# HPT geometry, bounds, and write-protection diagnostic harness

Status: programmed on Controller A; geometry, bounds, and protected-media diagnostics passed
Type: evidence
Updated: 2026-07-22
Next Action: implement and run injected read/write/flush/open error-propagation diagnostics
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-hpt-embedded-log-store-v0-4-0-renesas-integration.md

## Diagnostic contract

`HptLogStoreDiagnostics.[ch]` runs automatically only after an existing HPT
store opens successfully. Against live media it checks 512-byte geometry and
the reported sector count, then submits deliberately invalid transfers that
must be rejected inside the adapter before SSP access:

- read beginning exactly at `sector_count`;
- read beginning at `UINT64_MAX`;
- unsupported two-block read;
- write beginning exactly at `sector_count`.

The write-protection case uses a RAM-only mock block-media instance. Its ioctl
reports write protected, and the test requires
`SSP_ERR_CARD_WRITE_PROTECTED` plus a zero mock-write callback count. It cannot
write the physical qualification card.

Results are exposed as independent passed/failed bitmasks in
`S_HptMediaStatus`; diagnostics do not convert a failed test into media
corruption or initiate formatting.

## Verification

- HPT commissioning/source invariants: 23/23 pass.
- Existing SD safety invariants: 20/20 pass.
- Isolated Debug link: pass.
- Isolated Release link: pass.
- Generated Synergy changes: none.
- `git diff --check`: pass.
- Build root:
  `E:\dev\high_point\e2_workspaces\7520553_hpt_diag_5b89d020f58b4bbe9327e1722273de62`
- Debug S-record SHA-256:
  `D3EADFD250544254B98F6E5ACB036B72A878BE9759482A18BACDFA6BCC965A51`
- Release S-record SHA-256:
  `2F02832BE746B2C4C155379E0AF295AE59E2B2D55CF0B481E9FE3305FFD35A31`

The initial e2 Debug orchestration exceeded its 150-second watchdog while e2
was processing project metadata. Generated Debug makefiles already contained
the new source, and the qualified GNU make/toolchain then completed the clean
Debug compilation and link successfully. A subsequent isolated e2 Release
build completed normally.

## Controller A result

With explicit authorization, Controller A (`1751136`, J-Link `69664082`) was
programmed and verified with the Debug candidate hash above. The first attempt
exceeded the outer command timeout without returning a result; the orphaned
serial-specific SSH tunnel was identified and stopped. A bounded retry then
reported successful J-Link program and verify.

After boot, the diagnostic and media state were read directly from RAM and the
CPU was resumed:

| Result | Value |
| --- | ---: |
| Diagnostics passed mask | `0x0000007F` (all seven) |
| Diagnostics failed mask | `0x00000000` |
| Observed block size | 512 bytes |
| Observed sector count | 15,654,912 |
| Protected-media mock write calls | 0 |
| SD/HPT state | `RAW_HPT` / `HPT_READY` |
| HPT/SSP status | 0 / 0 |
| Active records / next sequence | 1 / 2 |

The existing commissioning record remained committed. The live-card cases
were rejected bounds operations; the protected write used only the RAM mock.
No format, valid-sector write, append, or power interruption occurred.
