# Checklist: Controller A HPT wrap and power interruption qualification

Status: template; remaining physical interruption execution belongs to srv-rpi00.local and is not ready
Type: checklist
Updated: 2026-08-02
Next Action: none in this firmware workspace; the Pi qualifier creates an immutable campaign instance only after its live-controller gate, exact bundle import, card identity, and case authorization pass
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md

Execution Owner: jong@srv-rpi00.local:~/dev/sd_qualification

This local checklist preserves the historical Controller A harness proof and
the remaining firmware acceptance requirements. The remote qualifier owns all
new physical interruption execution, generated evidence, and terminal
disposition. The separate HPT Lab Power service supplies G-PWR operations; the
operator supplies physical/safety authorization. Unchecked physical cases are
not local tasks.

## Goal

Prove on Controller A that the triple-circular store preserves acknowledged
records, never invents a committed record, resumes logging, iterates in order,
and exports complete data across reclaim/wrap and approved physical power
interruptions.

## Fixed Hardware

- Controller A assembly `1751136`
- J-Link `69664082`
- Dedicated expendable raw SD card `HPTCS0`
- Current pre-harness Debug SREC SHA-256:
  `532D7A2A9F147525D87028F680983EDD5BCCB40510E0C6E380E09102682E3353`
- Current firmware source commit: `8de76d1b`

The harness will change the source and image. Record new exact hashes before
programming. Never treat a host/model pass as controller qualification.

Frozen harness candidate:

- Source commit: `dff3f478d3b47b8211a2fd8e24a83806c17da9a4`
- Debug SREC SHA-256:
  `48259DAC09342662A24E15E298C2BD1FD502370DC5404E42A2420ACFF0D13BAD`
- Release SREC SHA-256:
  `63F9E4E5ED78B48C60B7E99E5C4EF0986580E6C375AA983B13B7C674C766D4F3`

## Standing SD identity evidence

- [ ] Every new evidence artifact includes or links a same-run service-467 CID
  capture with protocol status, CID/sector-read validity, manufacturer/MID,
  OEM/application ID, product name/revision, serial number, manufacturing date,
  and complete raw CID.
- [ ] Repeat the CID capture after each reboot used as qualification evidence
  and after any power-off card reinsertion, initialization, or replacement.
- [ ] Do not remove or insert an SD card while controller power is present;
  powered hot swap is unsupported and expected to damage or corrupt the card.
- [ ] If CID is unavailable, record the detection/driver reason; do not omit
  the identity block.

## Immediate Owner Setup

- [x] Safely eject and set aside the customer-export USB stick.
- [x] Leave `HPTCS0` installed in Controller A.
- [x] Keep Controller A powered and in normal non-heating operation.
- [x] Do not run service 468 or any SD evaluator/endurance service.
- [x] Do not remove the SD card or interrupt controller power until Codex gives
  a boundary-specific instruction.

## Automated Harness Gate

- [x] Capture the pre-change media generation, next/oldest sequence, lane
  positions, retirements, first storage error, and controller identity.
- [x] Add exhaustive host write-cut injection at every data, commit, segment
  header/seal, reclaim, retirement-snapshot, and flush boundary.
- [x] At every cut, reopen and prove the last acknowledged quorum record
  remains, an incomplete record is absent/rejected, and append can continue.
- [x] Add a diagnostic-only bounded target wrap mode with an explicit magic
  command, fixed operation limit, status/progress, cancel/failure handling, and
  no production-path activation.
- [x] Target wrap mode must exercise at least three logical wraps, reclaim,
  ordered readback, and export across wrap without waiting for real-time
  minute logging.
- [x] Run source invariants, deterministic models, interruption harness,
  existing HPT/export/SD regressions, and clean qualified Debug/Release builds.
- [x] Record RAM/ROM/static-storage changes before target execution; SD-thread
  stack margin, maximum
  append/reopen/read latency, and watchdog/control progress.
- [x] Freeze exact Debug/Release hashes and program/verify only Controller A.

## Controller A Accelerated Wrap Gate

- [x] Reconfirm `1751136` / J-Link `69664082`, `HPTCS0`, non-heating operation,
  no USB, and no competing SD service.
- [x] Start the bounded wrap diagnostic and capture its initial acknowledged
  sequence and intended geometry/window.
- [x] Prove at least three wrap generations with zero unexplained gaps or false
  records.
- [x] Prove ordered readback from the retained oldest sequence through the last
  acknowledged sequence.
- [x] Export a range spanning wrap; require exact requested/actual range,
  ordered rows, explicit health/gaps, completion trailer, and no `HPTE.TMP`.
- [x] Prove normal minute logging and chamber UI/control remain responsive.

## Automated Physical Power-Interruption Gate

No additional physical case may run until `G-PWR` passes
`work/runbooks/runbook-autonomous-hpt-sd-qualification.md`. The final topology
keeps USB data/ground and the J-Link target ribbon connected. The external
controller cuts J-Link USB 5 V, waits 10 seconds, cuts line voltage to the
controller's 24 VDC supply, keeps both off 30 seconds, restores controller line
voltage, waits 10 seconds for boot, and restores J-Link USB 5 V.

The previous physical-SWD-removal attempts remain historical evidence only.
They do not qualify the new automation. G-PWR requires at least three
consecutive non-writing volatile-witness cycles plus one repeat of the already
qualified data-durable-before-commit boundary.

The display turning off is not proof of MCU power loss. Before recovery, run
the automatic post-cut boot gate and require the volatile arm command/status
and diagnostic wrapper to be gone, the raw store to reopen under its normal
device context, and the recovered tail to stop at the interrupted sequence.

Record the last acknowledged sequence, intended operation, armed boundary,
firmware hash, card/controller identity, isolation/reconnection times, and
first storage error.

- [x] Implement a RAM-magic-only hold after lane A record data returns from its
  synchronous write/flush and before any commit block write.
- [x] Keep the SD owner asleep at the hold while Controller and HMI threads
  continue, expose an exact `HOLDING_CUT_POWER` state, and provide a safe cancel
  path that lets the append complete.
- [x] Provide a post-reboot recovery command that proves the last acknowledged
  record, rejects the interrupted payload marker as a false commit, and appends
  and reads a fresh three-lane recovery record.
- [x] Resolve all target RAM symbols from the frozen ELF; do not use stale
  hard-coded addresses.
- [x] Historical manual harness required physical J-Link isolation before arm;
  this is superseded for future execution by G-PWR.
- [x] Capture the second attempted cut and prove from retained volatile command,
  state, wrapper ownership, and run count that normal startup clearing was not
  observed after the operator disconnected J-Link power, removed/restored
  controller power, waited for boot, and then restored J-Link power.
- [x] Add an automatic true-reboot gate and block recovery unless it passes.
- [x] Run and pass a non-destructive volatile-witness cycle using J-Link-off,
  10-second discharge, 30-second both-off, controller-first boot, and
  post-boot J-Link power-up.
- [x] Capture the third armed attempt and prove that the live hold survived
  despite the timed J-Link-off sequence while the target cable remained
  physically attached.
- [x] Correct the harness so a private power-cut hold keeps healthy raw HPT
  media publicly present; commit `9849b00e`, Debug S-record SHA-256
  `46AFA0139C06C83DC8FEEFC556F7C80FF044F3A913E30837F71040D89A77D79B`.
- [x] Arm corrected attempt 5 at data-durable-before-commit and visually prove
  the periodic Home-screen check does not display a false missing-card warning.
- [x] Complete attempt 5 with the J-Link target/SWD cable physically removed before
  controller power-off.
- [x] Demonstrate one true controller-off interval with J-Link physically
  disconnected; the first attempt retained J-Link back-power and the second
  did not demonstrate normal startup clearing for an unresolved reason.
- [x] Pass G-PWR with the permanently connected topology before another
  destructive interruption.
- [ ] Interrupt during record-data write.
- [x] Interrupt between data durability and record commit.
- [ ] Interrupt during segment header/seal transition.
- [ ] Interrupt during reclaim/next-segment activation.
- [ ] Interrupt during retirement-metadata snapshot commit.
- [ ] After every reboot, prove all previously acknowledged records remain.
- [ ] After every reboot, prove the interrupted incomplete record is absent or
  explicitly rejected, never returned as committed.
- [ ] After every reboot, append and read back a new record to prove recovery.
- [ ] Confirm no cut blocks boot, UI, alarms, communications, or control.

## Runtime Closeout

- [ ] Cancel/disable the diagnostic command and prove it cannot start without
  its explicit magic value.
- [ ] Reopen `HPTCS0` in normal raw ownership with HPT/SSP status zero or record
  the exact accepted degradation.
- [ ] Leave Controller A on the frozen qualified candidate with no USB or
  pending diagnostic/export handoff.
- [ ] Preserve hashes, status captures, interruption records, and wrap/export
  evidence under
  `work/evidence/hpt-log-store-circular-mirror/controller-a/`.
- [ ] Update the parent without claiming Controller B or multi-card
  qualification.

## Stop Conditions

Stop immediately and preserve state if controller identity differs, heating or
unsafe outputs are active, SD/USB ownership is ambiguous, an unbounded command
is observed, watchdog/control progress stops, acknowledged data disappears, a
false committed record appears, or the first storage error cannot be captured.

## Verification

- Exhaustive host write-cut results
- Existing HPT commissioning, customer-export, circular model, and SD-safety
  checks
- Software completion gate:
  `work/evidence/hpt-log-store-circular-mirror/software-completion-gate-20260724.md`
- Qualified clean Debug/Release builds and exact artifact hashes
- J-Link target status captures before/after every physical interruption
- Ordered readback and finalized customer CSV spanning wrap
- First-boundary software gate:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/power-cut-data-durable-software-gate-20260723.md`
- Second invalid-attempt disposition:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/power-cut-data-durable-repeat-20260723/qualification-disposition.md`
- Passed reset witness:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/reset-witness-20260723/qualification-result.md`
- Third invalid-attempt disposition:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/power-cut-data-durable-attempt3-20260723/qualification-disposition.md`
- Corrected attempt-5 pre-cut UI observation:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/power-cut-data-durable-attempt5-20260723/precut-ui-observation.md`
- Passed attempt-5 physical cut and recovery:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/power-cut-data-durable-attempt5-20260723/qualification-result.md`
