diff --git a/Drivers/BSP/GD5F2GQ5UE/nand_ftl.c b/Drivers/BSP/GD5F2GQ5UE/nand_ftl.c
index 0702e20c..4df7f20c 100644
--- a/Drivers/BSP/GD5F2GQ5UE/nand_ftl.c
+++ b/Drivers/BSP/GD5F2GQ5UE/nand_ftl.c
@@ -132,6 +132,36 @@ int dhara_nand_prog(const struct dhara_nand *n, dhara_page_t p, const uint8_t *d
         return -1;
     }
 
+    /* 编程回读校验（2026-09-20 台架实证）：供电低于标称（3.1V）时
+     * program 可"状态成功"但 cell 未可靠 latch（ECC 不可纠或数据错位）——
+     * 状态寄存器发现不了，下次复位 journal resume 因 ECC 门拒绝这些
+     * checkpoint 页 → 新写入整体静默丢失（重格式化循环的真根因）。
+     * 回读比对+ECC 检查，失败则标记坏块由 dhara 迁移，宁可丢块不丢卷。 */
+    if (gd5f_page_read(phy_pg) != GD5F_OK) {
+        dhara_nand_mark_bad(n, p >> n->log2_ppb);
+        dhara_set_error(err, DHARA_E_ECC);
+        DBG_ERROR("program verify: readback fail, blk %lu",
+                  (unsigned long)(p >> n->log2_ppb));
+        return -1;
+    }
+
+    if (gd5f_check_ecc() != GD5F_OK) {
+        dhara_nand_mark_bad(n, p >> n->log2_ppb);
+        dhara_set_error(err, DHARA_E_ECC);
+        DBG_ERROR("program verify: ecc uncorrectable, blk %lu",
+                  (unsigned long)(p >> n->log2_ppb));
+        return -1;
+    }
+
+    gd5f_read_from_cache(0, s_copy_buf, FTL_PAGE_SIZE);
+    if (memcmp(s_copy_buf, data, FTL_PAGE_SIZE) != 0) {
+        dhara_nand_mark_bad(n, p >> n->log2_ppb);
+        dhara_set_error(err, DHARA_E_BAD_BLOCK);
+        DBG_ERROR("program verify: data mismatch, blk %lu",
+                  (unsigned long)(p >> n->log2_ppb));
+        return -1;
+    }
+
     return 0;
 }