# Project Map: SMI 00.05.02 first-format reliability

Status: active
Type: project-map
Updated: 2026-09-30
Origin: IDEA-0009
Target Release: 00.05.02
Next Action: prepare the exact 00.05.02 release package and complete publication gates; both controls passed first Format 2 from FAT32

## Purpose

Make SD initialization and commissioning succeed on the first attempt after a fresh SMI install. Preserve the exact first failure and distinguish driver I/O from invalid HPT metadata. Carry the verified fix into the shared 00.05.02 image with IDEA-0008.

## Direction

1. Reproduce or isolate the first-format sequence against v00.05.01, beginning with the provided two-controller screenshots and source trace. Keep the cause open until a failing operation or metadata invariant is observed.
2. Correct the proven common firmware defect and retain useful first-failure diagnostics. Do not add card-specific timing or unconditional retry behavior.
3. Verify format, reopen, commissioning append/readback, and failure paths with focused tests and the canonical managed build.
4. Coordinate the 00.05.02 candidate with IDEA-0008. Qualify the exact image on both affected controller/card combinations using separately authorized expendable media, CID baselines, service 468 results, and first-attempt outcomes before release.

## Current Position

v00.05.01 failed at commissioned-media reopen on the first format attempt on two controls with different cards; each second attempt worked in the same powered session. The original failing SD operation or HPT metadata check was not captured. Source tracing found that exhausted raw reads could be reported as CORRUPT and a subsequent legacy probe could erase the displayed driver error. Committed 00.05.02 diagnostics preserve the first raw error/sector, identify the open stage and lane, and classify proven read exhaustion as IO_ERROR. They do not yet establish the underlying first-attempt cause.

Commit `b7f9cd9fda8b65070b984e6137cfe0461adcfac0` passed clean managed Debug and Release rebuilds and focused commissioning checks (110/110). Immutable candidate `00.05.02-b7f9cd9fda8b-4e1a73b11a06` validates with manifest SHA-256 `DC624924690825C3EEDDC7F8B9D220ED0E5354739DDB0811C3B0EABD270FF170` and Release S-record SHA-256 `4E1A73B11A06C0026F9AAFDE37FD69E04924732BF1D8054B9C7E8F5EB7D21656`. Both affected controls were programmed, verified, reset, and independently read back; each complete 4 MiB flash matches candidate hash `A638AAA78E7CE51C2C9DE4283B3EEB188FB17EA70FA4B77E5AECA2C8F2B12AAF`. Fresh read-only CIDs, validity, and representative sector reads were captured after each reboot. The owner confirmed both installed cards expendable. CID-bound first format requests on the installed cards completed on the first observed 00.05.02 attempt, with full commissioning terminal proof and no retry. These cards were already HPT-ready at baseline following the owner's successful second attempt, so the original fresh-install failure remains unreplicated and no root-cause correction is proven. Evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md`.

The owner chose the same-card SMI-to-DisplayTest path to recreate FAT32 without SD removal. Controller A's ordinary DisplayTest update reported Success. Its full flash matches the published DisplayTest 01-01 IMX main payload; the same CID `FE34325344000000200000015B01A30B` was valid and FAT32 ready. The exact SMI 00.05.02 return IMX was built and CRC/round-trip checked; SHA-256 `E9B30A1B368C2D005252F145DB1630FF7718332CA67564605D7BC9D14ECB357E`.

The owner moved the USB drive labeled `imx` to the Windows PC. The exact 00.05.02 return IMX was copied to its root and read back with the same SHA-256; the existing DisplayTest update file also matched its published release hash. B's fresh read-only pre-transition CID and representative sector read still pass.

The owner returned `imx` to A, completed Prep for Ship with FAT32 handoff PASS, and reported successful installation of the exact return SMI image. Full A code-flash readback matches the candidate expanded image SHA-256 `A638AAA78E7CE51C2C9DE4283B3EEB188FB17EA70FA4B77E5AECA2C8F2B12AAF`. Read-only state showed FAT32, needs Format 2, unchanged valid CID, and a passing representative sector read. The first CID-bound Format 2 request from that state was acknowledged and **FAILED at commissioned-media reopen**, phase 8, HPT status CORRUPT (5), driver status zero, open failure stage DIRECTORY (6), lane 0. No retry was issued. Deep RAM evidence shows new media generation 1 but stale active segment 1, generation 2, in all three lanes, with oldest segment 0, generation 1. Reopen could not rebuild the lane directory from that mixed chain. `tc_format()` read only sector 0 for the previous generation; FAT32 overwrote that sector while old HPT segment metadata survived. Full evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md` and its `setup-a/first-fat32-*` captures.

Commit `f51d98e7ffec36a419a1564b24924a5639dfcb84` contains the generation correction. Clean managed Debug and Release rebuilds, 110 commissioning checks, and 141 write-cut states passed. Immutable candidate `00.05.02-f51d98e7ffec-b10533f2134c` validates with manifest SHA-256 `0D28D782529BBD6761F875A7D932410F877F7E6C96B3282487FEBCBFA1B997AF`. A was programmed, verified, reset, and read back; its four-MiB flash SHA-256 `7790FC400E0FC7C57372C82CFD90915136214F6047BBAA22BC7CBDDB14CB10A0` matches the controlled IMX expansion. Its CID remained valid and unchanged. A's first Format 2 request with the corrected firmware against its previously failed card **COMPLETED** at phase 11 with proof `0x0F`, HPT/driver status zero, no reopen failure, and HPT_READY detection. This initially established recovery on a card that already had one failed attempt. The corrected return IMX SHA-256 is `1CD371F93E825B9E34AFEA8175F865E9545E6F29ECA05141A3ED706F6783E9EF`.

A then completed the ordinary corrected-SMI-to-DisplayTest update on the same card. Published DisplayTest flash matched exactly and reported FAT32_READY; Prep for Ship reported FAT32 handoff PASS. The ordinary return SMI update installed the corrected image, confirmed by full target flash readback. The expected needs-Format-2 state, unchanged valid CID, and passing representative-sector read were captured before formatting. A single current-boot CID-bound Format 2 request then **COMPLETED on the first attempt**, phase 11, proof `0x0F`, HPT/driver status zero, detection HPT_READY, and unchanged valid/readable CID. Surviving prior metadata led the corrected format to choose media generation 3. No retry was issued. Full evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md` and its `setup-a/generation-fix-first-fat32-*` captures.

B's fresh old-candidate baseline remained HPT_READY with raw CID `284245323848465102A6910D080113CF`, valid CID, and passing representative-sector read. B was programmed from the corrected candidate, reset, and read back: full four-MiB flash SHA-256 `7790FC400E0FC7C57372C82CFD90915136214F6047BBAA22BC7CBDDB14CB10A0`, unchanged valid CID and readable sector, HPT_READY. B then completed the same-card ordinary DisplayTest update: published flash matched, FAT32_READY, unchanged CID. Its Lockout handoff passed, and the ordinary corrected SMI return image installed with exact full target flash readback. Before formatting, SMI showed FAT32/needs Format 2, idle initialization, unchanged valid CID, and a passing representative-sector read. A single current-boot CID-bound Format 2 request then **COMPLETED on its first attempt**, phase 11, proof `0x0F`, HPT/driver status zero, HPT_READY, and the same valid/readable CID. Its new media generation is 4. No retry was issued. Full evidence: `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/baseline.md` and linked `setup-b/generation-fix-first-fat32-*` captures. Both affected controller/card combinations now pass first-from-FAT32 on the corrected candidate.

## Dependencies And Boundaries

- Diagnostic and source work can proceed locally. Physical destructive formatting requires separate authorization and approved expendable media.
- No powered SD removal or insertion.
- Release 00.05.02 must include both this correction and IDEA-0008, with exact candidate identity and required release gates.

## Next Ground Task

The final shared candidate `00.05.02-a09c3c8bf30e-ab60c2b2295f` passed clean Debug and Release rebuilds, with all six generated artifacts matching its immutable files byte for byte. Its Release S-record SHA-256 is `AB60C2B2295FBC54E3B6E2B425BDDBB42737DB0CAA32D9E0D1673374783CC422`; the same expanded image has exact complete-flash readback on both controllers. The final 110/110 commissioning checks and local release validation profile passed. Both owning MAP cycles and IDEA parents were registered for the release cohort at Tool Shed revision 969. The owner also reran service 471 on A; post-format read-only evidence shows HPT_READY, unchanged valid/readable CID, new log records and a one-hour graph view. See `work/evidence/hpt-log-store-circular-mirror/00-05-02-preflash-20260930/release-readiness.md`.

Prepare one reviewed 00.05.02 release package and exact content commit, preserving unrelated dirty files. Keep tag, publication, and rollout behind the explicit owner authorization and exact-SHA CI gates. Preserve the bilateral first-format evidence under this map; the successful format tests alone do not prove release completion.
