# Project Executive Intent: SMI Firmware

Status: active
Type: decision
Role: project-executive-intent-v1
Updated: 2026-09-23

## North Star

Deliver dependable SMI oven firmware that keeps control, monitoring, and alarms operating through storage faults, and releases only behavior proven on both controller assemblies.

## Current Completion Horizon

Complete the SMI 00-05-01 and DisplayTest 01-01 or later transition through an evidence-backed release decision. "Done" requires the return path, the ordinary personality update floor, direct service rollback to any valid SMI image, explicit in-place FAT32 or HPT2 card preparation as applicable, and forward, return, refusal, and rollback tests on both assemblies. A passing build alone does not close this horizon.

## Strategic Context

The SMI 00-05-00 development line introduced HPT2 logging, but lacks the proposed ordinary-update downgrade guard and was never deployed on a production controller. Production DisplayTest hands off FAT32 media, while SMI prepares HPT2 media explicitly. A rare recovery may need direct installation of older SMI firmware; the installed SD card is not field accessible for replacement, so FAT32-era rollback requires a controlled in-place format. Service 471 can explicitly reinitialize HPT2 if current SMI remains bootable after a pre-flash failure. Internal-flash failure risk applies to upgrades and downgrades. Firmware candidate identity and exact-byte release controls are established; the full HPT2 claim and SD-card family qualification have separate evidence gates.

The SMI ordinary updater owns the 00-05-01 personality floor while HPT2 media may remain installed. The DisplayTest 01-01 return floor is distinct: revised DisplayTest must tolerate HPT2 on startup and verify FAT32 before its normal production test or personality install. Its own fixture-to-fixture floor is 01-01, and it may install a valid older SMI after FAT32 handoff. Read-only DisplayTest source and Controller B records support that path, but do not close the SMI two-controller transition gate.

## Current Priorities

- Treat all SMI candidates before `00.05.01-1bf8afe6aeba-6476100e5ae5` as superseded for current qualification.
- Preserve accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5`, frozen from commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`, and controller-generated image `7520553_SMI_00_05_01.imx` with SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`. Its updater retains verified FAT32, formats another readable layout only for a FAT32 target after consent, refuses missing or unreadable required media, and disables the main chart whenever logging is unavailable.
- Keep SMI bench testing paused. The earlier Controller A internal-flash handoff defect is resolved; obtain the still-missing controlled DisplayTest 01-01 IMX before further Controller A transition work.
- Exclude SMI 00-05-00 from target qualification. Its below-floor behavior is covered by focused host policy tests; it is not a production-controller baseline or bridge.
- Continue the authorized A-first/B-second forward, return, refusal, controlled rollback, HPT2 initialization, logging, retention, and export matrix; make the later release decision from exact candidate evidence.
- Keep CVO and DVO outside this project and do not alter DVO.

## Deliberate Non-Goals

- No unconfirmed SD-card conversion or erase, and no field SD-card swap as an update or rollback workflow.
- No claim that the update Title authenticates its publisher.
- No automatic CVO/DVO release, SD-family approval, ECO, or customer rollout from the SMI transition result.

## Decisions Needed

- Establish the exact DisplayTest 01-01 candidate IMX and complete its separate return qualification.
- The owner decides when to resume the paused SMI bench transition matrix.
- A later release decision must identify the exact qualified candidate.

## Review Triggers

- A DisplayTest 01-01 or later candidate is qualified for safe HPT2 startup and FAT32 handoff.
- Controller A visual boot or storage evidence contradicts the read-only target capture.
- Either assembly produces contradictory transition evidence.
- The in-place FAT32 preparation or service-471 recovery path produces contradictory evidence.
- An exact candidate reaches release qualification.
- The SD qualification or supply-change scope changes.

## 2026-09-22 requirements and evidence update

Controller A accepted and staged the prior SMI 00-05-01 IMX, with exact QSPI main SHA-256 `7F49E615FF971D1C63E44CF94B8DCD9BF919DA7846E052408189997A58B78B8E`, but internal flash remained at SHA-256 `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407`. The owner added a target-driven FAT32 rule and disabled-chart rule. The revised source passes focused checks and canonical Debug/Release builds; Release S-record SHA-256 is `4E7DFB2F7333202C71A736DF6692512030DB43508A1CCD0C556E7E8C1EB6B326`. It is not frozen or target-qualified. No controller or SD mutation occurred during this requirements detour.

## 2026-09-23 reconciliation

The 2026-09-22 internal-flash failure was diagnosed and corrected by watchdog, FCU command-lock, and ROM-cache changes. A controlled self update completed with diagnostic error `0` and exact four-MiB flash readback. Accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` has Release S-record SHA-256 `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`; Controller A exact readback SHA-256 is `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the Format 2 startup and disabled-chart UI behavior. Service 150 then generated the final SMI IMX with SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, valid CRCs, and an exact main-payload match. The remaining current prerequisites are the controlled DisplayTest 01-01 IMX and the paused A/B transition, refusal, rollback, and fault matrix. No release decision has been made.
