# Controller A data-durable-before-commit power-cut software gate

Status: software gate passed; physical result not yet valid because J-Link remained electrically connected
Type: evidence
Updated: 2026-07-23
Next Action: re-arm corrected commit 548aabc3, physically disconnect J-Link 69664082 before removing external power, boot with J-Link disconnected, then reconnect for recovery
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone

## Boundary

The first physical interruption is between lane A record-data durability and
the first record-commit write. The diagnostic:

1. requires exact RAM command `0x48504331`;
2. verifies raw HPT ready, an open store, no USB/export, and no competing HPT
   diagnostic;
3. commits a healthy three-lane setup record;
4. wraps only the store's device callbacks and selects the exact next lane A
   data block;
5. forwards the data write and synchronous Renesas flush;
6. publishes `HPT_POWER_CUT_DIAGNOSTIC_HOLDING_CUT_POWER` and sleeps the SD
   owner before any commit-block write; and
7. keeps Controller/HMI run-count deltas live while waiting.

The RAM cancel command `0x48504358` lets the held append complete without
injecting an I/O failure. A physical cut instead discards the RAM state. The
engineering qualification opener explicitly supports the marked tiny wrap
media after reboot.

## Electrical-isolation correction

Controller A is back-powered by J-Link `69664082` while the probe remains
electrically connected. Ending J-Link Commander, closing the SSH tunnel, or
stopping the Remote Server does not electrically isolate the controller.

The attempted external-supply interruption after the first arm therefore does
not count as a physical power cut: J-Link remained connected. Its pre-cut hold
capture remains valid software/target evidence, but no controller-off,
power-loss recovery, or cold-boot claim may be derived from that attempt.

The mandatory physical sequence is:

1. Arm and capture the hold while external controller power and J-Link are
   connected.
2. Keep external power on and physically disconnect J-Link from Controller A.
3. Remove external power and verify the controller is off.
4. Restore external power and let Controller A boot while J-Link remains
   disconnected.
5. Reconnect J-Link only after boot for read-only capture and recovery.

The recovery command `0x48505231` receives the expected interrupted sequence
from the host manifest. It proves the immediately preceding acknowledged
record, accepts the interrupted sequence only if it is absent or has since
been replaced by a different normal payload, rejects the unique interrupted
marker `0x50435554` as a false commit, then appends and reads a new record with
all three lanes.

The remote target tool resolves the command, status, and expected-sequence
addresses from the exact Debug ELF. It requires the exact S-record hash and
`ARM-HPT-PCUT-69664082`, validates the 128-byte target status layout, saves the
pre-cut status and manifest, automatically cancels if the verified hold is not
reached, and validates the post-cut recovery status.

## Software results

- HPT commissioning/source invariants: `70/70`
- HPT customer-export invariants: `17/17`
- SD-safety invariants: `20/20`
- Exhaustive modeled write cuts: `141`
  - format: `45`
  - ordinary append: `27`
  - reclaim append: `63`
  - retirement snapshot: `6`
- Triple-circular capacity/quorum/retirement/wrap model: pass
- Customer-export bounded snapshot/gap/health model: pass
- Isolated clean Debug build and package: pass
- Isolated clean Release build and package: pass
- PowerShell target-helper syntax: pass
- Debug status symbols:
  - command: `0x20047668`, 4 bytes
  - status: `0x20047670`, 128 bytes
  - recovery expected sequence: `0x200476F0`, 8 bytes
- Internal S7G2 RAM headroom: `135,072` bytes
  (`208` bytes less than the preceding wrap candidate)

## Frozen build artifacts

These hashes describe the current uncommitted source state and must be rebuilt
and reconfirmed after the scoped commit before programming:

- Debug SREC:
  `D20A438F2EEA5B7C0144E591F483715EDAFCF891CAE677D875D83265024B6FE2`
- Debug ELF:
  `4EF218D2B1637F9C757CA0AD6F71D31CC371D119B4B5610D6EDB35C0DE65ADB1`
- Release SREC:
  `D9F76F3CF187251FDA9ECD83BA644C4F9A586C42AEA7301B08FB5A916C3321DF`
- Release ELF:
  `2FF3BB8DF27FC42D51CA76A2B8572AECB5FF6B28D83DF03CB12439ECDCF42D09`

No controller RAM, flash, SD media, or power state was changed by this software
gate.
