# 4.2.11.2.4 TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases — `-man` ↔ `-cas` diff 报告
> **交付形态说明**：本报告随专家交付包分发——`-man`/`-cas` 脚本包 zip 与 190server HTML 执行日志已内联至 `packages/`、`evidence-html/`，相应路径已相对化；TTR、spec_intl、caseir 等仓内留痕仍为生成机原始路径（未随包）。

- 生成时间：2026-10-08 22:57:09 ｜引擎：holiday-blk5/0.1｜配对状态：`PAIRED`
- 分母口径：卡侧 61 之一

## 1. 配对与包

| 侧 | 包/源 | sha256 | 源类型 | 入口用例 |
|---|---|---|---|---|
| `-man` | 4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-man.zip | `e9204d49fd298b5e757749731b7480c43486f3e70b5d0552fdd9165ac8c09870` | zip | TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_02_Error_GetEUICCChallenge_during_BPP_loading |
| `-cas` | 4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-cas.zip | `19235596aefd11d71ad54361e7112a5415217a3755f6036ccdb073b665b550db` | zip | — |

- man 源路径：`../../packages/man/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-man.zip`
- cas 源路径：`../../packages/cas/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-cas.zip`
- 上游来源：{"man_ledger": true, "cas_ledger": true, "naming_map": true, "html_probe": true, "man_package": true, "cas_package": true}
- 适用性：naming-map=`M` ["M", "M", "M", "M", "M"]；caseir=`M`

## 2. 执行摘要（双方 job/终态）

| 侧 | 终态/计划 | 备注 | ErrorCount | job_id | 业务状态 | TTR | 诊断包 |
|---|---|---|---|---|---|---|---|
| `-man` | `ok` | `_ok` 复用（结构 A1-A7 PASS；`_ok` run 无厂商错误行） | 0 | `20261007_115451:04858b15466442729b11a5554ab02931` | — | `/Users/yuhu/cas/原料/切片/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases/logs/20260907_180935_ok/extracted/ESIM_TEST_SGP_23/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_02_Error_GetEUICCChallenge_during_BPP_loading.ttr` | `—` |
| `-cas` | `failed` | 纯 native 零卡态前置（N0） | 63 | `82a1d56b2b454c9c8ed1f74878f980dc` | — | `/Users/yuhu/cas/experiments/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-20261004_021951/logs/82a1d56b_gapfix1/result/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_01_02_merged.ttr` | `—` |
- cas 块4账本：decision=`RERUN`；route=`native_N0`；live 事件 2 条（4.6 波次进行中；以块4终版账本为准）
- cas 4.6 波次最新执行：terminal=`failed`；stage=`cas_gapfix_rerun`；job=`82a1d56b2b454c9c8ed1f74878f980dc`；gaps=["gapfix-rerun：job 终态 succeeded，业务判 failed（error_count=4）；failed 亦为有效终态，如实登记"]
- cas 失败归因引用（块4）：`b4-attribution.md`
- cas 证据来源分层：`RERUN` → 本轮 4.6 波次执行

## 3. HTML 执行日志状态

- `-man`：**NATIVE**（`../../evidence-html/4.2.11.2.4/man/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_02_Error_GetEUICCChallenge_during_BPP_loading.html`；sha256 `f22153e427eef04b98ceb5174d4f6cda3641719bc5bf375c3a52afb6e3324865`；160074 bytes）
- `-cas`：**NATIVE**（`../../evidence-html/4.2.11.2.4/cas/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_01_02_merged.html`；sha256 `44c21f332c817ddb3c5f0be1c41821b4c6bc97ff178b241ab797b600da0a05e0`；17299 bytes）
- 纪律：原生缺失 → `HTML_UNAVAILABLE` 显式阻断（附探针结论）；派生件仅标 `DERIVED_NOT_NATIVE`，不冒充原生。

## 4. L1 脚本/依赖/命名差异（源文件闭包级）

- 闭包规模：man 34 文件 / cas 82 文件；同名 31（字节同 30，内容异 1）
- 同名内容异：`Import/TestCase_SGP_23.js`
- man-only 文件 3：`ESIM_TEST_SGP_23.UCE`, `ESIM_TEST_SGP_23.sol`, `MANIFEST.json`
- cas-only 文件 51：`Import/CapInfo.js`, `Import/ExecuteTestCase.js`, `Import/ExecuteTestCase_CSC.js`, `Import/ExecuteTestCase_LoadProfile_via_bip.js`, `Import/ExecuteTestCase_Local_Management.js`, `Import/ExecuteTestCase_Non_Telecom_Profile.js`, `Import/ExecuteTestCase_Performance.js`, `Import/ExecuteTestCase_PressureTest.js`, `Import/ExecuteTestCase_ProfileFormatTest_V_2_3_1.js`, `Import/ExecuteTestCase_ProfileServicesListTest.js` …
- 注：man 包＝切片最小闭包（`script/` 投影）；cas 包＝slice_native 全工程投影（厂商参照闭包＋生成体）。闭包规模差为打包形态差异；同名文件字节差集中于 `Import/TestCase_SGP_23.js`（TC 入口本体）。

### 4.1 入口代码对照

- 行数：man 293 / cas 120；字符：man 15047 / cas 10614
- man 顶层调用 Top：[["TestStepStart2", 25], ["CheckData", 8], ["push", 7], ["GenHexData", 6], ["GenASN1HexData", 5], ["TS_SELECT", 4], ["LPAd_Transport_data_to_eUICC", 4], ["substr", 4], ["ES10b_GetEUICCChallenge", 3], ["SendGPcmdSCP03t", 3]]
- cas bind 调用：[["checkData", 24], ["sendApdu", 8]]

| 方言映射对 | 命中数 |
|---|---|
| TS_*_cmd() ↔ bind.* 命令封装 | 6 |

<details><summary>unified diff（截断预览）</summary>

```diff
--- man
+++ cas
@@ -1,292 +1,119 @@
-// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_01_Error_Unrecognized_leading_tag_in_BPP + TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_02_Error_GetEUICCChallenge_during_BPP_loading (extracted verbatim)
+// Author: 卡思Cas智能体
+// Date: 20261005-152741
+// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases，Test Sequence #01 Error: Unrecognized leading tag in BPP; #02 Error: GetEUICCChallenge during BPP loading，适用性 M。
+// Test points: S1-C1 SW；S2-C1 SW；S2-C2 response data absent；S3-C1 SW；S3-C2 SW；S4-C1 SW
+//   S4-C2 contains iccid 989209012143658709F5；S4-C3 contains iccid 989209012143658709F5
+//   S4-C4 isdpAid；S4-C5 profileState；S5-C1 SW；S5-C2 R_CHALLENGE outer tag
+//   S5-C2 R_CHALLENGE required members present；S5-C2 tagOfeuiccChallenge
+//   S5-C2 lengthOfeuiccChallenge；S5-C3 R_CHALLENGE outer tag；S5-C3 tagOfeuiccChallenge
+//   S5-C3 lengthOfeuiccChallenge；S6-C1 SW in 6A88/6985；S7-C1 SW；S7-C2 profileInfoListOk empty
+//   S8-C1 SW；S8-C2 notificationMetadataList empty
+// 本函数由 CaseIR 4.2.11.2.4 编译生成（fullwave-blindgen-live-70-W1-A3，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
+// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
+// 适用性 M：编译期门，运行时由 harness 环境前置承担。
+// PRECONDITION (declared, NOT compiled): initial_conditions 缺语料过程体（Annex C.2 absent from input package, corpus vacuum）: IC 序列属测试工具/卡态编排责任，本脚本不虚构初始化步骤；语义影响见 CaseIR open_items。
+// GIC1 The PROFILE_OPERATIONAL1 is not loaded on the eUICC.: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// GIC2 Communication S_Device/eUICC initialized, S_LPAd has selected the ISD-R; Common Mutual Authentication successfully executed (#GET_EUICC_INFO1, #GET_EUICC_CHALLENGE, #AUTHENTICATE_SMDP sent); the same GSMA CI chosen for signing and verification; End User Confirmation sub-procedure executed (#PREP_DOWNLOAD_NO_CC sent).: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// Seq01-IC1/IC2/IC3 Generate <OTPK_S_SM_DP+_ECKA>/<OT_SK_S_SM_DP+_ECKA>; <BPP> = MTD_GENERATE_BPP(#S_INIT_SC_PROF1, #CONF_ISDP_PROF1, #METADATA_OP_PROF1, NO_PARAM, #UPP_OP_PROF1); split into <BPP_SEG_INIT>/<BPP_SEG_A0>/<BPP_SEG_A1>/<BPP_SEG_A3>.: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// Seq01-IC4 S_LPAd → eUICC: MTD_STORE_DATA_SCRIPT(<BPP_SEG_INIT>) — SW=0x9000 without response data for all STORE DATA commands.: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// Seq01-IC5 S_LPAd → eUICC: MTD_STORE_DATA_SCRIPT(<BPP_SEG_A0>) — SW=0x9000 without response data for all STORE DATA commands (REQ RQ31_186_1).: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// Seq02-IC No Notification is stored in the eUICC's Pending Notifications List; IC1-IC6: generate one-time keys, generate <BPP> (same as Seq01-IC2), split segments, then load <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1> — each SW=0x9000 without response data.: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+function TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_01_02_merged() {
+    var bind = curBind;
 
-function TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_01_Error_Unrecognized_leading_tag_in_BPP()
-{
-	tracenamestr = "测试目的：确保eUICC在Profile下载期间，拒绝任何带有无法识别的leading tag的BPP部分。在这种情况下，eUICC应返回SW为0x6A88，不应丢弃下载会话状态";
-	curDis.TraceStart(sno++,tracenamestr);
+    // 步骤 1：Seq#01 Step1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_186_1, RQ57_013, RQ57_016）
+    // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+    var s1 = bind.sendApdu(null, "E2", "91", "00", "C9050102030405", "00", "6A88");
+    bind.checkData("S1-C1 SW", "6A88", s1.sw);
+    // S1-C2: kind 'requirement' pattern '' has no static generation face (corpus vacuum; see CaseIR unresolved).
+    // S1-C3: kind 'requirement' pattern '' has no static generation face (corpus vacuum; see CaseIR unresolved).
+    // S1-C2: binding:requirement_satisfied_by_same_step_error_sw_assertion (check_attestation)
+    // S1-C3: binding:requirement_satisfied_by_same_step_error_sw_assertion (check_attestation)
 
-	curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
-	Ini_powerOn_eUICC_LPAe_not_activate();
+    // 步骤 2：Seq#01 Step2] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_186_1）
+    // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+    var s2 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+    bind.checkData("S2-C1 SW", "9000", s2.sw);
+    bind.checkData("S2-C2 response data absent", "1", s2.resp === "" ? "1" : "0");
 
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
-	TS_MANAGE_CHANNEL_OPEN();
+    // 步骤 3：Seq#01 Step3] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_186_1）
+    // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+    var s3 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+    bind.checkData("S3-C1 SW", "9000", s3.sw);
+    bind.checkData("S3-C2 SW", "9000", s3.sw);
+    // S3-C3: binding:bpp_seg_load_pir_runtime_structure(S22-2.5.6;PIR-runtime-domain) (check_attestation)
 
-	curLogicChannel = 1;
+    // 步骤 4：Seq#01 Step4] MTD_STORE_DATA（tc_step）
+    // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+    var s4 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+    bind.checkData("S4-C1 SW", "9000", s4.sw);
+    var r2p4 = BindEs10xProcProfile.walkChoiceList(s4.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+    var r2has4_0 = false;
+    for (var r2i4_0 = 0; r2i4_0 < r2p4.elements.length; r2i4_0++) {
+        var f = r2p4.elements[r2i4_0].fields;
+        if (f["5A"] === "989209012143658709F5" && f["9F70"] === "00") { r2has4_0 = true; break; }
+    }
+    bind.checkData("S4-C2 contains iccid 989209012143658709F5", "1", (r2p4.branch_tag === "A0" && r2has4_0) ? "1" : "0");
+    var r2has4_0 = false;
+    for (var r2i4_0 = 0; r2i4_0 < r2p4.elements.length; r2i4_0++) {
+        var f = r2p4.elements[r2i4_0].fields;
+        if (f["5A"] === "989209012143658709F5") { r2has4_0 = true; break; }
+    }
+    bind.checkData("S4-C3 contains iccid 989209012143658709F5", "1", (r2p4.branch_tag === "A0" && r2has4_0) ? "1" : "0");
+    var r2fa4S4_C4 = false;
+    for (var r2fi4S4_C4 = 0; r2fi4S4_C4 < r2p4.elements.length; r2fi4S4_C4++) {
+        var f = r2p4.elements[r2fi4S4_C4].fields;
+        if (f["4F"] !== undefined) { r2fa4S4_C4 = true; break; }
+    }
+    bind.checkData("S4-C4 isdpAid", "1", (r2p4.branch_tag === "A0" && r2fa4S4_C4) ? "1" : "0");
+    var r2fa4S4_C5 = false;
+    for (var r2fi4S4_C5 = 0; r2fi4S4_C5 < r2p4.elements.length; r2fi4S4_C5++) {
+        var f = r2p4.elements[r2fi4S4_C5].fields;
+        if (f["9F70"] === "00") { r2fa4S4_C5 = true; break; }
+    }
+    bind.checkData("S4-C5 profileState", "1", (r2p4.branch_tag === "A0" && r2fa4S4_C5) ? "1" : "0");
 
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
-	TS_SELECT("Select ISD",ISD_R_AID,"9000");
+    // 步骤 5：Seq#02 Step1] MTD_STORE_DATA（tc_step；REQ: RQ31_188_1）
+    // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+    var s5 = bind.sendApdu(null, "E2", "91", "00", "BF2E00", "00", "9000");
+    bind.checkData("S5-C1 SW", "9000", s5.sw);
+    // geca-proc ES10b Info 响应面（R_CHALLENGE，SGP.22 §5.7.7/§5.7.8 结构机械转录；响应外层 tag = 请求 tag）：绑定层结构步行 + 在场性断言。
+    var gw5 = BindGecaProc.parseGecaResponse(s5.resp, {outer: "BF2E", required: ["80"], optional: []});
+    bind.checkData("S5-C2 R_CHALLENGE outer tag", "BF2E", gw5.outer_tag === null ? "absent" : gw5.outer_tag);
+    bind.checkData("S5-C2 R_CHALLENGE required members present", "1", gw5.ok ? "1" : "0");
+    var r2w5 = BindGecaProc.parseGecaResponse(s5.resp, {outer: "BF2E", required: ["80"]});
+    bind.checkData("S5-C2 R_CHALLENGE outer tag", "BF2E", r2w5.outer_tag === null ? "absent" : r2w5.outer_tag);
+    var r2ch5 = null; for (var r2ci5 = 0; r2ci5 < r2w5.children.length; r2ci5++) { if (r2w5.children[r2ci5].tag === "80") { r2ch5 = r2w5.children[r2ci5]; } }
+    var r2chal5 = r2ch5 === null ? "" : r2ch5.value;
+    bind.checkData("S5-C2 tagOfeuiccChallenge", "80", r2ch5 === null ? "absent" : r2ch5.tag);
+    bind.checkData("S5-C2 lengthOfeuiccChallenge", "10", r2ch5 === null ? "absent" : (r2ch5.len < 16 ? ("0" + r2ch5.len.toString(16).toUpperCase()) : r2ch5.len.toString(16).toUpperCase()));
+    bind.checkData("S5-C3 R_CHALLENGE outer tag", "BF2E", r2w5.outer_tag === null ? "absent" : r2w5.outer_tag);
+    bind.checkData("S5-C3 tagOfeuiccChallenge", "80", r2ch5 === null ? "absent" : r2ch5.tag);
+    bind.checkData("S5-C3 lengthOfeuiccChallenge", "10", r2ch5 === null ? "absent" : (r2ch5.len < 16 ? ("0" + r2ch5.len.toString(16).toUpperCase()) : r2ch5.len.toString(16).toUpperCase()));
 
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
+    // 步骤 6：Seq#02 Step2] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_185, RQ57_013, RQ57_016）
+    // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+    var s6 = bind.sendApdu(null, "E2", "00", "00", null, "00", "6A88/6985");
+    bind.checkData("S6-C1 SW in 6A88/6985", "1", (s6.sw === "6A88" || s6.sw === "6985") ? "1" : "0");
+    // S6-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
 
+    // 步骤 7：Seq#02 Step3] MTD_STORE_DATA（tc_step；REQ: RQ31_185）
+    // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
…（差异行超限，共 405 行，此处截断）
```

</details>
### 4.2 UCE/命名对照

- man：`ESIM_TEST_SGP_23.UCE`；入口 [('TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_02_Error_GetEUICCChallenge_during_BPP_loading', 'TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases', 'Import\\\\ExecuteTestCase_SGP_23.js(TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_02_Error_GetEUICCChallenge_during_BPP_loading)')]；参数 {"ReaderName": "Identiv SCR35xx USB Smart Card Reader 0"}
- cas：`TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases.uce`；入口 [('TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_01_02_merged', 'TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases', 'Import\\\\ExecuteTestCase_spec.js(TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_01_02_merged)')]；参数 {"ReaderName": "Identiv SCR35xx USB Smart Card Reader 0"}

## 5. L2 步骤/APDU/step_map 差异（结构化对齐）

- 命令计数：man 73 / cas 0；精确对齐 0，核心（CLA·INS·P1·P2·Lc）同 0，man-only 73，cas-only 0

| # | `-man` | `-cas` | 对齐 |
|---|---|---|---|
| — | man-only: `@RESET`, `00A40004023F00`, `00C0000020`, `80AA000007A9058100830137`, `8010000023FFFFFFFF7F9D00DFBF00001FE20000…0000038`, `801200000F`, `801400000C810301250082028281830100`, `0070000000`, `0070000001`, `01A4040010A0000005591010FFFFFFFF8900000100`, `01C0000021`, `81E2910003BF2000` | | |

## 6. L3 规范字段/Expected/REQ/通过条件差异

- spec：/Users/yuhu/cas/原料/切片/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases/spec_intl/SGP.23-v1.16_4.2.11_LoadBoundProfilePackage_ErrorCases.md（风格：mapping）；caseir：`/Users/yuhu/cas/experiments/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-20261004_021951/caseir_materialized_gate.json`

spec_intl 为人工核订映射表风格（规范步骤 ↔ 厂商脚本实现 ↔ 实跑结果）：

| 规范步骤 | man 脚本实现 | man 实跑结果 |
|---|---|---|
| General IC 链（选 ISD-R＋鉴权＋#PREP_DOWNLOAD_NO_CC；OP1 not loaded） | 初始化 `Ini_powerOn_eUICC_LPAe_not_activate()`（L90）→ 开通道 `TS_MANAGE_CHANN | 通过（链 APDU1-APDU119 全绿；前置成立＝前序切片绿跑 RecoverCard 已清卡） |
| IC1-IC6 生成 BPP 并发送 INIT/A0/A1（各段 SW=9000） | 步骤9「中间插入ES10b.GetEUICCChallenge」段构造（L120-258：initSC/SCP03t A0/88 元数据/8 | 通过（APDU123-APDU159 各段 Transport Command 期望 9000=实际 9000 逐段在案） |
| 1 #GET_EUICC_CHALLENGE（装载中）→ #R_CHALLENGE，SW=9000（RQ31_188_1） | 步骤10 `Profile_load_procedure.ES10b_GetEUICCChallenge()`（L260-263） | 通过（APDU161 `81E2910003BF2E00` → 61 15 → GET RESPONSE 响应 **`BF2E 12 801 |
| 2 BPP_SEG_A3 → SW=0x6A88 或 0x6985（RQ31_185 RQ57_013 RQ57_016） | 步骤11 `LPAd_Transport_data_to_eUICC(arr1[0],"91","00","6985/6A88","")`（ | 通过（APDU167 `81E2910004A3820883` 实际 SW **6A88**，期望 `6985/6A88` 多重接受集内匹配 |
| 3 ProfileInfoList → profileInfoListOk:{} 空（RQ31_185） | 步骤12-13 选 ISD-R（L268-269）+ `ProfileInfoListRequest`（tagList `5A4F9F70` | 通过（APDU178 响应 `BF2D02A000`（空列表）SW 9000；**Profile Info number 期望 00=实际  |
| 4 #LIST_NOTIF_ALL → #R_LIST_NOTIF_NONE（RQ31_185） | 步骤14 `LPAd_Transport_data_to_eUICC("BF2800")` + `CheckData("BF2802A000 | 通过（APDU187 响应 **`BF2802A000`**（pendingNotificationList 空）SW 9000；期望 `B |
| （收尾，非规范步骤） | `RecoverCard()`（L291） | 通过（Transaction 2 APDU195-APDU300 MemoryReset/通知链/关通道全绿） |

cas CaseIR 步骤/检查：

| 步 | 动作 | checks | REQ |
|---|---|---|---|
| 1 | [Seq#01 Step1] MTD_STORE_DATA_SCRIPT(#UNKNOWN_BPP_SEGMENT) | ["S1-C1", "S1-C2", "S1-C3"] | ["RQ31_186_1", "RQ57_013", "RQ57_016"] |
| 2 | [Seq#01 Step2] MTD_STORE_DATA_SCRIPT(<BPP_SEG_A1>) | ["S2-C1", "S2-C2"] | ["RQ31_186_1"] |
| 3 | [Seq#01 Step3] MTD_STORE_DATA_SCRIPT(<BPP_SEG_A3>) | ["S3-C1", "S3-C2", "S3-C3"] | ["RQ31_186_1"] |
| 4 | [Seq#01 Step4] MTD_STORE_DATA(MTD_GET_PROFILE_INFO(#ICCID_OP_PROF1, NO | ["S4-C1", "S4-C2", "S4-C3", "S4-C4", "S4-C5"] | [] |
| 5 | [Seq#02 Step1] MTD_STORE_DATA(#GET_EUICC_CHALLENGE) | ["S5-C1", "S5-C2", "S5-C3"] | ["RQ31_188_1"] |
| 6 | [Seq#02 Step2] MTD_STORE_DATA_SCRIPT(<BPP_SEG_A3>) | ["S6-C1", "S6-C2"] | ["RQ31_185", "RQ57_013", "RQ57_016"] |
| 7 | [Seq#02 Step3] MTD_STORE_DATA(MTD_GET_PROFILE_INFO(#ICCID_OP_PROF1, NO | ["S7-C1", "S7-C2"] | ["RQ31_185"] |
| 8 | [Seq#02 Step4] MTD_STORE_DATA(#LIST_NOTIF_ALL) | ["S8-C1", "S8-C2"] | ["RQ31_185"] |

### 6.1 充分性分析（启发式，不作最终裁定）

- cas：`NO_MECHANICAL_GAPS`（全步有检查=True；REQ 全覆盖=False；ErrorCount==0=False）
- cas 物化核对（启发式旁证，权威见下行 attestation）：声明检查 22 项 / 生成体 checkData 24 次 / S 标号重合 18 / 计数缺口 0 / 形态 `FULL`；执行面 `FAIL`（计数缺口须结合绑定层隐含断言核验，非直接判缺陷）
- **cas 编译器自证（check_attestation，同批构建）**：声明 None = js 18 + binding 4 + gap 0；缺口判定以本行为权威（启发式计数仅旁证）
  - binding 覆盖示例：`S1-C2`→binding:requirement_satisfied_by_same_step_error_sw_assertion；`S1-C3`→binding:requirement_satisfied_by_same_step_error_sw_assertion；`S3-C3`→binding:bpp_seg_load_pir_runtime_structure(S22-2.5.6;PIR-runtime；`S6-C2`→binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime
- cas 注释面登记检查（未以 checkData 物化、代码内有注释说明）：['S1-C2', 'S1-C3', 'S3-C3', 'S6-C2']
- man：映射行 7；TTR 期望/实际回声 118；厂商工具内置审计（TTR 期望/实际回声行为证据）；脚本字节级充分性不可完全外部验证
- REQ 声明面 vs caseir 引用面差异（35 项，非等价缺口判定）：['RQ32_070', 'RQ35_003_1', 'RQ44_003', 'RQ55_001', 'RQ55_002', 'RQ55_003', 'RQ55_006', 'RQ55_007', 'RQ55_008', 'RQ55_016', 'RQ55_017', 'RQ55_018', 'RQ55_020', 'RQ55_021', 'RQ55_022', 'RQ55_024', 'RQ55_025', 'RQ55_028', 'RQ55_033', 'RQ55_036'] …
- caseir open_items：
  - Seq01-IC4/IC5 与 Seq02-IC4/IC5/IC6 为含 APDU 交互的初始条件（BPP_SEG_INIT/A0(/A1) 预装载，各 SW=0x9000 无响应数据），属卡态编排前置，未编为 tc_step。
  - 每个 Test Sequence 后执行 clean-up procedure (CU) 恢复 Common Initial State（D_tc_structure_notation 2.2.2）。
  - BPP 各段字节、会话密钥、一次性密钥均为运行时动态（null）；#S_INIT_SC_PROF1/#CONF_ISDP_PROF1/#METADATA_OP_PROF1/#UPP_OP_PROF1 字节定义不在输入包。
  - Seq#02 Step2 期望 SW 为 0x6A88 或 0x6985 二选一（E_tc_4211 原文），执行时按实际返回判定。

## 7. 分类结论（封闭枚举）

| 轴 | 计数 | 说明 |
|---|---|---|
| `RUN_DIFF` | 1 | man 通过 / cas 失败 |
| `SCRIPT_DIALECT` | 54 | 闭包文件差：man-only 3 / cas-only 51 |
| `GEN_DIFF` | 108 | 命令序列差：man-only 73 / cas-only 0；REQ 覆盖缺口：['RQ32_070', 'RQ35_003_1', 'RQ44_003', 'RQ55_001', 'RQ55_002', 'RQ55_003', 'RQ55_006', 'RQ55_007', 'RQ55_008', 'RQ55_016', 'RQ55_017', 'RQ55_018', 'RQ55_020', 'RQ55_021', 'RQ55_022', 'RQ55_024', 'RQ55_025', 'RQ55_028', 'RQ55_033', 'RQ55_036', 'RQ55_037', 'RQ55_039', 'RQ55_040', 'RQ55_041', 'RQ57_010', 'RQ57_011', 'RQ57_012', 'RQ57_014', 'RQ57_040', 'RQ57_042', 'RQ57_043', 'RQ57_044', 'RQ57_045', '本卡漂移', '见下））'] |

| 侧 | 根因候选（七类，启发式签名） | 签名 |
|---|---|---|
| man | `card_vs_spec_mismatch` | `6985|6A88|6D00` |
| cas | `card_error` | `Connect Reader 失败|card is NOT connected|SW=0000|SW=00000000` |
| cas | `card_vs_spec_mismatch` | `6985|6A88|6D00` |

> 签名为文本面启发式命中（如 `6D00` 等 SW 亦可能是负例期望值），须结合 Expected 面核验后方可定论。

- 置信度：heuristic；需人工复核：False

## 8. 证据路径

- man 包：`../../packages/man/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-man.zip`
- man TTR：`/Users/yuhu/cas/原料/切片/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases/logs/20260907_180935_ok/extracted/ESIM_TEST_SGP_23/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_02_Error_GetEUICCChallenge_during_BPP_loading.ttr`
- cas 包/源：`../../packages/cas/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-cas.zip`
- cas TTR：`/Users/yuhu/cas/experiments/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-20261004_021951/logs/82a1d56b_gapfix1/result/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases/TC_eUICC_ES10b_LoadBoundProfilePackage_ErrorCases_01_02_merged.ttr`
- spec_intl：`/Users/yuhu/cas/原料/切片/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases/spec_intl/SGP.23-v1.16_4.2.11_LoadBoundProfilePackage_ErrorCases.md`
- caseir：`/Users/yuhu/cas/experiments/4.2.11.2.4-TC_eUICC_ES10b.LoadBoundProfilePackage_ErrorCases-20261004_021951/caseir_materialized_gate.json`
- step_map：`—`