# HPT full-address scrub cadence mitigation and reviewed bundle — 2026-08-04

Status: software mitigation, immutable bundle, Controller A promotion, and target full-card read passed; Pi method gate blocked on event-driven HMI delta
Type: evidence
Updated: 2026-08-04
Next Action: preserve all three non-replayable F1-A1 scrub operations; review/correct the Pi HMI-liveness acceptance predicate and obtain fresh authorization before minting one new read-only scrub operation
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-hpt-bounded-full-address-read-scrub.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Bundle-freeze outcome

The pre-initialization scrub slowdown is corrected in software. While a scrub
is active, the SD owner loop no longer applies the one-second degraded-media
retry backoff after every bounded 512 KiB scrub slice. The existing one-tick
active-scrub yield remains, and ordinary unavailable-media retry behavior keeps
the one-second backoff.

At this bundle-freeze checkpoint, no controller, J-Link endpoint, Pi qualifier,
SD card, campaign, or external bundle store was accessed. Controller A was not
programmed by the freeze work itself. The separately authorized successor
operation below later promoted this exact bundle; `F1-A1` remains
uninitialized and unwritten.

## Root cause and scope

The timed-out operation had completed 3,587,072 of 15,728,640 sectors in one
hour with no reported read failure, an observed rate of approximately
0.487 MiB/s. Each owner-loop slice reads 16 transfers of 64 sectors at 512
bytes per sector, or 512 KiB. The not-ready branch then unconditionally slept
for 100 ThreadX ticks; at 100 ticks/second this added approximately one second
per slice.

The backoff was originally introduced as the low-rate reopen/reclassification
cadence for absent or unreadable media where hardware card detect is disabled.
The later pre-initialization scrub ownership guard suppressed reclassification
while the scrub ran, but the sleep remained outside that guard. The correction
moves the existing `tx_thread_sleep(100U)` into the scrub-inactive block with
`detectAndClassifySdCard()`. It does not change transfer geometry, failure
accounting, CID pinning, command ABI, media writes, formatting, or
initialization.

Removing the observed sleep component projects a full-card duration near
7.1 minutes for this specimen. That is a diagnostic estimate, not target
qualification or a promised deadline; a newly authorized target run must
measure the actual result.

## Verification

- `script/check-hpt-full-address-scrub.ps1`: `13/13` passed, including the new
  invariant that the degraded-media retry backoff is bypassed only during an
  active scrub.
- `script/test-hpt-full-address-scrub-model.py`: passed.
- `script/check-hpt-commissioning.ps1`: `95/95` passed.
- `script/check-sd-qualification-lifecycle-policy.ps1`: `16/16` passed.
- Canonical managed Debug rebuild: passed with the repository's existing
  warning classes and no build error.
- Canonical managed Release rebuild: passed with the repository's existing
  warning classes and no build error.

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `src/Thread_SdCard_entry.c` | 265977 | `fc2e14e8a4c9fddc1130d25e621cfe509dfed8f292eb9f27bab2121edad2d335` |
| `script/check-hpt-full-address-scrub.ps1` | 5070 | `f51a1db267c1426e6c12c5b275cab1595752fa02cc26f0177584e82b17582d3e` |
| `Debug/7520553_SMI_FW.elf` | 14728108 | `c74909059b3ab99d5ddd86d3c5828abed9f91bd1856e38baba930a87cb2d684e` |
| `Debug/7520553_SMI_FW.map` | 36697779 | `29b11adf28cb503b18697b1a8deb6824839aa800109b66fd536197b4e28ec3b3` |
| `Debug/7520553_SMI_FW.srec` | 8658458 | `205249c7dc8894f4b7fcfb64009bcc0395c5c7efe1f0593b503f7815df282a79` |
| `Release/7520553_SMI_FW.elf` | 11394340 | `e5353c531fc9c9d048712b5d546d821a42113fd2708bab9ce843ba1c56c0b4e0` |
| `Release/7520553_SMI_FW.map` | 5452850 | `218c55940f8fa28c836919ac55ad531fd4877e8eea5211b1ec19a1b95daa8316` |
| `Release/7520553_SMI_FW.srec` | 8658458 | `e75e6df95e01c0f4ebf008013929ecc43c3c5d5fd8901e507309ab7536c2e815` |

## Frozen immutable bundle

- Bundle ID:
  `smi-00-05-00-3861b4a2c040-e75e6df95e01-release`.
- Local directory:
  `tmp/candidate-bundles/smi-00-05-00-3861b4a2c040-e75e6df95e01-release`.
- Base commit: `48181bd31c769addf9c1c825982e31d0b1ad62a0`.
- Reviewed source snapshot SHA-256:
  `3861b4a2c0409dcdae406bca2c3b4c0c7750ae76f805210c3821e6de7372d227`.
- Manifest SHA-256:
  `bb03950180b79ff17df257087e991f436b9ca1f615b074e3c4c60fccf4efabda`.
- Diagnostic mapping SHA-256:
  `570b161f2c156a9d958bb7acd9770b4ff37c44117419b5febb8286207958d406`.

Independent review verified the exact seven-file member set, every declared
size and SHA-256, current reviewed-source bindings, read-only attributes, the
scrub run/cancel constants and single-word command policy, `live_admitted` as
false, and all 180,386 Motorola S-record byte counts and checksums.

## Remaining controlled gates

Operations `e36882de-ebf5-4b35-93ef-698e352a553c`,
`fbfb1b52-e79c-4ffc-8e54-d34fd4102659`, and
`3b04cc35-ce17-4201-88f9-7a885a9300ab` are consumed and non-replayable. The
last operation completed every sector with zero failures or recovered retries
and positive controller-thread progress; the Pi rejected it solely because
the event-driven HMI thread did not wake. Campaign
`738c4a65-acf3-4492-8d17-244ade322670` is blocked on that method-policy
disposition. See
`work/evidence/controller-a-cadence-promotion-and-scrub-liveness-policy-block-20260804.md`.
