# Controller A durable retirement and ordered readback

Status: passed
Type: evidence
Updated: 2026-07-23
Next Action: proceed to separately scoped raw-export, interruption/wrap, and Controller B gates
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-controller-a-hpt-triple-circular-physical-qualification.md

## Candidate and target

- Controller A assembly `1751136`
- J-Link `69664082`; target voltage `3.285 V`
- Card `HPTCS0`; `15,654,912` sectors
- Debug SREC SHA-256:
  `A2ECEE7346EC946CCDD9109C6A5ECB850DC2DBB340E14E21D8AACF351AE16528`
- Programming and verification: J-Link V9.58 reported `O.K.`

## Durable format correction

The first injected campaign proved runtime retirement but a normal reset
cleared the RAM bitmap to `0/0/0`. The corrected media layout reserves 20 tail
sectors for two alternating complete retirement snapshots. Each snapshot has
media/snapshot generations, per-sector CRCs, and a header CRC. The old
pre-release prototype was explicitly classified and destructively
reinitialized; there is no automatic upgrade.

The corrected reinitialization completed with media generation 3,
commissioning iterator `1/1`, initialization phase `COMPLETE`, and retirement
snapshot generation 2.

## Lane campaign

The RAM-commanded bounded harness passed all ten checks (`passed=0x3FF`,
`failed=0`):

- one-lane injected failure: append/read lane mask `0x6`, healthy quorum;
- dual-lane injected failure: append/read lane mask `0x4`, degraded;
- only affected segments retired: A/B/C `2/1/0`;
- following records after each injection returned to lane mask `0x7`;
- chamber-control thread continued running during the campaign;
- retirement snapshot generation advanced from 2 to 5.

Measured target values:

- maximum normal/injected append including retirement metadata commit: 32
  ThreadX ticks (`320 ms`);
- maximum degraded read: 271 ticks (`2.71 s`);
- complete injected campaign: 425 ticks (`4.25 s`);
- SD-thread stack used/headroom: 2,500/1,596 bytes in the campaign capture.

## Reset and readback

After a normal reset:

- media state `HPT_READY`; HPT/SSP/first-error `0/0/0`;
- media generation `3`;
- startup open scan `394` ticks (`3.94 s`);
- retirement snapshot generation `5`;
- retired A/B/C remained `2/1/0`;
- last lane mask `0x7`;
- sequence continued monotonically.

The read-only recovered-range command then traversed:

- first/last sequence `1/16`;
- records `16`;
- gaps `0`;
- healthy `12`;
- degraded `4`;
- terminal status `HPT_STATUS_END`;
- traversal time `1,090` ticks (`10.90 s`).

This proves the commissioning record and all subsequent records in the captured
range remain ordered and readable after lane retirement and reboot. It does not
claim physical power-cut, full wrap, Controller B, multi-card, or completed
customer-export qualification.
