# HPT bounded-export software gate — 2026-08-14

Status: complete
Result: software, model, managed-build, ABI, and package-validation gates pass; Controller A/B target evidence is not authorized or complete
Type: evidence
Updated: 2026-08-14
Next Action: obtain exact authorization for the reviewed image, controller roles, installed SD-card disposition, USB labels, and target procedure
Campaign: 003-complete-bounded-hpt-slow-export-firmware-ticket
Parent: work/tickets/ticket-eliminate-full-history-scan-latency-for-bounded-hpt-customer-exports.md
Decision Evidence: work/evidence/hpt-bounded-export-preimplementation-baseline-and-budget-proposal-20260814.md

## Result

The full-history selection cause has a bounded software correction. A sealed
segment now carries a checksummed inclusive first/last/minimum/maximum timestamp
envelope, and open reconstructs a bounded directory for the newest 146 segments
per lane. Customer export intersects the requested time range with minimum and
maximum timestamps without assuming timestamp monotonicity, then traverses only
the candidate span plus its nearest predecessor and successor proof segments.

The normal iterator remains authoritative for every traversed record. Sequence
continuity, three-lane voting, commit/data/payload CRCs, malformed payloads,
ambiguous copies, immutable snapshot end, media generation, reclamation,
capacity, terminal state, and USB handoff rules are unchanged. The accepted
32 KiB FileX publication cap and broad USB command/lifecycle policy are
unchanged.

The owner-approved budget is:

- `<=60.0 s` total through `PUBLISHED / COMPLETE` for an ordinary ten-minute
  range against at least 1,000,000 retained records on both controller variants;
- `<=30.0 s` for lookup, HPT validation, and staging;
- `<=8,192` proof records for ordinary, duplicate, boundary, one forward-jump,
  and one backward-adjustment fixtures; and
- near-capacity work may scale with selected rows, not unrelated history.

## Complexity and telemetry

Range lookup reads no HPT record blocks. It examines at most `3 * 146 = 438`
in-memory entries and produces a proof sequence interval. The million-record
deterministic oracle selected the same 11 rows as the full visible-window scan
and traversed 4,092 proof records. Timestamp-jump, duplicate, and boundary
fixtures also remained below 8,192 records.

`S_HptExportStatus` schema 5 separately reports range lookup, HPT reads,
validation, row staging, and USB/total elapsed ticks, plus index-entry,
candidate-segment, proof-record, command/block, selected/scanned, gap, health,
and terminal fields. Validation time explicitly excludes the timed SDRAM row
copy. Both linked ELFs expose `gHptExportStatus` at exact size `0x130` (304
bytes), and packaging rejects any other size.

## Media and recovery boundary

The superblock explicitly advertises durable range envelopes. Existing media
without that feature is unsupported and must use an explicitly authorized
whole-card reinitialization or separately reviewed successor path; firmware
does not silently migrate metadata. A missing/corrupt envelope on an older
sealed segment fails open closed. The newest active segment may have no sealed
envelope because reopen validates its committed prefix and reconstructs the
active envelope from those records.

Deterministic recovery coverage includes an interruption before/during seal,
one corrupt lane envelope with two usable copies, split/degraded lanes,
wrap/reclaim, bounded directory eviction, missing sequences, malformed records,
ambiguous copies, concurrent append beyond snapshot end, export capacity, and
media I/O/generation guards.

## Source and contract snapshot

| File | Bytes | SHA-256 |
| --- | ---: | --- |
| `src/HptTripleCircular.c` | 77,069 | `b0318ac09944b61158017bfbf72e5ee688db8b61aa41c3227ce55a533a1ff107` |
| `src/HptTripleCircular.h` | 7,516 | `97b030cf335b65051f91cc13a0e80abc60ac063f1b8e019be032efb58a0de220` |
| `src/SdCardService.h` | 36,927 | `e680091dce5db816ae8775ab5a2b3b165b6a85191dde64a4c2a746d1c322da4c` |
| `src/Thread_SdCard_entry.c` | 288,378 | `358091fb0626410c2d853c3ffc5b98bfe526d561b6db4fbb09e19c2485280f37` |
| `script/check-hpt-customer-export.ps1` | 16,682 | `5ca4997c63484298ac49cdc2713c4b85abafdef802a2c930d8786721990f9352` |
| `script/invoke-controller-a-hpt-power-cut.ps1` | 127,123 | `e54e392c994e2fe1196d976114cbebddaab0c69c55b694064ecb6e2b4b62b623` |
| `script/package-sd-qualifier-firmware-bundle.ps1` | 38,892 | `76f3852f5f3d4254ac33cc40156b93c5a2b72c92ef5dd371f1be79a6329e4e14` |
| `script/test-hpt-customer-export-model.py` | 11,958 | `49f5dbaafa6c9ec4726af57c39b0c35739e2faa7c8449187f85dd5cacfae2f43` |
| `script/test-hpt-triple-circular-model.py` | 23,269 | `466acdbbe2169a07d1c1595ca305e7990d2f655d39fd688bd9550e3f056cea8e` |

The canonical media and operating contracts were updated in
`docs/hpt-triple-circular-media-contract.md` and
`docs/sd-card-operation-and-recovery.md`.

## Automated verification

- HPT customer-export invariants: `38/38` pass.
- HPT commissioning invariants: `100/100` pass, plus `16/16` SD lifecycle
  policy checks.
- Every repository `script/check-*.ps1`: `27/27` pass.
- Every repository `script/test-*.py`: `10/10` pass.
- Customer-export oracle: full-scan parity at 1,000,000 records, timestamp
  disorder, gaps, capacity, health, and bounded proof all pass.
- Triple-circular model: capacity, quorum, retirement, loss, three-plus wraps,
  split lanes, bulk parity, exact reads, sealed-envelope recovery, feature
  rejection, and bounded index eviction all pass.
- `git diff --check`: pass; only expected Git line-ending notices were emitted.

## Canonical managed builds

The final post-review builds used the managed-make wrapper with `-Jobs 4`.
Debug rebuilt cleanly in 113.9 seconds and Release rebuilt cleanly in 104.9
seconds. Both contain the repository's pre-existing SSP/application warning
set; no changed bounded-export source produced a build error. A one-time
incremental Release link encountered a Windows file-open error and passed on
the immediate managed retry; both later clean rebuilds passed.

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `Debug/7520553_SMI_FW.elf` | 14,761,352 | `4f63145ea2b3a09771dbcb7c3ea382ae93192650db50d19e3549aa3b921f6fa5` |
| `Debug/7520553_SMI_FW.srec` | 8,678,266 | `c67836ebdc371ac70ef465b55c96516689a1ee9c9e84b4c5cd27e6e4daae65e9` |
| `Debug/7520553_SMI_FW.map` | 36,703,269 | `ef1567446f7b6eb8c035eab6d59c34899609f8bd207594f33953f04004ddb890` |
| `Release/7520553_SMI_FW.elf` | 11,425,656 | `2eac26df49ee082760c2cef3fc4bbbae8740adbb196ad67d75aed5af9eb2056d` |
| `Release/7520553_SMI_FW.srec` | 8,678,266 | `d1fbfc257043dffb04da9b883f26992df4d8ee1525089be63485e43a0519e761` |
| `Release/7520553_SMI_FW.map` | 5,458,340 | `28808dd567fa14abd85bc9e679edc81b8d848eb93d5872cce5465c14d1592f58` |

Linked `text=2,892,724`, `data=0`, and aggregate `bss=28,705,712` for both
configurations. Internal sections are `.data=16,900`, `.bss=550,080`,
`.heap=38,912`, and reserved stacks `25,600`, leaving 23,868 bytes to the
640 KiB RAM limit after all linked/reserved sections. `gHptQualification` is
`0xD4B8` (54,456 bytes). The 438 entries are compile-time fixed at 28 bytes
each; sequence identity remains 64-bit through two aligned 32-bit words.

## Package and hash validation

The packager validated all declared files, source identity, exact ELF symbols,
artifact hashes, and diagnostic mapping for temporary reviewed-source Debug and
Release bundles. These are validation outputs under the user's temporary
directory, not the immutable corrected firmware bundle owned by campaign 004.

- source snapshot SHA-256:
  `30536a012f720bd290dc0d905102e171038881a90819c9d6b44e75653601019c`;
- Debug validation bundle:
  `smi-00-05-00-30536a012f72-c67836ebdc37-debug`, manifest
  `b2f4e6126131b32ae132ed762a18323f8a589a7c18b6607edae1fb081adcf18a`;
- Release validation bundle:
  `smi-00-05-00-30536a012f72-d1fbfc257043-release`, manifest
  `7208e6bab88498ad1fb8e6029fb4285c2a03b10919a388b384f4c8119e1ea29c`.

No controller was programmed, no RAM command was written, no SD/USB media was
changed, and no final campaign-004 bundle was created.

The host capture preflight now requires the exact schema-5
`gHptExportStatus` size `0x130`; the focused invariant checker locks that ABI
guard and passes `39/39`. The correction changes host tooling only and does
not change either validated firmware artifact.

## Read-only target baseline

Fresh read-only Controller A/B captures are summarized in
`work/evidence/hpt-bounded-export-target-authorization-gate-20260814.md`.
Both controllers resumed after capture. No controller, SD card, USB drive, or
configuration state was changed.

## Remaining gate

This software evidence does not satisfy the ticket's Controller A/B completion
criteria. Both hardware variants still require explicitly authorized large-
history proof against a trusted full-scan oracle, including ordinary and
near-capacity ranges, exact CSV/FAT/completion-tail validation, current CID
identity blocks, and before/after phase/read telemetry. Because currently
installed media predates the range-envelope feature, its disposition is a
destructive or successor-path decision and cannot be inferred from software
approval.
