# Pi full-address scrub HMI policy correction and reset gate — 2026-08-04

Status: historical interrupted-unknown checkpoint; resolved read-only to PASS on 2026-08-05
Type: evidence
Updated: 2026-08-05
Next Action: use `work/evidence/controller-a-baseline-scrub-readonly-reconciliation-20260805.md`; never replay the published command
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-hpt-bounded-full-address-read-scrub.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Authorized correction

The owner authorized the reviewed Pi-only policy correction and exactly one
fresh Controller A/F1-A1 read-only scrub under authorization reference
`owner-a-hmi-policy-correction-and-fresh-scrub-20260804`.

The Pi adapter now requires positive periodic controller-thread progress but
retains the event-driven HMI run delta as informational evidence. It still
requires target state `PASSED`, successful HPT status, 512-byte sectors,
complete geometry accounting, zero failed or retry-recovered sectors, and zero
identity mismatch.

- Pi source commit: `d7eb2da305351155b9169e93c4d0256ed0f737da`.
- Release identity: `full-address-scrub-hmi-policy-d7eb2da`.
- Deployed image:
  `sha256:09225b099791081ac06e822a7b03520795e21281ca03c9e489242f2610b8fae6`.
- Focused tests: `14/14` passed.
- Complete application tests: `144/144` passed.
- Exact-image focused tests: `14/14` passed.
- Pre-deploy backup: `sd-qualifier-20260804T214327Z.dump`; disposable restore
  passed with four campaigns.
- Rollback image tag: `srv-rpi00-sd-qualifier:rollback-df7ddc9-20260804`.
- Web, command worker, and notification worker all run the exact new image;
  health, database, evidence storage, clock, and worker gates pass.
- A deployed read-only check classifies the preserved prior terminal structure
  as `FULL_ADDRESS_SCRUB_PASS` while leaving the historical immutable operation
  unchanged as `FAILED/FULL_ADDRESS_SCRUB_FAILED`.

## Fresh campaign and identity

- Campaign: `c0b1b669-4828-476f-8879-c1077f139a26`, state `INTAKE`, version
  `2`, based on blocked campaign `738c4a65-acf3-4492-8d17-244ade322670`.
- Controller A assignment: `11`, `F1-A1`; Controller B assignment: `12`,
  `F1-B1`. Controller B was not accessed.
- Read-only observation:
  `2013ace7-e953-44af-bfe3-31deb34fe384`, classification `PASS`.
- Observation result SHA-256:
  `992a0363a24c80619a5c6b8fad70fd96889f5d7d6b049f155c972c29086b5966`.
- Observation transcript SHA-256:
  `b527142b9c80408f3313b0d71eaa13c095c2ffe739817f14c2abc03d22205adc`.
- Controller identity: assembly `1751136`, variant `0`, J-Link `69664082`,
  CPU running, VTref `3.282 V`.
- Complete flash:
  `b1abe4776388b0978a2a1f93473e25a0091af8da535aa54582bb270b2dfcabb3`.
- Fresh campaign CID capture `4`: protocol/CID/representative-sector status
  passed; raw CID `05000C61736466672200001C8901A34F`.
- Campaign Evidence row `20` links the immutable observation result and
  transcript.

The first observation invocation was rejected by the registry before endpoint
access because an atomic temporary rewrite did not preserve the registry file
owner. The exact original registry hash was restored. The temporary mutation
was corrected to preserve mode and ownership; the subsequent single target
observation above passed. This was a pre-target configuration failure, not a
hardware attempt or scrub command.

## New preflight blocker

The fresh scrub read-only preflight reached the exact controller and rejected
the interface because it was not idle and clear. Operation
`3b04cc35-ce17-4201-88f9-7a885a9300ab` completed successfully in firmware and
left its terminal `PASSED` status latched in volatile SRAM with command zero.
The firmware has no separate status-clear command; the status returns to idle
only at boot/reset. The adapter correctly refuses to publish another run word
over a prior terminal structure.

No new scrub operation UUID was minted, no SRAM write occurred, and the
authorized scrub itself was not attempted or consumed. Campaign
`c0b1b669-4828-476f-8879-c1077f139a26` remains `INTAKE`; assignment `11` is at
`SCRUB_PREFLIGHT_BLOCKED_LATCHED_TERMINAL`.

The protected registry returned exactly to
`37710ee75360f148b805d8f9d025cbf74a71a0b002240ca46b30dd79dff87647`,
both roles are disabled, temporary A-only firewall rules were removed, and no
observer or scrub tool container remains.

## Required authorization

Authorize one Controller A J-Link reset/run solely to clear the volatile scrub
command/status area. It must not program or erase code flash, VEEPROM, option
memory, or SD media. After reset, independently recapture exact complete flash,
running state, and CID, then repeat the read-only preflight. Only if those gates
pass may the Pi mint and publish the already-authorized single fresh scrub
operation. Any ambiguous reset or scrub attempt consumes its exact authority.

## Authorized reset envelope result

The owner authorized one Controller A J-Link reset/run with no programming,
erase, power cycle, or SD write. Reset operation
`a7f5b71c-a650-4e39-a7a5-eb30b7cfea2d` executed exactly once against probe
`69664082` at `3.282 V`. Its transcript contains one normal
`AIRCR.SYSRESETREQ`, proves the CPU running before and after, and contains no
programming or erase command. Transcript SHA-256:
`f9d2707603665765670e286600465ce116b14adbceb355fc9401c8fdf6b890e6`.

Independent read-only observation
`67f03b29-1849-4f27-9b9a-27d9a7779c30` passed with exact complete-flash hash
`b1abe4776388b0978a2a1f93473e25a0091af8da535aa54582bb270b2dfcabb3`,
CPU running before and after, and unchanged raw CID
`05000C61736466672200001C8901A34F`. Campaign Evidence `21` and fresh CID
capture `5` bind that result.

The actual read-only scrub preflight, gate
`9c723090-a859-4c4e-aa49-7a57b1080922`, passed with command `0`, status state
`0`, the exact flash hash, probe `69664082`, assignment `11`, and CID capture
`5`. Earlier CLI/allowlist rejects occurred before J-Link construction and did
not access the controller.

## Scrub execution stop

The one-shot execution wrapper minted proposed UUID
`b79d6044-0981-41d1-9dc9-f9af796aed19`, but failed before
`prepare_operation()` because that UUID was not propagated into the adapter
container. The production database contains no operation with that UUID and no
scrub operation for this fresh campaign. No J-Link scrub session began, no run
word was published, and no SRAM or SD write occurred.

Per the owner's no-retry condition, the exact scrub authority is treated as
consumed despite the pre-target failure. Assignment `11` is now
`SCRUB_EXECUTION_AUTHORITY_CONSUMED_PRE_TARGET`; a newly authorized attempt
must use a new UUID and must not repeat this reset or preflight unless separately
authorized.

Pi immutable Evidence `22` and `23` preserve the reset transcript and compact
envelope result. Result SHA-256:
`1e66481be4d4877f098b5de4092d191fc434bf95e997569fed3a7ba2c89eabb4`.
The protected registry returned to
`37710ee75360f148b805d8f9d025cbf74a71a0b002240ca46b30dd79dff87647`,
the temporary firewall rule was removed, and no one-shot adapter container
remains.

## Authorization interpretation correction and real operation

The proposed UUID `b79d6044-0981-41d1-9dc9-f9af796aed19` never entered
`prepare_operation()`, never became a durable operation, and never reached
J-Link. The owner confirmed that this pre-container wrapper rejection did not
consume the standing authorization. Pi event `49` records the correction.

The adapter then created the sole real baseline operation
`6279f027-759c-46be-b3ce-ad70766c5707` with the admitted campaign, bundle,
Controller A identity, and CID capture `5`. It completed its own read-only
preflight, published run word `0x48534352` exactly once at `0x20055F80`, and
read that word back. The CPU was running before and after publication.

The immediately following poll could not connect to the J-Link TCP endpoint
before target attachment. With reconnect attempts fixed at one to honor the
no-retry condition, the adapter failed closed as
`INTERRUPTED_UNKNOWN/FULL_ADDRESS_SCRUB_INTERRUPTED_UNKNOWN`. It performed no
automatic retry or replay. Firmware may have continued processing the scrub,
but its terminal status is not yet known.

- Pi Evidence `24`: immutable J-Link transcript,
  SHA-256 `ea01ffe872f80f342861b9b2470ff4cc594605b54a38e39a3594443b959c7ba1`.
- Pi Evidence `25`: immutable indeterminate result,
  SHA-256 `8885f5bd20b5e7bc6f50a131d9467616cbcf4825df5fe1463b9f8b8f978ee5c3`.
- Campaign assignment `11`:
  `SCRUB_INTERRUPTED_UNKNOWN_RECONCILIATION_AUTH_REQUIRED`.

Do not publish another run word and do not reset the controller. The next safe
operation is one separately authorized read-only reconciliation of the existing
operation. That reconciliation reads the command, stable status, and CID twice;
it does not write SRAM or SD media and cannot replay the scrub.
