# HPT pre-initialization full-address scrub reviewed bundle — 2026-08-04

Status: passed independent software/package review; immutable bundle imported and campaign-bound; physical qualification not run
Type: evidence
Updated: 2026-08-04
Next Action: obtain explicit authorization to program Controller A with this exact imported/bound bundle, then require post-program exact-flash and fresh boot-relevant CID evidence before any new operation
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-hpt-bounded-full-address-read-scrub.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Review disposition

An independent fresh-context review found no blocking defect in the
pre-initialization full-address scrub correction.

- The pre-initialization path requires the prior CID-valid,
  representative-sector-readable `NEEDS_INITIALIZATION` classification and an
  initialization-eligible media state.
- It copies the approved CID before acquiring raw ownership, recaptures and
  compares CID after acquisition, pins that identity for the run, and
  recaptures it before releasing owned raw ownership.
- It closes a raw block-media session only when the scrub acquired that
  session. The initialized-HPT path continues to borrow the existing open
  store and does not close it.
- Begin failures that opened the driver are cleaned up through the owned-session
  terminal path. Pass, failure, cancellation, geometry rejection, identity
  mismatch, and failure-budget termination all use the same cleanup path.
- The scrub service reaches the raw block-media `read` API but contains no
  write, format, discard, repair, or initialization call.
- Background card reclassification is inhibited while the scrub state is
  running. Existing bounded slices, retry visibility, failure budget,
  competing-diagnostic order, controller/HMI run deltas, and terminal command
  clearing remain in force.
- The Release ELF preserves the public Pi/J-Link ABI:
  `gHptFullAddressScrubCommand` is `0x20055F80`, 4 bytes, and
  `gHptFullAddressScrubStatus` is `0x20055F90`, 104 bytes (`0x68`).

## Exact source provenance

The repository was intentionally dirty and committing or staging was outside
this review's authorization. The packager therefore records an explicit
reviewed working-tree snapshot instead of falsely attributing the candidate to
clean `HEAD`.

- Base commit: `48181bd31c769addf9c1c825982e31d0b1ad62a0`.
- Base tree: `82d6a085b7378872c3d8a3f3a0c9b38635a03eb4`.
- Reviewed source snapshot SHA-256:
  `868598ee08d91fcbe76f346fdf9c315d02ad27083e364d3b180d78e42469800f`.

| Reviewed input | Bytes | SHA-256 |
| --- | ---: | --- |
| `src/Thread_SdCard_entry.c` | 265964 | `1c19088f56f4ca1d51d5455201761f4bd81a2282ce6bb8e36050f93fcd0f8137` |
| `script/check-hpt-full-address-scrub.ps1` | 4400 | `883f8b7c250a2ea695d23c7dc49c031c130a10fd2bd78633e15292e67ab2dd01` |
| `script/package-sd-qualifier-firmware-bundle.ps1` | 28028 | `37803a7392ba9b11db114f20af044cfd13cbf64d3827848c2c01bcb97321f21a` |

The packager rejects reviewed-dirty packaging when any changed build input
under `src/`, `synergy/`, or `synergy_cfg/`, or the primary e2 project files,
is absent from the explicit reviewed path set.

## Frozen bundle

Bundle ID:
`smi-00-05-00-868598ee08d9-404826a5be8e-release`

Local immutable candidate directory:
`tmp/candidate-bundles/smi-00-05-00-868598ee08d9-404826a5be8e-release`

The packager created a unique temporary directory, validated every declared
member and the absence of undeclared members, atomically renamed it to the
non-colliding final name, and marked all final files read-only. It refuses to
replace an existing final bundle.

An earlier local candidate produced before the final full-status refusal check
was corrected is not a candidate. Deletion was blocked by local shell policy,
so it was moved out of `tmp/candidate-bundles/` to the existing
`tmp/rejected-bundles/` quarantine with suffix
`.superseded-packager-regression`. The exact candidate named above was created
only after the corrected refusal tests passed.

| Bundle member | Bytes | SHA-256 |
| --- | ---: | --- |
| `artifacts/7520553_SMI_FW.elf` | 11394340 | `10840281efd9fc53b0e42447f2af241ea2e4140d09a96b89c254c41ad4cacb78` |
| `artifacts/7520553_SMI_FW.map` | 5452850 | `c09670bb4039d5da0f470b031cdb1e1aa2cb141f01f4c5839e373d5f55c8104c` |
| `artifacts/7520553_SMI_FW.srec` | 8658458 | `404826a5be8e318683157e838595cd82ae8cb36b6222115e707ef3debc99baf5` |
| `bundle-manifest.json` | 1275 | `b4422747feaad383df398becda58b94e20fbc5aa0ca5ccde2bf4a7ef415da3e2` |
| `diagnostic-mapping.json` | 17414 | `84660cb13b285a2647f8eabcb93f22d9b7bb1bd7bd5e5edf8c4f805316628966` |
| `firmware-build.json` | 2654 | `59fe99b6481c13b7e55fd983cf377a9c25cd87173abb168641e1622f6a7d3c30` |
| `profile-contract.json` | 4863 | `945ebbc67c1673ecef3d8d185de415a4613bd6050d13e1b0f1d12d260e434e00` |

Total: 7 files, 25,531,854 bytes. The SHA-256 of
`bundle-manifest.json`, which binds all six other members, is
`b4422747feaad383df398becda58b94e20fbc5aa0ca5ccde2bf4a7ef415da3e2`.

`diagnostic-mapping.json` now includes
`HPT_FULL_ADDRESS_READ_SCRUB_V1`, the exact command/status symbols and layout,
the run/cancel constants, a single-word command-write policy, and explicit
write/format/discard exclusions. `live_admitted` remains `false`.

## Validation repeated during review

- Tool Shed workspace preflight: completed; the existing 29.6 MiB tracked
  diff triggered `DIFF_BYTES` and `HARD_DIFF_LIMIT`, so review used the
  required fresh-handoff mitigation and no binary/generated-evidence diff.
- Packager PowerShell syntax parse: passed.
- The normal packager route refused full tracked/untracked dirty status, and
  the reviewed-dirty route rejected a transient unlisted untracked file under
  `src/`: passed. The transient probe was removed before final packaging.
- `script/check-hpt-full-address-scrub.ps1`: `12/12` passed.
- `script/test-hpt-full-address-scrub-model.py`: passed.
- `script/check-hpt-commissioning.ps1`: `95/95` passed.
- `script/check-sd-qualification-lifecycle-policy.ps1`: `16/16` passed.
- Current Debug and Release ELF/S-record hashes matched the prior canonical
  managed rebuild evidence exactly, so no redundant rebuild was run.
- Bundle member count, exact relative paths, per-member sizes and SHA-256,
  reviewed-source hashes, scrub ABI values, read-only attributes, and absence
  of undeclared files: passed.
- Every Motorola S-record byte-count and checksum record in the bundled SREC:
  passed.

## Remaining gates

This is a reviewed software candidate, not controller or media qualification.
No controller was contacted or programmed and no SD card was operated. Preserve
failed non-replayable operation `e36882de-ebf5-4b35-93ef-698e352a553c` and do
not initialize or write `F1-A1`. Before a new scrub, the Pi qualifier must
import and bind this exact bundle/mapping to a new campaign operation, separate
programming and operation authorization must be obtained, and a fresh complete
boot-relevant CID identity block must be captured. Baseline and post-endurance
physical full-address scrub results remain required for each card.
