# Frontier storage design review v1

| Operating condition | Present behavior | Qualification work |
|---|---|---|
| Sudden loss of power or a watchdog reset | The two-bank protocol orders invalidation, data and publication with flushes. An interrupted request can have an unknown outcome. | Cut actual device power at each phase, including allocation and directory creation. Correlate acknowledgments with recovered generation and contents. |
| Slow device, prolonged offline operation | Embedded calls work offline. A synchronous mutation rewrites the live snapshot and waits for three barriers. | Measure worst-case write and recovery time at full capacity before selecting watchdog deadlines and service queue sizes. |
| Limited RAM and storage | Record limits bound individual buffers. Two banks bound the logical extent. The example tests a hard 8 KiB capacity. | Measure peak allocator use, fragmentation, stack high-water mark and controller buffers under maximum-size records. Reserve recovery resources. |
| Flash endurance and long lifetimes | Both banks occupy the same device. Frequent small updates can induce large writes and wear concentrated header sectors. | Measure physical writes and erase cycles on the controller, calculate lifetime against the actual workload, retain capacity for controller remapping. |
| Bit flips and failed reads or writes | Record and header CRCs detect many corruptions. An erased header can resemble an unused bank. Failed commits require reopen. CRC cannot correct corrupt data. | Test ECC memory reporting, injected media errors, repeated restarts and bit flips in data, addresses and metadata. Preserve the failing image and fail closed on ambiguity. |
| Device loss and replacement | Losing one device loses both banks. Offline restoration requires an independently retained copy. | Rehearse cold restore onto a spare, check generation against the backup manifest, validate all records and verify application invariants. |
| Intermittent links | A dropped response can hide a successful commit from a remote client. | Reconnect and reconcile by stable IDs. Replaying multi-step workflows requires application-level deduplication and explicit conflict handling. |

For Avaco/Atlas bring-up, record the actual erase geometry, spare area, controller cache behavior, flush semantics and measured latency distribution. A hardware watchdog should permit progress through the longest validated recovery before escalation to a maintenance mode. Independent storage or ECC can address different failure domains. Their coverage depends on the controller, firmware and system recovery policy. Physical power cuts, radiation testing and operation on frontier hardware remain unverified.