# Historical research narrative ledger Historical original prose/translation, not current readiness or authorization. Interpret through ../../docs/CURRENT_STATE.md and ../../docs/SUPERSESSION.md. Native code fences/listings and private values were excluded or redacted; exact source paths/hashes are catalog metadata. ## K04641 Source `D0166`, original line889, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Currently, coupling of stages B, C, and D is underway: ABI4 radio runtime, exposure synchronization, optical chipID identification, and measured world pose. Source files for the overall pipeline have been created, but its integration audit and hardware verification are not complete. Especially important: the presence of a fusion method in code does not mean that IMU processing is already connected to it in the production runtime. ## K04642 Source `D0166`, original line891, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Verified on Frame: API active, radio service inactive, OpenOCD not running. The installed radio unit still references the old `roy_station_service250.elf` with duration of 10 seconds. The new driver, UI, API, and unit from this work are not installed. Candidate directory: `/home/steamos/pico-ram-work/integration-20261006`. ## K04643 Source `D0166`, original line893, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The user turned on the headset and both Valve controllers. The read-only monitor confirmed valid poses for all three devices. This is a verification of the baseline state, **not compatibility with the new radio**, which was not run. Pressing search/pairing on the PICO did not lead to a connection, since the new station is not yet working. Inviting the user to verify was premature. ## K04644 Source `D0166`, original line895, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## Status of stages A–F ## K04645 Source `D0166`, original line897, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Status as of evening 2026-10-06. Legend: ✅ done, 🔁 redone after audit, ⏳ remaining. ## K04646 Source `D0166`, original line899, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. | Stage | Done | Redone (evening 06.10) | Remaining | |---|---|---|---| | A. Build and Roy ownership | ✅ Manifest with SHA, reproducible build, flock, callback/MPU/RAM checks, checkpoint, trace controls restoration. ✅ Release `release-20261006b` built and **installed** with backup | 🔁 Cleanup of each resource in its own finally; OpenOCD terminate→kill | ⏳ Startup/shutdown sequence on hardware not verified | | B. Three radio devices | ✅ ABI4 (1956/2045 B), three profiles, seqlock-mailbox, discovery/enrollment, paired reconnect, ACK/seq-engine, controller watchdog | 🔁 Mailbox timing inside seqlock; timeouts in DWT cycles (were in slots, broke on fast interval); new RF tag on each attempt and correct ACK attribution; unified reset on reconnect; enrollment with empty mailbox and registry preservation before unpausing | ⏳ ABI4 was not executed on Roy; three-device stability, polling rate, controller compatibility | | C. Cameras and LEDs | ✅ Live frames, PTS↔OCC, serial↔sourceCamera, KB calibration, extrinsics, RAW↔MONOTONIC, timed command10/14, temporal identity. ✅ **New:** automatic LED phase search (`phase_search.py`) | 🔁 Frame index incremental with anchors (was drift); schedule caches by physical slot; plan stores chip; change in device count resets queue 10/14; temporal identity allows smooth movement | ⏳ Phase search, dark-pulse identity, and LED visibility on real trackers not verified | | D. World pose and fusion | ✅ Metric PnP/RANSAC, camera→head→world, publication barriers, EKF. ✅ **New:** IMU axis/bias/time-offset calibration from optics (`imu_calibration.py`), IMU connected to runtime | 🔁 Atomic IMU propagation with rollback (previously double rotation); IMU buffer replay after optical anchor; bias and offset in `configure_imu` | ⏳ Real poses of three trackers; real IMU calibration by movement; meters/orientation/world stability | | E. SteamVR | ✅ PTP2 and native driver, chipID identity, stale/reorder/finite checks. ✅ New driver **installed** (atomic replacement) | Without source changes | ⏳ Driver loading by restarting SteamVR; three GenericTrackers in SteamVR and game | | F. Service and application | ✅ New UI/API **installed**, API restarted; radio unit ABI4 installed (disabled, not started) | UI rebuilt from new main.cpp | ⏳ Autostart, pairing/reconnect, UI closing, restarts; camera clock evidence tied to current boot | ## K04647 Source `D0166`, original line908, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. **Not a single stage can be declared fully completed based solely on sources or unit tests.** ## K04648 Source `D0166`, original line910, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## What is confirmed by verifications ## K04649 Source `D0166`, original line912, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. 1. **220 offline tests pass** (06.10 evening; was 177). **ABI4 after fixes: 1956 bytes, code SHA256 `686794f8…`, ELF `30eedf64…`; item 2 below refers to the previous build.** Baseline: Python modules optical and radio/ram pass compileall. Full rotation/position math, outlier rejection, world pose transformation under head movement, clock/counter bounds, timed mailbox, watchdog, and temporal identity rejection on dropped frames/movement verified. Synthetic poses were not sent to SteamVR. 2. **ABI4 builds into 1928 bytes**, limit 2045, aligned size 1928. Code SHA256: `cdc769d142071851c458b0b6000f0abad89397cbbc9e4045fa5a44a235725e08`. ELF SHA256: `12103d05ee37c9a058d572dc9228e6fcd65e2ee716e5d3f34dcb0903347a90da`. The build was not loaded into SRAM. 3. New native driver and PTP2 codec built on Frame. Native read-only `tracking_watch` also built, including GenericTracker reading. This is not proof of receiving real tracker poses. 4. **One camera-only verification, 15 seconds:** 1800 metadata sets, 1372 decoded IR frames from four cameras, 1056×1024, exact PTS to OCC mapping. Dataset: `Deckard_2026-10-06_18-24-27.dataset`. The recording created by us has been stopped. RF/SWD/pose publication were not run. 5. For this fresh recording, the clock domain is distinguished by causality: source timestamp corresponds to `CLOCK_MONOTONIC_RAW`; by the read time, RAW age was 26.849–32.269 ms. In `CLOCK_MONOTONIC`, the same timestamps were in the future by 113.730–119.151 ms; BOOTTIME diverged by approximately 501 second. RAW→MONOTONIC conversion is now measured on each translation, because constant offset drifts. Evidence is tied to current boot; behavior after next boot still needs to be implemented and verified. 6. Factory serial links each IR camera to its active named calibration. Camera→head transform matches recorded SteamVR `sensorsFromHead` for slam_right with numerical discrepancy up to 1e-6. Mathematical agreement does not replace verification of world stability on a real tracker. ## K04650 Source `D0166`, original line919, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## Created/modified main components ## K04651 Source `D0166`, original line921, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. - `pc/radio/ram/roy_ram_station_v4.c`: SRAM ABI4, ring 10×112B, three peer profiles, seqlock-mailbox, phase patch on TX, time windows, trace controls. - `pc/radio/ram/peer_engine.py`, `station_v4_runtime.py`: product/registry, commands, ACK, sequence, reconnect, and live state. - `pc/radio/ram/roy_ram_loader.py`, `ownership.py`, `roy_ram_recover.py`, `build_station.py`: lifecycle, watchdog, build, and recovery. - `pc/optical/live_source.py`, `live_decode.py`, `h264_timestamp_mux.py`: bounded live transport, SPS/PPS priming without historical pictures, timestamped decode. - `pc/optical/frame_camera_rig.py`, `measurement_clock.py`, `exposure_schedule.py`: calibration, clock, and command10/14 schedule. - `pc/optical/ray_pose_solver.py`, `measured_pipeline.py`, `station_optics.py`, `temporal_identity.py`: measured pose and overall pipeline. Temporal identity is currently experimental and not hardware-certified. - `pc/driver/pose_frame.py`, native driver, `pc/frame_app/tracking_watch.cpp`: PTP2 and OpenVR evidence. - `pc/frame_app/frame-pico-radio.service`, `main.cpp`, `pc/radio/frame_debug_agent.py`: updated sources only; installation pending. ## K04652 Source `D0166`, original line930, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## What to do next, in strict order ## K04653 Source `D0166`, original line932, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. 1. ✅ **DONE 06.10 evening** (Codex+Gemini audit, 11+6 remarks, confirmed ones fixed, +12 integration tests). Not verified on hardware: actual phase value (now searched automatically). **Finish integration audit before RF.** Verify timed command10/14 with dropped slots, ACK during retiming, change in device count, reconnect with MCU reset, sequence transmission, and dark-frame calculation. The value of `phase_at_exposure_ticks` has not yet been measured on a real PICO; the existing schedule does not prove that the LED pulse falls within the short exposure. Check cleanup on optical flow error, guard, and worker stop. Add necessary integration tests rather than repeating already passed checks without changes. 2. ✅ **DONE offline 06.10 evening** (`imu_calibration.py`, wiring in `station_optics.py`/`measured_pipeline.py`; inertial prediction is enabled only after verified calibration). ⏳ The calibration itself is performed in item 4 by moving the trackers. **Complete inertial path.** Implement measurement of body axes/bias and sample-time offset from optical observations; connect real decoded IMU samples to `MeasuredPosePipeline.imu`. Until this is in place, only confirmed optical poses are permitted; do not enable inertial prediction with default axes. 3. ✅ **DONE 06.10 19:36**: `release-20261006b` built and installed via `install_release.sh`, backup copy `backup-before-20261006b`, autostart not enabled. **Prepare one consistent release build.** Update candidate Python to latest local sources, build native driver/UI/watch, generate config/registry/manifest of a single version. Do not mix ABI3, ABI4, and legacy PTP1. Install release and driver, preserving previous installation. Do not enable autostart before lifecycle verification. 4. ⏳ **NEXT STEP**, requires user in headset with two controllers and three trackers. Order: station start → LED phase search → temporal identity → IMU calibration (rotation along all axes, two pauses) → SteamVR restart for new driver. **Run one joint hardware session, 10 minutes.** Only after readiness of items 1–3 and fresh confirmation of HMD + two Valve controllers. Verify three PICOs, live LED visibility, command10/14 phase, temporal identity without swaps, measured world poses, and real streaming to GenericTracker. Collect latency, sample loss, optical inliers/residuals, controller validity, CPU/RAM/disk. Short isolated RF trials are prohibited. 5. ⏳ Based on the results of item 4. **Fix only specifically detected defects.** If the joint session does not pass, save exact data; next RF launch only after fixing the identified defect. Do not declare "done" upon RF connection or icon appearance. 6. ⏳ Not started. Known blocker: camera clock evidence is tied to boot `a7b75755…`, after reboot an automatic clock re-audit is needed. **Complete commissioning and gameplay.** OFF/ON of each PICO, UI closing, API restart, SteamVR restart, boot, safe recovery of Roy; current-boot clock evidence must not permanently block the next boot. Check orientations/meters/world stability and leg occlusion. Then enable stable service and test FBT in a consuming game with assigned roles. ## K04654 Source `D0166`, original line939, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## When the user will be able to play ## K04655 Source `D0166`, original line941, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. After items 1–6, when three moving GenericTrackers are genuinely confirmed and normal tracking of both Valve controllers is preserved. There is currently no reliable timeframe: hardware testing of the new loop has not yet begun. The test build is installed (06.10 19:36), so the next step already requires the user: session of item 4 upon their readiness. ## K04656 Source `D0166`, original line943, SHA256 `e4f4de3ab665a6f7b8be9fa69df005f7e06a83d7d8b3c800346d218a596039dc`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Private evidence files are located in `outputs/live-camera-clock-audit-20261006.json`, `outputs/camera-clock-evidence-20261006.json`, and isolated remote `build/`. Do not publish firmware, calibrations, or raw captures. ## K04657 Source `D0168`, original line1, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. # FW189 GRID3000: Codex verdict on Opus and Grok, 2026-10-07 ## K04658 Source `D0168`, original line3, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Status: candidate encoding confirmed; functional completeness of the patch and OTA readiness not confirmed. User hardware hold remains in effect. Original reports, production sources, and images are unchanged. ## K04659 Source `D0168`, original line5, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 1. Main fix: TIMER0 has a tick of 1 µs ## K04660 Source `D0168`, original line7, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Grok's latest remarks mistakenly call writing 3 to `0x40008508` a PRESCALER configuration. This is BITMODE. According to the Nordic specification, BITMODE is located at +0x508, PRESCALER at +0x510. ## K04661 Source `D0168`, original line9, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The actual init `0xbc06 → 0x8492 → 0x6184` writes: ## K04662 Source `D0168`, original line11, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. | Address | Register | Value | | --- | --- | --- | | 0x40008504 | MODE | 0, timer | | 0x40008508 | BITMODE | 3 | | 0x40008510 | PRESCALER | 4 | ## K04663 Source `D0168`, original line17, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. This is additionally reproduced by executing stock init in Unicorn. Frequency of TIMER0 = 16 MHz / 2^4 = 1 MHz. Consequently, 18910 ticks correspond to 18910 µs, 12000 to 12000 µs, 3000 to 3000 µs. Grok's conclusion of 6000 µs and 1500 µs is rejected. The init check is limited, is not an execution of the device's entire boot process, and does not rule out subsequent register modifications in other modes. ## K04664 Source `D0168`, original line19, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Source of register map and formula: Nordic TIMER specification (original reference: `https://docs.nordicsemi.com/r/bundle/ps_nrf52833/page/timer.html`). ## K04665 Source `D0168`, original line21, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. In the intermediate offline JSON of this verification, register +0x508 was also initially misnamed; the entry has been corrected, and the error is explicitly noted in the correction field. This intermediate interpretation cannot be used as confirmation of Grok. ## K04666 Source `D0168`, original line23, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 2. RTC: remark is substantial and confirmed ## K04667 Source `D0168`, original line25, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. When `0x20000f02` is non-zero, function 0x641c converts the argument via a double divider 30.5 and writes the result into RTC CC. When the flag is zero, a different path is used. The conclusion from one branch cannot be generalized to all modes without investigating the sources of the flag. ## K04668 Source `D0168`, original line27, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. RX arithmetic and the RTC branch itself were executed offline. For candidate N=13, an integer argument 40810 is obtained first, then CC=1338. With RTC at 32768 Hz and PRESCALER=0, this is 40832.51953125 µs. N=9 yields argument 28810 and CC=944, which is 28808.59375 µs under the same assumptions. Source of results: `outputs/tracker-grid3000-20261007/timer-units-countercheck.json`. ## K04669 Source `D0168`, original line29, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Thus, previous checks of RX arguments did not prove physical window time. However, a non-integer number of RTC ticks for 3000 µs does not in itself prove the grid is impossible: phase, rounding, and possible correction must be taken into account. The proposal to change the period to 2989 is also not a ready solution: 98 physical RTC ticks at the specified frequency amount to 2990.72265625 µs. ## K04670 Source `D0168`, original line31, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 3. Constants 9922 and 10980 ## K04671 Source `D0168`, original line33, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Five MOVW #9922 indeed remain at 0x6538, 0x65a2, 0x67de, 0x6c42, 0x6c5c and call 0x641c. The real bytes are 42f2c260; the Opus reproducer with 42f6c26c is incorrect. ## K04672 Source `D0168`, original line35, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Replacing 9922 → 6467 is unjustified. The equality 9922 = 2×4727.5+467 does not establish the origin of the constant. The number 467 in another handler has a different unit and does not prove such a dependency. These locations require analysis of purpose and call conditions. ## K04673 Source `D0168`, original line37, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The unchanged MOVW #10980 at 0x6eac is related to quanta: 10980 = 24×457.5 = 360×30.5. This is sufficient reason to include the branch in the completeness audit, but insufficient for automatic scaling: its gate and purpose are important. ## K04674 Source `D0168`, original line39, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 4. What to accept from the reports ## K04675 Source `D0168`, original line41, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. - Ten sites and 30 differing bytes: confirmed in narrow byte-by-byte scope. Completeness of schedule translation is not established by this. - OTA start/data/finish format, SPI layout, and CRC: confirmed in offline model. This does not imply sender readiness or successful activation. - waiting_target: reproduced defect in recording the result upon timeout before OTA start. - ACK: start/data/finish do not provide necessary correlation with transmission/session; offline reception of foreign generation is reproduced. Specific delivery of an old ACK through live queues remains a hypothesis. A check of the numeric tag alone is insufficient without considering its reuse. - Inevitable collision at 12 ms: not proven. The correct unit of TIMER0 restores the nominal 12 ms, but does not replace the analysis of ADDRESS, COMPARE0_STOP, gates, phases, and on-air time. - Bootloader/activation/recovery: insufficient data. The presence of a stock file does not prove recovery capability after any failure. ## K04676 Source `D0168`, original line48, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Grok's additional address corrections to Opus regarding 25.0 and 299815 are useful: one should distinguish the 32-bit high literal of a double from the finished 64-bit double, and the load instruction from the address of its pool. ## K04677 Source `D0168`, original line50, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 5. Summary and future work ## K04678 Source `D0168`, original line52, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The Opus report is accepted as a limited verification of bytes and the OTA model. Its A-1 is not accepted as a recipe for a fix. Grok's latest remarks are accepted regarding RTC and ACK limitations; the central argument of PRESCALER=3 is rejected based on register map and init execution. ## K04679 Source `D0168`, original line54, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The current candidate cannot be considered a finished solution for coexistence with controllers and cannot be considered ready for flashing. Nor is it disproven by the argument that "TIMER0 runs twice as fast". Before a new candidate, a full audit of timer units and branches, a decision on 9922/10980, verification of the actual RX phase, and elimination of sender defects are needed. Prior to hardware OTA, a confirmed activation/recovery path is separately required. ## K04680 Source `D0168`, original line56, SHA256 `76abf384e5a4d285ac5925dabcdf46dbb9b4ad6d569766578041d29469d700bf`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. 79 previous tests remain evidence of their limited scope, rather than proof of a correct physical schedule. Firmware/sender fixes and hardware actions were not performed as part of this verdict. ## K04681 Source `D0169`, original line1, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. # Independent validation report of PICO FW189 patch (GRID3000) ## K04682 Source `D0169`, original line3, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. **Validation date**: 2026-10-07 **Validation object**: Document FW189_GRID3000_INDEPENDENT_VALIDATION.md (original reference: `[PRIVATE_SOURCE_REFERENCE]`) and artifacts in directory `K:\AI\pico\outputs\tracker-grid3000-20261007/` **Status**: Strict audit without modification of source file and without use of physical hardware. ## K04683 Source `D0169`, original line9, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 1. Official verdicts ## K04684 Source `D0169`, original line20, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 2. Boundaries and justification of verdicts ## K04685 Source `D0169`, original line22, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### 2.1. Binary patch (`correct within specified scope`) - **Verified byte-by-byte**: Exactly 10 regions are affected (56 range bytes, **30 actually modified bytes**). - **ARMv7-M Encoding**: All 6 `MOVW T3` instructions (`0x6214`, `0x6218`, `0x630a`, `0x630e`, `0x6cde`, `0x6ce4`) are encoded in strict compliance with the ARMv7-M architectural specification (validated via Capstone disassembler and bitwise parsing). - **LE Double Floating Point**: Constants `0x6d40` (3000.0), `0x6d48` (1810.5), `0x6d50` (2207.0), `0x6f80` (3000.0) are aligned to 8 bytes and correctly encoded in little-endian IEEE754. - **RX Offset Math**: Offset $\Delta = 1727.5$ µs is subtracted from the receive window reopening intervals (`3538 - 1727.5 = 1810.5`, `3934.5 - 1727.5 = 2207.0`), which preserves the nominal width of the receive aperture window relative to the end of the period ($1189.5$ µs and $793$ µs respectively). - **Compensation −25 µs**: Calling function `0x13754` in the miss branch inverts the high sign bit of the second double operand (`0x40390000_00000000 = 25.0`) via `eor r3, r3, #0x80000000` and branches to `0x13508` (`__aeabi_dadd`). This is a proven mathematical **subtraction** of 25.0 µs, not an addition. - **Reversibility**: The `reverse(candidate, manifest)` function bitwise restores the original `STOCK_SHA256` (`477000fc1fde2b518f51a3a2233dc38714731049093e236d15cfe049cd690a89`). - **Immutability of critical regions**: Vector table, stack (`0x20006000`), interrupt handlers, pairing, and service structures are not modified. ## K04686 Source `D0169`, original line31, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### 2.2. OTA sender (`correct within specified scope`) - **Command 1 / Subcommand 0x25 Protocol**: Native dispatching `0x8c10 -> 0x16558 -> 0x88cc -> 0xfbcc` confirms packet structure: - Start (9 bytes): `25 01 [len:4 BE] [crc8:1] [ver:2 BE]` - Data (29 bytes): `25 02 [idx:2 BE] [len:1] [data:24]` - Finish (2 bytes): `25 03` - **Acknowledgement Decoding (ACK)**: Processing of positive/negative ACKs, block index matching, and support for 6-byte duplicate ACK with suffix `0xaa` (`0xfcca..0xfce4`) are correctly implemented. - **Queue draining (drain_ack)**: Transition to `drain_ack` state with $S_1 = 3$ and no-op payload `b'\0'` ensures that the next payload packet will not acknowledge itself before the host reads the response. - **SPI Layout**: SPI offset formula for 24-byte blocks on a 256-byte page (`floor(j/10)*256 + (j%10)*24`) fully matches code in `0xf7d8` and `0xd130`. ## K04687 Source `D0169`, original line40, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### 2.3. Radio compatibility with Steam Frame (`disproven`) - The claim of resolving the coexistence issue of trackers and controllers on the headset's radio grid is **disproven**. - The patch changes the autonomous transmission timer constant from 18910 to 12000 µs when $N \neq 0$, but **does not disable or coordinate autonomous TX**. - On the station polling grid with a step of 6000 µs (42000 µs cycle), the 12000 µs interval is a multiple ($12 \equiv 0 \pmod 6$), leading to inevitable periodic on-air collisions and interference with Valve controllers. ## K04688 Source `D0169`, original line45, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### 2.4. Hardware activation and recovery (`insufficient data`) - The repository lacks a dump of tracker Bootloader Flash memory. - It is impossible to confirm the absence of digital signature verification (RSA/ECDSA) in the bootloader prior to flashing Bank 0. - Dual-bank rollback or recovery mode upon failed application launch is not confirmed. In case of a hang or HardFault, a sealed tracker without an external USB port turns into an unrecoverable "brick". ## K04689 Source `D0169`, original line52, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 3. Detailed findings registry (Findings) ## K04690 Source `D0169`, original line54, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### Finding B-1: Deterministic collisions of autonomous TX in multi-user configuration - **Severity**: **Blocker** - **Location**: `fw189-stock.bin` VA `0x6214`, `0x630a`; tracker_grid_patch.py (original reference: `[PRIVATE_SOURCE_REFERENCE]`) - **Trigger and mechanism**: 1. When $N \neq 0$ ($N=13$), native code in `0x6222` and `0x6318` sets `TIMER0 CC0 = 12000` µs. 2. This timer initiates autonomous transmission of IMU samples. 3. Roy MPSL-based station operates with a slot step of 6000 µs (cycle of 7 slots, 42 ms): - $t = 0$ ms: polling Peer 0 - $t = 6$ ms: polling Peer 1 - $t = 12$ ms: polling Peer 2 - $t = 18, 24, 30, 36$ ms: reserved for two Valve controllers. 4. Since the autonomous transmission interval is 12 ms ($12 = 2 \times 6$ ms): - **Collision 1**: Peer 0 polled at $t = 0$. Its autonomous TX will trigger at $t = 12$ ms. At that exact moment, the station polls Peer 2 on channel 2 $\implies$ **direct radio collision**. - **Collision 2**: Peer 1 polled at $t = 6$. Its autonomous TX will trigger at $t = 6 + 12 \times 3 = 42$ ms. At that moment, the station polls Peer 0 again $\implies$ **direct radio collision**. - **Interference with controllers**: At times $t = 18, 24, 30, 36$ ms, autonomous TX of trackers fall into "quiet" slots, causing latency spikes and freezes of Valve controllers for 200–484 ms. - **Status**: Mathematical and algorithmic fact. - **Recommendation**: Modifying 30 bytes does not solve the problem. It is necessary to either completely suppress launching `TIMER0 CC0` when $N \neq 0$ (NOP CC0 write branch), or synchronize the timer with the station. ## K04691 Source `D0169`, original line74, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### Finding B-2: Tracker response duration exceeds slot limit (400 µs) - **Severity**: **Major** - **Location**: roy_ram_station_v4.c (original reference: `[PRIVATE_SOURCE_REFERENCE]`); section 7.3 of document - **Trigger and mechanism**: HIGH-slot allocates 600 µs, of which useful reception is bounded by threshold 400 µs (`steady_slot_us - end_margin_us = 600 - 200`). When transmitting multiple IMU samples or command queue, total on-air time including preamble, address, S1, payload, CRC, hardware ramp-up, and turnaround reaches 227–528 µs. Packets completing after 400 µs are truncated or delay return of radio to the controller stack. - **Status**: Confirmed by logs of real radio captures. ## K04692 Source `D0169`, original line83, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### Finding B-3: Synchronization breakdown upon reconnection due to unchanged version number (FW189) - **Severity**: **Major** - **Location**: station_v4_runtime.py (original reference: `[PRIVATE_SOURCE_REFERENCE]`); tracker_ota_runtime.py (original reference: `[PRIVATE_SOURCE_REFERENCE]`) - **Trigger and mechanism**: The firmware version remains 189. Stock requires $N=9$ (period of 4727.5 µs), while the patch requires $N=13$ (period of 3000 µs). If the tracker reconnects to the station without a predefined `tracker_poll_decimation_by_id` table, the host configures it with the default $N=9$. The patched tracker will open the reception window at $\operatorname{int}(9 \times 3000 + 1810.5) = 28810$ µs and close it by 30 ms, while the station poll will only arrive at 42 ms. A complete loss of connection occurs. - **Status**: Fact. A software indicator to distinguish the patched tracker is required. ## K04693 Source `D0169`, original line92, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### Finding D-1: The `result.json` artifact hangs in `waiting_target` on error before OTA start - **Severity**: **Major** - **Location**: tracker_ota_runtime.py (original reference: `[PRIVATE_SOURCE_REFERENCE]`), L124 (original reference: `[PRIVATE_SOURCE_REFERENCE]`) - **Trigger and mechanism**: In `__init__`, `result.json` is created with the `waiting_target` status. If the tracker fails to connect within 120 s or reports an unsupported version, `poll()` raises `RuntimeError`. Since `self.ota` is `None`, `_write_status()` is not called, and `result.json` permanently remains with the `waiting_target` status. On a subsequent call, `load_job()` terminates with `ValueError: OTA result already exists; do not replay a completed/interrupted job`, blocking operation without saving the failure cause. - **Recommendation**: Add exception handling prior to OTA start, saving the error to `result.json`. ## K04694 Source `D0169`, original line101, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### Finding D-2: Risk of MCU watchdog timeout due to synchronous disk I/O - **Severity**: **Minor** - **Location**: tracker_ota_runtime.py (original reference: `[PRIVATE_SOURCE_REFERENCE]`), L119-L120 (original reference: `[PRIVATE_SOURCE_REFERENCE]`) - **Trigger and mechanism**: On each of the 4023 blocks, atomic rewriting of the `.tmp` file and appending to `.events.jsonl` are performed. On the Steam Frame internal memory (eMMC), disk delays may exceed 1 second, which, given an MCU heartbeat transmission delay of 6 seconds, will cause an emergency shutdown of the service. - **Recommendation**: Flush status to disk in batches (once every 50–100 blocks or at an interval of 2–3 seconds). ## K04695 Source `D0169`, original line110, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ### Finding C-1: Absence of Bootloader dump and recovery guarantees - **Severity**: **Blocker (for hardware flashing)** - **Location**: Section 9 and Appendix G of the document - **Trigger and mechanism**: Following successful writing to SPI flash, the native `0xfa98` code writes an activation marker to flash `0x2f000` and performs a reset. Further actions are performed by the Bootloader, whose code is absent from the project. It is unknown whether it verifies RSA/ECDSA signatures, how it handles power failures during copying to internal flash, and whether an emergency recovery mode exists. - **Recommendation**: Prohibit flashing real devices until a Bootloader dump is obtained. ## K04696 Source `D0169`, original line119, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 4. List of missing input data ## K04697 Source `D0169`, original line121, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. 1. **Tracker Bootloader memory dump (`0x00000000..0x00001000` and upper region)**: Required to prove the absence of digital signature verification and clarify rollback logic on firmware crash. 2. **Hardware radio capture (RF Capture)**: Required to measure the actual behavior of tracker `TIMER0` during packet reception (reset vs autonomous TX overlap). 3. **SWD pinout and tracker NVMC dump**: Required to ensure wired recovery of the test unit before the first experimental OTA flashing. ## K04698 Source `D0169`, original line127, SHA256 `728c436d031b9cae1a8f0a261a3d6a4c4f43786fcd2df372997e65b9cc42b59c`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. *The report was prepared in the strict mode of an independent technical audit. The original file `FW189_GRID3000_INDEPENDENT_VALIDATION.md` was left unchanged.* ## K04699 Source `D0170`, original line1, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. # Independent validation of the PICO FW189 patch for Steam Frame radio ## K04700 Source `D0170`, original line3, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Date: 2026-10-07. Status: **experimental candidate, prepared offline; not flashed and not approved for hardware launch**. ## K04701 Source `D0170`, original line5, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. This document is intended for transfer to independent reviewers, including other neural networks. It contains context, precise edits, sender design, verification boundaries, and questions that could refute the chosen solution. The reviewer's task is to find specific errors and missing evidence, rather than confirming the author's conclusion based on the number of passing tests. ## K04702 Source `D0170`, original line7, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The user requested a pause after writing. **Do not run SSH/SWD/RF/OTA, modify services, or flash devices within the scope of this review.** Source code reading, calculations, and offline models are permitted. This document does not constitute permission for hardware launch. ## K04703 Source `D0170`, original line9, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 1. How to use the document ## K04704 Source `D0170`, original line11, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. If only this MD is available, start with sections 2–12, then examine the embedded snapshots of source code and disassembly in the appendices. Do not assume access to the author's local paths. When an answer requires a missing bootloader, RF trace, or hardware, explicitly state this deficiency. ## K04705 Source `D0170`, original line13, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. When accessing the repository, the project root is `K:\AI\pico`. First read its `AGENTS.md`. The primary log is `docs/EXECUTION_STATUS_2026-10-06.md`. Precise source snapshots in the appendices take priority over modified files from a future session. ## K04706 Source `D0170`, original line15, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Three separate subjects of review: ## K04707 Source `D0170`, original line17, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. 1. **Correctness of the binary patch:** proper locations, encoding, values, completeness of dependent constants, absence of unwanted changes. 2. **Correctness of OTA:** byte protocol, ACK, packet retries, SPI staging, CRC, activation, and recovery. 3. **Efficiency over radio:** not only the 3000 µs period, but also phase, autonomous TX, RX availability, response length, and coexistence of three trackers with controllers. ## K04708 Source `D0170`, original line21, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Do not combine these three verdicts. A correct 30 bytes does not prove safe OTA or a compatibility fix. ## K04709 Source `D0170`, original line23, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 2. Project goal and constraints ## K04710 Source `D0170`, original line25, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The goal is autonomous tracking of three PICO Motion Trackers by the Steam Frame headset using onboard Nordic Roy, without an external dongle and without a permanent PICO/Windows pose bridge. ## K04711 Source `D0170`, original line27, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Roy retains stock flash and normal operation of two Valve controllers. The user previously permitted a temporary SRAM/SWD module operating within granted MPSL timeslots. The user has now separately permitted the preparation of a small **tracker firmware** patch. This is not permission to modify Roy's flash. ## K04712 Source `D0170`, original line29, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The patch must preserve native code for IMU, LED, camera synchronization, commands, pairing, and boot vectors. "Code is unchanged" and "dynamic behavior is preserved" are different assertions: the new cadence may alter IMU batching, queues, power consumption, and timeliness of command processing without modifying driver instructions. ## K04713 Source `D0170`, original line31, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 3. Prior observations and their reliability ## K04714 Source `D0170`, original line33, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The following hardware details are taken from the project log and existing receiver sources, rather than re-measured during patch preparation: ## K04715 Source `D0170`, original line35, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. - Roy is identified as nRF52833; stock application build `1788551713`, Zephyr/MPSL/BLE controller stack. - Two controller links operate on a measured grid of approximately 3000 µs. In the phase-locking code, this is `PERIOD_S=3000e-6`, RTC 32768 Hz. - In one set of observations, controller radio occupied roughly phases 500–1200 and 2200–3100 µs; the quiet region was approximately 1300–2200 µs. This is a historical measurement in relative phase, not universal absolute times for all boot/connection states. - Roy MPSL did not provide a stable chain of slots with an interval under approximately 6 ms. Therefore, the chosen station slot is every **6000 µs**, rather than every 3000 µs. - The HIGH timeslot takes 600 µs; custom RF must complete by 400 µs after the start of the slot, leaving 200 µs to return the radio to the controllers. - There were periods of clean coexistence lasting several minutes, but there were also controller freezes of 200–484 ms. Therefore, 600/6000 µs cannot be considered a universally hardware-certified mode. - With stock FW189, reply ratios were approximately 3–30%; responses arrived in bursts with long pauses. Other saved measurements with short RX showed around 7% intercepted responses. These numbers pertain to different modes and do not form a single precise loss probability. - The duration/end of a received response varied approximately 227–528 µs from the start of the slot. Responses ending after 400 µs no longer fit into the current RX regardless of period matching. - `MODECNF0=0x201` should be preserved: writing 1 previously disrupted the controllers until Roy rebooted. ## K04716 Source `D0170`, original line45, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. **The new candidate has not been tested on hardware.** Neither an increased reply ratio, nor the absence of controller freezes, nor successful boot, nor full FBT are claimed by this document. ## K04717 Source `D0170`, original line47, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. The exact chip/flash layout of the tracker should not be automatically equated to Roy. The stack pointer `0x20006000` and metadata page `0x2f000` do not in themselves prove the MCU model or the absence of bootloader security. ## K04718 Source `D0170`, original line49, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. ## 4. Identity of inputs and outputs ## K04719 Source `D0170`, original line51, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. | Object | Size | SHA256 | |---|---:|---| | Vendor container `Swift2.0_sv1.89_20241213_b189_app.bin` | 193385 | `41bd2d24dd9293e7d17c62ab18acd1001d6085da393123a67d226b28d2132e54` | | Raw stock application image | 96532 (`0x17914`) | `477000fc1fde2b518f51a3a2233dc38714731049093e236d15cfe049cd690a89` | | Raw patched application image | 96532 | `6a82a89206a609fdce92a3de764882ce53f79f0360b925bebe1ce7853cde6a0d` | ## K04720 Source `D0170`, original line57, SHA256 `976d766758edb6c21a668b518b4510b0219a1e7b4b3199b18f6c63155e3cc0e7`. Status: historical/unadjudicated narrative; Gemini English; exact placeholder/block coverage checked. Verified container: header of 321 bytes (`0x141`), followed by two identical copies of the raw image of 96532 bytes each. Both match the separate extracted stock image. The signed container was not rewritten and no new RSA signature was created.