# Controller A data-durable power-cut qualification result

Status: passed
Type: evidence
Updated: 2026-07-23
Next Action: retain this result and implement the next named interruption boundary before another physical cut
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-controller-a-hpt-wrap-and-power-interruption-qualification.md

## Result

Controller A passed the physical
`data_durable_before_commit` interruption and recovery qualification on
2026-07-23.

- Controller assembly: `1751136`
- J-Link: `69664082`
- SD card: `HPTCS0`
- Firmware source commit: `9849b00e03da08ead19b376776b40e3c2a4cdf26`
- Debug S-record SHA-256:
  `46AFA0139C06C83DC8FEEFC556F7C80FF044F3A913E30837F71040D89A77D79B`
- Media generation: `4`
- Last setup/acknowledged sequence: `234`
- Interrupted sequence: `235`
- Recovery append sequence: `239`

## Physical Isolation

The operator:

1. powered J-Link off while Controller A remained powered;
2. waited 10 seconds;
3. physically removed the J-Link target/SWD cable;
4. removed Controller A external power;
5. left both unpowered for 30 seconds;
6. restored Controller A power with the target cable removed and waited for
   normal boot; and
7. reconnected the target/SWD cable and powered J-Link on.

## Automatic Boot Gate

The successful post-cut capture proved:

- diagnostic command and status both cleared to zero;
- normal, non-wrapper block-device ownership restored;
- SD startup open executed;
- public SD state `SD_CARD_STATE_RAW_HPT` (`6`);
- HPT media ready (`5`) with HPT/SD/system status zero;
- store open with all three lanes present;
- unchanged media generation `4`; and
- interrupted sequence `235` remained inside the retained range
  `[225, 239)`.

Normal minute logging advanced the tail before inspection. Host-helper commit
`8ef79e23` corrected the precheck to allow that expected advance only while the
interrupted sequence remains retained. The definitive firmware recovery check
still reads that exact sequence and rejects the unique interrupted payload
marker before making a recovery append.

## Recovery Gate

The recovery diagnostic read sequence `234` successfully, then read sequence
`235` and found an ordinary post-boot replacement record:

- record status: `HPT_STATUS_OK`;
- interrupted-payload marker: absent;
- observed marker: `1`;
- `InterruptedRecordReplaced = 1`.

It then appended recovery sequence `239` successfully to all three lanes
(`RecoveryLaneMask = 7`) and read the record back with status zero. Diagnostic
state `6` reported `POWER-CUT RECOVERY PASSED`, with no first failure step.

The result proves that a physical loss of power after lane-A record data became
durable but before its commit did not create a falsely committed interrupted
record, did not prevent true reboot/reopen, and did not prevent subsequent
three-lane logging.

A final read-only health capture found public state `RAW_HPT`, HPT ready/status
zero, system errors zero, six queued/six completed/zero dropped records, all
three lanes present, and normal logging advanced to next sequence `242`.

## Evidence Files

- `manifest.json`
- `precut-holding-status.bin`
- `precut-ui-observation.md`
- `postcut-boot-verification.json`
- `postcut-reboot-guard.bin`
- `postcut-sd-state.bin`
- `postcut-power-on-status.bin`
- `postcut-sd-available.bin`
- `postcut-system-errors.bin`
- `postcut-hpt-media-status.bin`
- `postcut-hpt-qualification.bin`
- `postcut-recovery-status.bin`
- `current-status.bin`
