Erasing at scale

The Hotswap station turns a chassis full of drives into one erase run: select everything you loaded, commit once, and all selected drives wipe in parallel — each producing its own result and its own certificate.

Verify and unlock

The station boots locked, exactly like the engine: no drive enumeration, no erase screen, nothing but Wi-Fi, retry, and power until it completes an online license verification. There is no offline unlock, and verification does not consume quota. The lock reasons, deny messages, and unlock flow are identical to the engine's — see Booting & verification.

The Drives screen

Open Erase in the sidebar. The header band reads Drives, and the screen is a spreadsheet grid with one row per drive:

Column	Contents
(checkbox)	Select the drive for erasure.
Device	Device path (e.g. /dev/sda).
Model	Drive model.
Size	Drive capacity.
Method	NIST 800-88 R2 Clear or NIST 800-88 R2 Purge, per drive.
PSID (Opal)	PSID entry for TCG Opal drives — hint: 32-char drive-label code. Collected only when the method is Purge.

Above the grid sits the danger notice, verbatim:

Selected devices will be irreversibly erased. There is no undo.

A drive that can't be erased shows excluded — {reason} in its Method cell instead of a method picker (see the eligibility rules). Selecting Clear on solid-state media shows a warning tooltip: Solid-state media: Clear cannot reach over-provisioned cells (NIST 800-88 recommends Purge). Result will be held for review.

The commit button reads ERASE {n} device(s) — red, and disabled while nothing is selected (No devices selected.).

Committing the run

Pressing the erase button opens a single "Are you sure?" confirmation for the whole selected batch — one confirm covers every drive in the run, not one per drive.

On confirm, the station performs one license check-in for the entire run. This is the fail-closed gate: only an affirmative allow from the server starts the wipes. On allow, every selected drive starts wiping immediately and in parallel — one job per drive, with no concurrency cap. A 12-bay chassis erases 12 drives at once.

When the run is blocked

If the check-in is denied or unreachable, no drive is touched and a window titled Wipe blocked explains why:

Situation	Message
No token on the stick	Device not provisioned: no backend token configured. Wipe blocked.
Server allowed but sent no job id	Check-in allowed but returned no job id. Wipe blocked.
Server denied	Wipe denied: {reason}.
Offline / unreachable	Check-in failed — offline or unreachable. Wipe blocked. ({e})

Deny reasons map to the same operator messages as the engine's:

Wire reason	Operator message
disabled	This ISO has been disabled by MAESON support. Contact support — your account admin cannot re-enable it.
revoked	This device's licence was revoked by an account admin. Download a fresh ISO.
suspended	This device's licence is suspended. An account admin can reinstate it.
quota_exceeded	This device has used its entire wipe quota. Contact your account admin.
account_inactive	The AVERASE subscription for this account is not active. Renew it to keep wiping.
not_found, invalid_token	This stick's licence token is not recognised. Download a fresh ISO.
validation_unavailable	The licence server is unreachable right now. Check the network and try again.
any other reason	Licence check denied ({other}).
transport failure	Could not reach the licence server. Check the network and try again. ({e})

Quota is metered per run today

---

The progress screen

The band reads Wipe progress, and each drive gets its own block headed by its device path, with three rows:

• Method — the method and technique in use.
• Progress — a progress bar with a percentage, or working… with a spinner for firmware-side techniques that don't report progress.
• Status — one of pending, running, completed (green), failed (red), or cancelled (muted).

While any job runs, the station shows Wiping… navigation is locked until all jobs finish. — navigation is disabled, with only the per-drive Cancel buttons exempt. When every job reaches a terminal state, the screen shows All jobs finished. with a View summary button.

Cancelling a drive

Each running drive has its own Cancel button. Pressing it opens a window titled Confirm cancel:

Cancel the wipe on {path}? The drive will be left PARTIALLY erased and is not safe to reuse until re-wiped.

with the buttons Yes, cancel wipe and No, keep erasing. While the cancellation lands, the drive's status shows cancelling…, then settles at cancelled.

The summary screen

The Summary screen shows one row per drive: its Method (with the technique that actually ran), the Result, and the Disposition:

Disposition	Meaning
sanitized	Erasure verified — the drive is safe to release.
DESTROY	Shown in red: the erase could not sanitize the drive — route it to physical destruction.
review	The result needs human review before release (e.g. a Clear on flash media).
—	No disposition (job didn't complete).

The footer reads, verbatim: Certificates are issued by AVERASE cloud — download them from your account.

One certificate per drive

Once all jobs are terminal, the station reports one wipe result per drive to the server. Each report carries the run's check-in job id with a per-drive suffix — job_id = "{checkin_job_id}-{index}", so a three-drive run reports job_abc-0, job_abc-1, job_abc-2 — and each persisted result generates its own signed PDF certificate in your account. Certificates are made only by AVERASE cloud; the station renders and signs nothing. See Results & certificates for the certificate contents and verification.

Where to next