# Project Map: Service 489 Unattended Run And USB Evidence

Status: complete
Type: project-map
Updated: 2026-09-03
Next Action: none; PRM-0007 completed the requested Work2 endpoint and later corrections or Work5 remain separately owned
Source Idea: IDEA-0003
Readiness Review: 7667930b6dcc4dbd2c650f83a9e5bceeec136e396426f18e7c16325ac9ae9f1d
Requested Endpoint: work2

## Desired Outcome

Deliver a committed firmware candidate in which service 489 collects and durably freezes its
controller/CID-bound execution plan, explicitly includes or bypasses service 487, optionally emits
bounded standards-based USB evidence, preserves the service-486 power boundary and service-488
one-shot resume, and reports bypass or evidence loss without manufacturing qualification credit.
Deploy that exact candidate to non-production Controller A and stop at verified Work2.

## Direction Map

```text
IDEA-0003
  |
  +--> Immutable session plan and result semantics -------- G1
  |
  +--> Bounded USB evidence publication ------------------- G2
  |
  +--> 486 pause / 488 one-shot resume -------------------- G3
  |
  +--> Focused checks, managed build, packaged candidate -- G4
  |
  +--> Controller A deploy, verify, release-cohort bind --- G5
          |
          +--> Work2 complete; later work remains separately owned
```

## Workstreams

| Workstream | Required result | Boundary |
| --- | --- | --- |
| Session plan | Persist controller, firmware/catalog, CID, 487 selection, USB selection, override reason, and final confirmation before destructive work | A bypass is never endurance credit |
| USB evidence | Versioned JSON/NDJSON, calculated capacity bound and reserve, viability probe, one folder, incremental artifacts, hashes, manifest, marker-last finalization | USB never becomes resume authority or specimen-specific behavior |
| Recovery/resume | Keep frozen 486-before-487 order, whole-controller interruption, stable-boot validation, and atomic service-488 consumption | No powered SD movement and no automatic replay |
| Firmware candidate | Reuse the shared engine and existing FileX/USB surfaces; pass focused policy/model/regression checks and canonical build/package gates | Do not duplicate leaf implementations or broaden USB lifecycle |
| Work2 target | Bind Controller A, live CID, exact candidate and rollback; verify focused changed behavior without claiming service-487 completion | No Controller B, family, certification, production, or Work5 credit |

## Readiness Gates

- `G1-SESSION-PLAN-SEMANTICS`: immutable selections, persistence, confirmation, routing, and result semantics pass model and source checks.
- `G2-USB-EVIDENCE-PUBLICATION`: bounded schema, capacity, viability, streaming, loss, hashing, manifest, and finalization behavior pass.
- `G3-RECOVERY-RESUME-SAFETY`: service 486 and 488 preserve identity-bound one-shot recovery with no replay.
- `G4-WORK2-CANDIDATE`: focused checks, canonical managed Debug rebuild, packaging, and scoped product commit pass.
- `G5-WORK2-CONTROLLER-A`: exact Controller A deployment, rollback, CID, health, focused behavior, and release-cohort registration pass.

## Separate Work Beyond This Map

Later service-487 execution and evidence admission, mounted-USB publication,
Controller B or paired-family qualification, subsequent firmware corrections,
certification, and Work5 are not owned by this completed Work2 map. They require
their own current outcome and release-cohort state; later evidence does not
retroactively reopen this map.

## Work2 Result

Candidate `ef61437cca8c350792d79c484abf0612a9167bf6` is committed and deployed
to non-production Controller A. Managed build/package and all focused
regressions pass. Target captures bind assembly `1751136`, J-Link `69664082`,
and valid/readable CID `05000C61736466672200001C8901A34F` to the exact
S-record SHA-256
`1A0D64B1A037882AF096A1A587246AC73CD382D690F2AC805CA399987E1167A2`.

USB-gated target runs proved independently frozen INCLUDE-487 and BYPASS-487
plans without starting a leaf. A reboot restored the immutable plan and
blocked without replay. Guarded abandonment and a final reset left the
controller idle with no saved run. Full evidence is in
`docs/sd-qualification-service-489-work2-evidence-20260901.md`.

G1 through G5 pass for Work2, and the IDEA-0003 outcome cycle is terminal,
satisfied, and reconciled. Subsequent service-487 execution, mounted-USB
artifact finalization, corrections, Controller B/family qualification,
certification, and production release remain separately owned and receive no
credit from this completed map.
