# Program Roadmap: Firmware Service-Code SD Qualification

Status: blocked
Type: program-roadmap
Updated: 2026-08-31
Project Map: MAP-0004
Source Idea: IDEA-0001
Outcome Cycle: cec58490-b533-46a7-bbe5-10e7addba684
Requested Endpoint: work2
Next Action: add complete lane-diagnostic status capture to the focused target evidence path, then obtain fresh authority to reinitialize the installed expendable card and run a bounded service-484 reproduction that identifies the failed diagnostic bit before selecting any repository correction or new candidate

## Program Outcome

Produce a committed firmware candidate in which individual SD qualification
services and one ordered full-run service use one shared leaf-test engine, then
deploy that exact commit to an explicitly bound non-production work target and
prove its changed behavior. Preserve powered-removal safety, CID-bound run
identity, no-replay recovery, standards-based USB publication, bounded-work
evidence, and independent final qualification authority.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Freeze the qualification authority and shared test catalog | `G1-SHARED-TEST-CATALOG`, `G2-FIRMWARE-WITNESS-AUTHORITY` | none | complete; Option A, contract disposition, and catalog frozen |
| M2 | Prove pause/resume and evidence contracts in a target-independent reference model | `G3-PAUSE-RESUME-SAFETY`, `G4-EVIDENCE-PUBLICATION` | M1 | complete; eight model tests and policy checks pass |
| M3 | Integrate the shared engine, service dispatcher, journal, and publication path; build and verify bounded work | `G5-PERFORMANCE-ADMISSION` | M2 | complete; candidate `3df82f32b997022efeaba97561d7a2320dcf7997` built and packaged |
| M4 | Deploy the exact candidate to the bound development target, run focused changed-behavior/rollback checks, and register the Work2 release cohort | `G6-WORK2-DEVELOPMENT-TARGET` | M3 | blocked; authorized replacement candidate failed service 484 on target and was rolled back |

## M1 — Authority And Catalog Freeze

### Owner decision D1 — Option A selected 2026-08-31

- **A — Recommended hybrid:** firmware owns leaf-test truth, prerequisites,
  progress, safe-stop checkpoints, and technical results; the Pi/web qualifier
  owns campaign sequencing across controllers, independent power witnessing,
  evidence ingestion/admission, and reviewer/family disposition.
- **B — Firmware owns the full campaign:** simplifies offline execution but
  moves cross-controller, review, persistent evidence, and power-witness burden
  into the controller and weakens independent observation.
- **C — Pi owns the full-run order:** stays closest to the current governing
  contract but does not deliver IDEA-0001's firmware full-run service unless
  that service becomes a thin, Pi-directed leaf sequence.

The owner selected Option A. Firmware is authoritative for shared leaf-test
execution, prerequisites, progress, safe-stop checkpoints, and technical
results. The Pi/web qualifier is authoritative for cross-controller campaign
sequencing, independent power witnessing, evidence ingestion/admission, and
reviewer/family disposition. Record this split in the disposition of
`SMI-SDQ-CONTRACT-V1`. Freeze the exact 480–489 allocation only after confirming
dispatcher availability. The catalog must reuse existing CID, media
classification, scrub, lane, wrap/reclaim, recovery, endurance, export, and
mailbox mechanisms rather than create parallel test implementations.

### M1 completion evidence

- `docs/sd-card-qualification-contract.md` records selected Option A.
- `qualification/profiles/sd-qualification-service-catalog-v1.json` and
  `docs/sd-qualification-service-catalog-v1.md` freeze the 480–489 service
  allocation, seven shared leaves, ten-step order, prerequisites, safety,
  progress, stop, and result semantics.
- `script/check-sd-qualification-service.ps1` proves dispatcher completeness
  and shared individual/full-run implementation routing.
- Result: `G1-SHARED-TEST-CATALOG` and
  `G2-FIRMWARE-WITNESS-AUTHORITY` pass.

## M2 — Safety And Evidence Reference Model

- The durable journal uses the existing mirrored configuration persistence and
  binds format/state, mode, step, completion mask, run identity, firmware and
  catalog identity, and raw 128-bit CID.
- An active interruption becomes blocked and never replays automatically.
  Manual service 488 continuation is accepted only from a planned pause after
  firmware, catalog, CID, representative-sector, and media checks pass.
- Workflow, technical result, method disposition, and evidence admission are
  separate. Firmware cannot claim Pi evidence admission.
- `script/test-sd-qualification-service-model.py` passes eight tests covering
  catalog identity, shared order, external power pause, active-reset no replay,
  identity-bound manual resume, separate results, independent evidence
  admission, and bounded leaf budgets.
- Result: firmware-side `G3-PAUSE-RESUME-SAFETY` and
  `G4-EVIDENCE-PUBLICATION` contracts pass; live Pi ingestion remains M4 proof.

## M3 — Firmware Candidate

- Shared state machine, dispatcher, catalog, journal, UI safety gates, status,
  progress, and result surfaces are integrated without specimen-specific SD or
  USB production behavior.
- All new policy/model checks and the existing SD safety, scrub,
  initialization, endurance, and commissioning suites pass.
- The canonical managed clean Debug rebuild and artifact packaging passed.
- ELF SHA-256:
  `E9AF2BAF44A43FABBE58F69B0D22D6E14A34691DC955E848668C3E737E3FC08E`.
- S-record SHA-256:
  `CE2A5D2337D49CC437BFDA0C6A14BB21CD07937947AF9B6EE0DD1B4889790490`.
- Map SHA-256:
  `8A6C169C12C2F0BCA72E3769651C801045D2A71301E5E94E88A6A4B435778CC2`.
- Scoped candidate commit:
  `3df82f32b997022efeaba97561d7a2320dcf7997`; unrelated dirty work remains
  outside the commit.
- Full evidence: `docs/sd-qualification-work2-candidate-evidence-20260831.md`.
- Result: repository-side `G5-PERFORMANCE-ADMISSION` passes.

## M4 — Work2 Delivery

### Material target decision D2

The owner bound Controller A assembly `1751136`, hardware variant `0`, J-Link
`69664082`, `setup-a`, and the installed expendable card with live CID
`05000C61736466672200001C8901A34F`. The owner authorized exact candidate
`3df82f32b997022efeaba97561d7a2320dcf7997`, a predeployment 4 MiB rollback
capture, the focused 480/481/483–486/488/489-through-recovery checks, and the
qualified whole-controller interruption. Service 487, powered SD movement,
production release, and family qualification remained excluded.

Candidate deployment and independent full-flash readback passed. Services 480,
481, and 483 through 485 passed, including the negative destructive-
confirmation check. A qualified Group A power cycle then proved durable
no-replay restoration, unchanged CID, healthy raw-HPT reopen, and an underlying
controlled recovery pass. Service 488 accepted continuation only after the
expected sequence/boundary was published and all resume validations produced
mask `0x3F`.

M4 failed because service 486 remained `WAITING /
EXTERNAL_COORDINATOR_REQUIRED` after the synchronous diagnostic reached
`RECOVERY_PASSED`. The qualification poll requires prior observation of a
transient active state, but the SD thread executes the complete synchronous
recovery between its before/after qualification polls. It therefore observes
idle-before and passed-after, never sets the active-observed flag, and never
finishes the leaf. Service 489 was not started.

### Service-486 remediation candidate

Replacement candidate `d22dac133a7e2f64ac3b65dd512c9e2577cc3bb9`
binds the synchronous recovery producer's `RECOVERY_RUNNING` transition
directly to an issued controlled-recovery leaf only while that leaf is waiting
or running. The terminal poll still requires that producer-bound observation,
so stale terminal diagnostic state cannot finish a newly started leaf. The
sequence/boundary, firmware/catalog, CID, representative-sector, media-state,
manual-continuation, no-replay, and external evidence-admission gates are
unchanged.

The focused service contracts, eight model tests, SD safety, scrub,
initialization-mailbox, endurance, commissioning, and lifecycle suites pass.
The canonical managed Debug rebuild, stable/versioned packaging, and clean
firmware-bundle validation pass with these exact identities:

- ELF SHA-256:
  `A3D5EA99D6C9F5C5F61D1EA799B878282DCB789FE181682A7293954DB01178B5`;
- S-record SHA-256:
  `32281EBC258F7FCC9241FB1899DB5068AD2219B9F75CD859B32FF5FCBDF310E5`;
- map SHA-256:
  `C2A3A4F69E949F88FEBF3DB5C34856495AE3546922FDDB42FDD9F70806EE14A0`;
- clean source snapshot SHA-256:
  `66C67D32C73193796A358920AD80A2FC64B05525483AB3D0749932531F1F9DA9`;
- bundle manifest SHA-256:
  `D74AEA1DCA7DB3EB22877200A5E6B1FBE81C20ACDF7FFFAC37BE1731D0EDB477`.

Full repository-side remediation evidence is in
`docs/sd-qualification-work2-m4-remediation-candidate-evidence-20260831.md`.
No target or remote coordinator state changed while producing this candidate.

### Replacement-candidate target repeat

The owner retained the prior Controller A, live-CID, rollback, focused-scope,
power-interruption, exclusion, and coordinator envelope and explicitly
authorized candidate `d22dac133a7e2f64ac3b65dd512c9e2577cc3bb9`, S-record
SHA-256
`32281EBC258F7FCC9241FB1899DB5068AD2219B9F75CD859B32FF5FCBDF310E5`.

The live target again reported CID `05000C61736466672200001C8901A34F`,
detection state `READY`, CID-valid `1`, and representative-sector-read `1`.
The fresh 4 MiB rollback capture hash was
`15DF631AE4C7887F22A72AFCDD95DEF96DD4D78620CAB21F76715E9433D4F214`.
Serial-bound programming succeeded, and the independent 4 MiB candidate
readback matched the expanded authorized S-record exactly at
`46CBAC3C0CD029191A706FF51619CCC3EE0354ADC68DBAD7AA77EDA751EEE476`.

The replacement candidate passed target health, service 480, service 481 at
2/2 work units, the unconfirmed-service-483 negative guard, and confirmed
service 483. Confirmed service 484 then completed 10/10 work units but returned
technical `FAIL`, workflow `BLOCKED`, and terminal reason `LEAF_FAILED`.
Fail-fast execution stopped before services 485, 486, 489, or a power
interruption; service 487 remained excluded.

The exact immediate predeployment 4 MiB capture was restored and independently
read back with the same
`15DF631AE4C7887F22A72AFCDD95DEF96DD4D78620CAB21F76715E9433D4F214`
hash. Controller A no longer carries the candidate. The focused helper retained
the qualification, CID, detection, and HPT-media objects but omitted the
volatile underlying lane-diagnostic object, so this run proves a service-484
failure without identifying its failed diagnostic bit. Full evidence is in
`docs/sd-qualification-work2-m4-repeat-target-evidence-20260831.md`.

A terminal post-restore capture then proved the same CID with CID-valid and
representative-sector-read flags both `1`, but detection state
`NEEDS_INITIALIZATION` and HPT media state/status `CORRUPT_OR_UNKNOWN` / `5`.
The controller-flash rollback is exact; the authorized destructive leaf did
not preserve a mountable HPT2 store on the expendable card. The card was left
installed and untouched. A controlled HPT2 reinitialization is now a required
precondition for another HPT-ready leaf and requires fresh explicit authority.

The exact predeployment 4 MiB flash capture was restored and independently
read back with matching SHA-256
`15DF631AE4C7887F22A72AFCDD95DEF96DD4D78620CAB21F76715E9433D4F214`.
Controller A is running the restored firmware and the CID remains unchanged.
The SD Qualifier ingested the immutable failed-run package at
`evidence/raw/prm-0006/m4-controller-a-20260831` without runtime, database, or
campaign mutation. Full evidence is in
`docs/sd-qualification-work2-m4-target-evidence-20260831.md`.

`G6-WORK2-DEVELOPMENT-TARGET` remains blocked. Do not register a release cohort
from either failed target run. Add complete lane-diagnostic status capture,
then obtain fresh explicit programming, media-reinitialization, and
destructive-leaf authority for a bounded service-484 reproduction before
selecting a correction or producing another candidate.

## Deferred Beyond Work2

- production push, tag, release, or promotion;
- card-family qualification credit or final family disposition;
- ECR/ECO, sourcing, BOM, pilot, or rollout decisions;
- physical destructive qualification not separately authorized.
