# Post-freeze integrated firmware qualification

Status: PASS — autonomous electronic and scoped dual-controller operator gates complete
Type: evidence
Date: 2026-07-25
Updated: 2026-07-25
Timezone: America/Los_Angeles
Next action: disposition separately scoped fault, interruption, degraded-media, endurance, multi-sample, and rollout gates
Parent: work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md

## Frozen candidate

### Final scrub-throughput candidate

The first reviewed replacement exposed a safe but impractical full-card scrub
cadence on Controller A. The active operation was reconciled, then cleanly
canceled at 26.9% with zero failed or retry-recovered sectors. The firmware
was changed to perform 16 bounded transfers per scrub slice while retaining
foreground controller scheduling. The resulting final candidate is:

- Firmware implementation commit:
  `391c7b4d053ee146b823c505987897d3f88c0022`
- Artifact freeze commit:
  `c0901312e0fe850d8a0b2452eb20d88c86ce07bd`
- Debug ELF SHA-256:
  `B38E120FC64F405F87C6C420F6E767DA64A7955BA96BE5BFDB30C2F9A5547BAC`
- Debug S-record SHA-256:
  `D386F03460E225B683D5146FFC7AD949CCFEF71A3EC8169C944EFA82B5992F9F`
- Debug map SHA-256:
  `C964A1CFB1637650B798FE0AEA3DFF1CF4965FC82360B1B46232BBE27B8C1734`
- Release ELF SHA-256:
  `FAB3AD7D46C73CD7EF5F32C7A8BFEB4410E91F7620C6C4E0EAE469D8F4F93D39`
- Release S-record SHA-256:
  `0DDB6DC35978970D9B017475553BDC7F35402BD3EAEC4EAF3A6378D3334EB1D1`
- Release map SHA-256:
  `1F53BE04D130EE507EE674155D1635CC6D7D4D842FBADD21A71556D2B86E5126`

Stable and `_00_05_00` artifacts match byte-for-byte. Clean managed Debug and
Release rebuilds passed, Release RAM headroom remains `102040` bytes, and all
17 `check-*.ps1` suites pass. The scrub invariant suite is `9/9`.

### Superseded intermediate replacement

The owner accepted the recovery recommendation to freeze and qualify the
reviewed current development line instead of restoring the superseded image.
This candidate established the broader functional baseline, but was superseded
by the scrub-throughput candidate above:

- Firmware source/tool commit:
  `d7f2677a6001d3247634603b0715034c9f0deac7`
- Artifact freeze commit:
  `6f4c3227ca8cf6187dc383d68d0bf57052483007`
- Debug ELF SHA-256:
  `21C8FF28885648F93CCF8E05334E76D7C5F033571C5695E995D0B7B9B19F76BB`
- Debug S-record SHA-256:
  `1BE24703AEFC2DF25E19373F6796C8C64A26276F2D26F28C1E89E72D503B3ABC`
- Debug map SHA-256:
  `32E281865C741E085EE10CA71DE38F7AF753EF65995BC7B34F7DF4714116C6C2`
- Release ELF SHA-256:
  `D6B99C26BE4CBF37E9673634374FBD49A7C3870A778BFDCD7385215E46886E25`
- Release S-record SHA-256:
  `AF2A87033FA88F9EF4BFCC21A1885BE60E43351AF682C0FAF5D57E2B627CE79A`
- Release map SHA-256:
  `9803E8D7CDD8D2080B371D8C4A2A6FA1F49208F2CDB176BAB2976C2F065F97B8`

Stable and `_00_05_00` artifacts matched byte-for-byte in both configurations.
Clean managed Debug and Release rebuilds passed. The isolated e2studio
headless build was not promoted because the isolated workspace repeatedly
failed to resolve Renesas support-file targets; a clean managed build with
eight jobs then passed. All 17 `check-*.ps1` suites pass, including HPT
commissioning `91/91`, scrub `8/8`, CID `25/25`, calibration `17/17`, and
version-5 HPT-only routing `11/11`. Release RAM used end is `0x20067168`,
leaving `102040` bytes to `0x20080000`.

The earlier candidate below also remains historical evidence only.

### Superseded candidate

- Firmware source commit:
  `fb441364b41655722d1bc4892839e72ec5ebd7e6`
- Artifact freeze commit:
  `d2dce0dce18482ae25a775aff465f24904e60d07`
- Debug S-record SHA-256:
  `74D00768F9A66BD7081E28FD4539C26A4AA7EE380E954E765D47728E14A82F73`
- Release S-record SHA-256:
  `2BBF9CA4B660562710081513041A0A9A1BF062BE88AB0ECB8506C0F022364ACB`
- Freeze record:
  `work/evidence/hpt-log-store-circular-mirror/integrated-candidate-freeze-20260725.md`

Target evidence collected before the replacement selection resolves to the
superseded Debug hash below and must not be mixed with replacement-candidate
results.

## Authorization and execution policy

- The owner authorized destructive SD-card routines on both Controller A and
  Controller B on 2026-07-25, explicitly including formatting Controller B.
- Prefer J-Link RAM commands, captured target state, and the qualified HPT Lab
  Power Control coordinated API.
- Reserve operator actions for genuinely human screen/audio judgment.
- Stop on controller/J-Link/CID mismatch, unsafe state, unrecoverable target
  access, HPT reopen failure, or unexplained data loss.

## Controller identities

| Controller | Assembly | J-Link | Card | Raw CID |
| --- | --- | --- | --- | --- |
| A | `1751136` | `69664082` | SanDisk/WD `SS08G` rev `8.0`, serial `2540634244`, manufactured `2024-05` | `035344535330384780976F0084018559` |
| B | `1751219` | `69660123` | SanDisk/WD `SS08G` rev `8.0`, serial `2540634245`, manufactured `2024-05` | `035344535330384780976F0085018507` |

Both baseline captures report CID valid and representative-sector read valid.
Final-candidate identity evidence:

- `work/evidence/hpt-log-store-circular-mirror/controller-a/scrub-throughput-candidate-20260725/baseline/sd-card-identity.json`
- `work/evidence/hpt-log-store-circular-mirror/controller-b/scrub-throughput-candidate-20260725/baseline/sd-card-identity.json`

## Final-candidate results

| Case | Controller A | Controller B | Evidence / notes |
| --- | --- | --- | --- |
| Exact `D386...` image program/verify/reset | PASS | PASS | J-Link `Program & Verify O.K.` on both targets |
| Post-reset CID and state baseline | PASS | PASS | protocol card state, CID-valid state, and representative-sector read all valid; raw HPT ready |
| CID identity match | PASS | PASS | A `035344535330384780976F0084018559`; B `035344535330384780976F0085018507` |
| Full-address read-only scrub | PASS | PASS | each read all `15,523,840` sectors in `242,560` 64-sector transfers; zero failures, retry recoveries, identity mismatches, or HPT errors; maximum read time 3 ticks |
| Integrated SD/HPT/chart/logging gate | PASS | PASS | zero system errors, raw HPT open, representative read good, chart rebuild reached 720/720 records and retained real data |

Final-candidate manifests:

- Controller A scrub:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/scrub-throughput-candidate-20260725/full-address-scrub/scrub-current-status.json`
- Controller B scrub:
  `work/evidence/hpt-log-store-circular-mirror/controller-b/scrub-throughput-candidate-20260725/full-address-scrub/scrub-current-status.json`
- Controller A integration:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/scrub-throughput-candidate-20260725/integration/pre-freeze-integration.json`
- Controller B integration:
  `work/evidence/hpt-log-store-circular-mirror/controller-b/scrub-throughput-candidate-20260725/integration/pre-freeze-integration.json`

Controller B required longer than the integration tool's original fixed
30-second observation window to traverse its retained store. The original
check recorded a timing-bound host failure while the target remained actively
working; its request later cleared at 720/720 records without a new dropped
log. The host tool now accepts a bounded chart wait and the formal extended
rerun passed. Controller B's pre-existing dropped count remained `2` before
and after the rebuild.

## Immediate-predecessor results (`1BE247...`)

| Case | Controller A | Controller B | Evidence / notes |
| --- | --- | --- | --- |
| Exact frozen image program/verify/reset | PASS | PASS | `program-bench.ps1`; both targets already contained byte-identical flash and J-Link reported `O.K.` |
| Fresh CID/state baseline | PASS | PASS | controller-specific `post-freeze-integrated-qualification-20260725/baseline/` directories |
| System errors / SD power-on readiness | PASS | PASS | zero system errors; SD power-on bit present |
| Triple HPT open | PASS | initially N/A; PASS after authorized initialization | A opened existing raw HPT; B initially reported FAT32-needs-initialization and issued no automatic write |
| Triple-store chart traversal | PASS | PASS after first production record | all 720 hourly units completed, stable even publication sequence, request cleared |
| Logging during chart traversal | PASS | PASS | completion advanced where a minute record arrived; drop count did not increase |
| Three consecutive Controller A cold starts | PASS | — | API operations `6f73aae5-6024-4def-ba83-51d9d3ac004a`, `e9ad564f-1d2c-4f88-9b8e-a04ec629c6d6`, and `bed18d37-22fa-4aa2-aa67-1d7b1c70c22f`; every RAM witness cleared, raw HPT reopened, and CID matched |
| Three consecutive Controller B cold starts after initialization | — | PASS | API operations `a7db7595-3165-4ef4-ac1b-81551bf71351`, `e87ade48-f468-4a7f-81e0-943a79c879c7`, and `5192d55e-2910-4c4a-9248-2e50be8c0473`; every RAM witness cleared, raw HPT reopened, and CID matched |
| Controller B guarded HPT initialization | — | PASS | exact SREC/J-Link/CID bound; post-state `RAW_HPT / HPT_READY`, HPT status `OK`, store open |

Controller B initialization evidence:

- Pre-initialization read-only baseline:
  `work/evidence/hpt-log-store-circular-mirror/controller-b/post-freeze-integrated-qualification-20260725/baseline/`
- Guarded corrected request:
  `work/evidence/hpt-log-store-circular-mirror/controller-b/post-freeze-integrated-qualification-20260725/hpt-initialization/retry-2/`
- Passing post-initialization integration:
  `work/evidence/hpt-log-store-circular-mirror/controller-b/post-freeze-integrated-qualification-20260725/hpt-initialization/retry-2/post-initialize-rerun/pre-freeze-integration.json`

The first host-side attempt raised only the request boolean. Firmware rejected
it because no approved-CID consent latch had been supplied, and the card
remained FAT32-needs-initialization. The corrected guarded automation reproduced
the complete firmware request contract: exact CID copy, initialize-pending
state, idle-service checks, and request. The failed attempt is retained under
`hpt-initialization/` as negative evidence.

The first generic integration check immediately after successful formatting
also reported failure because a new card had no production chart record in its
snapshot and the commissioning iterator's expected terminal status was
`HPT_STATUS_END`. A production log completed during that traversal without a
new drop. The fresh rerun then passed with real chart data and qualification
status `OK`; no firmware or card recovery action was required.

## Recovery continuation and candidate-binding stop

At recovery continuation on 2026-07-25, all three Controller B coordinated
cycle IDs were re-read from HPT Lab Power Control and were terminal
`success`. Current power status showed both controllers and the expected
J-Links on and present. Controller B cycle 3 must not be repeated.

A proposed final Controller A runtime baseline was first captured using the
current dirty-tree ELF. It decoded cleanly, reported zero system errors,
matching CID `035344535330384780976F0084018559`, raw HPT ready/open, 720 chart
records, and zero logging drops. That capture is diagnostic only: the current
local Debug S-record hashes to
`1BE24703AEFC2DF25E19373F6796C8C64A26276F2D26F28C1E89E72D503B3ABC`,
not the frozen hash above.

The tooling was then isolated at artifact-freeze commit `d2dce0dc`; its S-record
independently matched the required `74D007...` hash. Reading Controller A with
that frozen ELF produced invalid field decodes because the frozen and live RAM
layouts differ. This is a candidate-binding failure, not a product/media
failure. It proves the live Controller A state cannot support additional
frozen-candidate qualification without first establishing the exact installed
flash identity.

Read-only J-Link `VerifyBin` checks then compared every programmed S-record
region against the current dirty-tree ELF: `0x00000000..0x002BC15B`
(`2,867,548` bytes) and ID code `0x40120050..0x4012005F` (`16` bytes).
Both regions verified successfully on Controller A and Controller B. Therefore
both targets exactly match the current local Debug build whose S-record SHA-256
is `1BE24703AEFC2DF25E19373F6796C8C64A26276F2D26F28C1E89E72D503B3ABC`;
they do not contain the frozen `74D007...` build. The diagnostic Controller A
capture must not be promoted to frozen-candidate evidence.

No flash, reset, power cycle, SD initialization, or other destructive action
was performed during this recovery continuation. Controller B was not touched
after the binding failure.

## Autonomous disposition

Autonomous electronic qualification is complete for the final `D386...`
candidate. The immediate predecessor supplied three successful cold-start,
reopen, and CID cycles on each controller plus Controller B lane retirement
and ordered-readback evidence. The only firmware delta in the final candidate
is bounded full-address scrub scheduling. The final image was independently
programmed/verified/reset on both controllers, then passed CID-bound full-card
scrubs and the integrated runtime gate.

No additional lane-retirement run is recommended before operator review:
repeating it would consume finite retirement segments without exercising code
changed by the final delta. Likewise, repeating six physical cold starts adds
little coverage beyond the predecessor cycle matrix plus the final-candidate
program/reset/reopen evidence. These are explicit delta-scoped dispositions,
not claims that predecessor raw evidence belongs to the final hash.

## Operator feedback result

On 2026-07-25 the owner reported that both final-candidate controllers passed
the requested operator review:

- final screen wording, placement, and legibility: PASS;
- touchscreen navigation through Home, data-log chart, service/status, and
  return paths: PASS;
- audible alarm presence and quality, exercised with the normal service sound
  path: PASS.

No operator issue was reported. This closes the scoped operator-feedback gate
on Controllers A and B. It does not claim malformed-update, injected-failure,
physical interruption, degraded-media, endurance, multi-sample, or rollout
qualification.
