# HPT bounded-export target authorization gate — 2026-08-14

Status: complete
Result: decision required; read-only A/B baseline complete and target mutation not authorized
Type: evidence
Updated: 2026-08-14
Next Action: when an operator can complete the physical USB-reader handoff, obtain exact owner authorization for the reviewed Release image and destructive installed-card A/B proof, or arrange power-off successor-card installation
Campaign: 003-complete-bounded-hpt-slow-export-firmware-ticket
Parent: work/tickets/ticket-eliminate-full-history-scan-latency-for-bounded-hpt-customer-exports.md
Software Evidence: work/evidence/hpt-bounded-export-software-gate-20260814.md

## Read-only result

Both controllers were captured through their exact J-Link identities using the
currently installed frozen Release image. The capture halted each CPU only for
read-only RAM inspection and resumed it afterward. No RAM command was written,
no firmware was programmed, no SD or USB media was changed, and no controller
power action occurred.

The installed image on both targets remains S-record SHA-256
`37FF5C0C6F48576396C8EF3807AAE9C8F1DDAB742A72C47A4C1055454DA906F0`.
It predates the range-envelope feature and cannot provide campaign-003 target
performance evidence.

| Target | Assembly / J-Link | CID identity | Live HPT state |
| --- | --- | --- | --- |
| Controller A | `1751136` / `69664082` | status `6`; CID valid `1`; representative-sector status `0`; MID `0x05`; OID raw `0x000C`; product `asdfg`; revision `2.2`; serial `7305`; manufacture `2026-03`; raw CID `05000C61736466672200001C8901A34F` | media state/status `5/0`; retained sequences `1..1777367`; lane mask `7`; mismatch/lost/retired `0/0/0`; system errors `0` |
| Controller B | `1751219` / `69660123` | status `6`; CID valid `1`; representative-sector status `0`; MID `0x05`; OID raw `0x000C`; product `asdfg`; revision `2.2`; serial `7298`; manufacture `2026-03`; raw CID `05000C61736466672200001C8201A379` | media state/status `5/0`; retained sequences `1..960349`; lane mask `7`; mismatch/lost/retired `0/0/0`; system errors `0` |

Raw generated captures remain in the ignored controller-specific evidence
directories under stem `camp003-preauthorization-20260814`. The latest
controlled USB mapping is `USB07_32G` for Controller A and `USB05_4G` for
Controller B, recorded on 2026-08-11. A target preflight must verify those
drives are still present in those roles and stop without mutation on any
mismatch.

## Exact reviewed candidate

Campaign 003's reviewed target candidate is the managed Release build:

- S-record: `Release/7520553_SMI_FW.srec`;
- S-record SHA-256:
  `D1FBFC257043DFFB04DA9B883F26992DF4D8EE1525089BE63485E43A0519E761`;
- ELF: `Release/7520553_SMI_FW.elf`;
- ELF SHA-256:
  `2EAC26DF49EE082760C2CEF3FC4BBBAE8740ADBB196AD67D75AED5AF9EB2056D`;
- scoped source checkpoint:
  `797548fe9e25d38b0a9b4f47b810d4dc7e35b082`.

This is a reviewed target-test candidate, not the immutable corrected bundle
owned by campaign 004.

## Authorization boundary

The existing cards lack the explicit range-envelope feature. Proving the new
path on them therefore requires destructive whole-card HPT initialization.
That will erase Controller A's approximately 1.78 million-record history and
Controller B's approximately 0.96 million-record history. Firmware alone
cannot preserve or migrate those histories.

The smallest executable target plan is to:

1. verify the exact controller/J-Link/CID/image/USB identities above;
2. program and verify the exact reviewed Release candidate on both targets;
3. destructively initialize only the two identified installed SD cards, with
   no removal, insertion, or powered hot swap;
4. capture CID and media identity immediately after initialization;
5. create deterministic retained histories of at least 1,000,000 records on
   each controller, then run ordinary ten-minute and near-capacity exports;
6. verify oracle parity, bounded proof/phase telemetry, the approved latency
   budget, exact CSV completion, and USB filesystem state independently; and
7. capture final CID/health, preserve evidence, and restore only firmware state
   explicitly included in the approved procedure.

The controller export phase keeps `USB07_32G` at Controller A and `USB05_4G`
at Controller B. After each controller reports a completed publication and the
normal USB removal prerequisites are satisfied, independent CSV/FAT evidence
requires these physical reader handoffs:

```text
DRIVE: USB07_32G
TO: Raspberry Pi reader
```

```text
DRIVE: USB05_4G
TO: Raspberry Pi reader
```

These are normal powered USB operations; controller power-off is neither
required nor requested. Because the owner is currently remote from the
controllers and Pi, the end-to-end target gate cannot finish until a local
operator can perform those moves. A missing or mismatched USB, controller,
probe, CID, candidate hash, or prerequisite stops the procedure before
mutation. No SD card is physically handled while powered. Any needed physical
card replacement is a separate power-off operator action and is not authorized
by this plan.

The nondestructive alternative is to retain the installed histories and have
an operator power both controllers off, install separately identified
successor cards, and then authorize a revised exact-card procedure. That path
cannot begin while the operator is remote and no successor cards have been
installed.
