# Project Map: SMI 00-05-01 Transition Floor And Controlled Return

Status: active
Type: project-map
Updated: 2026-09-24
Source Idea: IDEA-0007
Technical Source: IDEA-0006
Requested Endpoint: source completion plus authorized A/B bench qualification; release and publication remain separate
Next Action: Preserve the owner-closed 00-04-11 incident as history. Keep release on hold; only interruption/timeout evidence limits need a future disposition. No further bench test is scheduled.
Campaign: standalone
Initial Target Control: Controller A

## September 24 current bench closeout — current state

The corrected source and immutable candidate are committed and locally registered with this open ownership chain. A/B corrected transitions, A warning Cancel, B initialization, logging/CSV/restart retention, and B ordinary DisplayTest return passed. B fixture NVRAM Status and Test Status were OK/OK after the owner's power cycle; fresh remote post-restart CID is unavailable because J-Link 69660123 is missing. G-APPROVED-IMAGES, G-SMI-CANDIDATE and bounded G-DISPLAYTEST-RETURN are satisfied. Current canonical detail is `docs/firmware-update-validation-and-recovery.md` and `work/evidence/smi-current-release-gate-review-20260924.json`.

A malformed-header-CRC image was refused on A with File Error 901 at header step 2; exact main flash, CID/HPT2 and SD diagnostics matched baseline. The idle USB reinsertion attempt navigated to the next picker file and did not exercise stale-selection refusal. The owner removed that specific test as a release requirement. The temporary malformed image was removed from IMX3; all five retained image hashes match and the drive is unmounted. The owner reports multiple later successful updates from 00-04-11 and closes its earlier Success-with-unchanged-flash incident without further resolution work; the original cause remains unknown. G-DUAL-CONTROLLER-TRANSITION remains open for explicit disposition of in-flight SD/flash fault behavior and the historical CID/warning capture limits. No destructive fault injection is inferred. The owner explicitly withheld firmware release authorization on September 24. Release-cohort freeze, preflight and publication are deferred; the proposed evidence dispositions are not approved gate passes. Earlier next-action paragraphs below are historical.


## September 24 B controlled return verified — latest state

B's corrected-candidate forward/return cycle is PASS. The owner reported Update Success and About 01-01. Final complete flash matches controlled DisplayTest main SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`; the same full CID `05000C61736466672200001C8201A379` is valid, driver ready, FAT32-ready with storage status 0, and update/format/test requests idle. The earlier unchanged-SMI capture followed only the USB move, before the owner started the update; it is not a failed return. That capture independently verifies the exact corrected SMI source image. Combined with explicit Format 2 initialization, fresh logging/history, the independently checked seven-record CSV and confirmed restart retention, this closes the bounded B transition/storage matrix. B remains on DisplayTest 01-01 with IMX2 connected. Evidence: `work/evidence/smi-b-corrected-forward-20260924.json`. Both USB drives were cleaned under the owner detour; obsolete fixture 00-99/01-00 and SMI 00-05-00 copies were backed up and removed, with the retained images hash-verified. Do not replay these completed cycles. Release remains open for applicable refusal/fault evidence disposition, warning/legacy-CID and legacy Success limitations, corrected-image provenance requirements, release preflight and the separate release decision. No overall release or lifecycle completion is claimed. This supersedes pending B return and earlier next-action statements below.

## September 24 B logging, export and retention verified — latest state

B completed corrected SMI 00-05-01 boot, explicit service-471 Format 2 initialization, fresh graph/history and normal USB export. The read-only host CSV check verified seven healthy rows, a complete footer and SHA-256 `61DC29AA512646F77A187DC161C6E4D12BD5846BB2E3AA8ADCA82F3AE9DDD561`; both IMX2 image hashes still match the controlled SMI and DisplayTest images. The owner then explicitly power-cycled B and confirmed earlier history remains. Fresh capture shows the same full CID `05000C61736466672200001C8201A379`, detection/CID/sector 5/1/1, HPT2 ready, completed chart with real data and 29 selected records, unchanged retained oldest bounds, three new postboot records and zero postboot dropped records. Update/export requests are idle. These bounded logging/export/retention checks pass. No new SMI full-flash readback is claimed; installation provenance is the unchanged hash-verified IMX plus owner boot report. Evidence: `work/evidence/smi-b-corrected-forward-20260924.json`, CSV `work/evidence/smi-b-customer-export-20260924.csv`. Next is the controlled B ordinary return to DisplayTest 01-01, with explicit FAT32 erase warning; only the sampled exported history is preserved by this CSV. Remaining refusal/fault evidence and explicit release dispositions remain open. This supersedes pending B forward/logging/export/retention and old next-action statements below.

## September 24 B DisplayTest entry verified — latest state

B's first ordinary DVO-to-DisplayTest attempt failed with exact DVO flash unchanged. The owner then power-cycled B and repeated the same DisplayTest 01-01 image from unchanged IMX2. The owner reports success/About 01-01; fresh complete flash matches `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. Fresh same-card CID `05000C61736466672200001C8201A379` is valid, driver ready, FAT32-ready with storage status 0 and idle update/format/test requests. No separate representative-sector read was issued. The first error and causal reason for recovery remain unconfirmed; no DVO investigation is reopened. Evidence: `work/evidence/smi-b-displaytest-entry-after-restart-20260924.json`. Next: DisplayTest Home > Lockout > Install Software, select corrected `7520553_SMI_00_05_01.imx` from IMX2. Stop after boot for full flash/CID verification before Format 2 initialization. This supersedes pending retry statements below.

## September 24 B DisplayTest entry retry — latest state

The owner confirmed B About (DVO 00-04-02, assembly 1751219), unchanged IMX2 images and the same test SD card. The ordinary DisplayTest 01-01 attempt failed. Complete read-only post-attempt flash matches exact unchanged DVO SHA-256 `8DC55368026649523FC751B09A6C99F47FD015251D1B0A6BE7F6CBC9DE44DAD6`; CPU halt remained clear. CID unavailable for the recorded legacy-DVO reason. The owner requested one retry of the same image on IMX2. Result pending; exact first error and root cause are unconfirmed. No new DVO investigation or production compatibility rule is authorized. Evidence: `work/evidence/smi-b-qualification-baseline-mismatch-20260924.json`. This paragraph supersedes the pending-media/baseline next actions below.

## September 24 approved freeze and fresh B baseline — current state

The owner approved the scoped corrected-candidate commit/freeze and remaining documented B/fault qualification. Commit `b59c33d1c1f4f1f556ae9ab64a798842fc9b07d1` contains only the seven reviewed source/test paths and four firmware outputs. Clean canonical Debug and Release rebuilds reproduced the committed ELF/SREC bytes. The release validator and focused checks pass. Immutable candidate `00.05.01-b59c33d1c1f4-3f464c236471` validates against HEAD; manifest SHA-256 `A993138CF15F33ABA70231AFE87D5DDF8C531871F1E36C19374E61EF5619000C`. Repackaging reproduces corrected IMX `4E4321E5BDA3942BF70ED9304B935DF33DC40E5FA1E9B8A4AEF60DCA6ED3B97A`. The source/immutable-freeze portion of G-SMI-CANDIDATE is complete; remaining qualification and release controls are open.

A's completed corrected-image transition, HPT2 restoration and Cancel evidence remains applicable by exact byte identity; do not replay it. Earlier A logging/history/export/retention remains evidence for the earlier AF8132D1 image and unchanged HPT2 subsystems, not a relabeled exact-byte test. Updater-path changes still require the remaining B pairing. See `work/evidence/smi-corrected-candidate-freeze-20260924.json` for the change-impact rationale and hashes.

Fresh B readback through probe `69660123`, port `19121`, is **DVO 00-04-02**, complete flash SHA-256 `8DC55368026649523FC751B09A6C99F47FD015251D1B0A6BE7F6CBC9DE44DAD6`, matching the saved legacy DVO image rather than yesterday's corrected SMI checkpoint. No halt/reset/program/write was issued. CID unavailable: this DVO image lacks service 467 and no trustworthy matching identity map is available. Captured SMI-address RAM is not interpreted. B SD format, data disposition and USB identity remain unverified. The historical SMI/HPT2 pass remains valid history; it is not today's live state. Evidence: `work/evidence/smi-b-qualification-baseline-mismatch-20260924.json`.

Next action: Confirm B current About, USB label and intervening firmware/card changes, then continue the controlled DisplayTest 01-01 to corrected SMI pairing; preserve completed A evidence and resolve only remaining B/fault and release evidence gates. The selected initial image is `7520708_DispTest_FW_01-01.imx`; the operator was told to stop before confirming installation pending target/media reconciliation. No physical SD move is requested. The owner-closed DVO USB investigation stays closed. Release/publication remain separate; preserve all four gate IDs and open MAP-0009/IDEA-0007 outcomes. Earlier authority/candidate/next-action paragraphs below describe prior checkpoints and are superseded by this capsule.

## September 24 A Cancel closeout — historical checkpoint

A's owner-started ordinary downgrade from corrected 00-05-01/HPT2 reached exact controlled 00-04-11 flash. The separately authorized ordinary return reached exact corrected main flash `1ACC79159FCD3F97BD994AA086106348BEC6B418A87A8C409B707156978BFC2D`. Separately authorized service 471 completed with reason 0, phase 11 and proof 15, restoring the same CID `05000C61736466672200001C8901A34F` to HPT2 ready with block media and store open.

The originally requested final-warning Cancel was then exercised. The owner reported return to Settings. The post-cancel capture proves the same exact corrected flash and full CID identity, HPT2 ready/open, idle requests, and unchanged initialization/format diagnostics. This bounded A warning/cancel gate is PASS; do not repeat it. The owner reports expected screens; exact warning transcription is not claimed. Legacy post-downgrade CID remains explicitly unavailable because 00-04-11 lacks service 467 and a trustworthy matching release-symbol identity map.

Evidence: `work/evidence/smi-a-warning-cancel-20260924.json`, including fresh before/after CID blocks, exact flash hashes, command logs and matched-symbol read-only captures. Canonical truth: `docs/firmware-update-validation-and-recovery.md`. Earlier current-state paragraphs are superseded by this closeout where they still call A Cancel, this return or HPT2 restoration pending.

Release remains open: corrected source is not frozen into the immutable candidate; B's missing transition/logging/export/retention and applicable negative/fault coverage, earlier-byte evidence applicability and legacy Success/evidence-limit disposition remain. A's completed tests do not close all dual-controller gates. No new hardware operation, format, power action, staging, commit or publication is authorized. Keep MAP-0009 and owning IDEA-0007 outcomes open; preserve abandoned work and the owner-closed DVO disposition.

## Current release-gate reconciliation — 2026-09-24

SMI 00-05-01 remains NOT PRODUCTION RELEASED. This capsule and the linked current release-gate review supersede earlier candidate, policy, pending-test and next-action statements. Dated observations below remain history; do not replay their completed tests or use them to override newer evidence.

The corrected IMX SHA-256 is `4E4321E5BDA3942BF70ED9304B935DF33DC40E5FA1E9B8A4AEF60DCA6ED3B97A`, complete main flash `1ACC79159FCD3F97BD994AA086106348BEC6B418A87A8C409B707156978BFC2D`. Local IMX hashing reconfirmed it on September 24. The second CID capture now occurs only after format/reopen. A installed this image, passed an ordinary retained-FAT32 downgrade to exact 00-04-11 and an ordinary return to the corrected image, then restored same-CID HPT2. B installed the same exact image and restored its own same-CID HPT2. Both raw stores were open and updates idle at the last September 23 captures. No new bench action or fresh live-state claim is made in this review.

The owner-directed ordinary updater and service 151 share admission, picker, confirmation and worker. Valid older SMI can use the ordinary path with target-driven FAT32 preparation; the former blanket ordinary personality floor/service-only downgrade is superseded. Missing/unreadable/busy required media and invalid identities fail closed. Verified FAT32 is retained; another readable layout is formatted only after explicit consent. DisplayTest 01-00 remains excluded; SMI 00-05-00 remains blocked/abandoned. No CVO/DVO release or firmware work is implied.

The retained-FAT32 901 cause and its bounded correction are separate from the earlier legacy 00-04-11 Success-with-unchanged-flash. That legacy observation remains unisolated despite the later exact return pass. Final retained-FAT32 warning wording and legacy post-downgrade CID were not captured; service 467 is unavailable in 00-04-11. Preserve these limits for explicit disposition, not invented evidence or automatic retest. DVO's intermittent legacy 901 investigation stays owner-closed with the alternate-verified-USB-stick workaround. A post-install power cycle is accepted behavior, not standing authorization for a new power action.

The corrected source is still dirty/uncommitted. The immutable candidate pointer still selects historical `00.05.01-1bf8afe6aeba-6476100e5ae5`; no active release cohort/register exists for the corrected image. Freeze, exact-candidate evidence applicability, warning/cancel and applicable refusal/fault-recovery coverage, remaining B transition/logging/export/retention, evidence-limit disposition and a separate release decision remain open. A's earlier fixture/return/logging/export/retention passes are credited at their recorded hashes; transfer requires a change-impact rationale, not relabeling them as corrected-image tests.

The smallest open bench action is a current-A ordinary warning/cancel-only check, after a fresh serial-bound matched-firmware/CID/idle baseline, verified target media and a reviewed safe cancel point. Stop before install confirmation; verify unchanged flash, CID, HPT2 and idle requests after cancel. It cannot recreate the missing retained-FAT32 prompt while the card is HPT2. No programming, formatting, power operation, SD swap, staging, commit or publication is authorized here. DisplayTest stays read-only and unrelated abandoned work stays abandoned.

Canonical gate matrix and prerequisites: [current release-gate review](docs/firmware-update-validation-and-recovery.md#current-release-gate-reconciliation--2026-09-24). Primary evidence: `work/evidence/smi-retained-fat32-correction-candidate-20260923.json` and `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`. MAP-0009 and its owning IDEA-0007 outcome remain open; no lifecycle completion is inferred.

## A normal forward and accepted ordinary return completed — 2026-09-23

Controller A completed exact DisplayTest 01-01 to accepted SMI 00-05-01 normal installation, explicit HPT2 initialization, fresh logging/history, six-row healthy customer USB export with independent CSV hash/content check, and post-restart HPT2 retention. Its ordinary SMI-to-DisplayTest return selected exact `7520708_DispTest_FW_01-01.imx`, accepted the conditional FAT32 warning, and yielded a complete four-MiB readback matching the controlled DisplayTest payload SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. A is FAT32-ready with the unchanged complete CID `05000C61736466672200001C8901A34F`; focused SD read/write passed. The first DisplayTest NVRAM screen showed Read Error / Not Tested. After an owner-operated restart, both displayed statuses and read-only target flags were OK/OK, with CID/FAT32 unchanged. The owner accepts a power cycle after new firmware installation and requests no mitigation. No Erase EEPROM service or firmware change was performed. The owner also confirmed post-return About 01-01, responsive Home touch and no FAT32 warning. Evidence: `work/evidence/smi-a-hpt2-post-restart-retention-20260923.json`, `work/evidence/smi-a-customer-export-20260923.json`, `work/evidence/smi-a-ordinary-displaytest-return-nvram-hold-20260923.json`, `work/evidence/smi-a-displaytest-nvram-restart-resolution-20260923.json`, and the SMI handoff ledger.

The A forward and ordinary return path passes with the accepted post-install power-cycle behavior. A below-floor refusal, representative service rollback and fault/recovery tests, plus B forward/return and remaining release evidence, are open. The DisplayTest SD Qualification Full Run was not performed or claimed. Earlier dated NVRAM-hold sections below record the resolved first-boot observation.

## A ordinary DisplayTest return has an NVRAM hold — 2026-09-23

The owner selected exact `7520708_DispTest_FW_01-01.imx` through the ordinary SMI Settings updater, confirmed the conditional FAT32 data-loss warning, and reported Update Success. A read-only full-flash capture matches the controlled DisplayTest 01-01 payload SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. A is FAT32-ready with valid unchanged CID `05000C61736466672200001C8901A34F`, no storage error, and a focused SD read/write PASS. The owner then supplied a photo of the DisplayTest NVRAM screen: “NVRAM Status: Read Error” and “Test Status: Not Tested.” Read-only target flags confirm invalid NVRAM and no completed power test. Evidence: `work/evidence/smi-a-ordinary-displaytest-return-nvram-hold-20260923.json` and the handoff ledger.

The matched sources show SMI writes 1,028-byte SPI NVRAM records, whereas DisplayTest 01-01 reads/writes 1,024-byte records with a different CRC position. A first-boot format mismatch is plausible, but SPI/hardware failure remains possible. DisplayTest only updates the validity flag on boot and periodically writes its own format. The owner proposed Service > Erase EEPROM; that service zeros configuration data flash, not SPI NVRAM, so it has not been run. A separately authorized DisplayTest restart is the focused discriminator. The ordinary A return image and FAT32 transition passed, but end-to-end return qualification is held pending NVRAM resolution and operator-facing checks. A refusal/rollback/recovery and B remain open. Earlier return-pending sections below are history.

## A HPT2 post-restart retention verified — 2026-09-23

The owner explicitly approved an A power-off/restart with the SD card installed and USB absent. A matched-SMI 10:33 baseline showed HPT2 ready, same complete CID `05000C61736466672200001C8901A34F`, retained oldest normal record sequence 2, live chart data and no pending update/export. The owner reported A booted 00-05-01 with pre-restart history visible. Fresh 10:35 read-only state found the same valid CID and representative-sector read, HPT2 ready, completed chart cache, retained oldest record sequence 2 / HPT timestamp 306930000, and 16 selected records in the postboot chart rebuild. New queued logging resumed with two completions and no drops since boot. Preboot cumulative counters reset on boot and are not compared directly. Evidence: `work/evidence/smi-a-hpt2-post-restart-retention-20260923.json` and the handoff ledger.

The A normal forward installation, HPT2 initialization, fresh logging/history, customer USB export with host CSV validation, and focused post-restart retention gates have passed. The USB CSV copy is preserved under SMI evidence; the drive is unmounted at the Pi. Next is the controlled ordinary A return to DisplayTest 01-01 with explicit FAT32 media preparation and fresh CID/status checks. A refusal/rollback/fault matrix and B remain open. No SD Qualification Full Run pass is claimed. Earlier dated retention-pending sections below are history.

## A customer HPT2 export and independent CSV check passed — 2026-09-23

On A, ordinary History/Graph showed recent records. The first Settings > Export Log attempt was rejected as “Range too short” before an export request. The owner retried the 10:20–10:26 controller-clock range and reported Success. Matched-SMI read-only status shows request 1 published, complete 1, USB status 0, final USB phase complete, six healthy records selected with no gaps, and no active export. The `IMX2` USB drive was mounted read-only on `srv-rpi00.local`: the 975-byte CSV contains six 10:21–10:26 minute rows and a COMPLETE footer matching target status. Its local evidence copy has the same SHA-256 `28C0D6E2005F868B76BC2EB77219DE67CC894E57B42354996D605E85FA8A041A`; the drive was unmounted cleanly. The A baseline and post-format result link the unchanged complete CID `05000C61736466672200001C8901A34F`. Evidence: `work/evidence/smi-a-customer-export-20260923.json`, `work/evidence/smi-a-customer-export-20260923.csv`, and `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

This closes A's normal fresh logging, history view and customer export/content gate. The next A test is post-restart HPT2 retention, which requires separate owner authority for a controller power operation. Then A return/refusal/rollback/fault recovery and B transition gates remain. No SD Qualification Full Run pass is claimed. Earlier dated export-pending sections below are history.

## A HPT2 ready and fresh logging verified — 2026-09-23

The owner reported SMI Format 2 **Success / log records erased**. A read-only matched-SMI capture found initialization complete, HPT2 ready, valid representative-sector read, and the unchanged complete CID `05000C61736466672200001C8901A34F`. Subsequent A captures showed acknowledged records rising from the one commissioning record to four, valid retained bounds, completed initial chart load, and live chart real data. The owner confirmed recent records are visible in the normal History/Graph view. The cumulative dropped-log count was five at 10:24 PDT; its timing is not established and remains an observation for follow-up. Evidence: `work/evidence/smi-a-post-forward-hpt2-initialization-20260923.json` and `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

This closes A's explicit HPT2 initialization and fresh logging/history view after the verified normal forward installation. Customer USB export/content validation, post-restart retention, return/refusal/rollback, fault/recovery and B remain open. The SD Qualification Full Run has not been performed or claimed. Earlier dated format-pending sections below are history.

## A normal DisplayTest-to-SMI forward transition verified — 2026-09-23

The owner completed the native DisplayTest FAT32 format and SD read/write, confirmed responsive Home touch after the affected sequence, and entered Prep for Ship/Lockout. Read-only A state confirmed FAT32 handoff PASS, unchanged valid CID `05000C61736466672200001C8901A34F` and USB ready. `IMX2` on-drive SMI 00-05-01 and DisplayTest 01-01 files were independently hash-verified on a Pi read-only mount; the drive returned to A.

The owner selected `7520553_SMI_00_05_01.imx` through Lockout > Install Software and reported Success. A read-only complete four-MiB internal-flash capture has SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`, exactly matching the accepted SMI Release candidate and controlled IMX main payload. Matched SMI RAM state has A assembly 1751136, same valid CID, representative-sector read valid, FAT32 needs Format 2, no initialization request and no update request. The owner confirmed 00-05-01 Home/About and the expected Format 2 warning. This closes the A forward installation gate, not the separate HPT2, return, refusal, rollback, fault, retention or B gates. Structured evidence: `work/evidence/smi-a-normal-fixture-install-20260923.json` and handoff ledger `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

The owner declared the card history expendable and continued the reviewed sequence. The operator has been instructed to use SMI's explicit two-stage Format 2 warning/service-471 flow and report its terminal result. No initialization pass is inferred before that result and a fresh CID/status capture. Older dated pause/missing-image/format-pending paragraphs below are historical.

## A transition execution checkpoint — 2026-09-23

The owner declared the retained HPT2 history expendable, reviewed the concrete sequence and said to continue. A FAT32 preparation and the normal SMI installation are authorized within that sequence, subject to their verification stops. The owner reports `IMX2` at A and can use A's touchscreen. SMI can read the J-Link state but has no approved touchscreen control path; the operator was given the native `System Test → SD Card Test → Format SD as FAT32?` step with its left confirmation.

Read-only A baseline at 09:48 PDT reconfirmed exact DisplayTest 01-01, assembly 1751136, serial 69664082, unchanged valid CID `05000C61736466672200001C8901A34F`, ready HPT2, cached valid sector approval, and idle update/format/SDQ request flags. Another read-only capture at 09:55 PDT showed card state 2 (HPT2), format request 0 and format result 0. Thus no format completion can be claimed. The SD read/write result field of 2 is pre-existing/stale; no such test was requested in this SMI execution. No install or power operation occurred. Raw captures: `work/evidence/generated/smi-displaytest-takeover-20260923-094826/` and `...-095550/`.

On reported format completion, capture fresh CID, protocol/card state, CID validity, representative-sector evidence and format status. Stop on CID change or failure. Then run only the affected FAT32 SD read/write–Home touch sequence, verify fresh FAT32 Lockout handoff, and check exact SMI IMX bytes on `IMX2` before the normal installation. The A/B release matrix remains open. `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md` is the SMI evidence ledger; prior handoff and paused statements below remain history.

## Current handoff reconciliation — 2026-09-23 09:27 PDT release

Coordination is resumed from SMI; live takeover is verified, with card-data disposition and explicit hardware-action authority still pending. DisplayTest released A with no pending operation, running 01-01 on assembly 1751136 / probe 69664082 with retained HPT2 CID `05000C61736466672200001C8901A34F`. Its controller-generated IMX, source `da955dc92a1652eba247f07b32d154b4b7001e02`, is now controlled at SHA-256 `E11CEB483BA478F6A3D98F75DBF303EA09800165463EFE17880D5CDB2ACD78AB`; local hashing matched it and the accepted SMI IMX. The missing-image prerequisite is complete.

Credit existing SMI candidate/UI/export and resolved updater evidence, plus DisplayTest HPT2 startup, export, scoped navigation and Card Identity; do not replay them. Full SD Qualification was not run and is not required merely for this transition. The affected SD read/write–then-Home touch sequence and verified FAT32 production handoff remain open.

Live read-only takeover succeeded at 09:40–09:41 PDT after the earlier DNS failure. Serial-bound A / assembly 1751136 / probe 69664082 has exact DisplayTest 01-01 main-flash SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. HPT2 is ready, driver CID valid, raw CID unchanged, cached sector-zero approval valid, and captured update/format/SD-test/SDQ request flags idle; FAT32 handoff remains NONE. See `work/evidence/smi-displaytest-live-takeover-20260923.json`. No halt/go/reset/program/power/format command was issued; J-Link initialization reported a low-power wake. The smallest open SMI-owned test is A's ordinary DisplayTest 01-01 → accepted SMI 00-05-01 installation through verified FAT32 fixture handoff. The retained HPT2 card first needs a recorded preservation/archive or expendable-data decision and explicit erase consent; an IMX export does not preserve SD history. After authorization, minimal FAT32 preparation and the focused affected touch check can supply that prerequisite without Full Run. Programming, power operations and formatting are not authorized by this handoff or reconciliation.

Remaining exact-candidate A/B forward/return, refusal/renamed-file, representative rollback, fault/recovery, initialization, logging/history/export and retention gates remain open. Earlier dated pause/missing-image statements below are history superseded by this capsule; prior owner-abandoned commitments remain abandoned. Evidence and the concrete next-step sequence: `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

## Outcome

Deliver a safe SMI 00-05-01 update floor, a direct controlled SMI rollback, and a safe return to revised DisplayTest. Preserve normal DisplayTest FAT32 handoff and explicit SMI HPT2 initialization. Qualify all transitions on both controller assemblies before any release decision.

## Direction and boundaries

1. Use CRC-validated IMX Title family/version identity plus MachineMask, layout, size and payload checks; the external filename is only a discovery label. Ordinary Update Software and service 151 share the current admission and confirmation flow. Valid older SMI is admitted through the ordinary path with target-driven media preparation; do not restore the superseded service-only restriction.
2. Retain verified FAT32; format another readable layout only for an admitted FAT32 target after explicit data-loss consent. Missing, unreadable or busy required media stops admission. Validate/stage the image, recheck CID and representative sector, prepare media, revalidate staged CRCs, then replace flash. The retained branch must not read CID through a closed raw driver.
3. Service 471 remains explicit HPT2 recovery when SMI remains bootable with usable UI. No promise covers recovery after internal-flash replacement starts.
4. DisplayTest 01-01 remains the controlled external return/handoff dependency; its project is read-only here. DisplayTest 01-00 and SMI 00-05-00 are excluded from target qualification. No Full Run merely to supply this transition.
5. CVO/DVO delivery is outside this project. Preserve owner-closed DVO 901 disposition and no specimen-specific production behavior.

## Execution sequence

Preserve completed A evidence and idle HPT2 state; prepare the exact corrected-candidate freeze scope for separate commit authority, then address only missing B/applicable fault coverage and explicit evidence-limit dispositions before release.

A final-warning Cancel and the current run's downgrade/return/HPT2 restoration are now evidenced. Do not replay them. Preserve the four stable readiness gate IDs and all remaining evidence limitations; no gate or outcome is force-closed.

## Readiness gates

- G-APPROVED-IMAGES: corrected SMI `4E4321E5…` and controlled DisplayTest `E11CEB48…` bytes are available; corrected-image export provenance/applicability remains explicit. The old service-150 export is not a corrected-image export.
- G-SMI-CANDIDATE: corrected managed builds/host checks and exact A/B installs are evidenced, but corrected source freeze and immutable candidate identity remain open. The current pointer is an older bundle; no corrected release cohort exists.
- G-DISPLAYTEST-RETURN: credit earlier A return, FAT32 handoff, touch and accepted restart. Evaluate corrected-shared-updater applicability and remaining B pairing; do not claim the separate DisplayTest lane delivered from SMI evidence alone.
- G-DUAL-CONTROLLER-TRANSITION: corrected A retained-FAT32 downgrade/return and A/B installation/HPT2 readiness pass. A warning/Cancel is now verified. Applicable refusal/fault recovery, missing B transition/logging/export/retention, earlier-byte evidence applicability and the legacy Success/evidence-limit disposition remain open.

All four stable gate IDs are preserved. Details and exact prerequisites are in the current release-gate review. No release decision, lifecycle completion or approved waiver is recorded.

## Controller A qualification image inventory

| Role | Controlled specimen status |
| --- | --- |
| FAT32-era direct service rollback | SMI `00-04-11`, controlled DisplayTest-project specimen SHA-256 `1A83853002168B373FE756FF090F4364E9D82039D247E12678E842643C6AB274`; verify exact bytes on target media before use. |
| DisplayTest return refusal | DisplayTest `01-00`, separate workspace Debug IMX SHA-256 `05059BFBB74C8B785BAD559743316667AB0BAC7F51D49CDE3347F8F85D8F4A78`; read-only inventory, below the return floor. |
| Forward install and permitted DisplayTest return | Accepted SMI candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` is frozen from commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`; its Release S-record SHA-256 is `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`. Controller A service 150 generated `7520553_SMI_00_05_01.imx`, 8,388,864 bytes, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`; its main payload exactly matches the candidate. DisplayTest `01-01` controller-generated IMX is available in the separate workspace Debug directory, SHA-256 `E11CEB483BA478F6A3D98F75DBF303EA09800165463EFE17880D5CDB2ACD78AB`, source `da955dc92a1652eba247f07b32d154b4b7001e02`; local hash verified 2026-09-23. |

These hashes identify test specimens and do not create firmware allowlists. The owner confirmed that SMI 00-05-00 was never deployed on a production controller and is outside this transition qualification. Its ordinary-floor rejection is covered by focused host policy tests; it will not be installed as a bridge. Both current controller-generated images are now identified and checked. Image availability does not qualify either transition or authorize installation.

## Current limits

The owner clarified on 2026-09-22 that neither controller initially ran SMI and therefore neither supported SMI service 467 in the pre-program DVO state. The owner then explicitly authorized overwriting Controller A and Controller B with SMI firmware. A pre-program CID block is recorded as `CID unavailable: installed DVO firmware has no service-467/equivalent mapped state`; the card remained installed, and post-program SMI captures supply current identity. The owner also clarified that service rollback accepts any valid SMI image and DisplayTest return requires 01-01 or later. The published DisplayTest `01-00` release tests and initializes HPT2 media for production, so it does not meet this directive's FAT32 production handoff and is below the return floor. Select exact qualification specimens before physical testing; no image-version allowlist is required for software implementation. Incomplete gates stay open and visible.

## 2026-09-22 target designation

Controller A remains the initial target control and Controller B follows for the dual-controller gate. A read-only four-MiB Controller A DVO rollback capture was retained before programming. After a fresh serial-bound inventory, Controller A was programmed with the manifest-bound SMI 00-05-01 Release candidate. No SD card was moved and no power operation or SD write occurred during this program step.

## 2026-09-22 rollback boundary review

The source review found that the USB updater could time out while the SD worker still had a pending or active FAT32 preparation, falsely reporting failure before a later card format. The updater now waits for the SD owner's terminal result once preparation is requested. The final read-only USB media flush remains telemetry rather than an image-admission gate after full payload and staged QSPI CRC verification. The canonical Release rebuild, 16 update cases, and 19 review checks pass. This does not prove SD-worker liveness or target fault behavior; the Controller A fault matrix remains open.

The separate DisplayTest project's newer Controller B record includes a five-minute export with newly written and read SMI `00-04-11` FAT32 records. Post-restart retention was not checked. That pairing evidence does not qualify the SMI `00-05-01` A/B transition.

## 2026-09-21 source checkpoint

The SMI source version is now 00-05-01. The ordinary update path parses family and two consistent numeric version spellings from the CRC-checked Title, checks the 00-05-01 personality floor and DisplayTest 01-01 return floor, and refuses malformed, unknown, or older identities before the first install QSPI erase. It does not use the USB filename as identity. A distinct controlled direct-rollback path accepts any valid SMI image. A pre-00-05-00 image is fully staged before the SD owner rechecks CID and representative sector, prepares FAT32 in place, and lets USB recheck the staged CRCs before internal-flash replacement. The managed Release rebuild and subsequent incremental build pass; the existing 16-case firmware-update negative corpus and 19 code-review checks pass. This was a source-only checkpoint; later sections supersede its target-evidence status. No controller programming or SD operation occurred at this checkpoint.

## 2026-09-22 source review

The legacy service branch now checks read-only SD preparation eligibility before the first QSPI erase, then checks again after staging when it requests the SD owner operation. The SD worker keeps FAT32 media unavailable to HPT logging until the older firmware takes over. Service-code consent text states that data loss is conditional on a pre-00-05-00 image. The managed Release rebuild and final incremental build pass; the existing 16-case update corpus and 15 review checks pass. The checked-in 00-05-00 IMX header has the expected controlled Title, format-1 layout, and four-MiB main/audio payloads. There is still no target evidence for the DisplayTest return, FAT32 failure/recovery boundary, or A/B transitions; no controller or card action occurred.

Read-only review of the separate DisplayTest 01-01 source found no personality version floor in `src/DisplayTestUpdateAdmission.h`, a 01-01 fixture-to-fixture minimum, and FAT32 handoff before personality installation. Its project record reports Controller B FAT32 handoff and installation of SMI 00-04-11, after a power cycle following an initially unresponsive install tap; old SMI logging remains unproven. The earlier reciprocal-floor requirement conflicted with that media-state design and is superseded above. This does not satisfy the SMI A/B return or rollback gates, and the SMI bench pause remains in force.

## 2026-09-22 resumed implementation checkpoint

The focused review now restricts SMI, CVO, and DVO Titles to product IDs 7520553, 7520555, and 7520721 respectively. A pending direct-rollback SD request cancels atomically if the SD thread does not accept it within 30 seconds; once accepted, USB waits for the terminal result because FAT32 erasure may be underway. Nineteen identity-policy cases, nine rollback-contract checks, the existing 16 update cases, and 19 review checks pass. Fresh managed Debug and Release rebuilds pass. This was a pre-target checkpoint; later sections supersede its candidate status.

## 2026-09-22 immutable candidate and bench-boundary checkpoint

Commit `77495a3715ffeb3d3a4928a82d6f2e949e7e5362` contains the reviewed SMI 00-05-01 source and deterministic Debug and Release outputs. Fresh clean-commit rebuilds reproduced the tracked outputs. Immutable candidate `00.05.01-77495a3715ff-5a30dd9eacda` validates against HEAD; its manifest SHA-256 is `B948EDFC72444042D38E692607A234D9C671B1D1D0BE98C229142095ED57160B`, Debug S-record SHA-256 is `51315325E3B37F91B6A8B204741480F3DC6ED621CC76594FBB0E987D1075047A`, and Release S-record SHA-256 is `5A30DD9EACDA99AD7BC86CA70D536FA331B78A4015325891DE920EA8421B00B3`. This closes the host-side candidate freeze portion of G-SMI-CANDIDATE; target behavior remains open.

Live hub inventory confirmed Controller A probe `69664082` at port `19120` and Controller B probe `69660123` at port `19121`. The Controller A pre-program DVO four-MiB rollback capture has SHA-256 `8DC55368026649523FC751B09A6C99F47FD015251D1B0A6BE7F6CBC9DE44DAD6`. Pre-program CID is unavailable because DVO has no service-467/equivalent mapped state; the installed card was not moved. Manifest-bound programming of the Release candidate passed with serial `69664082` and VTref 3.272 V. The post-program four-MiB readback SHA-256 is `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407` and exactly matches the expanded S-record. After startup settled, target state reported protocol detection `4` (FAT32 / needs initialization), CID valid `1`, representative-sector read valid `1`, and raw CID `05000C61736466672200001C8901A34F`. Owner-supplied photographs confirm successful SMI boot, working touch navigation, firmware `00-05-01`, assembly `1751136`, and the expected FAT32 / HPT media 2.0 initialization warning while temperature control remained active. No initialization was accepted. The owner confirmed that SMI 00-05-00 was never deployed on a production controller and does not require target qualification. It is excluded from the bridge path. A deterministic host builder now packages the exact SMI 00-05-01 Release S-record with the audio payload from released SMI 00-04-11, allowing the ordinary Settings > Update Firmware path to establish the correct SMI main and QSPI payloads directly.

## 2026-09-22 FAT32-safe candidate and direct updater checkpoint

Commit `22a3205bae1372b485f2c484de238e2c9cbae0db` retains an already-readable FAT32 card during service rollback after CID and representative-sector verification; only an HPT2-to-FAT32 conversion invokes formatting. Managed Debug and Release rebuilds pass. Nineteen identity-policy cases, ten rollback-contract checks, sixteen update-validation cases, fifteen review checks, the image-builder CRC round trip, and candidate tamper tests pass.

Immutable candidate `00.05.01-22a3205bae13-da6887348e38` validates against HEAD. Its manifest SHA-256 is `E45CA23CF3F4A321192555B9CFC3E84BFA23F86B000A468CAC5C379348A81FA8`; Release S-record SHA-256 is `DA6887348E38F986F53C17D29BEC6CB04D5ABFF1ECFED2BF67D972E99E657AA0`. Deterministic IMX `7520553_SMI_00_05_01.imx` is 8,388,864 bytes with SHA-256 `6F47AF091C9B73CCE8DD8DC58D4D7F3A270D6E21DB8659D28F1C30B6F4EB80D7`, header CRC `4A7B4205`, main CRC `F5B332CF`, and audio CRC `758FE2DE`. The main payload is the exact candidate Release S-record expanded to four MiB; the audio source is released SMI 00-04-11, SHA-256 `1A83853002168B373FE756FF090F4364E9D82039D247E12678E842643C6AB274`. Controller A was scheduled to consume this image through Settings > Update Firmware under the policy at that checkpoint. The later target-media requirement and staging result supersede this forward-looking statement.

## 2026-09-22 Controller A staging result and requirements detour

Controller A listed and accepted the exact `7520553_SMI_00_05_01.imx` through Settings > Update Firmware and returned to the main screen. Read-only evidence proves exact QSPI staging: main SHA-256 `7F49E615FF971D1C63E44CF94B8DCD9BF919DA7846E052408189997A58B78B8E` and audio SHA-256 `CEDDB5F1BC3F40EDD449E2228B3DB1EB75289C9B60DCD415276DCC31FAC8DCE2`. Internal flash remained exactly the prior candidate at SHA-256 `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407`; at this checkpoint the final flash-transition cause was unresolved. The FAT32 card remained uninitialized with CID `05000C61736466672200001C8901A34F`, identity valid, and representative-sector read valid. Configuration remained operational and quiescent. The 2026-09-23 reconciliation below closes that defect diagnosis.

The owner then required target-driven FAT32 preparation and a gray disabled main chart whenever logging is unavailable. The SMI implementation now shares FAT32 preparation across ordinary DisplayTest return and legacy-SMI service rollback, retains verified FAT32 without formatting, formats another readable classified layout after explicit consent, and refuses missing or unreadable media before QSPI erase. The chart uses live queue/media/store readiness and refuses stale clicks. Twenty-four identity/media cases, thirteen FAT32 transaction checks, sixteen update validation cases, the chart availability contract, nineteen review checks, seventeen warning checks, both managed builds, and related USB/FileX checks pass. Commit `10dbb91519384cc9144b94e8a79057c8f47c0630` was rebuilt cleanly and reproduced Debug S-record SHA-256 `69C28A9B4D51F6AA8BD0F70E6D4360B4D2EC56F401B20C6C82327475414EC8EF` and Release S-record SHA-256 `4E7DFB2F7333202C71A736DF6692512030DB43508A1CCD0C556E7E8C1EB6B326`. Immutable candidate `00.05.01-10dbb9151938-4e7dfb2f7333` validates with manifest SHA-256 `6F753689C56EFACE054C802FF782FFCC193BFAE2D7F5E948F0BE20F44FA86586`. The prior frozen candidate is superseded. Bench work remains paused and no controller programming or SD formatting occurred during this detour or freeze.

## 2026-09-23 operator UI acceptance and final SMI image

Controller A was direct-programmed with accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5`; a complete four-MiB readback matched the expanded Release S-record at SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the fitted startup warning, reason-specific disabled-chart message, return-to-home behavior, operator service 467 access, and the remaining service 471 warning flow. The owner unintentionally completed service 471 during that review. Immediate read-only state showed ready media, valid unchanged CID `05000C61736466672200001C8901A34F`, a successful representative-sector read, and no terminal initialization error.

After UI acceptance, Controller A service 150 generated the final `7520553_SMI_00_05_01.imx` on `IMX2`. Read-only host validation reports 8,388,864 bytes, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, valid header/main/audio CRCs, and an exact main-payload match to the accepted Release candidate. The source media was unmounted cleanly. This closes the SMI controlled-image portion of G-APPROVED-IMAGES. The separate DisplayTest workspace currently has no controlled `01-01` IMX, so that gate and the remaining Controller A transition matrix items remain open. No further controller programming or SD operation is authorized by this checkpoint.

## 2026-09-23 Tool Shed reconciliation to actual work

The earlier internal-flash handoff failure is resolved. Commit `76471306` added watchdog refresh during bounded flash erase/program waits; commit `ab0755e7` cleared stale FCU command-lock state and disabled ROM cache before the RAM-resident updater handoff. A controlled self update completed with terminal diagnostic error `0`, and the full internal-flash readback exactly matched its candidate at SHA-256 `6B27C922C40908BB6221819841F8A7F264E09C3E5D3399ABB0F18993BD01A86F`.

The current accepted candidate is `00.05.01-1bf8afe6aeba-6476100e5ae5`, from commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`, manifest SHA-256 `A4BDA8EEE4C5D78C45F7CC943616FAAE2285B00DD76F4F3E02363D5067AD1D60`, and Release S-record SHA-256 `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`. Controller A's full readback exactly matches the expanded Release image at SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner's UI acceptance and the final controller-generated SMI image close the source, UI, Controller A exact-image, and SMI image-control portions of the work.

Open work is now limited to the exact controlled DisplayTest 01-01 IMX and the still-paused A/B forward, return, refusal, controlled rollback, fault, logging, retention, and export evidence needed by the readiness gates. The separate DisplayTest lane has source and bench evidence for safe startup, FAT32 handoff, and touch, but this project cannot close G-DISPLAYTEST-RETURN without the controlled 01-01 image and required SMI transition evidence. MAP-0009 remains active; no release, ECO, or rollout decision is implied.
