# HPT2 fixed mailbox and Pi runner core evidence

Status: complete firmware/mailbox and durable Pi orchestration software-only checkpoint; live execution remains blocked
Type: evidence
Updated: 2026-08-02
Next Action: retain as predecessor to the completed fixed-mailbox A/B promotion evidence; review the separately gated A/B HPT2 stop/recovery measurement plan before enabling commands
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Scope and safety result

This checkpoint implemented and tested the fixed HPT2 command boundary without
contacting, programming, resetting, powering, or commanding either controller.
No SD or USB media operation occurred. Controller B and the frozen Release
baseline were preserved. T00 was not reopened and no USB command, retry, delay,
reset, VBUS, SSP, HCD, or specimen-specific behavior changed.

The implementation is not a live-admission result. The Pi production deployment
remains the fixture-only `hpt2-firmware-contract-1b7fa39` release at source
`1b7fa39915a05310399cae1cf14b92e23f5790e3`, and every state-changing capability
remains disabled.

## Firmware checkpoint

- Central source commit: `bc0b6ce4d0666cacd65e19efd2c3b56add39a50f`.
- Added a fixed 256-byte host-to-firmware mailbox and 80-byte coherent
  acknowledgement polled only by the SD-owner thread.
- Preserved the 208-byte coherent HPT2 status and existing typed Start/Stop API.
- Enforced odd/even coherent publication, exact versions/sizes, CRC-32,
  zero-padding, monotonic publication and command sequences, duplicate
  rejection, and acknowledgement publication.
- Debug and Release managed rebuilds passed. Exact mapped addresses were:
  status `0x2004D960`, acknowledgement `0x2004DA30`, and mailbox
  `0x2004DA80`.
- HPT commissioning remained `95/95`; lifecycle policy remained `16/16`; 13
  mailbox/profile model tests passed.
- Release ELF SHA-256:
  `bc05ac68bcba4645428c20446adcfe18c370a0f6bf68cc701ce616f1ff757a91`.
- Release S-record SHA-256:
  `3cfd2c7c571f32a11a14b28b7c72c0cec36b9861ac87068da47ad4cced1ab391`.
- Local immutable-package mapping SHA-256:
  `0b8b68c32955177a731f55e3dce6637100a3bcaf016ef9da729721295ef24770`.
  The later software-only Pi import review reproduced that exact identity and
  imported it valid but unadmitted and unbound; see
  `work/evidence/hpt2-fixed-mailbox-bundle-pi-import-review-20260802.md`. It is
  not programmed or live-admitted.

## Pi source checkpoint

- Repository: `PC-Redemption/sd-qualification`.
- Merged PR: `#26`, merge commit
  `a8ce25ac5800245d2e52c0dc1834d1dd05854c32`.
- The source core validates the exact bundle mapping, serializes exact Start and
  Stop payloads, writes only the fixed mailbox words, proves the CPU remains
  running, and rejects reset, halt, go, load, erase, PC/register, power, and
  arbitrary-address commands.
- Four 250 ms reconnect opportunities exist only for the exact SEGGER refusal
  before probe or target interaction. There is no retry after target
  interaction and no replay after a mailbox write may have occurred.
- A mailbox write followed by failure is classified indeterminate and requires
  read-only reconciliation. A connection failure before the first mailbox
  write is blocked but is not falsely labeled as a consumed command.
- Bounded transcripts and terminal result JSON are written to confined evidence
  storage. This is terminal-evidence core only; it does not yet satisfy the
  required durable pre-target intent and append-only phase ledger.
- There is no management command, API, UI action, compose service, role/endpoint
  enablement, deployment, or live-admission path for the runner.

## Pi validation

- Exact Raspberry Pi test image:
  `sha256:d34bbd80eba72a1b5d4d7f0b4407f30f2c877a8214bdb035dc1717f9c0324cda`.
- Focused fixed-mailbox tests: `18/18` passed locally and in that image.
- Django/application regression: `113/113` passed in that image.
- Contract, packaging, and network-policy regression: `15/15` passed in that
  image with the branch fixtures mounted read-only.
- Contract validator retained the expected fail-closed result: `7` schemas,
  `25` classification fixtures, `23` executable-negative fixtures,
  `valid=false`, `admitted=false`, and
  `EXTERNAL_APPROVAL_REQUIRED`.

## Durable Pi orchestration checkpoint

- Pi PR `#27` merged as
  `1634c61b28a06914db96e55eb2fea68c551e8108`.
- Immutable authorization and target-identity snapshots, exact 256-byte mailbox
  bytes/hash, and append-only phases are committed before target access.
- One Start/Stop pair per run uses increasing command/publication sequences;
  Stop binds the acknowledged Start request, and an open acknowledged session
  blocks another run on that controller.
- The tools-profile service accepts only an existing operation UUID and has
  empty role/endpoint defaults. The browser has no publish/reconcile action.
- Publication interruption becomes `RECONCILIATION_REQUIRED`; a second write
  is prohibited. Reconciliation reads two identical passes of the fixed
  mailbox, acknowledgement, and status, then binds request/run, boot witness,
  CID, command, and sequence before terminal disposition.
- Final exact Raspberry Pi image:
  `sha256:6a2074f9082d10e5bd11a35c58b92e1aeb7ef0e5324ca0e0abafe78a2a5e97b2`.
- Final validation: `28/28` focused HPT2 tests, `123/123` application tests,
  and `16/16` contract/packaging/network-policy tests passed. Contract
  admission remained intentionally blocked on external approval.
- Migration `0013` was model-drift and test-migration checked but was not
  applied to the deployed PostgreSQL database. No release was built or
  deployed, and the running fixture remains at source `1b7fa399...`.

## Remaining gates

The next software-only slice is the authenticated operator/reviewer frontend
for exact authorization, immutable operation preparation, and phase/evidence
display. The browser must provide only reviewed intent; it must not publish or
reconcile a command, select an endpoint/executable/address, or supply a raw
payload or target identity.

Deployment, live admission, Controller A/B target qualification, Controller B
access, stop-deadline measurement, reboot/interruption recovery, physical-media
work, and representative SD/USB regression remain separate later gates.
