# Ticket: Eliminate HPT2 exact-read occupancy scaling

Status: complete
Type: ticket
Updated: 2026-08-11
Next Action: none; retain the frozen-candidate and six-result matrix evidence
Parent: work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md

## Problem

`tc_read_copy()` walks from segment zero to the active segment for every exact
read and repeats that search on all three lanes. The endurance baseline appends
a record and immediately exact-reads it. Search work therefore rises with
active-segment occupancy and total campaign time trends approximately
quadratically. A and B show similar slopes, so this is shared firmware behavior
rather than evidence that either SD card is slow or failing.

## Acceptance Criteria

- [x] Select a bounded lookup that preserves exact sequence/generation and
  three-lane voting invariants across transition, reclaim, retirement, and wrap.
- [x] Add model/static tests for first, active, transitioned, reclaimed, wrapped,
  missing, corrupt, and divergent-lane records.
- [x] Pass canonical Debug and Release managed rebuilds and artifact/hash checks.
- [x] Run representative A/B correctness and timing regression on the immutable
  candidate without powered SD-card removal.
- [x] Demonstrate that per-record lookup time no longer grows linearly with the
  active segment number, or document and approve a bounded production limit.
- [x] Review returned evidence before reopening the protected 129600 gate.
- [x] Complete and jointly review the final A/B 129600 BEFORE, AT, and AFTER
  boundary observations.

## 2026-08-10 software and build gate

The integrated firmware now recognizes a sequence in a lane's committed active
prefix before the historical scan. It validates the active physical segment's
mirrored header against the in-memory generation and first sequence, reads the
exact slot, and returns fail-closed for retired, corrupt, missing, or mismatched
active state. Reads outside the active prefix retain the historical scan and
three-lane voting behavior.

The deterministic model covers active physical index 139, first and historical
records, transition, reclaim/wrap, retired segments, missing active slots,
corrupt headers, stale generations, and the existing divergent-lane majority.
The newest-record route performs one mirrored-header probe per lane independent
of active physical index. Static commissioning invariants pass `98/98`; the
HPT2 workload/mailbox model passes `17/17`.

Canonical managed Debug and Release rebuilds pass. The reviewed-working-tree
packager froze Release bundle
`smi-00-05-00-389167c1d57f-37ff5c0c6f48-release`, source snapshot
`389167c1d57f5d14228901c7e9c4acc9b81827fe03f091f6b35b1d764a91ed28`,
and SREC
`37ff5c0c6f48576396c8ef3807aae9c8f1ddab742a72c47a4c1055454da906f0`.
The exact candidate was subsequently programmed on Controllers A and B through
the protected route without powered SD-card removal. Post-program flash, boot,
CID, and HPT readiness checks passed. Independent 10081-record target runs
completed cleanly at approximately 32 verified records/s, and active
44640-record A/B proof runs continue at the same stable rate with no errors.
This established target timing and representative correctness evidence. The
protected 129600 gate remained closed until the two 44640 results became
terminal and were reviewed together. See
`work/evidence/hpt2-exact-read-active-prefix-software-gate-20260810.md`.

## 2026-08-10 protected target gate

The A/B 44640 AFTER pair completed with identical 44641
attempted/committed/verified counters, checkpoint 4, clean bounded stop,
terminal reason zero, terminal proof 31, two stable terminal observations, and
no hidden media operation. Total admitted-run elapsed time was 1464 seconds on
A and 1462 seconds on B. The joint evidence gate passed, the protected setting
was reopened to 129600 with an archived rollback configuration, and appliance
health plus the live admission decision passed.

A guarded coordinator started the final parallel A/B 129600 BEFORE, AT, and
AFTER matrix. It preserves the reviewed A-first proving requirement for every B
start and fails closed on any unit, admission, progress, terminal, or
adjudication failure.

## 2026-08-11 completion

All six final immutable results passed their exact checks: Controller A and B
each passed the 129600 BEFORE, AT, and AFTER observations. The subsequent
recovery and representative-regression stages retained the same frozen
candidate and exact CIDs. Final target logging/chart and configuration
save/restore gates also passed on both controllers. See
`work/evidence/hpt2-exact-read-active-prefix-software-gate-20260810.md`,
`work/evidence/representative-ab-regression-20260811.json`, and
`work/evidence/representative-ab-operator-target-gates-20260811.md`.

The later customer-export latency observation is a different full-history scan
path and remains tracked separately in
`work/tickets/ticket-eliminate-full-history-scan-latency-for-bounded-hpt-customer-exports.md`.
