# Controller A read-only FAT32 classification

Status: passed; read-only FAT32 gate and operator-confirmed HPT commissioning completed
Type: evidence
Updated: 2026-07-22
Next Action: run non-destructive geometry/bounds and write-protection rejection tests on Controller A
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-hpt-embedded-log-store-v0-4-0-renesas-integration.md

## Resolved target and candidate

- Controller A assembly: `1751136`
- J-Link serial: `69664082`
- Target: `R7FS7G27H3A01CFC`, SWD 4 MHz
- Target voltage during final read: 3.296 V
- Assigned expendable card: `card-cs0`, FAT label `HPTCS0`
- Corrected isolated Debug build root:
  `E:\dev\high_point\e2_workspaces\7520553_hpt_classification_fix_bb825c704ec24074935bf7a951444ec3`
- Programmed S-record SHA-256:
  `22AD9B619A571249BE72E687E384BB2D4F95C38961854B166196BBD01CDEE13A`
- J-Link program and verify: pass

## Startup-order correction

The first programmed software-complete candidate exposed an observation defect
during post-load symbol review: `restoreSdSoakState()` ran after media
classification and reset `gHptMediaStatus` to `UNCHECKED`. No media write or
format occurred. The restore calls were moved before `openSdCardMedia()`, an
automated ordering invariant was added, and the corrected candidate passed a
clean isolated Debug build and 20/20 commissioning invariants before reload.

## Direct RAM result

After boot, J-Link briefly halted the CPU, read status, resumed it, and detached:

| Symbol/field | Raw value | Interpretation |
| --- | ---: | --- |
| `gSdCardState` | 2 | `SD_CARD_STATE_READY` |
| `gHptMediaStatus.State` | 1 | `HPT_MEDIA_STATE_FAT32_NEEDS_INITIALIZATION` |
| `HptStatus` | 5 | expected non-HPT/FAT32 classification marker |
| `SspStatus` | 0 | no SSP error |
| `FirstErrorSector` | 0 | no failing sector |
| `SectorCount` | 0 | raw geometry was not opened/queryed |
| `AcknowledgedRecords` | 0 | no HPT append |
| `IteratedRecords` | 0 | no HPT iteration |

This is the requested read-only gate. Service 468 initialization was not
requested or confirmed. The firmware did not switch to raw ownership, format
the card, append a commissioning record, or perform a power interruption.

## Operator-run service 468 result

The operator subsequently reported running service 468. A direct J-Link RAM
read, followed by immediate CPU resume, recorded:

| Symbol/field | Raw value | Interpretation |
| --- | ---: | --- |
| `gSdCardState` | 6 | `SD_CARD_STATE_RAW_HPT` |
| `gHptMediaStatus.State` | 3 | `HPT_MEDIA_STATE_HPT_READY` |
| `HptStatus` | 0 | success |
| `SspStatus` | 0 | no SSP error |
| `FirstErrorSector` | 0 | no failing sector |
| `SectorCount` | 15,654,912 | whole-card raw geometry retained |
| `AcknowledgedRecords` | 1 | commissioning append acknowledged |
| `IteratedRecords` | 1 | exact commissioning record iterated |

This proves the implemented format, close/reopen, deterministic append, second
close/reopen, exact iterator comparison, and clean iterator-end sequence
completed on Controller A. FileX remains inhibited while the card is raw-owned.
No reset or physical power interruption was performed after commissioning.

## Controlled reset/reopen persistence result

With explicit operator authorization, J-Link issued a normal target reset and
immediately resumed Controller A. This was not a physical power cut. After an
eight-second startup interval, direct RAM inspection recorded:

| Field | Value | Result |
| --- | ---: | --- |
| SD state | 6 | exclusive `RAW_HPT` ownership restored |
| HPT media state | 3 | `HPT_READY` after reopen |
| HPT/SSP status | 0 / 0 | no error |
| First error sector | 0 | none |
| Sector count | 15,654,912 | geometry unchanged |
| Store active records | 1 | sole committed record recovered |
| Store next sequence | 2 | sequence 1 remains committed |

Before reset, sequence 1 was compared exactly for sequence, timestamp, type,
payload length, payload bytes, and clean end-of-iteration. After reset,
`hpt_log_store_open()` rescanned and accepted that sole committed record and
restored `active_records=1` and `next_sequence=2`. Together these observations
prove the acknowledged commissioning record survived the controlled reset and
the store can continue at sequence 2. Controller A was resumed after each
brief RAM read. No additional record, format, or power interruption occurred.
