# Executive Directive: Deliver a safe SMI 00-05-01 update floor while preserving a return path to revised DisplayTest and the FAT32 production handoff. Prove the transition on both controller assemblies before release.

Status: promoted
Type: idea-brief
Role: project-executive-directive-v1
Updated: 2026-09-23
Next Action: resolve A DisplayTest NVRAM Read Error with one separately authorized restart and fresh validity/status evidence; do not run Erase EEPROM for this SPI NVRAM symptom; then finish A refusal/rollback/recovery and B transition gates
Readiness Review: READY-WITH-PRM-GATES at revision 3; four gates transferred to MAP-0009
Produces: MAP-0009

## A ordinary DisplayTest return has an NVRAM hold — 2026-09-23

The owner selected exact `7520708_DispTest_FW_01-01.imx` through the ordinary SMI Settings updater, confirmed the conditional FAT32 data-loss warning, and reported Update Success. A read-only full-flash capture matches the controlled DisplayTest 01-01 payload SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. A is FAT32-ready with valid unchanged CID `05000C61736466672200001C8901A34F`, no storage error, and a focused SD read/write PASS. The owner then supplied a photo of the DisplayTest NVRAM screen: “NVRAM Status: Read Error” and “Test Status: Not Tested.” Read-only target flags confirm invalid NVRAM and no completed power test. Evidence: `work/evidence/smi-a-ordinary-displaytest-return-nvram-hold-20260923.json` and the handoff ledger.

The matched sources show SMI writes 1,028-byte SPI NVRAM records, whereas DisplayTest 01-01 reads/writes 1,024-byte records with a different CRC position. A first-boot format mismatch is plausible, but SPI/hardware failure remains possible. DisplayTest only updates the validity flag on boot and periodically writes its own format. The owner proposed Service > Erase EEPROM; that service zeros configuration data flash, not SPI NVRAM, so it has not been run. A separately authorized DisplayTest restart is the focused discriminator. The ordinary A return image and FAT32 transition passed, but end-to-end return qualification is held pending NVRAM resolution and operator-facing checks. A refusal/rollback/recovery and B remain open. Earlier return-pending sections below are history.

## A HPT2 post-restart retention verified — 2026-09-23

The owner explicitly approved an A power-off/restart with the SD card installed and USB absent. A matched-SMI 10:33 baseline showed HPT2 ready, same complete CID `05000C61736466672200001C8901A34F`, retained oldest normal record sequence 2, live chart data and no pending update/export. The owner reported A booted 00-05-01 with pre-restart history visible. Fresh 10:35 read-only state found the same valid CID and representative-sector read, HPT2 ready, completed chart cache, retained oldest record sequence 2 / HPT timestamp 306930000, and 16 selected records in the postboot chart rebuild. New queued logging resumed with two completions and no drops since boot. Preboot cumulative counters reset on boot and are not compared directly. Evidence: `work/evidence/smi-a-hpt2-post-restart-retention-20260923.json` and the handoff ledger.

The A normal forward installation, HPT2 initialization, fresh logging/history, customer USB export with host CSV validation, and focused post-restart retention gates have passed. The USB CSV copy is preserved under SMI evidence; the drive is unmounted at the Pi. Next is the controlled ordinary A return to DisplayTest 01-01 with explicit FAT32 media preparation and fresh CID/status checks. A refusal/rollback/fault matrix and B remain open. No SD Qualification Full Run pass is claimed. Earlier dated retention-pending sections below are history.

## A customer HPT2 export and independent CSV check passed — 2026-09-23

On A, ordinary History/Graph showed recent records. The first Settings > Export Log attempt was rejected as “Range too short” before an export request. The owner retried the 10:20–10:26 controller-clock range and reported Success. Matched-SMI read-only status shows request 1 published, complete 1, USB status 0, final USB phase complete, six healthy records selected with no gaps, and no active export. The `IMX2` USB drive was mounted read-only on `srv-rpi00.local`: the 975-byte CSV contains six 10:21–10:26 minute rows and a COMPLETE footer matching target status. Its local evidence copy has the same SHA-256 `28C0D6E2005F868B76BC2EB77219DE67CC894E57B42354996D605E85FA8A041A`; the drive was unmounted cleanly. The A baseline and post-format result link the unchanged complete CID `05000C61736466672200001C8901A34F`. Evidence: `work/evidence/smi-a-customer-export-20260923.json`, `work/evidence/smi-a-customer-export-20260923.csv`, and `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

This closes A's normal fresh logging, history view and customer export/content gate. The next A test is post-restart HPT2 retention, which requires separate owner authority for a controller power operation. Then A return/refusal/rollback/fault recovery and B transition gates remain. No SD Qualification Full Run pass is claimed. Earlier dated export-pending sections below are history.

## A HPT2 ready and fresh logging verified — 2026-09-23

The owner reported SMI Format 2 **Success / log records erased**. A read-only matched-SMI capture found initialization complete, HPT2 ready, valid representative-sector read, and the unchanged complete CID `05000C61736466672200001C8901A34F`. Subsequent A captures showed acknowledged records rising from the one commissioning record to four, valid retained bounds, completed initial chart load, and live chart real data. The owner confirmed recent records are visible in the normal History/Graph view. The cumulative dropped-log count was five at 10:24 PDT; its timing is not established and remains an observation for follow-up. Evidence: `work/evidence/smi-a-post-forward-hpt2-initialization-20260923.json` and `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

This closes A's explicit HPT2 initialization and fresh logging/history view after the verified normal forward installation. Customer USB export/content validation, post-restart retention, return/refusal/rollback, fault/recovery and B remain open. The SD Qualification Full Run has not been performed or claimed. Earlier dated format-pending sections below are history.

## A normal DisplayTest-to-SMI forward transition verified — 2026-09-23

The owner completed the native DisplayTest FAT32 format and SD read/write, confirmed responsive Home touch after the affected sequence, and entered Prep for Ship/Lockout. Read-only A state confirmed FAT32 handoff PASS, unchanged valid CID `05000C61736466672200001C8901A34F` and USB ready. `IMX2` on-drive SMI 00-05-01 and DisplayTest 01-01 files were independently hash-verified on a Pi read-only mount; the drive returned to A.

The owner selected `7520553_SMI_00_05_01.imx` through Lockout > Install Software and reported Success. A read-only complete four-MiB internal-flash capture has SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`, exactly matching the accepted SMI Release candidate and controlled IMX main payload. Matched SMI RAM state has A assembly 1751136, same valid CID, representative-sector read valid, FAT32 needs Format 2, no initialization request and no update request. The owner confirmed 00-05-01 Home/About and the expected Format 2 warning. This closes the A forward installation gate, not the separate HPT2, return, refusal, rollback, fault, retention or B gates. Structured evidence: `work/evidence/smi-a-normal-fixture-install-20260923.json` and handoff ledger `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

The owner declared the card history expendable and continued the reviewed sequence. The operator has been instructed to use SMI's explicit two-stage Format 2 warning/service-471 flow and report its terminal result. No initialization pass is inferred before that result and a fresh CID/status capture. Older dated pause/missing-image/format-pending paragraphs below are historical.

## A transition execution checkpoint — 2026-09-23

The owner declared the retained HPT2 history expendable, reviewed the concrete sequence and said to continue. A FAT32 preparation and the normal SMI installation are authorized within that sequence, subject to their verification stops. The owner reports `IMX2` at A and can use A's touchscreen. SMI can read the J-Link state but has no approved touchscreen control path; the operator was given the native `System Test → SD Card Test → Format SD as FAT32?` step with its left confirmation.

Read-only A baseline at 09:48 PDT reconfirmed exact DisplayTest 01-01, assembly 1751136, serial 69664082, unchanged valid CID `05000C61736466672200001C8901A34F`, ready HPT2, cached valid sector approval, and idle update/format/SDQ request flags. Another read-only capture at 09:55 PDT showed card state 2 (HPT2), format request 0 and format result 0. Thus no format completion can be claimed. The SD read/write result field of 2 is pre-existing/stale; no such test was requested in this SMI execution. No install or power operation occurred. Raw captures: `work/evidence/generated/smi-displaytest-takeover-20260923-094826/` and `...-095550/`.

On reported format completion, capture fresh CID, protocol/card state, CID validity, representative-sector evidence and format status. Stop on CID change or failure. Then run only the affected FAT32 SD read/write–Home touch sequence, verify fresh FAT32 Lockout handoff, and check exact SMI IMX bytes on `IMX2` before the normal installation. The A/B release matrix remains open. `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md` is the SMI evidence ledger; prior handoff and paused statements below remain history.

## Current handoff reconciliation — 2026-09-23 09:27 PDT release

Coordination is resumed from SMI; live takeover is verified, with card-data disposition and explicit hardware-action authority still pending. DisplayTest released A with no pending operation, running 01-01 on assembly 1751136 / probe 69664082 with retained HPT2 CID `05000C61736466672200001C8901A34F`. Its controller-generated IMX, source `da955dc92a1652eba247f07b32d154b4b7001e02`, is now controlled at SHA-256 `E11CEB483BA478F6A3D98F75DBF303EA09800165463EFE17880D5CDB2ACD78AB`; local hashing matched it and the accepted SMI IMX. The missing-image prerequisite is complete.

Credit existing SMI candidate/UI/export and resolved updater evidence, plus DisplayTest HPT2 startup, export, scoped navigation and Card Identity; do not replay them. Full SD Qualification was not run and is not required merely for this transition. The affected SD read/write–then-Home touch sequence and verified FAT32 production handoff remain open.

Live read-only takeover succeeded at 09:40–09:41 PDT after the earlier DNS failure. Serial-bound A / assembly 1751136 / probe 69664082 has exact DisplayTest 01-01 main-flash SHA-256 `ACA37CEBA6621701CAF3909D8712EB672872940ECC0E835DE690D6AD829D6D81`. HPT2 is ready, driver CID valid, raw CID unchanged, cached sector-zero approval valid, and captured update/format/SD-test/SDQ request flags idle; FAT32 handoff remains NONE. See `work/evidence/smi-displaytest-live-takeover-20260923.json`. No halt/go/reset/program/power/format command was issued; J-Link initialization reported a low-power wake. The smallest open SMI-owned test is A's ordinary DisplayTest 01-01 → accepted SMI 00-05-01 installation through verified FAT32 fixture handoff. The retained HPT2 card first needs a recorded preservation/archive or expendable-data decision and explicit erase consent; an IMX export does not preserve SD history. After authorization, minimal FAT32 preparation and the focused affected touch check can supply that prerequisite without Full Run. Programming, power operations and formatting are not authorized by this handoff or reconciliation.

Remaining exact-candidate A/B forward/return, refusal/renamed-file, representative rollback, fault/recovery, initialization, logging/history/export and retention gates remain open. Earlier dated pause/missing-image statements below are history superseded by this capsule; prior owner-abandoned commitments remain abandoned. Evidence and the concrete next-step sequence: `work/evidence/smi-displaytest-handoff-reconciliation-20260923.md`.

## CEO Directive

Deliver a safe SMI 00-05-01 update floor while preserving a return path to revised DisplayTest and the FAT32 production handoff. Prove the transition on both controller assemblies before release.

## Desired Outcome

Use IDEA-0006 as the technical scope and decision record. Deliver an SMI 00-05-01 candidate whose validated IMX Title governs family/version identity and whose ordinary updater refuses pre-00-05-01 personality images before QSPI erase. Provide a separate direct service rollback to any valid SMI image without a version allowlist. For any admitted FAT32 target, validate and stage the image before explicit target-media preparation: retain verified FAT32, format another readable classified layout after data-loss consent, and stop on missing or unreadable media; service 471 remains the HPT2 recovery action if current SMI survives a pre-flash failure. Preserve an SMI return path to DisplayTest 01-01 or later that safely handles HPT2 media and then verifies FAT32 handoff. DisplayTest may install a valid older SMI personality after that FAT32 handoff; its fixture-to-fixture minimum is 01-01. Keep SMI's HPT2 initialization explicit. Require transition, refusal, and rollback evidence on both controller assemblies before release.

## Current Position

The owner confirmed that SMI 00-05-00 was never deployed on a production controller and excluded it from target qualification. The earlier Controller A update that staged QSPI without replacing internal flash was diagnosed and corrected by the later watchdog, FCU command-lock, and ROM-cache changes. A controlled self update then completed with terminal diagnostic error `0`, and its complete four-MiB internal-flash readback exactly matched the candidate. The accepted source is commit `1bf8afe6aebab3df4a8c71cb626e405ace3322f8`; immutable candidate `00.05.01-1bf8afe6aeba-6476100e5ae5` validates with Release S-record SHA-256 `6476100E5AE5B5ED5EA38F5BBFDFC8AE6BC44513200678406F2711B0B91C1D9D`. Controller A was direct-programmed with this candidate and exact readback SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the startup warning, reason-specific disabled-chart behavior, service 467 operator access, and service 471 warning flow. Service 150 produced the final controlled SMI image, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, whose main payload exactly matches the accepted candidate. The controlled DisplayTest 01-01 IMX is now received and hash-verified; the A/B transition and fault matrix remains open. Coordination is resumed, with hardware execution blocked as recorded above.

## Progress

- [x] Directive captured exactly in canonical project state.
- [x] Codex has delegated the directive into a bounded plan and execution chain (MAP-0009).
- [ ] The requested outcome has evidence and is reconciled.

Only check a milestone when canonical lifecycle state or linked evidence supports it. Codex updates
this section as work moves; the generated `work/100k.md` never guesses progress.

## Recommended Next Action

settle retained HPT2 card-data preservation versus expendable-data disposition and explicit action authority; then minimal FAT32 preparation, affected SD read/write–Home touch check and normal DisplayTest 01-01 fixture installation of accepted SMI 00-05-01 on verified A. See the current handoff capsule and linked evidence for the concrete sequence.

## Why This Next

The accepted SMI candidate and both controlled IMX files are exact. Live A state now matches the handoff. The open work is card-data disposition and the unproven FAT32 fixture-to-SMI transition; image generation and the earlier updater defect are complete.

## Blockers

- Live A takeover is verified; renew the baseline after any intervening bench operation or relevant reboot/card change.
- Retained HPT2 data disposition, conversion consent and installation authority are not established.
- The affected DisplayTest SD read/write–then-Home touch sequence and verified FAT32 handoff remain open.
- Exact-candidate A/B transition, fault/recovery, logging, retention, export and representative rollback evidence remains incomplete.

## Operator Needs

- Choose whether to authorize one new A DisplayTest power cycle with the SD card installed for the NVRAM screen test. Avoid Service > Erase EEPROM, which changes configuration data flash rather than SPI NVRAM.

## Completion Condition

The SMI and DisplayTest implementation and release identities satisfy IDEA-0006; both controller assemblies pass the forward, return, renamed-file, ordinary legacy-refusal, and representative direct rollback matrix; in-place FAT32 preparation, service-471 recovery, and retention safeguards are verified; the resulting release decision is evidence-backed and reconciled to this directive.

## Authority And Delivery Boundary

- Preserve any endpoint, target, timing, non-goal, or authority language stated in the directive.
- Initial CEO intake does not authorize code, build, programming, SD preparation, bench testing, push, or release. Subordinate source-changing work defaults to a verified Work1 candidate until a later delivery endpoint is authorized.
- The owner's latest 2026-09-22 clarification explicitly authorizes replacing the installed DVO firmware with SMI on Controller A and Controller B. Pre-program CID is recorded unavailable because DVO lacks service 467; post-program CID evidence is mandatory.
- The service rollback is explicit and accepts any structurally valid SMI image, with no version allowlist. Do not treat the ordinary floor as a ban on controlled recovery or treat common internal-flash failure risk as unique to downgrading. Do not require field SD-card replacement.
- Interrupt only for a genuine material decision or authority boundary.

## Delegation Contract

Initial issuance is durable intake only. Tool Shed appends this Idea through canonical planning
order, checkpoints it, and stops so other directives may be captured first. Reissuing the exact
active directive delegates or resumes it when doing so will not preempt another working campaign.

The Plan Cycle interprets this directive, the Roadmap Cycle organizes it when needed, the Milestone
Cycle materializes bounded campaigns, Campaign Cycles execute, and Evidence/Outcome Cycles report
the result back to 100k. The CEO is not required to select those internal mechanics.

## Exploration Log

### 2026-09-21

- The owner accepted the recommended CEO framing from the IDEA-0006 discussion. Preserve that brief as the technical source and keep this directive as the executive outcome.
- The owner directed IDEA-0006 and this CEO directive to include direct service rollback to approved older SMI firmware and in-place FAT32 preparation. Service 471 is the existing explicit HPT2 recovery action when current SMI remains bootable.
- The owner later clarified that service rollback accepts any valid SMI image, and corrected the DisplayTest normal return floor to 01-01 or later. The earlier named-image questions are superseded; exact images remain qualification specimens.

### 2026-09-22

- Read-only review of the separate DisplayTest 01-01 source found FAT32 handoff before personality installation, no DisplayTest personality version floor, and a 01-01 fixture-to-fixture minimum. Its project record reports a Controller B transition to SMI 00-04-11 after FAT32 handoff, with an initially unresponsive install tap requiring a power cycle; old SMI logging remains unproven. The SMI ordinary 00-05-01 floor and DisplayTest return floor are distinct. SMI A/B target qualification and this project's bench pause remain open.
- Owner designated Controller A as the initial target control for the SMI 00-05-01 transition work. Controller B remains the second required release-qualification assembly. The designation does not itself resume bench work or authorize a target operation.
- Source review removed the late-format false-failure timeout and made the read-only USB media flush informational after staged CRC verification. Release rebuild, 16 update cases, and 15 review checks pass; target fault behavior is still open. SMI 00-05-00 and 00-04-11 specimens are identified by controlled hashes, while 00-05-01 and DisplayTest 01-01 IMX candidate bytes remain pending. A newer DisplayTest Controller B record demonstrates new SMI 00-04-11 FAT32 records in a five-minute export; post-restart retention was not checked.

### 2026-09-22 direct 00-05-01 updater correction

- The owner confirmed that 00-05-00 was never deployed on a production controller and excluded it from this qualification. A deterministic host-built 00-05-01 IMX now provides the correct SMI QSPI resources directly, so the next target step uses Settings > Update Firmware and does not install the 00-05-00 development image.

### 2026-09-22 Controller A result and owner requirements detour

- Controller A Settings > Update Firmware listed and accepted `7520553_SMI_00_05_01.imx`. QSPI main and audio matched the selected image, but internal flash remained the prior candidate. CID `05000C61736466672200001C8901A34F`, representative-sector validity, FAT32 classification, and operational configuration remained stable. At this checkpoint the final flash-transition cause was unresolved; the 2026-09-23 reconciliation below closes it.
- The owner required target-driven FAT32 preparation: retain verified FAT32; format another readable classified layout only when the admitted target requires FAT32; stop on missing or unreadable media. The owner also required the main chart to use its gray disabled appearance whenever logging is unavailable.
- The revised SMI source implements those requirements. Twenty-four identity/media cases, thirteen FAT32 transaction checks, sixteen update cases, main-chart availability checks, both canonical builds, and related review/warning/USB/FileX checks pass. Commit `10dbb91519384cc9144b94e8a79057c8f47c0630` was rebuilt cleanly and reproduced the committed bytes. Immutable candidate `00.05.01-10dbb9151938-4e7dfb2f7333` contains Release S-record SHA-256 `4E7DFB2F7333202C71A736DF6692512030DB43508A1CCD0C556E7E8C1EB6B326`; manifest SHA-256 is `6F753689C56EFACE054C802FF782FFCC193BFAE2D7F5E948F0BE20F44FA86586`. No controller programming or SD formatting occurred during the detour or freeze.

### 2026-09-23 reconciliation to completed Codex work

- Commits `76471306` and `ab0755e7` corrected the internal-flash handoff by refreshing the watchdog during bounded flash operations, clearing stale FCU command-lock state, and disabling ROM cache before the RAM-resident updater. A controlled self update completed with diagnostic error `0`; internal flash exactly matched the candidate at SHA-256 `6B27C922C40908BB6221819841F8A7F264E09C3E5D3399ABB0F18993BD01A86F`. The earlier unresolved-transition statement is closed by this evidence.
- Subsequent UI work produced accepted candidate `00.05.01-1bf8afe6aeba-6476100e5ae5`. Controller A exact readback matched its expanded Release image at SHA-256 `40560E9D046293BE345676BC97CD09E88E29D543DBEB02AD3B764EBF029D4E87`. The owner accepted the Format 2 startup warning, disabled-chart reason messages and return behavior, operator service 467 access, and service 471 warning flow.
- The owner unintentionally completed service 471 during review. Immediate evidence showed ready media, unchanged valid CID `05000C61736466672200001C8901A34F`, a valid representative-sector read, and no terminal initialization error.
- Controller A service 150 generated `7520553_SMI_00_05_01.imx` on `IMX2`. Read-only validation found 8,388,864 bytes, SHA-256 `AF8132D13837F6030CD73689E77833AA563C0C878C19126448E869DFEB337332`, valid header/main/audio CRCs, and an exact main-payload match to the accepted Release candidate. The SMI controlled-image prerequisite is complete; the DisplayTest 01-01 controlled IMX and the A/B transition matrix remain open.
