# ECP5 fabric safety-policy lockout record — 2026-08-29

## Result and scope

Company-authored physical-board engineering evidence: with the board-local
SW5-1 physical arm set ON, a direct machine-mode CFS request entered one
fabric-controlled permit interval. Retained UART then recorded:

```
permit=1
expired=2
renewal=2
pass=bounded_permit,hardware_lockout,no_cpu_renewal
```

The policy gave one permit, withdrew it after its 480,000-cycle window (40 ms
at the 12 MHz test clock), and rejected a fresh direct machine-mode request
after lockout. The operator returned SW5-1 OFF after the capture. The image
was volatile JTAG SRAM configuration only and used onboard LEDs, UART and
SW5-1; it did not touch configuration flash, expansion pins, product I/O or
actuators.

## What this establishes

The CPU cannot renew an active permit indefinitely, even while the physical arm is active: the fabric enforces a 40 ms policy window and then locks out. Scope: LED-only, in volatile SRAM on the ECP5 evaluation board.

## Reproducibility

The completed internal record is
`evidence/runs/2026-08-29-ecp5-fabric-safety-policy-lockout-001/manifest.json`.
It retains frozen inputs, bitstream, build and loader logs, raw UART capture,
tool versions and hashes.