# Project Map: SMI 00.05.02 first-format reliability

Status: active
Type: project-map
Updated: 2026-09-30
Origin: IDEA-0009
Target Release: 00.05.02
Next Action: run B's ordinary DisplayTest-to-SMI FAT32 transition and verify its first Format 2 with the corrected image; then finish graph and shared release gates

## Purpose

Make SD initialization and commissioning succeed on the first attempt after a fresh SMI install. Preserve the exact first failure and distinguish driver I/O from invalid HPT metadata. Carry the verified fix into the shared 00.05.02 image with IDEA-0008.

## Direction

1. Reproduce or isolate the first-format sequence against v00.05.01, beginning with the provided two-controller screenshots and source trace. Keep the cause open until a failing operation or metadata invariant is observed.
2. Correct the proven common firmware defect and retain useful first-failure diagnostics. Do not add card-specific timing or unconditional retry behavior.
3. Verify format, reopen, commissioning append/readback, and failure paths with focused tests and the canonical managed build.
4. Coordinate the 00.05.02 candidate with IDEA-0008. Qualify the exact image on both affected controller/card combinations using separately authorized expendable media, CID baselines, service 468 results, and first-attempt outcomes before release.

## Current Position

v00.05.01 failed at commissioned-media reopen on the first format attempt on two controls with different cards; each second attempt worked in the same powered session. The original failing SD operation or HPT metadata check was not captured. Source tracing found that exhausted raw reads could be reported as CORRUPT and a subsequent legacy probe could erase the displayed driver error. Committed 00.05.02 diagnostics preserve the first raw error/sector, identify the open stage and lane, and classify proven read exhaustion as IO_ERROR. They do not yet establish the underlying first-attempt cause.

Commit `b7f9cd9fda8b65070b984e6137cfe0461adcfac0` passed clean managed Debug and Release rebuilds and focused commissioning checks (110/110). Immutable candidate `00.05.02-b7f9cd9fda8b-4e1a73b11a06` validates with manifest SHA-256 `DC624924690825C3EEDDC7F8B9D220ED0E5354739DDB0811C3B0EABD270FF170` and Release S-record SHA-256 `4E1A73B11A06C0026F9AAFDE37FD69E04924732BF1D8054B9C7E8F5EB7D21656`. Both affected controls were programmed, verified, reset, and independently read back; each complete 4 MiB flash matches candidate hash `A638AAA78E7CE51C2C9DE4283B3EEB188FB17EA70FA4B77E5AECA2C8F2B12AAF`. Fresh read-only CIDs, validity, and representative sector reads were captured after each reboot. The owner confirmed both installed cards expendable. CID-bound first format requests on the installed cards completed on the first observed 00.05.02 attempt, with full commissioning terminal proof and no retry. These cards were already HPT-ready at baseline following the owner's successful second attempt, so the original fresh-install failure remains unreplicated and no root-cause correction is proven. Evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md`.

The owner chose the same-card SMI-to-DisplayTest path to recreate FAT32 without SD removal. Controller A's ordinary DisplayTest update reported Success. Its full flash matches the published DisplayTest 01-01 IMX main payload; the same CID `FE34325344000000200000015B01A30B` was valid and FAT32 ready. The exact SMI 00.05.02 return IMX was built and CRC/round-trip checked; SHA-256 `E9B30A1B368C2D005252F145DB1630FF7718332CA67564605D7BC9D14ECB357E`.

The owner moved the USB drive labeled `imx` to the Windows PC. The exact 00.05.02 return IMX was copied to its root and read back with the same SHA-256; the existing DisplayTest update file also matched its published release hash. B's fresh read-only pre-transition CID and representative sector read still pass.

The owner returned `imx` to A, completed Prep for Ship with FAT32 handoff PASS, and reported successful installation of the exact return SMI image. Full A code-flash readback matches the candidate expanded image SHA-256 `A638AAA78E7CE51C2C9DE4283B3EEB188FB17EA70FA4B77E5AECA2C8F2B12AAF`. Read-only state showed FAT32, needs Format 2, unchanged valid CID, and a passing representative sector read. The first CID-bound Format 2 request from that state was acknowledged and **FAILED at commissioned-media reopen**, phase 8, HPT status CORRUPT (5), driver status zero, open failure stage DIRECTORY (6), lane 0. No retry was issued. Deep RAM evidence shows new media generation 1 but stale active segment 1, generation 2, in all three lanes, with oldest segment 0, generation 1. Reopen could not rebuild the lane directory from that mixed chain. `tc_format()` read only sector 0 for the previous generation; FAT32 overwrote that sector while old HPT segment metadata survived. Full evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md` and its `setup-a/first-fat32-*` captures.

Commit `f51d98e7ffec36a419a1564b24924a5639dfcb84` contains the generation correction. Clean managed Debug and Release rebuilds, 110 commissioning checks, and 141 write-cut states passed. Immutable candidate `00.05.02-f51d98e7ffec-b10533f2134c` validates with manifest SHA-256 `0D28D782529BBD6761F875A7D932410F877F7E6C96B3282487FEBCBFA1B997AF`. A was programmed, verified, reset, and read back; its four-MiB flash SHA-256 `7790FC400E0FC7C57372C82CFD90915136214F6047BBAA22BC7CBDDB14CB10A0` matches the controlled IMX expansion. Its CID remained valid and unchanged. A's first Format 2 request with the corrected firmware against its previously failed card **COMPLETED** at phase 11 with proof `0x0F`, HPT/driver status zero, no reopen failure, and HPT_READY detection. This initially established recovery on a card that already had one failed attempt. The corrected return IMX SHA-256 is `1CD371F93E825B9E34AFEA8175F865E9545E6F29ECA05141A3ED706F6783E9EF`.

A then completed the ordinary corrected-SMI-to-DisplayTest update on the same card. Published DisplayTest flash matched exactly and reported FAT32_READY; Prep for Ship reported FAT32 handoff PASS. The ordinary return SMI update installed the corrected image, confirmed by full target flash readback. The expected needs-Format-2 state, unchanged valid CID, and passing representative-sector read were captured before formatting. A single current-boot CID-bound Format 2 request then **COMPLETED on the first attempt**, phase 11, proof `0x0F`, HPT/driver status zero, detection HPT_READY, and unchanged valid/readable CID. Surviving prior metadata led the corrected format to choose media generation 3. No retry was issued. Full evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md` and its `setup-a/generation-fix-first-fat32-*` captures.

B's fresh old-candidate baseline remained HPT_READY with raw CID `284245323848465102A6910D080113CF`, valid CID, and passing representative-sector read. B was programmed from the corrected candidate, reset, and read back: full four-MiB flash SHA-256 `7790FC400E0FC7C57372C82CFD90915136214F6047BBAA22BC7CBDDB14CB10A0`, unchanged valid CID and readable sector, HPT_READY. Its same-card FAT32 transition and first corrected format remain open.

## Dependencies And Boundaries

- Diagnostic and source work can proceed locally. Physical destructive formatting requires separate authorization and approved expendable media.
- No powered SD removal or insertion.
- Release 00.05.02 must include both this correction and IDEA-0008, with exact candidate identity and required release gates.

## Next Ground Task

On B, use the same-card ordinary DisplayTest transition, install the exact corrected SMI return image, and capture its first Format 2 with CID/service status and readback. Then complete graph qualification and release gates with one frozen image.
