# Project Executive Intent: SMI Firmware

Status: active
Type: decision
Role: project-executive-intent-v1
Updated: 2026-09-24

## Current release reconciliation — 2026-09-24

Corrected candidate `00.05.01-b59c33d1c1f4-3f464c236471` is committed, reproducibly built, immutable and locally registered. Controlled images, A/B normal transitions, A warning/Cancel, B HPT2 initialization/logging/CSV/restart retention, accepted DisplayTest return/restart behavior, and A malformed-header refusal are evidenced. CAMP-0028's service-471 target criterion is now evidenced on B. Do not repeat these completed checks.

The owner removed stale-selection testing as a release requirement and closed both the legacy 00-04-11 Success mismatch and DVO intermittent 901 investigations. Preserve their observations without further resolution work or root-cause claims. The accepted transition contract already excludes promised recovery after internal-flash replacement starts; this is a scope limit, not a new qualification deliverable. The owner accepted the existing source/host checks as sufficient for SD-preparation failures and timeouts before flash replacement on September 24. All four qualification gates are satisfied, including that explicit evidence disposition; no target fault-injection pass is invented. Missing historical CID/screen captures remain declared evidence limits, not requests to reconstruct them.

The owner explicitly authorized firmware release and inclusion of the .imx with "ts: ship and add .imx file to release" on September 24. The cohort remains working and unfrozen; the scoped local content checkpoint is the commit containing this revision. Release preflight/exact-content CI, publication, and release-outcome reconciliation remain future release work. One candidate commit has two owner registrations (MAP-0009 and CEO IDEA-0007), not two firmware candidates. IDEA-0006 is superseded; its technical direction is owned by this same outcome. No abandoned work is revived. Detailed prior checkpoints remain in managed revision history and linked evidence.

Current authority: `docs/firmware-update-validation-and-recovery.md` and `work/evidence/smi-current-release-gate-review-20260924.json`.

## North Star

Deliver dependable SMI oven firmware that keeps control, monitoring, and alarms operating through storage faults, and releases only behavior proven on both controller assemblies.

## Current Completion Horizon

Release accounting: **one distinct firmware candidate commit, two owner registrations, one delivery chain**. The bundled renderer below labels registration count as candidate count; its generated "2 candidate(s)" line is a display defect, not a second image or additional work.

Complete corrected SMI 00-05-01 under the shared ordinary/service updater policy, with controlled DisplayTest 01-01 return/FAT32 handoff and explicit HPT2 initialization. Done requires exact corrected immutable candidate identity, applicable both-assembly transition/refusal/fault/logging/export/retention evidence, disposition of known limits, and a separate release decision. A passing build or bounded A/B install is insufficient.

## Strategic Context

The field SD card is not practically replaceable. Ordinary Update Software and service 151 share admitted image policy, explicit consent and target-driven media preparation. Corrected candidate identity and the normal A/B cycle are established. The owner closed the legacy update investigations and excluded stale-selection testing. Recovery after internal-flash replacement begins was already outside the promised contract. Full HPT2, SD-family, supply and other abandoned work are not revived by this release review.

## Current Priorities

- Preserve the accepted exact candidate and completed A/B evidence.
- Publish the qualified SMI 00-05-01 candidate and .imx, verify exact downloaded bytes, and preserve unrelated owner work.
- Complete the authorized release controls before declaring publication verified.
- Keep DisplayTest read-only and abandoned work abandoned.

## Deliberate Non-Goals

- On 2026-09-23 the owner abandoned the temperature-control recovery and RTD-interlock successor campaigns, standalone SD Qualifier and independent physical-media validator delivery, SD specimen/family approval and supply-change closeout, and Tool Shed defect tickets TKT-0035/TKT-0036. These are no longer local execution commitments. Existing evidence, accepted limitations, and unresolved technical risks remain recorded in `docs/project-work-disposition-20260923.md`; abandonment is not qualification or defect resolution.
- No unconfirmed SD-card conversion or erase, and no field SD-card swap as an update or rollback workflow.
- No claim that the update Title authenticates its publisher.
- No automatic CVO/DVO release, SD-family approval, ECO, or customer rollout from the SMI transition result.

## Decisions Needed

- The owner has accepted existing source/host checks for pre-flash SD-preparation failures/timeouts. No qualification-scope decision remains. The local scoped checkpoint is authorized by the owner continuation; release is now authorized; preflight/CI, publication and verification remain. A question about committing dirty files is not a blanket instruction to commit every file.

## Review Triggers

- New evidence contradicts the qualified A/B behavior.
- The owner resumes release planning or changes the qualification scope.
- A source change invalidates the frozen candidate or its evidence applicability.

## 2026-09-22 requirements and evidence update

Controller A accepted and staged the prior SMI 00-05-01 IMX, with exact QSPI main SHA-256 `7F49E615FF971D1C63E44CF94B8DCD9BF919DA7846E052408189997A58B78B8E`, but internal flash remained at SHA-256 `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407`. The owner added a target-driven FAT32 rule and disabled-chart rule. The revised source passes focused checks and canonical Debug/Release builds; Release S-record SHA-256 is `4E7DFB2F7333202C71A736DF6692512030DB43508A1CCD0C556E7E8C1EB6B326`. It is not frozen or target-qualified. No controller or SD mutation occurred during this requirements detour.

## 2026-09-23 reconciliation

The 2026-09-22 internal-flash failure was diagnosed and corrected by watchdog, FCU command-lock, and ROM-cache changes. A controlled self update completed with diagnostic error `0` and exact four-MiB flash readback. Accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` has Release S-record SHA-256 `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`; Controller A exact readback SHA-256 is `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the Format 2 startup and disabled-chart UI behavior. Service 150 then generated the final SMI IMX with SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, valid CRCs, and an exact main-payload match. The remaining current prerequisites are the controlled DisplayTest 01-01 IMX and the paused A/B transition, refusal, rollback, and fault matrix. No release decision has been made.
