# Executive Directive: Deliver a safe SMI 00-05-01 update floor while preserving a return path to revised DisplayTest and the FAT32 production handoff. Prove the transition on both controller assemblies before release.

Status: promoted
Type: idea-brief
Role: project-executive-directive-v1
Updated: 2026-09-23
Next Action: settle retained HPT2 card-data preservation versus expendable-data disposition and explicit action authority; then minimal FAT32 preparation, affected SD read/write–Home touch check and normal DisplayTest 01-01 fixture installation of accepted SMI 00-05-01 on verified A
Readiness Review: READY-WITH-PRM-GATES at revision 3; four gates transferred to MAP-0009
Produces: MAP-0009

## Current handoff reconciliation — 2026-09-23 09:27 PDT release

Coordination is resumed from SMI; live takeover is verified, with card-data disposition and explicit hardware-action authority still pending. DisplayTest released A with no pending operation, running 01-01 on assembly 1751136 / probe 69664082 with retained HPT2 CID `05000C61736466672200001C8901A34F`. Its controller-generated IMX, source `da955dc92a1652eba247f07b32d154b4b7001e02`, is now controlled at SHA-256 `E11CEB483BA478F6A3D98F75DBF303EA09800165463EFE17880D5CDB2ACD78AB`; local hashing matched it and the accepted SMI IMX. The missing-image prerequisite is complete.

Credit existing SMI candidate/UI/export and resolved updater evidence, plus DisplayTest HPT2 startup, export, scoped navigation and Card Identity; do not replay them. Full SD Qualification was not run and is not required merely for this transition. The affected SD read/write–then-Home touch sequence and verified FAT32 production handoff remain open.

Live read-only takeover succeeded at 09:40–09:41 PDT after the earlier DNS failure. Serial-bound A / assembly 1751136 / probe 69664082 has exact DisplayTest 01-01 main-flash SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. HPT2 is ready, driver CID valid, raw CID unchanged, cached sector-zero approval valid, and captured update/format/SD-test/SDQ request flags idle; FAT32 handoff remains NONE. See `work/evidence/smi-displaytest-live-takeover-20260923.json`. No halt/go/reset/program/power/format command was issued; J-Link initialization reported a low-power wake. The smallest open SMI-owned test is A's ordinary DisplayTest 01-01 → accepted SMI 00-05-01 installation through verified FAT32 fixture handoff. The retained HPT2 card first needs a recorded preservation/archive or expendable-data decision and explicit erase consent; an IMX export does not preserve SD history. After authorization, minimal FAT32 preparation and the focused affected touch check can supply that prerequisite without Full Run. Programming, power operations and formatting are not authorized by this handoff or reconciliation.

Remaining exact-candidate A/B forward/return, refusal/renamed-file, representative rollback, fault/recovery, initialization, logging/history/export and retention gates remain open. Earlier dated pause/missing-image statements below are history superseded by this capsule; prior owner-abandoned commitments remain abandoned. Evidence and the concrete next-step sequence: `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

## CEO Directive

Deliver a safe SMI 00-05-01 update floor while preserving a return path to revised DisplayTest and the FAT32 production handoff. Prove the transition on both controller assemblies before release.

## Desired Outcome

Use IDEA-0006 as the technical scope and decision record. Deliver an SMI 00-05-01 candidate whose validated IMX Title governs family/version identity and whose ordinary updater refuses pre-00-05-01 personality images before QSPI erase. Provide a separate direct service rollback to any valid SMI image without a version allowlist. For any admitted FAT32 target, validate and stage the image before explicit target-media preparation: retain verified FAT32, format another readable classified layout after data-loss consent, and stop on missing or unreadable media; service 471 remains the HPT2 recovery action if current SMI survives a pre-flash failure. Preserve an SMI return path to DisplayTest 01-01 or later that safely handles HPT2 media and then verifies FAT32 handoff. DisplayTest may install a valid older SMI personality after that FAT32 handoff; its fixture-to-fixture minimum is 01-01. Keep SMI's HPT2 initialization explicit. Require transition, refusal, and rollback evidence on both controller assemblies before release.

## Current Position

The owner confirmed that SMI 00-05-00 was never deployed on a production controller and excluded it from target qualification. The earlier Controller A update that staged QSPI without replacing internal flash was diagnosed and corrected by the later watchdog, FCU command-lock, and ROM-cache changes. A controlled self update then completed with terminal diagnostic error `0`, and its complete four-MiB internal-flash readback exactly matched the candidate. The accepted source is commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`; immutable candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` validates with Release S-record SHA-256 `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`. Controller A was direct-programmed with this candidate and exact readback SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the startup warning, reason-specific disabled-chart behavior, service 467 operator access, and service 471 warning flow. Service 150 produced the final controlled SMI image, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, whose main payload exactly matches the accepted candidate. The controlled DisplayTest 01-01 IMX is now received and hash-verified; the A/B transition and fault matrix remains open. Coordination is resumed, with hardware execution blocked as recorded above.

## Progress

- [x] Directive captured exactly in canonical project state.
- [x] Codex has delegated the directive into a bounded plan and execution chain (MAP-0009).
- [ ] The requested outcome has evidence and is reconciled.

Only check a milestone when canonical lifecycle state or linked evidence supports it. Codex updates
this section as work moves; the generated `work/100k.md` never guesses progress.

## Recommended Next Action

settle retained HPT2 card-data preservation versus expendable-data disposition and explicit action authority; then minimal FAT32 preparation, affected SD read/write–Home touch check and normal DisplayTest 01-01 fixture installation of accepted SMI 00-05-01 on verified A. See the current handoff capsule and linked evidence for the concrete sequence.

## Why This Next

The accepted SMI candidate and both controlled IMX files are exact. Live A state now matches the handoff. The open work is card-data disposition and the unproven FAT32 fixture-to-SMI transition; image generation and the earlier updater defect are complete.

## Blockers

- Live A takeover is verified; renew the baseline after any intervening bench operation or relevant reboot/card change.
- Retained HPT2 data disposition, conversion consent and installation authority are not established.
- The affected DisplayTest SD read/write–then-Home touch sequence and verified FAT32 handoff remain open.
- Exact-candidate A/B transition, fault/recovery, logging, retention, export and representative rollback evidence remains incomplete.

## Operator Needs

- Decide whether the verified retained HPT2 history must be preserved or may be erased, and explicitly authorize the concrete next card/installation operation. No programming, power or formatting authority is inferred from this handoff.

## Completion Condition

The SMI and DisplayTest implementation and release identities satisfy IDEA-0006; both controller assemblies pass the forward, return, renamed-file, ordinary legacy-refusal, and representative direct rollback matrix; in-place FAT32 preparation, service-471 recovery, and retention safeguards are verified; the resulting release decision is evidence-backed and reconciled to this directive.

## Authority And Delivery Boundary

- Preserve any endpoint, target, timing, non-goal, or authority language stated in the directive.
- Initial CEO intake does not authorize code, build, programming, SD preparation, bench testing, push, or release. Subordinate source-changing work defaults to a verified Work1 candidate until a later delivery endpoint is authorized.
- The owner's latest 2026-09-22 clarification explicitly authorizes replacing the installed DVO firmware with SMI on Controller A and Controller B. Pre-program CID is recorded unavailable because DVO lacks service 467; post-program CID evidence is mandatory.
- The service rollback is explicit and accepts any structurally valid SMI image, with no version allowlist. Do not treat the ordinary floor as a ban on controlled recovery or treat common internal-flash failure risk as unique to downgrading. Do not require field SD-card replacement.
- Interrupt only for a genuine material decision or authority boundary.

## Delegation Contract

Initial issuance is durable intake only. Tool Shed appends this Idea through canonical planning
order, checkpoints it, and stops so other directives may be captured first. Reissuing the exact
active directive delegates or resumes it when doing so will not preempt another working campaign.

The Plan Cycle interprets this directive, the Roadmap Cycle organizes it when needed, the Milestone
Cycle materializes bounded campaigns, Campaign Cycles execute, and Evidence/Outcome Cycles report
the result back to 100k. The CEO is not required to select those internal mechanics.

## Exploration Log

### 2026-09-21

- The owner accepted the recommended CEO framing from the IDEA-0006 discussion. Preserve that brief as the technical source and keep this directive as the executive outcome.
- The owner directed IDEA-0006 and this CEO directive to include direct service rollback to approved older SMI firmware and in-place FAT32 preparation. Service 471 is the existing explicit HPT2 recovery action when current SMI remains bootable.
- The owner later clarified that service rollback accepts any valid SMI image, and corrected the DisplayTest normal return floor to 01-01 or later. The earlier named-image questions are superseded; exact images remain qualification specimens.

### 2026-09-22

- Read-only review of the separate DisplayTest 01-01 source found FAT32 handoff before personality installation, no DisplayTest personality version floor, and a 01-01 fixture-to-fixture minimum. Its project record reports a Controller B transition to SMI 00-04-11 after FAT32 handoff, with an initially unresponsive install tap requiring a power cycle; old SMI logging remains unproven. The SMI ordinary 00-05-01 floor and DisplayTest return floor are distinct. SMI A/B target qualification and this project's bench pause remain open.
- Owner designated Controller A as the initial target control for the SMI 00-05-01 transition work. Controller B remains the second required release-qualification assembly. The designation does not itself resume bench work or authorize a target operation.
- Source review removed the late-format false-failure timeout and made the read-only USB media flush informational after staged CRC verification. Release rebuild, 16 update cases, and 15 review checks pass; target fault behavior is still open. SMI 00-05-00 and 00-04-11 specimens are identified by controlled hashes, while 00-05-01 and DisplayTest 01-01 IMX candidate bytes remain pending. A newer DisplayTest Controller B record demonstrates new SMI 00-04-11 FAT32 records in a five-minute export; post-restart retention was not checked.

### 2026-09-22 direct 00-05-01 updater correction

- The owner confirmed that 00-05-00 was never deployed on a production controller and excluded it from this qualification. A deterministic host-built 00-05-01 IMX now provides the correct SMI QSPI resources directly, so the next target step uses Settings > Update Firmware and does not install the 00-05-00 development image.

### 2026-09-22 Controller A result and owner requirements detour

- Controller A Settings > Update Firmware listed and accepted `7520553_SMI_00_05_01.imx`. QSPI main and audio matched the selected image, but internal flash remained the prior candidate. CID `05000C61736466672200001C8901A34F`, representative-sector validity, FAT32 classification, and operational configuration remained stable. At this checkpoint the final flash-transition cause was unresolved; the 2026-09-23 reconciliation below closes it.
- The owner required target-driven FAT32 preparation: retain verified FAT32; format another readable classified layout only when the admitted target requires FAT32; stop on missing or unreadable media. The owner also required the main chart to use its gray disabled appearance whenever logging is unavailable.
- The revised SMI source implements those requirements. Twenty-four identity/media cases, thirteen FAT32 transaction checks, sixteen update cases, main-chart availability checks, both canonical builds, and related review/warning/USB/FileX checks pass. Commit `10dbb91519384cc9144b94e8a79057c8f47c0630` was rebuilt cleanly and reproduced the committed bytes. Immutable candidate `00.05.01-10dbb9151938-4e7dfb2f7333` contains Release S-record SHA-256 `4E7DFB2F7333202C71A736DF6692512030DB43508A1CCD0C556E7E8C1EB6B326`; manifest SHA-256 is `6F753689C56EFACE054C802FF782FFCC193BFAE2D7F5E948F0BE20F44FA86586`. No controller programming or SD formatting occurred during the detour or freeze.

### 2026-09-23 reconciliation to completed Codex work

- Commits `76471306` and `ab0755e7` corrected the internal-flash handoff by refreshing the watchdog during bounded flash operations, clearing stale FCU command-lock state, and disabling ROM cache before the RAM-resident updater. A controlled self update completed with diagnostic error `0`; internal flash exactly matched the candidate at SHA-256 `6B27C922C40908BB6221819841F8A7F264E09C3E5D3399ABB0F18993BD01A86F`. The earlier unresolved-transition statement is closed by this evidence.
- Subsequent UI work produced accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5`. Controller A exact readback matched its expanded Release image at SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the Format 2 startup warning, disabled-chart reason messages and return behavior, operator service 467 access, and service 471 warning flow.
- The owner unintentionally completed service 471 during review. Immediate evidence showed ready media, unchanged valid CID `05000C61736466672200001C8901A34F`, a valid representative-sector read, and no terminal initialization error.
- Controller A service 150 generated `7520553_SMI_00_05_01.imx` on `IMX2`. Read-only validation found 8,388,864 bytes, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, valid header/main/audio CRCs, and an exact main-payload match to the accepted Release candidate. The SMI controlled-image prerequisite is complete; the DisplayTest 01-01 controlled IMX and the A/B transition matrix remain open.
