# ADR: Commodity retail SD media policy

Status: accepted
Type: adr
Updated: 2026-08-02
Next Action: this firmware workspace completes the local HPT adoption and immutable candidate bundle; minimum-geometry A/B qualification waits for the gated srv-rpi00.local qualifier and returns through a reviewed result manifest
Parent: work/wp/completed/wp-hpt-embedded-log-store-v0-4-0-renesas-integration.md
Supersedes:
Superseded By:

## Context

The product is being redesigned to reduce cost and preserve media availability.
Industrial SD cards are disproportionately expensive and are becoming difficult
to source consistently in the required 2 GB through 32 GB range. The normal
workload is only one 64-byte reading per minute, and the customer-facing
retention requirement is 90 days rather than decades of accessible history.

Raw NAND write endurance is therefore not the dominant constraint. Power-loss
behavior, controller quality, temperature, contacts, silent substitution, and
detectable recovery are more important. The firmware must provide integrity
without assuming industrial-card-only power-loss protection, health telemetry,
or vendor-specific commands.

## Decision

Execution is deliberately split: this firmware workspace owns implementation,
candidate artifacts, and release acceptance; the separate
`jong@srv-rpi00.local:~/dev/sd_qualification` workspace owns physical media
campaigns after its readiness gates pass. The HPT Lab Power Control service is
a separate gated dependency, and the operator owns card handling with
controller power off. This ADR defines policy and acceptance intent; it does
not make the external qualifier ready or assign its campaigns to this
workspace.

Commodity retail SD media is the product default. Industrial rating is optional
and must not be a firmware, service, or procurement requirement.

Normative rules:

- The firmware shall operate with standards-compliant retail SD media in the
  supported 2 GB through 32 GB range. Prefer broadly available 8 GB through
  32 GB cards when legacy 2 GB/4 GB supply is poor.
- The storage design shall not depend on industrial-only power-fail protection,
  proprietary bad-block maps, health telemetry, fixed NAND type, or a single
  manufacturer/controller implementation.
- Media shall be treated as replaceable consumable storage. SD failure may
  degrade history but shall not stop control, monitoring, alarms, UI, USB, or
  communications.
- HPT shall detect corruption and I/O failure, retain the first storage error,
  reject incomplete records, and never report a partial export as complete.
- The retention design shall guarantee at least 90 days of minute records plus
  an approved event reserve. Excess capacity is margin, not a promise to retain
  all records for the card's lifetime.
- Procurement may multi-source retail cards. Each candidate model/capacity and
  material substitution must pass the bounded controller A/B compatibility,
  reset, removal, and authorized interruption screen before approval.
- Qualification shall include at least two retail product families and more
  than one physical sample when practical. Evidence applies to the tested
  cards; it is not a universal retail-card lifetime claim.
- Reused or unknown-history cards are allowed for development and destructive
  qualification, but not as new-production lifetime evidence.
- The service documentation shall provide visible failure indication, card
  replacement, and recovery instructions. No individual removable card is
  guaranteed to last the full equipment life.

## Consequences

Positive:

- Lower production and service-part cost.
- Better multi-source availability in common capacities.
- Avoids coupling the product to shrinking industrial low-capacity offerings.
- The minute-log write volume remains modest for ordinary managed NAND.

Negative:

- Retail components and controllers may change under the same commercial name.
- Power-loss behavior and internal recovery are less predictable.
- Environmental ratings, endurance documentation, and lifecycle support may be
  weaker than industrial products.
- Qualification must emphasize firmware recovery, multiple samples, visible
  degradation, and easy replacement.

## Alternatives Considered

- Require industrial pSLC SD cards: rejected as the default because of cost and
  declining availability; still allowed as an optional customer choice.
- Approve one exact retail part forever: rejected because it conflicts with the
  availability objective and retail bill-of-material substitutions are common.
- Depend only on the SD controller's internal recovery: rejected because the
  behavior is opaque and cannot satisfy the product integrity contract alone.

## Supersession Notes

This establishes the initial durable media-sourcing policy; it does not
supersede an earlier ADR.
