# Executive Directive: Deliver a safe SMI 00-05-01 update floor while preserving a return path to revised DisplayTest and the FAT32 production handoff. Prove the transition on both controller assemblies before release.

Status: promoted
Type: idea-brief
Role: project-executive-directive-v1
Updated: 2026-09-22
Next Action: retain the frozen SMI 00-05-01 candidate and obtain an eligible SMI controller with verified SMI QSPI resources without altering either DVO controller
Readiness Review: READY-WITH-PRM-GATES at revision 3; four gates transferred to MAP-0009
Produces: MAP-0009

## CEO Directive

Deliver a safe SMI 00-05-01 update floor while preserving a return path to revised DisplayTest and the FAT32 production handoff. Prove the transition on both controller assemblies before release.

## Desired Outcome

Use IDEA-0006 as the technical scope and decision record. Deliver an SMI 00-05-01 candidate whose validated IMX Title governs family/version identity and whose ordinary updater refuses pre-00-05-01 personality images before QSPI erase. Provide a separate direct service rollback to any valid SMI image without a version allowlist. For a pre-00-05-00 FAT32-era target, validate and stage the image before explicit, confirmed in-place FAT32 preparation of the installed card; service 471 remains the HPT2 recovery action if current SMI survives a pre-flash failure. Preserve an SMI return path to DisplayTest 01-01 or later that safely handles HPT2 media and then verifies FAT32 handoff. DisplayTest may install a valid older SMI personality after that FAT32 handoff; its fixture-to-fixture minimum is 01-01. Keep SMI's HPT2 initialization explicit. Require transition, refusal, and rollback evidence on both controller assemblies before release.

## Current Position

The owner accepted the direction in IDEA-0006 and added the rare direct SMI rollback path. MAP-0009 carries the four readiness gates. The SMI source has the ordinary Title floor, exact SMI/CVO/DVO product recognition, DisplayTest return parser, and separate service-code-151 rollback with CID-checked in-place FAT32 preparation. A pending SD request now cancels after 30 seconds if the SD owner never accepts it; accepted destructive work still waits for the terminal result. Fresh clean-commit Debug and Release rebuilds, 19 identity cases, 9 rollback checks, 16 update cases, and 15 review checks pass. Commit `77495a37` is frozen as immutable candidate `00.05.01-77495a3715ff-5a30dd9eacda`; the Release S-record SHA-256 is `5A30DD9EACDA99AD7BC86CA70D536FA331B78A4015325891DE920EA8421B00B3`. The owner clarified that both present controllers run DVO, do not support SMI service 467, and must not be altered by this project. SMI 00-05-01 and DisplayTest 01-01 IMX bytes remain to be generated and bound. Target transition and fault behavior are still unproven, so this is a source candidate, not a qualified release.

## Progress

- [x] Directive captured exactly in canonical project state.
- [x] Codex has delegated the directive into a bounded plan and execution chain (MAP-0009).
- [ ] The requested outcome has evidence and is reconciled.

Only check a milestone when canonical lifecycle state or linked evidence supports it. Codex updates
this section as work moves; the generated `work/100k.md` never guesses progress.

## Recommended Next Action

Retain the verified immutable SMI 00-05-01 candidate and designate an eligible SMI controller with verified SMI QSPI resources. Then capture its CID and rollback baseline before service-150 image generation and target qualification.

## Why This Next

The host-side implementation and immutable candidate are complete. Image generation and transition proof require SMI runtime services and correct SMI QSPI resources, which the protected DVO controllers cannot provide.

## Blockers

- A DisplayTest 01-01 or later image has not yet been qualified for safe HPT2 startup and FAT32 production handoff.
- The SMI 00-05-01 and DisplayTest 01-01 candidate IMX files and hashes are not yet established; verify selected legacy image bytes on target media before use.
- SMI 00-05-01 and DisplayTest 01-01 IMX files do not yet exist; service 150 must generate the SMI image from verified SMI QSPI resources before transition testing can consume it.
- Both present controllers run DVO, do not support SMI service 467, and must remain unaltered for this project; no eligible SMI target is currently designated.

## Operator Needs

- Designate an eligible SMI controller with verified SMI QSPI resources for service-150 image generation and initial qualification.
- Preserve both current DVO controllers exactly as they are.

## Completion Condition

The SMI and DisplayTest implementation and release identities satisfy IDEA-0006; both controller assemblies pass the forward, return, renamed-file, ordinary legacy-refusal, and representative direct rollback matrix; in-place FAT32 preparation, service-471 recovery, and retention safeguards are verified; the resulting release decision is evidence-backed and reconciled to this directive.

## Authority And Delivery Boundary

- Preserve any endpoint, target, timing, non-goal, or authority language stated in the directive.
- Initial CEO intake does not authorize code, build, programming, SD preparation, bench testing, push, or release. Subordinate source-changing work defaults to a verified Work1 candidate until a later delivery endpoint is authorized.
- The owner's later 2026-09-22 clarification supersedes the inbox's apparent A/B programming route for the current targets: both are DVO controllers and must not be altered by this SMI project.
- The service rollback is explicit and accepts any structurally valid SMI image, with no version allowlist. Do not treat the ordinary floor as a ban on controlled recovery or treat common internal-flash failure risk as unique to downgrading. Do not require field SD-card replacement.
- Interrupt only for a genuine material decision or authority boundary.

## Delegation Contract

Initial issuance is durable intake only. Tool Shed appends this Idea through canonical planning
order, checkpoints it, and stops so other directives may be captured first. Reissuing the exact
active directive delegates or resumes it when doing so will not preempt another working campaign.

The Plan Cycle interprets this directive, the Roadmap Cycle organizes it when needed, the Milestone
Cycle materializes bounded campaigns, Campaign Cycles execute, and Evidence/Outcome Cycles report
the result back to 100k. The CEO is not required to select those internal mechanics.

## Exploration Log

### 2026-09-21

- The owner accepted the recommended CEO framing from the IDEA-0006 discussion. Preserve that brief as the technical source and keep this directive as the executive outcome.
- The owner directed IDEA-0006 and this CEO directive to include direct service rollback to approved older SMI firmware and in-place FAT32 preparation. Service 471 is the existing explicit HPT2 recovery action when current SMI remains bootable.
- The owner later clarified that service rollback accepts any valid SMI image, and corrected the DisplayTest normal return floor to 01-01 or later. The earlier named-image questions are superseded; exact images remain qualification specimens.

### 2026-09-22

- Read-only review of the separate DisplayTest 01-01 source found FAT32 handoff before personality installation, no DisplayTest personality version floor, and a 01-01 fixture-to-fixture minimum. Its project record reports a Controller B transition to SMI 00-04-11 after FAT32 handoff, with an initially unresponsive install tap requiring a power cycle; old SMI logging remains unproven. The SMI ordinary 00-05-01 floor and DisplayTest return floor are distinct. SMI A/B target qualification and this project's bench pause remain open.
- Owner designated Controller A as the initial target control for the SMI 00-05-01 transition work. Controller B remains the second required release-qualification assembly. The designation does not itself resume bench work or authorize a target operation.
- Source review removed the late-format false-failure timeout and made the read-only USB media flush informational after staged CRC verification. Release rebuild, 16 update cases, and 15 review checks pass; target fault behavior is still open. SMI 00-05-00 and 00-04-11 specimens are identified by controlled hashes, while 00-05-01 and DisplayTest 01-01 IMX candidate bytes remain pending. A newer DisplayTest Controller B record demonstrates new SMI 00-04-11 FAT32 records in a five-minute export; post-restart retention was not checked.
