# Pi HPT2 unchanged-firmware runtime evidence deployment — 2026-08-05

Status: pass; S5 and S6 runtime evidence producers deployed without changing the firmware image
Type: evidence
Updated: 2026-08-05
Next Action: use successor map-parser release `hpt2-runtime-map-6dc1c3c` for controlled Controller A S4-S6 collection
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md
Canonical Truth: docs/hpt2-measurement-matrix-v1.md

## Result

Deployment note: this producer implementation remains the design baseline, but
the deployed runtime image is now superseded by commit `6dc1c3c`, which accepts
the exact GNU map's section-owned `gHptQualification` form. See
`work/evidence/controller-a-hpt2-s5-runtime-evidence-first-pass-20260805.md`.

The remaining S5 production-queue and S6 segment-transition/reclaim evidence
paths are implemented and deployed without rebuilding or reprogramming
firmware. The observer resolves only these existing symbols from the exact
bundle-contained Release map:

- `gSdLogRecordsCompleted`, `gSdLogRecordsDropped`, and
  `gSdLogRecordsQueued` as one reviewed contiguous counter block;
- `gHptQualification` with exact size `0xA4A0`, using the established HPT v0.5.0
  store sequence, health, and three-lane offsets.

The map artifact SHA-256 is verified against the immutable diagnostic mapping
before any address is accepted. Every runtime block and the HPT2 status are
read twice in one read-only J-Link session and must be byte-identical. No
arbitrary address, halt, reset, function call, write, retry, or replay is added.

S5 requires real queued/completed production-log progress over the admitted run,
empty queue boundaries, equal queued/completed deltas, and zero drop/loss.
S6 transition/reclaim credit requires exactly one profile-owned append, proven
by the store sequence delta, plus the exact lane transition; retained-oldest
advancement distinguishes reclaim. Any extra append or unstable state fails
closed.

This preserves firmware bundle
`smi-00-05-00-52edddc39e30-054d5386ad9d-release`, its profile/mapping hashes,
and all 35 existing Controller A S0-S3 adjudications.

## Exact deployment

- Pi source commit: `9d7e0f0584fd2589ba7a823d462f7ddce6e9023b`.
- Release identity: `hpt2-runtime-9d7e0f0`.
- Image: `sha256:24bb34397ca2099caf44c9e6e19dfb28cb437a367e489a97e179f50a017869ee`.
- Release manifest SHA-256:
  `ff94d00c42ccdb157d43246ca97c9214f04db2c194ff67070d87f0b8f0d21c2e`.
- Exact-image tests: `210/210` passed in `45.614 s`.
- Backup: `/backups/sd-qualifier-20260805T222327Z.dump`.
- Isolated restore check, migration check, storage preflight, package hashes,
  web health, and both workers passed.
- Default firewall still drops non-loopback ports `19120` and `19121`; no
  controller tool container remained.

## Live audit

No target was accessed and no new campaign evidence was created. The live audit
therefore correctly remains A S0 `3/3`, S1 `12/10`, S2 `11/10`, S3 `12/10`,
S4-S6 zero, A-local gate false, B disabled, matrix false, and
`stop_deadline_ms=null`.
