# Project Executive Intent: SMI Firmware

Status: active
Type: decision
Role: project-executive-intent-v1
Updated: 2026-09-23

## A normal forward and accepted ordinary return completed — 2026-09-23

Controller A completed exact DisplayTest 01-01 to accepted SMI 00-05-01 normal installation, explicit HPT2 initialization, fresh logging/history, six-row healthy customer USB export with independent CSV hash/content check, and post-restart HPT2 retention. Its ordinary SMI-to-DisplayTest return selected exact `7520708_DispTest_FW_01-01.imx`, accepted the conditional FAT32 warning, and yielded a complete four-MiB readback matching the controlled DisplayTest payload SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. A is FAT32-ready with the unchanged complete CID `05000C61736466672200001C8901A34F`; focused SD read/write passed. The first DisplayTest NVRAM screen showed Read Error / Not Tested. After an owner-operated restart, both displayed statuses and read-only target flags were OK/OK, with CID/FAT32 unchanged. The owner accepts a power cycle after new firmware installation and requests no mitigation. No Erase EEPROM service or firmware change was performed. The owner also confirmed post-return About 01-01, responsive Home touch and no FAT32 warning. Evidence: `work/evidence/smi-a-hpt2-post-restart-retention-20260923.json`, `work/evidence/smi-a-customer-export-20260923.json`, `work/evidence/smi-a-ordinary-displaytest-return-nvram-hold-20260923.json`, `work/evidence/smi-a-displaytest-nvram-restart-resolution-20260923.json`, and the SMI handoff ledger.

The A forward and ordinary return path passes with the accepted post-install power-cycle behavior. A below-floor refusal, representative service rollback and fault/recovery tests, plus B forward/return and remaining release evidence, are open. The DisplayTest SD Qualification Full Run was not performed or claimed. Earlier dated NVRAM-hold sections below record the resolved first-boot observation.

## A ordinary DisplayTest return has an NVRAM hold — 2026-09-23

The owner selected exact `7520708_DispTest_FW_01-01.imx` through the ordinary SMI Settings updater, confirmed the conditional FAT32 data-loss warning, and reported Update Success. A read-only full-flash capture matches the controlled DisplayTest 01-01 payload SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. A is FAT32-ready with valid unchanged CID `05000C61736466672200001C8901A34F`, no storage error, and a focused SD read/write PASS. The owner then supplied a photo of the DisplayTest NVRAM screen: “NVRAM Status: Read Error” and “Test Status: Not Tested.” Read-only target flags confirm invalid NVRAM and no completed power test. Evidence: `work/evidence/smi-a-ordinary-displaytest-return-nvram-hold-20260923.json` and the handoff ledger.

The matched sources show SMI writes 1,028-byte SPI NVRAM records, whereas DisplayTest 01-01 reads/writes 1,024-byte records with a different CRC position. A first-boot format mismatch is plausible, but SPI/hardware failure remains possible. DisplayTest only updates the validity flag on boot and periodically writes its own format. The owner proposed Service > Erase EEPROM; that service zeros configuration data flash, not SPI NVRAM, so it has not been run. A separately authorized DisplayTest restart is the focused discriminator. The ordinary A return image and FAT32 transition passed, but end-to-end return qualification is held pending NVRAM resolution and operator-facing checks. A refusal/rollback/recovery and B remain open. Earlier return-pending sections below are history.

## A HPT2 post-restart retention verified — 2026-09-23

The owner explicitly approved an A power-off/restart with the SD card installed and USB absent. A matched-SMI 10:33 baseline showed HPT2 ready, same complete CID `05000C61736466672200001C8901A34F`, retained oldest normal record sequence 2, live chart data and no pending update/export. The owner reported A booted 00-05-01 with pre-restart history visible. Fresh 10:35 read-only state found the same valid CID and representative-sector read, HPT2 ready, completed chart cache, retained oldest record sequence 2 / HPT timestamp 306930000, and 16 selected records in the postboot chart rebuild. New queued logging resumed with two completions and no drops since boot. Preboot cumulative counters reset on boot and are not compared directly. Evidence: `work/evidence/smi-a-hpt2-post-restart-retention-20260923.json` and the handoff ledger.

The A normal forward installation, HPT2 initialization, fresh logging/history, customer USB export with host CSV validation, and focused post-restart retention gates have passed. The USB CSV copy is preserved under SMI evidence; the drive is unmounted at the Pi. Next is the controlled ordinary A return to DisplayTest 01-01 with explicit FAT32 media preparation and fresh CID/status checks. A refusal/rollback/fault matrix and B remain open. No SD Qualification Full Run pass is claimed. Earlier dated retention-pending sections below are history.

## A customer HPT2 export and independent CSV check passed — 2026-09-23

On A, ordinary History/Graph showed recent records. The first Settings > Export Log attempt was rejected as “Range too short” before an export request. The owner retried the 10:20–10:26 controller-clock range and reported Success. Matched-SMI read-only status shows request 1 published, complete 1, USB status 0, final USB phase complete, six healthy records selected with no gaps, and no active export. The `IMX2` USB drive was mounted read-only on `srv-rpi00.local`: the 975-byte CSV contains six 10:21–10:26 minute rows and a COMPLETE footer matching target status. Its local evidence copy has the same SHA-256 `28C0D6E2005F868B76BC2EB77219DE67CC894E57B42354996D605E85FA8A041A`; the drive was unmounted cleanly. The A baseline and post-format result link the unchanged complete CID `05000C61736466672200001C8901A34F`. Evidence: `work/evidence/smi-a-customer-export-20260923.json`, `work/evidence/smi-a-customer-export-20260923.csv`, and `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

This closes A's normal fresh logging, history view and customer export/content gate. The next A test is post-restart HPT2 retention, which requires separate owner authority for a controller power operation. Then A return/refusal/rollback/fault recovery and B transition gates remain. No SD Qualification Full Run pass is claimed. Earlier dated export-pending sections below are history.

## A HPT2 ready and fresh logging verified — 2026-09-23

The owner reported SMI Format 2 **Success / log records erased**. A read-only matched-SMI capture found initialization complete, HPT2 ready, valid representative-sector read, and the unchanged complete CID `05000C61736466672200001C8901A34F`. Subsequent A captures showed acknowledged records rising from the one commissioning record to four, valid retained bounds, completed initial chart load, and live chart real data. The owner confirmed recent records are visible in the normal History/Graph view. The cumulative dropped-log count was five at 10:24 PDT; its timing is not established and remains an observation for follow-up. Evidence: `work/evidence/smi-a-post-forward-hpt2-initialization-20260923.json` and `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

This closes A's explicit HPT2 initialization and fresh logging/history view after the verified normal forward installation. Customer USB export/content validation, post-restart retention, return/refusal/rollback, fault/recovery and B remain open. The SD Qualification Full Run has not been performed or claimed. Earlier dated format-pending sections below are history.

## A normal DisplayTest-to-SMI forward transition verified — 2026-09-23

The owner completed the native DisplayTest FAT32 format and SD read/write, confirmed responsive Home touch after the affected sequence, and entered Prep for Ship/Lockout. Read-only A state confirmed FAT32 handoff PASS, unchanged valid CID `05000C61736466672200001C8901A34F` and USB ready. `IMX2` on-drive SMI 00-05-01 and DisplayTest 01-01 files were independently hash-verified on a Pi read-only mount; the drive returned to A.

The owner selected `7520553_SMI_00_05_01.imx` through Lockout > Install Software and reported Success. A read-only complete four-MiB internal-flash capture has SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`, exactly matching the accepted SMI Release candidate and controlled IMX main payload. Matched SMI RAM state has A assembly 1751136, same valid CID, representative-sector read valid, FAT32 needs Format 2, no initialization request and no update request. The owner confirmed 00-05-01 Home/About and the expected Format 2 warning. This closes the A forward installation gate, not the separate HPT2, return, refusal, rollback, fault, retention or B gates. Structured evidence: `work/evidence/smi-a-normal-fixture-install-20260923.json` and handoff ledger `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

The owner declared the card history expendable and continued the reviewed sequence. The operator has been instructed to use SMI's explicit two-stage Format 2 warning/service-471 flow and report its terminal result. No initialization pass is inferred before that result and a fresh CID/status capture. Older dated pause/missing-image/format-pending paragraphs below are historical.

## A transition execution checkpoint — 2026-09-23

The owner declared the retained HPT2 history expendable, reviewed the concrete sequence and said to continue. A FAT32 preparation and the normal SMI installation are authorized within that sequence, subject to their verification stops. The owner reports `IMX2` at A and can use A's touchscreen. SMI can read the J-Link state but has no approved touchscreen control path; the operator was given the native `System Test → SD Card Test → Format SD as FAT32?` step with its left confirmation.

Read-only A baseline at 09:48 PDT reconfirmed exact DisplayTest 01-01, assembly 1751136, serial 69664082, unchanged valid CID `05000C61736466672200001C8901A34F`, ready HPT2, cached valid sector approval, and idle update/format/SDQ request flags. Another read-only capture at 09:55 PDT showed card state 2 (HPT2), format request 0 and format result 0. Thus no format completion can be claimed. The SD read/write result field of 2 is pre-existing/stale; no such test was requested in this SMI execution. No install or power operation occurred. Raw captures: `work/evidence/generated/smi-displaytest-takeover-20260923-094826/` and `...-095550/`.

On reported format completion, capture fresh CID, protocol/card state, CID validity, representative-sector evidence and format status. Stop on CID change or failure. Then run only the affected FAT32 SD read/write–Home touch sequence, verify fresh FAT32 Lockout handoff, and check exact SMI IMX bytes on `IMX2` before the normal installation. The A/B release matrix remains open. `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md` is the SMI evidence ledger; prior handoff and paused statements below remain history.

## Current handoff reconciliation — 2026-09-23 09:27 PDT release

Coordination is resumed from SMI; live takeover is verified, with card-data disposition and explicit hardware-action authority still pending. DisplayTest released A with no pending operation, running 01-01 on assembly 1751136 / probe 69664082 with retained HPT2 CID `05000C61736466672200001C8901A34F`. Its controller-generated IMX, source `da955dc92a1652eba247f07b32d154b4b7001e02`, is now controlled at SHA-256 `E11CEB483BA478F6A3D98F75DBF303EA09800165463EFE17880D5CDB2ACD78AB`; local hashing matched it and the accepted SMI IMX. The missing-image prerequisite is complete.

Credit existing SMI candidate/UI/export and resolved updater evidence, plus DisplayTest HPT2 startup, export, scoped navigation and Card Identity; do not replay them. Full SD Qualification was not run and is not required merely for this transition. The affected SD read/write–then-Home touch sequence and verified FAT32 production handoff remain open.

Live read-only takeover succeeded at 09:40–09:41 PDT after the earlier DNS failure. Serial-bound A / assembly 1751136 / probe 69664082 has exact DisplayTest 01-01 main-flash SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. HPT2 is ready, driver CID valid, raw CID unchanged, cached sector-zero approval valid, and captured update/format/SD-test/SDQ request flags idle; FAT32 handoff remains NONE. See `work/evidence/smi-displaytest-live-takeover-20260923.json`. No halt/go/reset/program/power/format command was issued; J-Link initialization reported a low-power wake. The smallest open SMI-owned test is A's ordinary DisplayTest 01-01 → accepted SMI 00-05-01 installation through verified FAT32 fixture handoff. The retained HPT2 card first needs a recorded preservation/archive or expendable-data decision and explicit erase consent; an IMX export does not preserve SD history. After authorization, minimal FAT32 preparation and the focused affected touch check can supply that prerequisite without Full Run. Programming, power operations and formatting are not authorized by this handoff or reconciliation.

Remaining exact-candidate A/B forward/return, refusal/renamed-file, representative rollback, fault/recovery, initialization, logging/history/export and retention gates remain open. Earlier dated pause/missing-image statements below are history superseded by this capsule; prior owner-abandoned commitments remain abandoned. Evidence and the concrete next-step sequence: `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

## North Star

Deliver dependable SMI oven firmware that keeps control, monitoring, and alarms operating through storage faults, and releases only behavior proven on both controller assemblies.

## Current Completion Horizon

Complete the SMI 00-05-01 and DisplayTest 01-01 or later transition through an evidence-backed release decision. "Done" requires the return path, the ordinary personality update floor, direct service rollback to any valid SMI image, explicit in-place FAT32 or HPT2 card preparation as applicable, and forward, return, refusal, and rollback tests on both assemblies. A passing build alone does not close this horizon.

## Strategic Context

The SMI 00-05-00 development line introduced HPT2 logging, but lacks the proposed ordinary-update downgrade guard and was never deployed on a production controller. Production DisplayTest hands off FAT32 media, while SMI prepares HPT2 media explicitly. A rare recovery may need direct installation of older SMI firmware; the installed SD card is not field accessible for replacement, so FAT32-era rollback requires a controlled in-place format. Service 471 can explicitly reinitialize HPT2 if current SMI remains bootable after a pre-flash failure. Internal-flash failure risk applies to upgrades and downgrades. Firmware candidate identity and exact-byte release controls are established; the full HPT2 claim and SD-card family qualification have separate evidence gates.

The SMI ordinary updater owns the 00-05-01 personality floor while HPT2 media may remain installed. The DisplayTest 01-01 return floor is distinct: revised DisplayTest must tolerate HPT2 on startup and verify FAT32 before its normal production test or personality install. Its own fixture-to-fixture floor is 01-01, and it may install a valid older SMI after FAT32 handoff. Read-only DisplayTest source and Controller B records support that path, but do not close the SMI two-controller transition gate.

## Current Priorities

- Treat all SMI candidates before `00.05.01-1bf8afe6aeba-6476100e5ae5` as superseded for current qualification.
- Preserve accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5`, frozen from commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`, and controller-generated image `7520553_SMI_00_05_01.imx` with SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`. Its updater retains verified FAT32, formats another readable layout only for a FAT32 target after consent, refuses missing or unreadable required media, and disables the main chart whenever logging is unavailable.
- Resume SMI coordination with both exact IMX identities available. Live read-only A takeover is verified; settle retained HPT2 data disposition and explicit action authority, then qualify A's verified-FAT32 DisplayTest-to-SMI forward path. The earlier internal-flash handoff defect remains resolved.
- Exclude SMI 00-05-00 from target qualification. Its below-floor behavior is covered by focused host policy tests; it is not a production-controller baseline or bridge.
- Complete the A-first/B-second forward, return, refusal, controlled rollback, HPT2 initialization, logging, retention and export matrix under explicit hardware-action authority; make the later release decision from exact candidate evidence.
- Keep CVO and DVO outside this project and do not alter DVO.

## Deliberate Non-Goals

- On 2026-09-23 the owner abandoned the temperature-control recovery and RTD-interlock successor campaigns, standalone SD Qualifier and independent physical-media validator delivery, SD specimen/family approval and supply-change closeout, and Tool Shed defect tickets TKT-0035/TKT-0036. These are no longer local execution commitments. Existing evidence, accepted limitations, and unresolved technical risks remain recorded in `docs/project-work-disposition-20260923.md`; abandonment is not qualification or defect resolution.
- No unconfirmed SD-card conversion or erase, and no field SD-card swap as an update or rollback workflow.
- No claim that the update Title authenticates its publisher.
- No automatic CVO/DVO release, SD-family approval, ECO, or customer rollout from the SMI transition result.

## Decisions Needed

- Retained-card history is expendable. A FAT32 format, affected read/write–Home touch check, fixture handoff and exact SMI 00-05-01 normal installation passed. Await explicit HPT2 initialization result and post-format CID/status capture.
- The owner reviewed the sequence and said to continue; native A-side format and ordinary SMI installation are in scope. Any power or expanded recovery action remains separate.
- Close the remaining DisplayTest touch/FAT32 handoff and exact-candidate A/B gates before a separate release decision.

## Review Triggers

- A DisplayTest 01-01 or later candidate is qualified for safe HPT2 startup and FAT32 handoff.
- Controller A visual boot or storage evidence contradicts the read-only target capture.
- Either assembly produces contradictory transition evidence.
- The in-place FAT32 preparation or service-471 recovery path produces contradictory evidence.
- An exact candidate reaches release qualification.
- The SD qualification or supply-change scope changes.

## 2026-09-22 requirements and evidence update

Controller A accepted and staged the prior SMI 00-05-01 IMX, with exact QSPI main SHA-256 `7F49E615FF971D1C63E44CF94B8DCD9BF919DA7846E052408189997A58B78B8E`, but internal flash remained at SHA-256 `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407`. The owner added a target-driven FAT32 rule and disabled-chart rule. The revised source passes focused checks and canonical Debug/Release builds; Release S-record SHA-256 is `4E7DFB2F7333202C71A736DF6692512030DB43508A1CCD0C556E7E8C1EB6B326`. It is not frozen or target-qualified. No controller or SD mutation occurred during this requirements detour.

## 2026-09-23 reconciliation

The 2026-09-22 internal-flash failure was diagnosed and corrected by watchdog, FCU command-lock, and ROM-cache changes. A controlled self update completed with diagnostic error `0` and exact four-MiB flash readback. Accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` has Release S-record SHA-256 `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`; Controller A exact readback SHA-256 is `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the Format 2 startup and disabled-chart UI behavior. Service 150 then generated the final SMI IMX with SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, valid CRCs, and an exact main-payload match. The remaining current prerequisites are the controlled DisplayTest 01-01 IMX and the paused A/B transition, refusal, rollback, and fault matrix. No release decision has been made.
