# HPT media 2.0 software completion gate — 2026-07-24

Status: passed for host/source/build scope; no controller or SD-card
qualification claimed

## Implemented scope

- Export-domain reasons distinguish out-of-retention, retained gaps, HPT I/O,
  USB I/O, invalid requests, and bounded-capacity failures. Public status
  includes retained timestamp/sequence bounds and actionable HMI text.
- A bounded raw-device full-address scrub reads four sectors per SD-owner
  service slice, preserves all failed attempts, supports cancellation, pins
  CID identity, and never writes, formats, discards, repairs, or remaps media.
- Portable triple-circular hooks cover durable record data, prepared/final
  commit, reclaim invalidation, segment header/seal, and retirement
  bitmap/header durability boundaries. Production behavior is unchanged while
  the hook is null.
- Target RAM commands expose every named boundary. Preparation is bounded to
  32 records, and commit-final recovery explicitly distinguishes a durable but
  unacknowledged record from a false commit.
- Firmware 00.05.xx no longer enables the internal-SD FAT32/FileX logger.
  Services 469/470/471/472/474 report retirement; service 468 remains the
  explicit whole-card HPT initialization path. USB FileX remains active.
- HPT initialization eligibility is based on valid CID and readable sectors,
  not the prior filesystem. CID and a representative sector are rechecked
  after raw ownership and before the first destructive write.

## Verification

- HPT commissioning source invariants: `86/86`
- Customer-export invariants: `20/20`
- Full-address scrub invariants: `8/8`
- SD CID invariants: `25/25`
- Version-5 HPT-only SD invariants: `8/8`
- Triple-circular exhaustive write-cut model: `141` cut states
- Customer-export, full-address scrub, triple-circular, and legacy retirement
  models/checks: pass
- Managed-make Debug build and versioned packaging: pass
- Managed-make Release build and versioned packaging: pass

The installed e2 headless launcher remains unsuitable on this workstation: it
opens a Java exit-code dialog. Builds were therefore completed with the
repository's non-GUI managed-make path. The generated source inventory includes
the HPT core and vendored log-store sources.

## Candidate artifacts

- Branch:
  `codex/firmware-00-05-00-hpt-filesystem`
- Committed source/tests/docs:
  `23c205f646826efae1a1baf5b290dccce2073c5c`
- Frozen tracked-artifact commit:
  `3b9e21dd27d115a846e1b17c2d83f8028f3d760d`
- Debug ELF SHA-256:
  `C8C95A8D492381066D24D90D1FB3E0A2F89B408D53A7F1D3FB4964B231FAD4EB`
- Debug SREC SHA-256:
  `A5E0CB52DC524574EAEFA041E62A06A1D9289E2AEC82CE2E2FEB3759325FD234`
- Release ELF SHA-256:
  `7471A849103F421006480F8BB28F626DDF1F98ABB9B1A3D8182AC6B42C85DB31`
- Release SREC SHA-256:
  `26B0D1E0DDA3C389DCC4B2CEBFEAE009D6F36884B4577743D8C1284D46520FAA`
- Debug/Release image size:
  text `2,866,228`, data `0`, bss `28,463,060` bytes
- Release internal-RAM headroom:
  `134,808` bytes (`264` bytes less than the preceding
  data-durable-boundary candidate)

Debug and Release were clean-rebuilt through the non-GUI managed-make path
after the source commit. Stable and versioned ELF/SREC pairs are byte-identical.
The hashes above are frozen for the HPT development-review candidate; this is
not the final integrated release freeze because calibration and remaining
code-review qualification are still open.

## Physical gate

No controller, J-Link, SD card, USB stick, or external power state was changed.
CID is unavailable/not applicable because this was a software-only gate, not a
controller/card evidence collection.

The next destructive interruption remains blocked by `G-PWR`. The permanently
connected topology must first pass three consecutive non-writing volatile
witness cycles and the required data-durable correlation repeat through the
canonical hostname-based lab-power interface.
