# Ticket: HPT bounded full-address read scrub

Status: complete; prior reconciliation and the superseding exact-candidate Controller A baseline scrub both pass, with replay prohibited
Type: ticket
Updated: 2026-08-05
Next Action: none; rerun a fresh baseline only after installing a different exact firmware image or changing the physical card identity
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Problem

On 2026-08-03 the first required pre-initialization sample baseline exposed a
method gap not covered by the earlier initialized HPT A/B control passes.
`hptFullAddressScrubPreconditions()` requires `RAW_HPT`, `HPT_READY`, and an
open HPT store. New `F1-A1` correctly remained `NEEDS_INITIALIZATION`, so
operation `e36882de-ebf5-4b35-93ef-698e352a553c` failed with zero geometry,
zero read attempts, and `identity_mismatch=1`. Read-only reconciliation
confirmed stable terminal failure and command zero; no replay occurred. See
the Pi manifest
`work/evidence/kexin-f1-a1-full-address-scrub-baseline-failure-20260803.md`.

Normal logging, wrap, readback, and export exercise only the current HPT working
set. They cannot show that every addressable sector on a retail card responds to
a read. The July 22 Controller A failure included unreadable regions outside
the normal working set, so media qualification needs a bounded, resumable,
read-only full-address check.

The 2026-08-05 initialization-capable candidate is a different exact firmware
image. The completed scrub remains valid evidence for the installed prior
candidate but must not be carried across that firmware change. If the new
bundle is reviewed, admitted, and separately authorized for programming, run a
fresh exact-candidate observation and a new baseline scrub before HPT
initialization.

## 2026-08-04 software correction

The scrub now supports an explicitly owned pre-initialization raw-media session
without weakening the existing initialized-store path. It validates the prior
CID/readable classification, opens the existing SD-owner raw adapter, recaptures
and pins CID before geometry/read, closes only a scrub-owned session, and
recaptures CID before close at termination. Active scrub execution prevents
background card reclassification. The scrub still exposes no write, format,
discard, repair, or initialization path.

Focused gates pass (`12/12` scrub, deterministic model, `95/95` commissioning,
and `16/16` lifecycle policy), as do canonical managed Debug and Release
rebuilds. The public command/status addresses and sizes remain
`0x20055F80/0x04` and `0x20055F90/0x68`. Evidence:
`work/evidence/hpt-preinitialization-full-address-scrub-software-gate-20260804.md`.
At that software gate no immutable bundle had been created and no hardware was
accessed; the reviewed bundle freeze below supersedes only the packaging state.

## 2026-08-04 independent review and bundle freeze

Fresh-context source and package review passed. The non-colliding, read-only
candidate `smi-00-05-00-868598ee08d9-404826a5be8e-release` is frozen under
`tmp/candidate-bundles/`; its manifest SHA-256 is
`b4422747feaad383df398becda58b94e20fbc5aa0ca5ccde2bf4a7ef415da3e2`.
The mapping now exports the unchanged scrub command/status ABI needed by the
Pi campaign. No hardware was accessed. Evidence:
`work/evidence/hpt-preinitialization-full-address-scrub-reviewed-bundle-20260804.md`.

## 2026-08-04 Pi import and corrected campaign

The reviewed bundle was imported at content address `0fdff39a...9182761` and
bound to new change-impact campaign
`d2263f26-6ac7-4a90-ad80-8875c0c24d2a`. The prior campaign is `BLOCKED` and
the failed operation remains non-replayable. Canonical Controller A was
reconnected and read-only verified on its prior exact flash with CID
`05000C61736466672200001C8901A34F`; no programming or scrub occurred. See
`work/evidence/hpt-preinitialization-scrub-bundle-pi-import-campaign-binding-20260804.md`.

The new campaign intentionally has zero operation-admitted CID captures. The
next state-changing gate is explicit code-flash authorization, followed by an
exact post-program flash observation and fresh boot-relevant CID capture.

## 2026-08-04 cadence mitigation and replacement bundle

The one-hour scrub timeout was dominated by an inherited one-second
degraded-media retry sleep after each bounded 512 KiB scrub slice. The sleep
now remains in the ordinary scrub-inactive retry path and is bypassed while a
scrub is running; the active path retains its one-tick scheduler yield.

Focused gates now pass at `13/13`, model pass, `95/95`, and `16/16`, and both
canonical managed builds pass. Replacement immutable candidate
`smi-00-05-00-3861b4a2c040-e75e6df95e01-release` passed independent package,
source-binding, scrub-ABI, read-only, and full S-record checksum review. It was
not imported or programmed. The prior operation and campaign remain blocked
and non-replayable. Evidence:
`work/evidence/hpt-full-address-scrub-cadence-mitigation-reviewed-bundle-20260804.md`.

## 2026-08-04 target result and method block

The exact replacement bundle was imported, bound, programmed, completely
verified, and independently observed on Controller A with VEEPROM, option
memory, and `F1-A1` CID preserved. A single fresh scrub operation then read all
`15,728,640` sectors with zero failed or retry-recovered sectors, no identity
mismatch, and positive controller-thread progress.

The target reported state `PASSED`, but the Pi adapter returned failure solely
because `HmiRunDelta` was zero. That thread is event-driven and may legitimately
remain suspended; the established firmware diagnostics use the periodic
controller thread as the required liveness witness. The campaign is blocked as
a method failure, the immutable result is unchanged, and no initialization or
retry occurred. Evidence:
`work/evidence/controller-a-cadence-promotion-and-scrub-liveness-policy-block-20260804.md`.

## 2026-08-04 Pi correction deployment and reset gate

Pi commit `d7eb2da...` removes the event-driven HMI delta from pass/fail while
retaining the periodic controller-thread liveness gate. Focused, full, and
exact-image tests pass, and the exact deployed services are healthy. Fresh
campaign `c0b1b669-4828-476f-8879-c1077f139a26` has a passing Controller A
flash/CID observation.

The new scrub preflight stopped before operation creation or command
publication because the prior firmware-level pass remains latched in volatile
SRAM. The adapter requires idle/clear state. A separately authorized reset/run
is now required; no initialization or retry occurred. Evidence:
`work/evidence/pi-full-address-scrub-hmi-policy-correction-and-reset-gate-20260804.md`.

## 2026-08-05 read-only reconciliation closeout

Existing operation `6279f027-759c-46be-b3ce-ad70766c5707` reconciled without
another command publication. Firmware reported command zero and stable
`PASSED` status after reading all `15,728,640` sectors with zero failed or
retry-recovered sectors, zero identity mismatch, HPT status zero, and positive
controller-thread progress. The Pi durable state is now `COMPLETED` with
terminal code `FULL_ADDRESS_SCRUB_PASS`; automatic retry and replay remain
disabled.

A fresh complete-flash/CID observation passed and is linked as Pi Evidence
`28` and CID capture `6`. The card remains `NEEDS_INITIALIZATION`, identity and
representative-sector-read valid, with unchanged raw CID
`05000C61736466672200001C8901A34F`. No reset, programming, power operation,
initialization, SD write, or physical media action occurred. Evidence:
`work/evidence/controller-a-baseline-scrub-readonly-reconciliation-20260805.md`.

## Required behavior

- Query and validate the physical 512-byte sector geometry through the existing
  SD owner/adapter path.
- Read every addressable sector exactly once per completed pass without writing,
  formatting, repairing, remapping, or changing HPT metadata.
- Work in bounded slices so watchdog, control, alarm, UI, and normal scheduling
  remain responsive. The service may require logging to be quiesced, but it
  must state that explicitly.
- Publish total sectors, completed sectors, progress, elapsed time, read rate,
  retry count, first failing sector/status, total failed sectors, cancel state,
  and terminal result.
- Continue after a bounded number of individual read failures so the result
  describes the whole card; never hide a failure behind a later successful
  retry.
- Reject geometry overflow, unsupported sector size, target/card identity
  change, concurrent destructive operation, and invalid commands.
- Permit clean cancellation and restart from sector zero. A cancelled or
  incomplete pass is never a qualification pass.
- Preserve the first SSP/driver failure and make the final result available to
  J-Link automation in a stable machine-readable structure.

## Acceptance criteria

- [x] Host/model tests cover zero/invalid geometry, final-sector boundaries,
  counter overflow, isolated and repeated failures, retry accounting,
  cancellation, target/card change, and terminal latching.
- [x] Source invariants prove no write/format path is reachable from scrub.
- [x] A successful model pass accounts for every sector exactly once.
- [x] A failing model pass continues within its failure budget and reports the
  exact first failure and total failure count.
- [x] Target diagnostics expose progress without requiring operator interaction.
- [x] Clean Debug and Release builds pass with resource deltas recorded.
- [x] Final-candidate physical baseline passes include
  service-467/equivalent CID evidence captured at baseline and after any reboot,
  initialization, power-off reinsertion, or replacement relevant to the result.
- [ ] Baseline and post-endurance physical scrubs are linked from the same
  per-card qualification record.

Software-gate evidence:
`work/evidence/hpt-log-store-circular-mirror/software-completion-gate-20260724.md`.

Final-candidate A/B physical baseline evidence:
`work/evidence/post-freeze-integrated-qualification-20260725.md`.

## Not in scope

- Destructive write testing or sector repair.
- Proving CID authenticity.
- Lab relay implementation.
- Physical execution before `G-PWR` is qualified when the run includes power
  interruption.
