# Checklist: Controller A HPT triple-circular physical qualification

Status: completed
Type: checklist
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md

## Goal

Prove on Controller A that the exact pre-hardware candidate safely recognizes
the retained media 1.0 card, performs only an explicitly confirmed destructive
upgrade to triple-circular media 2.0, reopens and verifies all three copies, and
continues normal minute logging without affecting chamber control.

## Frozen Candidate

- Controller A: assembly `1751136`
- Probe: J-Link `69664082`
- Current card: `HPTCS0`, previously commissioned as HPT media 1.0
- Debug SREC: `Debug/7520553_SMI_FW_00_05_00.srec`
- Debug SREC SHA-256:
  `A2ECEE7346EC946CCDD9109C6A5ECB850DC2DBB340E14E21D8AACF351AE16528`
- Debug ELF SHA-256:
  `EA6208C7C5D7E7786D5F00D1FB5F34BFAFBD983476FF9D6732CA25730FF27C9B`
- Release SREC SHA-256:
  `475EF014A264011D63371B54E775C3C478688F59A831D0301032963C4ADC8ACA`
- Release ELF SHA-256:
  `DC187FE9D17CBFBD5A5A27E9EC0F989A4399D43E4DE4D35F67C9E2C2A85CB80B`

Any source or artifact change invalidates these hashes and returns to the clean
build/source/model gate.

## Authority Gate

- [x] Owner explicitly authorizes programming Controller A with the frozen Debug SREC.
- [x] Owner separately authorized and completed erasing card `HPTCS0`; its
  media 1.0 records are no longer treated as recoverable.
- [x] Controller/probe identity electronically reconfirmed as `1751136`/`69664082`;
  retained-card geometry/content matches assigned `HPTCS0` evidence.
- [ ] Known-good recovery image and programming path are available.
- [ ] Chamber is in a safe non-heating service condition for reset/programming.
- [ ] No evaluator, soak, export fixture, or continuous endurance service is active.

## Phase 1: Program and read-only classification

- [x] Program and verify only the frozen `00.05.00` Debug SREC on `1751136`/`69664082`.
- [x] Boot `00.05.00` without invoking service 468 initialization.
- [ ] Confirm control/UI/communications reach normal service operation.
- [x] Owner reports the service 468 screens looked correct before proceeding.
- [x] Target RAM independently reports `HPT media 1.0 - upgrade required` on
  `00.05.00`;
  display wording remains to be visually confirmed.
- [x] Confirm no automatic format, append, or media-version conversion occurred.
- [x] Capture HPT/SSP status, sector count, first-error sector, and current card identity.
- [ ] Stop and preserve evidence on any classification, geometry, or controller mismatch.

## Phase 2: Explicit destructive media 2.0 initialization

- [x] Separate card-erase authority was given by proceeding through the guarded
  service 468 workflow.
- [x] Owner traversed the service 468 warning screens and initiated whole-card
  media 2.0 initialization.
- [x] Confirm initialization formats media 2.0, closes/reopens, appends one commissioning record,
  closes/reopens again, reads the record through quorum, and reaches clean iterator end.
- [x] Confirm state is `HPT triple media 2.0 ready`.
- [x] Confirm commissioning lane mask is `0x7`, mismatch/lost counts are zero,
  retired A/B/C are `0/0/0`, and replace-media is zero.
- [x] Confirm discovered geometry supplies at least 142,560 slots per lane
  (`2,584,098` slots per lane before retirements).

Observed failure:

- The post-operation display reported corrupt media.
- Read-only RAM inspection found HPT state `CORRUPT_OR_UNKNOWN`, HPT status
  `INVALID_ARGUMENT`, SSP status `0`, first-error sector `0`, and the expected
  `15,654,912` sectors.
- Store state showed media generation/layout and sequence advancement. Do not
  retry service 468 on the old image.

Corrective software gate:

- [x] New-segment activation invalidates the first commit before publishing its
  header.
- [x] Append maintains an invalid next-slot sentinel so stale media bytes cannot
  extend the recovered prefix.
- [x] Raw queue writes remain disabled until complete commissioning succeeds.
- [x] Failure phase/status remains visible and an idle/closed session cannot
  overwrite it.
- [x] Recognized media 2.0 can be explicitly reinitialized through the same two
  warnings; corrupt/unknown/I/O-failing media remains ineligible.
- [x] HPT invariants `40/40`, SD safety `20/20`, stale-slot model, and isolated
  Debug/Release clean builds pass.

## Phase 3: Non-destructive runtime proof

- [x] Allow at least seven normal minute/event records to enter the SD queue.
- [x] Confirm acknowledged sequence/count advances and the last lane mask remains `0x7`.
- [x] Reset Controller A normally without removing power during a write.
- [x] Confirm media 2.0 reopens without format and sequence continues monotonically.
- [x] Confirm the commissioning and post-reset records are readable in order.
- [x] Confirm control remains responsive during open, append, read, and reset recovery.
- [x] Measure startup scan and append latency; stop if watchdog margin is uncertain.
- [x] Capture SD-thread stack high-water evidence after open/read/append activity.

## Phase 4: Controlled degraded-lane diagnostics

This phase must use RAM-only/injected faults or a separately approved expendable
media method. It must not deliberately damage the retained card without renewed
authorization.

- [x] Inject one lane write failure; confirm two copies yield healthy-with-reduced-margin.
- [x] Inject two lane failures; confirm the lone valid copy is reported degraded.
- [x] Confirm a persistent failure retires only the affected lane segment and
  the `2/1/0` retirement bitmap survives reset.
- [x] Confirm the next record continues on an available segment.
- [x] Confirm ordered readback reports degraded provenance and zero gaps; no
  mismatch/lost range was present in this campaign.
- [x] Confirm no injected SD failure stops chamber control.

## Stop Conditions

- Any unexpected write before the two-confirmation initialization.
- Any automatic formatting of unknown, corrupt, I/O-failing, or generic unsupported media.
- Sector geometry outside the supported contract.
- Fewer than two committed commissioning copies.
- Sequence reset, phantom record, silent mismatch, or partial export labeled complete.
- Unbounded retry, watchdog/reset, control delay, stack concern, or unexplained SSP error.
- Any card identity or probe/controller mismatch.

## Verification and Evidence

- [x] Record exact `00.05.00` programmed hash and J-Link verification result.
- [x] Record service 468 status after destructive initialization; pre-initialization
  RAM status is recorded.
- [x] Record reset/reopen sequence, lane mask, retirements, mismatch/loss, and replace-media state.
- [x] Record measured latency and stack high-water.
- [x] Store results under `work/evidence/hpt-log-store-circular-mirror/controller-a/`.
- [ ] Update the parent workpackage; do not claim Controller B, interruption, wrap,
  endurance, or production-media qualification from this run.

## Recovery

- If programming fails, leave media untouched and restore the known-good controller image.
- If read-only classification fails, power down through the service procedure and image the card.
- If initialization fails, do not retry blindly; preserve HPT/SSP status and first failing LBA.
- If media 2.0 cannot reopen, replace/recondition only under explicit destructive authority.

## Owner-directed reconciliation — 2026-09-23

Reconcile stale active lifecycle to the previously documented completed disposition; no new test or broader acceptance claim.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: complete for Controller A normal reset, durable retirement, lane degradation, and ordered readback
> Next Action: preserve this completed evidence; any separately authorized power-interruption, wrap, or Controller B successor is instantiated and coordinated by the ready srv-rpi00.local qualification app

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
