# Project Map: SMI firmware stabilization and qualification

Status: active
Type: project-map
Updated: 2026-08-14
Next Action: follow `work/00-campaigns/active-queue.md`; continue working request 002 while authorization-gated requests remain blocked
Campaign Reason: Cross-campaign coordination or operating guidance; intentionally tracked outside any single owner campaign.
Campaign: standalone

Canonical Truth: E:/dev/high_point/7520553_SMI_FW/docs/

## Current checkpoint

Owner execution is now ordered by `work/00-campaigns/active-queue.md`. The
SD-card supply-change checklist remains the engineering closeout contract, not
a competing scheduler. The canonical qualification contract and ECR document
define requirements; the deployed SD Qualifier database and exact image define
runtime state; all other active artifacts are subordinate workstreams or
evidence. The 2026-08-14 reconciliation manifest maps each incomplete outcome
to the owner queue:
`work/evidence/tool-shed-campaign-reconciliation-20260814.md`.

Gate 2 architecture and `work2` delivery are coordinated by
`work/wp/active/wp-controller-neutral-sd-qualification-and-independent-a-b-execution.md`:
one controller-neutral test contract, independent A/B scheduler lanes, one
cross-operation J-Link lease per controller, role-neutral recovery/readiness,
and a versioned UI/backend boundary. The non-web runtime core remains Pi commit
`8cdfa3b`, image `srv-rpi00-sd-qualifier:independent-ab-8cdfa3b`; both role
recovery variables select the same role-neutral runner. The current web image
is `srv-rpi00-sd-qualifier:terminal-closeout-470d62b`, source `470d62b`.
Gate 2 still requires physical Controller B recovery qualification and
release-line consolidation.

The owner accepted the 2026-08-13 frozen-audit recommendation for Aug. 10
campaign `8c7a2b1a-7e67-48ac-8895-7999d76c4c2a`. It is now terminal
`ABORTED`, presented as `CLOSED — without qualification conclusion`, with the
permanent `INCONCLUSIVE — no card rejection` reason. Coordinator and lanes
remain paused; all `187` runs and `361` HPT2 operations remain terminal; both
card results are unchanged. A reconciled immutable manifest/report records no
qualification conclusion. Terminal pages expose no resume controls, the exact
run-bound observer is disabled, observation evidence is stable, and appliance
health is OK. Evidence:
`work/evidence/sd-qualifier-aug10-campaign-inconclusive-closeout-20260813.md`.

The campaign-first `/sd-qualifier/` workspace is deployed for owner evaluation
as web-only image `campaign-workspace-ui-7a31b3e`, source
`7a31b3ea3ddf1a33122a84ddf649bdeda93c032f`. It provides campaign entry and
history, shared shell navigation, campaign phase status, progress/current-step
and forecast truth, short tabbed sections, and expandable detailed evidence.
Focused final responsive tests and authenticated desktop/mobile smoke checks
pass; the preceding full application candidate passed `355/355`. Campaign
workers retained identity and no controller, media, database, or firmware
action occurred. This is explicitly a first-pass UI deployment rather than a
hardened release. Evidence:
`work/evidence/sd-qualifier-campaign-workspace-first-pass-deployment-20260812.md`.

The owner has reset the primary direction to the website-driven SD-card
qualification application on `srv-rpi00.local`. The application workpackage now
contains the governing end-to-end operator journey, qualification contract,
shared page shell, campaign step navigation/status model, durable control
contract, application-first delivery stages, and an explicit stop-and-report
rule for any required supporting detour outside the app. Existing component and
live-campaign evidence remains valuable history, but it no longer defines the
next action by itself.

The web-started persistent campaign coordinator is deployed as release
`campaign-coordinator-0490369`. Exact ARM64 `348/348`, standalone `49/49`,
PostgreSQL `5/5`, package, backup/restore, health, authenticated Playwright,
and restart/no-replay verification pass. A fresh fixture campaign completed
the five executable matrix/recovery/regression/closeout leaves and stopped at
the reviewer-owned final-disposition gate. No live controller or media action
was admitted. Live continuation now requires the reviewed protected marker for
the restore-verified current backup plus reviewed A/B envelope lifetimes
covering the bounded matrix, followed later by protected Controller B
coordinated-cycle capability and reviewed scrub authority. Evidence:
`work/evidence/sd-qualifier-web-campaign-coordinator-deployment-20260812.md`.

The Controller A terminal supervisor state is reconciled without command
replay. Release `qualification-handoff-guidance-55ed692` now treats
an inactive successful transient runner as expected only when the completed run
has matching STOPPED terminal proof and finalized evidence. Web release
`qualification-handoff-guidance-55ed692` no longer claims automated work is
running when no current run is open; it presents the exact campaign handoff for
both cards. Both releases pass `343/343`, live health is OK, and both cards
remain correctly `IN PROGRESS`. Evidence:
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

Operator-guidance and failure-message cleanup is complete. The qualifier's
authenticated desktop/mobile review found and fixed a long-token overflow,
then passed exact-image testing and web-only continuity. Firmware now reports
specific confirmed HPT initialization failure phase/status/recovery text; all
six export-domain messages, focused gates, managed Debug/Release rebuilds, and
stable/versioned package hashes pass. The remaining export issue is the
separate full-history scan latency decision in
`work/tickets/ticket-eliminate-full-history-scan-latency-for-bounded-hpt-customer-exports.md`.

The occupancy-scaling correction and frozen candidate
`smi-00-05-00-389167c1d57f-37ff5c0c6f48-release` completed the representative
bilateral target regression on the installed Controller A and B specimens.
All six 129600 BEFORE/AT/AFTER results, representative HPT read/write, physical
USB publication and independent-reader verification, normal production
logging/chart read, and exact configuration save/restore passed. Both final
CIDs matched baseline; both controllers ended with HPT state/status 5/0, lane
mask 7, and zero mismatch, loss, retirement, or system errors. Evidence:
`work/evidence/hpt2-exact-read-active-prefix-software-gate-20260810.md`,
`work/evidence/representative-ab-regression-20260811.json`, and
`work/evidence/representative-ab-operator-target-gates-20260811.md`.

This is a representative-regression pass, not a final pass for either physical
specimen. Qualifier evidence IDs `7624` and `7625` now credit traveler step 6
only. The current-image matrix, Controller B recovery, both post-campaign
scrubs/CID closeouts, both dispositions, and the paired gate remain open; both
cards remain `IN PROGRESS`. The long bounded-export delay is deferred as a
separate performance issue. Evidence:
`work/evidence/sd-qualifier-representative-regression-reconciliation-deployment-20260811.md`.

Every QA traveler step now links to its detailed, contract-grounded
qualification description in production release
`qualification-traveler-reference-0acdb5e`, exact image
`sha256:a17164e...767881`. Each of the eight descriptions states the method,
pass criteria, evidence, failure handling, and operator/safety boundary.
Playwright clicked and returned through all eight links; exact ARM64 tests pass
`309/309`. Deployment preserved both runner invocation IDs and role observers,
both supervisors remain healthy, and current interventions remain zero.
Evidence:
`work/evidence/sd-qualifier-traveler-reference-deployment-20260810.md`.

The operator UI performance defect is corrected in production release
`qualification-page-performance-e2bc362`, exact image
`sha256:d7c5a855...cc3552`. A campaign query multiplied every run by every
event before aggregation, causing server time to grow with qualification
history. Correlated latest-event lookup reduces authenticated Playwright
timing from `11.666 s` to `1.080 s` for the dashboard and from `5.881 s` to
`1.745 s` for F1-A1; F1-B1 is `1.644 s`. Exact ARM64 tests pass `307/307`,
both parent runner invocations and observers are preserved, both live runs
continued to heartbeat, and current intervention/supervisor-alert counts are
zero. Evidence:
`work/evidence/sd-qualifier-card-page-performance-correction-20260810.md`.

The operator-facing intervention state is now current and auditable. Release
`qualification-current-interventions-e4bf6e5`, image
`sha256:99ff23bd...37e2db`, and manifest `ff7a182b...34089f` remove recovered
supervisor alerts from the current-action dashboard, retain them as closed
campaign history, stop their reminders, and give future watchdog alerts exact
run/controller attribution. All `185` recovered supervisor notifications are
closed with audit events; the authenticated dashboard and campaign render agree
with both healthy live supervisors. Both parent runner invocations were
preserved and zero commands are unresolved. Evidence:
`work/evidence/sd-qualifier-current-intervention-projection-and-recovery-closure-20260810.md`.

Production release `qualification-watchdog-91bfd8a`, unified source
`91bfd8a1709ea87aa9be393ac1a3bab086c77feb`, image
`sha256:819e12a233a867d4fedd28c1f45c8247b4d1b27bcfe6f0792dcb265765fcf7e4`,
and manifest
`6bc6e768fb82728e8d1ec6af3a64be1f8ea8ac0c43c350c251c939ed3374cd4d`
correct cross-controller activity coupling, exact S4 stage binding, observer
proving cadence, and false monotonic regression across a run boundary. The
operations suite passes `44/44`, focused watchdog tests pass `28/28`, and the
exact combined ARM64 suite passes `305/305`; backup restore, deployment,
container identity, health, and rollback preparation pass.

Controller A run `a2dbfca4-805b-4fca-bf69-b01717e0f083` is healthy and
progressing on S4 `44640 / AFTER` observation 3. Controller B run
`c46bc49d-c200-4dfe-a00d-ec38cfca7b2c` credited S4 `10080 / BEFORE`
observation 2 after its exact Start/Stop pair, stable stopped-clean evidence,
and both adjudicators. Successor B run
`79a3a85f-3433-4d49-97a6-5bd539cadb41` is active for observation 3 and was
healthy on its first new-run supervisor snapshot. Both controller identities
are unchanged, neither SD card was physically disturbed, and no unresolved
command operation remains. The full A/B matrix and combined audit remain the
gate before interrupted-session recovery. Evidence:
`work/evidence/s4-parallel-restart-watchdog-run-boundary-deployment-20260810.md`.

Controller B base coverage now passes at S0 `7/3`, S1 `11/10`, S2 `37/10`,
and S3 `10/10`. Operations commits `e0a1a95` and `beb5a57` add verified
dead-owner-only observer cleanup and role-scoped progress-aware S4 execution.
B service v1 completed and credited the first `1440 / BEFORE` observation
without replay, then exposed a transient adjudication-command exit after
finalization. Commit `c4990b2` adds durable-evidence confirmation. Successor
service `sdq-controller-b-s4-matrix-v2.service`, invocation
`c0e283d128d04dcfa5d7f94a5bcb2d4e`, completed and credited observation 2
with both adjudicators confirmed, and began observation 3 from credited count
2. A retained invocation
`8bf2ff84f9cb432db4b74edffe00ee6c` and advanced to
`36211/36211/36210`. Post-matrix recovery remains closed. Evidence:
`work/evidence/controller-b-base-matrix-pass-and-s4-parallel-launch-20260809.md`.

The runner/watchdog infrastructure gate is corrected. Production release
`qualification-runner-supervision-e82398a`, source `e82398a`, and manifest
`a25039e4...fb1fc` bind the actual A matrix/dependent service chain, a
record-progress lease, a separate hard ceiling, immutable Compose context, and
separate bounded per-controller target-access locks shared by campaign commands
and observer snapshots. Forced observer exits clean their temporary allowance,
and each new cycle removes same-role stale observer rules. Controller A exact run
`de340af2-d505-495e-a14f-5159e55b1633` resumed without Start replay; the
watchdog is healthy and names runner invocation
`8bf2ff84f9cb432db4b74edffe00ee6c`. Current progress is
`26716/26716/26715` with unchanged CID/boot/firmware identity.

Controller B S0 is now `3/3`, PASS. Separately authorized run
`c20498c3-9ba6-476d-b240-d868b7937044` completed one same-session,
replay-disabled Start/Stop pair with stable stopped-clean proof and unchanged
CID `05000C61736466672200001C8201A379`. No unresolved B operation or temporary
firewall rule remains. Independent B supervision passed on live S1 run
`fdf1d523...ab38` while A remained independently healthy. Successor envelope
`7da70559-4020-4d46-bf67-053a4c0eede8` is active. One ambiguous Start was
reconciled read-only without replay and supplied valid evidence after its
paired Stop. A later admitted no-command run was recovered through one exact
prepared Start without replay. B restarted at S1 `2/10`, S2 `6/10`, S3
`3/10`, with S0 `3/3` and zero unresolved commands. Immutable B parent
invocation `8bd7f82b0afe4c63ab33115e4557d532` is active from guarded operations
commit `9c00886`. The complete A/B matrix remains
false, the production Stop deadline remains unset, and no post-matrix recovery
case has started. Evidence:
`work/evidence/progress-aware-runner-supervision-and-controller-b-s0-3-20260809.md`.

The watchdog-gated recovery campaign has passed Stages 0 through 7. Controller
A's held S4 `44640 / AFTER` run was stopped once, finalized without Start
replay, and preserved as extended observation 1 of 3. Audit-selected replicate
2 run `de340af2-d505-495e-a14f-5159e55b1633` received one acknowledged Start
and is making stable progress under the Pi-owned supervisor. Four consecutive
new-release snapshots were healthy while verified records advanced
`1070 -> 1124 -> 1179 -> 1232`; CID, boot, firmware, run, lane/failure, worker,
storage, backup, disk, service, and notification state agree.

Stage 7 used fresh exact authority and unchanged CID
`05000C61736466672200001C8201A379` to execute the admitted S0 run
`ffb59651-0bb0-4d9b-a729-0099cc0f5690`. One Start and one same-session Stop
are acknowledged and replay-disabled; two stable stopped-clean observations
produced S0 `CASE_PASS`, and adjudication evidence `1975` credits S0
observation 1 of 3. Current supervisor commit `b14dc8e`, exact image
`sha256:f53c01017249e37afa93d06012ec3d9704159fcd72da66a8fbd30f03594a78d0`,
and manifest `0069893a8301710a71579a2e53b21980073d98a53245a431cb24f085bd4c9713`
pass `304/304` tests on SQLite and PostgreSQL 17. A remained healthy and
running; B is firewalled at rest and requires separate admission for its next
case. Evidence:
`work/evidence/watchdog-stage-2-fault-matrix-20260809.md`,
`work/evidence/watchdog-stage-3-production-deployment-20260809.md`, and
`work/evidence/watchdog-stage-4-controller-a-recovery-resume-20260809.md`, and
`work/evidence/watchdog-stage-5-controller-b-parallelization-policy-20260809.md`,
and
`work/evidence/watchdog-stage-6-controller-b-preflight-power-confirmation-gate-20260809.md`.
Completion evidence:
`work/evidence/watchdog-stage-6-controller-b-preflight-complete-20260809.md`
and
`work/evidence/watchdog-stage-7-controller-b-start-and-observation-20260809.md`.

The paragraphs below retain earlier checkpoints as history; they no longer
authorize continuation of the stopped Controller A chain.

All eight physical-card traveler sections now carry auditable completion times
at SD Qualifier merge `abca3b0`, exact image `sha256:2a42efc9...9e96`.
Completed sections use actual durable timestamps; open sections use same-track
history, mixed history/allowances, or explicit rough estimates. The live matrix
forecast was Aug. 9 at 10:34 p.m. PDT and approximately 2 days 12 hours
remaining when verified. Exact-image tests pass `260/260`, live health is good,
and both workers plus all four Controller A continuation services retained their
processes. The chain is now at S4 44640/AT observation 3 of 3. Evidence:
`work/evidence/sd-qualifier-section-completion-forecasts-deployment-20260807.md`.

The operator-facing matrix status defect is corrected and deployed at SD
Qualifier merge `5b0f4dd`, exact image `sha256:b032bd3b...71b37`. The card now
shows four completed S4 observations as `CREDITED`, the active S4 44640/AT
observation 2 of 3 as `RUNNING`, and separates 32 current-campaign runs from 69
earlier Engineering attempts. The raw base-classifier code is absent from the
authenticated production render. Exact-image tests pass `258/258`; health is
good; the command worker, notification worker, and Controller A runner remained
continuous. Evidence:
`work/evidence/sd-qualifier-matrix-status-projection-deployment-20260807.md`.

Repository checkpoint `2026-08-07T00:19:18Z` records Controller A S4
`44640 / BEFORE` run `b58be682-69cd-4982-b3bf-8f78972458a3` healthy at
attempted `13778 / 44640` (`30.9%`). Its one-shot START is acknowledged, no
STOP exists, all four continuation services are active, and the CID is
unchanged. Controller B remains at `INTAKE` with no active run. Evidence:
`work/evidence/controller-a-s4-44640-before-live-checkpoint-20260806.md`.


Account notification subscriptions are deployed at SD Qualifier PRs #43 and
#44, final merge `b9ccca1`, exact ARM64 image
`sha256:ea8fbb3a...62c371`. Production `jon` / `jong@sheldonmfg.com` is enabled
for intervention and qualification-completed topics. Exact-image tests pass
`257/257`; PostgreSQL migration/history, corrected delivery-only lease locking,
authenticated rendering, health, and SMTP provider acceptance pass. All four
Controller A services continue at exact S4 `44640 / BEFORE`; Controller B
remains not started. Evidence:
`work/evidence/sd-qualifier-account-notification-subscriptions-20260806.md`.


The corrected card operator-guidance enhancement is deployed at SD Qualifier
merge `d332449`, exact image `sha256:83473ed7...7da64`. Step 5 recovery is
`AUTOMATED` because the RPi performs the qualified controller power cycle; no
operator action is required and the card remains installed. Both correction
ARM64 suites pass `252/252`; authenticated production rendering and web-only
continuity pass.
F1-A1 correctly shows no operator action while its automated bounded-stop
matrix runs, and F1-B1 remains not started with a before-start review. The
browser runtime had no connected instance, so the ticket retains only its
visual-only desktop/mobile confirmation. Continue Controller A at exact S4
`44640 / BEFORE`; do not start Controller B. Evidence:
`work/evidence/sd-qualifier-card-operator-guidance-20260806.md`.


The fixed physical-card QA traveler is deployed at SD Qualifier merge
`fe27ecd`. Exact-image tests pass `250/250`; authenticated desktop/mobile
verification confirms separate A/B sheets, the final pair gate, compact
attempt history, and no horizontal overflow. F1-A1 reads `IN PROGRESS`,
continue `YES`, current bounded-stop matrix, zero card failures, and five
invalid attempts. F1-B1 remains `NOT STARTED`. The web-only deployment left
both workers and all four Controller A services uninterrupted. Resume the
Controller A exact-identity matrix at its recorded `44640 / BEFORE` next
action and keep Controller B qualification not started. Evidence:
`work/evidence/fixed-physical-card-qa-traveler-20260806.md`.


The owner authorized the complete remaining Controller A run. Exact S4 bundle
`smi-00-05-00-660433743898-bcf70c2de65c-release` is now programmed and
complete-readback verified on A. New campaign
`648ba10c-0bc0-4319-8089-78a0cce287ce` has passed independent flash/CID
observation, a zero-error `15,728,640`-sector baseline scrub, canonical HPT
initialization, and its first exact S4 `1440 / BEFORE` observation. Controller
B remains disabled and untouched. Because the firmware/profile identity
changed, prior S0-S3/S5/S6 rows remain historical and fresh identity-local
rows are required. Continue from
`work/evidence/controller-a-hpt2-s4-program-baseline-first-pass-20260806.md`.

The S4 checkpoint-region producer is software complete. Firmware commits
`20e2cb40` / `1e566bee` and Pi commit `b586704` pass managed Debug/Release,
17 model tests, and `224/224` exact-image tests. Candidate firmware bundle
`smi-00-05-00-660433743898-bcf70c2de65c-release` is valid but unadmitted;
deployed Pi release `hpt2-s4-boundary-b586704` is healthy. The active campaign
still binds the prior firmware, zero runs are active, firewall isolation is
restored, and no controller was accessed. Continue from
`work/evidence/hpt2-s4-checkpoint-producer-candidate-20260805.md`.

Controller A now passes provisional S6 at `10/10`, with APPEND, READ, and
SEGMENT_TRANSITION coverage. Live Pi release `hpt2-s6-boundary-4ad60e4`, source
`4ad60e4`, image `sha256:5e9e6b0a...8ecf`, passed `217/217` tests and all
deployment gates. The audit reports A S0 `3/3`, S1 `20/10`, S2 `27/10`, S3
`13/10`, S5 `10/10`, S6 `10/10`, and S4 zero. There are zero active runs,
firewall isolation is restored, B remains disabled, and the deadline remains
`null`. Continue with the S4 producer from
`work/evidence/controller-a-hpt2-s6-runtime-matrix-pass-20260805.md`.

Pi commit `7cf2cb8` corrects S6 runtime sequence decoding and proves exact
multi-record segment transitions. Image `sha256:dd1892d...e30de` passed
`214/214` tests and is deployed after all release gates. There are zero active
runs, firewall isolation is restored, and deployment did not access a
controller. Continue from
`work/evidence/controller-a-hpt2-s6-qualifier-predeployment-checkpoint-20260805.md`.

Pi source `86ac4c27...a838` is deployed as `hpt2-s0-hold-86ac4c2`, image
`sha256:826b43fa...3030`, after `51/51` focused and `188/188` full tests plus
backup/restore. Fully optimized same-JLink runs still ended clean at `3/3/3`
despite a measured `0 ms` host-side gap, proving the existing transition is
insufficient. Candidate firmware now provides exact qualification-only token
`0x53304844` to hold before first work; normal requests are unchanged.
Debug/Release builds and `15/15` contract/model tests pass. Bundle
`smi-00-05-00-52edddc39e30-054d5386ad9d-release` is imported valid but
unadmitted. Controller A remains on the prior bundle, S3 remains `2/10`, S0
remains `0/3`, the deadline remains `null`, and B remains disabled. Evidence:
`work/evidence/controller-a-hpt2-bounded-stop-measurement-checkpoint-20260805.md`.

Pi source `686a61e5...a10c` is deployed as
`hpt2-sequential-admission-686a61e` with measurement admission, stable-terminal
finalization, and append-only case adjudication. Controller A has completed two
one-shot Start/Stop runs with stable `STOPPED_CLEAN`, proof `0x1F`, unchanged
flash/boot/CID identity, three lanes, and no media failure. Both are valid S3
observations; the first run's planned S0 classification was rejected because
Stop followed substantial work. Current A progress is S3 `2/10`, S0 `0/3`.
The largest observation upper bound is `2051 ms`; production
`stop_deadline_ms` remains `null`, and Controller B has not started. Evidence:
`work/evidence/controller-a-hpt2-bounded-stop-measurement-checkpoint-20260805.md`.

Controller A/F1-A1 is now physically `HPT_INITIALIZED`. Operation
`d909a40c...32c5` was published once and never replayed. Its original terminal
result remains a false-negative `FAILED` because the commissioning append lane
mask was reset across reopen; independent read-only observation
`d1c51d83...0cab` proves exact flash, unchanged CID, readable
`RAW_HPT/HPT_READY`, all three lanes, and clean health. Pi Evidence `40`
adjudicates the physical result without rewriting history. The source
correction passes `97/97` commissioning checks and a canonical Debug rebuild
but is not programmed. HPT2 has not started. Evidence:
`work/evidence/controller-a-f1-a1-hpt-initialization-adjudicated-pass-20260805.md`.

Controller A programming, independent exact-flash/CID verification, and the
new bundle's complete baseline scrub now pass. Operation
`abc4be6b-6cde-447b-8b98-1bf7021e8586` read all `15,728,640` sectors with no
failure, recovery, or identity mismatch. Campaign
`8f3fe483-c783-4170-a720-3c2df3a48fd6` is version `2`, with A at
`BASELINE_SCRUB_PASSED`. Pi commit `ec2dd1b...` fixes the PostgreSQL
scrub-envelope lock and is deployed healthy at image `sha256:a09c4193...fe9`.
Both controllers are disabled, temporary network admission is removed, and no
tool container remains. HPT initialization was not performed because its
whole-card erase requires a separate explicit authorization. Evidence:
`work/evidence/controller-a-b845d4b9-program-verify-baseline-scrub-pass-20260805.md`.

The later 2026-08-05 continuation corrected the obsolete multi-block
diagnostic and imported superseding bundle
`smi-00-05-00-b845d4b9bcfe-4f37e97877d8-release` unadmitted. The Pi protected
trust-store reader and authenticated initialization envelope/status UI are now
deployed at commit `d7547a4...`, release `hpt-initialization-ui-d7547a4`, image
`sha256:a999e305...388243`. All live capabilities remain disabled and no target
or card was accessed. See
`work/evidence/hpt-initialization-readiness-software-continuation-20260805.md`.

On 2026-08-05, the guarded initialization ABI and Pi adapter completed their
software gates. Firmware bundle
`smi-00-05-00-c9ada4d5122b-e51ae77e9fab-release` is imported valid but
unadmitted. Pi commit `1572ed39...` is deployed as fixture-only release
`hpt-initialization-adapter-1572ed3`; migration `0016` and health checks pass,
while live admission, roles, endpoints, and tools execution remain disabled.

No controller or SD card was touched. Since the firmware candidate changed,
Controller A requires separately authorized programming, a fresh complete
flash/CID observation, and a new full-address scrub before the initialization
envelope may be minted. Evidence:
`work/evidence/hpt-initialization-mailbox-adapter-software-deployment-20260805.md`.

## Purpose

Coordinate the remaining SMI firmware stabilization and release work without
assigning remote qualification execution to this repository. This workspace is
the firmware producer and release-evidence consumer. It owns source, canonical
builds, firmware-side diagnostics, bundle publication, local firmware
host/model/static/build gates, and final review/release disposition. It does not
coordinate tests that execute on Controllers A or B.

The separate `PC-Redemption/sd-qualification` workspace at
`jong@srv-rpi00.local:~/dev/sd_qualification` is the qualification coordinator
and system of record for every controller-executed test using SMI firmware,
including code-review negative/recovery, calibration preservation, SD/HPT
fault/interruption, endurance, and media campaigns. It owns candidate intake,
live-controller orchestration, generated evidence, failure disposition, and
card-family approval. The HPT Lab Power
Control service on `srv-rpi00.local` is a separate operation provider used by
that qualifier; it is not part of this firmware workspace or implicitly part of
the qualifier application. The operator owns physical card handling and each
required safety or destructive-operation authorization.

This Tool Shed at `E:/dev/high_point/7520553_SMI_FW/work/` is the sole active
planning and next-action authority for firmware work, the Pi qualification
application, and HPT portable-core/validator development. Each repository
remains authoritative for its own source, tests, runtime or release artifacts,
technical documentation, and evidence. Their former `work/` maps and
workpackages are preserved as historical planning inputs and do not form
separate active task systems. Pi code is still implemented, tested, deployed,
and versioned in its owning Pi repository; centralized planning here does not
make this firmware process a controller coordinator.

The separate `Sheldon-Mfg-Inc/HPT-Embedded-Log-Store` repository at
`jong@srv-rpi00.local:~/dev/HPT-Embedded-Log-Store` owns portable-core source,
specifications, host tests, immutable portable source/tool releases, and the
independent read-only HPT media validator. This firmware workspace adopts a
pinned source release; `sd_qualification` imports a pinned validator release
to inspect an explicitly identified Pi-attached card or image after its own
admission gates pass. The HPT repository does not coordinate or qualify SMI
controllers, select devices, operate power, manage campaigns, or approve
media. It is distinct from the `sd_qualification` coordinator application even
though both reside on `srv-rpi00.local`.

The remote qualifier source and healthy fixture-only deployment are exact at
`32b636c` / release `readiness-gates-32b636c`. Its immutable HPT fixture-image
identity passes, the readiness UI separates required-now, fixture,
required-before-live, and expected-disabled gates, and HPT2 write authority is
separate from bench power/raw-media authority. Separately authorized,
immutable programming and read-only operations installed and independently
verified the exact fixed-mailbox candidate on both controllers, including fresh
CID/HPT state. Exact-candidate A/B identity is ready; state-changing execution
remains **not ready** until command-adapter admission, measured stop/recovery,
and representative regression readiness are complete.
`HPT2_ENDURANCE_BASELINE_V1` is now the selected first profile and
its contract is defined in `docs/hpt2-endurance-baseline-v1.md`. The fixed
216-byte request, 208-byte coherent status, duplicate rejection, first-failure
latch, and work-unit-boundary stop now pass host/model/static and clean managed
Debug/Release build gates, and the matching profile contract is deployed on the
Pi. The firmware fixed mailbox and the Pi durable no-replay orchestration,
operation-UUID-only tools service, transcript validation, terminal evidence,
and two-pass read-only acknowledgement reconciliation pass software-only gates.
The authenticated reviewer preparation-only UI, migration 0013, and durable
operation/phase display are deployed fixture-only from the hash-verified exact
release. The browser has no endpoint and cannot publish or reconcile; HPT2
roles/endpoints remain empty, no tools service ran, and no controller was
programmed or contacted for this slice. Live admission remains false and the
stop deadline remains deliberately unset.
The exact fixed-mailbox bundle `smi-00-05-00-bc0b6ce4d066-release` is now
imported under content address `5df475bd...176ce`; its stored mapping/profile
hashes and fixed mailbox/acknowledgement/status contract pass the deployed Pi
validator. It remains valid but unadmitted. Both protected controller entries
now bind the fixed-mailbox manifest and remain disabled. B passed exact
program/verify/reset/run. One B-only
read-only attempt stopped pre-publication because the Pi compared ordinary
VTref drift as probe identity; PR #29 fixed, tested, merged, and deployed that
observer defect without retrying the target. Freshly authorized operation
`a05bc76d...` then passed exact flash, stable fixed-mailbox mapped state, a
complete same-run SanDisk CID, and non-disqualifying HPT readiness. A operation
`ae2fe6ff...` subsequently passed programming with preserved VEEPROM/option
memory, and independent observation `e140c0f2...` passed exact flash, stable
state, its distinct same-run CID, and HPT readiness. The Pi
therefore continues to report live-blocked readiness and keeps every
state-changing profile disabled. The standalone foundation is not a later replacement for a development
tool: the same Pi application must be independently runnable and must own its
result ledger from the first live-controller campaign. During firmware
development, immutable results are also returned to this workspace only when
they are needed to correct, qualify, or release the firmware. After release,
routine endurance and card-family qualification run wholly within the Pi
application; only a systemic result routes back to the responsible source
workspace.

This repository must not represent programming, controller commands, fault
injection, calibration-preservation execution, receipt, card assignment, power
interruption, endurance, or family approval as local next actions. It publishes
an immutable firmware bundle and test contract, then consumes an immutable
candidate result manifest through GitHub when firmware release work requires
one.

The resulting release must have safe startup configuration, review mitigations
that work on target, and degradable, durable SD logging. Evidence from the two
physical SMI setups must remain distinguishable unless their equivalence is
demonstrated.
The confirmed temperature-profile retuning defect and the temperature-sensor
validity/RTD recovery interlock remain deferred successors. Configuration-schema
compatibility, complete profile provisioning, and safe persistence are not
deferred because they are required to prevent a new or upgraded unit from
starting with a non-operational heater configuration.

## Workspace Ownership and Readiness Gates

| Surface | System of record / owner | Owned work | Current readiness | Explicit boundary |
| --- | --- | --- | --- | --- |
| Cross-repository Tool Shed planning | `E:/dev/high_point/7520553_SMI_FW/work/` | project priorities, dependencies, readiness, next actions, and coding workpackages for the firmware, Pi qualifier, and HPT validator | active and sole planning authority | does not own remote source/runtime state or authorize controller execution merely by scheduling work |
| Portable HPT core and independent media validator | `jong@srv-rpi00.local:~/dev/HPT-Embedded-Log-Store` (`Sheldon-Mfg-Inc/HPT-Embedded-Log-Store`), planned by `work/wp/active/wp-build-independent-hpt-media-validator-for-pi-qualification.md` | portable source/API/media specification, host simulation/tests, immutable source/tool releases, and bounded read-only validation of an explicit Pi-attached HPT card or image | v0.5.0/media 2.0 is released at tag commit `d7b1dbe8...`; the exact Linux aarch64 validator is fixture-admitted and its immutable-image command/result/evidence path passes, while every raw-device gate remains open | no Renesas build, device selection, SMI programming, controller orchestration, power operation, operator notification, campaign disposition, or controller qualification claim |
| Firmware source and release | `E:/dev/high_point/7520553_SMI_FW` on Windows | source, managed builds, exact artifacts/hashes, firmware diagnostics, host/model/static/build gates, controller-test contracts, immutable firmware bundle, returned-result review, release decision | HPT v0.5.0 is adopted; HPT2 fixed-mailbox source `bc0b6ce4...`, profile `945ebbc6...`, host/model/static and clean Debug/Release gates pass; exact bundle `smi-00-05-00-bc0b6ce4d066-release` is imported valid but unadmitted as `5df475bd...176ce`; both controllers bind it and pass exact programming plus independent flash/state/CID/HPT observation | does not coordinate programming, controller commands, target fault/recovery tests, calibration-preservation runs, card intake, relay operations, or endurance |
| Controller qualification coordinator | `jong@srv-rpi00.local:~/dev/sd_qualification` (`PC-Redemption/sd-qualification`) | Pi source/runtime under the local planning workpackage `work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md`; one standalone application supporting firmware-development and released-media operating modes; exact-bundle import, live A/B adapter, all controller-executed SMI tests, sample registry, campaign profiles, intake records, durable result ledger, generated evidence, dispositions, reviewer approval | **A/B fixed-mailbox identity and Pi dual-backend software gates pass; state-changing execution not ready**; source/deployment are exact at `e9edba3` / `hpt2-postgres-lock-e9edba3`; B operations `7d3be985...`/`a05bc76d...` and A operations `ae2fe6ff...`/`e140c0f2...` pass exact programming, stable state, fresh CID/HPT, and cleanup; the reviewed stop/recovery/regression checklist is blocked on zero inventoried expendable samples; roles/endpoints are empty, live admission false, and all state-changing capability flags false | no independent remote Tool Shed plan and no target campaign until physical sample intake, adapter admission, stop/recovery, and evidence-path gates pass; no runtime dependency on the Windows firmware workspace |
| HPT Lab Power Control | separate service on `srv-rpi00.local` | qualified G-PWR-A/B sequencing and machine-readable operation results | power method qualified; each use remains case-gated | qualifier uses only the service-owned API/client; neither repository bypasses it with direct relay commands |
| Operator | human/safety authority | receipt handling, labels/photos, controller-power-off card insertion/removal, irreducible observations, and required authorization | gated per operation | never use the operator as a cross-workspace message relay; powered SD hot swap is prohibited |

## Big-Picture Service and Repository Responsibilities

| Component | Provides | Consumes | Must not provide |
| --- | --- | --- | --- |
| Central Tool Shed in this workspace | one plan, dependency graph, readiness state, next actions, and workpackages spanning all three code repositories | repository status, reviewed evidence, and owner decisions | runtime APIs, controller commands, qualification results, or implicit authorization |
| `7520553_SMI_FW` | SMI source, Renesas builds, firmware diagnostics/contracts, exact firmware bundles, and firmware release decisions | pinned HPT portable source release and returned candidate result manifests | Pi UI/runtime, raw-card selection, campaign orchestration, power operations, or standalone result storage |
| `HPT-Embedded-Log-Store` | portable HPT core/specification/vectors plus a pinned, bounded, read-only validator for explicit images or Pi-attached cards | adopted media-2.0 format truth and explicit validator inputs supplied by the qualifier | controller/J-Link access, device discovery/selection, card writes/repair, operator workflow, email, power, campaign approval, or firmware release decisions |
| `/sd-qualifier` application | authenticated operator UI, card/certificate inventory, immutable bundle import, controller and validator admission, campaign orchestration, progress, intervention email, durable evidence/results, pass/fail derivation, review, and media-family approval | reviewed SMI firmware/profile bundles, pinned HPT validator release, protected controller registry, power-service results, and operator actions/authorization | firmware compilation, HPT format implementation, direct relay bypass, browser-supplied hardware endpoints, or automatic physical action |
| HPT Lab Power Control | qualified G-PWR-A/B operations, off-state proof, and machine-readable power-operation results | exact operation requests from the admitted qualifier workflow | campaign policy, controller diagnostics, media interpretation, email, or direct operator UI authority |
| Front Door | stable `/sd-qualifier/` routing to the existing Django application | web requests and application health | qualification authentication policy, result decisions, controller access, or retrying non-idempotent actions |
| Controllers A/B | execute the exact SMI firmware and expose versioned diagnostics/state used by qualification | firmware, SD cards, USB devices, and authorized commands from the Pi adapter | campaign orchestration or independent validation of their own media claims |
| Operator | physical receipt/label/photo work, controller-power-off SD movement, explicit destructive/safety authorization, and irreducible human review | clear UI instructions and verified safe-state information | cross-workspace message relay, powered SD hot swap, or manual declaration of machine-derived pass state |

The independent-validation path is deliberately separate from controller
communication:

```text
/sd-qualifier -> admitted SMI adapter -> Controllers A/B
/sd-qualifier -> admitted HPT validator -> explicit Pi-attached SD/image
/sd-qualifier -> HPT Lab Power API -> G-PWR-A/B
Front Door -> /sd-qualifier UI
```

Only `/sd-qualifier` joins those results into a campaign. The HPT validator
reports media facts; it does not operate the controller or approve the card.

Cross-workspace handoff is one-way and immutable in each direction:

1. The portable-core repository publishes an immutable source release; this
   firmware workspace records its tag, commit, archive hash, and adopted source
   identity without treating host tests as controller evidence.
2. This workspace publishes a reviewed firmware bundle containing exact source,
   ELF/SREC/update hashes, diagnostic/interface version, campaign requirements,
   safety bounds, and authorization references.
3. The Pi qualifier imports that bundle into immutable controller-test and
   media-campaign instances only
   after all remote readiness gates pass.
4. In firmware-development mode, the Pi qualifier publishes a result manifest
   containing exact firmware, controller, J-Link, card/CID, profile, coverage,
   evidence, terminal state, failure attribution, and reviewer disposition.
5. This workspace reviews the returned development result manifest and makes
   the firmware/release decision. Results are never inferred from remote
   application health alone.
6. In standalone released-media mode, the Pi qualifier retains the same
   identity, evidence, disposition, and approval detail in its own durable
   system of record. Routine card-family results do not require this workspace;
   only a systemic failure is routed back to the responsible source workspace.

## Pi Qualification Application Operating Modes

There is one qualification application on `srv-rpi00.local`, with two operating
modes and one result model:

| Mode | Purpose | Inputs | Result ownership and feedback |
| --- | --- | --- | --- |
| Firmware-development and release qualification | Exercise exact SMI candidate firmware on Controllers A/B so firmware requirements, diagnostics, recovery behavior, and release gates can be finalized | immutable candidate firmware bundle and campaign contract from this workspace; authorized controller/card/power operations | the Pi application records the complete result first, then returns an immutable manifest to this workspace when a firmware correction or release decision requires it; any firmware change produces a new bundle and campaign identity |
| Standalone released-media qualification | Run endurance, fault, recovery, and card-family approval campaigns without interaction with this workspace | released SMI firmware bundle, released campaign profiles, locally registered cards/CIDs, and operation authorizations | the Pi application is the system of record for all results, evidence, dispositions, and approvals; routine results remain there, while a systemic defect may reopen the appropriate firmware, portable-core, qualifier, or power-service workstream |

Development mode must not introduce a hidden runtime dependency on this
workspace. The Pi application owns orchestration, persistence, recovery, and
result presentation in both modes. GitHub artifacts are immutable handoffs, not
an interactive control channel, shared database, or substitute for the Pi
application's local result tracking.

## Visual Map

```mermaid
flowchart TD
  subgraph CORE[HPT-Embedded-Log-Store / srv-rpi00.local]
    C1[Portable source + media-2.0 vectors + host tests] --> C2[Immutable portable core and validator release]
  end
  subgraph FW[7520553_SMI_FW / Windows]
    F1[Firmware source and non-controller gates] --> F2[Frozen candidate bundle and manifest]
    F3[Review returned results] --> F4[Release disposition and documentation]
  end
  subgraph GH[Immutable GitHub handoff]
    H1[Versioned bundle and campaign contract]
    H2[Versioned result manifest and evidence references]
    H3[Pinned HPT validator bundle and result schema]
  end
  subgraph PI[sd_qualification / srv-rpi00.local]
    P0[PARTIAL: A/B identity ready; stop/recovery + admission gated]
    P0 --> D1[Development mode: candidate intake and immutable campaign]
    D1 --> D2[Candidate controller tests and complete local result record]
    D2 --> D3[Development disposition and return manifest]
    P0 --> S1[Standalone mode: released bundle and campaign profiles]
    S1 --> S2[Independent endurance and card-family campaigns]
    S2 --> S3[Durable local results, dispositions, and approvals]
  end
  subgraph POWER[Separate HPT Lab Power service]
    G[G-PWR-A/B API and operation results]
  end
  O[Operator: physical handling and authorization]
  C2 --> F1
  C2 --> H3 --> P0
  F2 --> H1 --> D1
  O --> D1
  O --> D2
  O --> S2
  G --> D2
  G --> S2
  D3 --> H2 --> F3
  F3 -. standards-based firmware correction when required .-> F1
  F4 --> S1
  S3 -. systemic defect only .-> F1
  F4 --> T[Deferred temperature successors may be activated]
```

## Zoom Levels

30,000 ft:

- Overall outcome: release an SMI firmware image with safe configuration
  recovery, verified review mitigations, and qualified degraded/normal SD
  operation.
- Success shape: one identified candidate image passes automated gates and
  representative-target testing; each claim links to setup-specific evidence;
  accepted limitations are explicit; production configuration is restored.

10,000 ft:

- Major workstreams: semantic configuration validation; code-review mitigation
  closeout; firmware bundle publication; externally owned SD degraded-mode and
  datalogger/media qualification; returned-evidence review; documentation and
  release disposition.
- Key dependencies: setup inventory and recovery baselines precede fault tests;
  semantic recovery policy precedes implementation; the exact firmware bundle
  precedes remote campaign creation; the remote foundation/live-adapter/read-only
  gate precedes candidate intake; basic SD fault qualification precedes
  endurance and production-card approval.

1,000 ft:

- Local non-controller preparation surfaces: the adoption/bundle contract in
  `work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md`, which waits on
  a portable media-2.0 release identity, and the separately authorized
  clean-regeneration/build-only gate in
  `work/wp/completed/wp-migrate-usb-vbus-control-out-of-ssp.md`.
- Waiting external-result workpackages:
  `work/wp/active/wp-mitigate-smi-firmware-code-review-findings.md`,
  `work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md`, and
  `work/wp/active/wp-sd-card-accelerated-endurance-evaluator-and-media-qualification.md`;
  `work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md` additionally
  waits on both its portable release identity and returned controller evidence.
  Their firmware implementation history remains local, but every unfinished
  controller-executed test belongs to the `srv-rpi00.local` coordinator.
- Completed bounded-calibration implementation:
  `work/wp/completed/wp-bounded-temperature-calibration-and-drift-recovery.md`;
  its release-regression cases are transferred to the single post-freeze
  integrated qualification.
- Completed coordination reconciliation:
  `work/wp/completed/wp-reconcile-smi-baselines-current-truth-and-planning-surfaces.md`.
- Completed prerequisite:
  `work/wp/completed/wp-semantic-configuration-validation-and-recovery.md`.
- Externally owned media campaign, not ready for physical execution:
  `work/wp/active/wp-sd-card-accelerated-endurance-evaluator-and-media-qualification.md`.
- Completed cross-workspace lifecycle reconciliation:
  `work/wp/completed/wp-synchronize-sd-qualification-lifecycle-across-firmware-and-qualifier.md`.
- Current HPT media 2.0 local closeout and external qualification dependency:
  `work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md`.
- Completed USB compatibility and durability recovery:
  `work/wp/completed/wp-implement-usb-command-class-compatibility-fallback-end-to-end.md`;
  command-class fallback, fresh-session verification, negative fault handling,
  B-first/A-second Release deployment, and final USB05/USB07 A/B/Pi retesting
  pass.
- Deferred USB middleware/HCD investigation:
  `work/spikes/spike-evaluate-ssp-2-7-0-usbx-modernization-and-renesas-hcd-interoperability.md`;
  it follows R5 lifecycle stabilization and authorizes no migration or patch.
- Active/current tickets:
  `work/tickets/ticket-hpt-bounded-full-address-read-scrub.md`,
  `work/tickets/ticket-preserve-controller-a-failed-sd-evidence.md`, and
  `work/tickets/ticket-eliminate-full-history-scan-latency-for-bounded-hpt-customer-exports.md`.
- Deferred successor:
  `work/wp/deferred/wp-temperature-control-profile-recovery-and-steady-state-regulation.md`.
- Deferred sensor-safety successor:
  `work/wp/deferred/wp-temperature-sensor-validity-interlock-and-rtd-transport-recovery.md`.
- Decided qualification population: begin with two fresh samples split across
  A/B; add later samples only for a reviewed adaptive reason; require at least
  two counted passes with all failures dispositioned.
- Open decisions: approved SD-card models; case-specific destructive-test
  authorization; disposition of personal J-Flash profiles.

Ground:

- Unknown-drive command-class compatibility implementation, B-first/A-second
  Release deployment, negative fault injection, final USB05/USB07 retesting,
  and independent Pi persistence proof are complete. The checkpoint is clean
  and Tool Shed preflight has no findings. Future USB transaction-inventory
  drift is new scoped work.
- USB R5 lifecycle correctness and the conservative 32 KiB production
  compatibility baseline completed on 2026-07-29. Controller A covered all
  four available specimens and Controller B covered representative
  `USB01_2G` and `USB04_32G`; independent Pi persistence checks passed.
  The owner accepted 32 KiB performance and dispositioned 64 KiB-or-greater
  production promotion as no action. Isolated SSP/HCD research remains
  separate and requires fresh owner authorization.
- Historical handoff: Controller A remained on rejected R4 and `USB04_32G`
  (then labeled `A-CTRL-2`) was unmounted on
  `srv-rpi00.local` with differing FAT copies, zero-length `HPTE.TMP` owning
  clusters, and no final CSV. Preserve that state; do not reformat or reuse the
  specimen and do not deploy R4 to Controller B.

- Independent USB-host compatibility research from
  `E:/vsc_instances/usb_drive_research/research/` was ingested and cross-walked
  in `work/spikes/spike-ingest-external-usb-host-compatibility-research.md`.
  It preserves standards, mature-host, vendor, and proposed-policy evidence as
  separate classes. No firmware constants or code were changed; future USB
  corrections must first trace the failing layer and validate any proposed
  policy against SSP 2.6.1, S7G2 USBHS, and the full representative matrix.

- Controller B recovery baselines passed on 2026-07-27: hashed
  configuration/calibration and option memory, exact program-image readback,
  serial-bound J-Link recovery, reset persistence, and intentional electronic
  non-heating state. Evidence:
  `work/evidence/controller-b-recovery-baseline-20260727.md`. This removes the
  baseline dependency from later B work but does not remove exact-run
  physical-safety or operation-specific gates. The non-heating state was a
  bounded recovery snapshot; normal temperature control was restored and
  verified across reset for full-controller and endurance qualification.

- Current connected-bench records and setup-specific evidence directories exist at
  `work/inventories/smi-current-setup-a.md`,
  `work/inventories/smi-current-setup-b.md`,
  `work/evidence/setup-a/`, and `work/evidence/setup-b/`. Candidate intake is
  no longer initiated from this workspace. The authoritative Pi qualifier must
  has completed its standalone appliance foundation and authorized read-only
  A/B identity gate; it now owns candidate intake and the remaining gates
  authorized by `work/decisions/decision-remaining-qualification-authorization.md`.
  Powered SD-card hot swapping remains prohibited.
- Historical campaign inventories remain at `smi-setup-a.md` and
  `smi-setup-b.md`; they preserve the July 14--16 physical-controller evidence
  and are not current routing documents.
- Verification: each setup has its own evidence directory and completed baseline
  record, and neither destructive nor endurance work begins without its gate.

## Workstreams

| Workstream | Status | Lead Artifact | Depends On | Next Action |
| --- | --- | --- | --- | --- |
| Measurement-runner supervision | complete; A progresses under the exact runner/dependent service chain and the independent B observer passed a live S1 attempt | `work/wp/completed/wp-repair-progress-aware-measurement-runner-supervision.md` | exact A/B identities, immutable deployment manifest, fixture failure/notification proof, and live A/B projections | preserve A; renew the B envelope and continue supervised B base cases |
| Bench/setup control | current connected benches electronically identified on 2026-07-20 | `work/inventories/smi-current-setup-a.md`, `work/inventories/smi-current-setup-b.md` | reconfirm after cabling changes | use A=1751136/J-Link 69664082 and B=1751219/J-Link 69660123 for new work; retain older campaign labels as history |
| Semantic configuration safety | complete; representative release qualification and accepted coverage integrated into 00.04.13 | `work/wp/completed/wp-semantic-configuration-validation-and-recovery.md` | none | normal use; retain evidence and accepted coverage decisions |
| Bounded temperature calibration | firmware implementation complete; Controller A interaction/endpoints/Save/Cancel/timeout pass and `+0.3 C` is restored; RTD is the only qualified main-temperature path | `work/wp/completed/wp-bounded-temperature-calibration-and-drift-recovery.md` | exact bundle plus Pi coordinator readiness; LM73 explicitly excluded | this workspace supplies the contract; the Pi app coordinates reboot/update preservation, RTD alarm/logging, restoration, and evidence on the controllers |
| Code-review mitigation closeout | firmware implementation/build, prior dual-target baseline, scoped operator review, and Controller B recovery baseline pass; remaining target cases wait on the coordinator | `work/wp/active/wp-mitigate-smi-firmware-code-review-findings.md` | exact bundle plus Pi readiness and exact-case physical-safety, stop, media, identity, and evidence gates | this workspace supplies firmware and expected outcomes; the Pi app coordinates B negative-image, injected-failure, recovery, and conditional update-interruption execution |
| SD degraded-mode integrity | waiting on external qualifier; firmware implementation and software/model gates are complete, while remaining physical cases belong to `srv-rpi00.local` | `work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md` | immutable firmware bundle plus remote foundation/live-adapter/read-only A/B gate, approved expendable media, and case authorization | this workspace publishes requirements and reviews returned results; the Pi app coordinates power-off replacement/reboot, injected-failure, G-PWR, and post-campaign scrub cases on SMI controllers |
| Continuous background endurance (470) | historical 00.04.13 FAT32/FileX evidence; runs 03305/04904 passed on both controllers | `work/evidence/service-469-470-474-implementation-and-target-status-20260721.md` | none | retain as history; do not use for HPT media 2.0 candidate qualification |
| Autonomous production-log monitor (474) | historical 00.04.13 FAT32/FileX evidence | `work/evidence/service-469-470-474-implementation-and-target-status-20260721.md` | none | retain as history; do not use for HPT media 2.0 candidate qualification |
| Datalogger endurance and media approval | waiting on authoritative Pi qualifier; adaptive two-or-more-sample lifecycle adopted; procurement leads are retained locally but campaign intake is remote | `work/wp/active/wp-sd-card-accelerated-endurance-evaluator-and-media-qualification.md`, `work/inventories/inventory-sd-card-qualification-candidates.md` | immutable firmware bundle, Pi foundation/live adapter/authorized read-only A/B gate, controlled fault gate, and operator-provided physical samples | this workspace supplies the reviewed bundle; operator handles physical receipt; Pi qualifier records intake, runs the campaign, and publishes dispositioned results |
| Qualification lifecycle synchronization | complete; Pi repository is authoritative for qualification development/runtime and the firmware repository is a bundle producer | `work/wp/completed/wp-synchronize-sd-qualification-lifecycle-across-firmware-and-qualifier.md` | accepted lifecycle ADR, Interface Contract v0.1, and existing A/B safety/coverage contract | exchange contracts, bundles, and results through GitHub and immutable manifests; do not use the operator as a message relay |
| Graph rolling-cache correction | complete; live refresh and final A/B legend/Return/export-entry operator review passed | `work/wp/completed/wp-correct-hpt-graph-rolling-cache-refresh.md` | both controls run `D3D36155...A1EAF`; B retains CID and `86/86/1` lanes | retain the completed evidence |
| Triple-mirror read and all USB mass-storage workflows | complete; bulk reads, retained-start behavior, 128 KiB static SDRAM CSV publication, supported USBHS/USBX tuning, strict WAV load, atomic `.imx` backup/update, PID capture, phase timing, and B-first/A-second target qualification pass | `work/wp/completed/wp-optimize-hpt-triple-mirror-read-performance.md`, `work/wp/completed/wp-qualify-all-usb-mass-storage-workflows-after-usbhs-tuning.md`, `work/evidence/usb-mass-storage-workflow-qualification-20260726.md` | both controls run `7CB28AA3...A405A`; flash/audio round trips match, CSV is one write with zero errors, B abnormal lanes are preserved, and both Graphs are active/current | retain the safe measured USB settings; separately optimize the legacy 1 KiB `.imx` path only if recovery-image speed becomes a priority |
| USB FileX lifecycle and broad drive compatibility | general BOT missing-CSW session quarantine is implemented and source/build verified; T00 remains closed as documented/no-action root-cause evidence, while its missing-CSW observation remains unresolved contradictory evidence | `work/tickets/ticket-quarantine-bot-session-after-missing-csw.md`, `work/evidence/usb-bot-missing-csw-session-quarantine-source-build-20260801.md`, `work/spikes/spike-diagnose-t00-usb-write-timeout.md`, `work/incidents/incident-t00-usb-image-save-transfer-timeout.md` | representative target regression requires separate authorization plus Pi coordinator readiness/exact-bundle import; no analyzer acquisition, T00 campaign, Controller B change, or root-cause correction is active | preserve `ca6f573a` on Controller B; if authorized, the Pi app coordinates the generic quarantine matrix across both controllers; do not claim the missing-CSW cause resolved |
| Unknown-drive USB command compatibility | complete; USB09 resolved, optional STOP/VBUS/remount behavior removed from production, and the 32 KiB matrix, enumeration recovery, BOT validation, and representative regression are promoted | `work/incidents/incident-usb09-false-write-failure-and-usb-compatibility-architecture-correction.md`, `work/wp/completed/wp-restore-broad-usb-compatibility-baseline.md` | none | retain the standards-led baseline; a newer contradictory incident reopens architecture review |
| USB VBUS diagnostic adapter ownership | complete; one e2 regeneration preserved the user adapter, unrelated generated churn was rejected, SSP stubs were verified against Git, and canonical Debug/Release builds plus all invariant suites passed | `work/wp/completed/wp-migrate-usb-vbus-control-out-of-ssp.md`, `work/evidence/usb-vbus-adapter-regeneration-safety-closeout-20260817.md` | none | retain the diagnostic-only adapter and the minimal production publication lifecycle; no target action was part of closeout |
| Exploratory USB workflow specimen matrix | complete; observations produced the resolved compatibility ticket and remain specimen evidence, not an approved-drive list | `work/spikes/spike-explore-usb-drive-workflow-compatibility-across-controllers-a-and-b.md`, `work/tickets/ticket-investigate-usb-drive-enumeration-and-post-save-workflow-compatibility.md` | none | retain as historical evidence |
| USBX/FileX and Renesas HCD modernization | deferred/no action; no migration, HCD patch, analyzer acquisition, or Renesas escalation authorized | `work/spikes/spike-evaluate-ssp-2-7-0-usbx-modernization-and-renesas-hcd-interoperability.md` | none | retain as research history; reopen only on explicit owner authorization with new contradictory evidence |
| Operator warning truth | complete; all surfaces classified, high-risk asynchronous paths corrected, and the final A/B Graph review passed | `work/wp/completed/wp-operator-warning-truth-and-false-positive-prevention.md`, `docs/operator-warning-truth-policy.md` | none | retain the completed evidence |
| HPT Embedded Log Store v0.4.0/media-1.0 adoption | completed historical baseline; incomplete media-full and Controller B gates superseded, not claimed | `work/wp/completed/wp-hpt-embedded-log-store-v0-4-0-renesas-integration.md` | none | retain as predecessor evidence |
| Triple-mirrored circular HPT media 2.0 | local correctness models, read-performance implementation, shared USB workflows, and historical Controller B recovery baseline are retained; portable release identity, local adoption/bundle closeout, and every new controller test remain separately owned | `work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md` | portable-core repository publishes immutable media-2.0 source release; this workspace pins/adopts it and publishes the SMI bundle; Pi readiness precedes all controller execution | portable repo owns source release/host evidence; firmware workspace owns adoption/bundle/review; Pi qualifier coordinates all A/B execution |
| External automated lab power | separate `srv-rpi00.local` service; G-PWR-A and G-PWR-B methods passed fully on 2026-07-25 | `work/runbooks/runbook-autonomous-hpt-sd-qualification.md` | remote qualifier live adapter and case-specific authorization; card-specific HPT/data claims remain separate | no local execution task; the Pi qualifier invokes only the service-owned API/client for authorized cases |
| Temperature profile recovery and regulation | deferred by owner | `work/wp/deferred/wp-temperature-control-profile-recovery-and-steady-state-regulation.md` | every current active workpackage closed | do not activate or mutate firmware/configuration until the entry gate clears |
| Temperature sensor validity and RTD recovery | deferred by owner | `work/wp/deferred/wp-temperature-sensor-validity-interlock-and-rtd-transport-recovery.md` | every current active workpackage closed; layered runaway-prevention contract approved | retain the 0--70.1 C setpoint range; implement validity/freshness, response/energy, transport/converter, and independent protection in the successor |
| Release and documentation | local release-consumer task; pending | this map plus active workpackages | local gates plus an immutable Pi result manifest proving complete coverage and disposition | review returned results, promote settled behavior, record hashes/evidence, restore production state, and close packages |
| Knowledge and planning reconciliation | complete; duplicate work trees consolidated and dated baseline/current split established | `work/wp/completed/wp-reconcile-smi-baselines-current-truth-and-planning-surfaces.md` | none | normal use through the workspace-local physical `work/` tree and current map |

## Dependency Notes

- The semantic-configuration package owns a positive current-SMI schema
  fingerprint, clean automatic hard reset for every nonmatch, cross-field
  semantics, requested-versus-effective heater permission, recovery boot, reset
  policy, and transactional persistence. DispTest, DDS, older SMI, and other
  personalities are unchanged ecosystem inputs, not implementation targets.
- The review-mitigation package retains CR-10 history and owns only safe bounds
  at each model-table consumption point plus diagnostics. It must not implement
  a competing validator, persistently rewrite model/configuration, or gate heat
  solely from model identity.
- The bounded-calibration package owns the numeric main-temperature correction
  contract and repeated-calibration defect. Its immediate invariant is that no
  UI, service, persistence, or restore sequence can expand the approved absolute
  interval. PID retuning and sensor-transport recovery remain in their separate
  deferred packages.
- Use one final candidate image for combined sign-off. Results from the current
  `00.04.12` image remain baseline evidence if semantic changes produce a newer
  image; they do not automatically qualify that newer image.
- Owner sequencing decision on 2026-07-20: complete all intended implementation
  before the thorough interactive checklist begins. Earlier target checks remain
  development evidence only. Final release disposition must come from a fresh
  results file created after implementation freeze and tied to the exact final
  ELF/SREC/update hashes loaded on both controllers.
- Owner sequencing clarification on 2026-07-25: the filesystem upgrade,
  SD-card-friendly power-fail resistance, and triple-mirrored circular data
  store are the primary delivery goal and significant code changes. Complete
  them before heavy target qualification. Use lightweight, change-focused
  checks during implementation, then freeze one integrated candidate and run
  the thorough cross-controller, power-failure, degradation, and endurance
  matrices once.
- Owner sequencing decision: I-limit tuning and steady-state regulation remain
  deferred until the current active workpackages close. The clean factory-default
  builder must still include the existing complete valid PID/I-limit defaults so
  an automatic reset produces an operational configuration.
- Only a CRC-valid record carrying the complete supported current-SMI schema
  fingerprint is preserved. DispTest, DDS, older SMI, blank, corrupt, ambiguous,
  or otherwise nonmatching records all take the same automatic clean hard-reset
  path; SMI does not need personality-specific recognition or migration.
- A schema fingerprint identifies byte-layout compatibility, not an exact build.
  Compatible maintenance releases share it and preserve settings. A changed
  schema causes a deliberate one-time reset unless separately approved later.
- Owner approval on 2026-07-15 accepts the one-time settings loss for every
  nonmatching record, preserves no fields from untrusted layouts, resets serial
  to 0 / Not Configured, and keeps fingerprinted-but-unsafe SMI data for service
  diagnosis with effective heat off.
- A nonmatch or failed reset must not prevent SMI from reaching its service
  screen. A compiled-in recovery boot keeps heat off while retaining diagnostics,
  firmware loading, and manual factory reset. Automatic reset constructs fresh
  defaults without copying untrusted fields from the rejected record.
- The sensor-validity interlock is also deferred, but its incident evidence must
  be retained: an invalid zero reading saturated heat until power cycle restored
  RTD acquisition. The clarified goal retains the 0.0--70.1 C setpoint range and
  replaces the proposed 10 C floor with conversion validity/freshness and a
  heater-response/energy watchdog. Activation must still resolve any 75 C
  normal-mode ceiling against 180 C high heat, raw-count clamping,
  calibration/alarm interactions, independent hardware protection, and the
  37.0/37.4 C default mismatch. Coordinate code ownership with the deferred
  temperature-profile workpackage.
- Combine compatible smoke, update, configuration-preservation, control, UI,
  chart, export, and SD checks into one recorded run, while retaining the
  acceptance criteria and evidence links in each owning checklist.
- Campaign evidence through 2026-07-16 used A=`1751219` and B=`1751136` and
  remains attached to those physical controllers. The connected-bench mapping
  was electronically re-established on 2026-07-20 as A=`1751136` with J-Link
  `69664082` and B=`1751219` with J-Link `69660123`. Never relabel historical
  results to the current bench names; new work uses the current inventories and
  must reconfirm the mapping after cabling changes. EDGE run 67569 remains
  physical-controller `1751219` evidence regardless of its legacy directory.
- No-card and bounded media-failure behavior must pass before the long-duration
  campaign. Endurance evidence cannot substitute for controlled removal,
  full-card, power-interruption, or injected-failure evidence.
- `G-PWR-A` and `G-PWR-B` passed fully on 2026-07-25. Group B includes three
  current-firmware reset witnesses and stable CID identity. Neither power-method result replaces
  candidate freeze,
  controller/card identity, safety, authorization, and case-specific acceptance
  criteria still apply to every physical interruption or endurance run.
- The separate HPT Lab Power project owns relays, wiring, its API/client, and
  operation results. The Pi qualifier owns live orchestration and generated
  evidence for every test that executes on a controller, not only SD/media
  campaigns. This workspace owns firmware hooks, non-controller verification,
  bundle-side interface definitions, stable target requirements, and review of
  returned results. Use
  `srv-rpi00.local`, not a changing IP address.
- Power interruption, flash fault injection, configuration corruption, and
  endurance/media wear require explicit target approval, backups, known-good
  images, and probe recovery.
- The shared `smi.jflash` excludes internal data flash. Confirm whether
  `smi_jg_69664082.jflash` and `smi_sl_600110473.jflash` are active before
  aligning them.

## Delivery Plan

| Phase | Owner / workspace | Readiness | Outcome | Exit Gate |
| --- | --- | --- | --- | --- |
| 0. Control the benches | Pi qualifier + operator; firmware workspace supplies expected identities | complete historical baseline; remote reconfirmation is part of readiness after cabling changes | Both SMI setups and relevant probes are identified and recoverable | Pi readiness evidence binds each live controller/probe before execution |
| 1. Close the semantic contract | firmware workspace | complete | Current-SMI fingerprint, recovery, permission, diagnostics, and transaction contracts are reviewed | Positive current-SMI and negative ecosystem fixtures have agreed outcomes |
| 1A. Bound temperature calibration | firmware workspace | implementation and non-controller gates complete; controller regression transferred to the Pi campaign | One absolute offset contract governs UI, service, startup, and recovery | Contract and diagnostics are included in the immutable bundle |
| 2. Finish implementation | firmware workspace | complete for current integrated scope | HPT, review, calibration, datalog migration, and guarded Format implementation are complete | Host/model/static tests and product-path inventories pass |
| 2A. Qualify external power integration | HPT Lab Power service | method complete; each operation still gated | G-PWR-A/B provide qualified machine-readable power operations | Power-method evidence passes; no card-specific claim is inferred |
| 2B. Optimize triple-mirror reads | firmware workspace | complete | Shared format-compatible bulk traversal preserves integrity and logging | A/B performance and CID/lane-state evidence passes |
| 3. Freeze and publish portable and firmware bundles | HPT repository publishes core/validator; firmware workspace pins/adopts and packages SMI firmware | complete for handoff: HPT v0.5.0/media 2.0 is released and adopted; managed Debug/Release plus model/static gates pass; fixed-mailbox bundle `smi-00-05-00-bc0b6ce4d066-release` is imported valid but unadmitted as `5df475bd...176ce`; exact A/B programming and independent identity/CID/HPT gates pass | Pinned portable source and validator identities, shared vectors/schema, managed SMI builds, exact hashes, firmware diagnostics/interface version, campaign contract, and authorization references form immutable handoffs | Reviewed HPT source/tool and SMI firmware bundles are published through GitHub; host evidence is not controller qualification and no target execution is implied |
| 4. Establish controller-coordinator readiness | planned by `work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md` and `work/wp/active/wp-build-independent-hpt-media-validator-for-pi-qualification.md`; implemented in the two Pi repositories | **partially complete: fixture HPT execution and image identity, classified operator readiness, fixed-mailbox A/B programming and independent identity/CID/HPT gates, durable authorization/orchestration, protected operation-only service, authenticated preparation-only UI, exact bundle import, read-only acknowledgement reconciliation, PostgreSQL/SQLite validation, and the reviewed stop/recovery/regression checklist pass; `HPT2_ENDURANCE_BASELINE_V1` remains live-blocked because zero expendable samples are inventoried and target measurement, recovery evidence, approval trust-store integration, and adapter admission remain open** | One independently runnable Pi application establishes its standalone foundation, operator UI, inventory/certification workflow, email interventions, durable result ledger, pinned HPT validator, live-controller adapter, authorized read-only A/B identity, stop/recovery, and evidence-path gates; the same application supports both operating modes | Exact-candidate readiness manifest and standalone UI proof pass before target access, raw-device inspection, or destructive work; no runtime dependency on this workspace exists |
| 5. Run SMI controller release qualification in development mode | Pi qualifier + operator + HPT Lab Power service where required | blocked on completion of Phase 4; A/B fixed-mailbox programming and independent identity/CID/HPT gates pass, while adapter admission and stop/recovery readiness remain open | After separate authorization, the app proves bounded stop/recovery and then coordinates code-review negative/recovery, calibration preservation, normal smoke, and other exact-candidate target cases | Results are exact-bundle-bound, stored completely by the Pi application, machine-readable, evidence-linked, reviewed, dispositioned, and returned for firmware finalization |
| 6. Run controlled SD/HPT fault qualification | Pi qualifier + operator + HPT Lab Power service | blocked on Phase 5, samples, and case authorization | Read-only states, injected failures, power-off replacement/reboot, and named G-PWR interruptions execute on A/B | Failures are bounded, CID-linked, dispositioned, and machine-readable |
| 7. Qualify the first HPT media 2.0 family | Pi qualifier using the pinned independent HPT validator where the profile requires offline inspection | blocked on Phase 6 | Initial CID-traceable A/B pair passes baseline/post scrubs, initialization, wrap/reopen/export, endurance, recovery, and bounded independent read-only media validation after powered-off transfer to the Pi reader | At least two counted passes, complete controller and independent-validator coverage, all nonpasses dispositioned, no unresolved systemic failure, reviewer sign-off |
| 8. Return development results and release | Pi qualifier publishes; firmware workspace reviews/releases | blocked on Phase 7 result manifest | Exact candidate campaign results return through GitHub because they are required to finalize the firmware and first approved family; firmware then enters a recoverable pilot and release closeout | Local review accepts the immutable manifest, pilot passes, docs/evidence/production restoration and workpackage closeouts complete |
| 8A. Operate standalone media qualification and expand the approved-card pool | Pi qualifier | post-release | Without interaction with this workspace, each later family uses a separate adaptive two-or-more-sample campaign with unchanged released firmware; the Pi application tracks the complete result and approval history | Passing family is added in the Pi system of record; routine results remain there, while shared-system failures reopen only the appropriate owner workspace |
| 9. Activate deferred temperature recovery | firmware workspace | deferred until initial release workpackages close | Begin separately hashed temperature-profile successor | Owner activation, safe target, approved limits, and fresh baseline are recorded |
| 10. Activate deferred sensor-safety recovery | firmware workspace | deferred and sequenced after temperature-profile decision | Begin coordinated sensor-validity/interlock successor | Full safety contract and exact successor scope are approved |

## Development execution policy

- This project map and its linked local workpackages are the only active Tool
  Shed plan for Pi qualification-application and HPT validator coding. The two
  Pi repositories' `work/` directories are historical/reference inputs; do not
  create competing remote plans or infer next actions from their old active
  paths.
- Development and standalone qualification are operating modes of the same Pi
  application and use the same result schema, evidence rules, safety gates, and
  controller adapter. Development mode must remain independently runnable on
  `srv-rpi00.local`; this workspace is a bundle producer and feedback consumer,
  not a runtime dependency.
- The development feedback loop returns results here only to correct, qualify,
  or release SMI firmware. Once firmware and campaign profiles are released,
  routine endurance and card-family qualification remain in the Pi
  application's durable system of record. Only evidence of a systemic defect
  reopens the appropriate owner workspace.
- After its readiness gates pass, the `srv-rpi00.local` qualification app is
  the sole coordinator for J-Link commands, symbol/state reads, bounded
  diagnostics, programming/verify/reset, captured target artifacts, and
  qualified automated A/B power cycles. This workspace supplies the exact SMI
  firmware and test contract but does not issue those controller operations.
- Do not request operator screen reads when the same condition can be proven
  electronically.
- Reserve operator participation for behavior that inherently needs human
  visual or audible judgment, especially the final frozen-candidate screen
  review for wording, placement, legibility, and navigation.
- Complete a named inventory of every datalog CRUD consumer after the
  triple-mirror core stabilizes and before candidate freeze. Graph, events,
  temperature logging, formatting, export, service, diagnostics, and recovery
  are mandatory categories.

## Current Navigation

You are here:

- The 2026-08-02 workspace-boundary correction makes this repository an SMI
  firmware-bundle/test-contract producer and release-evidence consumer. Every
  test that executes on Controllers A/B—including code-review recovery,
  calibration preservation, normal smoke, SD/HPT fault/interruption, and
  endurance—is coordinated by
  `jong@srv-rpi00.local:~/dev/sd_qualification`. That application is healthy at
  `e9edba3` / `hpt2-postgres-lock-e9edba3`; its prior Controller A
  code-flash-only program/readback and separate firmware/CID/HPT observation
  pass. The newer fixed-mailbox bundle is imported valid but unadmitted as
  `5df475bd...176ce`; Controller B is bound to it and passed exact
  program/verify/reset/run and independent exact-flash/stable-state/CID/HPT
  observation. `HPT2_ENDURANCE_BASELINE_V1` is the
  selected first state-changing profile; its request/stop/recovery contract is
  documented and fixture-validated on the Pi. Exact-candidate A/B identity now
  passes; the exact measurement/recovery/regression checklist is reviewed, and
  execution now waits on an inventoried expendable A/B pair, live
  command-adapter admission, measured stop deadline, recovery evidence, and
  exact run authorization. The live UI/API report the unsupported gate and keep all
  state-changing profiles disabled.
  `HPT-Embedded-Log-Store` is
  a different Pi repository that owns only
  portable source/releases and host evidence. The HPT Lab Power service is a
  separate operation provider, and the operator owns physical handling and
  authorizations. The same Pi application has a firmware-development mode that
  returns exact candidate results here for firmware finalization and a
  standalone released-media mode that runs endurance/card qualification and
  retains all routine results without this workspace. No local `Next Action`
  may instruct controller execution.
- All Pi application coding is planned through
  `work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md`
  and executed in `jong@srv-rpi00.local:~/dev/sd_qualification`. The remote
  repository remains the code/runtime/result authority, while this Tool Shed
  remains the sole planning authority. Its current clean `main` is `e9edba3`.
  Stage 3 bundle binding, inventory,
  certification, intervention, evidence/report, image/SBOM/offline media,
  migration/rollback, and disconnected fixture gates pass and are deployed
  fixture-only; Stage 4 Gmail authentication, credential/egress confinement,
  confirmed delivery, outage/backoff/recovery, acknowledgement, and
  reminder/escalation coverage pass. PR #12 removed automatic
  certification-file retrieval, its hostname policy/readiness gate, and its
  failure intervention while retaining manual immutable records, reviews,
  evidence references, and `CERTIFICATE_REQUIRED`. HPT v0.5.0 fixture
  execution, the protected read-only controller observer, and the separately
  gated code-flash programmer are also deployed; Controller A exact candidate
  identity passes;
  live admission and both controller qualification flags remain false.
- All HPT portable-core and independent-validator coding is planned through
  `work/wp/active/wp-build-independent-hpt-media-validator-for-pi-qualification.md`
  and executed in `jong@srv-rpi00.local:~/dev/HPT-Embedded-Log-Store`. Clean
  `main` is at `1f0a45d`; audited draft checkpoint `d1e9e7e` is preserved on
  green PR #2. Media-2.0 reader Stages 1-2 pass and the initial validator exists,
  but its remaining Stage 3 negatives and immutable Stage 4 release still gate
  Pi admission.
- The 2026-08-01 semantic reconciliation closes the stale USB planning loop:
  USB02 and USB09 are resolved, the complete Stage 1/session/32 KiB/enumeration/
  BOT evidence chain routes to the promoted standards-led broad baseline, and
  predecessor artifacts have no executable next actions. T00 remains closed as
  unresolved no-action architecture evidence. The diagnostic-only VBUS
  ownership gate closed on 2026-08-17 after one e2 regeneration, rejection of
  unrelated generated churn, canonical Debug/Release rebuilds, and all
  repository invariant suites; no target action occurred.
- Stage 1 USB compatibility recovery is software-complete. The stock
  v00.04.11 USBX storage layer/configuration and 1 KiB application write
  baseline are restored while current HPT 2.0, CSV/export, firmware-update,
  graph, warning, calibration, and recovery behavior remains. Focused checks
  and canonical Debug/Release builds pass; exact hashes are in
  `work/evidence/usb-stage-1-software-baseline-20260731.md`. The exact Stage 1
  candidate is now deployed and independently read back on both controllers;
  controller/SD gates are recorded in
  `work/evidence/usb-stage1b-controller-deployment-baseline-20260731.md`.
  Paired rounds 1 and 2 passed `USB01_2G` and `USB05_4G` on both hardware
  variants, including common-path controller workflows, prior-image
  replacement, and independent Pi validation. Round 3 passed `USB03_32G` on
  B but failed `USB02_8G` on A after a valid FileX handoff: the inherited
  volume-query gate discarded its status, closed the still-attached session,
  and could not recover. Independent Pi validation proved USB02 remained clean
  and unchanged. Diagnostic round 4 then passed USB02 on B and USB03 on A
  through the complete workflow and Pi checks, proving the failure is a
  recoverability defect rather than an incompatible specimen. Correction,
  repeated gates, and USB09 regression remain, so broad compatibility is not
  claimed. The narrow lifecycle correction now passes all focused checks and
  canonical Debug/Release builds at commit
  `96b8ab4b87e438c41370b24001a5ef00bcd93492`. The exact candidate is now
  deployed B first and A second, with independent full-flash match and fresh
  controller/SD identity gates passing on both. Evidence is in
  `work/evidence/usb-session-recovery-controller-deployment-20260731.md`;
  recovery round 1 then repeated the previously failing USB02/A allocation.
  USB02/A and USB03/B both passed first insertion, the full workflow, live
  session/error telemetry, and independent Pi validation. Evidence is in
  `work/evidence/usb-session-recovery-round1-usb02-usb03-20260731.md`;
  the cross-controller read/playback check then passed within the one-reseat
  allowance. USB03/A's first insertion did not publish a new USBX class/media
  session and required the recorded clean reseat; USB02/B mounted first try.
  Evidence is in
  `work/evidence/usb-session-recovery-cross-check-usb03-usb02-20260731.md`.
  USB09 then passed its Pi pretest and mounted on Controller A on first
  insertion, but the full retained-range export failed at `fx_file_close()`
  after 99,328 requested bytes. The close consumed exactly 50 seconds and
  returned raw `0x5C`; publication remained false despite a still-valid,
  mounted session. Evidence is in
  `work/evidence/usb09-recovery-candidate-controller-failure-20260731.md`.
  Independent Pi inspection then confirmed differing FAT copies, an incorrect
  free-cluster summary, no final file, and an incomplete 97,280-byte
  `HPTE.TMP` ending mid-record. Evidence is in
  `work/evidence/usb09-recovery-candidate-pi-failure-inspection-20260731.md`.
  Raw `0x5C` is USBX `UX_TRANSFER_TIMEOUT`, passed through FileX by the stock
  USBX driver. The 1 KiB cap is therefore disproven as the broad baseline.
  The next discriminator changes only the HPT FileX cap to the previously
  accepted 32 KiB value; USB09 and the broad matrix remain required before
  promotion.
- Prior 32 KiB USB specimen results remain historical performance and
  compatibility input; they do not qualify promotion by themselves. Together
  with USB09 disproving the 1 KiB cap, they authorize one isolated 32 KiB
  recovery discriminator. USB09 and the broad matrix must pass before
  promotion. SSP/HCD migration remains unauthorized.
- The isolated 32 KiB discriminator passes all focused USB/export/code-review
  gates, canonical managed Debug and Release rebuilds, packaging, and exact
  artifact freezing at source commit `8fa1479b6b942f72f18ff4ed2cb1a5c73ddc2501`.
  Evidence is in
  `work/evidence/usb-32k-recovery-software-candidate-20260731.md`.
- The exact Release candidate is deployed B first and A second. Both complete
  flash readbacks match the frozen S-record and both post-reboot controller/SD
  gates pass. Evidence is in
  `work/evidence/usb-32k-recovery-controller-deployment-20260731.md`.
- After explicit authorization and a full Windows FAT32 format, USB09 passed
  exact Pi identity, equal-FAT, filesystem, full-device direct read, capacity,
  content, unmounted-state, and kernel-error gates. Evidence is in
  `work/evidence/usb09-post-windows-format-pi-health-20260731.md`.
- USB09 then passed the identical Controller A failure-range regression on the
  deployed isolated 32 KiB candidate: 8,540 healthy records, no gaps, 429,175
  published bytes in 14 writes, zero close delay, 2.12-second USB time, and
  zero errors. Evidence is in
  `work/evidence/usb09-32k-recovery-controller-pass-20260731.md`.
- Independent Pi verification passed equal FATs, filesystem state, exact
  429,175-byte size, all 8,540 sequential records, range/health metadata,
  completion marker, absence of temporary artifacts, and kernel-error gates.
  USB09 is resolved end to end; broad promotion remains blocked on the
  four-drive A/B matrix. Evidence is in
  `work/evidence/usb09-32k-recovery-pi-pass-20260731.md`.
- The immediate Round 1 repeat Pi gate passed `USB01_2G` and `USB05_4G` on
  identity, capacity, read-only FAT structure, equal FATs, retained content,
  current-insertion kernel state, and final unmounted state. Evidence is in
  `work/evidence/usb-32k-round1-precheck-usb01-usb05-20260731.md`.
- The complete 32 KiB Round 1 controller workflow passed both hardware
  variants on first insertion. WAV load/playback, PID, image replacement, and
  full retained HPT exports completed with exact 32 KiB writes, clean
  publication, retained mounted sessions, and zero USB/system errors. The Pi
  closeout remains pending. Evidence is in
  `work/evidence/usb-32k-round1-controller-usb01-usb05-20260731.md`.
- Independent no-repair Pi validation passed equal FATs, exact CSV sizes and
  continuous sequences, completion trailers, PID/WAV content, identical
  internally CRC-valid recovery images, kernel state, absence of temporary
  artifacts, and final unmounted state. Round 1 is PASS end to end. Evidence
  is in `work/evidence/usb-32k-round1-pi-usb01-usb05-20260731.md`.
- Opposite-controller 32 KiB Round 2 passed the complete controller workflow:
  `USB05_4G`/A and `USB01_2G`/B published full images and full-range HPT CSVs
  with 14 writes reaching 32,768 bytes and zero USB/system errors. A required
  one clean powered USB05 reseat after an initial below-class enumeration
  miss; no VBUS or controller power action was used, and the observation
  remains open compatibility evidence. Independent Pi validation is pending.
  Evidence is in
  `work/evidence/usb-32k-round2-controller-usb05-usb01-20260731.md`.
- Independent no-repair Pi validation passed equal FAT copies, exact and
  continuous CSVs with COMPLETE markers, PID/WAV content, identical internally
  CRC-valid recovery images, kernel state, absence of temporary artifacts, and
  final unmounted state. Round 2 is PASS end to end; the initial A/USB05
  enumeration miss remains open compatibility evidence. Evidence is in
  `work/evidence/usb-32k-round2-pi-usb05-usb01-20260731.md`.
- 32 KiB Round 3 passed the complete controller workflow with `USB02_8G` on A
  and `USB03_32G` on B. Both published full images and retained HPT CSVs in 14
  writes reaching 32,768 bytes with zero USB/system errors. USB03 required one
  clean powered reseat after a below-class first-insertion miss on B; the miss
  occurred before FileX and remains open broad-compatibility evidence. The
  independent Pi closeout subsequently passed equal FAT copies, exact and
  continuous CSVs, COMPLETE markers, PID/WAV and internally CRC-valid images,
  clean kernel state, no temporary artifacts, and final unmounted state. Round
  3 is PASS end to end. Evidence is in
  `work/evidence/usb-32k-round3-controller-usb02-usb03-20260731.md`
  and `work/evidence/usb-32k-round3-pi-usb02-usb03-20260731.md`.
- 32 KiB Round 4 passed the complete controller workflow with `USB03_32G` on
  A and `USB02_8G` on B. Both published full images and retained HPT CSVs in
  14 writes reaching 32,768 bytes with zero USB/system errors. USB03 required
  one clean powered reseat after another below-class first-insertion miss on
  A; the miss occurred before FileX and remains open broad-compatibility
  evidence. Independent Pi validation subsequently passed equal FAT copies,
  exact continuous CSVs and COMPLETE markers, PID/WAV and internally
  CRC-valid images, kernel state, no temporary artifacts, and final unmounted
  state. Round 4 is PASS end to end. Evidence is in
  `work/evidence/usb-32k-round4-controller-usb03-usb02-20260731.md` and
  `work/evidence/usb-32k-round4-pi-usb03-usb02-20260731.md`.
- The isolated 32 KiB write path passes USB09 plus all eight four-drive A/B
  observations. This separates the remaining below-class first-insertion
  reliability issue from FileX write size and keeps production promotion
  blocked on an evidence-backed enumeration disposition. Matrix closeout is
  in `work/evidence/usb-32k-four-drive-matrix-closeout-20260731.md`.
- The prior `D386...` Debug candidate remains a programmed/verified
  qualification baseline. Both controller/card pairs passed CID-linked full-address scrubs
  across all `15,523,840` sectors with zero failures or retries and passed the
  integrated HPT/chart/logging gate. The predecessor candidate supplied three
  successful cold-start/reopen/CID cycles on each controller; the final delta
  changes only bounded scrub scheduling, so those cycles are accepted as
  delta-scoped evidence and must not be repeated merely to recreate raw output.
  The owner then reported PASS for the scoped visual, audio, and touchscreen
  review on both controllers. Both controls now run `EAD175B1...81DA4B`,
  which proves the graph lifecycle correction and supplies scalar-read timing.
  Production release is reopened for the triple-mirror bulk-read/cache/export
  workpackage and its B-then-A performance gate before the separately scoped
  negative, destructive, degraded-media, endurance, multi-sample,
  upstream-adoption, and rollout work.
- Both controls previously ran warning-truth candidate
  `944BEA28...844501`. All 19 software gates and the clean build passed. Real
  setpoint saves on A and B reproduced first-attempt `SSP_ERR_CMD_LOCKED`,
  recovered on attempt 2 without a warning, and restored exact original bits.
  B remained unformatted with asymmetric lanes and loaded its graph cache in
  `2.51 s`; A loaded in `2.60 s`. That hash is predecessor evidence.
- Both controls now run the USB broad-compatibility Release candidate with
  S-record `6907F88F...932581` and full-flash hash
  `23428A89...754CA`. It retains
  the bulk-read, retained-start, warning-truth, Graph, SDRAM CSV, and supported
  USBHS/USBX corrections, strict WAV validation/programming, atomic `.imx`
  publication, correct update/PID file ownership, and shared 32 KiB SDRAM
  `.imx` buffering. B then A passed
  WAV load/playback/reboot persistence, `.imx` save/self-update, raw
  four-MiB flash comparison, audio restore, PID capture, and retained CSV
  publication. Both Graph screens are active, following newest, and current;
  B remains unformatted with `86/86/1` lanes. The BOT delta added strict CSW
  validation and passed deterministic error models plus representative
  cross-device regression without specimen-specific behavior. This is the
  only live candidate for remaining qualification.
- July 21 added and clean-built service 469 plus completed dual-controller
  service-470 FAT32/FileX evidence, now historical. On July 22, Controller A
  produced a silently
  truncated export and its card then showed repeatable hardware read failures
  inside the sole FAT and other regions. The 469 boundary campaign is invalidated,
  the failed card is retired as evidence, and media qualification is reactivated.

Do next:

- [x] Approve the remaining qualification matrix, controller/card roles,
  destructive authority, recovery/stop controls, first-family adaptive A/B
  release gate, rolling approved-pool expansion, and acceptance limits in
  `work/decisions/decision-remaining-qualification-authorization.md`.
- [x] Create one setup record and evidence directory for each physical SMI.
- [x] Preserve the historical campaign mapping and establish current connected
  routing: A=`1751136`/`69664082`, B=`1751219`/`69660123`.
- [x] Implement the export-domain reason contract and retained-bound reporting.
- [x] Implement the bounded full-address read scrub.
- [x] Implement/model record-data-write, segment header/seal,
  reclaim/next-segment, and retirement-snapshot interruption hooks.
- [x] Complete the version-5 production-routing FAT32-to-HPT transition
  dispositions while preserving USB FileX.
- [x] Finish approved calibration and remaining review mutations before freeze.
- [x] Receive the external hostname-based power API/client and pass G-PWR-A;
  before completion this blocked physical cuts/endurance, not preceding coding.
- [x] Pass G-PWR-B with three current-firmware reset witnesses, exact-target
  recovery, and matching baseline/post-reboot CID identity.
- [x] Approve the current-SMI fingerprint behavior, clean automatic hard-reset
  defaults, recovery boot, reset identity behavior, and requested/effective heater contract.
- [x] Preserve and inventory the overlapping dirty-worktree baseline before implementation.
- [x] Select exact schema/magic/layout constants and implement the
  generation/readback-verified save transaction.
- [x] Refactor the clean-default builder and add executable configuration fixtures.
- [x] Choose the integrated candidate version only after the semantic scope is fixed; clean Debug/Release builds and hashes are recorded in `work/evidence/integrated-candidate-build-and-readonly-gate-20260716.md`.
- [x] Finish the bounded-calibration contract and every other intended firmware
  mutation before starting final interactive qualification.
- [x] Finish every remaining filesystem/HPT media 2.0/triple-mirror code change
  and its lightweight host/model/static/build gate before freezing the final
  integrated candidate.
- [x] After the triple-mirror core is stable, inventory and migrate every
  datalog CRUD consumer; prove graph, events, temperature, formatting, export,
  service, diagnostics, and recovery use triple-mirrored HPT or are retired.
- [x] Add a guarded Format button to the installed-but-unformatted SD
  notification and verify its eligibility, cancel, success, and failure paths
  electronically where non-destructive, with terminal-state repetition and
  final operator screen review transferred to the frozen-candidate checklist.
- [x] Freeze the superseded July 24 baseline source commit `809362d8` and
  Debug/Release ELF/SREC artifacts in commit `c7a20522`; later filesystem/HPT
  integration work means it is historical rather than the final candidate.
- [x] After all significant code changes are complete, freeze the final
  integrated candidate, capture the read-only baseline, load that same image on
  A and B, and create one new empty checklist results file.
- [x] Complete final-candidate autonomous electronic qualification on A and B:
  program/verify/reset, same-run CID/status baselines, complete full-address
  read-only scrubs, and integrated HPT/chart/logging gates.
- [x] Complete the scoped post-freeze operator review for visual, audio, and
  touchscreen behavior on both controllers; owner reported PASS on 2026-07-25.
- [x] Complete operator acceptance of the implemented and electronically
  measured format-compatible multi-block reads shared by cache and export;
  B passed first without formatting, then A, and final USB timing is recorded
  in the completed workstream row above.
- [x] Classify all operator message surfaces, enforce terminal/revalidated
  asynchronous warnings, correct the recovered configuration-save race, pass
  the clean build and A/B exact-save proof, and return both graph caches ready
  for operator review.
- [x] Stop the failed-card 469 campaign and preserve the incident/recovery evidence.
- [x] Implement and qualify fail-closed HPT export completion/status handling
  on Controller A.
- [x] Preserve the July 22 failed-card recovery set in durable governed storage
  using the owner-approved compact archive disposition.
- [x] Close the repeated-card causal investigation at the supported boundary:
  direct cause was physical media unreadability; the initiating mechanism is
  indeterminate, and controller/media/workload discrimination is transferred
  to the active CID-linked A/B multi-sample HPT qualification campaign.

Avoid for now:

- Starting destructive fault injection or a long endurance run before setup
  identity, recovery, media samples, measurement method, and pass/fail limits
  are recorded.
- Treating implementation/build evidence as release qualification; completed
  feature work may close only when all remaining release gates are explicitly
  transferred to the post-freeze integrated checklist without weakening them.
- Treating a pass on one setup or firmware hash as coverage for the other setup
  or a later image.
- Starting the deferred temperature-control mitigation, changing live I-limit
  values, or reflashing a successor image before all current workpackages are
  closed and the owner explicitly activates the deferred workpackage.

## Related Artifacts

- Work index: `work/index.md`
- Workpackages:
  - Completed: `work/wp/completed/wp-semantic-configuration-validation-and-recovery.md`
  - Completed: `work/wp/completed/wp-bounded-temperature-calibration-and-drift-recovery.md`
  - Completed: `work/wp/completed/wp-operator-warning-truth-and-false-positive-prevention.md`
  - `work/wp/active/wp-mitigate-smi-firmware-code-review-findings.md`
  - `work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md`
  - Completed: `work/wp/completed/wp-reconcile-smi-baselines-current-truth-and-planning-surfaces.md`
  - `work/wp/active/wp-sd-card-accelerated-endurance-evaluator-and-media-qualification.md`
  - Completed: `work/wp/completed/wp-hpt-embedded-log-store-v0-4-0-renesas-integration.md`
  - `work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md`
  - Deferred: `work/wp/deferred/wp-temperature-control-profile-recovery-and-steady-state-regulation.md`
  - Deferred: `work/wp/deferred/wp-temperature-sensor-validity-interlock-and-rtd-transport-recovery.md`
- Tickets:
  - `work/tickets/ticket-hpt-bounded-full-address-read-scrub.md`
  - `work/tickets/ticket-preserve-controller-a-failed-sd-evidence.md`
  - `work/tickets/ticket-eliminate-full-history-scan-latency-for-bounded-hpt-customer-exports.md`
- Checklists:
  - `work/checklists/checklist-smi-firmware-mitigation-hardware-qualification.md`
  - `work/checklists/checklist-hpt-media-2-degraded-operation-qualification.md`
  - `work/checklists/checklist-hpt-media-2-autonomous-retail-card-qualification.md`
- Spikes:
  - `work/spikes/spike-clarify-hpt-export-retention-range-messaging.md`
  - `work/spikes/spike-version-5-retire-fat32-datalogging-and-standardize-hpt-media.md`
- ADRs: `work/adr/adr-smi-firmware-update-authentication.md`
- Runbooks:
  - `work/runbooks/runbook-autonomous-hpt-sd-qualification.md`
- Inventories:
  - `work/inventories/inventory-version-5-fat32-to-hpt-transition-surfaces.md`
- Evidence: `work/evidence/service-469-470-474-implementation-and-target-status-20260721.md`
- Decision matrices:
- Original pending scope, now materialized by the evaluator workpackage:
  `work/PENDING_PLAN_NOTE.md`
