# HPT2 M2 Bounded Core Paths Evidence

Status: complete
Type: evidence
Updated: 2026-08-27
Parent: work/maps/map-hpt2-qualification.md
Campaign: hpt2-prove-bounded-core-paths
Roadmap: hpt2-qualification
Roadmap Revision: 3
Milestone: M2
Gate: G2
Next Action: Run M3 physical qualification on the exact Debug/Release candidate on Controller A and Controller B with same-run CID identity evidence.

## Result

G2 passes. Deterministic maximum-geometry evidence now shows bounded normal
open, explicit full recovery, direct indexed range positioning, 30-day graph
reconstruction, 90-day export planning, graph/export cancellation, and
append-service interference. The canonical Debug rebuild passes. No safety or
data-corruption contradiction was observed.

This evidence proves the deterministic M2 gate. It does not substitute for the
Controller A/Controller B elapsed-time, power-interruption, CID, or durable
media evidence required by M3.

## Exact candidate identity

Repository HEAD at capture was `0cd01909e141171c3b5ba9dd14c14969de8c4f64`.
The working tree was intentionally dirty with 51 entries, including preserved
owner and earlier Tool Shed changes. The candidate is therefore bound to the
exact file and build hashes below, not represented as a clean release commit.

| File | Bytes | SHA-256 |
| --- | ---: | --- |
| `src/HptTripleCircular.c` | 97,108 | `fe004b75fee9e7e50212daeace182a4458003defaf45b501b833f0ef93a1f11c` |
| `src/HptTripleCircular.h` | 8,224 | `43ac5041fbfee03f7d97c450726af21cedb8d9d7e58f5629f6977b9d0d998fa3` |
| `src/Thread_SdCard_entry.c` | 290,761 | `d1ccadcaf34d631459e60d4b41378ef20e8dd8a1a29add425b3c2538397ec9fe` |
| `src/SdCardService.h` | 37,096 | `c625a3b61d082d1ebdbf4658908fcd76d8df78133f61fb3e91df5693a76b0c96` |
| `src/HMI_MainEventHandler.c` | 393,966 | `0230ca10bb66aed7f9bdfa63049a7e3e8dc23f74aa396387b9e0de85d7c45561` |
| `script/test-hpt-triple-circular-model.py` | 27,021 | `567a6fc39ae5c5f27f36eb09023ce787cf43a12596fc0594b4e2545dca756499` |
| `script/test-hpt-customer-export-model.py` | 13,662 | `c7c4d874cb9f33f8068fb45c29f06fbe6329ab3b632cc74e68503f643a6714f0` |
| `script/test-hpt-graph-cache-model.py` | 4,121 | `54bb9fa65fcbabf77db68bc1208f261fd638c658da05a1ac8f8aaef021fb9e36` |

## Smallest complete correction

- Normal open reads redundant recovery checkpoints embedded in the existing
  retirement-snapshot tail sectors. It validates the active, successor, and
  oldest state and reconstructs only the bounded visible suffix plus active
  prefix. No partition or media-layout expansion was introduced.
- A separately named explicit recovery API retains the complete segment walk.
  Successful recovery republishes both checkpoint copies and upgrades both
  superblocks, so the expensive path is fail-closed recovery rather than the
  normal boot path.
- Chart and export consumers initialize iterators directly from the bounded
  in-memory range index instead of seeking from the oldest retained segment.
- Export cancellation is checked at least once per 16 records, clears the SDRAM
  staged prefix, and never hands a partial result to USB. Chart cancellation is
  checked within the existing eight-record append-service cadence and cannot
  report a partial cache as complete.
- Long graph traversal continues to service queued production appends every
  eight records and relinquishes the SD thread at the same boundary.

## Deterministic maximum-geometry results

Command: `python script/test-hpt-triple-circular-model.py`

- PASS at 11,000 segments/lane and 11,253,000 slots/lane.
- Normal open: 459 segment-header reads, below the 512 limit.
- Normal open total: 6,632 HPT read blocks, below the 8,192 limit.
- Explicit full recovery: 66,000 segment-header reads, equal to the approved
  exceptional ceiling plus the separately bounded active-prefix scan.
- Direct range seek: six mirrored segment-header reads, below the graph ceiling
  of 900 and independent of unrelated retained history.
- Range index: 146 entries/lane; ordinary export proof: 4,092 records.
- Quorum, degraded copies, stale slots, retirement, more than three wraps,
  split-lane cursors, exact reads, bulk parity, checkpoint adoption, and corrupt
  checkpoint fail-closed behavior all pass.

Command: `python script/test-hpt-customer-export-model.py`

- PASS full-scan oracle parity, million-record lookup, timestamp disorder,
  gaps, cancellation, capacity, and health reporting.
- Ordinary ten-minute fixture: one candidate segment, 1,552 proof records, and
  11 selected records.
- Forward/backward clock fixture: two candidate segments and 3,598 proof
  records.
- Both proof results are below 8,192 records. The observed host range-plan
  times were 47.541 ms and 49.894 ms; the full-visible oracle was 39.892 ms.
- Cancellation check cadence: 16 records.

Command: `python script/test-hpt-graph-cache-model.py`

- PASS rolling-cache lifecycle, 535,681 fixed cache points, 142,560 visible
  record ceiling, and eight-record cancellation observation.
- Observed host-model elapsed time: 129.296 ms.

Host timings are deterministic regression observations and not substitutes for
the M3 target/media elapsed-time budgets.

## Correctness, interruption, and service regression

- `python script/test-hpt-write-cut-model.py` — 141/141 cut states PASS across
  ordinary append, reclaim append, retirement, and format transitions.
- `python script/test-hpt2-endurance-baseline-model.py` — 17/17 PASS.
- `script/check-export-range-policy.ps1` — 26/26 PASS.
- `script/check-hpt-customer-export.ps1` — 41/41 PASS.
- `script/check-hpt-commissioning.ps1` — 105/105 commissioning and 16/16 SD
  lifecycle-policy checks PASS.
- `script/check-hpt-graph-cache.ps1` — 15/15 PASS.
- `script/check-hpt2-endurance-baseline.ps1` — PASS.
- `git diff --check` reported only the repository's CRLF conversion warnings;
  it reported no whitespace error.

## Canonical Debug build

Command:
`./script/vscode-e2-build.ps1 -Action Rebuild -Configuration Debug -Jobs 8`

Result: PASS, exit 0. Existing compiler warnings remain; no new build error or
new cancellation/checkpoint warning was reported.

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `Debug/7520553_SMI_FW.elf` | 14,777,260 | `497063fda320ce6e87dd6f2036c79c08a3eaa5ed17500b5fb536b213ca74ffe6` |
| `Debug/7520553_SMI_FW.map` | 36,705,131 | `326e80a97bf571492230caebf896abdbd75162dcc3ad5b5812504d891618482e` |
| `Debug/7520553_SMI_FW.srec` | 8,688,298 | `2a634ea33275ca6d024ffb7ce0e12097d68093646604dbf310868d92454a9efb` |

## G2 adjudication

1. Chart/export seek work: PASS — direct range positioning uses six mirrored
   header reads and bounded request-window indexes/proofs.
2. Normal open/recovery: PASS — 459 headers and 6,632 blocks for normal open;
   the complete 66,000-header walk is reachable only through explicit recovery.
3. Correctness/mirror/visibility: PASS — cut-state, quorum, retirement, wrap,
   graph, and 30-day/90-day policy regressions all pass.
4. Maximum-geometry deterministic budgets: PASS — all stated work ceilings and
   host deterministic timing checks pass.
5. Safety/data-corruption contradictions: PASS — none observed. Powered SD-card
   removal remains prohibited and was neither requested nor simulated here.

M3 remains responsible for exact-candidate Release build evidence, Controller A
and Controller B target timing, same-run CID identity, physical wrap/reclaim,
approved whole-controller interruption, full recovery on Controller A, and the
accepted or narrowed supported claim.
