# Incident: powered SD removal after evaluator run 07949

Status: contained; historical FileX incident, HPT criteria transferred
Type: incident
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 011-qualify-degraded-sd-operation-and-logging-integrity; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md

## Impact

After evaluator run 07949 had completed and the controller had subsequently
rebooted into normal production operation, the SanDisk Industrial 8 GB card was
removed while the controller was still powered through J-Link. The operator did
not notice the controller remained powered until the card had already been
inserted into the PC.

The controller had also been powered without a card and correctly reached the
Home/control screen, but it did not display a missing-card warning. Control
availability therefore passed this observation; logging-loss visibility failed.

## Evidence and classification

- Run 07949 had already reported `PASSED` on-controller before this event.
- The PC copy contains 744 hourly files per mirror and all 44,640 logical
  records. Independent parsing found zero record errors and exact A/B equality.
- Source and preserved-copy SHA-256 manifests are identical.
- Read-only CHKDSK found one lost chain occupying one 4,096-byte cluster. It did
  not repair the volume.
- Because removal occurred while normal logging could be creating, closing, or
  flushing a file, the lost chain cannot be attributed to the evaluator run.
- The card remains mounted at `I:` only for preservation; no repair or format is
  authorized or required for this incident record.

Primary evidence is under
`work/evidence/setup-a/sd-evaluator/07949/`, including `host-analysis.txt`,
`host-analysis-live.txt`, both hash manifests, and `chkdsk-readonly.txt`.

## Recovery

No filesystem recovery was attempted. The complete readable dataset was copied
to `card-files/` before interpretation. The firmware now delays a one-shot
missing-card warning until Home has stabilized and re-arms the warning only
after media reaches `READY`; target verification is still required.

## Prevention and follow-up

- Show a clear warning that logging and chart history are unavailable while
  control remains active.
- Treat J-Link power as live controller power during all media handling.
- Remove SD media only after following the equipment power-down/service
  procedure unless the test is an explicitly authorized hot-removal case.
- Reproduce removal at defined FileX boundaries using backed-up expendable
  media, with before/after images and non-correcting checks.
- Do not use the single lost chain as proof of evaluator-caused corruption.

## Owner-directed reconciliation — 2026-09-23

Historical powered-removal incident remains contained evidence. Its transferred legacy qualification programme has been withdrawn; the powered SD removal prohibition remains fully in force, and no full root-cause or qualification pass is claimed.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: contained; historical FileX incident, HPT criteria transferred
> Next Action: use the HPT degraded-operation and G-PWR checklists for current qualification

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
