# Controller A F1-A1 HPT initialization adjudicated pass

Status: PASS by evidence-backed false-negative adjudication; original adapter terminal result remains preserved as FAILED
Type: evidence
Updated: 2026-08-05
Next Action: review the built terminal lane-mask correction, then separately qualify the bounded HPT2 stop/recovery gate before any HPT2 start
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Scope and identity

The owner's `continue` authorized the recorded Controller A/F1-A1 HPT
initialization gate, including the exact whole-card erase. It did not authorize
replaying an initialization mailbox or beginning HPT2.

- Campaign: `8f3fe483-c783-4170-a720-3c2df3a48fd6`; assignment `13`.
- Controller A: assembly `1751136`, variant `0`, J-Link `69664082`.
- Bundle: `smi-00-05-00-b845d4b9bcfe-4f37e97877d8-release`.
- Bundle manifest:
  `a858c703f1ba4ebd10e2d5c6c804c501bfb22a7480f011d907226bc13da00c94`.
- Complete installed flash:
  `aed8fc3f289094c4e7d4c3313268687a31d822d117833527fd6c8e0a7b4dd242`.
- Initialization operation: `d909a40c-7cf4-46d7-b93f-c6b3873b32c5`.
- Request: `a2e212ff-719f-4f0f-878b-1c7fc5bf032a`.
- Authorization envelope: `755946de-bed7-49a1-9ef4-fff60b526923`.
- Mailbox SHA-256:
  `5f8226402d073580ee736c1b7035aabc57410e9fb55b0bf5cfb5ba2db8379481`.

The campaign was promoted from fixture-only through guarded Pi commit
`def4057fc8c17f0d6f11f7839c72c5b50980122c`. Immediate pre-operation
observation `36d127dc-0229-422f-beff-1c97f96e62ff` passed exact flash,
controller/probe, CID, and representative-sector-read checks. CID capture `9`
and Pi Evidence `34` bind that state to the operation.

## No-replay schema incident and recovery

The target consumed the mailbox once. The Pi then failed while recording the
publication transcript because `Evidence.kind` was limited to 40 characters
and `hpt-initialization-publication-transcript` is 41. The durable operation
correctly remained `RECONCILIATION_REQUIRED`; initialization was not replayed.

Pi commit `f4f17af049185f0066d05356bb91a22baa8aaf26` widens the field to 80,
adds migration `0017`, and adds a regression assertion for every generated
initialization evidence kind. Twelve focused tests pass. The full suite passes
166/168; only the two established ordinary-container `/run/hpt-exec` fixture
tests fail. Backup `/backups/sd-qualifier-20260805T143431Z.dump` passed its
restore check. Deployed image
`sha256:31bb394ca6fa47990776d7e272ccdfca4c732480b7a9152bfe7ba3dcaf39807b`
is healthy.

Read-only reconciliation then completed without replay. The original immutable
result is intentionally preserved as `FAILED/HPT_INITIALIZATION_FAILED`, Pi
Evidence `37`/`38`. Its terminal status nevertheless showed completed phase
`11`, state `3`, reason/status/driver zero, one acknowledged and one iterated
commissioning record, no retirements, mismatches, loss, or replacement, and
terminal proof `0xF`. Its only failing field was `LastLaneMask=0`.

## Independent physical-state result and adjudication

Post-operation observation `d1c51d83-043a-40ce-b78a-14652f670cab` was strictly
read-only and passed:

- exact flash and running controller/probe identity;
- `SD_CARD_STATE_RAW_HPT` and `HPT_MEDIA_STATE_HPT_READY`;
- CID-valid and representative-sector-read valid;
- HPT and driver status zero;
- `LastLaneMask=7`, retired segments `0/0/0`, mismatch/lost `0/0`, and no
  replacement flag.

Pi CID capture `10`, Evidence `39` SHA-256
`717dbed663196fdf10f3106e73ac11efa8f79c377e56f30dbde12c871b70048b`,
and event `55` preserve the contradiction. Evidence-backed review combined the
original completed commissioning proof with the later clean three-lane state.
Adjudication Evidence `40` SHA-256
`12bab40090f39999469da41b7a6d88ff521aa8b2cb0ea77fe0069f0992eafa7b`
and event `56` classify the physical result `HPT_INITIALIZED` while preserving
the original adapter failure and prohibiting replay. Assignment `13` is now
`HPT_INITIALIZED`.

## Required post-initialization CID identity block

- Protocol/card status: `DETECTION_READY; RAW_HPT; DRIVER_OK`.
- CID-valid status: true.
- Representative-sector-read status: true.
- Manufacturer: unknown CID manufacturer; retail brand KEXIN; MID `0x05`.
- OEM/application ID: raw OID `0x000C` (decoded display `??`).
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7305` (`0x00001C89`).
- Manufacturing date: `2026-03`.
- Complete raw 128-bit CID: `05000C61736466672200001C8901A34F`.

CID is identity evidence, not proof of authenticity.

## Firmware correction and safety state

Source now captures the commissioning append lane mask before either reopen,
fails closed unless it is `0x7`, and republishes that preserved mask in the
terminal snapshot. Commissioning invariants pass `97/97`; initialization
mailbox checks and all 13 HPT2 model tests pass. The canonical managed Debug
rebuild passes. Debug ELF SHA-256 is
`2d4fed09737729d34e741ca759fdf14042f4bdfc671a4bafc4651791c57c8062`;
S-record SHA-256 is
`18b35b5dfd1e55aeba32402d42bc6d0ba77af7ac8ee2b8075a2e118d4942a5aa`.
This correction was built only; it was not programmed onto Controller A.

The protected registry is restored disabled at SHA-256
`4e58d3cde61c9430c8673008300c5bd21056de5550ba9aaa48bd298ad38541b0`.
Only the default non-loopback drop for ports `19120/19121` remains, no tool
container is running, and Pi database/storage/clock/workers are healthy. HPT2
was not started.
