# Campaign: Route service 471 to HPT media 2.0 formatting

Status: deferred
Type: campaign
Updated: 2026-09-03
Next Action: obtain explicit authorization to invoke destructive service 471 on Controller B, then capture baseline CID/status, verify the established screen wording, execute HPT media 2.0 formatting, and capture post-operation CID/status
Campaign ID: CAMP-0028
Campaign Number: 028
Outcome: Service code 471 preserves its established operator-facing wording and formats the installed SD card as HPT media 2.0 instead of FAT32
Primary Focus Areas: none
Supporting Focus Areas: none
Depends On: none
Decision: Controller B is the authorized deployment target; destructive service-471 formatting remains separately unauthorized
Detour For: none
Return To: none
Requested Endpoint: work2
Completion Gate: The scoped source is committed, deployed to the authorized development target, and focused target evidence proves the unchanged service-471 screens invoke guarded whole-card HPT media 2.0 initialization without invoking the legacy FAT32 formatter
Completion Evidence: Source and model checks passed; canonical managed Debug rebuild passed; candidate c577a6a6 was programmed and verified on Controller B through J-Link 69660123; destructive changed-behavior evidence remains pending
Disposition: none
Roadmap: none
Roadmap Revision: none
Milestone: none
Unlocks Gate: none

## Request

Permanently redirect service code 471 from the retired FAT/FileX formatting path to the production HPT media 2.0 whole-card initializer. Preserve the existing service-471 screen wording, title, buttons, progress wording, success wording, and error wording.

Candidate commit `c577a6a6` implements the request in `src/HMI_MainEventHandler.c`, updates the HPT-only regression check and development notes, and regenerates the Debug ELF/SREC artifacts. The owner authorized deployment to Controller B on 2026-09-03 but did not authorize invoking service 471 or destructively formatting a physical SD card.

## Current Evidence

- `script/check-version5-hpt-only-sd.ps1`: 15/15 passed.
- `script/check-hpt-commissioning.ps1`: 110/110 commissioning invariants and 16/16 lifecycle-policy checks passed.
- HPT interruption model: all 141 states passed.
- HPT triple-circular model passed.
- Canonical managed Debug rebuild completed without errors.
- Debug ELF SHA-256: `ABED86D24F81F4E855ABF2121DBA2CC7346E42EF18EBC440B42CE75526D6CC90`.
- Debug SREC SHA-256: `49293DF05D5D36D9BB679C761F2C3292B795A23DD395D298C0D8AA23F4F363F1`.
- Fresh-handoff commits: firmware candidate `c577a6a6`; initial campaign checkpoint `b5b6d39b`.
- Strict workspace preflight and Tool Shed Doctor passed with a clean worktree before deployment.
- Controller B / assembly `1751219` / J-Link `69660123` accepted the exact Debug S-record. J-Link reported VTref `3.295 V`, identified the Cortex-M4, programmed and verified 2,932,736 bytes, reset the controller, and resumed execution.
- Service 471 was not invoked and the installed SD card was not formatted, removed, or replaced.

## Completion Check

On the explicitly authorized development controller/card pair, capture baseline CID/status, enter service 471, confirm the established text is unchanged, execute the destructive action, and verify post-operation CID/status plus HPT media 2.0 readiness. Card insertion or replacement must occur only with controller power off.
