# HPT media-2.0 portable audit and validator checkpoint

Date: 2026-08-02
Result: PASS for the host-only development checkpoint; not a release or controller qualification
Repository: `jong@srv-rpi00.local:~/dev/HPT-Embedded-Log-Store`
Development worktree: `/var/tmp/hpt-media-2-0-release-20260802`
Branch: `codex/media-2-0-portable-core`
Head: `d1e9e7ebc7504c22ec2e3e46f398bbddd92e320a`
Review: draft PR #2, all GitHub checks green

## Scope and boundaries

This checkpoint audited and strengthened the portable media-2.0 implementation
without reopening T00, changing the frozen Controller B Release baseline, or
accessing a controller, USB drive, raw SD card, J-Link probe, or power service.
It is host evidence only. The released portable identity remains v0.4.0/media
1.0 until the separate media-2.0 immutable-release gate passes.

## Byte-equivalence audit

Two host harnesses compiled the SMI firmware media-2.0 implementation and the
portable implementation against the same in-memory block backend. Complete
serialized images matched byte for byte for:

- the normal 12-record qualification image; and
- every one of the first 80 persistent-operation interruption points.

The complete positive image SHA-256 is
`2ecd708f764f0c22a1014ce4fa526aded6e026bf11f1e474d002157ac5f7a7c1`.
The bounded audit workspace is
`/var/tmp/hpt-media2-audit-a42bd80ee751467a80e0933130727839`.

## Implemented checkpoints

- `f4a17be` specifies media format 2.0 and adds the deterministic compatibility
  vector and generator.
- `dbb0a0b` fails closed on unsupported versions/features, equal-generation
  metadata disagreement, invalid lane layout, segment disagreement, and
  retirement-snapshot disagreement; tentative retirement is rolled back when
  snapshot commit fails.
- `2477daf` adds monotonic retention-floor and bounded pin semantics. Reopen
  protects all history until policy is restored; exhaustion returns `FULL`
  without consuming sequence or lost-count state.
- `d1e9e7e` adds a bounded read-only structural validator for regular images
  and explicit `/dev/disk/by-id/...` block-device paths plus a true read-only
  file adapter and deterministic fixture workflow.

The validator emits `hpt-media-validator-result/v1` / `structural-v1` and
stable `PASS`, `FAIL`, `BLOCKED`, or `INCONCLUSIVE` classifications. The
development result deliberately reports
`release_identity=unreleased-development`, `source_commit=null`, and
`executable_sha256=null`; therefore it cannot satisfy Pi bundle admission.
Qualification-layout media requires an explicit regular-file fixture flag,
and that flag is rejected for block devices.

## Verification

- GCC Debug: 15/15 tests passed.
- Clang Debug: 15/15 tests passed.
- GCC ASan/UBSan: 15/15 tests passed.
- Clang ASan/UBSan: 15/15 tests passed.
- Formatting, clang-tidy, and cppcheck passed.
- Coverage run: 15/15 tests; 87.8% lines, 96.0% functions, 65.0% branches.
- The validator workflow proved normal qualification-fixture rejection,
  explicit fixture acceptance, bounded-scan `INCONCLUSIVE`, and identical
  source-image SHA-256 before and after every validator invocation.
- The positive serialized image remained byte-identical to the SMI firmware
  image after every correction.

## Remaining gates

The checkpoint is not an immutable release. Stage 3 still needs its complete
validator-specific corruption, I/O, timeout, and evidence-manifest negatives.
Stage 4 must then publish a tag, exact source commit, tool/archive hashes,
release notes, schema, and vectors. No raw-device or controller claim is made.
