# Historical HTML Claim Review — Batch 05

## Scope

Reviewed nine documents covering GCC-4241N controller pins, SFR initialization, BH6590KU servo theory, direct-seek theory, tray switches, Xbox SMC translation, and hardware finalization.

## Result

New claims: **95**  
Cumulative historical claims: **344**

| Status | Count |
|---|---:|
| Validated | 16 |
| Partially corroborated | 13 |
| Historical/Untrusted | 27 |
| Superseded | 3 |
| Rejected | 26 |
| Negative knowledge | 0 |
| Open question | 10 |

## Primary Hardware Conclusions

The GCC-4241N service manual separates the hardware roles clearly:

- **MN103S63G**: ATAPI, write strategy, DSP/servo decoder, encoder, CPU and host interface;
- **AN22107A**: RF amplifier, wobble and ALPC;
- **BH6590KU**: motor, actuator, stepping and tray drive.

This rejects the historical model of BH6590KU as a register-addressed servo/signal processor with generic offsets `0x42`, `0x44`, `0x48`, and `0x4A`.

The pin table validates these controller identities:

- 184/173: package coordinate P18, function TX/P13;
- 190/179: DASPST/MONI5;
- 191/180: NEJECT/MONI6;
- 192/181: NTRYCL/MONI7;
- 237/223: P0/SERIAL.

The historical eject mapping to MONI5 is rejected. NEJECT/MONI6 is the leading eject candidate. NTRYCL/MONI7 is the leading tray-state candidate, but direct board continuity remains pending.

## Tray and SMC Conclusions

Direct user observation validates the three-state mechanism truth table:

- closed: back closed, front closed;
- popped/moving: back closed, front open;
- fully open: back open, front open.

Combined with the active-low Xbox SMC contract, this validates the Boolean translation:

- TRAY_IN active only when both switches are closed;
- TRAY_OUT active only when both switches are open;
- CD_READY active for media presence/readiness; authentication or unlock is not required.

The exact Xbox connector pin numbers in the historical documents remain unresolved because the documents contradict each other.

## Firmware and GPIO Corrections

- Legacy `0x9000A040` / `0x9000A044` Port B mapping: rejected.
- Claimed tray IRQ at `0x10` or `0x18`: rejected by current A101 audit evidence supporting polling.
- Universal `0x03xx` SFR map: rejected.
- MN103S direction-bit rule `1=output`, `0=input`: validated as an architecture rule.
- P22/P23/P24 test-pad mapping: Open Question.
- Walking-bit output testing: useful only with strict safety constraints.

## Servo and Direct-Seek Corrections

Rejected:

- BH6590KU SPI/register model;
- fixed focus/tracking register offsets and gain values;
- tighter-XGD-track-geometry justification;
- direct PBA injection through BH6590KU;
- scalar physical LBA `0x02FDFFFE` interpretation;
- unauthenticated `0xAD/0xFE` raw 2,048-byte security-sector read.

Recipient-native calibration remains the safer general principle if later controlled experiments justify any optical changes.

## Power and IDE Integration

Validated:

- GCC-4241N is a 5 V slimline drive;
- the Xbox 12 V line must remain disconnected;
- the original Xbox HDD is master and the optical drive is slave.

Rejected:

- later documents that reverse the optical drive to master;
- fixed JAE pin bridges without verified connector schematics;
- claims that grounding one adapter pin is specifically required for SHA-1 correctness.

## TSOP48 Evidence Intake

The accurate A100 dump, accurate A101 dump, failed A101 flash-attempt package, and OEM comparison log are preserved for Batch 06. Successful external recovery is recorded as validated user hardware evidence. The transform theory remains unresolved.

## Full Claim Index

| Claim ID | Source | Status | Normalized claim |
|---|---|---|---|
| HCLM-B05-001 | HTML-002 | historical_untrusted | The Hardware I/O Map is a verified complete map of GCC-4241N tray and status I/O. |
| HCLM-B05-002 | HTML-002 | validated | System-controller pin 184/173 is package coordinate P18 with function TX/P13. |
| HCLM-B05-003 | HTML-002 | open_question | The tray-closed back switch is electrically routed to TX/P13 at pin 184/173. |
| HCLM-B05-004 | HTML-002 | validated | System-controller pin 192/181 is NTRYCL/MONI7 and supports an external-interrupt function. |
| HCLM-B05-005 | HTML-002 | partially_corroborated | The tray-open front switch is electrically routed to NTRYCL/MONI7 at pin 192/181. |
| HCLM-B05-006 | HTML-002 | rejected | The eject button is connected to DASPST/MONI5 at pin 190/179. |
| HCLM-B05-007 | HTML-002 | partially_corroborated | The onboard activity LED is controlled by P0/SERIAL at pin 237/223 through a transistor. |
| HCLM-B05-008 | HTML-004 | historical_untrusted | The listed port-initialization matrix was correctly extracted from the GCC-4241N boot vector. |
| HCLM-B05-009 | HTML-004 | historical_untrusted | Writes involving 0x0310 and 0x0314 configure mixed GPIO directions. |
| HCLM-B05-010 | HTML-004 | historical_untrusted | Addresses 0x0204, 0x0340, 0x0234, and 0x0260 are direction registers set to all-input mode. |
| HCLM-B05-011 | HTML-004 | rejected | The block beginning at 0x0230 is memory or bus configuration. |
| HCLM-B05-012 | HTML-004 | historical_untrusted | The value at 0x0344 configures pins 2, 3, 5, and 7 as mixed GPIO directions. |
| HCLM-B05-013 | HTML-004 | historical_untrusted | The same 0x8014 value at 0x0370 and 0x0374 establishes equivalent mixed pin modes. |
| HCLM-B05-014 | HTML-004 | rejected | The 0x0264 block is a heavy-output configuration for motor or stepper drive signals. |
| HCLM-B05-015 | HTML-004 | validated | For MN103S GPIO direction control, bit value 1 selects output and bit value 0 selects input. |
| HCLM-B05-016 | HTML-018 | rejected | BH6590KU is the GCC-4241N servo and signal processor. |
| HCLM-B05-017 | HTML-018 | validated | BH6590KU drives focus, tracking, tilt, spindle, stepping, tray, and solenoid actuator paths. |
| HCLM-B05-018 | HTML-018 | rejected | MN103S communicates with BH6590KU through memory-mapped registers and a high-speed SPI interface. |
| HCLM-B05-019 | HTML-018 | historical_untrusted | The GDR-8050L donor uses AN22107A for its servo-driver role. |
| HCLM-B05-020 | HTML-018 | historical_untrusted | GDR-8050L routine 0x90030687 is a high-gain Xbox servo tuner. |
| HCLM-B05-021 | HTML-018 | superseded | A recipient servo shim is required to translate donor AN22107A behavior into BH6590KU commands. |
| HCLM-B05-022 | HTML-018 | rejected | BH6590KU exposes focus gain, tracking gain, focus offset, and tracking offset registers at 0x42, 0x44, 0x48, and 0x4A. |
| HCLM-B05-023 | HTML-018 | superseded | A servo shim at SRAM address 0x40008600 can safely replace donor high-gain behavior. |
| HCLM-B05-024 | HTML-018 | rejected | Tracking gain 0x7F and focus gain 0x6A are optimized safe values for Xbox discs. |
| HCLM-B05-025 | HTML-018 | open_question | A native SPI-write helper exists and can program the claimed BH6590KU registers. |
| HCLM-B05-026 | HTML-018 | historical_untrusted | ROM offset 0x38B4A is the GCC-4241N dual-layer servo initialization hook. |
| HCLM-B05-027 | HTML-018 | historical_untrusted | ROM offset 0x3910C directly controls laser-power DAC output. |
| HCLM-B05-028 | HTML-018 | rejected | Xbox Game Discs require higher gain because their game partition has tighter track geometry than standard DVD media. |
| HCLM-B05-029 | HTML-018 | partially_corroborated | Using recipient-native dual-layer calibration before any experimental adjustment is safer than copying donor register values. |
| HCLM-B05-030 | HTML-020 | historical_untrusted | Target LBA, current LBA, and seek state are stored at 0x40000B20, 0x40000B24, and 0x40000B28. |
| HCLM-B05-031 | HTML-020 | historical_untrusted | Seek-state values 0, 1, and 2 mean idle, seeking, and settling. |
| HCLM-B05-032 | HTML-020 | historical_untrusted | ROM offset 0x2C450 converts LBA to PBA. |
| HCLM-B05-033 | HTML-020 | historical_untrusted | The recipient LBA walls are enforced inside the 0x2C450 translation routine. |
| HCLM-B05-034 | HTML-020 | rejected | A payload can bypass all LBA restrictions by writing physical coordinates directly to BH6590KU control state. |
| HCLM-B05-035 | HTML-020 | rejected | 0x02FDFFFE is the direct physical LBA of the Xbox security sector. |
| HCLM-B05-036 | HTML-020 | historical_untrusted | ROM offset 0x382F0 is the physical seek executor. |
| HCLM-B05-037 | HTML-020 | historical_untrusted | The physical seek executor accepts 0x02FDFFFE in d0. |
| HCLM-B05-038 | HTML-020 | rejected | A method-B payload at 0x40008800 can expose a vendor 0xAD format 0xFE read before authentication. |
| HCLM-B05-039 | HTML-020 | rejected | The method reads a raw 2,048-byte security sector. |
| HCLM-B05-040 | HTML-020 | historical_untrusted | ROM offset 0x39A10 is a native physical-sector read helper. |
| HCLM-B05-041 | HTML-020 | historical_untrusted | 0x10C80040 is a safe DRAM mirror for security data. |
| HCLM-B05-042 | HTML-020 | rejected | Direct seeking can establish original Xbox media independently of the SHA-1/RC4 handshake. |
| HCLM-B05-043 | HTML-033 | rejected | PORTB_IN and PORTB_DIR are located at 0x9000A040 and 0x9000A044. |
| HCLM-B05-044 | HTML-033 | rejected | Port B bits 0 and 1 encode tray-closed and tray-open state. |
| HCLM-B05-045 | HTML-033 | validated | Tray/media transition must clear Xbox authorization state. |
| HCLM-B05-046 | HTML-033 | rejected | A change on the tray GPIO vectors through external IRQ 0x10 or 0x18. |
| HCLM-B05-047 | HTML-033 | historical_untrusted | The tray handler clears an authorization flag at offset 0x2CC. |
| HCLM-B05-048 | HTML-033 | superseded | A tray-auth reset hook can be safely injected at 0x40008B00. |
| HCLM-B05-049 | HTML-033 | rejected | The hook should read 0x9000A040 and test bit 1. |
| HCLM-B05-050 | HTML-033 | historical_untrusted | The hook should clear byte 0x2CC to force unauthorized state. |
| HCLM-B05-051 | HTML-034 | validated | The original 0x9000A040 tray map is deprecated. |
| HCLM-B05-052 | HTML-034 | rejected | GCC-4241N SFRs are conclusively mapped in the 0x03xx address space. |
| HCLM-B05-053 | HTML-034 | validated | GCC-4241N uses an overlapping dual-switch tray topology with closed, popped, and fully open states. |
| HCLM-B05-054 | HTML-034 | open_question | The back tray switch is routed to P13 at pin 184/173. |
| HCLM-B05-055 | HTML-034 | partially_corroborated | The front tray switch is routed to NTRYCL/MONI7 at pin 192/181. |
| HCLM-B05-056 | HTML-034 | rejected | Because MONI7 supports external interrupt, firmware polling is unnecessary. |
| HCLM-B05-057 | HTML-034 | partially_corroborated | Directly exposing focus-ok or spindle-lock analog states as CD_READY is unsafe because they can change during normal operation. |
| HCLM-B05-058 | HTML-034 | validated | Xbox CD_READY represents media presence/readiness and is independent of authentication or unlock. |
| HCLM-B05-059 | HTML-034 | rejected | CD_READY should be generated from authorization flag 0x2CC. |
| HCLM-B05-060 | HTML-034 | partially_corroborated | A walking-bit hardware fuzzer is required before finalizing GPIO addresses and pad assignments. |
| HCLM-B05-061 | HTML-035 | validated | On an original Xbox IDE chain, the HDD is master and the optical drive must operate as slave. |
| HCLM-B05-062 | HTML-035 | historical_untrusted | An incorrect optical-drive IDE role specifically causes Xbox errors 07, 08, or 09. |
| HCLM-B05-063 | HTML-035 | validated | GCC-4241N requires 5 V power and the Xbox 12 V line must not be connected to the slimline drive. |
| HCLM-B05-064 | HTML-035 | partially_corroborated | Applying the Xbox 12 V line to the drive necessarily causes immediate catastrophic failure. |
| HCLM-B05-065 | HTML-035 | partially_corroborated | Both mechanical switch signal pads are 0 V when closed and 3.3 V when open. |
| HCLM-B05-066 | HTML-035 | validated | Xbox tray and ready inputs use active-low signaling. |
| HCLM-B05-067 | HTML-035 | historical_untrusted | Xbox yellow-cable pin 4 is EJECT, pin 7 is TRAY_IN, and pin 9 is TRAY_OUT. |
| HCLM-B05-068 | HTML-035 | open_question | A 2N3904 with a 10 kΩ base resistor can invert the front-switch signal to produce active-low TRAY_OUT. |
| HCLM-B05-069 | HTML-035 | open_question | The slimline mechanism cannot directly provide an active-low fully-open signal, so an inverter is mandatory. |
| HCLM-B05-070 | HTML-036 | open_question | Three unused factory test pads are tied to P22, P23, and P24 and are safe High-Z outputs for Xbox tray and ready signals. |
| HCLM-B05-071 | HTML-036 | historical_untrusted | P22, P23, and P24 should connect to Xbox pins 6, 5, and 7 for TRAY_IN, TRAY_OUT, and CD_READY. |
| HCLM-B05-072 | HTML-036 | rejected | Xbox EJECT can be tied directly to DASPST/MONI5. |
| HCLM-B05-073 | HTML-036 | validated | The native mechanism truth table is closed/closed when shut, closed/open while popped, and open/open when fully ejected. |
| HCLM-B05-074 | HTML-036 | validated | TRAY_IN should be active low only when both switches report closed. |
| HCLM-B05-075 | HTML-036 | validated | TRAY_OUT should be active low only when both switches report open. |
| HCLM-B05-076 | HTML-036 | validated | CD_READY is inactive with no media and active when media is present, independent of authentication. |
| HCLM-B05-077 | HTML-036 | partially_corroborated | Front-switch opening should immediately clear any custom media-ready latch. |
| HCLM-B05-078 | HTML-036 | open_question | READY_IDLE is sufficient to assert CD_READY as a media-presence signal. |
| HCLM-B05-079 | HTML-036 | partially_corroborated | P0/SERIAL at pin 237/223 is the internal activity-LED control line. |
| HCLM-B05-080 | HTML-036 | partially_corroborated | NDASP is the ATAPI drive-active/slave signal and is a better candidate for external activity indication than tapping a CPU pin. |
| HCLM-B05-081 | HTML-036 | rejected | The optical drive must be configured as IDE master by bridging JAE CSEL pin 47 to ground pin 45. |
| HCLM-B05-082 | HTML-036 | open_question | Grounding JAE pin 48 is required to prevent 80-wire IDE crosstalk and dashboard crashes. |
| HCLM-B05-083 | HTML-037 | validated | GCC-4241N is a 5 V-only slimline drive and the Xbox 12 V line must be isolated. |
| HCLM-B05-084 | HTML-037 | rejected | The Xbox requires the optical drive to be IDE master. |
| HCLM-B05-085 | HTML-037 | rejected | Bridging JAE pin 47 to pin 45 is the correct master configuration. |
| HCLM-B05-086 | HTML-037 | rejected | Grounding pin 48 is critical specifically to prevent corruption during SHA-1 calculations. |
| HCLM-B05-087 | HTML-037 | historical_untrusted | MONI0 at pin 185 is a validated focus-ok output suitable for Xbox Disc Ready. |
| HCLM-B05-088 | HTML-037 | historical_untrusted | MONI1 at pin 186 is a validated spindle-lock output suitable for Xbox Disc Ready. |
| HCLM-B05-089 | HTML-037 | partially_corroborated | NEJECT/MONI6 at pin 191/180 is the controller signal most directly associated with eject. |
| HCLM-B05-090 | HTML-037 | partially_corroborated | NTRYCL/MONI7 at pin 192/181 is the controller signal most directly associated with tray-closed state. |
| HCLM-B05-091 | HTML-037 | historical_untrusted | Xbox yellow-cable pins 11, 12, and 10 should be Disc Ready, Eject, and Tray In. |
| HCLM-B05-092 | HTML-037 | rejected | The GCC-4241N mechanism lacks a fully open tray sensor. |
| HCLM-B05-093 | HTML-037 | open_question | A 2N3904 inverter driven from pin 192 is the validated TRAY_OUT solution. |
| HCLM-B05-094 | HTML-037 | historical_untrusted | Electrical tape under the tray is a validated fix for high-gain seek resonance. |
| HCLM-B05-095 | HTML-037 | open_question | A 10 µF capacitor from Disc Ready to ground is a validated SMC-stability fix. |

## PFES v0.12.10 Correction

The earlier authorization requirement for `CD_READY` was incorrect. `CD_READY`
represents media presence/readiness and is independent of Xbox authentication
or drive unlock state. Claims HCLM-B05-058, HCLM-B05-059, HCLM-B05-076, and
HCLM-B05-078 were revised accordingly.
