# HPT2 S4 checkpoint-region producer candidate — 2026-08-05

Status: software pass; exact firmware bundle imported valid but unadmitted and not programmed
Type: evidence
Updated: 2026-08-05
Next Action: review and explicitly authorize Controller A programming, then repeat exact flash/CID, full-address scrub, and HPT initialization gates before S4 collection
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md
Canonical Truth: docs/hpt2-measurement-matrix-v1.md

## Result

The deterministic S4 checkpoint-region evidence path is implemented and passes
its software, firmware-build, package, and Pi deployment gates. It does not
change normal HPT2 requests. An exact qualification-only request encodes one
fixed target index and BEFORE/AT/AFTER region in the existing reserved word;
firmware runs ordinary append/readback work through that complete work-unit
boundary and then performs no further work until the exact one-shot Stop.
Unknown tokens fail closed. Final `129600 / AFTER` remains a normal run to
terminal `COMPLETED`, with no hold token.

The Pi requires an exact S4 target and region during admission, verifies that
the immutable bundle declares the capability, writes the exact reserved token,
and rejects any terminal evidence that contradicts the admitted boundary.
Planned metadata cannot create S4 credit; the existing immutable counter
adjudicator remains authoritative.

## Firmware identity and verification

- Source implementation commit: `20e2cb40e2f109c24b121d51d0d7895613c5e686`.
- Tracked artifact commit: `1e566bee8bd246f8eb77511966615a79a97a0e6f`.
- Managed Debug rebuild: pass.
- Managed Release rebuild: pass.
- Static/profile invariants: pass.
- Model tests: `17/17` pass.
- Bundle ID: `smi-00-05-00-660433743898-bcf70c2de65c-release`.
- Canonical imported manifest SHA-256: `d5da9437a9498b3ca82f6ee418dde82332159db463d51a1ef7a120abf29162fe`.
- Source snapshot SHA-256: `6604337438982ef9c6d714366d59195f589c7fde644f9a40a4b7dbfbad11d120`.
- Profile SHA-256: `b0d5247f4c2de03b02ab57c5748920a606d4b37cba61b82aeb065777f10fa0e8`.
- ELF SHA-256: `7cf8b76ffeda2523218dbfafcc1cc511a59249f6f69aa0eaf812be217c70be1b`.
- S-record SHA-256: `bcf70c2de65cd770d8d4ed45597b11f75454e499cd4bce5a2911beaa8208e1fd`.
- Map SHA-256: `8368f64385dad13663dbd1e7098cf83f1113fe4b9826d7afb8f9248a4783c8fc`.
- Diagnostic mapping SHA-256: `16dd780496778847d2a4996926aad91d7e27c858ca800af379c4de43c53cfbdc`.

The Pi importer reports `valid=true`, `admitted=false`, and admission scope
`none`. Import did not bind the bundle to a campaign, authorize programming, or
access a controller.

## Pi identity and deployment

- Source commit: `b586704a69e6e351ce4363e7e21d5cc311021046`.
- Release: `hpt2-s4-boundary-b586704`.
- Image: `sha256:4237e644eec42d742be75942a9ff2f8013812ebc309e0f416f306b70aefbd9c7`.
- Exact-image tests: `224/224` pass.
- Release manifest SHA-256: `6019acf204684279dd974c19c2aafa7f5d30af12d4096381f20f6cff7e9f1f82`.
- Backup: `/backups/sd-qualifier-20260806T003803Z.dump`; restore check passed.

Release packaging, migration, storage preflight, service health, exact
image/source identity, audit, firewall, and residual-tool gates passed. Web,
command worker, and notification worker all run the exact candidate image.

## Preserved live boundary

Campaign `7f13c433-e904-4320-a0d1-33d503057f69` remains bound to firmware bundle
`smi-00-05-00-52edddc39e30-054d5386ad9d-release`. Its current Controller A
ledger remains S0 `3/3`, S1 `20/10`, S2 `27/10`, S3 `13/10`, S5 `10/10`,
provisional S6 `10/10`, and S4 zero. The audit still reports
`S4_CHECKPOINT_REGION_EVIDENCE_PRODUCER_REQUIRED` because no live S4 evidence
exists; that label no longer represents a missing software path.

There are zero active runs. The non-loopback firewall drop remains installed
for ports `19120` and `19121`. Neither controller was accessed, no firmware was
programmed, no card was moved, and Controller B remains disabled.

Programming the candidate would change the campaign's immutable firmware and
profile identities. Before any S4 run, the controlled workflow must therefore
establish a matching campaign/bundle boundary, program Controller A, verify the
complete flash and current CID, pass a fresh full-address scrub, and complete
canonical HPT initialization. Existing S0-S3/S5/S6 evidence remains historical
and must not be silently relabeled as evidence for the new firmware identity.
