# Program Roadmap: Service 489 Unattended Run And USB Evidence

Status: complete
Type: program-roadmap
Updated: 2026-09-01
Project Map: MAP-0005
Source Idea: IDEA-0003
Outcome Cycle: 0393912f-773d-4c85-81f5-a60c5a919343
Requested Endpoint: work2
Next Action: none; Work2 is complete and service-487 endurance, mounted-USB publication, Controller B/family qualification, certification, and production release remain outside this roadmap

## Program Outcome

Produce and deploy a committed firmware candidate that adds a guided, immutable service-489
session plan; explicit service-487 include/bypass semantics; optional bounded USB evidence; and
identity-bound service-486/service-488 recovery continuity. Verify the exact candidate on
non-production Controller A and register it for later Work5 without claiming actual endurance,
Controller B, family, certification, or production-release credit.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Freeze session-plan, USB-evidence, and recovery/resume contracts with focused model and policy checks | `G1-SESSION-PLAN-SEMANTICS`, `G2-USB-EVIDENCE-PUBLICATION`, `G3-RECOVERY-RESUME-SAFETY` | none | complete; versioned contracts and focused models pass |
| M2 | Implement the shared-engine extension, pass focused regressions, build/package, and create the scoped candidate commit | `G4-WORK2-CANDIDATE` | M1 | complete; candidate `ef61437cca8c350792d79c484abf0612a9167bf6` built, packaged, and committed |
| M3 | Bind Controller A, capture rollback/CID evidence, deploy and verify the exact candidate, then register/checkpoint Work2 | `G5-WORK2-CONTROLLER-A` | M2 | complete; exact candidate and frozen session choices proved on Controller A with zero leaf work |

## M1 — Contract And Model

- Add current project documentation for the versioned session-plan and USB-evidence schemas.
- Model immutable selection, confirmed bypass, capacity admission, USB loss, marker-last finalization,
  frozen 486-before-487 order, and one-shot 488 resume.
- Keep firmware execution truth, USB evidence completeness, Pi admission, and reviewer disposition
  separate.

## M2 — Firmware Candidate

- Reuse the existing qualification engine, durable journal, FileX/USB primitives, CID surface, and
  result model.
- Add only the state and HMI flow required to collect, persist, review, and execute the plan.
- Run focused service, USB, persistence, recovery, endurance-routing, and safety checks.
- Complete the canonical managed Debug rebuild, package the exact artifacts, and commit scoped
  product changes while preserving unrelated worktree changes.

## M3 — Work2 Delivery

- Development target: Controller A, assembly `1751136`, hardware variant `0`, setup `setup-a`,
  J-Link `69664082`, non-production expendable-card environment.
- Capture a fresh CID identity block and rollback image before programming.
- Program and independently verify the exact candidate.
- Exercise USB_NO and USB_YES initialization behavior, explicit BYPASS_487, INCLUDE_487 routing
  without starting the 72-hour leaf, service-486 pause, stable reboot, and service-488 one-shot
  continuation as safely supported by the focused target protocol.
- Record current target evidence, register the candidate and open owner chain in the active release
  cohort, checkpoint/rebuild Hybrid state, and require strict Doctor.

## Work2 Completion

- `docs/sd-qualification-service-489-session-plan-v1.md` and
  `qualification/profiles/sd-qualification-service-489-session-plan-v1.json`
  freeze the immutable plan, bounded USB evidence, recovery, bypass, and final
  disposition contracts. Focused source/model, SD safety, scrub,
  initialization, endurance, commissioning, and lifecycle checks pass.
- The canonical managed Debug rebuild and production-name packaging pass. The
  stable/versioned S-record SHA-256 is
  `1A0D64B1A037882AF096A1A587246AC73CD382D690F2AC805CA399987E1167A2`.
  The exact deployed source candidate is
  `ef61437cca8c350792d79c484abf0612a9167bf6`.
- Controller A assembly `1751136`, J-Link `69664082`, retained valid/readable
  CID `05000C61736466672200001C8901A34F`. Serial-bound J-Link programming and
  verification passed.
- With USB unmounted, `INCLUDE_487 + USB_EVIDENCE` persisted as flags `3` and
  `BYPASS_487 + USB_EVIDENCE` persisted as flags `2`; each stopped at
  `USB_EVIDENCE_REQUIRED` with zero work and no leaf start.
- A same-image reboot restored flags `3`, the same CID, and resume mask `0x1F`,
  then blocked as `INTERRUPTED_NO_REPLAY` with zero work. Guarded abandonment
  cleared the checkpoint; a final reset captured the workflow idle with no
  saved run.
- The target-evidence contract is
  `docs/sd-qualification-service-489-work2-evidence-20260901.md`. `USB_NO` was
  source/model tested but not started on target because it would immediately
  launch the full destructive sequence. Physical USB artifact publication and
  the actual service-487 run remain later-work evidence.
- Result: G1 through G5 and M1 through M3 pass for the requested Work2
  endpoint. No service-487 endurance, Controller B, family, certification,
  release, or production credit is granted.

## Deferred Beyond Work2

- actual 72-hour service-487 execution and immutable evidence admission;
- equivalent Controller B and paired-family qualification;
- certification signing/reviewer disposition;
- push, tag, production release, and Work5.
