# HPT2 M1 contract and current-candidate baseline — 2026-08-27

Status: pass
Type: evidence
Updated: 2026-08-27
Next Action: complete campaign 021 and derive M2 only after the roadmap gate advances
Campaign Reason: Historical record from campaign hpt2-approve-contract-and-baseline; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Project Map: work/maps/map-hpt2-qualification.md
Canonical Truth: docs/hpt2-qualification-contract.md

## Result

M1/G1 passes. The owner-approved contract now defines distinct timing and work
budgets plus the minimum sufficient geometry, workload, lifecycle, and final
physical-target matrix. The current firmware/model baseline is reproducible,
the applicable correctness/safety checks pass, and every material scaling
condition is classified below.

This M1 run was host/source only. It did not program a controller, initialize
or modify an SD card, operate a USB drive, deploy software, or perform a
physical intervention.

## Exact source identity

- Git HEAD: `0cd01909e141171c3b5ba9dd14c14969de8c4f64`.
- `src/HptTripleCircular.c`: `b0318ac09944b61158017bfbf72e5ee688db8b61aa41c3227ce55a533a1ff107`.
- `src/HptTripleCircular.h`: `97b030cf335b65051f91cc13a0e80abc60ac063f1b8e019be032efb58a0de220`.
- `src/Thread_SdCard_entry.c`: `9d7c5de39c8dd909d78d35277881fdff85bd7e37901e86e474c1aac3ba311c69`.
- `src/SdCardService.h`: `e680091dce5db816ae8775ab5a2b3b165b6a85191dde64a4c2a746d1c322da4c`.
- Instrumented triple model: `39d56372d813d145a0da7680ac7270a1861e5aa5c7dd755ba02bf59d30b96682`.
- Instrumented export model: `bf5135ac0970ee4b601ef2a7f937d41146ab0a1576f4533c412ff1613511db35`.
- Instrumented graph model: `e3faa4ff1aedfbbf7a1aaaa17d6557488078a6709870fde66367ad1cf5dcb6ba`.

The repository contained unrelated pre-existing owner changes. The firmware
baseline is therefore bound to the exact file hashes above rather than claimed
as a clean immutable release candidate.

## Reproduction commands and observed baseline

All commands ran from the repository root on 2026-08-27.

### Triple-circular geometry and work

Command: `python script/test-hpt-triple-circular-model.py`

- PASS: capacity, quorum, stale-slot sentinel, retirement, loss, more than
  three wraps, split-lane cursor, bulk parity, bounded exact reads, and durable
  range envelopes.
- Minimum: 140 segments/lane; 142,560 required slots/lane; 1,023
  records/segment.
- Maximum implementation bound: 11,000 segments/lane and 11,253,000
  slots/lane.
- Current normal-open maximum: 66,000 segment-header sector reads.
- Current oldest-to-last-segment iterator seek maximum: 65,994
  segment-header sector reads.
- Split-lane scalar/bulk commands: 4,772/150, a 31.81x command reduction.
- Active exact-read header probes: 1.
- Range-index entries/lane: 146; ordinary proof records: 4,092.

### Million-record bounded export

Command: `python script/test-hpt-customer-export-model.py`

- PASS: full-visible-window oracle parity, bounded lookup, timestamp disorder,
  gaps, capacity, and health reporting.
- Ordinary ten-minute case: 50.755 ms host-model range plan, one candidate
  segment, 1,552 proof records, 11 selected records.
- Full visible-window oracle: 38.487 ms host observation.
- Forward/backward timestamp-adjusted case: 48.214 ms range plan, two candidate
  segments, 3,598 proof records.
- Both proof counts are below the approved 8,192-record ceiling. Host timings
  are regression observations and do not substitute for target/media timing.

### Graph cache

Command: `python script/test-hpt-graph-cache-model.py`

- PASS: rolling-cache lifecycle and visible-floor behavior.
- Cache points: 535,681; visible record ceiling: 142,560.
- Host-model elapsed: 133.488 ms.

### Static correctness and safety checks

- `pwsh -NoProfile -File script/check-export-range-policy.ps1` — 26/26 PASS.
- `pwsh -NoProfile -File script/check-hpt-customer-export.ps1` — 40/40 PASS.
- `pwsh -NoProfile -File script/check-hpt-commissioning.ps1` — 100/100 HPT
  commissioning checks plus 16/16 SD lifecycle-policy checks PASS.

## Scaling and proof classification

| Surface | Baseline | M1 classification | M2 implication |
| --- | --- | --- | --- |
| Ten-minute export range planning and proof | 1,552 ordinary and 3,598 adjusted proof records; fixed 146-entry/lane index | Bounded | Preserve and verify at maximum geometry |
| Graph retained window | Fixed 142,560-record visible ceiling | Bounded by customer window | Prove target timing and header-seek work |
| Active-prefix exact read | One mirrored-header probe/lane independent of active segment | Bounded | Regression only |
| Normal open/recovery | Up to 66,000 header-sector reads at implementation maximum | Core-claim blocking | Normal open must meet the 512-header/8,192-block work budget; full scan becomes explicit fallback only |
| Iterator positioning to a late indexed range | Up to 65,994 header-sector reads before requested records | Core-claim blocking | Position directly from approved range state or otherwise meet the header-work budget |
| 30-day/90-day export row processing | Prior target observations are approximately 200–224 s near 142,560 rows | Bounded by selected rows; target budget proof pending | Verify 180 s/300 s totals on the exact candidate; optimize only if measured failure occurs |
| Append/read service | Prior A evidence observed at most 28/28 ticks (280 ms) with positive controller progress | Bounded in representative evidence; maximum/concurrent proof pending | Verify 0.50 s ordinary and 2.0 s stressed budgets |
| Cancellation and return-to-usable | Static cancellation paths pass; exact target latency not measured | Core verification gap, not a proven defect | Measure 2.0 s terminal cancellation and 5.0 s usable-state budgets |
| Historical exact-read fallback | Historical segment walk remains outside active-prefix fast path | Later work unless a core profile invokes it | Do not optimize speculatively; promote only on measured core-path use/failure |

## G1 adjudication

1. Budgets and minimum matrix: PASS — exact approved contract is
   `docs/hpt2-qualification-contract.md`.
2. Reproducible elapsed/work baseline: PASS — commands, file hashes, elapsed
   observations, and work counters are recorded above.
3. Correctness and safety invariants: PASS — all six focused model/static
   command surfaces passed; no contradiction was observed.
4. Bottleneck classification: PASS — normal open and late iterator positioning
   are the two core-claim blockers; cancellation is a proof gap; historical
   exact-read breadth is later work; other measured paths are bounded or await
   exact-target timing proof.

M1 does not approve a specific M2 architecture. M2 must make the smallest
change justified by the two measured core blockers and rerun this baseline.
