# Checklist: SD card degraded boot and logging qualification

Status: superseded; historical FAT32/FileX qualification checklist
Type: checklist
Updated: 2026-07-24
Next Action: use work/checklists/checklist-hpt-media-2-degraded-operation-qualification.md
Campaign Reason: Historical record from campaign 011-qualify-degraded-sd-operation-and-logging-integrity; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Superseded By: work/checklists/checklist-hpt-media-2-degraded-operation-qualification.md
Parent: work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md

## Test record

| Field | Value |
| --- | --- |
| Tester/date | |
| Target serial / PCB revision | |
| Firmware hash | |
| Probe / recovery image | |
| SD card brand and capacity | |
| CID status / sector-read validity | |
| CID decoded identity: MID/manufacturer, OEM, product/revision, serial, date | |
| Complete raw 128-bit CID | |
| Evidence folder | |

Use `PASS`, `FAIL`, `BLOCKED`, or `N/A` with evidence. Perform destructive
power-cut tests only on an approved recoverable bench target.

Repeat the CID identity block after every qualification reboot and any card
power-off reinsertion, initialization, or replacement. If it is unavailable,
record the detection/driver reason rather than leaving the fields blank.

Powered SD-card removal/insertion is unsupported, expected to damage or corrupt
the card, and prohibited. The historical physical removal rows below are
superseded and must not be executed.

Observed 2026-07-14: one no-card boot reached control/Home, but the prior image
did not warn that logging was unavailable. A later unplanned powered removal
occurred while J-Link still powered the controller. Evidence and containment are
in `work/incidents/incident-sd-hot-removal-after-evaluator-07949.md`. The warning
fix is built but remains an on-target gate.

Supersession note: the original programming hash and Setup A/B routing in this
worksheet predate the current 2026-07-20 bench mapping and July 21 service
469/470 changes. Retain the observations as baseline. For release disposition,
copy this checklist, record the final frozen image hash, and use current
inventories `work/inventories/smi-current-setup-a.md` and
`work/inventories/smi-current-setup-b.md`.

## Static and build gates

- [ ] `script/check-sd-safety.ps1` passes.
- [ ] Clean headless Debug build/package passes.
- [ ] Clean headless Release build/package passes.
- [ ] Exact ELF/SREC SHA-256 hashes are recorded.

## Degraded boot

- [ ] Ten cold boots with no SD card reach normal control and UI.
- [ ] Alarms, monitoring, watchdog, temperature control, door input, USB, and
  communications operate without SD media.
- [x] UI reports no card after Home stabilizes rather than bad format or generic fatal boot (controller 1751219, 2026-07-16).
- [ ] Blank card boots control and is not automatically formatted.
- [ ] Corrupt filesystem boots control and is not automatically repaired/formatted.
- [ ] Full card boots control and preserves existing contents.
- [ ] No-card power-on/off log requests complete within the bounded timeout.

## Normal logging

- [ ] Approved formatted card reaches `SD_CARD_STATE_READY`.
- [ ] FileX fault-tolerant enable succeeds after mount.
- [ ] Generate 15 periodic and at least 10 event records with known timestamps.
- [ ] Mirror A and B contain every expected record in order with valid framing.
- [ ] `gSdLogRecordsDropped`, mirror failure counters, and I/O failures remain zero.
- [ ] Reboot and repeat; existing hourly files append rather than overwrite.
- [ ] PC filesystem check reports no FAT/directory errors.

## Queue and contention

- [ ] Generate an event burst while periodic logging is due.
- [ ] Exercise chart loading and USB export while logging continues.
- [ ] Record ordering is preserved; any queue overflow is counted and visible.
- [ ] Control-loop timing and watchdog service remain within limits.

## Media loss and power-off replacement

- [x] Physical powered removal/reinsertion cases are `N/A` and prohibited.
- [ ] Inject media loss while idle, during write/flush, chart load, and export.
- [ ] Each injected failure produces one bounded state transition without a
  reset/hang, and control continues.
- [ ] Power off, replace or reinsert the card, reboot, and repeat CID/media
  classification without automatic format.
- [ ] Subsequent records are valid and prior records remain readable when the
  same healthy card is reinstalled while power is off.

## Capacity and injected failures

- [ ] Card-full write is reported; success is not claimed.
- [ ] Inject directory, create/open, write, close, flush, and SDMMC timeout failures.
- [ ] Close is never called for a file that did not open.
- [ ] First failure and failed mirror are preserved in diagnostics.
- [ ] A single good mirror is reported as degraded redundancy.
- [ ] Two failed mirrors transition media to I/O error and drop later requests visibly.
- [ ] Format failure at every phase stops immediately and never reports success.

## Power interruption and filesystem integrity

- [ ] Image the baseline card before destructive testing.
- [ ] Interrupt power during directory creation, file creation, record write, close,
  flush, and fault-tolerant metadata commit.
- [ ] Run at least the agreed number of repetitions per phase: ______.
- [ ] After each cut, boot control with and without the card.
- [ ] After power-off reinstall/reboot, inspect fault-tolerant recovery, both
  mirrors, and filesystem.
- [ ] No unexplained filesystem corruption or silent record gap remains.
- [ ] Any bounded lost-record window is measured and approved.

## Soak and closeout

- [ ] Run normal logging for at least 24 hours using two approved card models.
- [ ] Include periodic events, chart reads, and USB exports during the soak.
- [ ] Compare expected sequence with mirror A/B and run PC filesystem checks.
- [ ] Repeat normal control smoke tests after all fault testing.
- [ ] Restore production firmware/configuration and programmer-verify the target.
- [ ] Link evidence and failures from the parent workpackage.
- [ ] Firmware, hardware, and release reviewers sign off.

Overall result: `PASS / FAIL / BLOCKED`

Open failures or accepted limitations:

1. ___________________________________________________________________________
2. ___________________________________________________________________________
3. ___________________________________________________________________________
