# Checklist: HPT media 2.0 degraded operation qualification

Status: superseded
Type: checklist
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 011-qualify-degraded-sd-operation-and-logging-integrity; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Authorization Matrix: work/decisions/decision-remaining-qualification-authorization.md

Execution Owner: jong@srv-rpi00.local:~/dev/sd_qualification

This file defines required coverage and expected firmware behavior. Unchecked
items are externally executed campaign requirements, not local tasks. The
remote qualifier publishes their terminal state and evidence through an
immutable result manifest for local release review.

## Powered-removal policy

Powered SD-card removal or insertion is unsupported, expected to damage or
corrupt the card, and prohibited. Do not execute a physical hot-swap case.
Exercise unexpected in-service loss through diagnostic injection. Exercise
replacement by powering the controller off, changing the card, rebooting, and
capturing the new CID/classification.

## Identity and baseline

- [ ] Exact controller/J-Link/firmware hashes are recorded.
- [ ] Service-467/equivalent CID identity block is recorded.
- [ ] CID is repeated after every reboot, initialization, power-off
  reinsertion, or replacement relevant to the result.
- [ ] Baseline HPT lanes, retained range, retirements, error state, normal log,
  graph, readback, and export pass.

## Read-only classification

- [ ] Missing/no response.
- [ ] CID response but representative sector read failure.
- [ ] Blank/readable media requiring HPT initialization.
- [ ] FAT32/readable legacy media requiring HPT initialization.
- [ ] HPT media 1.0 requiring explicit upgrade.
- [ ] HPT media 2.0 ready.
- [ ] Unsupported future HPT version.
- [ ] Corrupt/ambiguous HPT metadata.
- [ ] Write-protected media.
- [ ] Readable degraded/replace-media state.

No classification case may automatically erase or initialize a card.

## Operation failures

The diagnostic hooks and deterministic models for these boundaries pass the
software gate. Leave each case unchecked until its required Controller A/B or
physical evidence is captured.

- [ ] Append data-write failure.
- [ ] Commit-write failure.
- [ ] Segment header/seal failure.
- [ ] Reclaim/next-segment failure.
- [ ] Retirement-snapshot failure.
- [ ] One-lane and two-lane read/write degradation.
- [ ] Full-address scrub isolated and repeated read failures.
- [ ] Retained data gap versus out-of-retention export.
- [ ] USB create/write/flush/close/verify/rename failures.
- [ ] Diagnostic cancellation, timeout, and target/card identity change.

## Required product behavior

- [ ] Chamber control, monitoring, alarms, communications, UI, and USB update
  remain available when SD logging is unavailable.
- [ ] First failure and sector/status are retained.
- [ ] Logging continues where quorum policy permits; otherwise it fails visibly
  without false success.
- [ ] No partial customer export is published.
- [ ] Card state and operator action are specific and stable.
- [ ] Power-off replacement/reboot performs a full bounded classifier and never
  assumes FAT32/FileX mount failure means no card.

## Physical cases after G-PWR

- [x] Non-writing reset witness and data-durable correlation pass.
- [ ] Named HPT interruption boundaries pass on Controller A.
- [ ] Identical frozen image and required cases pass on Controller B.
- [ ] Evidence contains relay timestamps, J-Link state, reset witness, post-boot
  CID, HPT reopen, recovered tail, lane state, errors, and logging resume.

## Owner-directed reconciliation — 2026-09-23

Legacy external-qualifier execution plan superseded by the owner withdrawal of the standalone qualification programme and the current exact-candidate MAP-0009 release plan. Historical unmet tests remain unproven; every applicable current release fault/logging gate remains open in MAP-0009.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: template; external execution not ready pending srv-rpi00.local live-controller gates and exact bundle import
> Next Action: none in this firmware workspace; the Pi qualifier creates the immutable degraded-operation campaign after readiness, bundle, identity, and authorization gates pass

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
