# HPT2 fixed-mailbox bundle Pi import review

Status: complete software-only import and review; valid but unadmitted and unbound
Type: evidence
Updated: 2026-08-02
Next Action: retain as predecessor to the completed fixed-mailbox A/B promotion evidence; review the separately gated A/B HPT2 stop/recovery measurement plan before enabling commands
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Result

The newer fixed-mailbox firmware bundle
`smi-00-05-00-bc0b6ce4d066-release` was reproduced with the canonical firmware
packager, transferred to the Pi bundle inbox, independently verified by the Pi
importer, and published into the Pi's hardened content-addressed bundle store.
The import did not admit the bundle, bind it to a controller, program or contact
a controller, enable an endpoint, or invoke an HPT2 command.

The first detached-worktree reconstruction was rejected from consideration
because Git normalized the profile contract to LF and therefore did not match
the recorded package identity. Reusing the reviewed central-workspace profile
bytes reproduced the recorded Windows/CRLF profile and mapping hashes exactly.
Only that exact reproduction was transferred and imported.

## Reproduced firmware-package identity

- Bundle ID: `smi-00-05-00-bc0b6ce4d066-release`.
- Firmware source commit:
  `bc0b6ce4d0666cacd65e19efd2c3b56add39a50f`.
- Firmware source tree:
  `fafed6502191387c9eee65fe50f77e590c298fdc`.
- Release ELF SHA-256:
  `bc05ac68bcba4645428c20446adcfe18c370a0f6bf68cc701ce616f1ff757a91`.
- Release S-record SHA-256:
  `3cfd2c7c571f32a11a14b28b7c72c0cec36b9861ac87068da47ad4cced1ab391`.
- Release map SHA-256:
  `aae6b5cb77ad0943800be929b6a04ec6b0ed052dc15f24729b1ec45dcecfe1d4`.
- Profile-contract SHA-256:
  `945ebbc67c1673ecef3d8d185de415a4613bd6050d13e1b0f1d12d260e434e00`.
- Diagnostic-mapping SHA-256:
  `0b8b68c32955177a731f55e3dce6637100a3bcaf016ef9da729721295ef24770`.
- The manifest listed six members, every member hash and size matched, and no
  unlisted member was present.

## Pi import identity and readback

- Importing release identity: `hpt2-operator-ui-351182d`.
- Importer: `sdq-bundle-importer/1`.
- Import actor: `owner-requested-bc0b6ce4-import-review-20260802`.
- Pi canonical-manifest/content address:
  `5df475bd0b2de8792f40bc2bd49efde37fce66f9b80bd24b4bb2e675fc1176ce`.
- The Pi database reports `valid=true`, `admitted=false`, and admission scope
  `none`.
- The content-addressed store contains the manifest plus the exact six listed
  members. Directories are read/execute-only and files are read-only.
- A second full importer pass over the hardened inbox returned
  `already-present` with the same `5df475bd...176ce` identity and unchanged
  `admitted=false`, proving idempotent manifest/member readback.
- The appliance checkout remains clean: its local Git exclude file now ignores
  only `/fixtures/bundle-inbox/`, keeping immutable runtime intake out of source
  status without changing the repository's tracked ignore policy.
- Import blockers remain
  `IMMUTABLE_RELEASE_IDENTITY_REQUIRED`, `EXTERNAL_APPROVAL_REQUIRED`, and
  `COMPATIBILITY_ADMISSION_REQUIRED`.

## Fixed-mailbox contract review

The deployed Pi runner loaded the stored mapping and stored profile contract
successfully using its production contract validator:

- coherent status: `0x2004D960`, 208 bytes;
- coherent acknowledgement: `0x2004DA30`, 80 bytes;
- host command mailbox: `0x2004DA80`, 256 bytes;
- profile: `HPT2_ENDURANCE_BASELINE_V1`, version 1, SHA-256 `945ebbc6...e434e00`;
- mapping declares `live_admitted=false` and the reviewed fixed-mailbox adapter
  contract expected by the Pi runner.

The three ranges are aligned, inside target SRAM, non-overlapping, and retain
the exact symbol/type/size identities enforced by the Pi runner.

## Preserved gates

- The protected controller registry is valid, but both A and B remain disabled
  and remain bound to the older firmware manifest `2340c9e8...0d28`.
- No controller role is bound to the new `5df475bd...176ce` manifest.
- `SDQ_HPT2_COMMAND_CONTROLLER_ROLES` and both HPT2 command endpoints are
  empty. No HPT2 tools-profile container remains running.
- Appliance health remains green and fixture-only with `live_admitted=false`,
  `state_changing_profiles_enabled=false`, `bounded_stop_supported=false`, and
  `recovery_supported=false`.
- Controller B's preserved Release was not changed. T00 was not reopened and
  no USB firmware behavior was changed.
- CID evidence is not applicable to this software-only import: neither
  controller nor any SD card was accessed.

Import and structural compatibility are proven. Candidate promotion,
protected-registry rebinding, code-flash programming, independent post-program
identity/CID/HPT observation, stop/recovery measurement, and live admission
remain separate gated actions.
