# HPT2 endurance baseline v1 firmware ABI evidence

Status: complete for source, host/model/static, managed-build, bundle-metadata, and matching Pi fixture-deployment scope; no target qualification or live admission
Type: evidence
Updated: 2026-08-02
Next Action: design and review a safe live command adapter and representative target regression plan without target access; do not measure or assign stop timing without separate A/B authorization
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md
Canonical Truth: docs/hpt2-endurance-baseline-v1.md

## Scope and safety result

This slice implemented the firmware-side ABI and deterministic host model for
`HPT2_ENDURANCE_BASELINE_V1`. It did not program, connect to, command, reset, or
power either controller. It performed no SD-card or USB operation and no J-Link
operation. Controller B and its frozen Release baseline remain unchanged. T00
remains unresolved USB architecture evidence and was not reopened.

The implementation exposes no controller HMI Start/Stop action and no Pi live
command adapter. The bundle metadata explicitly records
`command_adapter=not-implemented` and `live_admitted=false`. The stop deadline
remains `null`; no timing value was guessed.

## Immutable identities

- Source commit: `4b79b70842bfae5daae79eb8d6b9da1c661924e9`.
- Canonical profile:
  `qualification/profiles/hpt2-endurance-baseline-v1.json`.
- Profile SHA-256:
  `945ebbc67c1673ecef3d8d185de415a4613bd6050d13e1b0f1d12d260e434e00`.
- Local Release bundle ID:
  `smi-00-05-00-4b79b70842bf-release`.
- Bundle diagnostic-mapping SHA-256:
  `88e7bba263b00484e4a8b9fead85fbf2b35b9f9608f7e0931f04a09413d4aa16`.
- Debug ELF SHA-256:
  `20fc53dfaafb61a5e2670912bb5ea7ee5bf762049518f3d02016d5f5f081a645`.
- Debug S-record SHA-256:
  `c0fb56a6faa8b656303f1bb1446931fe5a371887f67766d48b28e232c79afaa0`.
- Release ELF SHA-256:
  `514f47b1a7317ea4aef8c02b38f4ebba3ca16c5005ef438191f607c98bb6e3f7`.
- Release S-record SHA-256:
  `d01d567454b0ed2c03ed59d7a9868e6f841542d1713cc6e7614a3fcffbf35b62`.

The bundle is a locally validated handoff artifact, not an admitted or
programmed candidate. All six listed bundle members passed exact size and
SHA-256 readback. Its embedded profile hash equals the firmware-compiled
profile hash and diagnostic mapping.

## Implemented contract

- Fixed 216-byte request ABI and 208-byte status ABI with compile-time size and
  selected offset assertions.
- Fixed-width status state/reason fields, independent of the project's
  short-enum compiler setting.
- Typed 24-byte ABI descriptor retaining Start, Stop, and coherent GetStatus
  functions in both linked ELF artifacts without creating a command route.
- Exact profile SHA, request/run identity, boot witness, complete raw CID,
  bundle/artifact/mapping hashes, authorization expiry, and positive
  heartbeat/stop deadline fields.
- Duplicate request/run rejection for the current boot session and no automatic
  start or stop retry.
- One 64-byte production HPT2 append plus immediate exact-sequence quorum
  readback per work unit, scheduled only after normal production log queue work.
- Exact 129,600-record target and milestone counts; milestones perform no extra
  media operation.
- Separate append/read lane masks, retirement/mismatch/loss/replacement checks,
  first-failure latching, coherent even-sequence status, and stop
  acknowledgement only between complete work units.
- No format, initialization, raw-device selection, diagnostic fault, reset,
  delay, power, USB, VBUS, physical-card, or specimen-specific operation.

## Validation

- `script/check-hpt2-endurance-baseline.ps1`: passed all profile/hash/ABI,
  command-surface, production-priority, and excluded-operation invariants.
- `script/test-hpt2-endurance-baseline-model.py`: `9/9` tests passed, covering
  exact completion, stop before work, stop latched during append/readback,
  duplicate start/stop, first-failure preservation, no retry, every acceptance
  degradation, and reboot reconciliation to `INTERRUPTED_UNKNOWN`.
- `script/check-hpt-commissioning.ps1`: `95/95` HPT invariants passed.
- SD qualification lifecycle policy: `16/16` checks passed.
- Canonical managed Debug rebuild: passed; ABI descriptor is 24 bytes, status
  symbol is 208 bytes, and all three API functions are present in the ELF.
- Canonical managed Release rebuild: passed with the same ABI addresses and
  sizes as Debug.
- Bundle packaging and six-member hash/size readback passed. Mapping exposes
  the coherent status layout but retains the existing read-only observation set
  and explicitly excludes arbitrary J-Link writes/function calls, reset, and
  power operations.

## Matching Pi fixture deployment

- Pi contract implementation: `PC-Redemption/sd-qualification` PR #24, merge
  `5a147535eab74d0e4de4051507b44b91fec0cf35`.
- Stale readiness wording correction: PR #25, exact deployed merge
  `1b7fa39915a05310399cae1cf14b92e23f5790e3`.
- Deployed release identity: `hpt2-firmware-contract-1b7fa39`; image
  `sha256:924ff94619db643db59efb50b5877a0c69310df7488a40fbc0b7986b237907d5`.
- Pi validation: `95/95` Django tests and `15/15` interface/network/release
  tests passed. Seven schemas, 25 classification fixtures, and 23 executable
  negative fixtures passed while external approval remained fail-closed.
- Predeployment backup
  `/backups/sd-qualifier-20260802T234404Z.dump` restored successfully; SHA-256
  `cb9446d4869bfc333e51fed99f5d07896b6977723aa5a41b1d5ddee839fe241d`.
- Database migrations were already current and the evidence-storage preflight
  passed. Web, command-worker, notification-worker, database, storage, clock,
  and worker health are green.
- The live appliance advertises profile SHA-256
  `945ebbc67c1673ecef3d8d185de415a4613bd6050d13e1b0f1d12d260e434e00`
  with `fixture_contract_valid=true`, `live_ready=false`,
  `live_admitted=false`, and all state-changing, bounded-stop, and recovery
  capabilities false.
- Rollback images for `285a004` and `5a14753` and mode-0600 protected
  configuration copies are retained outside the source tree. Pi `main` is
  clean. No controller, card, J-Link, power, or USB operation occurred.

## Remaining gates

This evidence does not establish target correctness, bounded-stop time, reboot
recovery, controller equivalence, card-family endurance, or release readiness.
Live use remains blocked by all of the following:

1. reviewed safe live command adapter implementation and admission;
2. target qualification of the exact ABI on representative Controllers A and B;
3. separately authorized stop-boundary measurement and firmware-owner margin;
4. interrupted-session reconciliation evidence;
5. representative multi-card regression plan and expendable-card inventory;
6. exact run authorization and all physical/safety gates.
