# Controller A bounded wrap/interruption harness software gate

Status: passed; Controller A accelerated wrap and visible USB publication passed
Type: evidence
Updated: 2026-07-23
Next Action: implement and arm the first boundary-specific physical interruption
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone

## Frozen candidate

- Source commit: `dff3f478d3b47b8211a2fd8e24a83806c17da9a4`
- Debug SREC SHA-256:
  `48259DAC09342662A24E15E298C2BD1FD502370DC5404E42A2420ACFF0D13BAD`
- Debug ELF SHA-256:
  `C121C124D6A775016E5EE660081FD32E2EFA9E7533E2655498BE21438A4877AE`
- Release SREC SHA-256:
  `63F9E4E5ED78B48C60B7E99E5C4EF0986580E6C375AA983B13B7C674C766D4F3`
- Release ELF SHA-256:
  `F2E7122935881ED19B86118CD1F9AA5EBB5BBB0AC074597C62D4DCFE739E4504`

## Harness

The raw format has an explicit qualification-media feature bit. Production
`HptTripleCircularOpen` rejects that bit. The engineering diagnostic uses an
exact RAM magic command, two real 2,048-sector segments per lane, and eight
records per segment. Its fixed 64-record limit forces seven segment advances
per lane, which exceeds three complete logical ring wraps while retaining the
production block layout, data/commit ordering, header/seal writes, reclaim,
reopen, quorum read, iterator, and export-compatible `S_LogRecord` payload.
It then runs the production raw customer-export scanner over the retained
wrapped window, requires a complete staged result with exact counts/ranges and
zero gaps, and suppresses the USB publication handoff.

The public status reports progress, append/read counts, gaps, lane segment
generations, retained sequence range, timestamps, latency, stack margin, and
controller/HMI scheduling progress. A separate cancel magic is checked between
records. Failure is terminal and leaves raw logging disabled.

## Software results

- Exhaustive old/new/flush durability model: `141` cut states passed
  - format: `45`
  - ordinary append: `27`
  - reclaim append: `63`
  - retirement snapshot: `6`
- HPT commissioning/source invariants: `62/62`
- Existing triple-circular model: pass
- Existing customer-export model: pass
- SD safety invariants: `20/20`
- Qualified isolated Debug build/package: pass
- Qualified isolated Release build/package: pass
- Qualified GCC direct core compile with warnings-as-errors: pass
- Internal S7G2 RAM headroom: `135,280` bytes
  (`312` bytes less than the prior `135,592`-byte candidate)
- New static wrap status: `208` bytes; no heap allocation added

Target execution will measure append/reopen/read latency, SD-thread stack
high-water, and scheduling progress. Host/model results do not claim controller
qualification.

## Programming attempt

J-Link Commander V8.10a and V9.58 were both directed at serial `69664082`.
Neither found a connected SEGGER USB device; Windows also reported no present
J-Link/SEGGER PnP device. Every connect command failed before halt/load, so no
flash or target state was changed. Programming remains pending.

## Correct remote programming

The local-USB attempt was the wrong route. The established connector is the
serial-bound SEGGER Remote Server on `srv-rpi00`, reached only through an
authenticated SSH forward to `127.0.0.1:19120`. The hub inventory reported:

- service `jlink-remote@jlink-69664082`: active;
- serial: `69664082`;
- product: J-Link Plus;
- direct Pi USB sysfs location: `3-2`;
- remote port: `19120`.

The repository's guarded `program-bench.ps1` verified the exact Debug S-record
hash before opening that tunnel. Windows J-Link V9.58 connected to serial
`69664082`, reported `VTref=3.285 V`, identified `R7FS7G27H`, and completed
Program & Verify `O.K.`. It reset and resumed Controller A.

The post-load read-only capture found raw HPT ready, HPT/SSP/first-error
`0/0/0`, lane mask `0x7`, retirements `2/1/0`, USB/export idle, and both wrap
command and status zero.

## Accelerated Controller A result

RAM command `0x48575250` ran once and cleared itself to zero. Terminal status
was `PASSED` with:

- media generation: `4`;
- qualification geometry: two 2,048-sector segments per lane, eight records
  per segment;
- planned/appended records: `64/64`;
- segment generations A/B/C: `8/8/8`;
- retained/read range: sequences `49–64`;
- read records: `16`, all healthy, zero degraded, zero gaps;
- staged export snapshot: sequences `49–64`;
- export scanned/selected/healthy: `16/16/16`;
- export degraded/snapshot gaps/requested gaps: `0/0/0`;
- maximum append latency: `44` ThreadX ticks;
- reopen/readback latency: `3/8` ticks;
- total diagnostic time: `182` ticks;
- SD-thread stack used/free: `2,588/1,508` bytes;
- Controller thread run-count delta: `4`;
- first failure step and HPT status: `0/0`.

The staged export deliberately suppressed the USB handoff. A later read-only
capture found the normal acknowledged-record counter advanced from `64` to
`65`, last lane mask `0x7`, and no storage error, proving ordinary minute
logging resumed after the accelerated run.

This proves physical Controller A wrap, reopen, ordered readback, raw export
staging across the segment boundary, stack margin, and continued logging. It
does not yet prove physical interruption recovery.

## Visible USB publication and range rejection

The owner requested and completed a visible ten-minute export after the
accelerated wrap. Host read-only inspection of the FAT32 USB stick found:

- finalized file:
  `SMI6_07162026_20260723t1228-20260723t1238.csv`;
- file length: `1,136` bytes;
- SHA-256:
  `EB3D6466156DA81C1B984CDE20E747A52F32EDB92B392673D8CFD35C0481B056`;
- requested HPT timestamps: `301580908–301581514`;
- snapshot sequences: `49–102`;
- actual sequences: `93–102`;
- 10 ordered records at one-minute intervals, all healthy and zero degraded;
- 40 gaps before the requested range and zero requested-range gaps;
- `Snapshot validation: COMPLETE`; and
- `Export completion: COMPLETE; records published: 10`.

The owner then requested thirty minutes while the accelerated qualification
geometry retained only 16 records. The controller reported the visible generic
copy error. A live read-only capture before USB removal showed:

- export state `HPT_EXPORT_FAILED`;
- `HptStatus = HPT_STATUS_CORRUPT`, USB status zero;
- requested HPT timestamps `301579681–301581549`;
- first failure sequence 49;
- one record scanned, zero selected;
- 40 snapshot and requested-range gaps;
- HPT media still ready with HPT/SSP/first-sector errors `0/0/0`; and
- normal minute logging continuing.

Host inspection found no finalized file for that thirty-minute interval and no
`HPTE.TMP`, `.tmp`, `.part`, or other partial file anywhere on the USB stick.
This proves complete-or-fail publication and confirms that the ten-minute
visible export succeeded across the wrapped retained window. The thirty-minute
failure is an expected out-of-retention condition on the deliberately tiny
qualification geometry, not evidence of a card or USB error. Its misleading
customer message is scoped separately in
`work/spikes/spike-clarify-hpt-export-retention-range-messaging.md`.
