# Controller A raw customer-export staging

Status: passed
Type: evidence
Updated: 2026-07-23
Next Action: proceed to separately scoped Controller A interruption/wrap and Controller B qualification
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md

## Candidate

- Controller A assembly `1751136`
- J-Link `69664082`; target voltage `3.285 V`
- Card `HPTCS0`; `15,654,912` sectors
- Debug SREC SHA-256:
  `B46C2367A5EE2220EAF3F3FD2B325F82ACD6931D84FFD23ECBCBCDD00C4F7FE7`
- Debug ELF SHA-256:
  `1982398599CBD00FC5BA97CC734AAEF400F6D6726BB5B148A00C5CCFFE9DA32F`
- Release SREC SHA-256:
  `0C97A89F4CCCBF91452C852443E11C9D701A1F81C7DA291DA0DECCFF257A2BAF`
- Release ELF SHA-256:
  `1CBE70D4EC2CD8A96C558C7098C46947C2F5471E5829BA3A524C02D9136417B4`

## Implemented contract

The SD owner snapshots media generation, oldest sequence, and exclusive end
sequence, then processes one raw iterator record per idle service slice after
the log queue. It validates customer-record type, payload size, embedded
timestamp, end marker, quorum provenance, bounded SDRAM capacity, and any
sequence gaps that may overlap the requested time range.

No SDRAM prefix reaches USB until clean iterator end. The public status reports
requested/actual ranges, snapshot and actual sequences, scanned/selected
counts, snapshot/requested gaps, healthy/degraded counts, first failure,
completion, and publication.

The USB owner accepts only a complete `STAGED` raw result. It writes
`HPTE.TMP`, includes range/gap/health metadata, checks the written row count,
adds an explicit completion trailer, closes and flushes, and only then renames
the temporary file to the customer-selected CSV name.

## Software gate

- HPT customer-export invariants: `16/16`
- Deterministic export model: pass
- HPT commissioning invariants: `55/55`
- SD safety invariants: `20/20`
- Isolated Debug clean build/package: pass
- Isolated Release clean build/package: pass
- S7G2 internal-RAM headroom from the Release map: `135,592` bytes
- Export staging payload/record buffers are static. Its iterator call chain is
  smaller than the previously qualified readback diagnostic call frame; the
  underlying triple-read stack demand is unchanged.

## Controller A staging gate

Electronic preflight reported hardware variant `0` (assembly `1751136`), probe
serial `69664082`, `VTref=3.285 V`, and no mounted USB device. Programming and
verification completed `O.K.`.

After startup:

- media state `HPT_READY`;
- HPT/SSP/first-error `0/0/0`;
- lane mask `0x7`;
- retired A/B/C `2/1/0`;
- no export or USB handoff active.

A RAM-commanded read-only export used the full timestamp range solely to prove
staging without USB publication:

- state `HPT_EXPORT_STAGED`;
- media generation `3`;
- snapshot sequence range `1–43` (exclusive end `44`);
- actual customer sequence range `6–43`;
- records scanned/selected `43/38`;
- snapshot/requested-range gaps `0/0`;
- healthy/degraded selected records `38/0`;
- complete/published `1/0`;
- USB remained unmounted, so no file was created.

A normal reset discarded the diagnostic SDRAM staging state. The target then
returned to raw HPT ready with export idle, no pending USB handoff, zero HPT/SSP
errors, and retirements `2/1/0`.

## Boundary

This evidence proves integration, clean builds, resource fit, programming, and
read-only target staging. It does not prove visible progress/UI completion,
temporary-file rename on a real USB stick, CSV contents, physical wrap,
power interruption, Controller B, or multi-card qualification.

## First visible USB publication and correction

The owner ran a short export on the original candidate and the UI reported
success. A post-export target capture reported:

- export state `HPT_EXPORT_PUBLISHED`;
- complete/published `1/1`;
- requested timestamps `301572602–301573271`;
- snapshot sequences `1–58`;
- actual timestamps `301572660–301573260`;
- actual sequences `48–58`;
- records scanned/selected/healthy/degraded `58/11/11/0`;
- snapshot/requested gaps `0/0`;
- HPT/SSP/USB status `0/0/0`.

The finalized host file was
`SMI6_07162026_20260723t1010-20260723t1021.csv`, 1,183 bytes, SHA-256
`FB304C0ECEBF27F58541C2AF386FBD29773826422BE85540F55B0E425E269965`.
It contained 11 ordered rows, no `HPTE.TMP` remained, and its completion trailer
reported 11 published records. Qualification nevertheless failed because the
metadata header used unsupported `%llu` conversions. The target library printed
literal `lu` and consumed the arguments incorrectly, corrupting the snapshot,
actual-range, sequence, count, health, and gap lines.

The USB formatter now converts each 64-bit sequence to a bounded decimal string
before formatting. A new invariant rejects the unsupported sequence format.
The corrective gate passed:

- HPT customer-export invariants `17/17`;
- deterministic export model pass;
- HPT commissioning invariants `55/55`;
- SD safety invariants `20/20`;
- isolated Debug and Release clean builds/package checks pass.

Corrective candidate identities:

- Debug SREC SHA-256:
  `532D7A2A9F147525D87028F680983EDD5BCCB40510E0C6E380E09102682E3353`;
- Debug ELF SHA-256:
  `73151D131A3C6668DF3FACB1A351F949A8708EC561E3A54B146DA9032E807F7F`;
- Release SREC SHA-256:
  `E24447C9ED9B0F8A2FF9704533576CCB42724E8F4F6314CE73D7ED45A217E31A`;
- Release ELF SHA-256:
  `96C8A5A45C427A8348CD2E97162AD80D5BA378B002ABFBD071A510B8F4A70713`.

J-Link `69664082` programmed and verified the corrective Debug S-record `O.K.`
at `VTref=3.285 V`. The post-program read-only capture showed export idle,
`HPT_READY`, HPT/SSP/first-error `0/0/0`, lane mask `0x7`, and persistent
retirements `2/1/0`. A second visible USB publication remains required.

## Corrective target publication

The owner selected a ten-minute range and the corrected UI flow reported
success. With the USB stick still mounted, the read-only target capture showed:

- export state `HPT_EXPORT_PUBLISHED`;
- complete/published `1/1`;
- requested timestamps `0x11F9A941–0x11F9AB9F`;
- actual timestamps `0x11F9A978–0x11F9AB94`;
- snapshot sequences `1–90`;
- actual sequences `81–90`;
- records scanned/selected/healthy/degraded `90/10/10/0`;
- snapshot/requested gaps `0/0`;
- HPT/SSP/USB status `0/0/0`;
- HPT media `READY`, lane mask `0x7`, retirements `2/1/0`;
- export inactive, completion progress `1000`, and no pending handoff flags;
- store next sequence `91`, proving minute logging continued.

This passes corrective target publication. Host inspection of the finalized CSV
and absence of `HPTE.TMP` remains required before closing the gate.

## Corrective host inspection

Windows mounted the completed FAT32 stick as `H:`. The newest file was:

- filename:
  `SMI6_07162026_20260723t1041-20260723t1051.csv`;
- length: `1,132` bytes;
- SHA-256:
  `BFA8D68FA555C3562BB2B90F9AE44C5FA2880C4FCA21661EE3EEA9E8260D1BF9`;
- `HPTE.TMP`: absent.

The CSV reported requested timestamps `301574465–301575071`, snapshot
sequences `1–90`, actual timestamps `301574520–301575060`, actual sequences
`81–90`, ten records, ten healthy, zero degraded, zero snapshot/requested
gaps, and `Snapshot validation: COMPLETE`. Every value matches the target
capture.

The ten data rows are numbered 1 through 10 and advance exactly once per minute
from 10:42 through 10:51. The final trailer is
`Export completion: COMPLETE; records published: 10`. Target/actual
temperatures remained 20.0–20.1 C with no door, temperature, or power events.

This closes Controller A customer-export publication on the corrective
candidate. It does not claim physical interruption, physical wrap, Controller
B, or multi-card qualification.
