# Project Map: SMI 00.05.02 first-format reliability

Status: active
Type: project-map
Updated: 2026-10-01
Origin: IDEA-0009
Target Release: 00.05.02
Next Action: None for this release; preserve the first-format evidence and published assets.

## Purpose

Make SD initialization and commissioning succeed on the first attempt after a fresh SMI install. Preserve the exact first failure and distinguish driver I/O from invalid HPT metadata. Carry the verified fix into the shared 00.05.02 image with IDEA-0008.

## Direction

1. Reproduce or isolate the first-format sequence against v00.05.01, beginning with the provided two-controller screenshots and source trace. Keep the cause open until a failing operation or metadata invariant is observed.
2. Correct the proven common firmware defect and retain useful first-failure diagnostics. Do not add card-specific timing or unconditional retry behavior.
3. Verify format, reopen, commissioning append/readback, and failure paths with focused tests and the canonical managed build.
4. Coordinate the 00.05.02 candidate with IDEA-0008. Qualify the exact image on both affected controller/card combinations using separately authorized expendable media, CID baselines, service 468 results, and first-attempt outcomes before release.

## Current Position

v00.05.01 failed at commissioned-media reopen on the first format attempt on two controls with different cards; each second attempt worked in the same powered session. The original failing SD operation or HPT metadata check was not captured. Source tracing found that exhausted raw reads could be reported as CORRUPT and a subsequent legacy probe could erase the displayed driver error. Committed 00.05.02 diagnostics preserve the first raw error/sector, identify the open stage and lane, and classify proven read exhaustion as IO_ERROR. They do not yet establish the underlying first-attempt cause.

Commit `b7f9cd9fda8b65070b984e6137cfe0461adcfac0` passed clean managed Debug and Release rebuilds and focused commissioning checks (110/110). Immutable candidate `00.05.02-b7f9cd9fda8b-4e1a73b11a06` validates with manifest SHA-256 `DC624924690825C3EEDDC7F8B9D220ED0E5354739DDB0811C3B0EABD270FF170` and Release S-record SHA-256 `4E1A73B11A06C0026F9AAFDE37FD69E04924732BF1D8054B9C7E8F5EB7D21656`. Both affected controls were programmed, verified, reset, and independently read back; each complete 4 MiB flash matches candidate hash `A638AAA78E7CE51C2C9DE4283B3EEB188FB17EA70FA4B77E5AECA2C8F2B12AAF`. Fresh read-only CIDs, validity, and representative sector reads were captured after each reboot. The owner confirmed both installed cards expendable. CID-bound first format requests on the installed cards completed on the first observed 00.05.02 attempt, with full commissioning terminal proof and no retry. These cards were already HPT-ready at baseline following the owner's successful second attempt, so the original fresh-install failure remains unreplicated and no root-cause correction is proven. Evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md`.

The owner chose the same-card SMI-to-DisplayTest path to recreate FAT32 without SD removal. Controller A's ordinary DisplayTest update reported Success. Its full flash matches the published DisplayTest 01-01 IMX main payload; the same CID `FE34325344000000200000015B01A30B` was valid and FAT32 ready. The exact SMI 00.05.02 return IMX was built and CRC/round-trip checked; SHA-256 `E9B30A1B368C2D005252F145DB1630FF7718332CA67564605D7BC9D14ECB357E`.

The owner moved the USB drive labeled `imx` to the Windows PC. The exact 00.05.02 return IMX was copied to its root and read back with the same SHA-256; the existing DisplayTest update file also matched its published release hash. B's fresh read-only pre-transition CID and representative sector read still pass.

The owner returned `imx` to A, completed Prep for Ship with FAT32 handoff PASS, and reported successful installation of the exact return SMI image. Full A code-flash readback matches the candidate expanded image SHA-256 `A638AAA78E7CE51C2C9DE4283B3EEB188FB17EA70FA4B77E5AECA2C8F2B12AAF`. Read-only state showed FAT32, needs Format 2, unchanged valid CID, and a passing representative sector read. The first CID-bound Format 2 request from that state was acknowledged and **FAILED at commissioned-media reopen**, phase 8, HPT status CORRUPT (5), driver status zero, open failure stage DIRECTORY (6), lane 0. No retry was issued. Deep RAM evidence shows new media generation 1 but stale active segment 1, generation 2, in all three lanes, with oldest segment 0, generation 1. Reopen could not rebuild the lane directory from that mixed chain. `tc_format()` read only sector 0 for the previous generation; FAT32 overwrote that sector while old HPT segment metadata survived. Full evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md` and its `setup-a/first-fat32-*` captures.

Commit `f51d98e7ffec36a419a1564b24924a5639dfcb84` contains the generation correction. Clean managed Debug and Release rebuilds, 110 commissioning checks, and 141 write-cut states passed. Immutable candidate `00.05.02-f51d98e7ffec-b10533f2134c` validates with manifest SHA-256 `0D28D782529BBD6761F875A7D932410F877F7E6C96B3282487FEBCBFA1B997AF`. A was programmed, verified, reset, and read back; its four-MiB flash SHA-256 `7790FC400E0FC7C57372C82CFD90915136214F6047BBAA22BC7CBDDB14CB10A0` matches the controlled IMX expansion. Its CID remained valid and unchanged. A's first Format 2 request with the corrected firmware against its previously failed card **COMPLETED** at phase 11 with proof `0x0F`, HPT/driver status zero, no reopen failure, and HPT_READY detection. This initially established recovery on a card that already had one failed attempt. The corrected return IMX SHA-256 is `1CD371F93E825B9E34AFEA8175F865E9545E6F29ECA05141A3ED706F6783E9EF`.

A then completed the ordinary corrected-SMI-to-DisplayTest update on the same card. Published DisplayTest flash matched exactly and reported FAT32_READY; Prep for Ship reported FAT32 handoff PASS. The ordinary return SMI update installed the corrected image, confirmed by full target flash readback. The expected needs-Format-2 state, unchanged valid CID, and passing representative-sector read were captured before formatting. A single current-boot CID-bound Format 2 request then **COMPLETED on the first attempt**, phase 11, proof `0x0F`, HPT/driver status zero, detection HPT_READY, and unchanged valid/readable CID. Surviving prior metadata led the corrected format to choose media generation 3. No retry was issued. Full evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md` and its `setup-a/generation-fix-first-fat32-*` captures.

B's fresh old-candidate baseline remained HPT_READY with raw CID `284245323848465102A6910D080113CF`, valid CID, and passing representative-sector read. B was programmed from the corrected candidate, reset, and read back: full four-MiB flash SHA-256 `7790FC400E0FC7C57372C82CFD90915136214F6047BBAA22BC7CBDDB14CB10A0`, unchanged valid CID and readable sector, HPT_READY. B then completed the same-card ordinary DisplayTest update: published flash matched, FAT32_READY, unchanged CID. Its Lockout handoff passed, and the ordinary corrected SMI return image installed with exact full target flash readback. Before formatting, SMI showed FAT32/needs Format 2, idle initialization, unchanged valid CID, and a passing representative-sector read. A single current-boot CID-bound Format 2 request then **COMPLETED on its first attempt**, phase 11, proof `0x0F`, HPT/driver status zero, HPT_READY, and the same valid/readable CID. Its new media generation is 4. No retry was issued. Full evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md` and linked `setup-b/generation-fix-first-fat32-*` captures. Both affected controller/card combinations now pass first-from-FAT32 on the corrected candidate.

## Dependencies And Boundaries

- Diagnostic and source work can proceed locally. Physical destructive formatting requires separate authorization and approved expendable media.
- No powered SD removal or insertion.
- Release 00.05.02 must include both this correction and IDEA-0008, with exact candidate identity and required release gates.

## Next Ground Task

The final shared candidate `00.05.02-a09c3c8bf30e-ab60c2b2295f` passed clean Debug and Release rebuilds, with all six generated artifacts matching its immutable files byte for byte. Its Release S-record SHA-256 is `AB60C2B2295FBC54E3B6E2B425BDDBB42737DB0CAA32D9E0D1673374783CC422`; the same expanded image has exact complete-flash readback on both controllers. The final 110/110 commissioning checks and local release validation profile passed. Both owning MAP cycles and IDEA parents were registered for the release cohort at Tool Shed revision 969. The owner also reran service 471 on A; post-format read-only evidence shows HPT_READY, unchanged valid/readable CID, new log records and a one-hour graph view. See `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/release-readiness.md`.

The later Graph date-row correction is included in shared source commit `67a0ede43e45aceb36af897ec774a2c96f223c46` and immutable candidate `00.05.02-67a0ede43e45-3091e7a4cdba`. Clean managed Debug/Release builds, 110/110 HPT commissioning invariants, candidate validation, and the Windows Python 3.13.1 release profile passed. The new Release S-record has full-flash readback SHA-256 `CED5BB48725624F7656D4CC17DBA063542B0F1BA91183A87A6E32D565583144C` on both controls, with their CIDs unchanged and SD sectors readable. The owner confirmed the revised Graph date row and immediate first `+` tap on both. Both FAT32 USB drives now contain the exact same normal-updater image, SHA-256 `CC43980F6BCDE68BE480F9AD2CE36B900F2EA97CCEE366A560C2608C6D1DECE4`, verified by complete readback. The normal DisplayTest-to-SMI path and first Format 2 have not yet been repeated on this newest combined image; prior first-format passes remain valid evidence for the unchanged format correction. Exact links are in `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/release-readiness.md`.

The owner subsequently completed DisplayTest-to-00.05.02-IMX installation on both controls and reported the focused format and Graph changes passing on both. Controller B additionally passed guided format and the full reported service-code sequence `471`, `504`, `501`, `51`, `511`, `505`, `506`; that full sequence was not claimed on A. After both J-Link probes were reconnected, complete post-IMX flash captures on A and B matched the exact updater expanded main SHA-256 `CED5BB48725624F7656D4CC17DBA063542B0F1BA91183A87A6E32D565583144C`. Fresh read-only identity captures show both cards unchanged, protocol READY, valid CID, passing representative-sector read, and HPT_READY with status zero after the operator's format checks. The exact files and CID blocks are linked from `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/release-readiness.md`.

Prepare one reviewed 00.05.02 release package and content commit while preserving unrelated dirty files. Keep tag, publication, and rollout behind explicit owner authorization and exact-content-SHA CI gates. Successful format tests alone do not prove release completion.

## Verified release result

The first FAT32-to-HPT Format 2 attempt passed without retry on both approved controller/card combinations. The final DisplayTest-to-SMI IMX install was reported successful on both controls, and complete post-install flash readbacks matched the qualified image. SD CIDs remained valid and representative sectors readable. The first-failure generation collision and the diagnostic correction are documented in the linked qualification record.

Release: https://github.com/Sheldon-Mfg-Inc/7520553_SMI_FW/releases/tag/v00.05.02. Exact-content four-job CI: https://github.com/Sheldon-Mfg-Inc/7520553_SMI_FW/actions/runs/36880599577. Independent download, checksum, and IMX identity evidence: `work/evidence/generated/00-05-02-graph-date-row-20261001/publication-verification.json`. This closes the firmware release obligation; customer rollout, ECO/BOM, and supplier approvals are separate.
