# Triple-mirrored circular HPT log store Workpackage

Status: superseded
Type: workpackage
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Canonical Truth: docs/sd-card-operation-and-recovery.md

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Predecessor: work/wp/completed/wp-hpt-embedded-log-store-v0-4-0-renesas-integration.md

## 2026-08-11 Operator-message closeout

The export-domain failure-reason and installed-unformatted-card Format tickets
are complete. All six export messages are asserted, and initialization
failures now report the confirmed phase, HPT/driver status, service-468
recovery, and power-off-before-card-replacement guidance. Current focused
gates and canonical Debug/Release builds/package hashes pass. Presentation-only
target injection was dispositioned by evidence equivalence because the remote
qualifier exposes no admitted injection profile; transport/media/recovery
target requirements remain unchanged. Evidence:
`work/evidence/hpt-operator-failure-message-closeout-20260811.md`.

## 2026-08-02 Workspace Ownership and Readiness Gate

This workpackage has three explicitly separated lanes.

### Portable-core source lane — separate repository

`jong@srv-rpi00.local:~/dev/HPT-Embedded-Log-Store` owns portable source,
media/API specifications, host simulation/tests, and the immutable portable
release identity. It owns no Renesas build or controller qualification claim.
The current published release is v0.5.0/media 2.0 at tag commit
`d7b1dbe8...`; this workspace pins that release and `sd_qualification` imports
its independently packaged validator. Neither repository manufactures the
other repository's release identity.

### Local firmware lane — active

`E:/dev/high_point/7520553_SMI_FW` owns adoption of the pinned portable release,
firmware source and managed builds, exact candidate artifacts/hashes,
firmware-side diagnostics/interface version, campaign requirements, immutable
bundle publication, returned-result review, and final firmware/release
disposition. It owns host/model/static/build checks only; it does not coordinate
any test that executes on Controllers A/B.

### Remote qualification lane — fixed-mailbox A/B identity ready; stop/recovery gate open

`jong@srv-rpi00.local:~/dev/sd_qualification` owns exact SMI bundle import,
sample/campaign records, live A/B orchestration, every controller-executed
baseline/functional/fault/recovery/calibration/interruption/endurance case,
physical card intake, generated evidence, failure attribution, and family
approval. Its source is clean at `e9edba3` and the healthy fixture-only
deployment is `hpt2-postgres-lock-e9edba3`. It imported the newer fixed-mailbox
bundle `smi-00-05-00-bc0b6ce4d066-release` as valid but unadmitted
content address `5df475bd...176ce`; the stored contract passes the deployed Pi
validator. Both roles remain disabled and bind the newer bundle. Before this
promotion, the older candidate was complete-readback verified on Controller A
and its independent read-only firmware/CID/HPT gate passed. B operation
`7d3be985...` then passed its fixed-mailbox program/verify/reset/run gate. B's
first separately authorized fixed-mailbox read-only attempt stopped before
publication because the Pi observer compared normal VTref drift as probe
identity. PR #29 fixed, tested, merged, and deployed that defect without a
target retry. Freshly authorized operation `a05bc76d...` then passed exact
flash, stable mapped state, full same-run CID, and HPT readiness. Its sole
diagnostic failure bit is the obsolete multi-block-rejection predicate; all
operational status/error fields are clean and the raw masks are retained for
pre-release contract cleanup. The end-to-end A promotion then passed:
programming operation `ae2fe6ff...` preserved VEEPROM/option memory and
installed exact flash `68029e19...7bb28`; independent observation
`e140c0f2...` passed stable state, CID
`035344535330384780976F0084018559`, HPT readiness, and cleanup. Its UI/API
explicitly report
`BOUNDED_STOP_RECOVERY_UNSUPPORTED`, so all state-changing profiles remain
disabled. `HPT2_ENDURANCE_BASELINE_V1` is selected and its contract is defined
in `docs/hpt2-endurance-baseline-v1.md`. Its firmware ABI now passes host/model,
static, and clean Debug/Release build gates. Its exact matching Pi fixture
contract and preparation-only UI are deployed. The new ABI is programmed and
independently observed on A and B. Migration 0013, durable fixed-mailbox
orchestration, and the protected operation-only tools service are deployed
fixture-only with roles/endpoints empty and live admission false. No physical
campaign begins until safe adapter admission,
measured stop deadline, recovery evidence, regression plan, and exact
authorization pass. The exact A/B stop/recovery/regression plan is reviewed in
`work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md`,
and Pi PR #30 plus the exact deployed image pass the complete PostgreSQL and
SQLite suites. Target execution is now blocked on physical intake: the Pi has
zero card samples/CID captures and both installed SanDisk cards are retained
non-expendable controls.

The separate HPT Lab Power service supplies qualified G-PWR operations to the
Pi qualifier. The operator supplies physical card handling with controller
power off and required authorizations. Neither is owned by this repository.

The incomplete physical acceptance criteria below are requirements for the
returned campaign manifest, not local `Next Action` instructions. This package
closes only after the local adoption/bundle lane passes and this workspace
accepts the remote result manifest; remote application health alone is not
qualification evidence.

## Current Context

HPT Embedded Log Store v0.4.0/media format 1.0 is integrated with a bounded
Renesas block adapter and has passed commissioning, reopen, geometry, bounds,
write-protection, and injected-error diagnostics on Controller A. Its current
append-only format eventually reports `FULL`; it does not reclaim old segments,
retire persistently failing logical regions, or store redundant record copies.

The application records one 64-byte `S_LogRecord` per minute. Media format 1.0
allocates two 512-byte logical sectors per record and uses a power-loss-safe
commit protocol. One 90-day stream therefore requires approximately 129,600
records and 126.6 MiB before additional format metadata and reserve. Three
complete 90-day streams need approximately 380 MiB, so the target fits the
minimum supported nominal 2 GB card and has substantial margin on 8 GB media.

The product uses commodity retail SD cards from 2 GB through 32 GB. The card's
internal controller owns physical ECC, NAND bad-block mapping, and wear
leveling. Firmware sees only logical sectors and cannot prove that widely
separated logical regions occupy independent NAND. All three copies still
share the card controller, power, contacts, and package.

## Recommendation

Create a new, versioned HPT media format with three independently managed
circular record lanes: A, B, and C. Each lane has separate segment generations,
append position, validation state, and retired-segment accounting. Commit a
record independently to all three lanes; report normal redundancy after any two
matching copies commit, degraded success when only one commits, and loss only
when no copy commits. Never let storage failure block chamber control.

Use whole-segment reclamation and retirement. Do not attempt firmware-level
physical bad-block mapping, assume logical distance equals physical distance,
silently substitute a disagreeing value, or automatically format unknown or
damaged media. Use excess capacity for rotation, spare segments, recovery
metadata, and event reserve rather than promising decades of customer history.

## Current State

Completed:

- Pinned and byte-verified the immutable HPT v0.5.0 portable source release at
  tag commit `d7b1dbe8...`; adopted its pristine portable tree while retaining
  the product-owned target adapter/API boundary.
- Managed Debug/Release rebuilds, all static/invariant suites, deterministic
  circular/scrub/export models, and all 141 recovery cuts pass for the adopted
  source.
- Published and imported exact firmware bundle
  `smi-00-05-00-248c1e7b7aab-release`, outer manifest
  `2340c9e8...0d28`, with exact Release artifacts and diagnostic mapping.
- Reproduced and imported the newer fixed-mailbox bundle
  `smi-00-05-00-bc0b6ce4d066-release` as valid but unadmitted outer
  manifest `5df475bd...176ce`; its exact stored profile, mapping, and fixed
  mailbox/acknowledgement/status contract pass the deployed Pi validator.
- Atomically rebound only Controller B and completed programming operation
  `7d3be985...` with exact flash `68029e19...7bb28`, unchanged VEEPROM and
  option memory, and a running CPU. After the observer VTref fix, independent
  operation `a05bc76d...` passed exact flash, stable state, full CID
  `035344535330384780976F0085018507`, HPT readiness, and cleanup.
- Atomically rebound only Controller A and completed programming operation
  `ae2fe6ff...` with exact flash `68029e19...7bb28`, unchanged VEEPROM and
  option memory, and a running CPU. Independent operation `e140c0f2...` passed
  exact flash, stable state, full CID `035344535330384780976F0084018559`, HPT
  readiness, and cleanup. Both registry entries remain qualification-disabled.
- Deployed the Pi read-only observer in PR #18. Its authorized Controller A
  full-flash comparison published `BLOCKED/FIRMWARE_IDENTITY_MISMATCH` because
  A still runs the older `ca6f573a...` Release image; CPU remained running and
  no mapped RAM read occurred. Controller B remained untouched.
- Deployed the separately gated code-flash-only programmer through Pi PR #19
  and its pre-target Remote Server readiness correction through PR #20.
  Authorized operation `741d370e...` installed the exact Release candidate on
  Controller A, complete-readback verified `d1babfa7...`, preserved complete
  VEEPROM and option-memory hashes, and left the CPU running.
- Deployed the observer readiness correction through Pi PR #21. Read-only
  operation `19a603d0...` independently passed exact candidate flash, stable
  mapped state, zero main-system errors, valid representative-sector read, and
  complete CID `035344535330384780976F0084018559`. At that historical
  Controller A checkpoint, qualification state remained unchanged and
  Controller B was untouched.

- Commodity retail media and 90-day minimum-retention policy accepted.
- HPT v0.4.0/media 1.0 source adoption, Renesas adapter, commissioning path,
  and Controller A injected-error diagnostics completed.
- Minimum-capacity calculation shows three 90-day minute-record copies fit on a
  nominal 2 GB card.
- Target architecture, failure states, migration boundary, and qualification
  stages recorded in this workpackage.
- Media 2.0 contract, product-owned triple-circular core, legacy media 1.0
  classification/guarded upgrade, queued-record integration, and service
  diagnostics implemented.
- Protocol-based SD detection/status and read-only CID reporting are complete.
  The owner verified the compact operator service-467 screen through its final
  `Raw CID` field on Controller A.
- Deterministic capacity/quorum/retirement/wrap model, 33 commissioning source
  invariants, 20 SD-safety invariants, and clean isolated Debug/Release builds pass.
- Exact pre-Controller-A hashes, memory evidence, and operation-specific physical
  checklist recorded without programming a controller or accessing a card.
- Exact Debug candidate programmed and verified on Controller A; retained
  `HPTCS0` classified read-only as recognized media 1.0 with zero SSP/sector
  error and no automatic format or append.
- The owner completed service 468 initialization on Controller A. A subsequent
  read-only RAM snapshot found the expected controller/card identity and
  geometry, SSP status zero, first-error sector zero, media state
  `CORRUPT_OR_UNKNOWN`, and HPT status `INVALID_ARGUMENT`. The in-memory store
  showed media generation 1, an open-format layout, and sequence advancement,
  so this is a firmware lifecycle/status failure rather than evidence of an SD
  transport failure.
- The corrected Debug image was programmed and service 468 completed
  successfully. Read-only status showed `HPT_READY`, zero HPT/SSP errors,
  three-lane mask `0x7`, no retired/mismatched/lost records, and no replacement
  warning. Hands-off logging reached 11 acknowledged records.
- A normal Controller A reset reopened media generation 2 without formatting.
  Store `next_sequence` advanced monotonically from 13 before reset to 16 after
  boot, with `oldest_sequence` retained at 1 and all three lanes active.
- A target-injected single-lane failure returned healthy with lane mask `0x6`;
  a dual-lane failure returned degraded with mask `0x4`; both following records
  recovered mask `0x7`. Retirement bitmap snapshots persisted `2/1/0` across a
  normal reset, snapshot generation remained 5, and sequence continued.
- Post-reset readback traversed sequences 1 through 16 with zero gaps: 12
  healthy and four explicitly degraded records. Startup scan was 3.94 seconds,
  degraded read at most 2.71 seconds, retirement-commit append at most 320 ms,
  and SD-thread stack headroom was at least 1,548 bytes.
- Raw customer export now scans an immutable media-generation/end-sequence
  snapshot incrementally behind queued logging, validates log payload identity,
  fails on requested-range gaps or ambiguous copies, and exposes requested and
  actual range, gap, health, completion, and publication status. USB output is
  written to a temporary file and renamed only after close/flush, record-count
  verification, and a completion trailer.
- The clean Debug/Release builds passed with 135,592 bytes of internal-RAM
  headroom. Controller A programmed/verified the exact Debug image and staged a
  full retained-range export: generation 3, snapshot sequences 1 through 43,
  43 records scanned, 38 customer records selected, zero gaps, 38 healthy, zero
  degraded, and no USB publication. A normal reset returned export state to
  idle and reopened HPT media with zero HPT/SSP errors and retirements `2/1/0`.
- The first visible USB export reached `PUBLISHED` with 11 ordered healthy
  records, zero gaps/errors, a correct completion trailer, and no residual
  temporary file. Host inspection rejected the CSV because the small target
  printf library does not implement `%llu`; the sequence placeholders printed
  as `lu` and shifted later header fields. The formatter now uses bounded
  decimal strings, the expanded `17/17` export gate and all regression/build
  gates pass, and corrective Debug SREC
  `532D7A2A9F147525D87028F680983EDD5BCCB40510E0C6E380E09102682E3353`
  is programmed and verified on Controller A.
- The corrective visible export passed on Controller A. Target status reported
  `PUBLISHED`, complete/published `1/1`, actual sequences `81–90`, ten selected
  healthy records, zero degraded/gaps, and zero HPT/SSP/USB errors while logging
  advanced through sequence 91. The finalized 1,132-byte CSV matched every
  target field, held ten ordered one-minute rows and a ten-record completion
  trailer, left no `HPTE.TMP`, and hashed to
  `BFA8D68FA555C3562BB2B90F9AE44C5FA2880C4FCA21661EE3EEA9E8260D1BF9`.
- The bounded Controller A wrap harness appended 64 of 64 records, advanced all
  three lane generations to 8, retained sequences 49 through 64, read back 16
  healthy records with zero degraded records or gaps, and staged all 16 through
  the production raw-export scanner. Maximum append time was 44 ticks and
  normal minute logging resumed afterward.
- A subsequent visible ten-minute export reported success. A thirty-minute
  request on the intentionally 16-record qualification fixture failed closed
  before USB publication: live diagnostics showed 40 requested-range gaps,
  zero USB error, ready HPT media, and uninterrupted logging. The generic
  `Copying log data` error incorrectly presented expected out-of-retention
  availability as corruption; correction is scoped in
  `work/spikes/spike-clarify-hpt-export-retention-range-messaging.md`.
- Host inspection accepted the 1,136-byte visible CSV: actual sequences
  `93–102`, ten ordered one-minute records, all healthy, zero requested-range
  gaps, and a COMPLETE validation/publication trailer. Its SHA-256 is
  `EB3D6466156DA81C1B984CDE20E747A52F32EDB92B392673D8CFD35C0481B056`.
  The rejected thirty-minute request left no finalized or temporary partial
  file.
- The first physical-interruption harness now holds the SD owner after the
  selected lane A data write/flush and before any commit write, while
  Controller/HMI scheduling continues. It has exact RAM arm/cancel/recovery
  commands, ELF-resolved target capture, automatic failed-arm cancellation,
  and post-reboot false-commit/prior-record/fresh-append verification. Clean
  Debug/Release builds, `70/70` HPT commissioning invariants, all export/SD
  regressions, and all `141` modeled cuts pass with 135,072 bytes of internal
  RAM headroom. Controller A physical data-durable-before-commit recovery was
  later demonstrated with manual SWD isolation; that historical pass does not
  qualify the new permanently connected automated power topology.
- The July 24 software slice adds six export-domain reasons and true retained
  bounds, a bounded CID-pinned full-address read-only scrub, and exact portable
  and target hooks for record data/commit, reclaim, segment header/seal, and
  retirement metadata. Exhaustive recovery covers 141 cut states.
- Firmware 00.05.xx now treats a readable FAT32 card as installed but requiring
  HPT initialization and never enables the internal-SD FileX logger. Services
  469/470/471/472/474 report retirement; USB FileX remains unchanged.
  Initialization eligibility uses valid CID plus readable sectors rather than
  a named prior filesystem and repeats CID/read proof before erase.
- HPT commissioning (`86/86`), export (`20/20`), scrub (`8/8`), CID (`25/25`),
  version-5 routing (`8/8`), deterministic models, and managed-make
  Debug/Release packaging pass. Evidence and current hashes are recorded in
  `work/evidence/hpt-log-store-circular-mirror/software-completion-gate-20260724.md`.
- The complete datalog CRUD audit is closed for pre-freeze integration:
  periodic temperature records, every event producer, graph load/refresh,
  Graph and Settings export, USB publication, format/reinitialization,
  service diagnostics, and recovery use triple HPT or are explicitly retired.
- The installed/readable/unformatted Home notice now offers the canonical
  two-warning guarded Format workflow. Cancel returns Home without issuing an
  initialization request; no automatic or one-click erase path was added.
- Graph startup no longer blocks SD power-on readiness. It publishes blank
  chart state and queues the triple-store rebuild behind foreground logging;
  the bounded traversal also drains queued minute/event records.
- All source/invariant gates, the circular/export models, and `141` write-cut
  states pass. Clean managed-make Debug and Release rebuilds pass with text
  `2,867,468`, BSS `28,463,052`, and exact S-record hashes recorded in
  `work/evidence/hpt-log-store-circular-mirror/pre-freeze-integration-20260725.md`.
- The exact Debug image was programmed/verified/reset on both controllers.
  Controller A actively rebuilt the chart from an open healthy triple store,
  recovered retained real data, completed two foreground log records, and
  retained zero drops. Controller B remained read-only and proved the installed
  FAT32 card is initialization-eligible with no initialization request issued.
- The prior scrub-throughput candidate baseline was frozen at commit `c0901312` with
  Debug S-record SHA-256 `D386F034...B5992F9F`. Both controllers were
  programmed and verified against that exact image, retained their expected
  CIDs, read all `15,523,840` sectors with zero failures or retries, and passed
  the integrated raw-HPT/chart/logging gate. Compact evidence is in
  `work/evidence/post-freeze-integrated-qualification-20260725.md`.
- The later graph-cache image `EAD175B1...81DA4B` is programmed on both
  controls and establishes CID-linked scalar traversal baselines. Target
  timing then exposed the remaining healthy-path single-sector and export
  pacing costs; the release candidate is reopened for the linked
  format-compatible bulk-read workpackage.
- The bulk-read candidate `A77ADA66...F7211` is now programmed on B then A.
  All repository checks and the clean managed build/package pass. A completes
  cache traversal in `1.15 s`; preserved split-lane B completes in `1.04 s`.
  Both graph caches are ready with correct CIDs and zero system errors. The
  electronic implementation/performance evidence is complete; graph and
  bounded USB-export operator review remains.
- The retained-start successor `91D05B35...0CCB5` is now programmed on B then
  A after all software and clean-build gates passed. Both controls publish a
  valid oldest customer record and remain graph ready with correct CIDs and
  zero system errors. B was not formatted or reinitialized and retains its
  abnormal `86/86/1` lane starts. Operator notification/navigation, filename,
  graph, and bounded USB-export review remains.
- The tuned USB successor `6484150E...A236E1A` is the current image on
  both controls. It retains the bulk-read, retained-start, warning-truth, and
  real Graph corrections while coalescing HPT CSV output in a bounded aligned
  `128 KiB` external-SDRAM buffer and using the supported maximum USBHS FIFO,
  `128 KiB` BOT phase, and `8 KiB` FileX media buffer. B passed twice before A;
  all real publications used one write with zero gaps/errors/fallbacks. Both
  Graph screens are active and current, CIDs are unchanged, and B retains
  `86/86/1`. Treat `35B020FD...A956B4F` and earlier hashes as stage or rollback
  evidence, not the live candidate. See
  `work/evidence/hpt-usb-sdram-buffer-and-usbhs-tuning-20260726.md`.
- The shared-USB safety successor `7CB28AA3...A405A` supersedes that tuning
  image on both controls. All 35 applicable host gates and the isolated build
  passed. B then A passed strict WAV load/playback/reboot persistence, atomic
  `.imx` save and self-update, four-MiB internal-flash comparison, audio-table
  restore, PID publication, and retained-range CSV publication. Final CIDs,
  configuration, logging, and Graph state are correct; B still retains
  `86/86/1` oldest lane starts and `2/1/0` retirements. Evidence:
  `work/evidence/usb-mass-storage-workflow-qualification-20260726.md`.
- The shared 32 KiB SDRAM `.imx` successor `30C98F00...ADF649` is now the
  cumulative image on both controls. B then A passed buffered backup,
  self-update, exact four-MiB flash comparison, configuration/CID preservation,
  WAV restoration, and final Graph readiness. Controller B recovery baselines
  then passed with hashed configuration/calibration and option memory, exact
  program-image readback, serial-bound J-Link reset/reacquisition, and an
  intentional electronic non-heating snapshot persistent across reset. Normal
  temperature control was then restored and verified across another reset for
  full-controller endurance qualification. Evidence:
  `work/evidence/imx-shared-sdram-buffer-qualification-20260727.md` and
  `work/evidence/controller-b-recovery-baseline-20260727.md`.

Incomplete:
- Disposition or execute the remaining separately scoped physical
  interruption, degraded-operation, and multi-sample media gates.
- Portable upstream release/adoption pin for the media 2.0 implementation.

The owner reported PASS on 2026-07-25 for the scoped visual, audio, and
touchscreen review on both final-candidate controllers.

## Goal

Deliver a power-loss-safe, triple-mirrored circular raw log store that exposes
at least the newest 90 days of minute readings, continues logging around
localized logical-media failures, makes every degraded or lost range visible,
and operates on qualified commodity retail cards from 2 GB through 32 GB.

## Non-Negotiable Behavioral Contract

- A record identity is `(generation, sequence, timestamp)`; wrap never resets
  monotonic sequence identity.
- Each lane stores a complete independently checksummed and committed record.
- Two matching valid copies are `HEALTHY`; one valid copy is `DEGRADED`; zero
  valid copies are `LOST`. A mismatch is never silently hidden.
- The append API remains bounded. Failure of one or all lanes cannot block or
  stop control, monitoring, alarms, UI, USB, or communications.
- Transient I/O is retried only to an explicit bounded limit. Repeated failure
  retires the affected lane segment, not the same logical offset in every lane.
- A retired segment is never reused until an explicit destructive reformat.
- Reclamation selects the oldest eligible sealed segment and cannot erase a
  segment pinned by an active read/export snapshot.
- Customer reads expose only the approved retention window even if older bytes
  remain on managed NAND. No secure-erasure claim is made.
- Iteration returns records in logical sequence order across wrap and identifies
  missing, mismatched, reconstructed, and degraded ranges.
- Unknown, corrupt, unsupported, removed, write-protected, or I/O-failing media
  is never automatically formatted.
- Card-wide failure remains a supported degraded operating state and is not
  misrepresented as recoverable by same-card mirroring.
- Every controller/SD evidence package includes or links a same-run service-467
  CID block containing protocol/read validity, all decoded identity fields, and
  the complete raw CID; material card or boot transitions require recapture.

## Capacity Policy

- Design and qualification minimum: nominal 2 GB card.
- Required live history: at least 90 days (129,600 minute records) plus the
  approved alarm/event reserve.
- Record copies: three.
- Keep metadata copies and lane headers in independently checksummed locations.
- Allocate capacity proportionally from discovered geometry; do not encode one
  fixed card size or assume all marketed capacities have identical sector count.
- Establish a conservative minimum free/retirable segment reserve at design
  review. A reserve below threshold raises `REPLACE_MEDIA` while logging
  continues wherever safe space remains.
- Larger cards, including 8 GB, increase circular rotation and retirement margin;
  they do not increase the customer-visible retention promise.

## Delivery Stages

| Stage | Outcome | Entry Evidence | Exit Evidence |
| --- | --- | --- | --- |
| 0 | Freeze requirements and hazards | this workpackage and retail-media ADR | approved retention/event reserve, quorum, warning, privacy, and bounded-latency contracts |
| 1 | Specify successor media format | HPT media 1.0 behavior and geometry known | reviewed on-media layout, version/feature fields, generation rules, metadata redundancy, state transitions, and compatibility rules |
| 2 | Implement portable core | format specification frozen | heap-free host core passes deterministic simulator tests for append/read/wrap/reclaim/retire/quorum/repair |
| 3 | Prove interruption recovery | fault-injection harness available | exhaustive bounded write-cut tests at every metadata/data/commit/reclaim transition recover to the last valid quorum without false records |
| 4 | Integrate Renesas product behavior | portable release pinned and verified | adapter/UI/status/export changes build cleanly without overlapping FileX/raw ownership or generated-file edits |
| 5 | Non-destructive target qualification | exact candidate hashes and controller/card identities recorded | geometry, reopen, read, degraded-lane, latency, stack, and watchdog evidence passes on Controllers A and B |
| 6 | Destructive media qualification | the controller under test has its own passed G-PWR gate; expendable inventoried retail samples and explicit authorization | wrap, repeated logical error, segment retirement, reset, and approved power-interruption matrix passes |
| 7 | First-family retention/endurance qualification | destructive functional gates pass | accelerated 90-day-plus workload, customer export, card-health warnings, and the initial A/B pair pass; any later sample has a reviewed adaptive reason and independent coverage |
| 8 | Release and migration closeout | final candidate frozen | docs, service procedure, adoption manifest, exact hashes, evidence, rollback/reformat path, and release disposition complete |

## Implementation Sequence

Deferred formatting-policy slice (do not implement during the service-467
detection/status review cycle): change guarded service 468 eligibility from its
current FAT32/recognized-legacy list to any card that returns a valid protocol
identity and readable representative sectors but does not validate as current
HPT media 2.0. Continue to block no-response, read-error, and write-protected
media; retain the two explicit whole-card erase confirmations and never format
automatically.

Before final candidate freeze, perform a complete product datalog integration
audit after the triple-mirror core is stable. Inventory every routine that
creates, reads, updates, deletes, formats, traverses, graphs, reports, or exports
datalog content. This explicitly includes normal temperature samples, events,
alarms/warnings, door and power events, graph population/refresh, retained-range
selection, customer export, format/initialization, diagnostics, recovery,
service routines, and any legacy FAT32/FileX datalog path. Every production
consumer must use the triple-mirrored circular HPT interfaces or be explicitly
retired with evidence; no hidden single-copy or legacy datalog path may remain.

Development and qualification must minimize operator intervention. Prefer
J-Link RAM commands, symbol/state reads, bounded diagnostic routines, captured
results, and the qualified automated power-cycle methods for setup,
manipulation, observation, reset, and recovery. Ask the operator only when a
judgment genuinely requires human visual/audible review, with final screen
wording, placement, legibility, and navigation review reserved for the frozen
candidate whenever practical.

1. Freeze definitions for `HEALTHY`, `DEGRADED`, `LOST`, `REPLACE_MEDIA`,
   minimum retention, event reserve, retry limits, and maximum append latency.
2. Specify a new media version; do not reinterpret media 1.0 in place. Define
   superblock copies, lane descriptors, segment headers/trailers, generation and
   sequence arithmetic, checksums, commit states, retirement markers, and
   forward/unsupported-version behavior.
3. Define geometry allocation for every supported card. Prove by calculation
   that the smallest accepted sector count satisfies three copies, metadata,
   events, and reserve without relying on marketed capacity.
4. Define circular reclamation and power-loss ordering. Reclaim only sealed,
   oldest, unpinned segments after newer quorum data is durable.
5. Implement independent A/B/C append state machines and bounded retry. A lane
   failure advances that lane to a spare segment without perturbing healthy
   lanes or reusing retired storage.
6. Implement quorum read/iteration. Prefer two matching valid copies; allow one
   valid copy with degraded provenance; surface disagreement and sequence gaps.
7. Preserve degraded retained records rather than rewriting them in place in
   media 2.0. A failed lane advances to a new segment for the next monotonic
   sequence, so there is no safe reserved hole to backfill without changing the
   immutable record/segment identity contract. Every later append still
   attempts all three lanes synchronously; degraded provenance stays visible
   until circular reclamation. Any automatic historical repair requires a
   successor media contract and its own write-cut qualification.
8. Define a stable export snapshot so circular reclamation cannot erase data
   under traversal. Fail closed if the requested range cannot be completed and
   report actual range, gaps, and redundancy state.
9. Extend diagnostics with per-lane success/failure, first failing LBA, retired
   segments, reserve remaining, last quorum state, mismatch/loss counts, wrap
   generation, and replacement warning.
10. Add host simulator/model tests covering minimum and odd geometries, many
    wraps, sequence rollover arithmetic, every single-lane failure, dual-lane
    failure, mismatched valid data, full reserve depletion, and reopen.
11. Add exhaustive write-cut/fault injection around every write and flush in
    format, append, seal, reclaim, retirement, and repair. Verify no phantom
    committed record and no erasure of the last quorum-valid retained record.
12. Publish and pin the portable-core release, verify archive provenance, then
    integrate it through the product-owned Renesas adapter without generated
    Synergy edits.
13. Complete the product datalog integration audit and migrate every graph,
    event, temperature-log, format, export, service, recovery, and diagnostic
    CRUD path to the triple-mirrored circular HPT system or explicitly retire
    the obsolete path.
14. Add the installed-but-unformatted notification Format action defined by
    `work/tickets/ticket-offer-explicit-format-action-from-installed-unformatted-sd-notification.md`.
15. Run clean Debug/Release builds, source invariants, static/RAM/stack review,
    and bounded diagnostic tests before programming either controller.
16. Qualify Controller A first on an expendable card, then Controller B with the
    identical image. Escalate from read-only/reopen to wrap/retirement and only
    then to injected media loss and explicitly authorized whole-controller power
    interruption. Powered SD-card removal/insertion is prohibited.
17. Run the accelerated retention campaign on the initial two samples from the
    first retail family, one on A and one on B; verify newest-90-day exports
    across many wraps and record latency, lost ranges, retirements, and
    replacement thresholds. Add a later sample only for a reviewed adaptive
    reason. After release, repeat one adaptive two-or-more-sample family at a
    time to expand the approved pool without changing the released firmware.
18. Promote settled behavior to product/service documentation, freeze exact
    source and artifact hashes, record supported migration/reformat behavior,
    and close both this package and its predecessor only after evidence passes.

## Acceptance Criteria

- [x] A nominal 2 GB minimum-geometry fixture proves three complete 90-day
  streams plus metadata, event reserve, and approved retired-segment reserve.
- [x] Media 1.0 is opened read-only or reported as requiring explicit migration;
  it is never silently converted, reformatted, or misread as the new version.
- [x] Append/reopen/iterate remains correct through at least three complete
  logical wraps and sequence ordering is unambiguous.
- [x] Every single-lane failure retains the record from another lane and reports
  degradation without stopping subsequent logging.
- [x] Every pair of matching copies wins over a disagreeing third copy; a lone
  valid copy is returned with explicit degraded provenance.
- [x] Repeated logical-sector failures retire only the affected lane segment;
  future appends continue using available segments.
- [x] Exhausted reserve raises replacement status before the 90-day guarantee is
  threatened, using a reviewed quantitative threshold.
- [x] Power interruption at every modeled write boundary produces no false
  committed record and preserves the newest previously durable quorum record.
- [x] Export across wrap is snapshot-safe, ordered, complete-or-explicitly-failed,
  and reports actual sequence/time range and gaps.
- [x] No SD state or retry path blocks essential controller functions or exceeds
  the approved SD-thread latency/watchdog budget.
- [x] RAM, ROM, SD-thread stack high-water, and transfer-buffer usage fit the
  approved S7G2 budget without heap allocation.
- [ ] Identical frozen Debug/Release candidate behavior passes Controllers A and
  B on inventoried expendable media.
- [ ] At least two qualified retail product families and multiple samples when
  practical pass the approved wrap/error/removal/interruption screen.
- [x] Service UI distinguishes healthy, degraded, data-loss, replace-media,
  unsupported-format, and card-wide-unavailable states.
- [x] A reviewed inventory proves every datalog CRUD consumer—including graph,
  event, temperature, format, and export paths—uses triple-mirrored circular
  HPT storage or is explicitly retired; no production legacy path remains.
- [x] Installed, readable media that requires formatting offers a guarded
  Format action from its notification without automatic erasure.
- [x] Development evidence uses J-Link diagnostics and automated power control
  wherever practical; operator actions are reserved for irreducibly human and
  final visual/audible review.
- [ ] Power-off card replacement, reboot classification, and explicit
  destructive initialization recover logging without changing or blocking
  chamber control behavior; powered hot swap is prohibited.

## Milestones

### Milestone 1: Contract and media-format review

Completion criteria:

- [x] Requirements, hazard analysis, capacity math, and format state machine are
  reviewed before implementation.
- [x] New media-version identity and media 1.0 disposition are approved.

### Milestone 2: Portable implementation proof

Completion criteria:

- [x] Host simulator passes deterministic circular/quorum/retirement behavior.
- [x] Exhaustive bounded interruption and corruption campaigns pass.

### Milestone 3: Product integration proof

Completion criteria:

- [x] Clean qualified-toolchain builds and resource evidence pass.
- [x] Normal controller behavior remains independent of SD health.

### Milestone 4: Physical qualification and release

Completion criteria:

- [ ] The initial Controller A/B pair from the first retail-card family passes,
  every nonpassing or added sample is dispositioned, and no unresolved family
  or systemic failure remains; later families use adaptive rolling
  post-release qualification.
- [ ] Exact release hashes, evidence, service documentation, and replacement
  procedure are approved.

## Settled implementation decisions

- Capacity reserves all `129,600` periodic records plus
  `HPT_TC_MIN_RECORDS_PER_LANE - HPT_TC_REQUIRED_RECORDS` event records per
  lane before minimum geometry is accepted.
- All three lane attempts finish synchronously before append returns. Two
  matching commits are healthy; one commit is explicitly degraded.
- Each media operation has three total bounded attempts. Target diagnostics
  and stack/timing evidence remain part of frozen-candidate qualification.
- `REPLACE_MEDIA` asserts when any lane's non-retired capacity falls below
  `142,560` record slots.
- Media 2.0 does not rewrite degraded historical copies in place. New records
  immediately resume three-lane attempts; historical health remains explicit.
- Records older than 90 days are hidden by customer-range policy but no secure
  physical-erasure claim is made for managed NAND.
- Media 1.0, prototype 2.0, and other eligible prior states require explicit
  destructive reinitialization; there is no in-place migration.
- G-PWR-A and G-PWR-B are qualified methods. Exact retail families/sample
  counts remain a physical campaign/release decision, not a source-code gap.

## Risks and Controls

- Same-card common-mode failure: state this limitation; qualify replacement and
  degraded operation. Only a second physical card could remove it.
- False physical-independence assumption: treat lanes as logical redundancy and
  rely on the SD controller for physical placement/remapping.
- Reclamation destroys last good data: require quorum durability, sealed-state
  validation, pinning, and exhaustive interruption tests before erase/reuse.
- Excess retry stalls control: enforce bounded retries and SD-thread-only access;
  publish maximum measured latency.
- Metadata becomes a single point of failure: checksum and rotate redundant
  metadata copies with generation-based selection.
- Silent partial export: snapshot/pin the requested range and fail closed with
  actual-range/gap reporting.
- Format drift between upstream and product forks: implement portable behavior
  upstream, pin an immutable release, and keep only hardware policy in the
  Renesas adapter.

## Related Artifacts

- Predecessor: work/wp/completed/wp-hpt-embedded-log-store-v0-4-0-renesas-integration.md
- Read-performance workpackage:
  work/wp/completed/wp-optimize-hpt-triple-mirror-read-performance.md
- USB-publication workpackage:
  work/wp/completed/wp-optimize-hpt-usb-csv-publication-throughput.md
- USB buffer-window tuning:
  work/wp/completed/wp-tune-hpt-usb-csv-buffer-window.md
- USB SDRAM and USBHS tuning:
  work/wp/completed/wp-move-hpt-usb-buffer-to-sdram-and-tune-usbhs-throughput.md
- Checklists: work/checklists/checklist-hpt-log-store-dedicated-card-controller-qualification.md;
  work/checklists/checklist-controller-a-hpt-triple-circular-physical-qualification.md;
  work/checklists/checklist-controller-a-hpt-wrap-and-power-interruption-qualification.md;
  work/checklists/checklist-hpt-media-2-autonomous-retail-card-qualification.md
- Tickets: work/tickets/ticket-hpt-export-domain-failure-reasons.md;
  work/tickets/ticket-hpt-bounded-full-address-read-scrub.md
- ADRs: work/adr/adr-commodity-retail-sd-media-policy.md
- Spikes: work/spikes/spike-clarify-hpt-export-retention-range-messaging.md;
  work/spikes/spike-raw-hpt-boot-reports-no-sd-card.md
- Inventories: work/inventories/inventory-hpt-embedded-log-store-v0-4-0-integration-surfaces.md;
  work/inventories/inventory-version-5-fat32-to-hpt-transition-surfaces.md
- Runbook: work/runbooks/runbook-autonomous-hpt-sd-qualification.md
- Evidence: work/evidence/hpt-log-store-v0-4-0/
  and work/evidence/hpt-log-store-circular-mirror/pre-controller-a-software-gate-20260722.md

## Completion Standard

This workpackage is complete for initial release only when the successor
portable media format is specified and released, all host/model/interruption
tests pass, the exact integrated candidate passes clean builds and resource
gates, identical firmware passes Controller A/B qualification with at least
two counted samples from the first approved retail family and complete
assigned campaign coverage, 90-day
complete-or-explicit-gap export is demonstrated across repeated wraps, service
replacement/recovery is documented, and exact evidence and hashes are
recorded. Build success or a single-card demonstration alone is insufficient.
Additional retail families are qualified after release through rolling
adaptive two-or-more-sample campaigns without reopening this firmware release
unless a result implicates shared firmware, controller hardware, automation,
evidence, safety, or the shared method.

## Closeout Routing

- Current truth promoted to: docs/sd-card-operation-and-recovery.md and the
  upstream HPT media-format/adoption documentation
- Historical context remains in: this workpackage and the predecessor
- Runtime/status evidence: work/evidence/hpt-log-store-circular-mirror/
- Cleanup deferred to: legacy FileX logging retirement only after the new raw
  path is qualified and release migration is approved

## Owner-directed reconciliation — 2026-09-23

Legacy external-qualifier execution plan superseded by the owner withdrawal of the standalone qualification programme and the current exact-candidate MAP-0009 release plan. Historical unmet tests remain unproven; every applicable current release fault/logging gate remains open in MAP-0009.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: waiting on target-qualified A/B stop/recovery, adapter admission, and returned qualification results; local v0.5.0 adoption, fixed-mailbox ABI, deployed Pi orchestration/UI, exact bundle review, and A/B promotion gates pass
> Next Action: receive and inventory an expendable same-family A/B SD-card pair in `/sd-qualifier`; preserve the installed controls and keep command roles/endpoints empty until the reviewed measurement checklist's physical gates pass

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
