# Checklist: HPT media 2.0 autonomous retail-card qualification

Disposition: abandoned by owner; unfinished completion gates are not passed

Status: abandoned
Type: checklist
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 015-qualify-intended-retail-sd-breadth-and-approved-pool; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-sd-card-accelerated-endurance-evaluator-and-media-qualification.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Authorization Matrix: work/decisions/decision-remaining-qualification-authorization.md

Execution Owner: jong@srv-rpi00.local:~/dev/sd_qualification

This tracked checklist defines firmware release coverage and review fields. It
must not be copied here as a live campaign worksheet. The remote qualifier owns
the authoritative instance, generated evidence, terminal state, and reviewer
disposition; this workspace consumes its immutable result manifest.

Use one immutable checklist instance per controller, physical card, firmware
hash, and run profile.

## Identity

| Field | Value |
| --- | --- |
| Run ID / timestamps / timezone | |
| Campaign ID / qualification reason / applicable release scope | |
| Based-on or superseded campaign, if any | |
| Controller assembly / hardware | |
| J-Link serial / endpoint | |
| Source commit / ELF / SREC hashes | |
| Card sample / supplier / lot / capacity | |
| Protocol status / CID valid / sector read valid | |
| Manufacturer and MID | |
| OEM/application ID | |
| Product / revision / serial / manufacture date | |
| Complete raw 128-bit CID | |
| HPT media generation and geometry | |
| Power-control cycle/profile version | |
| Evidence directory | |
| Initial or added sample / added-sample reason | |
| Required coverage / counts toward approval | |

## Gates

- [ ] Card is explicitly expendable and authorized for destructive HPT
  initialization/endurance.
- [x] G-PWR-A is passed and linked through
  `work/evidence/hpt-log-store-circular-mirror/controller-a/g-pwr-20260725/qualification-result.md`.
- [x] G-PWR-B power method is passed and linked through
  `work/evidence/hpt-log-store-circular-mirror/controller-b/g-pwr-full-20260725/qualification-result.md`;
  its three reset witnesses and CID captures pass, while card-specific
  HPT/data checks remain required on the frozen candidate.
- [ ] Exact controller/J-Link/card identities match the planned run.
- [ ] Firmware and host automation are frozen and hashes recorded.
- [ ] Isolated-bench controller identity, stop control, timeout, and recovery
  route pass. The exact A/B test controls have no heater/load/production
  connection, so no repeated heat or alarm review is required.
- [ ] Baseline CID capture is complete.
- [ ] The pre-destructive full-address scrub accounts for every
  host-addressable logical sector with zero unreadable or retry-recovered
  sectors.
- [ ] Exact-scope destructive authorization is recorded only after the CID and
  full-address baseline pass.
- [ ] HPT initialization is explicit, deliberate, and verified.
- [ ] CID is recaptured after initialization and every reboot or power-off card
  replacement/reinsertion. Powered hot swap is prohibited.

## Baseline and assigned coverage

- [ ] The passed pre-destructive scrub evidence is linked here; it was not
  deferred until after initialization.
- [ ] HPT open, lane state, retained range, retirement state, and first-error
  snapshot pass.
- [ ] Normal log, ordered readback, graph, and USB export pass.
- [ ] Installed-but-unformatted notification offers the guarded Format action;
  J-Link evidence proves eligibility, cancel, success, and failure behavior,
  and the operator performs only the final wording/layout/navigation review.

## Autonomous campaign

- [ ] Accelerated wrap/reclaim/readback/export workload reaches its planned
  generations and operation counts.
- [ ] Scheduled power interruptions cover record data write, segment
  header/seal, reclaim/next-segment, and retirement snapshot.
- [ ] Every reboot captures power timestamps, reset witness, CID, reopened
  state, recovered tail, last acknowledged sequence, lane/quorum state,
  retirements, errors, and resumed logging.
- [ ] No acknowledged record is lost and no incomplete record becomes committed.
- [ ] Degraded lanes and bad regions remain bounded; logging continues whenever
  quorum policy permits and loss is explicitly reported.
- [ ] Stop reason and terminal state are machine-readable.

## Post-campaign

- [ ] Full-address read scrub repeats, accounts for every host-addressable
  logical sector with zero unreadable or retry-recovered sectors, and is
  compared with baseline.
- [ ] Ordered retained-window readback passes with explained gaps only.
- [ ] Customer export passes for retained ranges and reports
  `RANGE_NOT_RETAINED` for older ranges.
- [ ] Final CID and HPT state are captured.
- [ ] Result disposition is PASS, FAIL, or BLOCKED with evidence links.

## Family review

- [ ] At least two counted samples pass all assigned coverage.
- [ ] The initial counted pair spans Controller A and Controller B.
- [ ] Every added sample has a reviewed reason, independent gates, role, and
  required coverage.
- [ ] Every failed, blocked, excluded, or inconclusive sample has failure
  attribution and reviewed disposition.
- [ ] No confirmed media-family failure is hidden by later passes.
- [ ] No unresolved firmware, controller, method, automation, evidence,
  infrastructure, or safety failure remains.
- [ ] Reviewer sign-off records the applicable release scope and any
  superseded campaign without overwriting prior history.

## Owner-directed reconciliation — 2026-09-23

Retire the unexecuted retail-card qualification template with the owner-abandoned sample/family programme; no qualification pass is claimed.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: template; external execution not ready pending srv-rpi00.local live-controller gates and exact bundle import
> Next Action: none in this firmware workspace; the Pi qualifier creates immutable per-sample campaign instances after readiness, bundle, identity, and authorization gates pass

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
