# Project Executive Intent: SMI Firmware

Status: active
Type: decision
Role: project-executive-intent-v1
Updated: 2026-09-23

## Current handoff reconciliation — 2026-09-23 09:27 PDT release

Coordination is resumed from SMI; live takeover is verified, with card-data disposition and explicit hardware-action authority still pending. DisplayTest released A with no pending operation, running 01-01 on assembly 1751136 / probe 69664082 with retained HPT2 CID `05000C61736466672200001C8901A34F`. Its controller-generated IMX, source `da955dc92a1652eba247f07b32d154b4b7001e02`, is now controlled at SHA-256 `E11CEB483BA478F6A3D98F75DBF303EA09800165463EFE17880D5CDB2ACD78AB`; local hashing matched it and the accepted SMI IMX. The missing-image prerequisite is complete.

Credit existing SMI candidate/UI/export and resolved updater evidence, plus DisplayTest HPT2 startup, export, scoped navigation and Card Identity; do not replay them. Full SD Qualification was not run and is not required merely for this transition. The affected SD read/write–then-Home touch sequence and verified FAT32 production handoff remain open.

Live read-only takeover succeeded at 09:40–09:41 PDT after the earlier DNS failure. Serial-bound A / assembly 1751136 / probe 69664082 has exact DisplayTest 01-01 main-flash SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. HPT2 is ready, driver CID valid, raw CID unchanged, cached sector-zero approval valid, and captured update/format/SD-test/SDQ request flags idle; FAT32 handoff remains NONE. See `work/evidence/smi-displaytest-live-takeover-20260923.json`. No halt/go/reset/program/power/format command was issued; J-Link initialization reported a low-power wake. The smallest open SMI-owned test is A's ordinary DisplayTest 01-01 → accepted SMI 00-05-01 installation through verified FAT32 fixture handoff. The retained HPT2 card first needs a recorded preservation/archive or expendable-data decision and explicit erase consent; an IMX export does not preserve SD history. After authorization, minimal FAT32 preparation and the focused affected touch check can supply that prerequisite without Full Run. Programming, power operations and formatting are not authorized by this handoff or reconciliation.

Remaining exact-candidate A/B forward/return, refusal/renamed-file, representative rollback, fault/recovery, initialization, logging/history/export and retention gates remain open. Earlier dated pause/missing-image statements below are history superseded by this capsule; prior owner-abandoned commitments remain abandoned. Evidence and the concrete next-step sequence: `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

## North Star

Deliver dependable SMI oven firmware that keeps control, monitoring, and alarms operating through storage faults, and releases only behavior proven on both controller assemblies.

## Current Completion Horizon

Complete the SMI 00-05-01 and DisplayTest 01-01 or later transition through an evidence-backed release decision. "Done" requires the return path, the ordinary personality update floor, direct service rollback to any valid SMI image, explicit in-place FAT32 or HPT2 card preparation as applicable, and forward, return, refusal, and rollback tests on both assemblies. A passing build alone does not close this horizon.

## Strategic Context

The SMI 00-05-00 development line introduced HPT2 logging, but lacks the proposed ordinary-update downgrade guard and was never deployed on a production controller. Production DisplayTest hands off FAT32 media, while SMI prepares HPT2 media explicitly. A rare recovery may need direct installation of older SMI firmware; the installed SD card is not field accessible for replacement, so FAT32-era rollback requires a controlled in-place format. Service 471 can explicitly reinitialize HPT2 if current SMI remains bootable after a pre-flash failure. Internal-flash failure risk applies to upgrades and downgrades. Firmware candidate identity and exact-byte release controls are established; the full HPT2 claim and SD-card family qualification have separate evidence gates.

The SMI ordinary updater owns the 00-05-01 personality floor while HPT2 media may remain installed. The DisplayTest 01-01 return floor is distinct: revised DisplayTest must tolerate HPT2 on startup and verify FAT32 before its normal production test or personality install. Its own fixture-to-fixture floor is 01-01, and it may install a valid older SMI after FAT32 handoff. Read-only DisplayTest source and Controller B records support that path, but do not close the SMI two-controller transition gate.

## Current Priorities

- Treat all SMI candidates before `00.05.01-1bf8afe6aeba-6476100e5ae5` as superseded for current qualification.
- Preserve accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5`, frozen from commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`, and controller-generated image `7520553_SMI_00_05_01.imx` with SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`. Its updater retains verified FAT32, formats another readable layout only for a FAT32 target after consent, refuses missing or unreadable required media, and disables the main chart whenever logging is unavailable.
- Resume SMI coordination with both exact IMX identities available. Live read-only A takeover is verified; settle retained HPT2 data disposition and explicit action authority, then qualify A's verified-FAT32 DisplayTest-to-SMI forward path. The earlier internal-flash handoff defect remains resolved.
- Exclude SMI 00-05-00 from target qualification. Its below-floor behavior is covered by focused host policy tests; it is not a production-controller baseline or bridge.
- Complete the A-first/B-second forward, return, refusal, controlled rollback, HPT2 initialization, logging, retention and export matrix under explicit hardware-action authority; make the later release decision from exact candidate evidence.
- Keep CVO and DVO outside this project and do not alter DVO.

## Deliberate Non-Goals

- On 2026-09-23 the owner abandoned the temperature-control recovery and RTD-interlock successor campaigns, standalone SD Qualifier and independent physical-media validator delivery, SD specimen/family approval and supply-change closeout, and Tool Shed defect tickets TKT-0035/TKT-0036. These are no longer local execution commitments. Existing evidence, accepted limitations, and unresolved technical risks remain recorded in `docs/project-work-disposition-20260923.md`; abandonment is not qualification or defect resolution.
- No unconfirmed SD-card conversion or erase, and no field SD-card swap as an update or rollback workflow.
- No claim that the update Title authenticates its publisher.
- No automatic CVO/DVO release, SD-family approval, ECO, or customer rollout from the SMI transition result.

## Decisions Needed

- Settle retained-card preservation/archive versus explicit expendable-data disposition before conversion.
- Live A verification is complete; explicitly authorize the next hardware operation after card-data disposition; coordination resumption alone is not programming, power or format permission.
- Close the remaining DisplayTest touch/FAT32 handoff and exact-candidate A/B gates before a separate release decision.

## Review Triggers

- A DisplayTest 01-01 or later candidate is qualified for safe HPT2 startup and FAT32 handoff.
- Controller A visual boot or storage evidence contradicts the read-only target capture.
- Either assembly produces contradictory transition evidence.
- The in-place FAT32 preparation or service-471 recovery path produces contradictory evidence.
- An exact candidate reaches release qualification.
- The SD qualification or supply-change scope changes.

## 2026-09-22 requirements and evidence update

Controller A accepted and staged the prior SMI 00-05-01 IMX, with exact QSPI main SHA-256 `7F49E615FF971D1C63E44CF94B8DCD9BF919DA7846E052408189997A58B78B8E`, but internal flash remained at SHA-256 `CFC9ECC6ABCCDDA5633FFF6AB8A6595ECAC21F6AC951ED35F0D51407BB8CE407`. The owner added a target-driven FAT32 rule and disabled-chart rule. The revised source passes focused checks and canonical Debug/Release builds; Release S-record SHA-256 is `4E7DFB2F7333202C71A736DF6692512030DB43508A1CCD0C556E7E8C1EB6B326`. It is not frozen or target-qualified. No controller or SD mutation occurred during this requirements detour.

## 2026-09-23 reconciliation

The 2026-09-22 internal-flash failure was diagnosed and corrected by watchdog, FCU command-lock, and ROM-cache changes. A controlled self update completed with diagnostic error `0` and exact four-MiB flash readback. Accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` has Release S-record SHA-256 `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`; Controller A exact readback SHA-256 is `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the Format 2 startup and disabled-chart UI behavior. Service 150 then generated the final SMI IMX with SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, valid CRCs, and an exact main-payload match. The remaining current prerequisites are the controlled DisplayTest 01-01 IMX and the paused A/B transition, refusal, rollback, and fault matrix. No release decision has been made.
