# Project Map: SMI 00-05-01 Transition Floor And Controlled Return

Status: active
Type: project-map
Updated: 2026-09-22
Source Idea: IDEA-0007
Technical Source: IDEA-0006
Requested Endpoint: source completion plus authorized A/B bench qualification; release and publication remain separate
Next Action: list Controller A service-151 IMX choices without selecting one, then install the controlled SMI 00-05-00 bridge to establish SMI QSPI resources
Campaign: standalone
Initial Target Control: Controller A

## Outcome

Deliver a safe SMI 00-05-01 update floor, a direct controlled SMI rollback, and a safe return to revised DisplayTest. Preserve normal DisplayTest FAT32 handoff and explicit SMI HPT2 initialization. Qualify all transitions on both controller assemblies before any release decision.

## Direction and boundaries

1. Use the validated format-1 IMX header Title for family and numeric release identity, with MachineMask, layout, header CRC, and payload CRC as existing independent checks. USB filenames are discovery labels only. Ordinary update rejects older or unknown personality images before any QSPI erase.
2. Keep direct service rollback separate from ordinary update. Admit any valid SMI image without a version allowlist. SMI 00-05-00 or later needs no FAT32 conversion; a pre-00-05-00 FAT32-era release needs staged full-image validation and explicit in-place FAT32 preparation, history disposition, data-loss consent, CID recheck, media verification, and staged-image revalidation before internal-flash replacement.
3. Preserve service 471 as explicit HPT2 reinitialization if current SMI remains bootable and its UI usable after a pre-flash stop. Do not promise recovery after internal-flash replacement starts.
4. The DisplayTest 01-01 or later image belongs to its own project-bound lane. It must boot safely with HPT2 media, enforce its 01-01 fixture-to-fixture floor, and verify FAT32 for normal production handoff. After that FAT32 handoff its updater may install a valid older SMI personality; the 00-05-01 ordinary personality floor belongs to SMI while HPT2 media may remain. DisplayTest 01-00 is below the SMI return floor.
5. CVO and DVO have separate build and proof lanes. This SMI project cannot claim those delivered.

## Execution sequence

- Establish exact controlled IMX identities and current source behavior. Implement the SMI normal floor and verify deterministic negative cases, including a renamed valid file.
- Implement the explicit service rollback for any valid SMI image and FAT32 preparation for pre-00-05-00 images. Keep all media mutations outside the ordinary update path.
- Reconcile the separate DisplayTest lane against its own project authority and image evidence.
- Use Controller A for the first forward, return, refusal, rollback, and failure-recovery matrix, with post-program CID identity and an explicit pre-program `CID unavailable` record because DVO lacks service 467. Repeat the required transition evidence on Controller B before release.
- Reconcile evidence and make a separate release decision. The owner explicitly authorized overwriting the installed DVO firmware with SMI on both controllers; that target authority does not authorize push, publication, or release.

## Readiness gates

- G-APPROVED-IMAGES: select exact DisplayTest 01-01 or later and representative SMI release specimens with hashes and media requirements for qualification; these do not form production allowlists.
- G-SMI-CANDIDATE: implement and verify the SMI floor, separate any-valid-SMI rollback, preparation, retention, CID, and recovery behavior at the authorized endpoint.
- G-DISPLAYTEST-RETURN: prove revised DisplayTest safe HPT2 startup, 01-01 fixture-to-fixture floor, verified FAT32 production handoff, and legacy SMI admission only after that handoff in its own project lane.
- G-DUAL-CONTROLLER-TRANSITION: collect CID-bound transition and fault evidence on A and B before release.

## Controller A qualification image inventory

| Role | Controlled specimen status |
| --- | --- |
| Ordinary legacy refusal and HPT2-capable service rollback | SMI `00-05-00`, `Release/7520553_SMI_00_05_00.imx`, SHA-256 `9AEFD6A39A16207B4625D28E83A2788B95470D404BB2E53BD4F96AA2A2B25114`; bytes present in this workspace. |
| FAT32-era direct service rollback | SMI `00-04-11`, controlled DisplayTest-project specimen SHA-256 `1A83853002168B373FE756FF090F4364E9D82039D247E12678E842643C6AB274`; verify exact bytes on target media before use. |
| DisplayTest return refusal | DisplayTest `01-00`, separate workspace Debug IMX SHA-256 `05059BFBB74C8B785BAD559743316667AB0BAC7F51D49CDE3347F8F85D8F4A78`; read-only inventory, below the return floor. |
| Forward install and permitted DisplayTest return | SMI `00-05-01` and DisplayTest `01-01` are source candidates; controlled IMX bytes and hashes are not yet available. |

These hashes identify test specimens and do not create firmware allowlists. G-APPROVED-IMAGES stays open until the candidate images and target-media copies are identified and checked.

## Current limits

The owner clarified on 2026-09-22 that neither controller initially ran SMI and therefore neither supported SMI service 467 in the pre-program DVO state. The owner then explicitly authorized overwriting Controller A and Controller B with SMI firmware. A pre-program CID block is recorded as `CID unavailable: installed DVO firmware has no service-467/equivalent mapped state`; the card remained installed, and post-program SMI captures supply current identity. The owner also clarified that service rollback accepts any valid SMI image and DisplayTest return requires 01-01 or later. The published DisplayTest `01-00` release tests and initializes HPT2 media for production, so it does not meet this directive's FAT32 production handoff and is below the return floor. Select exact qualification specimens before physical testing; no image-version allowlist is required for software implementation. Incomplete gates stay open and visible.

## 2026-09-22 target designation

Controller A remains the initial target control and Controller B follows for the dual-controller gate. A read-only four-MiB Controller A DVO rollback capture was retained before programming. After a fresh serial-bound inventory, Controller A was programmed with the manifest-bound SMI 00-05-01 Release candidate. No SD card was moved and no power operation or SD write occurred during this program step.

## 2026-09-22 rollback boundary review

The source review found that the USB updater could time out while the SD worker still had a pending or active FAT32 preparation, falsely reporting failure before a later card format. The updater now waits for the SD owner's terminal result once preparation is requested. The final read-only USB media flush remains telemetry rather than an image-admission gate after full payload and staged QSPI CRC verification. The canonical Release rebuild, 16 update cases, and 15 review checks pass. This does not prove SD-worker liveness or target fault behavior; the Controller A fault matrix remains open.

The separate DisplayTest project's newer Controller B record includes a five-minute export with newly written and read SMI `00-04-11` FAT32 records. Post-restart retention was not checked. That pairing evidence does not qualify the SMI `00-05-01` A/B transition.

## 2026-09-21 source checkpoint

The SMI source version is now 00-05-01. The ordinary update path parses family and two consistent numeric version spellings from the CRC-checked Title, checks the 00-05-01 personality floor and DisplayTest 01-01 return floor, and refuses malformed, unknown, or older identities before the first install QSPI erase. It does not use the USB filename as identity. Service code 151 now selects a distinct any-valid-SMI rollback path. A pre-00-05-00 image is fully staged before the SD owner rechecks CID and representative sector, prepares FAT32 in place, and lets USB recheck the staged CRCs before internal-flash replacement. The managed Release rebuild and subsequent incremental build pass; the existing 16-case firmware-update negative corpus and 15 code-review checks pass. This is a source candidate only; parser, SD preparation, fault recovery, and A/B transitions lack target evidence. No controller programming or SD operation occurred.

## 2026-09-22 source review

The legacy service branch now checks read-only SD preparation eligibility before the first QSPI erase, then checks again after staging when it requests the SD owner operation. The SD worker keeps FAT32 media unavailable to HPT logging until the older firmware takes over. Service-code consent text states that data loss is conditional on a pre-00-05-00 image. The managed Release rebuild and final incremental build pass; the existing 16-case update corpus and 15 review checks pass. The checked-in 00-05-00 IMX header has the expected controlled Title, format-1 layout, and four-MiB main/audio payloads. There is still no target evidence for the DisplayTest return, FAT32 failure/recovery boundary, or A/B transitions; no controller or card action occurred.

Read-only review of the separate DisplayTest 01-01 source found no personality version floor in `src/DisplayTestUpdateAdmission.h`, a 01-01 fixture-to-fixture minimum, and FAT32 handoff before personality installation. Its project record reports Controller B FAT32 handoff and installation of SMI 00-04-11, after a power cycle following an initially unresponsive install tap; old SMI logging remains unproven. The earlier reciprocal-floor requirement conflicted with that media-state design and is superseded above. This does not satisfy the SMI A/B return or rollback gates, and the SMI bench pause remains in force.

## 2026-09-22 resumed implementation checkpoint

The focused review now restricts SMI, CVO, and DVO Titles to product IDs 7520553, 7520555, and 7520721 respectively. A pending service-151 SD request cancels atomically if the SD thread does not accept it within 30 seconds; once accepted, USB waits for the terminal result because FAT32 erasure may be underway. Nineteen identity-policy cases, nine rollback-contract checks, the existing 16 update cases, and 15 review checks pass. Fresh managed Debug and Release rebuilds pass. The candidate remains pre-target until committed, rebuilt from the clean commit, frozen through the immutable candidate process, and programmed on Controller A with CID-bound baseline evidence.

## 2026-09-22 immutable candidate and bench-boundary checkpoint

Commit `77495a3715ffeb3d3a4928a82d6f2e949e7e5362` contains the reviewed SMI 00-05-01 source and deterministic Debug and Release outputs. Fresh clean-commit rebuilds reproduced the tracked outputs. Immutable candidate `00.05.01-77495a3715ff-5a30dd9eacda` validates against HEAD; its manifest SHA-256 is `B948EDFC72444042D38E692607A234D9C671B1D1D0BE98C229142095ED57160B`, Debug S-record SHA-256 is `51315325E3B37F91B6A8B204741480F3DC6ED621CC76594FBB0E987D1075047A`, and Release S-record SHA-256 is `5A30DD9EACDA99AD7BC86CA70D536FA331B78A4015325891DE920EA8421B00B3`. This closes the host-side candidate freeze portion of G-SMI-CANDIDATE; target behavior remains open.

Live hub inventory confirmed Controller A probe `69664082` at port `19120` and Controller B probe `69660123` at port `19121`. The Controller A pre-program DVO four-MiB rollback capture has SHA-256 `8DC55368026649523FC751B09A6C99F47FD015251D1B0A6BE7F6CBC9DE44DAD6`. Pre-program CID is unavailable because DVO has no service-467/equivalent mapped state; the installed card was not moved. Manifest-bound programming of the Release candidate passed with serial `69664082` and VTref 3.272 V. The post-program four-MiB readback SHA-256 is `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407` and exactly matches the expanded S-record. After startup settled, target state reported protocol detection `4` (FAT32 / needs initialization), CID valid `1`, representative-sector read valid `1`, and raw CID `05000C61736466672200001C8901A34F`. Owner-supplied photographs confirm successful SMI boot, working touch navigation, firmware `00-05-01`, assembly `1751136`, and the expected FAT32 / HPT media 2.0 initialization warning while temperature control remained active. No initialization was accepted. Controller A still requires controlled SMI QSPI resources before service-150 generation; the next action is a read-only service-151 filename listing, followed by selection of the controlled SMI `00-05-00` bridge only after its target-media identity is verified.
