# Checklist: SD card supply change project closeout

Status: active; Gate 1 complete with all stale campaigns terminal; releasable baseline remains
Type: checklist
Updated: 2026-08-14
Next Action: consolidate one reviewed release line, integrate `SMI-SDQ-CONTRACT-V1`, and register a contract-complete immutable execution plan before controller execution
Campaign Reason: Historical record from campaign 016-release-implement-and-close-sd-supply-change; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/maps/map-smi-firmware-stabilization-and-qualification.md
Canonical Truth: docs/sd-card-qualification-contract.md and docs/ecr-sd-card-supply-change-resolution.md

## Outcome

Close the SD card supply-change project with direct evidence for physical-card
qualification, controlled requirements, part-number/ECO release, and
implementation in both 1751136 and DCS 1751219 production paths.

This checklist is the single ordered closeout queue. The canonical documents
define requirements, the deployed SD Qualifier database and image define live
runtime state, and dated evidence proves individual gates. Existing maps,
workpackages, tickets, campaigns, branches, and completed artifacts are inputs
or history; they do not create competing next actions.

## Current limiting condition

The Aug. 10 `CHANGE_IMPACT` campaign is terminally closed without a
qualification conclusion. The application stores the accepted
`INCONCLUSIVE — no card rejection` decision as its supported `ABORTED`
closeout state, version `3`, while coordinator and lanes remain `PAUSED`.
All `187` runs and `361` HPT2 operations remain terminal, both card results
remain `PENDING`, and the immutable report records
`qualification_conclusion=false`. The obsolete run-bound host observer is
disabled; no observation evidence was added across a later poll interval, and
the appliance remains healthy under the documented between-campaign worker
override. A frozen cross-campaign admission audit confirms that the same A/B
cards recur but the fragments cannot form a successful qualification: every
substantive predecessor used a different firmware bundle, 6 matrix leaves are
missing everywhere, and B recovery, both required workload-based endurance results, final
scrubs/CID closeout, and reviewer outcomes do not exist. All nine remaining
stale, superseded, and fixture campaigns were then closed through the supported
application service as `ABORTED` with `qualification_conclusion=false`,
unchanged sample results, and immutable hash-verified reports. The deployed
database now contains `11` terminal campaigns, zero non-terminal campaigns,
and zero active execution operations. Gate 1 is complete; Gate 2 is the
limiting condition.

## Closeout rules

- Do not start another controller task until Gate 2 establishes the accepted
  contract-bound release baseline and the new campaign is explicitly authorized.
- Do not use the Aug. 10 hotfix campaign to claim card-family qualification.
- Admit existing evidence row by row; never silently reinterpret or replay it.
- Close obsolete application campaigns by truthful terminal disposition; do
  not delete their records or evidence.
- Keep checkout, deployed-image, database, card, firmware, and controlled-ECO
  identities distinct.
- A passing build, fixture, matrix case, installed pair, or application release
  is not by itself project completion.

## Gate 1 — make the live system truthful and quiescent

- [x] Capture two matching read-only stopped-clean observations for run
  `efdeaec7-f0e7-4458-8012-7580dab9f18f` through the admitted Controller B
  terminal-observation path.
- [x] Finalize that run without granting S2/profile pass credit and without
  publishing another Start or Stop.
- [x] Snapshot the campaign database, immutable evidence ledger, frozen
      firmware/profile identities, application release transitions, tasks, runs,
      commands, and first failures.
- [x] Reconcile campaign, coordinator, task, run, traveler, dashboard, and
  report state so they agree.
- [x] Record one decision: explicitly migrate admitted rows to a versioned
  `CHANGE_IMPACT` plan, or close the campaign `INCONCLUSIVE` and start clean.
- [x] Terminally disposition stale fixture and superseded historical campaigns
  without deleting evidence or treating them as current work.

Evidence required: immutable campaign/run identifiers, read-only observation
outputs, command non-replay proof, database state, and the migration or
inconclusive-closeout decision.

Snapshot/audit evidence:
`work/evidence/sd-qualifier-aug10-campaign-snapshot-audit-and-disposition-recommendation-20260813.md`.
The accepted closeout and report evidence is
`work/evidence/sd-qualifier-aug10-campaign-inconclusive-closeout-20260813.md`.
The nine-campaign administrative closeout, backup/recovery record, and
hash-verified report manifest are
`work/evidence/sd-qualifier-nine-campaign-administrative-closeout-20260814.md`.

## Gate 2 — establish one releasable SD Qualifier baseline

Implementation is coordinated by
`work/wp/active/wp-controller-neutral-sd-qualification-and-independent-a-b-execution.md`.

- [ ] Integrate the machine-readable `SMI-SDQ-CONTRACT-V1` source with the
  selected release line; do not leave the governing contract on a detached
  feature branch.
- [ ] Bind a new immutable execution-plan revision to campaign type, permitted
  conclusion, ordered leaf gates, bounded attempts, evidence admission, and
  result aggregation.
- [x] Make coordinator and UI use the same state/transition and
  control-availability rules.
- [ ] Pass fixtures for pass, fail, blocked, inconclusive, pause/resume,
  restart, duplicate submission, exhausted budget, evidence reuse, and final
  reviewer outcomes.
- [ ] Consolidate the deployed source lineage into one reviewed release branch
  and record exact commit, image digest, migration state, backup, rollback, and
  test evidence.
- [x] Audit existing A/B evidence row by row across campaigns and explicitly
  classify target-bundle review candidates, wrong-bundle rejects, and missing
  leaves without resuming controller execution.
- [x] Deploy and verify the exact release on `srv-rpi00.local` before making it
  the basis of physical qualification.

Work2 deployment evidence is
`work/evidence/2026-08-13-sdq-independent-ab-work2.md`. The deployed core is
not yet the final releasable baseline: the role-neutral Controller B recovery
runner is deployed and configured, but still needs an explicitly authorized
physical end-to-end qualification, and the source lineage has not been
consolidated onto a reviewed release branch.

Cross-campaign admission evidence is
`work/evidence/sd-qualifier-cross-campaign-evidence-admission-audit-20260813.md`.
It rejects a synthetic successful campaign. Twenty exact-target plan leaves
remain reviewable for a future signed migration, while the remaining physical
and reviewer gates must be completed in a contract-bound campaign.

Evidence required: reviewed source history, test results, migration result,
image identity, health, restart/no-replay proof, backup/restore proof, and
rollback reference.

## Gate 3 — prove the application end to end

- [ ] Through the website, have a normal operator create a versioned campaign,
  enter traceability, and bind each physical card to the complete service-467
  CID identity block.
- [ ] Use one website Run action to advance every automatable step, stopping
  only at genuine safety, physical, authorization, or reviewer gates.
- [ ] Complete the required matrix, Controller A/B recovery, post-campaign
  full-address scrubs, final CID observations, per-card dispositions, paired
  review, report, and history.
- [ ] Prove that no SSH-selected case or hidden manual orchestration is needed
  for the normal operator journey.

Evidence required: one immutable application-acceptance campaign with the
frozen definition, complete event/evidence manifest, per-card results, paired
result, report, and historical reconstruction.

## Gate 4 — qualify the intended retail samples

- [ ] Receive the intended eligible retail samples and assign immutable sample
  identities with source, markings, capacity, speed class, and lot/date data.
- [ ] Capture the required CID block at baseline and after every relevant
  power-off replacement, initialization, or reboot.
- [ ] Execute the controlled HPT media 2.0 procedure for each required sample
  and record `PASS`, `FAIL`, or `INCONCLUSIVE` with attribution.
- [ ] Satisfy the approved minimum family/sample breadth; do not infer broad
  approval from only the currently installed KEXIN pair.

Evidence required: approved per-sample records and family disposition meeting
the controlled sampling requirement.

## Gate 5 — finish the controlled change

- [ ] Reframe the selection, sourcing, candidate, Amazon-screening, and
  procurement narratives so obsolete industrial-grade, Class 10/U1, brand,
  seller, and authorized-source rules are historical rather than acceptance
  gates.
- [ ] Decide whether to generalize part 1500513 or release a new
  part/specification, including inspection, traceability, legacy inventory,
  risk, and affected-document treatment.
- [ ] Approve and release the ECO with the qualification evidence and
  unambiguous acceptance criteria.
- [ ] Implement every ECO action in purchasing, receiving, BOM/work
  instructions, internal 1751136 production, and DCS 1751219 production.
- [ ] Verify internal and DCS paths use the same released rule and disposition
  all exceptions and legacy inventory.

Evidence required: released controlled documents, approved ECO, implementation
records, owner/approver records, and aligned internal/DCS production evidence.

## Gate 6 — reconcile and close

- [ ] Promote the final settled state to README/current docs and keep bulky
  execution history in dated evidence.
- [ ] Complete or supersede subordinate SD workpackages only where their own
  completion criteria have direct evidence.
- [ ] Mark the Tool Shed project and subordinate artifacts complete only after
  every preceding evidence gate is satisfied.
- [ ] After Tool Shed closeout is correct, synchronize the downstream Marshal
  mirror and verify that it reflects the same final state.
- [ ] Regenerate Tool Shed indexes; pass stale-path, work-state, link, and
  `git diff --check` verification.

## Critical path

Gate 1 → Gate 2 → Gate 3 → Gate 4 → Gate 5 part/ECO decision → Gate 5 rollout →
Gate 6. The sourcing-document rewrite in Gate 5 may proceed while waiting for
retail sample delivery, but ECO approval cannot outrun qualification evidence.

## Project health

The Tool Shed project remains at risk because the executable contract is not
yet the accepted deployed plan, cross-campaign fragments cannot supply the missing
matrix, recovery, endurance, closeout, and review proof, intended retail
samples are not qualified, and ECO/rollout gates remain open.
Any downstream tracker is a mirror of this state, not an authority for it.

## Verification

- `python tool_shed/scripts/update_work_index.py --workspace .`
- `python tool_shed/scripts/check_stale_paths.py --workspace .`
- `python tool_shed/scripts/review_work_state.py --workspace .`
- `git diff --check -- README.md docs/ work/`
