# Project Map: SMI 00-05-01 Transition Floor And Controlled Return

Status: active
Type: project-map
Updated: 2026-09-23
Source Idea: IDEA-0007
Technical Source: IDEA-0006
Requested Endpoint: source completion plus authorized A/B bench qualification; release and publication remain separate
Next Action: operator executes the native DisplayTest FAT32 format on A, then report screen result; verify unchanged CID and FAT32 ready before focused SD read/write–Home touch check and exact SMI USB staging
Campaign: standalone
Initial Target Control: Controller A

## A transition execution checkpoint — 2026-09-23

The owner declared the retained HPT2 history expendable, reviewed the concrete sequence and said to continue. A FAT32 preparation and the normal SMI installation are authorized within that sequence, subject to their verification stops. The owner reports `IMX2` at A and can use A's touchscreen. SMI can read the J-Link state but has no approved touchscreen control path; the operator was given the native `System Test → SD Card Test → Format SD as FAT32?` step with its left confirmation.

Read-only A baseline at 09:48 PDT reconfirmed exact DisplayTest 01-01, assembly 1751136, serial 69664082, unchanged valid CID `05000C61736466672200001C8901A34F`, ready HPT2, cached valid sector approval, and idle update/format/SDQ request flags. Another read-only capture at 09:55 PDT showed card state 2 (HPT2), format request 0 and format result 0. Thus no format completion can be claimed. The SD read/write result field of 2 is pre-existing/stale; no such test was requested in this SMI execution. No install or power operation occurred. Raw captures: `work/evidence/generated/smi-displaytest-takeover-20260923-094826/` and `...-095550/`.

On reported format completion, capture fresh CID, protocol/card state, CID validity, representative-sector evidence and format status. Stop on CID change or failure. Then run only the affected FAT32 SD read/write–Home touch sequence, verify fresh FAT32 Lockout handoff, and check exact SMI IMX bytes on `IMX2` before the normal installation. The A/B release matrix remains open. `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md` is the SMI evidence ledger; prior handoff and paused statements below remain history.

## Current handoff reconciliation — 2026-09-23 09:27 PDT release

Coordination is resumed from SMI; live takeover is verified, with card-data disposition and explicit hardware-action authority still pending. DisplayTest released A with no pending operation, running 01-01 on assembly 1751136 / probe 69664082 with retained HPT2 CID `05000C61736466672200001C8901A34F`. Its controller-generated IMX, source `da955dc92a1652eba247f07b32d154b4b7001e02`, is now controlled at SHA-256 `E11CEB483BA478F6A3D98F75DBF303EA09800165463EFE17880D5CDB2ACD78AB`; local hashing matched it and the accepted SMI IMX. The missing-image prerequisite is complete.

Credit existing SMI candidate/UI/export and resolved updater evidence, plus DisplayTest HPT2 startup, export, scoped navigation and Card Identity; do not replay them. Full SD Qualification was not run and is not required merely for this transition. The affected SD read/write–then-Home touch sequence and verified FAT32 production handoff remain open.

Live read-only takeover succeeded at 09:40–09:41 PDT after the earlier DNS failure. Serial-bound A / assembly 1751136 / probe 69664082 has exact DisplayTest 01-01 main-flash SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. HPT2 is ready, driver CID valid, raw CID unchanged, cached sector-zero approval valid, and captured update/format/SD-test/SDQ request flags idle; FAT32 handoff remains NONE. See `work/evidence/smi-displaytest-live-takeover-20260923.json`. No halt/go/reset/program/power/format command was issued; J-Link initialization reported a low-power wake. The smallest open SMI-owned test is A's ordinary DisplayTest 01-01 → accepted SMI 00-05-01 installation through verified FAT32 fixture handoff. The retained HPT2 card first needs a recorded preservation/archive or expendable-data decision and explicit erase consent; an IMX export does not preserve SD history. After authorization, minimal FAT32 preparation and the focused affected touch check can supply that prerequisite without Full Run. Programming, power operations and formatting are not authorized by this handoff or reconciliation.

Remaining exact-candidate A/B forward/return, refusal/renamed-file, representative rollback, fault/recovery, initialization, logging/history/export and retention gates remain open. Earlier dated pause/missing-image statements below are history superseded by this capsule; prior owner-abandoned commitments remain abandoned. Evidence and the concrete next-step sequence: `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

## Outcome

Deliver a safe SMI 00-05-01 update floor, a direct controlled SMI rollback, and a safe return to revised DisplayTest. Preserve normal DisplayTest FAT32 handoff and explicit SMI HPT2 initialization. Qualify all transitions on both controller assemblies before any release decision.

## Direction and boundaries

1. Use the validated format-1 IMX header Title for family and numeric release identity, with MachineMask, layout, header CRC, and payload CRC as existing independent checks. USB filenames are discovery labels only. Ordinary update rejects older or unknown personality images before any QSPI erase.
2. Keep direct service rollback admission separate from ordinary update. Use one target-media policy after admission: supported DisplayTest and pre-00-05-00 SMI require FAT32; ordinary SMI/CVO/DVO at 00-05-01 or later retain HPT2. When FAT32 is required, verify and retain existing FAT32, format any other readable classified layout only after explicit data-loss consent, refuse missing or unreadable media before QSPI erase, recheck CID and representative-sector readability, and revalidate the staged image before internal-flash replacement.
3. Preserve service 471 as explicit HPT2 reinitialization if current SMI remains bootable and its UI usable after a pre-flash stop. Do not promise recovery after internal-flash replacement starts.
4. The DisplayTest 01-01 or later image belongs to its own project-bound lane. It must boot safely with HPT2 media, enforce its 01-01 fixture-to-fixture floor, and verify FAT32 for normal production handoff. SMI ordinary update now prepares FAT32 before installing an admitted DisplayTest return image. After that FAT32 handoff DisplayTest may install a valid older SMI personality; the 00-05-01 ordinary personality floor belongs to SMI while HPT2 media may remain. DisplayTest 01-00 is below the SMI return floor.
5. CVO and DVO are outside this project. This SMI project cannot claim those delivered and must not alter DVO.

## Execution sequence

- Establish exact controlled IMX identities and current source behavior. Implement the SMI normal floor and verify deterministic negative cases, including a renamed valid file.
- Implement the explicit service rollback for any valid SMI image and shared target-driven FAT32 preparation for both ordinary DisplayTest return and pre-00-05-00 SMI service rollback. Disable the main chart whenever the logger is not writable.
- Reconcile the separate DisplayTest lane against its own project authority and image evidence.
- Use Controller A for the remaining forward, return, refusal, rollback and failure-recovery matrix, with a fresh matched-firmware CID baseline before action and after each relevant reboot or initialization. The historical DVO CID-unavailable record is not the current baseline. Repeat required evidence on B before release.
- Reconcile evidence and make a separate release decision. Earlier DVO replacement authorization is historical; the current handoff authorizes no programming, power operation or format. Obtain explicit action authority for the next transition; push, publication and release remain separate.

## Readiness gates

- G-APPROVED-IMAGES: exact SMI 00-05-01 and DisplayTest 01-01 controller-generated IMX identities are complete and locally hash-verified. Representative rollback/refusal specimens are inventoried below; verify their bytes on target media before use. These are qualification specimens, not production allowlists.
- G-SMI-CANDIDATE: source, immutable candidate, exact Controller A readback, final controller-generated image, and owner UI acceptance are complete. Target fault, rollback, retention, and both-controller evidence remain open.
- G-DISPLAYTEST-RETURN: credit the supplied A HPT2 startup and scoped navigation/Card Identity evidence. Preserve remaining affected touch-sequence, fixture-to-fixture floor and verified FAT32 production-handoff/legacy-admission qualification in the DisplayTest lane; this SMI reconciliation does not declare that gate passed.
- G-DUAL-CONTROLLER-TRANSITION: collect CID-bound transition and fault evidence on A and B before release.

## Controller A qualification image inventory

| Role | Controlled specimen status |
| --- | --- |
| FAT32-era direct service rollback | SMI `00-04-11`, controlled DisplayTest-project specimen SHA-256 `1A83853002168B373FE756FF090F4364E9D82039D247E12678E842643C6AB274`; verify exact bytes on target media before use. |
| DisplayTest return refusal | DisplayTest `01-00`, separate workspace Debug IMX SHA-256 `05059BFBB74C8B785BAD559743316667AB0BAC7F51D49CDE3347F8F85D8F4A78`; read-only inventory, below the return floor. |
| Forward install and permitted DisplayTest return | Accepted SMI candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` is frozen from commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`; its Release S-record SHA-256 is `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`. Controller A service 150 generated `7520553_SMI_00_05_01.imx`, 8,388,864 bytes, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`; its main payload exactly matches the candidate. DisplayTest `01-01` controller-generated IMX is available in the separate workspace Debug directory, SHA-256 `E11CEB483BA478F6A3D98F75DBF303EA09800165463EFE17880D5CDB2ACD78AB`, source `da955dc92a1652eba247f07b32d154b4b7001e02`; local hash verified 2026-09-23. |

These hashes identify test specimens and do not create firmware allowlists. The owner confirmed that SMI 00-05-00 was never deployed on a production controller and is outside this transition qualification. Its ordinary-floor rejection is covered by focused host policy tests; it will not be installed as a bridge. Both current controller-generated images are now identified and checked. Image availability does not qualify either transition or authorize installation.

## Current limits

The owner clarified on 2026-09-22 that neither controller initially ran SMI and therefore neither supported SMI service 467 in the pre-program DVO state. The owner then explicitly authorized overwriting Controller A and Controller B with SMI firmware. A pre-program CID block is recorded as `CID unavailable: installed DVO firmware has no service-467/equivalent mapped state`; the card remained installed, and post-program SMI captures supply current identity. The owner also clarified that service rollback accepts any valid SMI image and DisplayTest return requires 01-01 or later. The published DisplayTest `01-00` release tests and initializes HPT2 media for production, so it does not meet this directive's FAT32 production handoff and is below the return floor. Select exact qualification specimens before physical testing; no image-version allowlist is required for software implementation. Incomplete gates stay open and visible.

## 2026-09-22 target designation

Controller A remains the initial target control and Controller B follows for the dual-controller gate. A read-only four-MiB Controller A DVO rollback capture was retained before programming. After a fresh serial-bound inventory, Controller A was programmed with the manifest-bound SMI 00-05-01 Release candidate. No SD card was moved and no power operation or SD write occurred during this program step.

## 2026-09-22 rollback boundary review

The source review found that the USB updater could time out while the SD worker still had a pending or active FAT32 preparation, falsely reporting failure before a later card format. The updater now waits for the SD owner's terminal result once preparation is requested. The final read-only USB media flush remains telemetry rather than an image-admission gate after full payload and staged QSPI CRC verification. The canonical Release rebuild, 16 update cases, and 19 review checks pass. This does not prove SD-worker liveness or target fault behavior; the Controller A fault matrix remains open.

The separate DisplayTest project's newer Controller B record includes a five-minute export with newly written and read SMI `00-04-11` FAT32 records. Post-restart retention was not checked. That pairing evidence does not qualify the SMI `00-05-01` A/B transition.

## 2026-09-21 source checkpoint

The SMI source version is now 00-05-01. The ordinary update path parses family and two consistent numeric version spellings from the CRC-checked Title, checks the 00-05-01 personality floor and DisplayTest 01-01 return floor, and refuses malformed, unknown, or older identities before the first install QSPI erase. It does not use the USB filename as identity. A distinct controlled direct-rollback path accepts any valid SMI image. A pre-00-05-00 image is fully staged before the SD owner rechecks CID and representative sector, prepares FAT32 in place, and lets USB recheck the staged CRCs before internal-flash replacement. The managed Release rebuild and subsequent incremental build pass; the existing 16-case firmware-update negative corpus and 19 code-review checks pass. This was a source-only checkpoint; later sections supersede its target-evidence status. No controller programming or SD operation occurred at this checkpoint.

## 2026-09-22 source review

The legacy service branch now checks read-only SD preparation eligibility before the first QSPI erase, then checks again after staging when it requests the SD owner operation. The SD worker keeps FAT32 media unavailable to HPT logging until the older firmware takes over. Service-code consent text states that data loss is conditional on a pre-00-05-00 image. The managed Release rebuild and final incremental build pass; the existing 16-case update corpus and 15 review checks pass. The checked-in 00-05-00 IMX header has the expected controlled Title, format-1 layout, and four-MiB main/audio payloads. There is still no target evidence for the DisplayTest return, FAT32 failure/recovery boundary, or A/B transitions; no controller or card action occurred.

Read-only review of the separate DisplayTest 01-01 source found no personality version floor in `src/DisplayTestUpdateAdmission.h`, a 01-01 fixture-to-fixture minimum, and FAT32 handoff before personality installation. Its project record reports Controller B FAT32 handoff and installation of SMI 00-04-11, after a power cycle following an initially unresponsive install tap; old SMI logging remains unproven. The earlier reciprocal-floor requirement conflicted with that media-state design and is superseded above. This does not satisfy the SMI A/B return or rollback gates, and the SMI bench pause remains in force.

## 2026-09-22 resumed implementation checkpoint

The focused review now restricts SMI, CVO, and DVO Titles to product IDs 7520553, 7520555, and 7520721 respectively. A pending direct-rollback SD request cancels atomically if the SD thread does not accept it within 30 seconds; once accepted, USB waits for the terminal result because FAT32 erasure may be underway. Nineteen identity-policy cases, nine rollback-contract checks, the existing 16 update cases, and 19 review checks pass. Fresh managed Debug and Release rebuilds pass. This was a pre-target checkpoint; later sections supersede its candidate status.

## 2026-09-22 immutable candidate and bench-boundary checkpoint

Commit `77495a3715ffeb3d3a4928a82d6f2e949e7e5362` contains the reviewed SMI 00-05-01 source and deterministic Debug and Release outputs. Fresh clean-commit rebuilds reproduced the tracked outputs. Immutable candidate `00.05.01-77495a3715ff-5a30dd9eacda` validates against HEAD; its manifest SHA-256 is `B948EDFC72444042D38E692607A234D9C671B1D1D0BE98C229142095ED57160B`, Debug S-record SHA-256 is `51315325E3B37F91B6A8B204741480F3DC6ED621CC76594FBB0E987D1075047A`, and Release S-record SHA-256 is `5A30DD9EACDA99AD7BC86CA70D536FA331B78A4015325891DE920EA8421B00B3`. This closes the host-side candidate freeze portion of G-SMI-CANDIDATE; target behavior remains open.

Live hub inventory confirmed Controller A probe `69664082` at port `19120` and Controller B probe `69660123` at port `19121`. The Controller A pre-program DVO four-MiB rollback capture has SHA-256 `8DC55368026649523FC751B09A6C99F47FD015251D1B0A6BE7F6CBC9DE44DAD6`. Pre-program CID is unavailable because DVO has no service-467/equivalent mapped state; the installed card was not moved. Manifest-bound programming of the Release candidate passed with serial `69664082` and VTref 3.272 V. The post-program four-MiB readback SHA-256 is `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407` and exactly matches the expanded S-record. After startup settled, target state reported protocol detection `4` (FAT32 / needs initialization), CID valid `1`, representative-sector read valid `1`, and raw CID `05000C61736466672200001C8901A34F`. Owner-supplied photographs confirm successful SMI boot, working touch navigation, firmware `00-05-01`, assembly `1751136`, and the expected FAT32 / HPT media 2.0 initialization warning while temperature control remained active. No initialization was accepted. The owner confirmed that SMI 00-05-00 was never deployed on a production controller and does not require target qualification. It is excluded from the bridge path. A deterministic host builder now packages the exact SMI 00-05-01 Release S-record with the audio payload from released SMI 00-04-11, allowing the ordinary Settings > Update Firmware path to establish the correct SMI main and QSPI payloads directly.

## 2026-09-22 FAT32-safe candidate and direct updater checkpoint

Commit `22a3205bae1372b485f2c484de238e2c9cbae0db` retains an already-readable FAT32 card during service rollback after CID and representative-sector verification; only an HPT2-to-FAT32 conversion invokes formatting. Managed Debug and Release rebuilds pass. Nineteen identity-policy cases, ten rollback-contract checks, sixteen update-validation cases, fifteen review checks, the image-builder CRC round trip, and candidate tamper tests pass.

Immutable candidate `00.05.01-22a3205bae13-da6887348e38` validates against HEAD. Its manifest SHA-256 is `E45CA23CF3F4A321192555B9CFC3E84BFA23F86B000A468CAC5C379348A81FA8`; Release S-record SHA-256 is `DA6887348E38F986F53C17D29BEC6CB04D5ABFF1ECFED2BF67D972E99E657AA0`. Deterministic IMX `7520553_SMI_00_05_01.imx` is 8,388,864 bytes with SHA-256 `6F47AF091C9B73CCE8DD8DC58D4D7F3A270D6E21DB8659D28F1C30B6F4EB80D7`, header CRC `4A7B4205`, main CRC `F5B332CF`, and audio CRC `758FE2DE`. The main payload is the exact candidate Release S-record expanded to four MiB; the audio source is released SMI 00-04-11, SHA-256 `1A83853002168B373FE756FF090F4364E9D82039D247E12678E842643C6AB274`. Controller A was scheduled to consume this image through Settings > Update Firmware under the policy at that checkpoint. The later target-media requirement and staging result supersede this forward-looking statement.

## 2026-09-22 Controller A staging result and requirements detour

Controller A listed and accepted the exact `7520553_SMI_00_05_01.imx` through Settings > Update Firmware and returned to the main screen. Read-only evidence proves exact QSPI staging: main SHA-256 `7F49E615FF971D1C63E44CF94B8DCD9BF919DA7846E052408189997A58B78B8E` and audio SHA-256 `CEDDB5F1BC3F40EDD449E2228B3DB1EB75289C9B60DCD415276DCC31FAC8DCE2`. Internal flash remained exactly the prior candidate at SHA-256 `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407`; at this checkpoint the final flash-transition cause was unresolved. The FAT32 card remained uninitialized with CID `05000C61736466672200001C8901A34F`, identity valid, and representative-sector read valid. Configuration remained operational and quiescent. The 2026-09-23 reconciliation below closes that defect diagnosis.

The owner then required target-driven FAT32 preparation and a gray disabled main chart whenever logging is unavailable. The SMI implementation now shares FAT32 preparation across ordinary DisplayTest return and legacy-SMI service rollback, retains verified FAT32 without formatting, formats another readable classified layout after explicit consent, and refuses missing or unreadable media before QSPI erase. The chart uses live queue/media/store readiness and refuses stale clicks. Twenty-four identity/media cases, thirteen FAT32 transaction checks, sixteen update validation cases, the chart availability contract, nineteen review checks, seventeen warning checks, both managed builds, and related USB/FileX checks pass. Commit `10dbb91519384cc9144b94e8a79057c8f47c0630` was rebuilt cleanly and reproduced Debug S-record SHA-256 `69C28A9B4D51F6AA8BD0F70E6D4360B4D2EC56F401B20C6C82327475414EC8EF` and Release S-record SHA-256 `4E7DFB2F7333202C71A736DF6692512030DB43508A1CCD0C556E7E8C1EB6B326`. Immutable candidate `00.05.01-10dbb9151938-4e7dfb2f7333` validates with manifest SHA-256 `6F753689C56EFACE054C802FF782FFCC193BFAE2D7F5E948F0BE20F44FA86586`. The prior frozen candidate is superseded. Bench work remains paused and no controller programming or SD formatting occurred during this detour or freeze.

## 2026-09-23 operator UI acceptance and final SMI image

Controller A was direct-programmed with accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5`; a complete four-MiB readback matched the expanded Release S-record at SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the fitted startup warning, reason-specific disabled-chart message, return-to-home behavior, operator service 467 access, and the remaining service 471 warning flow. The owner unintentionally completed service 471 during that review. Immediate read-only state showed ready media, valid unchanged CID `05000C61736466672200001C8901A34F`, a successful representative-sector read, and no terminal initialization error.

After UI acceptance, Controller A service 150 generated the final `7520553_SMI_00_05_01.imx` on `IMX2`. Read-only host validation reports 8,388,864 bytes, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, valid header/main/audio CRCs, and an exact main-payload match to the accepted Release candidate. The source media was unmounted cleanly. This closes the SMI controlled-image portion of G-APPROVED-IMAGES. The separate DisplayTest workspace currently has no controlled `01-01` IMX, so that gate and the remaining Controller A transition matrix items remain open. No further controller programming or SD operation is authorized by this checkpoint.

## 2026-09-23 Tool Shed reconciliation to actual work

The earlier internal-flash handoff failure is resolved. Commit `76471306` added watchdog refresh during bounded flash erase/program waits; commit `ab0755e7` cleared stale FCU command-lock state and disabled ROM cache before the RAM-resident updater handoff. A controlled self update completed with terminal diagnostic error `0`, and the full internal-flash readback exactly matched its candidate at SHA-256 `6B27C922C40908BB6221819841F8A7F264E09C3E5D3399ABB0F18993BD01A86F`.

The current accepted candidate is `00.05.01-1bf8afe6aeba-6476100e5ae5`, from commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`, manifest SHA-256 `A4BDA8EEE4C5D78C45F7CC943616FAAE2285B00DD76F4F3E02363D5067AD1D60`, and Release S-record SHA-256 `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`. Controller A's full readback exactly matches the expanded Release image at SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner's UI acceptance and the final controller-generated SMI image close the source, UI, Controller A exact-image, and SMI image-control portions of the work.

Open work is now limited to the exact controlled DisplayTest 01-01 IMX and the still-paused A/B forward, return, refusal, controlled rollback, fault, logging, retention, and export evidence needed by the readiness gates. The separate DisplayTest lane has source and bench evidence for safe startup, FAT32 handoff, and touch, but this project cannot close G-DISPLAYTEST-RETURN without the controlled 01-01 image and required SMI transition evidence. MAP-0009 remains active; no release, ECO, or rollout decision is implied.
