewed controller with fresh private output paths and matching baseline/manifest:

python3 tools/mainline-drm-initrd-shell-trial.py --mode minimal \
  --same-image-shell-pid1 --uart-progress --uart-progress-memory \
  --uart-progress-memory-no-stimulus \
  --bundle /nix/store/lznjjfx1kzm8mp2j0r06c87h2vdymkhd-k230-mainline-drm-trial-boot-files \
  --manifest "$HOME/tmp/k230-mainline-uart-memory-no-stimulus-board/candidate-manifest.json" \
  --normal-report "$HOME/tmp/k230-mainline-uart-memory-no-stimulus-board/normal-report.json" \
  --log "$HOME/tmp/k230-mainline-uart-memory-no-stimulus-board/trial.private.log" \
  --result "$HOME/tmp/k230-mainline-uart-memory-no-stimulus-board/result.private.json"

The normal report for this physical command must follow the new verified reset; a historical host-qualification report is not a live preflight or recovery proof.