[docs] bind C3 post-OI NVS evidence

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

docs/specifications/firmware/browser-flashing.md

@@ -2349,6 +2349,22 @@ The operation does not run a gate, infer a pass from a build, create a
 threshold, or turn pending evidence into a result. This section freezes an
 evidence-writing workflow and records no passed result.
 
+For `esp32-c3-4mb`, `create-result` additionally requires one explicit
+post-OI NVS inventory receipt path; Pico rejects that input. The receipt MUST
+be canonical strict JSON in one stable, exclusive mode-`0600` regular file. It
+contains no NVS values or device identity: only namespace/key/type inventory
+and an exact summary with schema/profile, candidate `release.json` and merged
+firmware SHA-256, the verify-mode OI raw-log SHA-256, exactly 10 reset samples,
+NVS partition offset `0x9000` and size `0x6000`, integrity `passed`, and the
+complete sorted written-namespace list. The writer derives the receipt's byte
+length and SHA-256, requires its summary to match the inventory, rejects any
+written `phy` namespace/key, and copies only the summary plus receipt binding
+into the private result. Completion and finalization cross-check the retained
+OI raw-log digest against the completed C3 observation. The public C3 summary
+does not expose this private object; `qualification_result_sha256` binds it.
+The already-required `provisioning_install: passed` remains the separate
+full-chip-erase/install proof and is neither duplicated nor weakened.
+
 The four ESP records use `resource_kind: "esp-idf"` and
 `provisioning_kind: "esp-web-serial"`. Each additionally has exact
 `manifest_sha256`; the V4 ESP `oi1_build`, heap observations, and

docs/specifications/firmware/ports/esp32-c3-4mb.md

@@ -89,8 +89,22 @@ existing 10 controlled C3-G4 reset samples MUST still pass the 3,000 ms ceiling
 and every frozen heap floor. A read-only NVS namespace/key/type inventory taken
 after those repeated resets MUST pass partition integrity checks and contain no
 written `phy` namespace or key; values are neither required nor retained as
-public evidence. The application and VFS regions remain subject to their
-existing exact-byte and functional checks.
+public evidence. The C3 private-result writer MUST require that inventory as a
+stable, exclusive mode-`0600` canonical receipt. It derives and stores the
+receipt's exact SHA-256 and byte length plus a candidate-bound summary; the
+summary binds the candidate release and firmware digests, the exact OI raw-log
+digest, 10 reset samples, NVS offset `0x9000`, size `0x6000`, integrity pass,
+and the complete written namespace list. The writer rejects a missing,
+changed, malformed, non-exclusive, wrong-candidate, wrong-offset,
+wrong-size, integrity-failed, or `phy`-containing receipt. Finalization MUST
+cross-check its OI raw-log binding against the completed C3 observation. The
+public summary omits the private receipt body; its private-result digest binds
+the validated receipt transitively. The application and VFS regions remain
+subject to their existing exact-byte and functional checks.
+
+The existing V5 `provisioning_install: passed` check remains the mechanical
+full-chip-erase/install attestation and MUST still be present. The NVS receipt
+does not duplicate or replace that check.
 
 ## C3-G0 — Identity, build, and install (FROZEN)