# HPT pre-initialization full-address scrub software gate — 2026-08-04

Status: passed software-only; physical qualification not run
Type: evidence
Updated: 2026-08-04
Next Action: review and freeze a new immutable firmware bundle and Pi campaign binding before any separately authorized programming or controller operation
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-hpt-bounded-full-address-read-scrub.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Scope

Resume the preserved `F1-A1` first-failure checkpoint without replaying operation
`e36882de-ebf5-4b35-93ef-698e352a553c`. Correct the firmware method so the
bounded, read-only full-address scrub can run while a CID-valid,
representative-sector-readable card is still `NEEDS_INITIALIZATION`.

No controller was contacted or programmed. No SD card was initialized, read,
written, inserted, removed, or otherwise operated during this software gate.
The last verified physical state remains the prior checkpoint; fresh
boot-relevant service-467/equivalent CID evidence is mandatory before any new
operation.

## Implemented boundary

- A pre-initialization scrub opens its own bounded raw block-media session
  through the existing SD-owner qualification adapter and closes only that
  session on pass, failure, or cancellation.
- A scrub on initialized HPT media continues to borrow the existing open HPT
  session and does not close or replace it.
- The pre-initialization path accepts only an unavailable FileX/HPT store that
  is classified `NEEDS_INITIALIZATION`, has valid CID and representative-sector
  evidence, and is in an explicitly initialization-eligible media state.
- CID is copied before raw-session acquisition, recaptured and compared after
  acquisition, pinned for the run, and recaptured again before a scrub-owned
  session is closed.
- The scrub path contains no write, format, discard, repair, or initialization
  call. Existing bounded slices, retry accounting, failure budget, cancellation,
  and competing-diagnostic gates remain in force.
- Background card reclassification is inhibited while the pre-initialization
  scrub is running.
- The public Pi/J-Link ABI remains unchanged in both builds:
  `gHptFullAddressScrubCommand` at `0x20055F80` with size `0x04`, and
  `gHptFullAddressScrubStatus` at `0x20055F90` with size `0x68`.

## Verification

Base commit: `48181bd31c769addf9c1c825982e31d0b1ad62a0`

- `script/check-hpt-full-address-scrub.ps1`: `12/12` passed.
- `script/test-hpt-full-address-scrub-model.py`: passed.
- `script/check-hpt-commissioning.ps1`: `95/95` passed.
- `script/check-sd-qualification-lifecycle-policy.ps1`: `16/16` passed.
- Canonical managed Debug rebuild: passed.
- Canonical managed Release rebuild: passed.
- Builds emitted existing repository warning classes and no build error.

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `src/Thread_SdCard_entry.c` | 265964 | `1c19088f56f4ca1d51d5455201761f4bd81a2282ce6bb8e36050f93fcd0f8137` |
| `script/check-hpt-full-address-scrub.ps1` | 4400 | `883f8b7c250a2ea695d23c7dc49c031c130a10fd2bd78633e15292e67ab2dd01` |
| `Debug/7520553_SMI_FW.elf` | 14728108 | `93bdb79b44c66659d036a22c7732d272f120f18bbdc58b08e911c28d04bc2ff3` |
| `Debug/7520553_SMI_FW.map` | 36697779 | `c3f50593feda32b1b2b1562989f13b85549c522bff3fd68a3ea04ee979ade4e9` |
| `Debug/7520553_SMI_FW.srec` | 8658458 | `8b6be42308bb0531edf7c510a427fe1038d35ab6cf402761d91d13dfdfa03fb7` |
| `Release/7520553_SMI_FW.elf` | 11394340 | `10840281efd9fc53b0e42447f2af241ea2e4140d09a96b89c254c41ad4cacb78` |
| `Release/7520553_SMI_FW.map` | 5452850 | `c09670bb4039d5da0f470b031cdb1e1aa2cb141f01f4c5839e373d5f55c8104c` |
| `Release/7520553_SMI_FW.srec` | 8658458 | `404826a5be8e318683157e838595cd82ae8cb36b6222115e707ef3debc99baf5` |

GNU size for each current Debug and Release ELF is `text=2886124`, `data=0`,
`bss=28679144`, `total=31565268`. These unversioned build outputs are software
gate inputs only; they are not an immutable candidate bundle or release.

## Remaining gate

The source correction is not physical proof. Preserve the prior failed
operation and do not replay it. Before another baseline scrub, create and
review a new immutable firmware bundle, update the exact Pi mapping/campaign
binding even though the public addresses remain stable, obtain separate
programming/operation authorization, and capture a fresh complete CID identity
block after the relevant boot.
