# Controller A media 2.0 initialization lifecycle failure

Status: corrective candidate frozen and ready to flash; target recovery proof pending
Type: evidence
Updated: 2026-07-23
Next Action: program the frozen Debug S-record, capture non-destructive reopen status, then explicitly reinitialize recognized media 2.0 once
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-controller-a-hpt-triple-circular-physical-qualification.md

## Operation

The owner visually reviewed the service 468 screens and proceeded through the
guarded whole-card initialization on Controller A. The display subsequently
reported corrupt media. No repeat initialization, reset, or card removal was
performed after that report.

## Read-only target capture

- Controller assembly: `1751136`
- J-Link: `69664082`
- VTref: `3.285 V`
- Card geometry: `15,654,912` sectors at 512 bytes
- HPT media state: `HPT_MEDIA_STATE_CORRUPT_OR_UNKNOWN`
- HPT status: `HPT_STATUS_INVALID_ARGUMENT`
- SSP status: `SSP_SUCCESS`
- First-error sector: `0`
- Media generation in store memory: `1`
- Store layout present and sequence advanced beyond initial value

The diagnostic session briefly halted the CPU, read RAM, resumed the target,
and closed its SSH/J-Link tunnel. It issued no format, reset, program, or media
write command.

## Initial diagnosis

`initializeHptWholeCard()` selects `SD_CARD_STATE_RAW_HPT` before the complete
format/reopen/commissioning verification has succeeded. Its failure path closes
the qualification session but does not leave raw-HPT mode. The next queued log
record can therefore call `HptLogQualificationAppend()` against an idle/closed
qualification object. That returns `HPT_STATUS_INVALID_ARGUMENT`, and the queue
path copies it into the public media status, replacing the more useful
initialization result.

This proves a firmware lifecycle and diagnostic-preservation defect. SSP status
zero and first-error sector zero provide no evidence of a physical SD I/O
failure.

## Corrective gate

- Raw-HPT queue processing must become reachable only after full commissioning
  succeeds.
- Any initialization failure must leave raw writes disabled and retain its
  phase/status until an explicit later diagnostic action.
- Queue processing must verify both public-ready state and an open qualification
  session before appending.
- Regression checks must cover successful activation and every failed phase.
- Debug and Release must clean-build before Controller A is programmed again.
- The next target action is a non-destructive reopen/status capture; service 468
  must not be repeated automatically.

## Corrective candidate

The implementation now invalidates the first record commit before publishing a
new segment and maintains an invalid commit sentinel immediately after the
active prefix. Raw queue writes are enabled only after the complete
format/reopen/commissioning/read/end verification succeeds. Failure paths close
the raw session, disable writes, and preserve the failing initialization phase.

Recognized media 2.0 may be explicitly reinitialized through service 468's two
warnings. Corrupt, unknown, unsupported, I/O-failing, removed, and
write-protected media remain ineligible.

Validation:

- HPT source invariants: `40/40`
- SD safety invariants: `20/20`
- Deterministic stale-slot/capacity/quorum/wrap model: pass
- Isolated e2 Debug clean build/package: pass
- Isolated e2 Release clean build/package: pass

Frozen artifacts:

- Debug SREC:
  `767CFE1A9D15281CEDFB13C07F6867D3EA7DE1EF736D5C3CCB5E3DDB7460AE84`
- Debug ELF:
  `E8E44928D62E53140E941C672E1127FCD439E07E04C2E8A9FCCF926EDDF7A19D`
- Release SREC:
  `E58B999A96BBCE1399180F4FDCC3F0ABAC9888FC9D5F9F913B15887625ACBDC5`
- Release ELF:
  `D115D2BF1B9293FE38E3F99FA819711DB8064835B38C5774E989F094F0B222EF`
