# ADR: SD evaluator destructive media preparation

Status: superseded; accepted only for historical FAT32/FileX service 472
Type: adr
Updated: 2026-07-14
Next Action: use explicit HPT service-468 initialization and the HPT media 2.0 qualification checklist
Campaign Reason: Historical record from campaign 012-prove-independent-hpt-media-validation; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Superseded By: work/checklists/checklist-hpt-media-2-autonomous-retail-card-qualification.md
Parent: work/wp/active/wp-sd-card-accelerated-endurance-evaluator-and-media-qualification.md

## Context

Reliable comparison requires every evaluator run to begin from known filesystem
geometry, empty test namespaces, known free space, and no residue from an older
run. Accelerated append, metadata, capacity, restart, and corruption testing is
inherently destructive to the selected evaluation media. Preserving arbitrary
user data would make run-to-run results ambiguous and could expose unrelated
files to the same failure under investigation.

The owner explicitly authorized destructive datalogger activity when needed for
proof of reliability, provided the operator receives a clear data-loss
confirmation.

## Decision

Service code **472** may erase and format the selected SD card as the first
stage of an accelerated evaluator run.

Every run requires a fresh two-stage confirmation:

1. An information screen identifies the selected card as far as the controller
   can (capacity, filesystem, volume label, CID/serial when available), describes
   the 31-day accelerated workload, and states that the test is destructive.
2. The final confirmation must prominently state:
   **ALL DATA ON THE SD CARD WILL BE PERMANENTLY LOST.** The only actions are
   Cancel and Erase/Start.

Cancel performs no format, repair, directory creation, or write. Consent is not
remembered across runs or reboots.

After Erase/Start, the evaluator reuses the same reviewed format implementation
as service code 471, including error handling, fault-tolerant enable, flush,
marker verification, reopen, and status reporting. Evaluator writes begin only
after format verification succeeds. A format failure latches the run as failed
and never reports an endurance result.

This decision does not permit automatic formatting on card insertion, mount
failure, missing marker, corruption, or retry. Only the explicit service-code
confirmation authorizes destructive preparation.

## Evidence preservation exception

A historically failed or newly failed card must be imaged and inspected before
the destructive evaluator reset when failure evidence is still needed. The
operator confirms that preservation is complete or explicitly waived before
Erase/Start.

## Consequences

- Each run starts from a reproducible on-controller format baseline.
- Existing card data is intentionally destroyed after explicit consent.
- Evaluation media must be correctly selected and backed up before confirmation.
- The result manifest records pre-format identity, format parameters/status,
  confirmation time/operator, and post-format geometry/free space.
- Phase-targeted power interruption remains separately authorized because it
  can endanger the controller/setup as well as the SD filesystem.
