# Campaign 003 fast-history route authorization and clean stop

Status: complete
Result: complete; fast construction, exact-candidate restoration, independent scan, A/B target performance, successor verification, and USB reader closeout pass; destructive physical wrap test deferred by owner
Type: evidence
Updated: 2026-08-17
Next Action: none; retain both million-record datasets and this closeout evidence
Campaign: 003-complete-bounded-hpt-slow-export-firmware-ticket

## Decision

The owner authorized Campaign 003 to replace its eight exhaustive
`129600 / AFTER` iterations per controller with a fast valid-history build,
campaign update, implementation, and execution. This route is limited to
preparing at least one million retained records for the bounded-export repair
test. It creates no endurance or formal SD-card qualification credit.

The fast route must preserve the real HPT media 2.0 record, commit, segment,
and durable range-envelope format. A temporary diagnostic image may batch
fixture construction, but the exact reviewed candidate must be restored and
its flash identity verified before measured exports. A complete independent
retained-history scan is required after construction and before export credit.

## Superseded runners

The Pi-hosted services `sdq-controller-a-camp003-million.service` and
`sdq-controller-b-camp003-million.service` were stopped before replacement.
Both firmware sessions received acknowledged Stop commands, produced two
stable clean terminal observations, and finalized as
`BOUNDED_STOP_PASS_CASE_TRIGGER_NOT_MET` with zero terminal reason, loss, or
mismatch. This preserves the work without manufacturing S4 completion credit.

| Role | Run | Verified at clean stop | Final evidence | CID |
| --- | --- | ---: | ---: | --- |
| A | `3ea798ce-df69-4d4b-b838-ce1800dcf762` | 41,109 | `19807` | `05000C61736466672200001C8901A34F` |
| B | `9e5e9b17-972d-4355-af19-3731769aefe0` | 110,097 | `19815` | `05000C61736466672200001C8201A379` |

Post-stop read-only store captures found 41,202 retained records on A and
110,189 on B. Both long-run services are inactive. One exact stale temporary
Controller A firewall rule left by runner termination was identified by its
comment and handle and removed; no campaign-specific temporary rule remains.

## Safety boundary

- No SD card was removed, inserted, or replaced.
- No SD card was reinitialized by this decision or stop sequence.
- No USB drive was moved.
- Temporary diagnostic programming must be followed by exact-candidate
  restoration and flash verification before performance evidence is accepted.

## Temporary builder and fill result

The fixture was implemented in the isolated worktree
`tmp/camp003-fastfill` and committed on branch
`codex/camp003-fast-history-fixture`. The implementation added a bounded
16-record / 32-sector append batch while retaining the production record,
commit, sentinel, segment-seal, CRC, and three-lane media format. Static and
model checks passed `11/11` and `4/4`; commissioning checks passed `100/100`.

The final temporary Debug S-record SHA-256 was
`B91C3DBDC3A0B26987E87166F9E2A6CF2F133D5EADC10C203008C44F92FFD091`.
Independent 4 MiB post-program flash captures from both controllers matched
expanded-image SHA-256
`AE7AAD0213CFE79A3F98AC5C354EADED4B8F5AE164F555223261D9364E1F6FA3`.

Both controllers reached the target without reinitializing or replacing an SD
card:

| Role | Planned fixture records | Fixture appended | Concurrent production records | Final retained | Result |
| --- | ---: | ---: | ---: | ---: | --- |
| A | 946,303 | 946,275 | 28 | 1,000,000 | PASS; status 0; no failed step |
| B | 877,763 | 877,736 | 27 | 1,000,000 | PASS; status 0; no failed step |

The final parallel fill completed in approximately 30 minutes. The difference
between planned and fixture-appended rows is exactly explained by ordinary
production logging continuing during the run; it is not missing history.

## Reviewed candidate restoration

The temporary image was removed from both controllers. The reviewed Release
S-record SHA-256
`D1FBFC257043DFFB04DA9B883F26992DF4D8EE1525089BE63485E43A0519E761`
was programmed and verified on A and B. Independent 4 MiB flash readbacks from
both controllers exactly matched the expanded Release oracle SHA-256
`6974B370AF81405A66743FA85A229856B3AAF87DA2DC5B12BB3781C7476B1C60`.

Fresh post-restore captures preserved the same CIDs, reported protocol state
6, CID-valid 1, representative-sector read status 0, HPT-ready state 5,
HPT status 0, no system error, lane mask 7, no mismatch, no lost record, and
no retired segment. Normal logging advanced the histories to 1,000,005
retained records on A and 1,000,006 on B.

## Independent full-retained scan

The reviewed candidate's read-only lane readback traversed every retained
sequence and applied the production three-lane voting and record-validation
path. The harness's initial five-minute wait expired without stopping either
firmware operation. A new host-only `CaptureLaneReadbackStatus` action was
added so continuing status could be captured without replaying the run
command; its PowerShell parse, commissioning `100/100`, customer-export
`40/40`, and diff checks pass.

| Role | Records | First..last sequence | Healthy | Degraded | Gaps | Readback time | Result |
| --- | ---: | --- | ---: | ---: | ---: | ---: | --- |
| A | 1,000,007 | 1..1,000,007 | 1,000,007 | 0 | 0 | 1,090.10 s | PASS / clean iterator end |
| B | 1,000,009 | 1..1,000,009 | 1,000,009 | 0 | 0 | 1,102.37 s | PASS / clean iterator end |

This complete scan is the independent fixture-integrity oracle. Its roughly
18-minute duration is validation evidence, not the customer export time and
does not need to be repeated for ordinary use.

## Million-history bounded export result

The populated ten-minute requests used 1,000,000-plus-record stores and the
reviewed Release candidate. Both selected the exact 11 inclusive one-minute
records, published successfully to the already mounted assigned USB drive,
and stayed far below the owner-approved 60-second total budget and 8,192-record
proof ceiling.

| Role / USB | Sequence range | Scanned / selected | Lookup | HPT read | USB | Total | Result |
| --- | --- | --- | ---: | ---: | ---: | ---: | --- |
| A / `USB07_32G` | 859,310..859,320 | 2,876 / 11 | 0.09 s | 4.01 s | 0.21 s | 4.80 s | PUBLISHED; COMPLETE; 11 healthy; 0 degraded/gaps/fallbacks |
| B / `USB05_4G` | 859,310..859,320 | 2,875 / 11 | 0.09 s | 4.29 s | 0.16 s | 5.03 s | PUBLISHED; COMPLETE; 11 healthy; 0 degraded/gaps/fallbacks |

The prior baseline was 1,177.33 seconds on A and 693.90 seconds on B for 9
and 10 rows. The target result is therefore about 245 times faster on A and
138 times faster on B while preserving exact range and health telemetry.

An initial boundary request published a valid zero-row CSV in 4.35 seconds on
A and 3.80 seconds on B because the visible retention floor advanced during
the independent scan while the HMI's cached oldest timestamp remained stale.
That result receives no populated-range credit. It exposed a separate stale
retained-start refresh defect that must be tracked rather than hidden.

## Near visible-capacity result

The fixture has exactly 142,560 customer-visible records, less than the
225,260-row export ceiling, so an exact export-ceiling case cannot be created
from this one-record-per-minute fixture without adding artificial event
density. The honest near-capacity case exported the entire visible window.

| Role / USB | Scanned / selected | HPT phase | USB phase | Bytes / writes | Total | Result |
| --- | --- | ---: | ---: | --- | ---: | --- |
| A / `USB07_32G` | 142,560 / 142,559 | 167.02 s | 32.95 s | 7,303,789 / 223 | 200.01 s | PUBLISHED; COMPLETE; 0 degraded/gaps/fallbacks |
| B / `USB05_4G` | 142,560 / 142,553 | 174.58 s | 49.74 s | 7,303,477 / 223 | 224.33 s | PUBLISHED; COMPLETE; 0 degraded/gaps/fallbacks |

Controller B's first full-window publication was observed at STAGED state 3
during content write and the next guarded trigger captured prior state 4,
proving it reached PUBLISHED. A one-row-short B retry had already been issued
before correcting that enum interpretation; it supplied the terminal metrics
above and made no firmware, SD, or configuration change.

## Remaining physical closeout

Controller telemetry proves exact selection, completion, and publication but
does not replace an independent reader. `USB07_32G` and `USB05_4G` still need
read-only host inspection for exact filenames, row counts, headers/trailers,
hashes, FAT-copy state, free-space accounting, and absence of `.tmp`, `.part`,
or `.bak` artifacts. `USB07_32G` retains its already accepted two-cluster
primary-FSInfo offset and must not be described as repaired or clean.

## Moving-retention-floor correction and successor build

The stale boundary was caused by a refresh guard comparing the store's fixed
physical oldest sequence with the HMI's cached retained-oldest sequence. Once
the customer-visible floor advanced inside that physical history, the equality
remained unchanged and the cache was not refreshed. The correction compares
`HptTripleCircularVisibleFirstSequence(&store)` with the cached retained-oldest
sequence instead.

Focused verification passes:

- graph-cache invariants `15/15` plus the moving-visible-floor model;
- customer-export invariants `40/40`;
- million-export oracle and commissioning `100/100`;
- `git diff --check` (line-ending warnings only);
- canonical managed Debug rebuild in 73.1 seconds;
- canonical managed Release rebuild in 67.9 seconds; and
- reviewed-source package and manifest validation.

The reviewed source snapshot SHA-256 is
`9E00F69EC676BB2E27A97562D560517948DC288AE07B1AE0BEC1735BC7807CCF`.
The successor artifacts are:

| Configuration | ELF SHA-256 | S-record SHA-256 | Map SHA-256 |
| --- | --- | --- | --- |
| Debug | `8CA7CCEFFC14D55793F461F7825C57FFEB845615E219BFAAACB11EC589CBCDB1` | `AEA2AB714BCCF124A9D8FAA7331EA0B7A649971DCECB02B5A3B6D7DDB4988188` | `EA7B5AD5EAC8E608F3C55C5885847E835E3ECA1EA0213E0B5CDB30A01EBC0144` |
| Release | `D363218F2BBEAD6B339A86F82F25474BAEB454600AF21365FB32C93572BEEB06` | `75F108D5E2E77031E107B2D71852545C9FD246B128085CCB7D4F6E256BC37462` | `6C60B509F6F0F816CA85C302E677550B773ECFD6B74AF8F3B7173501ABFCE411` |

Package validation used
`tmp/camp003-retention-refresh-bundle`; its Release bundle identity is
`smi-00-05-00-9e00f69ec676-75f108d5e2e7-release`. The owner authorized this
exact Release S-record for nondestructive retained-floor verification on
Controllers A and B. The verified target results are recorded below.

## Successor A/B target verification

The authorized Release S-record was programmed on both controllers. Independent
4 MiB code-flash captures from A and B each matched the expanded Release oracle:

`6EEF5DB83CE2AE71AEB63D598ECAD1CFA7D68475EBFE052301F4FC2A0F97DFC4`

Post-program boot captures passed on both targets:

| Role | Protocol state | CID valid | Representative read | HPT state/status | System errors | Raw CID |
| --- | ---: | ---: | ---: | --- | ---: | --- |
| A | 6 | 1 | 0 | 5 / 0 | 0 | `05000C61736466672200001C8901A34F` |
| B | 6 | 1 | 0 | 5 / 0 | 0 | `05000C61736466672200001C8201A379` |

The nondestructive moving-floor observation then passed:

| Role | Physical lane oldest | Visible retained sequence before | Visible retained sequence after | Graph cache |
| --- | --- | ---: | ---: | --- |
| A | `1 / 1 / 1` | 857,491 | 857,492 | ready |
| B | `1 / 1 / 1` | 857,492 | 857,493 | ready |

Thus the visible retained floor advanced after an ordinary production append
even though the physical oldest sequence did not change. This directly covers
the stale guard that the successor corrected. No million-record rebuild, full
retained scan, SD-card move, SD reinitialization, or destructive media action
was repeated. Final captures found export state 0 and USB status/phase 0 on
both controllers, establishing the idle handoff point for powered USB removal.

## Independent USB-reader closeout

The operator moved both drives to the Raspberry Pi reader after the controller
export state was idle. Linux identified the expected specimens without
ambiguity:

| Label | Device | Model / serial | UUID |
| --- | --- | --- | --- |
| `USB07_32G` | `/dev/sda1` | `USB DISK 3.0` / `07190C5B908CDC85` | `4693-0F61` |
| `USB05_4G` | `/dev/sdb1` | `UDisk` / `General_UDisk-0:0` | `362E-8170` |

Both volumes were checked unmounted with `fsck.fat -n -v`, mounted read-only
for content inspection, and unmounted afterward. Final mountpoint inspection
was empty for both devices. No `.tmp`, `.part`, or `.bak` file and no relevant
insertion-time kernel error was found.

### Exact campaign CSV results

| Drive | File | Bytes | Records | SHA-256 | Result |
| --- | --- | ---: | ---: | --- | --- |
| `USB07_32G` | `C003_A_1M_10MIN.csv` | 569 | 0 | `1B930CFBBDB179603D988524937142C95DE2F35D29D5903ABEB428357336607D` | complete zero-row boundary artifact; no populated credit |
| `USB07_32G` | `C003_A_1M_DATA.csv` | 1,239 | 11 | `23B5BF85F6CE3BD151910BCD76BF4F9109C03B2B5336D9A2D7DFDC866E968A5D` | PASS; 11 healthy; sequence 859,310..859,320 |
| `USB07_32G` | `C003_A_1M_NEAR.csv` | 7,303,789 | 142,559 | `7FB748E090E13978266058D69DF27E422579FA69BCD9495515B9953B99529C14` | PASS; all healthy |
| `USB05_4G` | `C003_B_1M_10MIN.csv` | 569 | 0 | `940A67D4674B688D133945BBAC87B9BB75749121EA0761A2224692BCB4CF8A0E` | complete zero-row boundary artifact; no populated credit |
| `USB05_4G` | `C003_B_1M_DATA.csv` | 1,239 | 11 | `5A99A065FA2577FEFB2BC74E1A1042D351A69D96FBD6A6C07ECA5C40C944F148` | PASS; 11 healthy; sequence 859,310..859,320 |
| `USB05_4G` | `C003_B_1M_NEAR.csv` | 7,303,841 | 142,560 | `E465820AE3891344055C01F97DBCEFA987D42638881250F7A2697E963A49CBF3` | PASS; all healthy |
| `USB05_4G` | `C003_B_1M_NEAR_R.csv` | 7,303,477 | 142,553 | `D8954F64D77F40C18F616333FE50C2D92D0C8F9CA11F2D88FC5BCA10D6D202B8` | PASS retry; all healthy |

For every file, the independently parsed row count equals the declared and
published count, data line numbers are sequential, degraded and gap counts are
zero, snapshot validation is `COMPLETE`, and the final trailer is `COMPLETE`.

### Filesystem state

| Drive | FAT-copy SHA-256 | Allocation/free result | Disposition |
| --- | --- | --- | --- |
| `USB07_32G` | both `3B6A1573512CC7FCE9793EEAFEB9C8C2909863CDD98357581F47E8192D7294E8` | 993 allocated; primary FSInfo 1,892,674 free; FAT scan 1,892,672 free | accepted pre-existing two-cluster offset unchanged; not repaired or called clean |
| `USB05_4G` | both `D312C2DA70A124DBF80D623780207DFD6B04C7034047E1F86E5046C0BF71E6E5` | 5,940 allocated; 974,796 free; summary exact | filesystem content passes; root-only volume-label convention unchanged |

Primary FSInfo-sector SHA-256 is
`29CFD1CBF195B975C7CD83608758749477B19AF601E1FE6CC8742F21EFBA1CE0`
for `USB07_32G` and
`6D3080AB383C8E7874A1839191E606B4B3BFA471D4EB18AA93512E2BA6680402`
for `USB05_4G`.

## Accepted wrapped-history disposition

The independent reader gate is complete. The remaining hardware criterion is
an ordinary wrapped-history result. The built-in `RunWrapDiagnostic` calls
`HptLogQualificationFormatWrapDiagnostic()` and therefore reformats the
installed HPT media before creating its wrapped fixture. Running it now would
erase the two million-record test datasets that the owner asked to preserve.
It is not authorized by the nondestructive build-and-run decision and was not
started. The owner accepted preserving both million-record datasets, using the
passing deterministic wrapped-history model and invariant coverage for this
ticket, and deferring destructive physical wrap testing to later qualification.
This is an explicit evidence-scope decision, not a claim that physical wrapped
history was tested and not a relaxation of production fail-closed behavior.
