# HPT2 M3 performance plausibility review

Status: complete
Type: evidence
Updated: 2026-08-27
Next Action: close M3 with the narrowed exact-candidate claim
Campaign: hpt2-qualify-and-close-supported-claim
Canonical Truth: docs/hpt2-qualification-contract.md

## Review rule

An elapsed-time pass is necessary but not sufficient. Each performance-bearing
path must identify the requested bound, the code's starting position, expected
I/O and order of growth, relevant hardware/media capability, observed target
work, and one `ACCEPT`, `MITIGATE`, or `NARROW` disposition. A bounded request
that scans from sector 1, the oldest retained segment, or another media origin
is not acceptable when validated index or checkpoint state can position the
work directly.

Independent measurements are coverage even when they are not the largest
counter in a run. Dominance is reported separately and is never manufactured by
repeating a stochastic test. Structural transition and reclaim paths still
require positive target-owned identity proof.

## Hardware and media basis

- Renesas S7G2 clock configuration: 24 MHz crystal, PLL `/2 *20`, 240 MHz
  ICLK, 60 MHz PCLKB, and enabled SDCLK output.
- SD interface: four-bit SDMMC channel 0, DTC transfer, 512-byte blocks.
- Controller timing evidence uses 10 ms ThreadX ticks.
- Controller A: assembly `1751136`, probe `69664082`, variant `0`, raw CID
  `05000C61736466672200001C8901A34F`.
- Controller B: assembly `1751219`, probe `69660123`, variant `1`, raw CID
  `05000C61736466672200001C8201A379`.
- Both cards passed same-run protocol status, CID validity,
  representative-sector read, full-address scrub, HPT2 initialization, and
  three-lane ready-state checks before the measurements below.

## Code-work baseline

The production store is triple mirrored. An ordinary qualification append
performs, per lane, one next-slot commit invalidation, one data-sector write,
one prepared-commit write, and one final-commit write: 12 synchronous
512-byte writes across three lanes. Exact readback examines a data and commit
sector on each lane: six 512-byte reads. This is fixed work per record and does
not scale with retained history. The qualification service also yields 10 ms
after each verified record.

The current host oracle proves these algorithmic ceilings for the exact source:

- normal checkpointed open: at most 459 segment-header reads and 6,632 total
  read blocks;
- explicit full recovery: at most 66,000 segment-header reads;
- direct range seek: at most six segment-header reads;
- range index: 146 entries per lane, 438 total;
- ordinary range proof: 4,092 records; and
- bulk traversal: 150 commands versus 4,772 scalar commands in the split-lane
  fixture, a 31.81x command-count reduction.

These are code/model bounds, not substitutes for physical-target elapsed and
counter evidence.

## Current target observations and dispositions

| Surface | Predicted work and scaling | Current observation | Disposition |
| --- | --- | --- | --- |
| Ordinary mirrored append | 12 block writes per record plus in-memory CRC/index updates; `O(1)` in retained history | Final 20-row S6 aggregate: maximum 34 ticks / 340 ms; no queue drops or production-log loss in the 20 credited S5 contention rows | `ACCEPT`: below the 0.50 s ordinary-append gate with fixed work independent of retained history |
| Exact mirrored readback | Six block reads per requested record with quorum comparison; `O(1)` in retained history | Final 20-row S6 aggregate: maximum 6 ticks / 60 ms; every credited row contains a valid read maximum even though READ was not dominant | `ACCEPT`: measured coverage is independent of dominant-path identity and the result is plausible for six synchronous mirrored reads |
| Segment transition | Fixed header/seal/checkpoint work at a 1,023-record production boundary; independent of total history | Both controllers supplied positive target-owned transition identity; final S6 maximum append was 340 ms and maximum bounded-stop end-to-end upper bound was 2,114 ms | `ACCEPT` for segment transition; reclaim remains a separate pending lifecycle surface |
| S4 accelerated append/readback fixture | Same 12-write/six-read proof per record plus a 10 ms yield; intentionally stronger than production | Final 129,600-record runs sustained about 31-32 verified records/s; approximately 384 writes/s and 192 reads/s | `NARROW`: valid durability/timing stress evidence, but too write-heavy for general-purpose history population; select a separately reviewed bounded population method if later profiles need setup speed |
| S4 repetition policy | Exact BEFORE/AT/AFTER tuples are deterministic and independently repeated on both variants; no confidence target or independent fault mechanism supported three same-cell populations | Final v5/v4 audit passes: one physical `1440` observation per region/controller, the existing terminal `129600 / AFTER` observation per controller, and exhaustive software proof for the remaining mappings; no implementation gap or invalid extended evidence | `ACCEPT` after mitigation: one exact observation represents each deterministic class and a contradiction expands only the affected class |
| S4 physical cell selection | Target indexes feed one fixed table, regions feed one minus/identity/plus mapping, and every ordinary hold uses the same verified-record comparator; target value does not change the append/read/stop path | Both `129600 / AFTER` terminal runs traversed all milestones; A and B each passed physical `1440 / BEFORE`, `AT`, and `AFTER`; v4 avoids 3,127,680 redundant fixture records versus the original Cartesian rule | `ACCEPT` after mitigation: physical hardware-variant and region coverage is retained without repeatedly exercising an equivalent target-value mapping |
| Pi runtime observation | J-Link snapshot decoding and stability checks should observe, not dominate, controller work | Each intermediate capture takes about 5-7 s; paired execution caused baseline instability. One B preflight then failed before run creation because the Remote Server leaked a client and reported `max connections exceeded`; database, target containers, and firewall were quiescent, the exact B server alone was restarted, and the subsequent read-only identity/flash/CID observation and remaining matrix cells passed | `ACCEPT` for sequential M3 evidence; `MITIGATE` remains open for paired execution and automatic stale-connection recovery before either method is reusable |
| S0-S3 functional repetition | Exact immutable pre-write counters select one of four deterministic stop states; publication timing affects which state is sampled but not the code executed after that state is proven | A no-work S0 observation consumed about 57 s of Pi/J-Link orchestration; repeated S2 attempts often credited S1/S3 because S2 is a narrow random sampling window; the final v5 audit has one exact state proof per controller | `ACCEPT` after mitigation: deterministic state coverage is complete; variable timing remains only in the 20-row S6 aggregate |
| Checkpointed normal open | Bounded by checkpoint validation, at most 145 sealed trailers per lane, and active-prefix scans; no full-media walk | A: 0.57 s, 453 headers, 1,751 blocks. B: 1.87 s, 453 headers, 5,483 blocks. Both exact-candidate captures followed coordinated reboots and retained exact CID identity. | `ACCEPT`: both variants pass 30 s / 512 headers / 8,192 blocks and the 453-header result matches the predicted 459 ceiling |
| Bounded graph reconstruction | Direct-position from the retained range, then validate mirrored records only inside the visible window; `O(visible records)`, not `O(total history)` | A: 56,160 records, 61.82 s, 337,824 blocks. B: 56,160 records, 62.59 s, 337,902 blocks. Both have zero fallback and reproduce about six blocks/record. Linear maximum-window projection is 157-159 s. | `NARROW`: the exact candidate does not qualify the 60-second 30-day initial-reconstruction claim; repeating the scan or reducing the fixture is not mitigation |
| Bounded export seek/publication | Examine at most 438 range-index entries, direct-position each lane, and scan only proof/request records | Exact-source host bound remains six seek headers and 4,092 ordinary proof records, but no exact-candidate physical export result was collected before the graph core gate failed | `NARROW`: no exact-candidate 30-day/90-day physical export-performance claim; prior-candidate evidence remains history, not substitute credit |
| Physical maximum-geometry wrap/reclaim | Structural work must be proven without brute-forcing 11.25 million verified appends per lane; target work must remain proportional to the intended lifecycle evidence | Deterministic maximum-geometry models pass, but the exact-candidate destructive bounded wrap fixture was not run after the reproducible graph core-gate failure | `NARROW`: maximum-geometry physical wrap/reclaim is not in the exact-candidate supported claim; continuing destructive population cannot repair the graph result |
| Explicit fail-closed recovery | Only approved path allowed to scan full geometry; `O(total segments)` with visible progress/cancellation | Host ceiling is 66,000 header reads, but `HptLogQualificationRecover()` has no caller, command/mailbox entry, progress publication, or cancellation path in the exact candidate; only checkpointed `HptLogQualificationOpen()` is production-reachable | `NARROW`: explicit full recovery is not in the supported candidate claim. A missing/corrupt checkpoint fails closed and requires the approved power-off media-replacement or guarded reinitialization workflow; it must not silently fall back to a long origin scan. |

## Qualification-development effect

- Matrix S6 reports `measured_paths` separately from `dominant_paths`.
- The front-door SD qualification contract now requires the same pre-admission
  hardware/code/observation review for every new performance-bearing leaf.
- Matrix S4 requires a stated deterministic/stochastic classification,
  repetition rationale, predicted work, and duration before target admission;
  deterministic exact-boundary cells now require one observation per controller.
- Both append and read maxima must be valid in every credited S6 observation.
- Transition or reclaim credit remains fail-closed and requires controller-path
  telemetry with exact ownership bounds.
- Any `MITIGATE` row blocks credit until the method or implementation is
  corrected and affected evidence is rerun. Any `NARROW` row must appear in the
  final supported claim.
- Every M3 performance-bearing surface now has a hardware/code/observation
  comparison and an `ACCEPT` or `NARROW` disposition. Paired J-Link execution
  remains deferred method work and receives no qualification credit.

## Full-recovery reachability decision

The portable store retains `HptTripleCircularRecover()` and the qualification
wrapper retains `HptLogQualificationRecover()`, but the exact firmware has no
caller for the qualification wrapper. `HptTripleCircularRecoverQualification()`
enters `tc_open(..., full_recovery=true)` without a progress callback or a
cancellation token. Adding a debugger-only function call would prove neither a
supported product route nor safe scheduling behavior, so it is not an honest
substitute for target qualification.

The M3 disposition is therefore `NARROW`, not “pending forever” and not a
brute-force target experiment. Checkpointed normal open remains supported if it
passes its independent target gate. Explicit full recovery remains excluded
until a future candidate supplies a product-reachable, visible, cancellable
entry point and repeats the affected qualification.
