# Program Roadmap: Firmware Service-Code SD Qualification

Status: blocked
Type: program-roadmap
Updated: 2026-08-31
Project Map: MAP-0004
Source Idea: IDEA-0001
Outcome Cycle: cec58490-b533-46a7-bbe5-10e7addba684
Requested Endpoint: work2
Next Action: correct service 486 so a coordinator-bound synchronous recovery pass can reach a terminal leaf result without weakening no-replay or identity gates; build a new exact candidate and obtain fresh programming authority before repeating M4

## Program Outcome

Produce a committed firmware candidate in which individual SD qualification
services and one ordered full-run service use one shared leaf-test engine, then
deploy that exact commit to an explicitly bound non-production work target and
prove its changed behavior. Preserve powered-removal safety, CID-bound run
identity, no-replay recovery, standards-based USB publication, bounded-work
evidence, and independent final qualification authority.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Freeze the qualification authority and shared test catalog | `G1-SHARED-TEST-CATALOG`, `G2-FIRMWARE-WITNESS-AUTHORITY` | none | complete; Option A, contract disposition, and catalog frozen |
| M2 | Prove pause/resume and evidence contracts in a target-independent reference model | `G3-PAUSE-RESUME-SAFETY`, `G4-EVIDENCE-PUBLICATION` | M1 | complete; eight model tests and policy checks pass |
| M3 | Integrate the shared engine, service dispatcher, journal, and publication path; build and verify bounded work | `G5-PERFORMANCE-ADMISSION` | M2 | complete; candidate `3df82f32b997022efeaba97561d7a2320dcf7997` built and packaged |
| M4 | Deploy the exact candidate to the bound development target, run focused changed-behavior/rollback checks, and register the Work2 release cohort | `G6-WORK2-DEVELOPMENT-TARGET` | M3 | blocked; exact candidate failed service-486 recovery integration on target and was rolled back |

## M1 — Authority And Catalog Freeze

### Owner decision D1 — Option A selected 2026-08-31

- **A — Recommended hybrid:** firmware owns leaf-test truth, prerequisites,
  progress, safe-stop checkpoints, and technical results; the Pi/web qualifier
  owns campaign sequencing across controllers, independent power witnessing,
  evidence ingestion/admission, and reviewer/family disposition.
- **B — Firmware owns the full campaign:** simplifies offline execution but
  moves cross-controller, review, persistent evidence, and power-witness burden
  into the controller and weakens independent observation.
- **C — Pi owns the full-run order:** stays closest to the current governing
  contract but does not deliver IDEA-0001's firmware full-run service unless
  that service becomes a thin, Pi-directed leaf sequence.

The owner selected Option A. Firmware is authoritative for shared leaf-test
execution, prerequisites, progress, safe-stop checkpoints, and technical
results. The Pi/web qualifier is authoritative for cross-controller campaign
sequencing, independent power witnessing, evidence ingestion/admission, and
reviewer/family disposition. Record this split in the disposition of
`SMI-SDQ-CONTRACT-V1`. Freeze the exact 480–489 allocation only after confirming
dispatcher availability. The catalog must reuse existing CID, media
classification, scrub, lane, wrap/reclaim, recovery, endurance, export, and
mailbox mechanisms rather than create parallel test implementations.

### M1 completion evidence

- `docs/sd-card-qualification-contract.md` records selected Option A.
- `qualification/profiles/sd-qualification-service-catalog-v1.json` and
  `docs/sd-qualification-service-catalog-v1.md` freeze the 480–489 service
  allocation, seven shared leaves, ten-step order, prerequisites, safety,
  progress, stop, and result semantics.
- `script/check-sd-qualification-service.ps1` proves dispatcher completeness
  and shared individual/full-run implementation routing.
- Result: `G1-SHARED-TEST-CATALOG` and
  `G2-FIRMWARE-WITNESS-AUTHORITY` pass.

## M2 — Safety And Evidence Reference Model

- The durable journal uses the existing mirrored configuration persistence and
  binds format/state, mode, step, completion mask, run identity, firmware and
  catalog identity, and raw 128-bit CID.
- An active interruption becomes blocked and never replays automatically.
  Manual service 488 continuation is accepted only from a planned pause after
  firmware, catalog, CID, representative-sector, and media checks pass.
- Workflow, technical result, method disposition, and evidence admission are
  separate. Firmware cannot claim Pi evidence admission.
- `script/test-sd-qualification-service-model.py` passes eight tests covering
  catalog identity, shared order, external power pause, active-reset no replay,
  identity-bound manual resume, separate results, independent evidence
  admission, and bounded leaf budgets.
- Result: firmware-side `G3-PAUSE-RESUME-SAFETY` and
  `G4-EVIDENCE-PUBLICATION` contracts pass; live Pi ingestion remains M4 proof.

## M3 — Firmware Candidate

- Shared state machine, dispatcher, catalog, journal, UI safety gates, status,
  progress, and result surfaces are integrated without specimen-specific SD or
  USB production behavior.
- All new policy/model checks and the existing SD safety, scrub,
  initialization, endurance, and commissioning suites pass.
- The canonical managed clean Debug rebuild and artifact packaging passed.
- ELF SHA-256:
  `E9AF2BAF44A43FABBE58F69B0D22D6E14A34691DC955E848668C3E737E3FC08E`.
- S-record SHA-256:
  `CE2A5D2337D49CC437BFDA0C6A14BB21CD07937947AF9B6EE0DD1B4889790490`.
- Map SHA-256:
  `8A6C169C12C2F0BCA72E3769651C801045D2A71301E5E94E88A6A4B435778CC2`.
- Scoped candidate commit:
  `3df82f32b997022efeaba97561d7a2320dcf7997`; unrelated dirty work remains
  outside the commit.
- Full evidence: `docs/sd-qualification-work2-candidate-evidence-20260831.md`.
- Result: repository-side `G5-PERFORMANCE-ADMISSION` passes.

## M4 — Work2 Delivery

### Material target decision D2

The owner bound Controller A assembly `1751136`, hardware variant `0`, J-Link
`69664082`, `setup-a`, and the installed expendable card with live CID
`05000C61736466672200001C8901A34F`. The owner authorized exact candidate
`3df82f32b997022efeaba97561d7a2320dcf7997`, a predeployment 4 MiB rollback
capture, the focused 480/481/483–486/488/489-through-recovery checks, and the
qualified whole-controller interruption. Service 487, powered SD movement,
production release, and family qualification remained excluded.

Candidate deployment and independent full-flash readback passed. Services 480,
481, and 483 through 485 passed, including the negative destructive-
confirmation check. A qualified Group A power cycle then proved durable
no-replay restoration, unchanged CID, healthy raw-HPT reopen, and an underlying
controlled recovery pass. Service 488 accepted continuation only after the
expected sequence/boundary was published and all resume validations produced
mask `0x3F`.

M4 failed because service 486 remained `WAITING /
EXTERNAL_COORDINATOR_REQUIRED` after the synchronous diagnostic reached
`RECOVERY_PASSED`. The qualification poll requires prior observation of a
transient active state, but the SD thread executes the complete synchronous
recovery between its before/after qualification polls. It therefore observes
idle-before and passed-after, never sets the active-observed flag, and never
finishes the leaf. Service 489 was not started.

The exact predeployment 4 MiB flash capture was restored and independently
read back with matching SHA-256
`15DF631AE4C7887F22A72AFCDD95DEF96DD4D78620CAB21F76715E9433D4F214`.
Controller A is running the restored firmware and the CID remains unchanged.
The SD Qualifier ingested the immutable failed-run package at
`evidence/raw/prm-0006/m4-controller-a-20260831` without runtime, database, or
campaign mutation. Full evidence is in
`docs/sd-qualification-work2-m4-target-evidence-20260831.md`.

`G6-WORK2-DEVELOPMENT-TARGET` remains blocked. Do not register a release cohort
from this failed candidate. Correct the service-486 terminal-observation
contract without weakening sequence/boundary, firmware/catalog, CID,
representative-sector, media-state, manual-continuation, or no-replay gates;
then rebuild a new exact candidate and obtain fresh programming authority
before repeating M4.

## Deferred Beyond Work2

- production push, tag, release, or promotion;
- card-family qualification credit or final family disposition;
- ECR/ECO, sourcing, BOM, pilot, or rollout decisions;
- physical destructive qualification not separately authorized.
