One Status Bit, Several Root Causes
When NAND reports a program failure, all the firmware learns is that the write did not land. The cause may be a programming pulse insufficient to push the threshold voltage into its target window, program disturb from an adjacent wordline pushing a finished distribution past its boundary, or a cell whose tunnel oxide has degraded after heavy cycling until it simply will not take a write. The costs diverge sharply: the first two usually pass on a rewrite to a different physical location, while the third will likely fail again on any page of the same block. Declaring every failure a bad block eats into spare capacity; retrying every failure leaves data in a region that can no longer be trusted.
Two Boundaries on Retry
Retries are bounded on two axes: count and location. The retry count at the same target is deliberately low, because repeatedly applying program pulses itself aggravates disturb on neighbouring cells. Past that threshold the firmware moves to a different page; if that also fails, the whole block leaves the usable pool and a reserved spare takes its place transparently. The decision also consults the block's program/erase count and recent error history. A block with low cycling that suddenly fails repeatedly looks more like an external factor — temperature, a supply transient — and is worth recording rather than discarding. A block near end of life should be retired early.
Where the Source Data Lives at the Moment of Failure
Recovery is only possible if the source has not yet been released. The write buffer holds its entry until program verification passes, which is the same logic that underpins power-loss protection: PLP guarantees buffered content reaches media on an unexpected power loss, and the retention policy guarantees there is still a source to re-program on failure. The rewrite itself stays inside end-to-end protection, with T10 DIF/DIX protection information travelling alongside the data so the repair does not introduce a fresh silent error.
Growth Rate, Not Single Events
One program failure says little; the trend says a great deal. Firmware counts newly retired blocks over time windows and surfaces the figure through SMART and Telemetry, so operations can schedule replacement while the drive is still serving normally rather than reacting once spare capacity is exhausted. J750 and J770 are at the product-definition/EVT stage, and this handling logic together with its thresholds is being calibrated point by point on the engineering platform across temperature ranges and cycling depths.