# SMI Fingerprint-or-Reset Implementation Evidence

Status: software implementation and executable policy fixtures complete; hardware qualification safety-gated
Date: 2026-07-15
Firmware repository: `E:/dev/high_point/7520553_SMI_FW`

## Implemented

- Current-SMI schema: `0x534D4902`.
- Personality magic: `0x534D4943`.
- Layout revision: `1`.
- Stored fingerprint also includes `sizeof(S_Config)`, `MACHINE_TYPE_SMI`, a
  nonzero generation, and block CRC.
- `sizeof(S_Config)` is locked at 1,436 bytes by a compile-time assertion; a
  layout change must deliberately update the fingerprint revision.
- Startup preserves only complete fingerprinted, CRC-valid SMI records.
- Every nonmatch clears RAM first, sets serial to 0, and installs complete SMI defaults.
- Fingerprinted configurations are semantically checked on a copy; requested
  enable fields are not normalized or persisted by startup validation.
- Same-generation divergent blocks enter recovery instead of silently preferring block 1.
- Newest valid generation is selected and older/invalid redundancy is repaired.
- Writes use one snapshot, inactive/older-first ordering, memory-mapped readback
  comparison, and returned storage status.
- Save requests raised during a write remain pending; storage failure is retried
  and semantic rejection is not flash-hammered.
- The Misc-thread machine-type-only conversion was removed.
- Main and high-heat control require effective configuration permission; the
  fail-safe branch clears heater ticks, accumulated I, and high-heat state.
- Main-screen recovery warning retains service codes 473 and 504 and states that
  heating is disabled while service/firmware update remain available.

## Verification

- `script/check-config-semantic.ps1`: 14/14 source-contract checks passed.
- `script/test-config-fingerprint-policy.ps1`: all 14 executable policy
  fixtures passed, including foreign/old/blank/corrupt reset, newest/repair,
  ambiguity, semantic/storage recovery, rollover, and concurrent-save cases.
- Isolated clean e2 Debug build and versioned packaging after the final pure
  default-builder/layout-lock changes: passed.
- `git diff --check`: passed.
- Incremental Release compile reached link, then failed on pre-existing Release
  configuration issues: missing `fx_fault_tolerant_enable` and `.smi_chart`
  placement/FLASH/RAM overflow. No configuration-mitigation compile error was
  reported. The stable Release ELF removed by the failed link was restored from
  its pre-existing versioned twin; both hashes are
  `F8A32759F821F89711F9DF94540AE5D86F4287457C1F3E09ABCDDE2E0910496B`.

## Debug Artifact Hashes

| Artifact | SHA-256 |
| --- | --- |
| `Debug/7520553_SMI_FW.elf` | `C9E298E3FB559D477101B3AEEA9A88C06BFC0C908E825F6C4483BB0154C14EEA` |
| `Debug/7520553_SMI_FW.srec` | `FDEB112C248CDC5508FD3AD096B2E18CAE1EE3FC865E8C88350E0A60D5CB69E4` |
| `Debug/7520553_SMI_FW.map` | `84521F18A85533C742E273E277D062B67A1C65CADA4E1E4421578F24E088D047` |

## Remaining Qualification

- Exercise current SMI preservation, DispTest/DDS/old-SMI reset, one/two block
  faults, same-generation divergence, readback failure, concurrent save, reboot,
  and power interruption on an inventoried target.
- Resolve or separately disposition the pre-existing Release linker/FileX failure.
- Read-only inventory on 2026-07-15 found the connected controller live and
  actively heating. The owner subsequently approved candidate programming; the
  load, legacy reset, redundant commit, and cold-boot preservation checks
  passed. See `work/evidence/setup-a/fingerprint-candidate-load-20260715.md`.
  Destructive fault injection still requires separate explicit authority.
