# HPT2 exact-read active-prefix software gate — 2026-08-10

Status: complete; software/model/static/build/package, A/B target scaling, and all six protected 129600 observations passed
Type: evidence
Updated: 2026-08-11
Next Action: none for exact-read occupancy scaling; retain with frozen-candidate evidence
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-eliminate-hpt2-exact-read-scaling.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Disposition

The shared firmware cause of the increasing HPT2 endurance duration has a
bounded software correction and a frozen candidate. Source, model/static,
managed build, ABI, and package integrity passed. The exact candidate was then
programmed on Controllers A and B through the protected qualifier route without
powered SD-card removal, and post-program flash, boot, CID, and HPT readiness
checks passed on both controllers.

The old slow observations were stopped cleanly and preserved without being
credited as exact S4 cases. A successor campaign retains the same two physical
cards and records explicit firmware-change continuity evidence. Live 10081 and
44640-record observations are measuring target correctness and rate before the
protected 129600 admission hold is changed. This is not yet final SD-card or
production-release qualification.

## Cause and correction

`tc_read_copy()` previously searched physical segment zero through the active
segment for every exact read on every lane. The endurance profile appends one
record and immediately reads that same sequence, so header-read work grew with
the active physical segment and cumulative run duration trended approximately
quadratically.

The corrected route recognizes sequences in the committed active prefix using
the lane's in-memory `active_first_sequence` and `active_records`. Before
reading the exact slot, it reads the mirrored segment header and requires the
on-media generation and first sequence to match active lane state. Retired,
corrupt, missing, or generation-mismatched active state returns no valid copy;
it does not fall through to stale history. Sequences outside the active prefix
retain the prior historical scan, retired-segment exclusion, exact slot CRC and
commit checks, and three-lane voting.

The media format, profile ABI, record layout, and voting policy are unchanged.
The pristine vendored portable snapshot was not modified; the correction is in
the product-integrated Renesas implementation `src/HptTripleCircular.c`.

## Structural I/O bound

For the append/same-sequence route, each lane now performs one mirrored-header
probe plus one data/commit slot read, independent of the active physical
segment. That is 12 scalar block reads over three lanes: two header copies and
two slot blocks per lane.

With no retired segments, the former route required:

| Sequence | Active segment index | Former exact-read block reads | Corrected block reads | Structural reduction |
| ---: | ---: | ---: | ---: | ---: |
| 44,640 | 43 | 270 | 12 | 22.5x |
| 129,600 | 126 | 768 | 12 | 64x |

This proves that lookup I/O count no longer grows with active segment number.
Measured controller time and end-to-end correctness remain target gates.

## Source and tests

Reviewed files:

| File | Bytes | SHA-256 |
| --- | ---: | --- |
| `src/HptTripleCircular.c` | 54,616 | `483756ee73a6d37b7c707beaef44c370b9fbf4340a5d3b88e15b3f9449525ad4` |
| `script/check-hpt-commissioning.ps1` | 22,712 | `72a376aedea5e626bac3e83cfe348212ae8fd348641eb900d2c2d30c29e200aa` |
| `script/test-hpt-triple-circular-model.py` | 16,360 | `60dde5d04863fd7d485ed000573afcd80a236b12f201869c1a56a2fdf821b143` |

Results:

- triple-circular model: pass, including active physical index 139, first,
  active, transitioned, reclaimed/wrapped, retired, historical, missing,
  corrupt-header, stale-generation, and divergent-lane cases;
- HPT commissioning static/lifecycle gate: `98/98` plus `16/16` lifecycle
  policy checks;
- HPT2 endurance profile static gate: pass;
- HPT2 workload/mailbox model: `17/17` pass.

## Canonical managed builds

Both builds used the repository's managed wrapper and GCC Arm Embedded
10.3.1 under e2 studio 2024-01.1 / SSP 2.6.1.

```powershell
.\script\vscode-e2-build.ps1 -Action Rebuild -Configuration Debug -Jobs 8
.\script\vscode-e2-build.ps1 -Action Rebuild -Configuration Release -Jobs 8
```

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `Debug/7520553_SMI_FW.elf` | 14,742,228 | `97fc598feafd6a9e6a82d0076fb52d31fb4eed85e9e28af4e826a119e8b74577` |
| `Debug/7520553_SMI_FW.srec` | 8,665,226 | `973b2ff9d9f1e2a4077e028fa6a1fe1401a98c01c3dccd576bf2f897d4aaecf9` |
| `Release/7520553_SMI_FW.elf` | 11,406,596 | `88e9654ff2bfa4cff1c3801978558a95cbd94421043550206112ca2da0c4b1d2` |
| `Release/7520553_SMI_FW.map` | 5,456,100 | `fe14ca7bb4a7d7f355a65a9134b0c892cce002c8fd1578b83a8f2a6105d3d552` |
| `Release/7520553_SMI_FW.srec` | 8,665,226 | `37ff5c0c6f48576396c8ef3807aae9c8f1ddab742a72c47a4c1055454da906f0` |

The integrated `HptTripleCircular.o` is present in both managed build trees.
The build output contains the project's existing SSP/application warning set;
no new error or warning was attributed to the corrected source.

## Frozen package

- Bundle: `smi-00-05-00-389167c1d57f-37ff5c0c6f48-release`.
- Local immutable directory:
  `tmp/candidate-bundles/smi-00-05-00-389167c1d57f-37ff5c0c6f48-release`.
- Base commit: `77be6e40e87ed6ed45b19b8bc548a550443be265`.
- Reviewed source snapshot SHA-256:
  `389167c1d57f5d14228901c7e9c4acc9b81827fe03f091f6b35b1d764a91ed28`.
- Bundle manifest SHA-256:
  `d5970e8d4eadab9a3170a891a19f0209ad77e7184a9b7b3b9d2fa5ab38e17ff6`.
- Diagnostic mapping SHA-256:
  `09abfe84c59c8c83abe0154217087464b98cb65abc6e1417e2f04cf4026a8b0d`.
- Profile SHA-256:
  `b0d5247f4c2de03b02ab57c5748920a606d4b37cba61b82aeb065777f10fa0e8`.
- Package declaration: seven files; every member size/hash validated; required
  firmware observation and command/status ABI symbols validated.
- Live admission in packaged profile: `false`.

## Protected target deployment

- Successor campaign:
  `8c7a2b1a-7e67-48ac-8895-7999d76c4c2a`.
- Controller A programming operation:
  `555bfb0a-16c5-4197-a161-f38c25f6d951` — pass.
- Controller B programming operation:
  `303144a9-6e7a-464b-85b8-0c9119f24e95` — pass.
- Candidate code-flash hash:
  `685fb3151cb4118f0a5d53a68eceb20e31c9c18b1ad2b7d0b9054f7151b6c86b`.
- Controller A post-program observer:
  `12175727-ee96-4c6a-be8b-0e133f32c614` — pass; CID
  `05000C61736466672200001C8901A34F`.
- Controller B post-program observer:
  `a265c754-7ddc-47ce-84b9-523ba76ae4e6` — pass; CID
  `05000C61736466672200001C8201A379`.
- Both observers reported exact flash identity, HPT state 5 ready, lane mask 7,
  zero mismatch/loss/retirement/replacement counters, and zero system errors.
- VEEPROM and option memory were unchanged; both CPUs returned to running.

The Pi qualifier continuity/admission correction is commit
`e24fce3ef08e1073faf379126f428472e555db32`, deployed as release
`hpt2-continuity-e24fce3`, image
`sha256:a970a841365f7d9b2a698ce04ee243f5ca6947087431cd237f570d05564acf93`.
It permits an exact-CID, media-format-preserving firmware change to satisfy the
redundant B baseline/initialization gates while retaining role-scoped evidence
and the protected maximum-target admission policy. Focused tests passed 7/7;
the mailbox and parallelization suite passed 69/69 with an isolated evidence
root. Deployment backup, restore check, service health, and closed-default
firewall checks passed.

## Live target proof

Controller A run `a63f5aa2-0485-4399-a77e-c35501a0d86f` completed 10081
records cleanly at approximately 31.9 verified records/s. Controller B run
`720c7451-7ad7-48dc-8097-793ddcfe49c0` completed 10081 records cleanly and
received immutable S4 credit for 10080 AFTER. Both reported equal
attempted/committed/verified counts, a passing bounded stop, no hidden media
operation, and no controller errors.

The 44640-record proof runs are:

- Controller A: `0a348620-7bd4-49ac-888c-809361f6beff` — completed
  cleanly with 44641 attempted/committed/verified records, checkpoint 4,
  terminal reason zero, terminal proof 31, and two stable terminal
  observations. Result evidence 6591 and extended adjudication evidence 6593
  were returned; total admitted-run elapsed time was 1464 seconds.
- Controller B: `cd2a3f22-4696-431f-a40f-95bc2f6418ba` — completed
  cleanly with the same 44641 attempted/committed/verified records, checkpoint
  4, terminal reason zero, terminal proof 31, and two stable terminal
  observations. Result evidence 6616 and extended adjudication evidence 6618
  were returned; total admitted-run elapsed time was 1462 seconds.

The joint A/B review passed. Both controllers returned the same exact counters,
terminal fields, clean bounded stop, and absence of hidden media operations.
The protected admission setting was therefore changed from 44640 to 129600.

A guarded admission watcher performs that review without an operator or web-UI
handoff delay. It requires both proof-run services to exit successfully, asserts
the exact immutable counters and terminal fields for A and B, archives the
protected 44640 configuration, atomically installs the reviewed 129600 setting,
restarts and health-checks the affected appliance services, verifies the live
admission decision, and starts a coordinated A/B final matrix. Any failure after
the setting change restores the archived configuration and services. The final
matrix sequences 129600 BEFORE, AT, and AFTER for both controllers, starts A
first for each phase, and waits for the reviewed A proving window before B
admission.

Final status polling is 20 seconds rather than 10 seconds. This halves the
short-lived adapter-container and Pi load while retaining the independent
30-second supervisors and adding at most about 10 seconds of detection latency
at a boundary.

The policy deployment passed Compose validation, recreated the web, command,
notification, and watchdog services, returned HTTP 200 health, confirmed live
129600 admission, and left the controller-access firewall closed by default.
The archived prior policy is
`s4-admission-policy-2167623-compose.override.yaml.pre-129600-20260810T191730Z`.
The coordinated final matrix started at 2026-08-10 12:31:49 PDT. Its first runs
are Controller A `b845aa18-b6b1-4fb8-966c-d2972fc41700` and Controller B
`ecc46ce8-3f81-4892-8160-35962d553797`, both for 129600 BEFORE.

Both 129600 BEFORE runs subsequently reached their exact 129599-record hold,
published one STOP each, returned two stable stopped observations, completed
base and extended adjudication, and left no unresolved command operation. The
coordinator then started the 129600 AT pair: Controller A
`3cb00eed-c511-408d-8f04-1df5f49bf605` and Controller B
`2bfdc54b-91c7-48df-8c7f-5da6c0702d17`. Both demonstrated immediate monotonic
progress with terminal reason zero.

During the BEFORE pair, transient read-only supervisor captures sometimes
returned exit code 1 and systemd restarted the observer. Persisted snapshot
coverage remained HEALTHY: measured maximum gaps stayed below 96 seconds in
the first observation window and below 59 seconds in the next, versus the
600-second progress threshold and ten-minute lease. Diagnostic commit
`f9c7bff` records the exact failing command without changing retry, controller,
or publication behavior. It attributed recurrences to the ephemeral
`capture_qualification_supervisor_snapshot` invocation. At the AT transition,
both observers restarted normally for the new run identities, remained active,
and had zero restart count.

At the AFTER transition, the watchdog emitted transient `RUN_BLOCKED`
notifications while the new run identities were still acquiring their first
three-plane snapshots. For Controller B run
`4ecb8abc-4d9c-4aad-93ba-3b9ea614c163`, notification 225 reported no snapshot
at 2026-08-10 14:58:31 PDT; the first healthy B snapshot was persisted at
14:59:43 PDT and the notification closed automatically. Notification 226 then
reported a regressed heartbeat during the same run-identity transition and
also closed automatically. At 15:02:14 PDT the B supervisor state was HEALTHY,
its observation lease extended through 15:12:14 PDT, and no `RUN_BLOCKED`
notification remained open. Controller A was likewise HEALTHY with a valid
lease. Both controller runs continued monotonically at the corrected rate.
This is evidence of a watchdog startup-transition false intervention, not a
controller stop or loss of qualification evidence; it requires a follow-up
grace/baseline correction after the protected matrix completes.

## Recovery qualification status on 2026-08-11

The coordinated A/B 129600 BEFORE, AT, and AFTER matrix passed all six exact
immutable result checks. Controller A then completed four of the five required
interrupted-session recovery cases with immutable PASS evidence:

- `DISCONNECT_BEFORE_PUBLICATION`: run
  `be2ad1c1-cc27-4f59-9f76-e1e5a66aced1`, evidence 7310.
- `DISCONNECT_AFTER_PUBLICATION_BEFORE_ACKNOWLEDGEMENT`: run
  `683f62ae-e1be-4317-83e5-b224674314c6`; the one Start publication was
  reconciled read-only with no replay after one transient seqlock capture
  failure.
- `DISCONNECT_AFTER_ACKNOWLEDGEMENT_BEFORE_TERMINAL_OBSERVATION`: run
  `b106a085-26db-4d48-a8bd-c204b3b4bfdd`, recovery evidence 7394 and
  interruption-checkpoint evidence 7390.
- `APPLICATION_RESTART_DURING_UNRESOLVED_OPERATION`: run
  `a07566ad-0934-4ff2-9c08-d734747f71be`.

Application commit `dff86854b4ef61d84e972552399266ace6770425` and operations
commit `2b42a86e7a48d39729c134634786da6d516470e5` contain the qualification
corrections found by these cases. The authoritative Django suite passes 326/326.
The live appliance release is `qualification-recovery-dff8685`, image
`sha256:07236924fb4856502e859013ab1847ef6aa2bf8ab4274ed23da8ac502551dec1`,
with protected deployment manifest
`1c83e9ae4d40b9e0efe1d0b76ffa7e4105d729604e2ce750bfd7b78d5e0fa575`.

The fifth case is not credited. Controller A run
`84eb4aea-10e6-4854-94ca-3df005d7117c` entered the coordinated power-cycle
case with one acknowledged Start. Power-control operation
`52680b01-921a-425e-ae66-a1fcde05699e` completed J-Link off, plug off, the
30-second power-down, plug on, and J-Link on, but returned
`verification_failed`: the long-lived serial-bound Remote Server did not
reattach to J-Link 69664082 after USB power returned. The failed result is
preserved and is not accepted as qualified power-cycle evidence.

Restarting only `jlink-remote@jlink-69664082.service` restored read-only SWD
access without another controller power action. Delayed observations
`0cd23564-0211-47eb-a13a-c910fdb11403` and
`eab741b1-eba9-4c57-9274-9bf8d962b46d` proved the same raw CID
`05000C61736466672200001C8901A34F`, valid representative-sector access,
healthy HPT media, and fresh boot witness `614E121268473248`. Firmware source
defines post-boot HPT2 state 0 as `HPT2_ENDURANCE_BASELINE_IDLE`; the qualifier
now checks that exact state instead of the incorrect START_PENDING value 1.

## Remaining protected gate

The J-Link lifecycle correction is firmware-workspace commit
`f03051f8`. The installed exact-serial supervisor hashes are
`fe469d705ae079186a8898910ab8f6f9930784ea87691a32e99f92efd4f99f0a`
for `hublib.py` and
`9d56041ff807cc8d98a005a3553c5be57d959579e64cf1610f3215f86cd17a5a`
for `remote_server.py`. Local and Pi-native unit suites pass 7/7. Only the A
service was restarted; Controller B's J-Link service retained PID 1093 and its
2026-08-04 start time. A host check and bounded SWD check both passed after
deployment.

Operations commit `bea67ad2aa3c48830d9fe93aa6ee106fa36af246` adds a
non-replaying Case 5 resume gate, preserves full power-verifier detail, refuses
to overwrite an existing power result, and uses a distinct path for an
authorized retry. The resume gate passed for run
`84eb4aea-10e6-4854-94ca-3df005d7117c` and its one acknowledged Start.

The retry runner then correctly stopped before power. The first physical cycle
had already rebooted the controller into HPT2 IDLE, so the controller no longer
bound the admitted active-run identity. Every new supervisor capture failed
with `The HPT2 status no longer binds the admitted run identity.` The runner
exhausted its bounded health gate and exited status 1. No retry result file was
created, no second power operation was submitted, the observer and temporary
firewall rule were removed, and the user's one newly authorized cycle remains
unused.

The remaining scientifically valid routes require a new operator decision:

- admit a fresh exact S6 run, publish one new Start under a new authorization
  envelope, then spend the one authorized coordinated A cycle while the target
  proves that run identity; or
- define and review a composite delayed-verification policy for the already
  completed physical cycle. Its physical off/on stages and fresh boot/CID/HPT
  recovery passed, but its immutable power-service result remains
  `verification_failed` and must not be silently reclassified.

After five recovery PASS records, run the final recovery gate and continue to
representative regression. Until those gates pass, the candidate must not be
treated as a production firmware release.

## Fresh Case 5 qualification result on 2026-08-11

The operator approved the first route above for Controller A only. The stale
run `84eb4aea-10e6-4854-94ca-3df005d7117c` was closed as `BLOCKED` with
terminal reason `hpt2-power-cycle-verification-failed` and immutable INVALID
evidence 7424; that closeout does not count as a card failure and does not
rewrite the original failed power result.

Application commit `e86e9e2103691152038c68ff6cfbb4f680e8f6aa` releases an
acknowledged HPT2 session lock only after the exact audited invalid-cycle
closeout, same campaign/controller/CID proof, and a different current boot
witness. Unsafe unclosed sessions remain blocked. The focused session tests
pass, and all 327 application tests pass across the authoritative suite plus
the two evidence-write tests rerun with writable evidence storage. Operations
commit `1d34252f15eecadcadd09fbd8d2150aacb86fe9e` safely reuses a freshly
admitted run that has no operation instead of attempting duplicate admission.

Before deployment, database backup
`/backups/sd-qualifier-20260811T123713Z.dump` was restore-checked and bound by
SHA-256
`0e1c21606a58a57ae388e3555a38a15a73ccf1c4e0d4ee4a7c8cfb25e911ef8e`.
The live application release is now `qualification-power-session-e86e9e2`,
image
`sha256:4a6f306a20cd97332536d76fe800ca64ad12855aa753c88439c77cf86d52b5c8`,
with protected deployment manifest
`e5a1b0ab1aaf40dc48f370324b8186b1954a5e30e26898d08c3633dcccfd8e87`.
Migration, storage preflight, Compose validation, manifest validation, bound
script hashes, and live web health all passed. The predeployment image and
configuration were retained for rollback.

Fresh S6 run `8c4c6880-fd94-4b7f-999e-07454510e43b` used raw CID
`05000C61736466672200001C8901A34F` and pre-cycle boot witness
`614E121268473248`. Exactly one new Start,
`3d5c9ae7-1a0b-4382-a49e-2f9b2d3e66c3`, reached `ACKNOWLEDGED` by read-only
reconciliation with no replay. The three-plane supervisor reached
`HEALTHY:QUALIFICATION_SUPERVISOR_HEALTHY` before the cycle.

The one authorized Controller A cycle is immutable evidence 7432, path
`foundation/controller-power-cycles/controller-a-recovery-active-run-8c4c6880-fd94-4b7f-999e-07454510e43b-approved-retry-20260811.json`,
SHA-256
`713b63dc7a6ff09822365506ee447a74c3419c5aab3283026116cb876d82f5c8`.
All ten verifier stages passed. The final plug output was on, J-Link serial
69664082 was present, and both the host and bounded SWD target checks passed.
The serial-bound supervisor recorded detach, waited for reattachment, and
restarted the Remote Server automatically.

Post-cycle CID capture 234 records protocol status
`DETECTION_READY; RAW_HPT; DRIVER_OK`, valid CID, valid representative-sector
read, MID `0x05`, OID `0x000C`, product `asdfg`, revision `2.2`, serial 7305,
manufacturing date `2026-03`, capacity 8053063680 bytes, the same complete raw
CID, and fresh boot witness `3D701212C4443248`. Recovery evidence 7433 credits
`ACTIVE_RUN_COORDINATED_POWER_INTERRUPTION` as PASS, records HPT2 post-cycle
state 0, forbids automatic command replay/resume/format/repair, and leaves the
interrupted run intentionally `BLOCKED` with reason
`INTERRUPTED_UNKNOWN_COORDINATED_POWER_CYCLE`.

The final gate returned `HOTFIX_RECOVERY_GATE_PASS cases=5`. There are no open
campaign intervention notifications, the temporary observer is inactive, the
controller-access firewall is closed by default, and no target-access tool
container remains. Controller B was not operated on; its J-Link service
retained PID 1093 and its 2026-08-04 start time. The recovery gate is complete;
the next qualification stage is representative Controller A/B regression.

## Representative A/B regression status on 2026-08-11

Application commit `9df09da1dc8d7b5f04aabcc81410ca9519789b69` releases an
acknowledged HPT2 session only after exact same-campaign, role, CID, boot, and
qualified PASS recovery evidence. The focused session-lock tests pass 4/4 and
the authoritative application suite passes 328/328. Firmware-workspace commit
`973e0ce5d1bdb703602c1967e0aff6d5e4d5bf0e` corrects the HPT customer-export
checker scope without changing firmware. Exact candidate software checks pass
for configuration semantics and the 17/17 fingerprint policy, graph policy,
13/13 follow-newest plus 5/5 zoom behavior, 15/15 HPT graph cache, 34/34 HPT
customer export, 12/12 USB mass-storage workflow, and 3/3 USB BOT session
quarantine.

Operations commit `498ef6f6a241fb4125df21bcc28ebf7ff01ed57a` supplies the
role-bound A/B regression runners, non-replaying recovery, bounded Stop
preparation retry, a policy-compatible configurable supervisor cadence, and a
90-second read-only observer cleanup window. The protected deployment manifest
is `f8bda89343c41fe846ec36f805a0ecd6d0203af000cdda261bf0fe79e9ce8936`.
Database backup `/backups/sd-qualifier-20260811T140400Z.dump`, SHA-256
`accce7494142eba05166894e3eb33ed318ce1ae5b9ef51dee63ac0b79dbba27d`,
size 1,722,520 bytes, was restored successfully into the isolated verification
database before the bilateral run.

Controller A run `4c0e0706-4e9d-4ed4-bb7f-e623b117744e` passed S1 with
immutable result evidence 7567 and adjudication evidence 7568. Its one Start
and one Stop both reached `ACKNOWLEDGED`; terminal proof was 31, terminal reason
zero, and attempted/committed/verified counters all equaled 11,605. The A
supervisor provided the required three progressing snapshots over more than
60 seconds while B was admitted.

Controller B run `af6fe758-9504-44c4-955b-4d69d77716e9` used its exact
independent endpoint and CID. Its one Start and one Stop both reached
`ACKNOWLEDGED`; terminal proof was 31, terminal reason zero, and all final
counters equaled 941. Result evidence 7552 is a bounded-stop PASS but the
planned S1 trigger was not met, so it is accepted for representative active
read/write regression and explicitly receives no measurement-matrix credit.

Final read-only observations `420319c5-00c2-4816-8b4e-981e36dffa99` (A) and
`5392f889-970d-4896-a188-49008abae415` (B) prove the exact candidate flash and
raw CIDs. A acknowledged records advanced from 42 to 37,636; B advanced from
444,653 to 445,654. Both cards remain HPT state 5 with lane mask 7, valid
representative-sector reads, and zero mismatch, loss, retirements, or system
errors. Both supervisor services are inactive, no target-access container
remains, and the firewall is back to its default drop-only state.

The compact result is
`work/evidence/representative-ab-regression-20260811.json`. It deliberately
initially classified the stage as `PARTIAL_PASS_OPERATOR_GATES_PENDING` while
operator target gates remained. Physical USB publication and independent-reader
verification then passed on both controllers, with the Controller A USB07
pre-existing FSInfo offset explicitly accepted without media repair or firmware
change. Normal-production logging/chart read and exact configuration
save/restore subsequently passed on both controllers. The manifest now records
`QUALIFICATION_PASS_TARGET_AB`; see
`work/evidence/representative-ab-operator-target-gates-20260811.md`.
