# Project Executive Intent: SMI Firmware

Status: active
Type: decision
Role: project-executive-intent-v1
Updated: 2026-09-22

## North Star

Deliver dependable SMI oven firmware that keeps control, monitoring, and alarms operating through storage faults, and releases only behavior proven on both controller assemblies.

## Current Completion Horizon

Complete the SMI 00-05-01 and DisplayTest 01-01 or later transition through an evidence-backed release decision. "Done" requires the return path, the ordinary personality update floor, direct service rollback to any valid SMI image, explicit in-place FAT32 or HPT2 card preparation as applicable, and forward, return, refusal, and rollback tests on both assemblies. A passing build alone does not close this horizon.

## Strategic Context

The SMI 00-05-00 development line introduced HPT2 logging, but lacks the proposed ordinary-update downgrade guard and was never deployed on a production controller. Production DisplayTest hands off FAT32 media, while SMI prepares HPT2 media explicitly. A rare recovery may need direct installation of older SMI firmware; the installed SD card is not field accessible for replacement, so FAT32-era rollback requires a controlled in-place format. Service 471 can explicitly reinitialize HPT2 if current SMI remains bootable after a pre-flash failure. Internal-flash failure risk applies to upgrades and downgrades. Firmware candidate identity and exact-byte release controls are established; the full HPT2 claim and SD-card family qualification have separate evidence gates.

The SMI ordinary updater owns the 00-05-01 personality floor while HPT2 media may remain installed. The DisplayTest 01-01 return floor is distinct: revised DisplayTest must tolerate HPT2 on startup and verify FAT32 before its normal production test or personality install. Its own fixture-to-fixture floor is 01-01, and it may install a valid older SMI after FAT32 handoff. Read-only DisplayTest source and Controller B records support that path, but do not close the SMI two-controller transition gate.

## Current Priorities

- Retain superseding immutable candidate `00.05.01-22a3205bae13-da6887348e38`, Release S-record SHA-256 `DA6887348E38F986F53C17D29BEC6CB04D5ABFF1ECFED2BF67D972E99E657AA0`, and IMX SHA-256 `6F47AF091C9B73CCE8DD8DC58D4D7F3A270D6E21DB8659D28F1C30B6F4EB80D7`.
- Put that exact IMX on `imx2` and use Controller A Settings > Update Firmware to install the same 00-05-01 main and SMI QSPI payloads while retaining its readable FAT32 card.
- Exclude SMI 00-05-00 from target qualification. Its below-floor behavior is covered by focused host policy tests; it is not a production-controller baseline or bridge.
- Continue the authorized A-first/B-second forward, return, refusal, controlled rollback, HPT2 initialization, logging, retention, and export matrix; make the later release decision from exact candidate evidence.

## Deliberate Non-Goals

- No automatic SD-card conversion or erase, and no field SD-card swap as a rollback workflow.
- No claim that the update Title authenticates its publisher.
- No automatic CVO/DVO release, SD-family approval, ECO, or customer rollout from the SMI transition result.

## Decisions Needed

- Establish the exact DisplayTest 01-01 candidate IMX and complete its separate return qualification.
- Decide when to resume the remaining bench transition matrix beyond the currently directed Controller A updater step.
- A later release decision must identify the exact qualified candidate.

## Review Triggers

- A DisplayTest 01-01 or later candidate is qualified for safe HPT2 startup and FAT32 handoff.
- Controller A visual boot or storage evidence contradicts the read-only target capture.
- Either assembly produces contradictory transition evidence.
- The in-place FAT32 preparation or service-471 recovery path produces contradictory evidence.
- An exact candidate reaches release qualification.
- The SD qualification or supply-change scope changes.
