# SD card degraded boot and logging integrity Workpackage

Status: superseded
Type: workpackage
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 011-qualify-degraded-sd-operation-and-logging-integrity; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Canonical Truth: E:/dev/high_point/7520553_SMI_FW/docs/sd-card-operation-and-recovery.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## 2026-08-02 Workspace Ownership and Readiness Gate

Firmware implementation, host/model/static/build gates, and historical target
baselines remain owned here. Every new test that executes on Controllers A/B,
including normal baseline, power-off replacement/reboot, injected media-loss,
G-PWR interruption, calibration preservation, post-campaign scrub, and
multi-card cases, is externally coordinated qualification. It belongs to
`jong@srv-rpi00.local:~/dev/sd_qualification`, not to this repository.

The remote lane is **NOT READY for physical execution** until the qualifier's
standalone foundation, live-controller adapter, authorized read-only A/B
identity, stop/recovery, and evidence-path gates pass. Application health in
fixture-only mode is not execution readiness and is not authorization.

Responsibilities:

- This workspace: exact candidate, managed artifacts/hashes, firmware hooks,
  diagnostics, expected outcomes, safety boundaries, immutable bundle
  publication, and returned-result review.
- Pi qualifier: import the bundle, create immutable controller-test/campaign
  instances, program/verify/reset when authorized, execute and monitor the
  cases, collect generated evidence, attribute failures, and
  publish the reviewed result manifest.
- HPT Lab Power service: supply only its qualified API/client and operation
  results for authorized G-PWR cases.
- Operator: physical card handling with controller power off, irreducible
  observations, and required authorizations.

The implementation and hardware matrices below remain acceptance requirements.
Unchecked physical items do not become local execution tasks. Powered SD-card
removal/insertion remains prohibited.

## Goal

Planning update (2026-07-24): use
`work/checklists/checklist-hpt-media-2-degraded-operation-qualification.md` for
current HPT work. Software/model injection hooks, export-domain reasons, and the
bounded full-address scrub passed the software/build gate; target execution and
evidence remain. Physical
interruption cases require `G-PWR` from
`work/runbooks/runbook-autonomous-hpt-sd-qualification.md`; the older FileX
checklist is historical regression knowledge only.

An absent, unreadable, unexpectedly lost, exhausted, or failing SD card must never prevent the
SMI controller, monitoring, alarms, UI, or communications from booting and
operating. Normal HPT media 2.0 data logging must use a deterministic media
lifecycle, report every failed durability boundary, recover cleanly after
power-off card replacement and reboot, and withstand the approved power-loss
test matrix without silent log corruption. Powered removal or insertion is not
supported and must not be performed as a qualification action.

This workpackage does not make SD logging a prerequisite for control. It treats
logging as a degradable service and makes loss of logging visible.

The FileX/FAT32 implementation and service-470/474 sections below are retained
as 00.04.13 history. They do not define current media acceptance. Open work is
external Controller A/B classification and qualification, remaining named
physical interruption boundaries, retail-card sampling, and systemic-risk
disposition through the Pi qualifier.

## Execution Status

Software implementation completed 2026-07-12:

- [x] Dirty/staged state captured under `work/evidence/sd-wp-baseline-20260712-194705-*`.
- [x] Missing-media callback is nonfatal and records degraded state.
- [x] SD mount, retry, physical health probe, removal, and I/O-error states implemented.
- [x] No-media chart initialization and power-on readiness are independent of FileX.
- [x] Periodic/event records use a bounded 16-record ThreadX snapshot queue.
- [x] Power event-log waits are bounded and no-media drops are acknowledged.
- [x] Mirrored append uses local file objects and checks write, close, and flush.
- [x] Format path stops at first failure and verifies its durability/marker boundary.
- [x] FileX fault-tolerant service is enabled with a 4096-byte work buffer.
- [x] Export SDRAM record count is bounded.
- [x] Degraded SD state is visible on the About screen.
- [x] A delayed one-shot Home warning for missing SD/logging unavailability is implemented and clean-built.
- [x] Automated SD safety invariant checks pass.
- [x] Clean headless Debug build/package passes for `00.04.12`.
- [x] Clean headless Release build/package passes for `00.04.12`.
- [x] Stable operating contract promoted to `docs/sd-card-operation-and-recovery.md`.
- [x] Clean Debug/Release builds and versioned packaging pass for engineering candidate `00.04.13`.
- [x] `00.04.13` was programmed and verified on assemblies `1751136` and `1751219`; both booted SD-ready with zero system/SD errors and successful mirrored periodic logging.
- [x] Both current controllers completed clean short service-474 runs with zero dropped, mirror, I/O, or latched-failure counters.
- [x] Service 470 continuous background endurance passed on both controllers as
  runs 03305 and 04904, including power-cycle recovery, controlled stop,
  retained evidence, explicit cleanup, and service-474 ownership behavior.
- [x] The recovery watchdog fault caused by an unbounded whole-volume FileX
  media check was corrected; repeat clean builds and power-cycle tests passed.
- [x] Service 469 signed 365-day export fixture was implemented, clean-built,
  and loaded on Controller A without normal-log, mirror, or SD failures.
- [x] Stop the Controller A 469 campaign after the incomplete export, retire the
  failed card, preserve host evidence, and characterize the failure in
  `work/incidents/incident-control-a-sd-card-read-failure-20260722.md`.
- [x] Make export fail closed when SD traversal does not reach the requested end;
  report actual range/status and reject or explicitly mark partial output.
- [x] Add bounded, resumable full-address read coverage and first-failing-LBA
  reporting; do not treat 470/474 bounded-working-set passes as whole-card proof.
- [x] Re-run export-boundary qualification only on inventoried expendable media
  after the failure mechanism and mitigations are reviewed.

Remaining qualification gate:

- [ ] Representative-target read-only classification, power-off
  replacement/reboot, full-address scrub, injected HPT/USB failure,
  G-PWR-backed power-cut,
  Controller B, and multi-card campaign pass.
- [x] Target verification closed the missing-warning behavior through the
  protocol-based service/status implementation and its linked completed ticket.

The 2026-07-14 no-card observation confirmed nonfatal control startup but found
the missing Home warning. A later unplanned powered removal created a confounded
4 KiB lost-chain observation; see
`work/incidents/incident-sd-hot-removal-after-evaluator-07949.md`. No repair was
performed.

No hardware result is inferred from compilation. The workpackage stays active
until the linked checklist has evidence and reviewer sign-off.

## User-Observed Problem

- Boot/control fails when the SD card is not installed.
- SD cards may become corrupt during otherwise normal data logging.

The first problem has a directly evidenced boot path. The corruption report
needs controlled reproduction and media evidence; the code audit identifies
several credible contributors but does not claim a single cause prematurely.

## Reconnaissance Findings

### F-01 — Confirmed boot blocker: generated auto-open is fatal

- `src/synergy_gen/common_data.c` defines
  `SF_EL_FX_AUTO_INIT_g_fx_media_sd (1)` and calls `fx_media_init0()` from
  `g_common_init()` before application thread entry.
- `fx_media_init0()` calls `fx_media_init0_open()`. Any open failure calls the
  generated weak `g_fx_media_sd_err_callback()`.
- That weak callback calls `BSP_CFG_HANDLE_UNRECOVERABLE_ERROR(0)`.
- `hal_entry.c` sets `gIsSdCardAvailable = true`, but this flag is not consulted
  by generated common initialization and therefore cannot prevent the halt.
- The SDMMC configuration uses `SDMMC_CARD_DETECT_NONE`, so there is no hardware
  insertion/removal event to make the assumption reliable.

Impact: missing or unreadable removable storage is treated as a fatal platform
initialization error before the controller can enter degraded operation.

### F-02 — Confirmed invalid no-media flow after startup is made recoverable

- `Thread_SdCard_entry()` eventually sets `POWER_ON_SD_CARD_OK`, even for an
  unavailable card, which is the correct high-level intent.
- Before setting it, `powerOnInitChartRecords()` always calls
  `loadAllChartLogs()`, which issues FileX operations through `sdCard_ptr` even
  when no media was opened.
- Periodic, event, chart, export, and format requests have no common
  `READY`-state gate. The thread can call FileX against closed/failed media.
- The System Monitor waits indefinitely for `gIsSaveEventLog` to clear during
  power-on/off log sequencing. A degraded-mode design must explicitly
  acknowledge a dropped log request so control startup cannot wait on storage.

### F-03 — Confirmed unsafe file cleanup and ignored durability errors

In both mirror-A and mirror-B paths of `saveLogRecord()`:

- `fx_file_close(&LogRecordFile)` is called unconditionally, including paths
  where attribute, directory, create, or open failed and the control block was
  never opened for that operation.
- The close result is overwritten immediately by `fx_media_flush()`.
- The flush result is ignored.
- The same global `FX_FILE` object is reused for both mirrors and all reads,
  increasing the consequence of stale state after a failed open/close.
- FileX error checking is enabled in the current generated configuration, but
  application logic should not rely on the library rejecting invalid lifecycle
  calls as its safety mechanism.

Impact: failures at the exact points that commit file size, directory, FAT, and
cached sectors are not surfaced, and stale control-block operations can compound
an initial media error.

### F-04 — Confirmed unexpected media-loss blind spot

- `gIsSdCardAvailable` is assumed true at startup and is not maintained from an
  application-owned mount state machine.
- There is no periodic physical-sector probe, unmount/abort transition, bounded
  reopen retry, or reinsertion recovery in SMI.
- With card detect disabled, removal while idle may not be observed until a
  later metadata or data operation fails.
- After an I/O failure the code continues accepting minute/event logging flags
  against the same media state.

Impact: removal, contact bounce, brownout, or a transient driver failure can
leave FileX and the application disagreeing about whether the volume is usable.
This finding requires fail-closed handling; it does not establish or require
powered hot-swap support.

### F-05 — Confirmed lack of FileX fault-tolerant mode

- `synergy_cfg/ssp_cfg/framework/el/fx_src_user.h` does not define
  `FX_ENABLE_FAULT_TOLERANT`.
- No call to `fx_fault_tolerant_enable()` exists.
- The bundled SSP 2.6.1 FileX source and API include fault-tolerant support.
- The format path creates one FAT and uses one 512-byte sector per cluster.

Impact: close/flush reduces exposure but does not journal FAT/directory metadata.
Power loss or removal during metadata updates can still leave filesystem damage.
Enabling fault tolerance, changing FAT count, or changing cluster geometry must
be measured and power-cut tested; none should be assumed sufficient alone.

### F-06 — Confirmed request/data handoff weakness

- Periodic and event producers write global record structures and then set
  boolean flags.
- Boolean flags cannot queue multiple events. A second producer update before
  consumption overwrites the pending record.
- System Monitor uses an unbounded wait for power event-log completion.
- SD work is selected by an `else-if` priority chain, so long chart/export work
  can delay minute/event log completion.

Impact: records can be silently coalesced/lost, and storage latency can affect
startup sequencing. This is data integrity rather than necessarily FAT damage.

### F-07 — Append semantics are not a defect

The checked-in SSP FileX implementation positions `FX_OPEN_FOR_WRITE` at
`fx_file_current_file_size` in `fx_file_open.c`. The current code therefore does
append records even though it does not explicitly seek to end. Tests should lock
this behavior down, but the mitigation must not add a redundant seek and call it
the root cause.

### F-08 — Reference implementation contains reusable patterns

`E:/dev/high_point/7520708_DispTest_FW/src/Thread_SdCard_entry.c` contains an
application-owned weak-callback override, close-if-open helper, explicit open
state, retry loop, physical-sector health probe, and nonfatal missing-card
behavior. These patterns are evidence and a starting point only. SMI has logging,
power-on event handshakes, chart loading, format, and export behavior that the
display-test project does not, so copy/paste parity is not sufficient.

## Scope

Primary files expected to change:

- `configuration.xml` and regenerated `src/synergy_gen/common_data.c/.h` only as
  required by e² configuration; never hand-edit generated behavior without its
  canonical configuration change.
- `src/Thread_SdCard_entry.c`
- `src/AppVariables.h` and the project global-definition surface
- `src/Thread_Controller_entry.c`
- `src/Thread_SystemMonitor_entry.c`
- `src/HMI_MainEventHandler.c` for explicit unavailable/degraded status
- `synergy_cfg/ssp_cfg/framework/el/fx_src_user.h` through e² configuration if
  fault-tolerant FileX is approved after the compatibility test
- Host test/fault-corpus scripts and hardware qualification checklist
- `docs/sd-card-operation-and-recovery.md` after behavior is proven

Out of scope unless evidence requires it:

- USB mass-storage FileX behavior; it uses a separate media object.
- Changing the binary `S_LogRecord` layout.
- Automatically formatting an unknown, corrupt, or newly inserted card.
- Making control conditional on successful logging.

## Implementation Plan

### Stage 0 — Preserve and reproduce

1. Record the current dirty working tree with `git status`, staged diff, and
   hashes. Do not reset or fold the existing version/build/mitigation/Release
   cleanup into SD-specific commits.
2. Archive the current `00.04.12` ELF/SREC/MAP and headless build log.
3. On a representative target, capture boot traces with: valid card, no card,
   blank card, corrupt FAT, write-protected card if electrically supported, and
   card removed during idle and during a record append.
4. Image at least one reportedly corrupt card before allowing Windows or FileX
   to repair it. Capture partition table, FAT copies, root/directory sectors,
   CHKDSK/fsck report, capacity/CID if available, and the last readable A/B logs.
5. Establish a deterministic log workload with known timestamps and event count.

Exit evidence: boot failure is reproducible; corruption symptoms are classified
as filesystem damage, truncated record, mirror divergence, lost record, or media
hardware failure rather than grouped under one label.

### Stage 1 — Make missing storage nonfatal

1. Add an application-owned strong `g_fx_media_sd_err_callback()` that records
   status and transitions SD state; it must never invoke the unrecoverable-error
   handler for removable-media absence/failure.
2. Introduce explicit states such as `UNINITIALIZED`, `OPENING`, `READY`,
   `UNAVAILABLE`, `IO_ERROR`, and `FORMATTING`, plus last status, attempt count,
   failure count, and dropped-record diagnostics.
3. Implement `OpenSdCard()` and `CloseSdCardMedia()` with media-ID/open-state
   checks and one cleanup path. Reuse the proven reference pattern after adapting
   names and SMI behavior.
4. Initialize blank chart memory without FileX when media is unavailable. Mark
   chart load complete with an explicit no-media status.
5. Set `POWER_ON_SD_CARD_OK` to mean "SD service initialized", not "card exists".
   Explicitly complete/drop startup log requests when unavailable so System
   Monitor never waits indefinitely.
6. Keep control, alarms, monitor, UI, and communications fully operational while
   surfacing a latched/logging-unavailable diagnostic.

Exit evidence: ten cold boots with no card reach control; valid-card boot remains
unchanged; blank/corrupt card does not trigger format or halt; watchdog remains
healthy; no FileX data operation occurs unless state is `READY`.

### Stage 2 — Centralize media ownership and recovery

1. Make the SD thread the sole owner of SD `FX_MEDIA` and `FX_FILE` lifecycles.
2. Replace ad-hoc readiness checks with a single operation gate that either
   executes in `READY` or returns a typed `NO_MEDIA`/`IO_ERROR` result.
3. Because hardware card detect is disabled, add a low-rate physical-sector
   probe while ready and a bounded reopen retry while unavailable. Do not use
   `fx_media_flush()` as a presence probe.
4. On the first hard I/O error: stop new writes, close only proven-open files,
   abort the media if normal close cannot complete, transition state, and retain
   the original error code.
5. After power-off replacement and reboot: perform a fresh protocol/CID/media
   classification, validate the installed media, and transition to the
   appropriate state. Never auto-format.
6. Define user-visible distinctions between no card, unformatted card, corrupt
   card, full card, write failure, and retrying.

Exit evidence: injected loss at idle and every append boundary fails closed
while control continues; power-off replacement/reboot classifies the card
without automatic format; no repeated calls use an invalid FileX control block.
No physical powered removal or insertion is performed.

### Stage 3 — Make each mirrored append transactional and observable

1. Refactor mirror writes into a helper with a local `FX_FILE`, `file_open` flag,
   and one cleanup block.
2. Check directory test/create, file create/open, record write, file close, and
   media flush separately. Preserve the first failure and record the failed phase.
3. Close only when open succeeded. Never overwrite a close failure with a flush
   result. A failed durability boundary transitions the media to error state.
4. Snapshot the record before any I/O and validate `Start`, `End`, timestamp, and
   size. Keep mirror A/B outcomes separate.
5. Define success policy: a record is durable only after at least one mirror has
   successfully written, closed, and flushed. Report degraded redundancy when
   only one mirror succeeds.
6. Add monotonic sequence information using an existing spare field if compatible,
   so field analysis can distinguish loss, duplication, and mirror divergence
   without changing record size.
7. Verify card-full and allocation failures do not repeatedly mutate metadata or
   claim success.

Exit evidence: injected failure at every FileX call produces the expected state,
cleanup, diagnostic, mirror result, and bounded producer acknowledgement.

### Stage 4 — Replace lossy flags with bounded messaging

1. Add a ThreadX queue carrying immutable periodic/event record snapshots and a
   request type/sequence number.
2. Define queue depth from worst-case event burst plus media latency; measure
   stack/RAM impact and add a compile-time capacity check.
3. Define overflow policy explicitly: never block the control loop; count and
   alarm dropped records; preserve power event priority without starving normal
   logging.
4. Replace System Monitor's unbounded `gIsSaveEventLog` waits with bounded
   completion signaling. Missing media returns a completed-but-not-persisted
   result, not an infinite pending flag.
5. Route format/chart/export commands through explicit requests or an equally
   auditable state machine. Prioritize record persistence over long reads.

Exit evidence: burst tests prove ordering and loss accounting; control timing is
unchanged; no producer mutates a record owned by the SD thread.

### Stage 5 — Evaluate and enable filesystem crash protection

1. Build a focused compatibility spike for SSP 2.6.1
   `FX_ENABLE_FAULT_TOLERANT` plus `fx_fault_tolerant_enable()` using dedicated,
   correctly aligned memory.
2. Test existing field-formatted cards, newly formatted cards, mount/recovery
   time, RAM/flash growth, write latency, and behavior after removal/power loss.
3. Evaluate two FATs and capacity-appropriate cluster sizing separately. Changing
   format geometry requires an explicit service/migration decision and must not
   silently reformat existing media.
4. Enable only the combination whose on-target recovery evidence is better than
   the baseline and whose latency fits control/logging constraints.
5. Document that A/B log mirrors protect record availability but do not replace
   filesystem metadata protection because both live on the same volume.

Exit evidence: an approved configuration and measured rationale, or a recorded
decision not to enable it with an alternative recovery mechanism.

### Stage 6 — Format and read-path hardening

1. Refactor `formatSDCard()` to stop immediately after each failed phase, close
   only valid state, preserve the first error, bound configuration-save waits,
   and declare success only after reopen, marker creation, close/flush, and marker
   verification all succeed.
2. Require explicit authenticated service/UI confirmation before format; never
   format merely because mount or marker validation failed.
3. Validate complete `S_LogRecord` framing and timestamp before accepting it.
   Treat partial trailing records as a recoverable truncated tail, not a valid log.
4. Ensure read paths close only opened files and preserve A/B fallback diagnostics.
5. Bound export range and SDRAM record count, and ensure media removal cancels
   chart/export cleanly.

Exit evidence: malformed files/cards cannot index outside buffers, format errors
cannot report success, and read-only recovery never modifies the card.

### Stage 7 — Integrated verification and documentation

1. Run clean GUI-free Debug and Release e² builds and package ELF/SREC artifacts.
2. Add host tests for state transitions, queue overflow, result aggregation,
   record validation, mirror fallback, and injected FileX call failures.
3. Run the hardware matrix below using at least two card brands/capacities and a
   card with representative field age if available.
4. Promote proven behavior, status codes, formatting policy, recovery, and media
   requirements to `docs/sd-card-operation-and-recovery.md`.
5. Link test logs and close this workpackage only after all failure modes have a
   disposition.

## Hardware and Fault Matrix

- Valid card; no card; blank card; corrupt FAT/directory; full card.
- Cold boot and warm reset for each media condition.
- Power-off no-card boot and power-off replacement/reboot classification.
- Injected media loss while idle, opening, directory creation, file creation,
  record write, close, flush, chart load, export load, and format; do not
  physically remove a powered card.
- Power interruption at those same destructive phases on an approved recoverable target.
- Inject each FileX return failure and SDMMC timeout separately.
- Minute logging plus rapid event burst, chart load, and USB export contention.
- 24-hour minimum logging soak, followed by PC filesystem check and exact A/B
  record sequence comparison.
- Repeated reset/power-cycle campaign sized to the agreed reliability target.
- Confirm control output timing, alarms, watchdog service, UI, communications,
  and NVRAM continue with storage absent or failing.

## Acceptance Criteria

- No SD condition can prevent control startup or cause an unrecoverable platform halt.
- Control never waits indefinitely for an SD log acknowledgement.
- Every SD FileX call is reachable only through an initialized/ready media owner.
- Files are closed only if opened; write, close, and flush results are individually checked.
- Removal/failure produces one state transition and bounded retries, not repeated
  writes through stale media state.
- Queue overflow, no-media drops, mirror degradation, full media, and I/O errors
  are counted and visible.
- No test reports success unless its required durability boundary completed.
- The power-cut/soak corpus produces no unexplained FAT/directory corruption and
  no silent record gaps. Any accepted limitation is documented and approved.
- Debug and Release headless builds pass with current toolchain and generated-code parity.
- Existing unrelated working-tree changes remain intact and reviewable.

## Working-Tree Preservation

The repository already contains extensive staged Release cleanup, retained
ELF/SREC artifacts, e²/headless setup, version `00.04.12`, prior mitigation code,
and Tool Shed artifacts. Before implementation:

- Capture `git status --short`, `git diff`, and `git diff --cached`.
- Do not reset, clean, amend, or regenerate unrelated project surfaces.
- Keep SD work in reviewable slices and inspect generated diffs after e² regeneration.
- Do not delete local Debug/Release outputs; current ignore policy intentionally
  tracks top-level ELF/SREC files and ignores other generated content.
- If a required generated change overlaps existing edits, preserve both and call
  out the overlap in the workpackage evidence.

## Risks and Decisions Requiring Evidence

- Whether SSP 2.6.1 FileX fault tolerance is stable and affordable on this image.
- Powered removal/insertion is unsupported and prohibited; qualification uses
  power-off replacement/reboot and injected media-loss cases.
- Queue depth and event-priority policy.
- Retry cadence and whether repeated failure should latch until user service.
- Whether two FATs or new cluster geometry justify a controlled reformat/migration.
- Required retention and acceptable lost-record window during abrupt power loss.
- Which SD brands, capacities, speed classes, and endurance ratings are supported.

## Related Artifacts

- Existing mitigation workpackage:
  `work/wp/active/wp-mitigate-smi-firmware-code-review-findings.md`
- Existing hardware checklist:
  `work/checklists/checklist-smi-firmware-mitigation-hardware-qualification.md`
- SD-specific qualification checklist:
  `work/checklists/checklist-sd-card-degraded-boot-and-logging-qualification.md`
- Reference implementation:
  `E:/dev/high_point/7520708_DispTest_FW/src/Thread_SdCard_entry.c`
- Architecture/review evidence:
  `E:/dev/high_point/AI_Discovery/7520553_SMI_FW/code-review.md`

## Completion Standard

Complete only when degraded boot, normal logging, power-off card
replacement/reboot, injected I/O failures, full media, power interruption,
soak, filesystem inspection, and control-regression tests have linked evidence;
all failures are fixed or formally disposed; production firmware is restored;
and the stable operational contract is promoted to repository documentation.

## Owner-directed reconciliation — 2026-09-23

Legacy external-qualifier execution plan superseded by the owner withdrawal of the standalone qualification programme and the current exact-candidate MAP-0009 release plan. Historical unmet tests remain unproven; every applicable current release fault/logging gate remains open in MAP-0009.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: waiting on external qualifier readiness and returned degraded-operation evidence; firmware implementation complete
> Next Action: this workspace publishes the exact SMI firmware bundle, degraded-operation contract, diagnostic interface, and authorization references after candidate freeze; the srv-rpi00.local app coordinates every remaining controller case after its readiness gate and returns an immutable result manifest

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
