# Program Roadmap: Service 489 Unattended Run And USB Evidence

Status: active
Type: program-roadmap
Updated: 2026-09-01
Project Map: MAP-0005
Source Idea: IDEA-0003
Requested Endpoint: work2
Next Action: complete M1 contract and model evidence

## Program Outcome

Produce and deploy a committed firmware candidate that adds a guided, immutable service-489
session plan; explicit service-487 include/bypass semantics; optional bounded USB evidence; and
identity-bound service-486/service-488 recovery continuity. Verify the exact candidate on
non-production Controller A and register it for later Work5 without claiming actual endurance,
Controller B, family, certification, or production-release credit.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Freeze session-plan, USB-evidence, and recovery/resume contracts with focused model and policy checks | `G1-SESSION-PLAN-SEMANTICS`, `G2-USB-EVIDENCE-PUBLICATION`, `G3-RECOVERY-RESUME-SAFETY` | none | active |
| M2 | Implement the shared-engine extension, pass focused regressions, build/package, and create the scoped candidate commit | `G4-WORK2-CANDIDATE` | M1 | pending |
| M3 | Bind Controller A, capture rollback/CID evidence, deploy and verify the exact candidate, then register/checkpoint Work2 | `G5-WORK2-CONTROLLER-A` | M2 | pending |

## M1 — Contract And Model

- Add current project documentation for the versioned session-plan and USB-evidence schemas.
- Model immutable selection, confirmed bypass, capacity admission, USB loss, marker-last finalization,
  frozen 486-before-487 order, and one-shot 488 resume.
- Keep firmware execution truth, USB evidence completeness, Pi admission, and reviewer disposition
  separate.

## M2 — Firmware Candidate

- Reuse the existing qualification engine, durable journal, FileX/USB primitives, CID surface, and
  result model.
- Add only the state and HMI flow required to collect, persist, review, and execute the plan.
- Run focused service, USB, persistence, recovery, endurance-routing, and safety checks.
- Complete the canonical managed Debug rebuild, package the exact artifacts, and commit scoped
  product changes while preserving unrelated worktree changes.

## M3 — Work2 Delivery

- Development target: Controller A, assembly `1751136`, hardware variant `0`, setup `setup-a`,
  J-Link `69664082`, non-production expendable-card environment.
- Capture a fresh CID identity block and rollback image before programming.
- Program and independently verify the exact candidate.
- Exercise USB_NO and USB_YES initialization behavior, explicit BYPASS_487, INCLUDE_487 routing
  without starting the 72-hour leaf, service-486 pause, stable reboot, and service-488 one-shot
  continuation as safely supported by the focused target protocol.
- Record current target evidence, register the candidate and open owner chain in the active release
  cohort, checkpoint/rebuild Hybrid state, and require strict Doctor.

## Deferred Beyond Work2

- actual 72-hour service-487 execution and immutable evidence admission;
- equivalent Controller B and paired-family qualification;
- certification signing/reviewer disposition;
- push, tag, production release, and Work5.
