# Checklist: SD card accelerated endurance evaluator

Status: superseded; historical FAT32/FileX service-472 checklist
Type: checklist
Updated: 2026-07-24
Next Action: use work/checklists/checklist-hpt-media-2-autonomous-retail-card-qualification.md
Campaign Reason: Historical record from campaign 015-qualify-intended-retail-sd-breadth-and-approved-pool; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Superseded By: work/checklists/checklist-hpt-media-2-autonomous-retail-card-qualification.md
Parent: work/wp/active/wp-sd-card-accelerated-endurance-evaluator-and-media-qualification.md

Use `PASS`, `FAIL`, `BLOCKED`, or `N/A` with an evidence link for every item.
One checklist instance covers one physical card, firmware hash, setup, and run
profile. Copy it for every run; never overwrite a prior result.

## Run identity

| Field | Value |
| --- | --- |
| Run ID | |
| Tester/date/time/timezone | |
| Setup A/B and asset serial | |
| Controller/display/I/O PCB revisions | |
| Firmware version and ELF/SREC SHA-256 | |
| Evaluator revision/profile hash | |
| Card role: failure/working/candidate | |
| Brand/family/capacity/exact MPN | |
| Physical sample ID and CSD | |
| CID status / sector-read validity | |
| CID decoded identity: MID/manufacturer, OEM, product/revision, serial, date | |
| Complete raw 128-bit CID | |
| Supplier/PO/lot/packaging evidence | |
| Filesystem/FAT/allocation unit | |
| Start free bytes | |
| Evidence directory | |

## Authority and recovery gate

- [ ] Setup inventory and recovery baseline are complete.
- [ ] Configuration/calibration backups and hashes are recorded.
- [ ] Known-good recovery firmware and probe path are verified.
- [ ] This physical card is approved for endurance writes.
- [ ] Existing card contents are imaged/backed up, or the operator explicitly
  accepts that they are disposable and will be permanently lost.
- [ ] Heater/load/shutdown provisions are approved for attended operation.
- [ ] Whole-controller power-cut authority is separately recorded if
  applicable. Powered SD-card removal/insertion is prohibited.
- [ ] No repair, correction, or implicit format occurs before confirmation.

## Evidence preservation

- [ ] Front, back, packaging, and installed-media photos are stored.
- [ ] Service-467 or equivalent read-only CID evidence captures status,
  CID/sector-read validity, every decoded identity field, and the complete raw
  CID. If unavailable, the detection/driver reason is recorded.
- [ ] CID evidence is repeated after any card replacement, power-off reinsertion,
  initialization, or reboot material to the run result.
- [ ] Pre-test host directory listing and file hashes are stored.
- [ ] Pre-test non-correcting host filesystem check is stored.
- [ ] Sector image and SHA-256 are stored when authorized/required.
- [ ] Failure-prone and working reference evidence records are linked.

## Static and build gate

- [x] Service code 472 is unique and Factory/Engineering protected.
- [ ] First confirmation identifies the card and destructive workload.
- [x] Final confirmation states `ALL DATA ON THE SD CARD WILL BE PERMANENTLY LOST`.
- [ ] Cancel is verified to perform zero media mutation.
- [x] Erase/Start reuses the reviewed service-code 471 format implementation.
- [x] Endurance starts only after the reviewed format path reports success.
- [x] Format failure latches failure and never reports an endurance pass.
- [x] Status and controlled stop are reachable while the run is active.
- [x] No insertion/mount/error/retry path can reach format without service-code consent.
- [x] Evaluator runs in the SD thread and yields after bounded work slices.
- [x] Production periodic/event queue retains priority.
- [x] Unique run namespace prevents collision with production logs/prior runs after the confirmed format.
- [x] `S_LogRecord` size and deployed production format are unchanged.
- [x] Static evaluator regression script passes.
- [x] Host state-machine/record-validation tests pass (`script/test-sd-evaluator-model.ps1`, 10/10).
- [x] Debug and Release builds pass; artifact hashes are recorded in `work/evidence/implementation-and-build-20260714.md`.

## Profile confirmation

- [ ] Target is 44,640 logical one-minute records over 31 simulated days.
- [ ] Expected shape is 744 hourly files and 44,640 records per mirror.
- [ ] Expected total record payload is 5,713,920 bytes for A+B.
- [ ] Checkpoints are configured at 1,440, 2,880, 10,080, and 44,640 records.
- [ ] Evaluator run ID/test directories are empty before start.
- [ ] Checkpoint policy is `scan each checkpoint / final-only production-equivalent`.

## Concurrent operation

- [ ] Temperature control remains active at the approved safe setpoint.
- [ ] UI heartbeat/navigation is exercised throughout the run.
- [ ] Communications and current-output heartbeats are recorded.
- [ ] Door/alarm transitions and event bursts are generated.
- [ ] Production minute records continue during the evaluator.
- [ ] Chart loads are requested during active evaluator writes.
- [ ] USB export is requested during active evaluator writes.
- [ ] NVRAM/configuration save activity is exercised.
- [ ] Watchdog resets and control/PID deadline misses remain zero.

## One-day checkpoint — 1,440 records

- [ ] Exact A/B file count and size pass.
- [ ] Record framing, timestamp, sequence, and complement pass.
- [ ] A/B byte comparison passes.
- [ ] Non-correcting FileX media check reports zero errors.
- [ ] Free-space delta and latency/counter snapshot are captured.
- [ ] No production-service regression is observed.

## Two-day fast-reproduction checkpoint — 2,880 records

- [ ] Exact A/B file count and size pass.
- [ ] Record and mirror integrity pass.
- [ ] Non-correcting FileX media check reports zero errors.
- [ ] Failure-prone EDGE behavior is recorded without repair if corruption occurs.
- [ ] First failed operation/status/sequence and equivalent age are preserved.
- [ ] Working/candidate media continue only under the approved profile.

## Seven-day checkpoint — 10,080 records

- [ ] Exact A/B file count and size pass.
- [ ] Record and mirror integrity pass.
- [ ] Non-correcting FileX media check reports zero errors.
- [ ] Free-space, timing distribution, queue, and control snapshots are captured.
- [ ] Approved warm restart resumes after the last committed sequence.

## Month checkpoint — 44,640 records

- [ ] Exactly 44,640 valid records exist in each mirror.
- [ ] Exactly 744 expected hourly files exist in each mirror.
- [ ] No missing, duplicate, out-of-order, malformed, or partial record exists.
- [ ] Mirror A and B are byte-identical.
- [ ] All FileX/SDMMC and filesystem-error counters remain zero.
- [ ] Final physical probe and non-correcting FileX media check pass.
- [ ] Final free-space delta is explained.
- [ ] Wall time, simulated time, and acceleration ratio are recorded.
- [ ] Worst and distribution-ready timing counters are exported.

## Stop, restart, and recovery

- [ ] Controlled stop completes the active durability boundary then stops.
- [ ] Stopped results/counters remain readable and files remain intact.
- [ ] Warm restart discovers the prior run without overwriting it.
- [ ] Resume, when enabled, starts at the next committed sequence.
- [ ] Approved power-cut cases preserve the measured loss window.
- [ ] FileX recovery and both mirrors are inspected after every interruption.
- [ ] Control boots with the card removed or failed.

## Host closeout

- [ ] Card is removed only after evaluator completion/controlled stop and flush.
- [ ] Host filesystem check is run without correction first.
- [ ] FAT, directory, lost-cluster, file-size, block, and sector results are stored.
- [ ] Full directory listing, file sizes, and hashes are stored.
- [ ] A/B records are independently parsed and compared on the host.
- [ ] Failed media is preserved before any repair or format.
- [ ] Controller and host conclusions agree or the discrepancy is ticketed.

## Comparative validity and firmware decision

- [ ] Old code plus EDGE reproduces the historical failure.
- [ ] Old code plus Industrial passes the approved reference profile.
- [ ] If reference discrimination fails, evaluator qualification is marked FAIL.
- [ ] Current/final firmware plus EDGE passes three consecutive month profiles.
- [ ] Current/final firmware plus Industrial passes three consecutive profiles.
- [ ] Both physical samples of each candidate model complete the approved matrix.
- [ ] The required workload-based endurance profile passes per required card role/model.
- [ ] Quantitative latency/control limits have owner sign-off.
- [ ] Production card, filesystem format, and firmware disposition are approved.

Overall result: `PASS / FAIL / BLOCKED`

First failure or limiting metric:

______________________________________________________________________________

Open failures/accepted limitations and ticket links:

1. ___________________________________________________________________________
2. ___________________________________________________________________________
3. ___________________________________________________________________________

Firmware reviewer: ____________________  Date: __________

Hardware/test reviewer: _______________  Date: __________

Release owner: ________________________  Date: __________
