# Program Roadmap: Firmware Service-Code SD Qualification

Status: blocked
Type: program-roadmap
Updated: 2026-08-31
Project Map: MAP-0004
Source Idea: IDEA-0001
Outcome Cycle: cec58490-b533-46a7-bbe5-10e7addba684
Requested Endpoint: work2
Next Action: obtain fresh programming authority for replacement candidate d22dac133a7e2f64ac3b65dd512c9e2577cc3bb9 and its S-record SHA-256 32281EBC258F7FCC9241FB1899DB5068AD2219B9F75CD859B32FF5FCBDF310E5, then repeat the authorized focused M4 gate with rollback protection

## Program Outcome

Produce a committed firmware candidate in which individual SD qualification
services and one ordered full-run service use one shared leaf-test engine, then
deploy that exact commit to an explicitly bound non-production work target and
prove its changed behavior. Preserve powered-removal safety, CID-bound run
identity, no-replay recovery, standards-based USB publication, bounded-work
evidence, and independent final qualification authority.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Freeze the qualification authority and shared test catalog | `G1-SHARED-TEST-CATALOG`, `G2-FIRMWARE-WITNESS-AUTHORITY` | none | complete; Option A, contract disposition, and catalog frozen |
| M2 | Prove pause/resume and evidence contracts in a target-independent reference model | `G3-PAUSE-RESUME-SAFETY`, `G4-EVIDENCE-PUBLICATION` | M1 | complete; eight model tests and policy checks pass |
| M3 | Integrate the shared engine, service dispatcher, journal, and publication path; build and verify bounded work | `G5-PERFORMANCE-ADMISSION` | M2 | complete; candidate `3df82f32b997022efeaba97561d7a2320dcf7997` built and packaged |
| M4 | Deploy the exact candidate to the bound development target, run focused changed-behavior/rollback checks, and register the Work2 release cohort | `G6-WORK2-DEVELOPMENT-TARGET` | M3 | blocked; replacement candidate `d22dac133a7e2f64ac3b65dd512c9e2577cc3bb9` is repository-verified and awaits fresh programming authority |

## M1 — Authority And Catalog Freeze

### Owner decision D1 — Option A selected 2026-08-31

- **A — Recommended hybrid:** firmware owns leaf-test truth, prerequisites,
  progress, safe-stop checkpoints, and technical results; the Pi/web qualifier
  owns campaign sequencing across controllers, independent power witnessing,
  evidence ingestion/admission, and reviewer/family disposition.
- **B — Firmware owns the full campaign:** simplifies offline execution but
  moves cross-controller, review, persistent evidence, and power-witness burden
  into the controller and weakens independent observation.
- **C — Pi owns the full-run order:** stays closest to the current governing
  contract but does not deliver IDEA-0001's firmware full-run service unless
  that service becomes a thin, Pi-directed leaf sequence.

The owner selected Option A. Firmware is authoritative for shared leaf-test
execution, prerequisites, progress, safe-stop checkpoints, and technical
results. The Pi/web qualifier is authoritative for cross-controller campaign
sequencing, independent power witnessing, evidence ingestion/admission, and
reviewer/family disposition. Record this split in the disposition of
`SMI-SDQ-CONTRACT-V1`. Freeze the exact 480–489 allocation only after confirming
dispatcher availability. The catalog must reuse existing CID, media
classification, scrub, lane, wrap/reclaim, recovery, endurance, export, and
mailbox mechanisms rather than create parallel test implementations.

### M1 completion evidence

- `docs/sd-card-qualification-contract.md` records selected Option A.
- `qualification/profiles/sd-qualification-service-catalog-v1.json` and
  `docs/sd-qualification-service-catalog-v1.md` freeze the 480–489 service
  allocation, seven shared leaves, ten-step order, prerequisites, safety,
  progress, stop, and result semantics.
- `script/check-sd-qualification-service.ps1` proves dispatcher completeness
  and shared individual/full-run implementation routing.
- Result: `G1-SHARED-TEST-CATALOG` and
  `G2-FIRMWARE-WITNESS-AUTHORITY` pass.

## M2 — Safety And Evidence Reference Model

- The durable journal uses the existing mirrored configuration persistence and
  binds format/state, mode, step, completion mask, run identity, firmware and
  catalog identity, and raw 128-bit CID.
- An active interruption becomes blocked and never replays automatically.
  Manual service 488 continuation is accepted only from a planned pause after
  firmware, catalog, CID, representative-sector, and media checks pass.
- Workflow, technical result, method disposition, and evidence admission are
  separate. Firmware cannot claim Pi evidence admission.
- `script/test-sd-qualification-service-model.py` passes eight tests covering
  catalog identity, shared order, external power pause, active-reset no replay,
  identity-bound manual resume, separate results, independent evidence
  admission, and bounded leaf budgets.
- Result: firmware-side `G3-PAUSE-RESUME-SAFETY` and
  `G4-EVIDENCE-PUBLICATION` contracts pass; live Pi ingestion remains M4 proof.

## M3 — Firmware Candidate

- Shared state machine, dispatcher, catalog, journal, UI safety gates, status,
  progress, and result surfaces are integrated without specimen-specific SD or
  USB production behavior.
- All new policy/model checks and the existing SD safety, scrub,
  initialization, endurance, and commissioning suites pass.
- The canonical managed clean Debug rebuild and artifact packaging passed.
- ELF SHA-256:
  `E9AF2BAF44A43FABBE58F69B0D22D6E14A34691DC955E848668C3E737E3FC08E`.
- S-record SHA-256:
  `CE2A5D2337D49CC437BFDA0C6A14BB21CD07937947AF9B6EE0DD1B4889790490`.
- Map SHA-256:
  `8A6C169C12C2F0BCA72E3769651C801045D2A71301E5E94E88A6A4B435778CC2`.
- Scoped candidate commit:
  `3df82f32b997022efeaba97561d7a2320dcf7997`; unrelated dirty work remains
  outside the commit.
- Full evidence: `docs/sd-qualification-work2-candidate-evidence-20260831.md`.
- Result: repository-side `G5-PERFORMANCE-ADMISSION` passes.

## M4 — Work2 Delivery

### Material target decision D2

The owner bound Controller A assembly `1751136`, hardware variant `0`, J-Link
`69664082`, `setup-a`, and the installed expendable card with live CID
`05000C61736466672200001C8901A34F`. The owner authorized exact candidate
`3df82f32b997022efeaba97561d7a2320dcf7997`, a predeployment 4 MiB rollback
capture, the focused 480/481/483–486/488/489-through-recovery checks, and the
qualified whole-controller interruption. Service 487, powered SD movement,
production release, and family qualification remained excluded.

Candidate deployment and independent full-flash readback passed. Services 480,
481, and 483 through 485 passed, including the negative destructive-
confirmation check. A qualified Group A power cycle then proved durable
no-replay restoration, unchanged CID, healthy raw-HPT reopen, and an underlying
controlled recovery pass. Service 488 accepted continuation only after the
expected sequence/boundary was published and all resume validations produced
mask `0x3F`.

M4 failed because service 486 remained `WAITING /
EXTERNAL_COORDINATOR_REQUIRED` after the synchronous diagnostic reached
`RECOVERY_PASSED`. The qualification poll requires prior observation of a
transient active state, but the SD thread executes the complete synchronous
recovery between its before/after qualification polls. It therefore observes
idle-before and passed-after, never sets the active-observed flag, and never
finishes the leaf. Service 489 was not started.

### Service-486 remediation candidate

Replacement candidate `d22dac133a7e2f64ac3b65dd512c9e2577cc3bb9`
binds the synchronous recovery producer's `RECOVERY_RUNNING` transition
directly to an issued controlled-recovery leaf only while that leaf is waiting
or running. The terminal poll still requires that producer-bound observation,
so stale terminal diagnostic state cannot finish a newly started leaf. The
sequence/boundary, firmware/catalog, CID, representative-sector, media-state,
manual-continuation, no-replay, and external evidence-admission gates are
unchanged.

The focused service contracts, eight model tests, SD safety, scrub,
initialization-mailbox, endurance, commissioning, and lifecycle suites pass.
The canonical managed Debug rebuild, stable/versioned packaging, and clean
firmware-bundle validation pass with these exact identities:

- ELF SHA-256:
  `A3D5EA99D6C9F5C5F61D1EA799B878282DCB789FE181682A7293954DB01178B5`;
- S-record SHA-256:
  `32281EBC258F7FCC9241FB1899DB5068AD2219B9F75CD859B32FF5FCBDF310E5`;
- map SHA-256:
  `C2A3A4F69E949F88FEBF3DB5C34856495AE3546922FDDB42FDD9F70806EE14A0`;
- clean source snapshot SHA-256:
  `66C67D32C73193796A358920AD80A2FC64B05525483AB3D0749932531F1F9DA9`;
- bundle manifest SHA-256:
  `D74AEA1DCA7DB3EB22877200A5E6B1FBE81C20ACDF7FFFAC37BE1731D0EDB477`.

Full repository-side remediation evidence is in
`docs/sd-qualification-work2-m4-remediation-candidate-evidence-20260831.md`.
No target or remote coordinator state changed while producing this candidate.

The exact predeployment 4 MiB flash capture was restored and independently
read back with matching SHA-256
`15DF631AE4C7887F22A72AFCDD95DEF96DD4D78620CAB21F76715E9433D4F214`.
Controller A is running the restored firmware and the CID remains unchanged.
The SD Qualifier ingested the immutable failed-run package at
`evidence/raw/prm-0006/m4-controller-a-20260831` without runtime, database, or
campaign mutation. Full evidence is in
`docs/sd-qualification-work2-m4-target-evidence-20260831.md`.

`G6-WORK2-DEVELOPMENT-TARGET` remains blocked. Do not register a release cohort
from the failed candidate or from repository-only replacement evidence. The
owner must explicitly authorize programming exact replacement candidate
`d22dac133a7e2f64ac3b65dd512c9e2577cc3bb9` before the focused M4 target gate
can be repeated.

## Deferred Beyond Work2

- production push, tag, release, or promotion;
- card-family qualification credit or final family disposition;
- ECR/ECO, sourcing, BOM, pilot, or rollout decisions;
- physical destructive qualification not separately authorized.
