# HPT2 staged retained-history scalability — 2026-08-27

Status: complete; G4 passed after all three credited stages and the required smaller-stage regression
Type: evidence
Updated: 2026-08-27
Next Action: none
Parent: work/00-campaigns/completed/026-hpt2-prove-staged-retained-history-scalability.md
Campaign: hpt2-prove-staged-retained-history-scalability

## Fixed identities

- Controller A assembly / J-Link: `1751136` / `69664082`
- SD raw CID: `05000C61736466672200001C8901A34F`
- Exact frozen Release SREC SHA-256:
  `FA874D68BFBD16BDC4891ED9C18ED87695CC4EE0B113EF2756B54E675F95E0FC`
- First temporary builder SREC SHA-256:
  `C6A04FD5FB80F105BAEE862B856BF20A051A8853C37F41A041A352DEED500ACD`
- Corrected exclusive builder SREC SHA-256:
  `0233D536783247C18B9F9EBFD7E5B80FCA61A9CEFA48AA44C011581852AA7B3A`
- Final clean-format exclusive builder SREC SHA-256:
  `D7953C5DB1304CAB8555C69ADA5D39DEA2A4CB12263E0582D60BEC955419185D`
- Required smaller-regression builder SREC SHA-256:
  `8F8B1530199CEE638DA334B3A32E26E0D312B58D9911E2B6ABE0EDB72842FB35`
- 13-calendar-month builder SREC SHA-256:
  `B540A8E07A1AFDF95C9296B4AA3B4C49FCC6A81CD6ED1C5468B6DDE94DF06A10`
- Two-year builder SREC SHA-256:
  `FC80D6A76D6674D48EC436AD8C5901A41844C6EA992A2D6A91261F7C1670DC3C`

## First 100-day attempt — preserved, not credited

The installed development SD card was reinitialized through the guarded
controller workflow without physical removal. Baseline and post-initialization
CID captures matched. The first builder reached exactly 144,000 retained
sequences with HPT status zero and no fixture failure, then the exact frozen
Release image was restored and verified.

The exact Release image passed the useful performance observations:

| Gate | Result | Budget |
| --- | ---: | ---: |
| Normal open | 1.72 s; 438 header blocks; 5,144 total blocks | 30 s; 512; 8,192 |
| Newest-30-day graph reconstruction | 52.92 s; 142,560 scanned; 864 graph header reads; zero fallback | 60 s; 142,560; 900 |
| Operator export HPT phase | 166.82 s | 240 s |
| Operator export total | 193.14 s | 300 s |
| Export lookup/proof | 420 index entries; 2,200 proof neighbors; zero fallback | 438; 8,192 |

The customer export completed and published with HPT/USB status zero, zero
snapshot/requested-range gaps, and 129,536 healthy selected rows. The operator
entered the planned 90-day boundary, received the product's greater-than-90-day
notice, and advanced the start by one hour before submitting.

This attempt is not a stage pass. The first builder allowed current production
records to enter the store before and between backdated fixture batches. Target
telemetry then exposed a non-chronological store: the export's first selected
sequence was `13,940`, but its reported first timestamp was near the current
end of the fixture, and the selected count was not the required 129,600. That
fixture defect, not export speed or mirror integrity, is the fail-fast stop.

Read-only Raspberry Pi inspection identified the expected `USB07_32G` by
serial `07190C5B908CDC85` and UUID `4693-0F61`. The new file was
`SMI6_07162026_20260529t1551-20260827t1451.csv`: 6,626,588 bytes, 129,536
data rows, and SHA-256
`14A8FF7645E3E8E37D3D246D06E8CCD3CA34681A2C0948F4308626DA0353C0E2`.
Its completion trailer matched the controller count and no partial-file
artifact was present. Content independently proved the chronology defect:
line 1 was `Thu Aug 27 14:36:00 2026`, followed by line 2 at
`Fri May 29 15:51:33 2026`. The read-only FAT check reproduced USB07's
previously accepted two-cluster free-space-summary offset and changed nothing.

## Narrow remediation

The campaign-only builder now:

- suppresses and counts ordinary production records from builder boot through
  fixture completion;
- refuses to begin unless initialization left zero retained records;
- reports initial retained count, suppression count, fixture timestamps, and
  any chronology violation in the target status; and
- leaves the frozen Release source and artifact unchanged.

The correction passes 13/13 fast-history invariants, 4/4 fixture model cases,
108/108 HPT commissioning invariants, and the canonical managed Debug rebuild.
The failed store and export remain evidence; they are not reused as a valid
qualification rung.

## Corrected 100-day repeat — target gates passed

The fixture-only initialization path was narrowed once more after target
evidence showed that normal commissioning deliberately leaves one current-time
record. The exclusive builder now stops after the verified clean format; the
production Release commissioning path is unchanged. The post-initialization
store was exactly empty (`oldest=1`, `next=1`, retained `0`) with the same CID.

The corrected builder then completed exactly 144,000 chronological one-minute
records, sequences `1` through `144000`, timestamps `295974402` through
`304614342`, zero chronology violations, zero gaps, and eight explicitly
suppressed production records. The exact frozen Release image was restored and
verified before any qualification measurement.

| Gate | Credited result | Budget |
| --- | ---: | ---: |
| Normal open | 1.72 s; 438 open headers; 5,138 open blocks | 30 s; 512; 8,192 |
| Newest-30-day graph reconstruction | 52.95 s; 142,560 scanned; zero fallback | 60 s; 142,560; 900 headers |
| Operator export HPT phase | 165.39 s | 240 s |
| Operator export total | 191.39 s | 300 s |
| Export lookup/proof | 0.09 s; 420 index entries; zero fallback | 438 entries; selected + 8,192 |

The normal UI advanced the entered start to the rolling 90-day boundary at
`2026-05-29 15:17`. The owner explicitly accepted the 11-minute fixture/reflash
edge as insignificant. The completed export selected and published 129,595
healthy rows, only five fewer than the theoretical 129,600 because normal
Release logging filled most of the edge. It reported zero snapshot gaps, zero
requested-range gaps, zero degraded rows, HPT/USB status zero, and no range
index or bulk-read fallback. USB publication took 25.99 seconds and completed
the close/flush/rename path.

This target result is credited. The required smaller-stage regression remains
before the 13-month rung may start; the owner explicitly directed that no next
test be started during this evaluation turn.

## Credited export — independent USB07 inspection

USB07 was identified read-only on the Raspberry Pi as model `USB DISK 3.0`,
serial `07190C5B908CDC85`, label `USB07_32G`, and UUID `4693-0F61`. The newly
published file is:

- name: `SMI6_07162026_20260529t1517-20260827t1516.csv`
- size: 6,629,656 bytes, matching target USB bytes requested
- SHA-256: `A9670CBC5CFB548CE7D378232402D42DEBADA26FCE200E9B9B1FA75323B545FB`
- physical lines: 129,613
- contiguous numbered data rows: 129,595
- trailer: `Export completion: COMPLETE; records published: 129595`
- partial/temp artifacts: none

Every data timestamp was parsed. The first was
`2026-05-29 15:17:42`, the last was `2026-08-27 15:16:00`, and there were zero
backward timestamps and zero duplicates. There were 129,591 exact one-minute
transitions. The only transition over one minute was the already accepted
fixture-to-Release edge from `15:05:42` to the `15:11:35` power-off record
(353 seconds); the following power-on and minute-log transitions remained
forward ordered. These values agree with the controller's captured request,
actual range, row count, and measured reflash edge.

The non-repairing FAT check reproduced USB07's known two-cluster free-summary
offset (`1,891,864` recorded versus `1,891,862` actual) and explicitly left the
filesystem unchanged. No USB kernel I/O error was found. The read-only mount
was unmounted after inspection.

## Required smaller-stage regression — PASS

The post-remediation regression reused the prior physical fail-fast size of
56,160 records. The fixture-only builder passed 13/13 invariants and the
canonical managed Debug rebuild before programming. Baseline, builder-boot,
post-initialization, exact-Release-boot, and final identity captures all report
the same installed SD card:

- protocol card status: `6`;
- CID-valid status: `1`;
- representative-sector-read status: `0` (success);
- manufacturer/MID: associated table entry / `0x05`;
- OEM/application ID: `??`;
- product/revision: `asdfg` / `2.2`;
- serial/manufacturing date: `7305` / `2026-03`; and
- complete raw CID: `05000C61736466672200001C8901A34F`.

The guarded initialization left an exactly empty store (`oldest=1`, `next=1`,
retained `0`). The exclusive builder then completed exactly 56,160 records,
sequences `1` through `56160`, timestamps `301254139` through `304623679`,
with zero chronology violations, zero gaps, and six explicitly suppressed
production records. The exact frozen Release S-record was restored and
program-verified before qualification measurements.

| Gate | Regression result | Budget |
| --- | ---: | ---: |
| Normal open | 1.93 s; 180 open headers; 5,708 open blocks | 30 s; 512; 8,192 |
| Newest-30-day graph reconstruction | 21.40 s; 56,160 scanned; zero fallback | 60 s; 56,160; 900 headers |
| Full fixture-range export HPT phase | 71.87 s | 240 s |
| Full fixture-range export total | 87.59 s | 300 s |
| Export lookup/proof | 0.02 s; 165 index entries; zero fallback | 438 entries; selected + 8,192 |

The candidate-bound guarded trigger released the normal production export path
for the exact fixture range. Terminal telemetry reports state `4`/published,
HPT and USB status zero, USB phase `14`/complete, 56,160 healthy selected rows,
sequences `1` through `56160`, timestamps `301254139` through `304623679`,
zero snapshot/requested-range gaps, zero degraded rows, and no range-index or
bulk-read fallback. USB publication took 15.70 seconds and the requested byte
count was 2,854,846.

Read-only independent inspection on the Raspberry Pi identified USB07 as model
`USB DISK 3.0`, serial `07190C5B908CDC85`, label `USB07_32G`, and UUID
`4693-0F61`. `HPT2_SMALL_56160.csv` is 2,854,846 bytes with SHA-256
`138AA1B1E863C31DDA52E38B4A6DC8A754475A8052545817A7953C7D21C0F406`.
It has 56,178 physical lines and exactly 56,160 contiguous numbered data rows.
Every timestamp parsed: first `2026-07-19 17:42:19`, last
`2026-08-27 17:41:19`, zero backward or duplicate timestamps, and all 56,159
transitions exactly 60 seconds. Metadata, actual HPT/sequence ranges, snapshot
validation, and the `records published: 56160` trailer match controller
telemetry. No partial/temp artifact or USB kernel I/O error was present.

The non-repairing FAT check reproduced USB07's known two-cluster free-summary
offset (`1,891,689` recorded versus `1,891,687` actual), explicitly left the
filesystem unchanged, and the read-only mount was unmounted. The required
smaller-stage regression therefore passes and clears the continuation boundary
to the clean 13-calendar-month rung.

## Clean 13-calendar-month rung — PASS

The fixture-only builder passed 13/13 invariants and the canonical managed
Debug rebuild before programming. Baseline, builder-boot,
post-initialization, exact-Release-boot, and final identity captures all report
the same installed SD card:

- protocol card status: `6`;
- CID-valid status: `1`;
- representative-sector-read status: `0` (success);
- manufacturer/MID: associated table entry / `0x05`;
- OEM/application ID: `??`;
- product/revision: `asdfg` / `2.2`;
- serial/manufacturing date: `7305` / `2026-03`; and
- complete raw CID: `05000C61736466672200001C8901A34F`.

The guarded initialization left an exactly empty store (`oldest=1`, `next=1`,
retained `0`). The exclusive builder then completed exactly 570,240 records,
sequences `1` through `570240`, timestamps `270411685` through `304626025`,
with zero chronology violations, zero gaps, and 19 explicitly suppressed
production records. The exact frozen Release S-record was restored and
program-verified before qualification measurements.

| Gate | 13-month result | Budget |
| --- | ---: | ---: |
| Normal open | 1.02 s; 453 open headers; 3,047 open blocks | 30 s; 512; 8,192 |
| Newest-30-day graph reconstruction | 53.26 s; 142,560 scanned; zero fallback | 60 s; 142,560; 900 headers |
| Operator export HPT phase | 166.38 s | 240 s |
| Operator export total | 195.10 s | 300 s |
| Export lookup/proof | 0.10 s; 420 index entries; zero fallback | 438 entries; selected + 8,192 |

Graph reconstruction selected 42,861 records and produced a ready cache over
sequences `427681` through `570240`. A live UI capture made after the owner
questioned the visible span proved that the viewport was following the newest
record at zoom level `1`, which is a 12-hour window. The underlying graph cache
contained the product-supported newest 142,560-record slice (about 99 days),
and the store retained the full 570,240-record fixture. The few visible hours
were therefore the active zoom window, not missing retained history.

The owner submitted the rolling export through the customer UI with the start
adjusted to the actual run time. Terminal telemetry reports state
`4`/published, HPT and USB status zero, USB phase `14`/complete, 129,581 healthy
selected rows, sequences `440728` through `570308`, timestamps `296855305`
through `304631220`, zero snapshot/requested-range gaps, zero degraded rows,
and no range-index or bulk-read fallback. USB publication took 28.70 seconds;
the requested byte count was 6,628,931.

Read-only independent inspection on the Raspberry Pi identified USB07 as model
`USB DISK 3.0`, serial `07190C5B908CDC85`, label `USB07_32G`, and UUID
`4693-0F61`. The newly published file
`SMI6_07162026_20260529t1948-20260827t1947.csv` is 6,628,931 bytes with
SHA-256
`341E2C2F4693CFC0C1D8A75BC49191558F9F43DC37E4A287D584A3E5FBC43DAB`.
It has 129,599 physical lines and exactly 129,581 contiguous numbered data
rows. Every timestamp parsed: first `2026-05-29 19:48:25`, last
`2026-08-27 19:47:00`, with zero backward or duplicate timestamps. There were
129,577 exact one-minute transitions. The only three non-one-minute
transitions are the measured builder-to-Release handoff after fixture sequence
`570240`: 1,176 seconds to the power-off record, 44 seconds to power-on, and 75
seconds to the next minute log. Metadata, actual HPT/sequence ranges, snapshot
validation, and the `records published: 129581` trailer all match controller
telemetry. No partial/temp artifact or USB kernel I/O error was present.

The non-repairing FAT check reproduced USB07's known two-cluster free-summary
offset (`1,891,284` recorded versus `1,891,282` actual), explicitly left the
filesystem unchanged, and the read-only mount was unmounted. The clean
13-calendar-month rung therefore passes and clears the continuation boundary
to the final two-year rung.

## Two-year / 1,051,200-record stage — PASS

Baseline, builder-boot, post-initialization, exact-Release-boot, and final
identity captures all report the same installed SD card:

- protocol card status: `6`;
- CID-valid status: `1`;
- representative-sector-read status: `0` (success);
- manufacturer/MID: associated table entry / `0x05`;
- OEM/application ID: `??`;
- product/revision: `asdfg` / `2.2`;
- serial/manufacturing date: `7305` / `2026-03`; and
- complete raw CID: `05000C61736466672200001C8901A34F`.

The fixture-only builder passed all 13 source invariants and the canonical
managed Debug rebuild. Its ELF/SREC hashes were
`BC2E7266E9E6000810A9437D40EEFBA3BA075DCFDAEB4DE11AE12E241B5DA983`
and
`FC80D6A76D6674D48EC436AD8C5901A41844C6EA992A2D6A91261F7C1670DC3C`.
The guarded initialization left an exactly empty store (`oldest=1`, `next=1`,
retained `0`). The exclusive builder completed exactly 1,051,200 records,
sequences `1` through `1051200`, timestamps `241561346` through `304633286`,
with zero chronology violations, zero gaps, zero failures, and 35 explicitly
suppressed production records. The exact frozen Release S-record was then
restored and program-verified before qualification measurements.

| Gate | Two-year result | Budget |
| --- | ---: | ---: |
| Normal open | 1.32 s; 453 open headers; 3,947 open blocks | 30 s; 512; 8,192 |
| Newest-30-day graph reconstruction | 52.85 s; 142,560 scanned; zero fallback | 60 s; 142,560; 900 headers |
| Operator export HPT phase | 166.49 s | 240 s |
| Operator export total | 198.31 s | 300 s |
| Export lookup/proof | 0.10 s; 420 index entries; zero fallback | 438 entries; selected + 8,192 |

Graph reconstruction selected 42,982 records and produced a ready cache over
sequences `908641` through `1051201`. It used 9,798 read commands, 286,414
blocks, 8,926 bulk refills, and zero bulk fallback. The normal customer export
was submitted by the owner through the UI and reached state `4`/published with
HPT and USB status zero and USB phase `14`/complete. It selected 129,567
healthy rows, sequences `921640` through `1051206`, timestamps `296859686`
through `304635600`, with zero snapshot/requested-range gaps, zero degraded
records, and no range-index or bulk-read fallback. USB publication took 31.79
seconds and the requested byte count was 6,628,205.

Read-only independent inspection on the Raspberry Pi identified USB07 as model
`USB DISK 3.0`, serial `07190C5B908CDC85`, label `USB07_32G`, and UUID
`4693-0F61`. The newly published file
`SMI6_07162026_20260529t2101-20260827t2100.csv` is 6,628,205 bytes with
SHA-256
`E78B34AFEDA6CDE8713C73B1D22EE71BDEE2280684C713A5D708425998135644`.
It has 129,585 physical lines and exactly 129,567 contiguous numbered data
rows. Every timestamp parsed: first `2026-05-29 21:01:26`, last
`2026-08-27 21:00:00`, with zero backward or duplicate timestamps. There were
129,563 exact one-minute transitions. The only three non-one-minute
transitions were the measured fixture-to-Release handoff: 2,042 seconds to the
power-off record, 44 seconds to power-on, and 48 seconds to the next minute
log. Metadata, actual HPT/sequence ranges, snapshot validation, and the
`records published: 129567` trailer all match controller telemetry. No
partial/temp artifact or USB kernel I/O error was present.

The non-repairing FAT check reproduced USB07's known two-cluster free-summary
offset (`1,890,879` recorded versus `1,890,877` actual), explicitly left the
filesystem unchanged, and the read-only mount was unmounted. The final target
capture reports the exact frozen Release, USB detached, protocol status `6`,
CID valid, representative read success, and zero HPT, system, and USB errors.

## G4 decision — PASS

All three credited stages passed before the next larger stage began. The same
newest-30-day graph work remained fixed at 142,560 scanned records and about
53 seconds for 100 days, 13 calendar months, and two years. The same full
newest-90-day export remained fixed at 420 index entries, zero fallback, about
165–166.5 seconds for the HPT phase, and under 199 seconds end to end. Every
fixture was independently chronological, every Release measurement was bound
to the same frozen candidate and installed-card CID, and every USB result was
independently verified. Gate G4 therefore passes. This evidence makes no
Controller B, SD-family, wrap/reclaim, ECO, release, or rollout claim.

## Raw target evidence

- First-attempt exact-Release evidence:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/`
- First-builder terminal evidence:
  `tmp/camp003-fastfill/work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage1-100d-builder-terminal/`
- Corrected-builder terminal evidence:
  `tmp/camp003-fastfill/work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage1-repeat-builder-terminal/`
- Credited exact-Release graph/open/export evidence:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage1-repeat-release-*`
  and
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage1-repeat-export-*`
- Smaller-regression builder evidence:
  `tmp/camp003-fastfill/work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/smaller-regression-*`
- Smaller-regression exact-Release evidence:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/smaller-regression-*`
- Independent USB inspection summary:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/smaller-regression-usb07-independent-inspection.json`
- 13-calendar-month builder evidence:
  `tmp/camp003-fastfill/work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage2-13m-*`
- 13-calendar-month exact-Release evidence:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage2-13m-*`
- 13-calendar-month independent USB inspection summary:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage2-13m-usb07-independent-inspection.json`
- Two-year builder evidence:
  `tmp/camp003-fastfill/work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage3-2y-*`
- Two-year exact-Release evidence:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage3-2y-*`
- Two-year independent USB inspection summary:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/staged-retention-20260827/stage3-2y-usb07-independent-inspection.json`

## Session checkpoint

Final state after the clean two-year rung and G4 decision:

- Controller A is running the exact frozen Release candidate with SREC SHA-256
  `FA874D68BFBD16BDC4891ED9C18ED87695CC4EE0B113EF2756B54E675F95E0FC`.
- The installed SD card remains in Controller A with CID
  `05000C61736466672200001C8901A34F`; do not remove it while powered.
- The corrected 100-day Stage 1, required 56,160-record smaller-stage
  regression, clean 13-calendar-month stage, and clean two-year stage are
  credited as passed, each including independent USB CSV verification.
- USB07 is physically in the Raspberry Pi reader and is unmounted after the
  read-only evaluation.
- The fixture-only development worktree remains `tmp/camp003-fastfill`; its
  two-year builder hash is recorded above and it must never be treated as the
  qualification candidate.
- Campaign 026 is complete and Gate G4 passed. No release, ECO, rollout,
  Controller B, or SD-family action is authorized by this result.
- No Git commit or staging operation was performed for this checkpoint;
  unrelated owner worktree changes remain preserved.
