# Idea Brief: HPT2 Personality Update Floor at 00-05-01

Status: exploring
Type: idea-brief
Updated: 2026-09-24
Next Action: None for this brief; remaining release work is owned by IDEA-0007 and MAP-0009.
Superseded By: IDEA-0007, MAP-0009
Readiness Review: run explicitly with ts: bs review; ordinary brainstorming does not review
Produces:

## Current release reconciliation — 2026-09-24

Corrected candidate `00.05.01-b59c33d1c1f4-3f464c236471` is committed, reproducibly built, immutable and locally registered. Controlled images, A/B normal transitions, A warning/Cancel, B HPT2 initialization/logging/CSV/restart retention, accepted DisplayTest return/restart behavior, and A malformed-header refusal are evidenced. CAMP-0028's service-471 target criterion is now evidenced on B. Do not repeat these completed checks.

The owner removed stale-selection testing as a release requirement and closed both the legacy 00-04-11 Success mismatch and DVO intermittent 901 investigations. Preserve their observations without further resolution work or root-cause claims. The accepted transition contract already excludes promised recovery after internal-flash replacement starts; this is a scope limit, not a new qualification deliverable. The owner accepted the existing source/host checks as sufficient for SD-preparation failures and timeouts before flash replacement on September 24. All four qualification gates are satisfied, including that explicit evidence disposition; no target fault-injection pass is invented. Missing historical CID/screen captures remain declared evidence limits, not requests to reconstruct them.

Firmware release is explicitly unauthorized. The cohort remains working and unfrozen; final scoped content checkpoint, release preflight/exact-content CI, publication, and release-outcome reconciliation remain future release work. One candidate commit has two owner registrations (MAP-0009 and CEO IDEA-0007), not two firmware candidates. IDEA-0006 is the technical source for this same outcome. No abandoned work is revived. Detailed prior checkpoints remain in managed revision history and linked evidence.

Current authority: `docs/firmware-update-validation-and-recovery.md` and `work/evidence/smi-current-release-gate-review-20260924.json`.

## Current Synthesis

This discovery brief is superseded by IDEA-0007 and MAP-0009. Its technical direction and accepted qualification are preserved there; it has no independent active or ready work. Firmware release remains unauthorized.

The technical direction has been carried into CEO IDEA-0007 and MAP-0009: ordinary Update Software and service 151 share admission, confirmation and worker; valid older SMI uses target-driven FAT32 preparation with explicit consent, retaining verified FAT32. Service 471 initializes HPT2. DisplayTest 01-01 is the return floor. Corrected candidate identity, normal A/B transitions and storage behavior, and malformed-header refusal are evidenced. This technical-source brief does not add a second execution or release commitment. Qualification is accepted; remaining release preparation and delivery are owned by MAP-0009/IDEA-0007.

## Constraints And Non-Goals

- CVO and DVO are outside this project. Do not alter DVO in this lane; this project implements and qualifies SMI only.
- DisplayTest uses a separate 01-xx version series. The normal return floor is 01-01; unknown or older DisplayTest images default to refusal. Identify exact specimens for qualification, not for a production allowlist.
- Field SD-card removal or replacement is not a practical recovery step. Service 471 initializes HPT2, not FAT32; the FAT32-era rollback requires a distinct explicit FAT32 preparation action.
- No update workflow may promise a working touch screen after a failed internal-flash replacement. That risk is common to upgrades and downgrades; it is not a downgrade-specific reason to prohibit the service path.
- MachineMask alone does not establish product identity or SD compatibility. The version convention depends on controlled release discipline, not cryptographic authentication.
- Preserve published IMX files unchanged. Do not erase card data requiring retention without controlled disposition.
- This brief adds no new hardware or release authorization. Completed approved work is credited by MAP-0009; no further bench test is scheduled.

## Shared Transition Contract

The current capsule and `docs/firmware-update-validation-and-recovery.md#current-release-gate-reconciliation--2026-09-24` define shared target-media preparation. DisplayTest remains its own read-only project lane with verified FAT32 production handoff and a 01-01 fixture floor. SMI handles explicit HPT2 initialization and admitted ordinary legacy downgrades in place; field SD-card replacement is not a supported recovery workflow.

## Open Questions

No transition qualification question remains after the owner accepted source/host coverage of SD-preparation failures and timeouts. Final release preparation and release authorization remain with MAP-0009/IDEA-0007; this brief adds no separate task.

## Decisions

Owner direction controls: shared ordinary/service updater, conditional in-place FAT32 preparation, no powered SD swapping, excluded SMI 00-05-00 and DisplayTest 01-00 loads, accepted post-install power cycle, closed DVO and 00-04-11 legacy investigations, and no required stale-selection test. The existing contract does not promise recovery once internal-flash replacement starts. Release remains unauthorized. Earlier exploration records preserve history and do not override these decisions.

## Exploration Log

### 2026-09-21

- Owner selected a common 00-05-01 minimum for SMI, CVO, and DVO HPT2 personalities, directed the next SMI revision to be 00-05-01, and requested separate Tool Shed entry points.
- Owner accepted the transition and media-preparation recommendations, required a return path to DisplayTest, and selected the IMX header Title as the candidate identity source because operators may rename the external USB file. The return floor was clarified to DisplayTest 01-01 or later, with safe HPT2-card startup and a reciprocal personality floor required before release.
- Owner added the rare direct SMI service-rollback need, rejected field SD-card swapping as impractical, and identified service 471 as the existing explicit HPT2 reinitialization path after a pre-flash failure. Ordinary upgrade and downgrade share internal-flash failure risk; the extra rollback requirement is controlled in-place FAT32 media preparation and data-loss handling.
- Owner clarified that service rollback may use any valid SMI image, with no version allowlist. The DisplayTest normal return minimum is 01-01, correcting an earlier 05.01 reference. Exact images remain qualification specimens and release evidence, not admission policy.

### 2026-09-22

- Read-only DisplayTest source review found that `src/DisplayTestUpdateAdmission.h` imposes no personality version floor; its fixture-to-fixture minimum is 01-01. DisplayTest's FAT32 handoff precedes personality installation. Its project record reports a Controller B FAT32 handoff and installation of SMI 00-04-11, with a power cycle needed after an initially unresponsive install tap; old SMI logging remains unproven there. The earlier reciprocal personality-floor language is superseded by the media-state contract above. SMI A/B return and rollback qualification remains open, and this project's bench pause remains in force.

### 2026-09-22 scope correction

- The owner confirmed that `7520553_SMI_00_05_00.imx` was never deployed on a production controller and does not need target qualification. It is removed from the physical transition path. The exact SMI 00-05-01 candidate will be installed directly through Settings > Update Firmware using a deterministic IMX built from the frozen Release S-record and released 00-04-11 audio resources.

### 2026-09-22 target-media and chart-availability requirement

- The owner requires an admitted FAT32 target to retain an already verified FAT32 card and to require a controlled format for any other readable classified layout. Missing or unreadable required media stops the update. Supported DisplayTest and pre-00-05-00 SMI targets require FAT32; ordinary SMI/CVO/DVO at 00-05-01 or later retain HPT2.
- The owner requires the main chart button to look disabled whenever the datalogger cannot record, including absent media or wrong format. The SMI implementation now uses live logger readiness and the existing gray disabled pixelmap.
- Controller A accepted and staged the prior 00-05-01 IMX but retained the old internal flash. That frozen candidate is superseded by this requirement change. Commit `10dbb91519384cc9144b94e8a79057c8f47c0630` contains the target-media and chart-availability implementation. Clean Debug and Release rebuilds reproduced the committed artifacts byte for byte, and immutable candidate `00.05.01-10dbb9151938-4e7dfb2f7333` validates with manifest SHA-256 `6F753689C56EFACE054C802FF782FFCC193BFAE2D7F5E948F0BE20F44FA86586`. Target proof remained open at this checkpoint; the 2026-09-23 entry below records the later evidence.

### 2026-09-23 current evidence

- Later watchdog, FCU command-lock, and ROM-cache corrections resolved the Controller A internal-flash handoff defect. A controlled self update completed with diagnostic error `0`, and the complete internal-flash readback exactly matched its candidate. The prior unresolved-transition statement is historical and no longer a blocker.
- Accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` is frozen from commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`; its Release S-record SHA-256 is `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`. Controller A readback exactly matched the expanded image at SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`.
- The owner accepted the fitted Format 2 startup warning, reason-specific disabled-chart interaction, operator service 467 access, and service 471 warnings. The card was then initialized during review and returned ready with unchanged valid CID `05000C61736466672200001C8901A34F`.
- Controller A service 150 generated final SMI image `7520553_SMI_00_05_01.imx`, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`; all container CRCs validate and its main payload exactly matches the accepted Release candidate. The exact DisplayTest 01-01 IMX and the remaining A/B transition, refusal, rollback, and fault evidence are still open. Bench work remains paused.
