# SD card accelerated endurance evaluator and media qualification Workpackage

Disposition: abandoned by owner; unfinished completion gates are not passed

Status: installed-pair representative regression passed; both physical-card qualifications and broader multi-sample media qualification remain active
Type: workpackage
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 015-qualify-intended-retail-sd-breadth-and-approved-pool; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone

Canonical Truth: E:/dev/high_point/7520553_SMI_FW/docs/sd-card-endurance-evaluator.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Parent: work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md

## 2026-08-11 terminal supervisor and handoff status

The false Controller A terminal supervisor block is reconciled without command
replay, and the website now distinguishes an incomplete matrix from an active
runner. Both cards remain `IN PROGRESS`; their next exact reviews are
`CASE_PASS` for Controller A and `BOUNDED_STOP_PASS_CASE_TRIGGER_NOT_MET` for
Controller B. See
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

## 2026-08-11 installed-pair representative regression result

The frozen candidate completed its bilateral target sequence on the installed
Controller A and B specimens. All six 129600 BEFORE/AT/AFTER immutable checks,
recovery, representative HPT read/write, standards-based USB publication and
independent-reader verification, normal production logging/chart read, and
exact configuration save/restore passed. Final CIDs matched baseline and both
controllers ended at HPT state/status 5/0 with lane mask 7 and zero mismatch,
loss, retirement, or system errors. The compact manifest now records
`QUALIFICATION_PASS_TARGET_AB`; see
`work/evidence/representative-ab-regression-20260811.json` and
`work/evidence/representative-ab-operator-target-gates-20260811.md`.

This result credits representative-regression traveler step 6 for both exact
cards; it does not qualify either physical specimen. The current-image matrix,
Controller B recovery, both post-campaign full-address scrubs/CID closeouts,
both dispositions, and the final paired gate remain open. The separately
tracked full-history export latency issue is deferred performance work, not an
SD-card qualification failure. Evidence reconciliation and the intentionally
open traveler gates are recorded in
`work/evidence/sd-qualifier-representative-regression-reconciliation-deployment-20260811.md`.

## 2026-08-10 Final-target admission hold

Live qualification identified shared occupancy-dependent exact-read scaling,
not a card failure. Pi release `s4-admission-policy-2167623` now blocks every
new 129600 run before controller observation or Start intent while preserving
current A/B observations and their Stop paths. The selected v2 contract retains
three observations at ordinary S4 regions and requires one BEFORE, AT, and
AFTER observation at 129600 per controller. See
`docs/hpt2-measurement-matrix-v2.md` and
`work/evidence/sd-qualifier-s4-final-target-admission-policy-release-20260810.md`.

## 2026-08-10 Exact-read software correction gate

The integrated firmware's append/same-sequence readback path now validates and
reads the committed active segment directly instead of searching every earlier
physical segment on all three lanes. Historical reads and three-lane voting are
unchanged; corrupt, retired, missing, or generation-mismatched active state
fails closed. Model/static gates, canonical managed Debug/Release rebuilds, and
the immutable package/hash gate pass. Frozen local candidate:
`smi-00-05-00-389167c1d57f-37ff5c0c6f48-release`.

The two live controllers were not interrupted or reprogrammed. A/B timing and
correctness evidence remains required, and the Pi's 129600 admission hold must
remain closed until that evidence is reviewed. See
`work/evidence/hpt2-exact-read-active-prefix-software-gate-20260810.md`.

## 2026-08-02 Workspace Ownership and Readiness Gate

This file preserves firmware evaluator implementation history and the
acceptance requirements that the firmware bundle must export. It is not the
execution plan for physical card qualification.

Execution system of record:
`jong@srv-rpi00.local:~/dev/sd_qualification`
(`PC-Redemption/sd-qualification`). That workspace owns campaign/sample
records, physical candidate intake, live-controller orchestration, generated
evidence, failure disposition, reviewer approval, and approved-family history.
It coordinates every controller-executed prerequisite and campaign case using
the imported exact SMI firmware; this workspace does not operate the targets.

Current readiness is **NOT READY for physical execution**. The remote qualifier
was last proved healthy in fixture-only mode. Before any card is assigned or
destructively exercised, it must pass its standalone appliance foundation,
live-controller adapter, authorized read-only A/B identity, stop/recovery, and
evidence-path gates.

This firmware workspace owns only non-controller production/review work:

- the exact firmware candidate and managed build artifacts;
- firmware-side diagnostics and interface version;
- the versioned campaign requirements and safety/authorization references;
- publication of one immutable bundle/manifest through GitHub; and
- review of the returned immutable result manifest for release disposition.

The operator owns physical receipt, labels/photos, controller-power-off card
handling, and required authorizations. The separate HPT Lab Power service owns
G-PWR operations. Do not use the operator as a cross-workspace message relay.

All later imperative campaign stages in this workpackage are retained as
historical requirements and remote acceptance criteria. They are not local
`Next Action` instructions. Services 470/472/474 remain historical firmware
evidence, not the remote HPT media 2.0 campaign mechanism.

## HPT media 2.0 scope correction

Planning update (2026-07-24): service 472 and the FAT32/FileX evaluator are
historical version-4 evidence, not the version-5 qualification mechanism. Use
`work/checklists/checklist-hpt-media-2-autonomous-retail-card-qualification.md`
and `work/runbooks/runbook-autonomous-hpt-sd-qualification.md`. Host modeling,
full-address scrub, export reasons, interruption hooks, and managed builds pass
the July 24 software gate. G-PWR-A/B now pass. Physical cuts,
interruption-endurance, Controller B HPT media qualification, and retail
multi-sample execution wait only for the frozen image and their case-specific
media/operation authorization.

Services 470, 472, and 474 and their FAT32/FileX campaigns are preserved below
as 00.04.13 history. They are not current candidate-card qualification gates.
Only their physical-sample traceability, failure evidence, and bounded-test
lessons carry forward. Current acceptance is the HPT media 2.0 procedure in
`docs/ecr-sd-card-supply-change-resolution.md`, including CID identity,
three-lane diagnostics, wrap/reclaim/reopen/readback/export, full-address
scrub, and normal one-minute logging.

Historical execution decision, corrected 2026-07-16: two physical controllers
were available. The campaign then called asset `1751219` Setup A and asset
`1751136` Setup B, and required completing A before B. EDGE run 67569 was
performed on physical controller `1751219` during the superseded one-controller
assumption; its legacy `setup-b` evidence path does not make it coverage for
physical controller `1751136`.

Current routing correction, 2026-07-20: those labels describe the historical
campaign and must not be rewritten. The currently connected benches are
A=`1751136`/J-Link `69664082` and B=`1751219`/J-Link `69660123`, verified from
each running controller's hardware variant. New execution must use the current
inventories and reconfirm mapping after cabling changes.

## 2026-07-25 candidate procurement intake

The owner provided order screenshots for all three planned retail candidates.
The ordered leads are a KEXIN 8 GB 10-pack, a GIGASTONE 8 GB 2-pack, and a
Lexar High-Performance microSDHC 300x 8 GB listing model
`LSDMI8GBBNL300A`. Listing details, visible quantities, provisional
sequencing, and the physical/CID intake fields are maintained in
`work/inventories/inventory-sd-card-qualification-candidates.md`.

KEXIN is the preferred first-family lead because the delivered pack can supply
the initial A/B pair plus fresh adaptive replacements or investigation
specimens. This is not a qualification decision: receipt inspection,
package/lot and card markings, per-card CID identity, and baseline full-address
scrubs remain mandatory. The two ordered GIGASTONE samples can begin an
initial A/B campaign if both pass intake and have consistent commercial
identity. Lexar is the Family 3 lead; its screenshot does not show order
quantity, so obtain one additional matching sample if only one physical card
was ordered.

## 2026-07-20 owner deferral

The owner deferred this workpackage because the original/retained SD card is
currently operating well and broader qualification of the previously selected
cards is not presently desired. No additional card model or sample is approved
by this deferral. Existing accelerated, host-analysis, service-474, and incident
evidence remains valid history, including the unresolved EDGE 4 KiB lost-chain
finding.

This decision pauses comparative, repeat, interruption, multi-sample, and
long-cadence media campaigns. It does not authorize destructive testing of the
working card and does not remove the active degraded-operation workpackage's
firmware requirements for absent, full, removed, or failed media. Reactivation
requires an explicit owner decision and fresh current-bench/media inventory and
operation-specific authority.

## 2026-07-22 reactivation

The deferral condition was met when Controller A's retained card produced an
incomplete export and then showed repeatable hardware read failures through
Linux and Windows readers. Similar reported failures across cards installed in
both controllers make independent defective media an insufficient root-cause
assumption. The workpackage is reactivated for non-destructive investigation
and planning. Any destructive or accelerated execution still requires fresh
media inventory, an expendable-card designation, and operation-specific owner
authority.

The immediate campaign must cover full-address reads, FAT/address coverage,
power-rail and shutdown/reset behavior, signal integrity, multiple card samples,
and fail-closed export behavior. A separate portable append-only log-store
project may reduce centralized metadata risk, but it does not replace root-cause
analysis of the current hardware path.

The July 22 incident investigation was bounded and closed on 2026-07-25. It
proved physical media unreadability as the direct cause but could not identify a
unique initiating mechanism from one failed specimen. This campaign now owns
systemic-risk discrimination: CID-linked baseline/post scrubs, multiple samples
from the first release family followed by one rolling retail family at a time,
Controller A/B comparison, and scheduled interruptions. Cross-family evidence
accumulates after release rather than blocking the first approved family.
Escalate to power-rail/signal-integrity measurement only if failures cluster by
controller; escalate workload analysis only if failures cluster under
accelerated activity across controllers.

## Goal

Provide an on-controller evaluator that compresses at least one month of the
production datalogger workload into the shortest safe bench run, while the
normal controller, UI, alarms, communications, chart, export, USB, NVRAM, and
watchdog routines remain scheduled. The evaluator must expose corruption,
mirror divergence, stalls, FileX errors, capacity problems, and restart defects
quickly enough to compare firmware changes and SD-card samples.

The long-term objective is to determine whether firmware can reliably operate
the less-capable SanDisk EDGE 8 GB card that corrupts with the old code. A
single recovered card is not automatically production-approved; multi-sample
and traceability gates still apply.

## Reference evidence

| Role | Card | Evidence | Historical behavior |
| --- | --- | --- | --- |
| failure-prone control | SanDisk EDGE 8 GB microSDHC, UHS-I, Class 4 | `work/evidence/sd-card-failure-reference-identification-20260714.md` | old code corrupts after about 1–2 days |
| known-working control | SanDisk Industrial 8 GB microSDHC, UHS-I, U1/Class 10 | `work/evidence/sd-card-reference-identification-20260714.md` | old code works |

Notion source pages and all original HEIC attachments are preserved under
`work/evidence/notion-sd-card/`.

Run 07949 host preservation is complete: all 44,640 records validate and A/B
match exactly. Its result JSON exposed an unsupported `%llu` formatter defect,
now fixed and tracked in
`work/tickets/ticket-sd-evaluator-result-json-serialization.md`. A later
unplanned powered removal confounds CHKDSK's single lost 4 KiB chain, so the run
does not pass the clean host-filesystem gate; see
`work/incidents/incident-sd-hot-removal-after-evaluator-07949.md`.

## Evaluator validity rule

The evaluator is not qualified merely because it writes many records. Before
using it to approve firmware, run the old firmware and require historical
discrimination:

1. the EDGE reference reproduces a filesystem, file, record, mirror, or media
   integrity failure at a comparable accelerated age; and
2. the Industrial reference completes the same campaign without corruption.

If both pass, the workload is not yet an adequate reproduction. If both fail,
the evaluator is harsher than the historical workload or has its own defect.
Either result blocks firmware conclusions until the profile is corrected.

## Operator interface

- Reserve service code **472** for `SD Datalogger Endurance Evaluation`.
- Access level: Factory/Engineering.
- First entry shows destructive-use warnings and the exact profile, run ID,
  firmware version/hash identifier, card identity fields, and estimated work.
- Start requires a second confirmation stating **ALL DATA ON THE SD CARD WILL
  BE PERMANENTLY LOST**. Cancel leaves the card byte-for-byte untouched by the
  evaluator.
- After confirmation, the evaluator may call the same reviewed format routine
  used by service code 471 and starts endurance writes only after format,
  flush, marker verification, and reopen all succeed.
- Re-entering code 472 shows live status and offers a controlled stop.
- A stopped, failed, or completed run retains its counters until a new run or
  reboot and writes a machine-readable result file when media remains usable.
- Service code 471 remains the standalone format operation; service code 472
  may reuse its implementation only after its own per-run data-loss consent.

The confirmation must state that the evaluator erases all existing files,
formats the media, creates test files, consumes write endurance, can expose or
worsen media defects, and must run only on backed-up evaluation media. The
accepted decision is recorded in
`work/adr/adr-sd-evaluator-destructive-media-preparation.md`.

## Production-path reuse

The evaluator belongs in the SD thread, not in a blocking HMI callback. Refactor
only enough to share these production operations:

- periodic-record population and framing;
- directory test/create;
- file create/open-for-append;
- 64-byte record write;
- close and media flush durability boundaries;
- A/B mirror result aggregation;
- media health probe, mount/error state, FileX fault-tolerant operation, and
  diagnostics.

Normal periodic/event queue entries have first priority. Existing chart load,
USB export, format, and recovery requests retain bounded opportunities to run.
The evaluator performs a small work slice and yields to ThreadX after every
slice so control and unrelated threads remain active.

Do not change `S_LogRecord` size. Use spare fields in evaluator-only records for
a fixed test magic, monotonically increasing sequence, and complemented
sequence or payload check. Production records retain their deployed layout and
meaning.

## Isolation and repeatability

- Following the confirmed destructive format, write evaluator data under a
  unique, short FAT-compatible namespace keyed by
  run ID, separate from production year A/B directories.
- Never append a new run to an old evaluator namespace.
- Advance the synthetic record timestamp by exactly 60 seconds per record.
- Preserve the production hourly rollover shape: 60 records per hour file.
- Use separate A and B test mirrors on the same volume, matching production
  redundancy and its shared-filesystem limitation.
- Capture baseline and final free bytes, filesystem geometry, card CID when
  available, FileX version/configuration, and fault-tolerant enable result.
- Do not erase evaluator files automatically; preserve them for host analysis.

## Default accelerated profile

One logical month is 31 days:

- 44,640 one-minute logical records;
- 744 hourly files per mirror;
- 89,280 mirror durability transactions;
- 5,713,920 bytes of record payload across A and B before filesystem overhead;
- checkpoints at 1,440 records (one day), 2,880 (two days), 10,080 (seven
  days), and 44,640 (31 days).

Run as quickly as the media completes real open/write/close/flush operations.
Do not replace the workload with one large sequential write: the historical
metadata cadence is part of the test. Report achieved logical-time
acceleration rather than hiding slow cards behind a timeout.

At each checkpoint, record metrics and perform a non-correcting integrity scan.
The two-day checkpoint is the primary fast-reproduction gate for the EDGE
reference. A second production-equivalent profile may defer full readback until
the end to measure the effect of checkpoint scans; both profiles use identical
writes.

## Online verification

After each checkpoint and at completion:

1. flush media and retain the first error without overwriting it;
2. inspect expected file counts and exact file sizes;
3. reopen records read-only and validate framing, timestamp, test magic,
   sequence, and sequence complement;
4. compare mirror A and B byte-for-byte and identify the first divergence;
5. run `fx_media_check()` with no error correction and record FAT-chain,
   directory, lost-cluster, and file-size error bits;
6. probe the physical media and measure available-space behavior;
7. resume only if the configured profile permits; any integrity error latches
   the run as failed and prevents further writes by default.

The evaluator must never repair the volume during qualification. Correction or
formatting is a separately authorized recovery action after evidence capture.

## Required metrics

- requested, started, written, flushed, read, verified, and rejected records;
- queue depth/high-water, production queue drops, evaluator throttles, and
  event-log completion timeouts;
- mirror A and B phase/status independently;
- first and last FileX/SDMMC status and failed operation phase;
- minimum, mean, percentile-ready histogram buckets, and maximum time for
  directory, open/create, write, close, flush, complete A/B record, checkpoint
  scan, and media check;
- starting/current/ending free bytes and expected payload delta;
- physical-probe failures, reopen attempts, fault-tolerant recoveries, and
  filesystem error bits;
- control/PID deadline misses, watchdog resets, UI heartbeat, communications
  heartbeat, alarm activity, chart/export requests and outcomes;
- wall time, simulated time, and achieved acceleration ratio;
- restart count and last committed evaluator sequence.

Use integer tick counters and overflow-safe accumulation. Preserve raw counters
in the result file so host tooling can calculate additional percentiles.

## Concurrent workload matrix

All profiles keep normal control and monitoring active. The recorded campaign
must also exercise:

- periodic production logging and event bursts while evaluator writes run;
- continuous temperature control at a safe attended setpoint;
- door input and alarm transitions;
- HMI navigation and repeated chart loads;
- USB log export during evaluator activity;
- communications traffic and current-output updates;
- NVRAM/configuration save activity;
- controlled warm restart at checkpoints;
- separately authorized power interruption during directory create, file
  create/open, write, close, flush, and fault-tolerant commit.

The evaluator pauses or yields for normal SD requests; it must not fake
concurrency by disabling production services.

## Campaign stages

### Stage 0 — Preserve media and establish identity

- Photograph both faces and packaging.
- Read CID/CSD/serial where tooling permits.
- Record source, lot, capacity, filesystem, allocation unit, free space, and
  write-protect state.
- Image the failure-prone card before any format or repair if readable.
- Preserve host filesystem-check output without correction.

### Stage 1 — Implement and host-check evaluator

- Add service code 472 start/status/stop behavior.
- Add the SD-thread state machine, unique run namespace, metrics, result file,
  checkpoint readback, and non-correcting media check.
- Add static checks and host tests for state transitions, arithmetic, record
  generation/validation, run isolation, stop/failure latching, and counter
  overflow.
- Build Debug and Release and capture exact hashes.

### Stage 2 — Validate evaluator discrimination on old code

- Establish an old-code baseline image and exact hash.
- Run the failure-prone EDGE control through at least the one- and two-day
  checkpoints, preserving first-failure evidence.
- Run the Industrial control through the full 31-day profile.
- Tune only documented workload parameters if historical discrimination is not
  reproduced; do not tune card-specific pass rules.

### Stage 3 — Compare firmware variants

Use the same physical references, format geometry, setup, workload profile, and
evidence schema for:

1. old firmware baseline;
2. current hardened firmware;
3. each isolated candidate change when practical; and
4. the final integrated candidate.

This separates code effects from media and setup effects. Reimage or format only
according to the approved reset procedure between variants.

### Stage 4 — Candidate-card and capacity campaign

Evaluate both samples of each ordered candidate:

- WD Purple SC QD101 32 GB, `WDD032G1P0C`;
- PNY Elite 16 GB, exact received MPN to be recorded;
- Transcend 8 GB, exact received MPN to be recorded.

Include the two reference cards. Capacity, FAT type, allocation unit, supplier,
and sample identity must not be pooled. A production recommendation requires
the approved sample count and traceability, not a single passing card.

### Stage 5 — Restart, power-cut, and recovery

- Warm restart after one day, two days, seven days, and final write completion.
- Resume from the last committed sequence without overwriting or silently
  skipping records.
- Execute the approved phase-targeted power-cut matrix.
- After each interruption, capture FileX recovery, non-correcting media check,
  exact mirror contents, and host filesystem inspection.

### Stage 6 — Workload-based endurance

Endurance acceptance is based on the defined record, wrap/reclaim, readback,
concurrent-activity, and controlled-restart workload. No minimum wall-clock
soak duration is required or inferred from service 487.

## Provisional acceptance criteria

These criteria are implementation defaults pending owner sign-off:

- zero FileX/SDMMC errors and zero `fx_media_check` error bits;
- zero malformed, missing, duplicate, or out-of-order evaluator records;
- exact A/B mirror equality at every completed checkpoint;
- exact expected file count and file sizes;
- zero unexplained production log drops or event completion timeouts;
- no watchdog reset, control/PID deadline miss, UI hang, alarm loss, or
  communications loss attributable to evaluator activity;
- free-space reduction is explainable by payload plus measured FAT/directory
  allocation overhead and never increases unexpectedly during append-only work;
- controlled stop/restart preserves all committed records and resumes cleanly;
- final non-correcting FileX check and host filesystem check report no errors;
- the old-code reference campaign discriminates EDGE failure from Industrial
  success before evaluator results qualify a firmware fix;
- the final candidate completes three consecutive 31-day accelerated profiles
  on each physical reference card, then the approved multi-sample candidate
  matrix and real-time soak.

Latency limits are not guessed in this plan. The baseline run must establish
distributions, after which firmware, controls, and release owners approve
maximum record transaction, queue delay, chart/export, and control-jitter
limits. Any operation exceeding an approved limit fails even if data survives.

## Evidence layout

Use one immutable directory per run:

`work/evidence/setup-<a|b>/sd-evaluator/<run-id>/`

Required contents:

- `manifest.md` with setup/card/firmware/profile/operator identity;
- controller result/counter export;
- serial/debug trace with first failure;
- pre/post directory listings and hashes;
- A/B comparison report;
- non-correcting FileX media-check result;
- host filesystem-check output and sector-image hash where authorized;
- timing/acceleration summary;
- photos and CID/packaging traceability;
- disposition and reviewer sign-off.

Never use evidence from one physical card, setup, firmware hash, or run ID as
coverage for another without a written equivalence decision.

## Safety and authorization gates

- Use only inventoried, recoverable Setup B unless another setup is explicitly
  approved.
- Back up configuration/calibration and verify recovery firmware/probe first.
- Evaluation media must be backed up and explicitly released for destructive
  endurance use.
- Destructive format/endurance authority is accepted through the mandatory
  service-code 472 confirmation for the selected card; record the operator and
  confirmation timestamp in the run manifest.
- Whole-controller power interruption during writes requires the approved
  G-PWR scope. Powered SD-card removal/insertion is prohibited.
- Do not run unattended heater operation until the bench safety owner approves
  setpoint, load, shutdown, and monitoring provisions.
- Do not format, repair, or discard a failed card before failure evidence is
  captured and reviewed.

## Completion standard

The initial release gate and this release workpackage are complete when the
final frozen firmware and at least two counted samples from the first candidate
retail family—one on A and one on B—pass their complete assigned accelerated,
restart, power-cut, host-integrity, concurrent-load, and real-time campaigns;
every nonpassing or added sample is dispositioned; no unresolved family or
systemic failure remains; quantitative limits and the first production-card
disposition are signed; and settled behavior is promoted to
`docs/sd-card-endurance-evaluator.md` and the release documentation. After
release, use the reusable retail-card checklist and supply-change procedure for
one-family-at-a-time adaptive two-or-more-sample qualification; each passing
family is added to the approved pool without reopening the byte-identical
firmware release.

## 2026-07-14 execution update

Stage 1 software is complete. Service code 472, SD-thread state machine,
production-path reuse, checkpoint readback, byte-for-byte mirror comparison,
non-correcting media check, controlled stop, and JSON result output are
implemented. The semantic/evaluator/SD regression scripts and isolated clean
Debug and Release builds pass. See
`work/evidence/implementation-and-build-20260714.md` and
`E:/dev/high_point/7520553_SMI_FW/docs/sd-card-endurance-evaluator.md`.

The physical campaign did not start: J-Link 69664082 is attached, but the only
removable device reports RAW, No Media, and zero bytes. No target or card was
mutated. Stages 2–6 remain required and must not be reported as passed from
software/build evidence.

Later connection update: the Release candidate was loaded and verified on the
controller, VEEPROM was preserved byte-for-byte, and the controller reports its
internal SD card READY. The PC reader's No Media state is unrelated. The run is
now gated by physical identification of the installed EDGE/Industrial card and
the required on-screen service-code 472 confirmation. See
`work/evidence/setup-a/controller-candidate-load-20260714.md`.

Corrected-candidate execution update: initial run 06670 stopped at the first
checkpoint because the evaluator's FileX scan workspace was undersized; all
records/mirrors had verified, so it was classified as infrastructure failure,
not card failure. After adding a 512 KiB SDRAM scan workspace and bounded FAT
cluster geometry, run 07949 on the identified SanDisk Industrial 8 GB reference
passed 44,640/44,640 records, all checkpoint A/B/file checks, and all
non-correcting media scans in 2,074.96 seconds with zero FileX/media errors.
See `work/evidence/setup-a/sd-evaluator/07949/manifest.md`. Comparative validity,
host inspection, repeat runs, old-code EDGE reproduction, restart/power-cut
coverage and multi-sample cards remain open.

## 2026-07-16 EDGE campaign update

Under the then-current one-controller assumption, the owner approved a
temporary endurance campaign state on controller A and released the installed
slow/failure-prone SanDisk EDGE 8 GB card for destructive
format/endurance use. Corrected-candidate service-code 472 run 67569 reached
controller terminal state PASS: 44,640 writes, 118,080 mirror-record checks,
1,968 file checks, and zero reported FileX/SDMMC/media-check failures in
1,685.57 seconds. See
`work/evidence/setup-b/sd-evaluator/67569/manifest.md`.

Host A/B comparison, corrected `.RESULT` JSON validation, non-repairing host
filesystem inspection, and exact Setup A restoration remain required. This one
EDGE run does not close the repeat-run, reference discrimination, interruption,
multi-sample, concurrent-load, or workload-based endurance acceptance criteria.

Host content analysis then passed: 744 files per mirror, all 44,640 logical
records valid, exact A/B equality, valid corrected result JSON, and zero
analyzer errors. Non-repairing CHKDSK separately reported one 4,096-byte lost
allocation chain but could not lock the in-use FAT volume and warned of possible
false positives. The dirty bit is clear. The card is preserved without repair;
this unresolved FAT finding prevents treating the EDGE run as final media
approval. See the run manifest and `host-filesystem-check-20260716.md`.

Owner correction: there are two controllers. Run 67569 and all related captures
were produced on Setup A/controller `1751219`, despite the legacy `setup-b`
directory name. Setup B/controller `1751136` remains untouched and receives no
coverage from this run. Finish all controller-A qualification before switching.

## 2026-07-16 autonomous weekend-soak update

Service code 474 now provides a separate non-formatting real-time soak monitor.
It runs without J-Link until operator stop/failure, keeps normal one-minute
production logging and controller operation active, writes hourly SD JSON
checkpoints, latches failures, persists essential status in reserved VEEPROM
spares, and resumes an active run after reset. Static/model tests and isolated
Debug/Release builds pass; the Debug candidate is loaded on controller A with
VEEPROM preserved exactly. A short Industrial-card start/minute-log/stop target
gate remains before unattended use. See
`work/evidence/setup-a/autonomous-soak-implementation-build-load-20260716.md`.

## 2026-07-20 dual-controller qualification update

Engineering candidate 00.04.13 was programmed and verified on both current
controllers. Each booted SD-ready and completed normal mirrored periodic
logging with zero system/SD errors. Service 474 also accumulated a clean
short-duration target run on each controller before the owner stopped it:

- current A / assembly `1751136` / J-Link `69664082`: run `86275`, 5,513
  elapsed seconds, 5,432 completed records, reset count 6, and zero dropped,
  mirror, I/O, or failure counters;
- current B / assembly `1751219` / J-Link `69660123`: run `35709`, 5,240
  elapsed seconds and records, reset count 0, and zero dropped, mirror, I/O,
  or failure counters.

Both final live and persisted records reported state 3 (Stopped), and both CPUs
were running after source-debug detach. This closes the earlier short 474
start/status/stop gate and supplies useful approximately 90-minute evidence on
both controllers. It does not replace the required repeat, interruption,
multi-sample, host-integrity, or long-cadence campaign.

## Owner-directed reconciliation — 2026-09-23

Owner withdrew SD specimen/family qualification and supply-change work; no new card, family, supplier, or production-use approval is granted.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: installed-pair representative regression passed; both physical-card qualifications and broader multi-sample media qualification remain active
> Next Action: review Controller A CASE_PASS and Controller B BOUNDED_STOP_PASS_CASE_TRIGGER_NOT_MET, finish the current pair's matrix and Controller B recovery, then complete both post-campaign scrubs, CID closeouts, and dispositions before retail multi-sample qualification

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
