# HPT operator failure-message closeout

Status: complete
Type: evidence
Updated: 2026-08-11
Next Action: none for message behavior; retain the separate bounded-export latency ticket
Tickets:

- work/tickets/ticket-hpt-export-domain-failure-reasons.md
- work/tickets/ticket-offer-explicit-format-action-from-installed-unformatted-sd-notification.md

## Result

The six HPT export-domain reasons have distinct actionable messages, and HPT
initialization failures now replace generic `SD Error 900/901` text with the
confirmed failing phase, HPT status, SD driver status, and a safe recovery
path. The recovery directs the operator to service 468 before retrying and
states that controller power must be off before SD-card replacement.

The initialization progress screen opts into this mapping only after the
guarded request is accepted. At terminal error it double-reads the live
`S_HptMediaStatus` and rejects changed phase/status or a success status. A
failure therefore cannot borrow stale initialization evidence. The existing
export mapping retains its request-ID-bound double-read and both mappings use
the same established terminal progress navigation.

## Export message contract

| Domain reason | Operator correction |
| --- | --- |
| `RANGE_NOT_RETAINED` | choose a shorter or more recent range |
| `RETAINED_DATA_GAP` | report validation failure and no created file |
| `HPT_MEDIA_IO` | retry or service the SD card |
| `USB_IO` | check or replace the USB drive |
| `INVALID_REQUEST` | correct the requested date range |
| `EXPORT_CAPACITY` | choose a shorter range |

The static gate now asserts every message literal, not a representative
subset. The deterministic model covers all six reasons. Representative target
evidence in
`work/evidence/representative-ab-usb-publication-reader-verification-20260811.md`
also records a real `EXPORT_CAPACITY` terminal result with no USB publication,
followed by successful bounded A/B publications.

## Format action and negative-path contract

- The home notification offers Format only for installed, identified,
  representative-sector-readable media that the SD owner classifies as
  eligible for initialization.
- No-response and representative-read failure states receive no destructive
  action. The Renesas adapter queries and rejects driver write protection
  before the first write; this board has no electronic write-protect input.
- Format routes through the existing two explicit whole-card warnings. Cancel
  preserves the card and returns to Home.
- Prior Controller B evidence proves the CID-bound guarded success path,
  commissioning readback, reopen, and stable post-initialization status.
- A terminal failure now reports a named phase such as whole-card format,
  commissioning-record write/readback, or end verification, with both stored
  status codes and the recovery route.

Existing target evidence is retained in
`work/evidence/hpt-log-store-circular-mirror/pre-freeze-integration-20260725.md`
and the evidence linked from the Format ticket.

## Verification on 2026-08-11

- `script/check-hpt-commissioning.ps1`: `100/100` passed, followed by SD
  qualification lifecycle policy `16/16`.
- `script/check-hpt-customer-export.ps1`: `34/34` passed.
- `script/check-operator-warning-truth.ps1`: `17/17` plus the three-scenario
  warning transaction model passed.
- `script/test-hpt-customer-export-model.py`: passed all six reasons.
- Canonical managed Debug rebuild: passed.
- Canonical managed Release rebuild: passed.
- Explicit Debug and Release packaging: passed for stable and
  `7520553_SMI_FW_00_05_00` artifacts.
- All six stable/versioned artifact pairs match by SHA-256.

| Configuration | Artifact | SHA-256 |
| --- | --- | --- |
| Debug | ELF | `d25f9949161d3956b24ba8fcac0ddde1354914b723f54880b4a25c40b7cbee11` |
| Debug | S-record | `623a7817106cd4069138d1251d104c242d460bc81b1e62419c856ac1e4ff7d4c` |
| Debug | map | `78d13181d96a39568bb814d6bcc65194b2d9c4d13a843efee4f05ba8983e29dc` |
| Release | ELF | `99c222b4ac5e8e7e968cef4fc7b9360427e3e6bc26fdf8af402438f760aeaea9` |
| Release | S-record | `35541f47b4a000c5a5e5960b6fcf2cdf2cc1debd8cb0aefbe70d4d20fcaae525` |
| Release | map | `db5943e2453cd1ecab1f6c04b83a34935c3489b4748e7ef881d955b03f3f4dbb` |

The managed builds retain the repository's existing toolchain warnings; the
new HMI code introduced no build failure.

## Target-injection equivalence disposition

The remote qualifier has no admitted export-message or initialization-failure
injection profile. Direct controller/J-Link execution from this firmware
workspace is prohibited, and adding an unreviewed bypass solely to force a UI
literal would weaken the ownership boundary.

The remaining presentation risk is nevertheless closed without claiming an
unperformed injected target run:

1. reason/phase selection is deterministic and fully asserted by the host
   gates;
2. target evidence proves a real export-capacity terminal reason and the
   guarded initialization success/navigation path;
3. the general A/B visual/audio/touchscreen review is already accepted;
4. the unique strings reuse the established progress error screen and do not
   introduce a new layout or control path; and
5. live-state double-read guards cover stale warning/message risk.

This evidence supersedes the earlier requirement to inject every unique
message on target. It does not waive target injection for transport, media,
publication, durability, or recovery behavior; it applies only to reviewing
the deterministic operator text and its already-established navigation.
