# Idea Brief: HPT2 Personality Update Floor at 00-05-01

Status: exploring
Type: idea-brief
Updated: 2026-09-21
Next Action: plan SMI 00-05-01 implementation in this repository; bench transition testing remains paused
Readiness Review: run explicitly with ts: bs review; ordinary brainstorming does not review
Produces:

## Current Synthesis

### Idea

Release SMI 00-05-01 with a minimum compatibility floor for ordinary updates and a separate, deliberate service rollback to named approved older SMI images. Use the existing IMX header Title as the source of candidate family and version identity, together with MachineMask, layout, and CRC checks. The external USB filename may be changed by an operator and is not an identity input. No new header field is required. SMI accepts a FAT32 DisplayTest handoff, performs explicit HPT2 initialization, and has an approved return path to revised DisplayTest. A FAT32-era rollback prepares the installed SD card in place; field card replacement is not a supported workflow.

### Why It Matters

Controller B running older DisplayTest showed a persistent white screen with HPT2 media. It booted after the expendable card was formatted FAT32. An ordinary downgrade from HPT2 personality firmware to FAT32-era firmware could leave an installed controller without display access. Field access to the internal SD card is impractical, so a rare recovery downgrade must prepare the installed card in place. Published SMI 00-05-00 supports HPT2 but does not have the normal-update guard; a new release is required.

### Desired Outcome

- SMI 00-05-01 identifies the candidate before any QSPI erase: bounded numeric version and family parsed from the validated IMX header Title, intended machine from MachineMask, and existing integrity/layout checks. Require the identity fields within the Title to be consistent. The external USB filename is used only to discover an `.imx` candidate; renaming it does not change acceptance.
- In the ordinary updater, admit recognized approved HPT2-capable SMI, CVO, or DVO personality images only at 00-05-01 or later. Reject older, unknown, inconsistent, or unparseable personality identities before erase and leave firmware bootable and SD media untouched.
- The ordinary cutoff refuses SMI 00-05-00 despite its HPT2 logger. A separate service rollback may admit that named release without SD formatting, or a named FAT32-era SMI release with explicit in-place FAT32 preparation. Do not require an intervening DisplayTest installation.
- For a FAT32-era rollback, validate and stage the complete selected IMX before changing SD media; dispose of required HPT2 history, obtain explicit data-loss confirmation, recheck the installed card CID, format FAT32, verify it, revalidate the staged image, and then use the ordinary internal-flash replacement path. A failed preparation or staging step must not start internal-flash replacement.
- If rollback stops before internal-flash replacement, current SMI remains available with its touch screen and USB updater. Existing service 471 can explicitly reinitialize the card as HPT2, with the prior card data already lost. A failure after internal-flash replacement starts has the same recovery risk as any firmware update and requires the existing target fault-qualification gate.
- Guarded SMI permits a return to explicitly approved revised DisplayTest 01-xx image(s). Revised DisplayTest boots safely with HPT2 media and tells the operator that normal production testing requires a FAT32 card. Its ordinary updater enforces the same personality minimum; any older-image recovery is a deliberate service exception. Older DisplayTest images are excluded from the normal return path.
- SMI accepts eligible FAT32 media from the DisplayTest fixture and initializes HPT2 only through an explicit service action with data-loss warnings, confirmations, card identity recheck, and disposition of required FAT32 history. Verify logging, retention, history, and export. Already ready HPT2 media is not needlessly reinitialized.
- Prove installation from old and revised FAT32 DisplayTest handoffs on both controller assemblies. Prove renamed USB files with valid Titles remain eligible, legacy IMX images are rejected by the ordinary updater before erase, and the approved revised DisplayTest return path boots safely with HPT2 media. Separately prove direct service rollback to each approved older SMI image, including FAT32 preparation and service-471 recovery after pre-flash failure where applicable.

## Constraints And Non-Goals

- CVO and DVO 00-05-01 will need their own HPT2-capable builds and proof; this lane implements SMI only.
- DisplayTest uses a separate 01-xx version series. Name the exact revised release image(s) approved for return; unknown or older DisplayTest images default to refusal.
- Field SD-card removal or replacement is not a practical recovery step. Service 471 initializes HPT2, not FAT32; the FAT32-era rollback requires a distinct explicit FAT32 preparation action.
- No rollback workflow may promise a working touch screen after a failed internal-flash replacement. That risk is common to upgrades and downgrades; it is not a downgrade-specific reason to prohibit the service path.
- MachineMask alone does not establish product identity or SD compatibility. The version convention depends on controlled release discipline, not cryptographic authentication.
- Preserve published IMX files unchanged. Do not erase card data requiring retention without controlled disposition.
- This brief authorizes no code change, build, programming, format, power cycle, bench test, release, or rollout. Transition testing is paused.

## Shared Transition Contract

- DisplayTest normal production testing and Prep for Ship hand off verified FAT32 media; separate card-family qualification remains HPT2.
- Personality releases SMI, CVO, and DVO 00-05-01 and later signify HPT2 support.
- SMI 00-05-01 owns explicit FAT32-to-HPT2 initialization, the ordinary personality minimum compatibility floor, and a controlled direct service rollback to named older SMI images with in-place FAT32 preparation when required. Approved revised DisplayTest provides a return path and safe HPT2-card startup.
- Use separate project-bound Codex VS Code lanes. Related DisplayTest brief: FAT32 Production SD Handoff and Separate HPT2 Qualification in E:\dev\high_point\7520708_DispTest_FW.

## Open Questions

- Which exact revised DisplayTest 01-xx release image(s) satisfy safe HPT2-card startup and the reciprocal personality floor, and may be installed from guarded SMI?
- Which exact older SMI releases are approved for direct service rollback, and which require FAT32 rather than HPT2 media?
- Which exact released IMX specimens and target checks prove parsing, ordinary refusal before erase, direct rollback, format/recovery failure boundaries, and FAT32-to-HPT2 acceptance on both controller assemblies?

## Decisions

- Use existing IMX header information and the common 00-05-01 personality minimum.
- Apply that minimum to ordinary updates; provide a distinct service rollback for named approved older SMI releases. Do not force a DisplayTest hop for SMI rollback.
- Prepare the installed card in place for FAT32-era rollback after complete IMX validation and staging, with explicit data-loss consent and CID recheck. Service 471 remains the explicit HPT2 recovery action if current SMI survives a pre-flash failure.
- Treat the validated header Title as the source of family/version identity; do not require the external USB filename to match it.
- Permit return only to approved revised DisplayTest with safe HPT2-card startup and a reciprocal personality floor. Normal DisplayTest production handoff remains FAT32.
- Fail closed on unknown or inconsistent identity before erase.
- Fixture handoff remains FAT32; SMI performs explicit, warned HPT2 initialization after media identity and retention checks.
- Qualify the transition and refusal matrix on both controller assemblies, including renamed files, old and revised DisplayTest handoffs, ordinary SMI 00-05-00 refusal, approved service rollback, failure recovery, and safe return to revised DisplayTest. Qualify CVO and DVO builds separately.
- Bench testing remains paused until the owner resumes it.

## Exploration Log

### 2026-09-21

- Owner selected a common 00-05-01 minimum for SMI, CVO, and DVO HPT2 personalities, directed the next SMI revision to be 00-05-01, and requested separate Tool Shed entry points.
- Owner accepted the transition and media-preparation recommendations, required a return path to DisplayTest, and selected the IMX header Title as the candidate identity source because operators may rename the external USB file. The recommended return path is approved revised DisplayTest with safe HPT2-card startup and a reciprocal personality floor; its exact release image remains to be named.
- Owner added the rare direct SMI service-rollback need, rejected field SD-card swapping as impractical, and identified service 471 as the existing explicit HPT2 reinitialization path after a pre-flash failure. Ordinary upgrade and downgrade share internal-flash failure risk; the extra rollback requirement is controlled in-place FAT32 media preparation and data-loss handling.
