repo://poppyup/docs/00-architecture-decisions.md

50 KB · 350 lines · markdown · View source · Download from the repository page

PoppyUp — Architecture Decision Record (ADR) / Source of Truth

Phase: 1 — Hardware Design Status: Baseline v0.3 (2026-09-27). All other documents in docs/ derive their numbers and part choices from this file. If a document disagrees with this file, this file wins.

v0.3 (2026-09-27): owner review of v0.2 — decisions D1–D13 applied. Change record in §15. Headlines: cellular removal confirmed; desk-operation assumption (bag = transport only); magnesium AZ91D chassis; 38 mm / CFast kept; 5GbE only; Port C Pro-only with PD sink, decoupled from Base launch; host mode read-only on both ports by default; XQD unsupported; SoM undecided (PoC bake-off incl. board-down); ODM engaged; fan decision at EVT exit.

v0.2 (2026-09-27): the built-in 5G cellular modem is removed from the hardware. Rationale and consequences are in §14.

This file exists so that every deliverable (requirements, block diagram, power budget, BOM, mechanical, etc.) uses one consistent set of decisions. It is deliberately terse; rationale and alternatives live in the topic documents.

1. Product summary (one paragraph)

PoppyUp is a battery-powered, ruggedized (MIL-STD-810H 1.22 m drop, IP54 shutter-closed) field device, 190 × 96 × 38 mm, ~830 g (magnesium chassis), that accepts professional camera media on its top edge (CFexpress Type B, CFexpress Type A, SD UHS-II, microSD, CFast 2.0) under a sliding aluminum shutter, mounts the cards read-only, and streams their contents directly to SFTP / S3-compatible / Google Drive / Dropbox endpoints over 5GBASE-T Ethernet or Wi-Fi 7, with automatic link selection and resumable, checksummed transfers. There is no built-in cellular modem: away from wired or Wi-Fi infrastructure the device uploads through the user's phone (Wi-Fi hotspot, or USB tethering on Port B) or through an off-the-shelf USB LTE/5G adapter on Port B. Plugged into a Mac/PC/iPad/iPhone it becomes a driverless, read-only-by-default card reader (two host paths, see §4). An optional internal M.2 NVMe provides buffering / quick-copy on a higher SKU.

Operating assumption (v0.3, D2). PoppyUp operates on a desk or table (studio, venue, hotel, vehicle). A bag is for transport only; the device is not expected to operate inside a closed bag. The rugged targets (MIL-STD-810H drop, IP54 shutter-closed) are unchanged because they cover transport. Thermal design, runtime claims and the throttling ladder assume free-air desk operation, either lying flat or standing on its bottom edge; a thermal safety rule (§3.5) protects the device if it is packed away mid-job.

2. Key numbers (targets)

Item	Target
External dimensions	190 × 96 × 38 mm (L × W × T), ±3 mm — final (D3). 38 mm is set by the 21 mm 21700 cell stacked in front of the main board plus a uniform 6.5 mm rear-face component budget (see `08-mechanical.md` §3). The tallest rear-face part is the SoM/NVMe stack (~4.5–4.7 mm); the ~2 mm slack goes to SoM boss height and thicker gap pads. CFast slot kept; no dimensional change to the drawings.
Weight	850 g target; bottom-up ~828 g with the AZ91D magnesium die-cast chassis (1.6 mm walls) — production and prototypes (D4). Machined AZ31B EVT/DVT chassis ≈ 830–840 g (verify). Aluminum would have been ~935 g and is no longer planned.
Battery	4 × 21700 Li-ion NMC, 2S2P, 7.2 V nominal, 10 Ah, 72 Wh nominal (≤100 Wh airline limit)
Usable energy for runtime calcs	65 Wh (90 % of nominal)
Charging input	USB-C PD 3.1 sink, 5–20 V, up to 65 W (100 W tolerated), buck-boost NVDC charger
Charge time	0→80 % ≈ 1.6 h, 0→100 % ≈ 2.3 h from a 65 W source
Drop	MIL-STD-810H Method 516.8 Proc. IV, 1.22 m onto concrete, 26 drops, functional after
Ingress	IP54 with shutter closed and port door closed; IP52 shutter open
Operating temp	−10 °C to +40 °C full performance; −20 °C to +50 °C with throttling; charge 0–45 °C
Skin temperature limit	48 °C on metal, 55 °C on plastic (throttle trigger); thermal safety rule at 52 °C skin / 60 °C internal air / component limits: checkpoint all jobs → standby → auto-resume (§3.5). Charging current derates at skin > 42 °C. Light matte finish (solar load) — see §8 coating.
Sustained thermal dissipation (passive, magnesium chassis, desk, free air)	Shutter closed: ~10.0 W at 25 °C ambient, ~5.7 W at 35 °C. Shutter open (slats parked over the top band of the rear face): ~9.5 W / ~5.4 W. Model: A ≈ 0.056 m², h ≈ 9 W/m²·K, ribs, 0.80 spreading-uniformity factor for AZ91D (k ≈ 72 W/m·K vs ~96 for die-cast Al) → G ≈ 0.44 W/K closed / 0.41 W/K open (verify at EVT on magnesium units, `06-thermal.md` §3). v0.2 aluminum figures were ~10.6 / ~6.0 W. Per-mode ambient ceilings are in §6.2.
5GbE upload burst before throttling (effective thermal mass ≈ 500 J/K: Mg chassis 143 g casting per `08-mechanical.md` §2.2, ~170 g incl. inserts/bosses as counted in `06-thermal.md` §4 → ~150–175 J/K, plus PCBs, frame and pack fractions)	~17 min from 25 °C ambient, ~9 min from 35 °C (verify); one 512 GB card at ~500 MB/s ≈ 15–17 min. Cool-down time constant ≈ 19 min.
Shutter cycle life	10,000 open/close cycles
Card slot insertion life	10,000 (CFe B/A), 10,000 (SD), 5,000 (CFast, connector-limited)
Ethernet	5GBASE-T only (RTL8126; NBASE-T 5G/2.5G/1G/100M auto-negotiation) — final (D6). No 10GbE footprint or watch item.
Wi-Fi	Wi-Fi 7 (802.11be) 2×2, 2.4/5/6 GHz, 160 MHz; STA + AP concurrent (same channel)
Cellular	None built in — confirmed final (D1); no reinstatement provisions. Cellular reach via (a) Wi-Fi STA to a phone hotspot, (b) USB tethering of an iPhone/Android phone on Port B (`ipheth`, `cdc_ncm`/`rndis_host`), or (c) a USB LTE/5G adapter on Port B (`cdc_mbim`/`qmi_wwan` or hotspot-class NCM/RNDIS). Port B sources 5 V at 0.5 / 1.5 (default) / 3 A to charge the phone; 3 A only while PoppyUp itself has external PD power (D13), EC-enforced. Firmware feature; no hardware beyond Port B.
BLE	Bluetooth 5.4 LE via the always-on embedded controller (nRF5340), not via the Wi-Fi module
Host reader speed (USB4 path, CFe B only, Pro SKU)	≥ 2.8 GB/s to USB4 host; ≥ 900 MB/s to USB 3.2 Gen2 host (iPhone Pro). Read-only by default (D8).
Host reader speed (universal gadget path, all slots)	≥ 380 MB/s (USB 3.2 Gen1, 5 Gbps). Sufficient for app-driven cloud upload through the host, whose internet link is the bottleneck (D7). Read-only by default (D8).
Job geotagging	No GNSS receiver (D13). The iPhone app sends the phone's location over BLE (GATT "Job Location" characteristic on the EC) or over the Wi-Fi/NCM management API at job start or on request; stored in job metadata and written to the upload manifest / sidecar.
Standalone card read rate (internal)	CFe B ≥ 1.6 GB/s (Gen3 ×2), CFe A ≥ 850 MB/s (Gen3 ×1), SD UHS-II ≥ 280 MB/s, CFast ≥ 480 MB/s (SATA III / card-limited; ASM1064 sits on a Gen3 ×1 switch port), microSD ≥ 90 MB/s
Upload throughput target (Ethernet 5GbE)	≥ 480 MB/s sustained to S3 with TLS + per-part checksum

3. Compute & PCIe/USB topology (final)

3.1 SoC

Rockchip RK3588 (industrial RK3588J variant preferred). Carrier form undecided (D12) — decided at PoC exit between three paths, all evaluated at PoC (13-roadmap.md §1):

Firefly Core-3588J SoM (8 GB LPDDR4x, 64 GB eMMC, −40…85 °C, exposes all 4 Gen3 + 3 Gen2 PCIe lanes, both USB3 OTG) — v0.2 default.
Forlinx FET3588-C SoM (pin-incompatible with Firefly; carrier respin ~3 weeks).
Board-down RK3588J on the main board using the ODM's RK3588 reference design, if they have one (removes the SoM connector stack from the Z-budget and the single-vendor SoM risk; adds DDR/PMIC layout, PMIC/DDR sourcing and RK boot-firmware work to the ODM).

PoC comparison criteria: pcie3x4 ×2+×2 bifurcation and exposure of all 7 lanes; both USB3 OTG with dwc3 gadget (UAS/BOT to iOS/macOS); thermal interface (SoC top height, boss geometry, measured ΔT at 8 W); longevity and EOL terms in writing (≥ 5 years); price at 1 k / 10 k; second-source / pin-compatibility story; ODM's ability to support the path.
Turing Machines RK1 is a dev-kit convenience for PoC only.
Memory 8 GB LPDDR4x; storage 64 GB eMMC (OS A/B + job DB + logs).
Runners-up: NXP i.MX 95 (best longevity, too few Gen3 lanes: 2× Gen3 ×1), Qualcomm QCS6490 (ecosystem gating, lane budget), Intel N100 (power, no USB device mode), Raspberry Pi CM5 (single PCIe lane — rejected outright).

3.2 PCIe lane map (RK3588 has 4 × Gen3 lanes shared by two controllers `pcie3x4` / `pcie3x2`, plus 3 × Gen2 ×1 combo lanes)

RK3588 port	Width / gen	Goes to	Notes
`pcie3x4` (bifurcated)	Gen3 ×2	CFexpress Type B slot, via Diodes PI3DBS16412 (Gen4-rated 2:1 ×2 mux)	Dedicated root port for the top-priority slot. Mux "A" side = SoC. Mux "B" side = ASM2464PD (USB4 bridge). REFCLK muxed alongside; PERST#/CLKREQ# controlled by the EC.
`pcie3x2`	Gen3 ×2	ASMedia ASM2812 PCIe Gen3 packet switch (×2 upstream as wired, up to 12 downstream lanes)	Fallback switch if ASMedia access is a problem: Broadcom PEX8724 (hotter, public docs)
ASM2812 downstream	×1 Gen3	CFexpress Type A slot (card is NVMe)
ASM2812 downstream	×2 Gen3	Optional M.2 2280 M-key NVMe (unpopulated on base SKU)
ASM2812 downstream	×1 Gen3	Realtek RTL8126 5GbE MAC/PHY → RJ45
ASM2812 downstream	×1 Gen3	Genesys GL9755 SD UHS-II host controller (SD slot)	mainline `sdhci-pci-gli`
ASM2812 downstream	×1 Gen3	Genesys GL9750 SD UHS-I host controller (microSD slot)
ASM2812 downstream	×1 Gen3	ASMedia ASM1064 AHCI SATA controller → CFast 2.0 slot
ASM2812 downstream	×2 Gen3	ASMedia ASM3142 xHCI → USB 3.2 Gen2 (10 Gbps) host → Port B "SSD / TETHER"	External SSD ingest at ~900 MB/s; also the USB host port for phone tethering / USB cellular adapters
`pcie2x1l0`	Gen2 ×1	Spare (test header / future daughterboard). v0.1: 5G modem M.2 Key-B slot — removed.
`pcie2x1l1`	Gen2 ×1	Wi-Fi 7 M.2 Key-E 2230 slot (MediaTek MT7925 module)	BT lines wired to SoC USB 2.0 but unused (BLE is on the EC)
`pcie2x1l2`	Gen2 ×1	Spare (test header / future daughterboard)

Total ASM2812 downstream lanes used: 1+2+1+1+1+1+2 = 9 of 12.

3.3 USB map

SoC / chip port	Role	Physical port
RK3588 USB3 OTG1 (dwc3, 5 Gbps)	UFP device (gadget): composite UAS/BOT mass-storage LUNs (one per card) + CDC-NCM management network	Port A "PD / PHONE" USB-C
RK3588 USB3 OTG0 (5 Gbps)	Spare (test header)	—
ASM3142 (10 Gbps)	Host: external SSD, USB-tethered phone, USB cellular adapter	Port B "SSD / TETHER" USB-C, 5 V/3 A source
ASMedia ASM2464PD (USB4 40 Gbps ↔ PCIe Gen4 ×4 bridge; falls back to USB 3.2 Gen2 UAS NVMe bridge)	Device	Port C "USB4 / CFexpress FAST" USB-C
RK3588 USB2 host ×2	Wi-Fi module BT (unused); spare (test header). v0.1: one was the modem fallback/AT channel.	internal

3.4 Physical ports (all on the bottom short end unless noted)

Port A: USB-C, PD sink (charging) + gadget + management. Also PD Source 5 V/1.5 A to top-up a connected phone (PR_Swap, optional feature).
Port B: USB-C, USB 3.2 Gen2 host for external SSDs, USB-tethered phones and USB cellular adapters; 5 V/3 A source.
Port C: USB-C, USB4 device (CFexpress B pass-through). Pro SKU only; depopulated on the Base SKU (receptacle fitted, blanked) — final (D7). PD sink on Port C (D7 / former Q17: yes, Pro only): a third TPS25750 PD controller and a TPS2121-class priority power mux OR the Port C VBUS into the BQ25792 charger input, Port A having priority, so a connected Mac (typically 15 W, 5 V/3 A; PD up to the host's advertised contract) powers the device during long reader sessions. One PD entity owns Port C's CC lines: the external TPS25750 (sink role), with the ASM2464PD's integrated PD block left passive/disabled (verify with the ASMedia team; ASM2464PD reference designs pair it with an external PD controller). Base SKU depopulates the Port C PD controller and mux with the ASM2464PD.
RJ45 5GBASE-T behind a hinged silicone door.
USB-C receptacles are IP67-rated sealed mid-mount parts; no doors.
No SIM tray (removed in v0.2): the enclosure penetrations are the three USB-C receptacles, the RJ45 door, the button, the reset pinhole and the vent membrane.

3.5 Embedded controller (EC)

Nordic nRF5340 — always-on, ~50 mW. Duties: power sequencing, power button, fuel gauge & charger supervision, thermal sensors and throttle requests, PCIe mux/reset sequencing for mode switching, LED bar, OLED (so the display works while the SoC is off), Hall sensor (shutter state), card-detect wake, RTC, SoC watchdog/hard reset, BLE 5.4 provisioning & control link, secure boot via MCUboot. Added in v0.3:

Thermal safety rule (D2, firmware only): if skin ≥ 52 °C, internal air ≥ 60 °C, battery ≥ 55 °C or any component limit is crossed (e.g. shutter closed mid-job and packed away), the EC requests the job engine to checkpoint every job (finish the current part, record offsets), the SoC unmounts and powers down slots and radios, and the device enters standby with the OLED showing "Too hot — paused, will resume". The EC keeps sampling and wakes the SoC to resume automatically when skin ≤ 42 °C and internal air ≤ 45 °C, provided the link and cards are still present; the app is notified over BLE. An independent mechanical thermal switch (60 °C class, chassis inner wall near the SoM boss, asserting THERM_ALERT to the EC and cutting charging) remains as the firmware-independent backstop — re-rated from v0.1's 48 °C, which would trip in normal operation now that 48 °C is the skin throttle cap (placement and rating verify at EVT).
Job Location GATT characteristic (D13): the app writes latitude, longitude, altitude, horizontal accuracy, timestamp and source (vendor UUID, write-with-response, encrypted/bonded link); the EC forwards it to the SoC job DB. The same payload is accepted on the NCM management API when a host is attached.
Port B charge-current policy (D13): the EC caps the Port B tether supply at 1.5 A on battery and permits 3 A only while a PD source with a contract of ≥ 45 W is present on Port A (or Port C on the Pro SKU) — a 15 W Mac on Port C does not qualify, since it cannot carry the device plus a 15 W phone charge; 0.5 A remains user-selectable.

3.6 Security silicon

Infineon OPTIGA TPM SLB9672 (SPI, TPM 2.0) for sealing the LUKS2 data-partition key to boot state, device identity key (ECC P-256), and OTA signature verification anchor.
RK3588 secure boot: OTP-fused root-of-trust hash → signed SPL/TF-A/OP-TEE → FIT-verified U-Boot/kernel → dm-verity root (A/B, RAUC) → LUKS2 data.
Alternative SE: NXP EdgeLock SE050 (if EAL6+ certification or pre-provisioned keys are needed).

3.7 Display & indicators

2.42" monochrome OLED, 128 × 64, SSD1309, SPI, driven by the EC (not e-paper: e-paper's 0 °C operating floor, slow refresh and glass fragility; not memory-LCD: poor dark-set readability without frontlight). Auto-dim/off after 30 s to avoid burn-in.
5-segment RGB LED bar along the front top edge (per-slot state + link/battery), visible with shutter closed.
One sealed power/action button; one recessed reset.

4. Operating modes and mode switching (final)

4.1 Standalone mode (default)

All slots mount read-only (ro,noload-style; never write, never fix dirty bits). Job engine streams file → chunk → hash → TLS → endpoint with no intermediate copy. NVMe (if present) is used only when the network is down or "quick copy" is requested.

4.2 Host-connected mode — two physical paths

Path 1 — Port C "USB4 FAST" (CFexpress B only, Pro SKU): Cable attach on Port C → EC notifies SoC → job engine checkpoints the CFe B job (finishes current part, records offset), unmounts, powers down slot → EC asserts PERST#, flips PI3DBS16412 + REFCLK mux to ASM2464PD, restores power → host enumerates the card as a native NVMe device (USB4/TB hosts, ~3 GB/s) or as a UAS NVMe bridge (USB 3.2 Gen2 hosts such as iPhone 15/16/17 Pro, ~900 MB/s). Other slots keep uploading. Detach → reverse → SoC rescans PCIe → job engine re-verifies card identity (controller serial + FS UUID + directory mtime scan) → resumes.

Read-only by default on Port C (D8). Source media must never be modified unless the user explicitly allows it; macOS silently writes .Spotlight-V100, .fseventsd, .Trashes and ._* files to any writable volume. Enforcement options, in order of preference (details and what the host sees in each: 02-system-architecture.md §4.x, 04-component-selection.md §(e)):

NVMe Namespace Write Protection (NVMe 1.4 Feature 0x84): before flipping the mux, the SoC — which owns the card at that moment — sets the namespace to Write Protect (state 1, cleared only by another Set Features, which macOS/iOS generic NVMe drivers never issue). The host mounts the volume read-only. Works in both native-USB4 and UAS-fallback modes, but only on cards whose controller reports NWPC support (Identify Controller byte 531) — expected to be a minority of camera cards (verify per card at PoC). Because the mode switch power-cycles the slot, the "until power cycle" state (2) is not usable; state 1 is. Side effects: state 1 persists across power cycles by design, so the SoC clears it on return; a card pulled from the slot during a Port C session leaves write-protected and will refuse camera writes until re-inserted in PoppyUp (or any NVMe host that clears it) — the OLED warns before the card is ejected and the device clears it on re-insertion. For non-NWPC cards the device must know whether the host is native USB4 or UAS fallback before choosing between options 2 and 3, so the ASM2464PD is powered and enumerates on Port C before the mux flips (reverses the v0.2 sequence for that case; PoC verify item).
ASM2464PD bridge write-protect (UAS/BOT fallback mode only, i.e. iPhone and USB 3.2 hosts): the bridge's SCSI Mode Sense WP bit / a firmware read-only configuration, if ASMedia's firmware tool exposes it (verify with the ASMedia-access team, 12-risks-open-questions.md). Has no effect in native USB4/PCIe-tunnelled mode, where the host talks to the card directly and no bridge logic is in the data path.
Fallback when neither applies (native USB4 host + card without NWPC): read-only cannot be enforced by hardware or firmware. The device then does not switch to pass-through automatically: the OLED and app show "Mac wants write access to CFe B — allow?"; the user confirms per session (button hold or app toggle), the session is logged, and on return the job engine re-verifies the card (identity + full directory/mtime scan) and reports any changed or added files. This satisfies the requirement that media is only ever modified with explicit user consent. Tracked as a risk (Port C read-only enforcement). The app toggle to enable writes (RW session) exists on both paths; default is RO.

Path 2 — Port A "PHONE" (all slots, all SKUs): Cable attach on Port A with a USB host → SoC exposes every inserted card as a read-only UAS/BOT LUN (SCSI WP bit set; the host mounts read-only) + a CDC-NCM management network interface. Writes are enabled only by an explicit app toggle for the session (D8). In-progress uploads are paused (checkpointed) for the duration — final (D9); concurrent read-only sharing is technically safe and remains an opt-in app setting. iPhone: PD sink disabled (0 mA drawn); optional 5 V source to the phone.

4.3 Tethered-uplink mode (Port B, all SKUs)

A phone (iPhone Personal Hotspot over USB, Android USB tethering) or a USB cellular adapter attached to Port B enumerates as a USB network class device on the ASM3142 host controller and becomes an uplink candidate in the link policy (§5). The job engine treats it exactly like a metered Wi-Fi hotspot: per-link caps, data-cap warnings and adaptive chunk size apply. Port B sources 5 V at a user-set 0.5 / 1.5 (default) / 3 A so the phone is charged, not drained, while tethered; the EC allows 3 A only while PoppyUp has an external PD contract of ≥ 45 W (D13) — on battery, or on a 15 W Mac, the cap is 1.5 A regardless of the setting, so the 3 A case is never a battery-runtime case. Port B cannot ingest an external SSD at the same time (single receptacle); the OLED says so.

4.4 What the user sees

OLED line 1: mode ("UPLOADING", "UPLOADING via iPhone", "READER: iPhone (RO)", "READER: USB4 Mac (RO)", "Too hot — paused, will resume"); line 2–4: per-slot progress/status; LED bar: per-slot colors (blue = reader mode, green pulsing = uploading, solid green = done/verified, amber = paused/waiting for link, red = error). App mirrors this.

5. Networking (final)

Ethernet: RTL8126 5GBASE-T only (PCIe Gen3 ×1, r8169 mainline) — final (D6). 10GBASE-T (Marvell AQC113C, Realtek RTL8127) rejected: +2–4 W PHY dissipation in a sealed passive enclosure and marginal real-world benefit; no 10GbE footprint option is carried.
Wi-Fi/BT: MediaTek MT7925 M.2 E-key module (e.g. AzureWave AW-XB591NF), mt7925e mainline, STA+AP concurrent. Alternates: Qualcomm QCNCM865 (ath12k), Intel BE200 (STA-only in practice).
Cellular: no built-in modem (removed v0.2; see §14). Cellular reach = phone hotspot over Wi-Fi STA, USB-tethered phone on Port B (ipheth for iPhone, cdc_ncm/rndis_host for Android), or a USB LTE/5G adapter on Port B (cdc_mbim/qmi_wwan; hotspot-class adapters appear as NCM/RNDIS). The phone or adapter carries its own FCC/PTCRB/carrier certification; PoppyUp carries none.
Link policy: Ethernet > Wi-Fi STA > USB tether by default (user-configurable); each link is tagged metered/unmetered (hotspots and tethers default to metered); per-link caps, data-cap warnings; multi-link bonding is a firmware-phase option, not a hardware dependency.

6. Power tree (final)

Pack: 2S2P 21700 (Samsung INR21700-50E / LG M50LT / Molicel P45B class), pack PCB with TI BQ40Z50-R2 gauge+protector (Impedance Track → SOH, cycle count, runtime), secondary protector (BQ294xx), fuse, NTCs.
Charger: TI BQ25792 buck-boost NVDC 1–4S charger (5 A) with TI TPS25750 USB-PD controller on Port A (I²C-linked). Port B: TPS25750 as 5 V source-only controller. Port C (Pro SKU, D7): TPS25750 PD sink controller + TPS2121-class priority power mux ORing Port C VBUS with Port A VBUS into the BQ25792 input; Port A has priority, break-before-make, 5–20 V, ≤ 3.25 A (verify mux rating at 20 V/65 W); depopulated on Base with the ASM2464PD. When only a Mac is attached on Port C the device sinks what the Mac offers (typically 15 W) and the NVDC charger supplements from the battery as needed.
Rails: VSYS (6–8.4 V) → 5.0 V/6 A SYS (SoM, Port A 5 V/1.5 A source, OLED), 5.0 V/3 A PORT B (dedicated buck, TPS62933 class, through the Port B eFuse; EC sets the 0.5/1.5/3 A limit and can cut it for the low-battery and thermal ladders — a single 6 A rail would see a 6.1 A coincident peak and couple phone charge-current steps into the SoM rail, see 05-power-budget.md §3.3), 3.3 V/4 A card-slot rail with per-slot eFuses (TPS2596-class), 3.3 V/4 A logic (switch, controllers, Wi-Fi, Ethernet; Pro-SKU peak ≈ 3.1 A), local 1.05/1.2/1.8 V bucks/LDOs, always-on 3.3 V LDO for EC (~50 mW). The v0.1 dedicated 3.3–3.6 V/5 A modem rail is deleted.
Hold-up: battery is always in circuit (non-removable); bulk caps ride the PD-unplug transient; graceful shutdown starts at 5 % SoC, EC hard-off at 3 %, cell UVLO 2.8 V.
Peak system draw (realistic coincident peak: SoM 8 W + CFe B 5 W + Port B 15 W) ≈ 28 W for ms (v0.1: ~40 W with the modem burst) → ~5 A pack, 2.5 A per cell. The arithmetic sum of every §6.1 peak is ~55 W and is not a design case.

6.1 Component power table (W) used by all documents

Component	Off / power-gated	Idle	Typical active	Peak
RK3588 SoM (SoC+DDR+eMMC+PMIC)	0 (standby: EC only)	1.8	3.0 (≤ 10 MB/s hotspot/tethered upload) / 5.5 (5GbE TLS upload)	8.0
ASM2812 switch	0	0.5 (ASPM)	1.8	2.2
PI3DBS16412 mux + clock mux	—	0.05	0.05	0.05
ASM2464PD USB4 bridge	0 (powered only when Port C attached)	0.5	2.0	2.5
ASM3142 USB host ctrl	—	0.1	0.8	1.0
GL9755 / GL9750 / ASM1064 (each)	—	0.1	0.4 / 0.3 / 0.6	0.7
CFexpress B card	0 (slot power-gated)	0.6	3.0 (seq read)	5.0
CFexpress A card	0	0.4	1.8	3.0
SD UHS-II card	0	0.1	0.8	1.2
microSD card	0	0.05	0.3	0.5
CFast 2.0 card	0	0.3	2.0	3.0
RTL8126 5GbE	0.2 (link down)	0.7 (1GbE) / 1.2 (2.5GbE)	1.9 (5GbE link)	2.2
MT7925 Wi-Fi 7	0.05	0.3 (STA idle)	1.0 (TX at ≤ 10 MB/s) / 1.8 (TX at 80 MB/s) / 2.2 (AP+STA)	2.5
Port B VBUS to tethered phone (user-set limit)	0	—	7.5 (5 V × 1.5 A)	15 (5 V × 3 A, only with external PD present)
Port B VBUS to a USB LTE/5G adapter (instead of a phone)	0	0.5	2–4	5
NVMe SSD (optional)	0	0.3	4.0 (write)	6.0
EC nRF5340 + OLED + LED bar	0.05 (BLE adv.)	0.15 (OLED on)	0.2	0.4
TPM, sensors, misc	—	0.1	0.1	0.1
DC/DC conversion efficiency	—	85 % (light)	88 %	90 %

6.2 Mode power & runtime (battery draw = Σ loads ÷ 0.88; usable 65 Wh) and passive thermal ceiling (Mg chassis, desk, free air)

"Heat" is the in-device dissipation (battery draw, minus power exported to a tethered phone). "Ceiling" is the highest ambient at which that heat holds the skin ≤ 48 °C passively, shutter closed / open (G ≈ 0.44 / 0.41 W/K, 06-thermal.md §3; all (verify) at EVT on magnesium units). "Burst" = exceeds the ceiling at any realistic ambient and relies on thermal mass then throttling.

Mode	Σ loads (W)	Battery draw (W)	Runtime (h)	Heat in device (W)	Passive ceiling, ambient °C (closed / open)
Ethernet upload, 5GbE, CFe B ~500 MB/s	13.1	14.9	4.4	14.9	burst: ~17 min from 25 °C, ~9 min from 35 °C, then 2.5GbE
Ethernet upload, 1GbE venue (~110 MB/s)	9.2	10.5	6.2	10.5	24 / 23
Wi-Fi upload (~80 MB/s)	8.9	10.1	6.5	10.1	25 / 24
Wi-Fi upload via phone hotspot (~10 MB/s, phone's cellular uplink limits; phone on its own battery)	6.9	7.8	8.3	7.8	30 / 29
Upload via USB-tethered phone on Port B (~10 MB/s), phone charged at 1.5 A (battery default)	14.1	16.0	4.1	~7.9 (7.5 W is exported to the phone)	30 / 29
Host mode, USB4 path (CFe B → Mac, ~3 GB/s), radios asleep	9.0	10.2	6.4 (Mac PD on Port C: indefinite, Pro)	10.2	25 / 23
Host mode, gadget path (→ iPhone, ~400 MB/s), radios asleep	7.7	8.7	7.5	8.7	28 / 27
Host mode Port C while other slots keep uploading over 5GbE (worst combined)	~17.5	~20	3.3	~20	burst
Idle awake (Wi-Fi associated, OLED on)	3.3	3.75	17	3.8	39 / 39
Standby (SoC off, EC + BLE advertising)	0.09	0.1	~600 (≈3 weeks incl. self-discharge)	0.1	—
Quick copy CFe B → NVMe (NVMe SKU)	13.0	14.8	4.4	14.8	burst

Tethered-phone row with phone charging at 0.5 A: Σ 9.1 W, 10.3 W, 6.3 h. The 3 A setting is only available with external PD present and is therefore not a battery-runtime case. Reading the ceilings: on a 25 °C desk every mode except the two Ethernet/NVMe bursts runs indefinitely; Wi-Fi at 80 MB/s and the USB4 reader are marginal at 25 °C and will throttle on a warm (≥ ~26 °C) desk — this is the case the EVT-exit fan gate (§12, D5) decides on. The v0.2 aluminum ceilings were ~1–2 K higher.

7. Card slots & reader daughterboard (final)

Top edge, left→right (viewed from front): CFast 2.0 | CFexpress B | CFexpress A | SD UHS-II | microSD. Slot widths incl. housing: 45 / 40 / 22 / 27 / 13 mm; 4 mm gaps; row length ≈ 163 mm; shutter plate 170 mm; leaves 10 mm at each end of the 190 mm top edge for the shutter rail grooves and drain exits in the end caps (these zones no longer need to be RF-transparent — v0.1 used them for the cellular antennas). All push-push connectors are specified as "deep-insertion" so inserted cards sit ≥ 1 mm below the shutter plane (top-edge recess 6 mm; the SD UHS-II slot needs a deep-insertion connector or a locally deeper 8 mm recess).

XQD: physically compatible with the CFe B slot, but XQD uses a proprietary (non-NVMe) PCIe protocol with no Linux driver. Not supported, not marketed, no licensing and no USB-reader workaround — final (D10). The only XQD-related behaviour that remains is firmware detecting a non-NVMe PCIe device in the CFe B slot and showing "XQD not supported". XQD appears in no supported-media list, spec table or product copy.
SD Express / UHS-III: not supported (UHS-III has no cards; SD Express has negligible camera adoption). SD Express cards fall back to UHS-I in our slot. Footprint-compatible upgrade path: GL9767 (SD Express + UHS-I) or a future dual controller.
Reader board is an internal daughterboard (not user-swappable) on a Samtec ADM6/ADF6 0.635 mm mezzanine pair (80 pins: CFe B Gen3 ×2 + REFCLK, CFe A Gen3 ×1, three Gen3 ×1 lanes for GL9755/GL9750/ASM1064, PERST#/CLKREQ#/WAKE#, I²C, card-detect, 3.3 V slot power ≥ 6 A; see 09-pcb-architecture.md) so a no-CFast (150 mm) variant or a dual-CFe-B variant is a board swap, not a re-spin of the main board.
Per-slot: eFuse/load switch with current limit, card-detect to EC (wake), thermal pad from CFe B cage to chassis.

8. Mechanical (final)

Architecture: internal magnesium chassis-heatsink forming the rear and bottom skins — AZ91D hot-chamber die-cast at production, machined AZ31B (or thixomolded AZ91D if faster/cheaper) for EVT/DVT so thermal data reflects production (D4), PC+30 % GF front frame carrying the Wi-Fi RF window band and lens, TPU Shore 80A overmold bumpers at corners and edges. The end caps are part of the frame moulding; with no cellular antennas they carry only the shutter rail grooves and drains, and a magnesium end-cap variant (part of the chassis, for drop stiffness) is an EVT option.
- Material data (verify against supplier datasheets): AZ91D k ≈ 72 W/m·K, cp ≈ 1.02 J/g·K, ρ 1.81 g/cm³; AZ31B (machined prototypes) k ≈ 96 W/m·K — ~30 % better than production AZ91D, so EVT thermal results on AZ31B must be corrected (or DVT must use AZ91D thixomolded / T0 die-cast shots) before the fan gate is called.
- Castability (D4.6): walls 1.6 mm (AZ91D casts to ~1.0–1.2 mm; 1.6 kept for drop), draft ≥ 1° (1.5° on deep walls), ribs 1.2 mm thick × ≤ 3× wall tall with R0.5 root fillets, bosses ≥ 2.5 mm wall with R0.5–1.0 fillets, thermal boss faces machined after casting to 0.10 mm flatness, no undercuts in the rear skin; aluminum or zinc-nickel-coated wire-thread / press-in inserts for all threads (no tapped Mg, no stainless helicoils). 08-mechanical.md §4 carries the DFM list.
- Coating system (D4.3): chromate-free conversion coat over the whole casting (Gardobond X 4707 / Alodine 5200 class, ~1 µm, thermally negligible) + light matte grey powder coat or e-coat 40–60 µm on all external surfaces (solar load, ε ≈ 0.9). Masked bare-conversion pads at the SoM/ASM2812/RTL8126 gap-pad bosses and EMI-gasket lands (a 60 µm organic coat under an 8 W boss would add ~5 K, verify); POM shutter tracks are separate mouldings so no coating requirement there. Alternate for a later salt-fog/marine claim: plasma electrolytic oxidation (Keronite/Tagnite class, 15–25 µm ceramic) under the same top-coat.
- Galvanic isolation (D4.3): magnesium is anodic to everything else in the assembly. Fasteners: zinc-nickel-plated steel or 5056/6061 aluminum screws with aluminum washers in coated pockets; stainless helicoils avoided — use aluminum or zinc-nickel-coated inserts; stainless detent balls and springs sit in POM housings (no Mg contact); the hard-anodized aluminum shutter slats never touch the chassis (POM tracks, silicone seals); conductive EMI gasket contacts only masked conversion-coated lands (verify contact resistance and 500 h neutral salt fog on coupons at EVT).
Shutter: two-slat articulated slider — 2 × (2.0 mm hard-anodized 6061 slats, 20 × 170 mm) on a full-length hinge pin, slides front→rear over the top edge and turns an R14 corner into a POM T-track pocket on the rear face (travel ≈ 36 mm). A single rigid plate cannot turn the corner and would cantilever behind the device when parked. Pins run in two POM (acetal) T-tracks with stainless ball-spring detents at both ends, N52 magnets + Hall sensor for closed detection, silicone wiper lip seal and brush seals at rail ends, drainage channels. IP54 achieved only when closed.
Battery pack is user-replaceable-by-service behind a screw-down door (EU Battery Regulation 2023/1542 portable-battery replaceability, applicable from Feb 2027).
Antennas: 2× Wi-Fi 2.4/5/6 GHz flex in the front PC frame's upper band, one on either side of the centred OLED (centres ~118 mm apart) — not the rear face, which is the magnesium heat spreader and hosts the shutter pocket; 1× BLE chip antenna on EC behind a PC window. All behind PC/TPU (no metal) windows. v0.1's 4× cellular end-cap antennas are deleted.
Cooling: passive for EVT (D5); the sealed tunnel-fan envelope stays reserved in the chassis and PC frame. Fan design-in for DVT is decided at the EVT-exit gate (§12).
Shutter: the two-slat roll-top is approved unchanged (D11); when open, the slats park over the top ~40 mm of the rear face and reduce passive conductance ~5–7 % (§2, 06-thermal.md §3.4).
Internal layout (side section, front→rear): battery pack occupies the front half of the thickness (cool side, behind the PC front frame), main board lies against the rear magnesium skin (heat path: SoM, switch, Ethernet PHY thermal-padded to masked bosses). In the height direction (front view): top ~40 mm band = reader daughterboard + slots; middle = main board with the two M.2 slots (Wi-Fi 2230, NVMe 2280); bottom ~30 mm band = ports and PD/charger section.

9. PCB set (final)

Main board — 10-layer, hybrid stackup (low-loss laminate e.g. Panasonic Megtron 6 / Isola I-Speed on the USB4 + Gen4 mux layers), ~165 × 80 mm: SoM connectors, ASM2812, RTL8126 + magnetics, M.2 Key-E (Wi-Fi), M.2 M-key (NVMe), ASM2464PD + PI3DBS16412, ASM3142, PD controllers ×3 (Port C's + TPS2121-class VBUS priority mux populated on Pro only), charger BQ25792, all bucks, TPM, EC nRF5340, OLED/LED connectors, USB-C ×3, RJ45. The ~30 × 52 mm area freed by the v0.1 M.2 Key-B modem slot is used to spread the power section and bulk capacitance; board outline unchanged in v0.2 (shrink is an EVT option).
Reader daughterboard — 8-layer, ~172 × 38 mm: 5 card connectors, GL9755, GL9750, ASM1064, eFuses, card-detect, Hall sensor, LED bar; mezzanine to main.
Battery pack PCB — 2-layer: BQ40Z50-R2, BQ294xx, fuse, NTC, pack connector.
Flex: OLED FPC, 2× antenna cables (MHF4, Wi-Fi), button/Hall flex.

10. SKUs

	Base	Pro
CFe B / A, SD, microSD, CFast slots	✓	✓
5GbE, Wi-Fi 7, BLE	✓	✓
Tethered uplink on Port B (phone / USB cellular adapter)	✓ (firmware)	✓ (firmware)
Port C USB4 CFe B pass-through (ASM2464PD), read-only by default	— (depop.)	✓
Port C PD sink (Mac powers the device in reader mode)	— (depop.)	✓
Internal NVMe (M.2 2280)	— (socket present, empty)	✓ 1 TB
Battery	72 Wh	72 Wh

Same PCBs, same enclosure; SKUs differ by population only. No built-in cellular on any SKU. Base is validated and shippable without Port C (D7): firmware keeps the Port C path behind a feature flag, the Base FCT fixture does not exercise Port C, and Base regulatory testing covers the Base population; Pro's USB4 path is a later population variant with its own 15B SDoC/RED addendum — Port C can slip to a later Pro revision without delaying Base launch (13-roadmap.md §2.7).

11. Preliminary BOM roll-up (USD, rounded; detail in `10-bom.md`)

	1 k units	10 k units
Base SKU BOM (materials + PCBA + box-build, excl. tooling & NRE)	~$490	~$325
Pro SKU BOM (adds ASM2464PD path + Port C PD sink + 1 TB NVMe)	~$575	~$400
Tooling & fixtures (magnesium die-cast chassis tool, PC frame, TPU overmold, shutter, gaskets, test fixtures)	~$195 k one-time (Mg tool ≈ +12 % vs Al, verify)	(amortized separately)
Certification (FCC/ISED/CE RED incl. Wi-Fi SAR and EN 18031, UN38.3, IEC 62133-2, UL 62368-1, MIL-STD/IP lab)	~$150–200 k one-time for the Base launch (low case ~$160 k incl. UL, ~$145 k with UL deferred; realistic planning figure ~$190 k; no PTCRB/GCF/carrier programs). Pro USB4/Port C population addendum (15B SDoC, RED file update, 62368-1 variation) ≈ +$8–15 k after Base launch (verify).

v0.3 deltas: magnesium chassis + coating ≈ +$12 @1k (machined AZ31B / thixomolded) and +$6 @10k (die-cast, both SKUs, verify); Port C PD sink ≈ +$3.80 @1k / +$2.90 @10k (Pro only, verify). v0.2 for reference: Base ~$475/$320, Pro ~$560/$390. v0.1: Base ~$620/$430, Pro ~$705/$500, certification ~$250–350 k.

Full program cost view (v0.3, 13-roadmap.md §8): hardware program to MP (PoC, EVT, DVT, PVT units, tooling, certification) ≈ $1.1–1.4 M; engineering staffing through MP ≈ $2.2–2.6 M at US fully-loaded rates or ≈ $0.9–1.3 M in an ODM-supported / lower-cost scenario; Phase 2 firmware (job engine, connectors, EC, OTA, security) ≈ $0.5–0.9 M US / $0.25–0.45 M low-cost; Phase 3 apps (iPhone, then desktop) ≈ $0.4–0.6 M US / $0.2–0.3 M low-cost; contingency 20–25 %. Total ≈ $5.5–6.5 M (US) or ≈ $3.2–3.9 M (ODM-supported) — central bands; the all-low/all-high corners of the component ranges are ≈ $5.0–6.9 M / $2.9–4.3 M. Ranges are deliberately wide. Target retail price and budget ceiling: not yet set by the owner; the BOM-implied MSRP band (2.5–3.2× BOM) is in 10-bom.md and a gap analysis is deferred until a target exists.

12. Schedule (final)

Stage	Months	Units
PoC on dev kits	0–2	3 rigs
EVT	3–7	15–20
DVT	7–12	60–100
PVT	12–15	200–500
MP	15+	—

Without the PTCRB → carrier chain, regulatory grants (FCC/ISED/CE) land ~2 months after DVT samples and no longer gate MP; the critical path in the second half is hard tooling (magnesium die-cast chassis, PC frame) and DVT verification.

Gates added in v0.3:

ODM design-review package before EVT schematic kick-off (D12): ADR, block diagram, component selection, PCB architecture, mechanical concept, BOM, and a question list for the ODM (preferred parts, DFM/DFT, test capability, magnesium die-cast and coating suppliers, battery-pack vendor, RK3588 board-down reference design). ODM owns FCT/ICT fixtures, line NRE and hard tooling from DVT exit; details 13-roadmap.md §2.0.
PoC exit (month 2): SoM / board-down decision (D12) per the §3.1 criteria.
EVT exit (month 7): fan gate (D5) on measured magnesium (AZ91D-corrected) thermal data, desk, free air, shutter closed and open. Pass = all of: (a) one 512 GB 5GbE upload (~15 min) completes without throttling at 25 °C and ≥ 8 min at 35 °C; (b) Wi-Fi upload at 80 MB/s and USB4 reader mode run ≥ 60 min at 25 °C without throttling; (c) hotspot/tether upload runs indefinitely at 30 °C; (d) skin ≤ 48 °C metal / 55 °C plastic throughout. Any fail → design the sealed tunnel fan into DVT. The §6.2 model predicts (a) and (c) pass and (b) is marginal.
Base launch decoupled from Port C (D7): Port C/ASM2464PD validation runs as a parallel Pro track that may slip to a later Pro revision.

13. Owner decisions — status after the v0.3 review (2026-09-27)

Closed items keep their number so the history stays readable; the decision is bold.

#	Question	Status / decision
1	Port C USB4 pass-through	Closed (D7): Pro SKU only, depopulated on Base; decoupled from Base launch; PD sink added on Port C (Pro).
2	Ethernet 5GbE vs 10GbE	Closed (D6): 5GBASE-T RTL8126 only; no RTL8127 footprint or watch item.
3	CFast slot	Closed (D3): keep; device stays 190 mm.
4	XQD	Closed (D10): unsupported, not marketed, no licensing, no USB-reader workaround; only the "XQD not supported" detection message remains.
5	Battery	Closed (D13): 72 Wh, 4 × 21700, 2S2P.
6	Display	Closed (D13): 2.42" monochrome OLED.
7	Port A host-mode behaviour	Closed (D9): uploads pause by default; concurrent read-only sharing is an opt-in app setting.
8	Host-mode write access	Closed (D8): read-only by default on both Port A and Port C, app toggle per session; Port C enforcement per §4.2 (NVMe namespace WP → bridge WP → explicit per-session consent).
9	mmWave	Closed: moot (no cellular).
10	GNSS / geotagging	Closed (D13): no GPS receiver; location comes from the iPhone app over BLE / NCM and is stored in job metadata and the upload manifest.
11	SoM vendor	OPEN (D12): PoC bake-off of Firefly Core-3588J, Forlinx FET3588-C and ODM board-down RK3588J; decide at PoC exit (criteria §3.1).
12	Cellular	Closed (D1): no built-in modem, confirmed; no reinstatement provisions.
13	Thickness	Closed (D3): 38 mm; slack to SoM boss and gap pads; no redraw.
14	Port B tether charging	Closed (D13): 1.5 A default; 3 A only with external PD present (EC-enforced); 0.5 A selectable.
15	Chassis material	Closed (D4): magnesium AZ91D die-cast; EVT/DVT units in machined AZ31B or thixomolded AZ91D.
16	Active cooling	Closed as "decide at EVT exit" (D5): passive for EVT, fan envelope reserved, gate criteria §12.
17	Port C as a power input	Closed (D7): yes, OR-ed PD sink on Port C, Pro only.

Remaining open questions (v0.3): SoM / board-down (PoC exit); fan (EVT exit); Port C read-only mechanism — NWPC support across the card library and ASM2464PD write-protect availability (verify at PoC, 12-risks-open-questions.md §3); magnesium coating/galvanic coupon results and AZ31B→AZ91D thermal correction (EVT); target retail price and program budget ceiling (owner).

14. v0.2 change record — removal of the built-in 5G modem

Decision. Delete the Quectel RM520N-GL, its M.2 Key-B 3052 slot, the dedicated 3.3–3.6 V/5 A rail, the nano-SIM tray, the MFF2 eUICC and the four end-cap cellular antennas. Cellular reach is provided through the user's phone or a USB cellular adapter on Port B (§4.3, §5).

Why.

The uplink was never the hardware's to fix. Real-world sub-6 uplink is 2.5–10 MB/s, 150–650× below the internal card read rate; a 256 GB card takes 7–28 h over cellular (v0.1 risk R1, the top-ranked risk at E = 25). A phone hotspot delivers the same uplink from the same cell.
Cost. ~$146 (1 k) / ~$112 (10 k) of BOM — the largest single line, ~19–24 % of the Base SKU — plus ~$100–150 k of one-time certification (GSMA TAC, PTCRB, GCF, AT&T, Verizon ODI, cellular SAR bands, cellular host integration) and ~$40 k of DVT carrier-lab entry.
Schedule. The PTCRB → carrier chain was the critical path after DVT (Verizon ODI 12–20 weeks, serial with the FCC grant); MP moves ~1 month earlier and launch messaging no longer depends on carrier approvals.
Thermal and power. The modem was the hottest sustained source (4.5–6 W) and the only 12 W millisecond-burst load; its removal deletes one buck, ~12 W of peak-current sizing (system peak ~40 W → ~28 W), and one thermistor, and puts every non-Ethernet upload mode under the passive thermal ceiling (the USB-tether row's 14.1 W includes ~7.5 W exported to the phone; in-device dissipation is ~6.6 W plus ~0.4 W of conversion loss). The one addition is a 5 V/3 A buck for Port B, which reuses the deleted modem buck's board area.
Mechanical. Removes one sealed enclosure penetration (SIM tray), four antenna cables, the RF-transparency constraint on the end caps, and the tallest rear-face part (the only reason 36 mm was rejected in 08-mechanical.md §3.4).
Supply and firmware. Removes a 12–20-week lead-time, carrier-firmware-locked, single-vendor part and the MHI/MBIM/eSIM-LPA firmware surface.

What it costs. No upload without infrastructure or a phone; the phone's battery becomes part of the field kit (mitigated by Port B charging the phone while tethered); tethering behaviour on iOS/Android is a new firmware-validation item (PoC test). Product positioning shifts from "5G built in" to "uses the cellular you already carry".

Documents changed. All of docs/01–13, README.md, drawings/generate_drawings.py and the four SVGs, in the same revision.

15. v0.3 change record — owner review decisions D1–D13 (2026-09-27)

#	Decision	Rationale (owner)	Documents / sections changed
D1	Cellular removal confirmed; no reinstatement provisions (no Key-B slot, SIM, antenna windows).	v0.2 §14 reasoning accepted.	ADR §2, §13 (Q12 closed); 04 §(j) reinstatement note removed; 12 Q12.
D2	Operating assumption: desk/table operation; bag is transport only. In-bag heuristic deleted; thermal safety rule added (checkpoint → standby → auto-resume).	Matches how DIT/venue users actually work; removes a scenario that no passive design can meet, and replaces it with a safe failure mode.	ADR §1, §2, §3.5; 01 (assumption + new requirements); 02 §7 state machine, §8 EC table; 06 (§3.4 in-bag section, §6 sensors, §7.3 heuristic, §11 DVT bag test → thermal-safety test); 12 §4 assumptions, R3 (thermal).
D3	Size final: CFast kept, 190 × 96 × 38 mm; rear slack to SoM boss and gap pads.	CFast serves the rental fleet; 2 mm is not worth a redraw.	ADR §2, §13 (Q3, Q13 closed); 08 §3.2/§3.4 (option B closed); 12 Q3/Q13; drawings unchanged.
D4	Chassis material: magnesium AZ91D die-cast; Mg prototypes at EVT/DVT; coating + galvanic isolation specified; mass ~828 g; Mg tool re-estimated; castability checked.	Weight target met with margin (850 g target vs ~828 g).	ADR §2, §8, §11, §13 (Q15 closed); 06 (Mg thermal re-run incl. open shutter, per-mode ceilings, burst duration); 08 (materials, DFM, coating, galvanic, mass budget); 10 (chassis cost, coating, Mg tool); 13 (EVT/DVT Mg builds and costs, coupon tests); 12 (new R7 Mg corrosion/galvanic, R8 Mg thermal fidelity; R17 weight re-scored E 6).
D5	Passive cooling for EVT; fan envelope reserved; fan decision at EVT exit with defined pass/fail criteria.	Decide on measured data, not on the model.	ADR §8, §12, §13 (Q16 → "decide at EVT exit"); 06 §9; 08 fan envelope; 13 §2.5 gate; 12 Q16, R3 (thermal).
D6	Ethernet 5GbE only; RTL8127 option and watch item removed.	Thermal budget; real-world venue uplinks.	ADR §2, §5, §13 (Q2 closed); 03 §4.4; 04 §(h); 09; 12 (Q2, R24 closed-accepted — v0.2 R17); 13 exit criteria.
D7	Port C Pro-only, decoupled from Base launch; PD sink added on Port C (Pro).	Through a host app the host's internet link is the bottleneck, so Port A's ~380 MB/s suffices; Port C's value is fast local copies. Base must ship without it.	ADR §3.4, §6, §9, §10, §11, §12, §13 (Q1, Q17 closed); 02 (Port C PD path); 04 §(n) PD parts; 05 (charger input OR-ing, Port C sink mode); 09 (PD-C + mux); 10 (+$3–4 Pro); 13 §2.7 decoupling plan; 12 R1 (mode-switch) impact lowered.
D8	Host mode read-only by default on both ports; Port C enforcement investigated and documented; fallback = explicit per-session consent + re-verification; tracked as a risk.	Source media must never be modified without explicit consent; macOS writes hidden metadata to any writable volume.	ADR §1, §2, §4.2, §13 (Q8 closed); 01 (requirements); 02 §4.x / §6 mode descriptions; 04 §(e); 12 R2 "Port C read-only enforcement" (v0.2 R14, re-scored E 12).
D9	Port A: uploads pause while a host is attached; concurrent RO sharing opt-in.	Per spec.	ADR §4.2, §13 (Q7 closed); 12 Q7.
D10	XQD unsupported, no workaround; only the detection message remains; removed from all supported-media lists and copy.	No driver, no licence.	ADR §7, §13 (Q4 closed); 01 out-of-scope; 03; 04 §(f); 13 card library; 12 (Q4, R23 closed — v0.2 R8).
D11	Two-slat roll-top shutter approved unchanged; open-shutter effect modelled thermally.	Design accepted.	ADR §8; 06 §3 (open-shutter conductance); 08 unchanged; 12 R6 (shutter, v0.2 R7) unchanged.
D12	ASMedia primary (owner has an access team), PEX8724 fallback retained; ODM/CM lined up (design-review package, ODM-owned fixtures/tooling); SoM undecided — PoC bake-off incl. ODM board-down RK3588J.	Reduces the ASMedia access risk; leverages the ODM.	ADR §3.1, §12, §13 (Q11 open with plan); 04 §(a)/(b)/(c); 09 (board-down option note); 13 (§1 PoC criteria, §2.0 ODM package, EVT-onward ODM roles); 12 (R15 ASMedia re-scored E 8 — v0.2 R2; new R9 ODM dependency).
D13	OLED and 72 Wh confirmed; no GPS — phone location over BLE/NCM into job metadata; Port B 1.5 A default, 3 A only with external PD.	Smaller decisions.	ADR §2, §3.5, §4.3, §6.1, §6.2, §13 (Q5, Q6, Q10, Q14 closed); 01 (location requirement, Port B rule); 02 (GATT / management API); 05 (Port B policy); 12 Q5/Q6/Q10/Q14.
—	Budget: BOM (Mg, Port C sink), Mg tool, EVT/DVT Mg prototype costs, full program cost view (staffing US vs ODM-supported, Phase 2/3, contingency). Target price / budget ceiling not yet set.	Owner request.	ADR §11; 10 (BOM, tooling, MSRP); 13 §8 program cost; README diff summary.

Knock-on refinements made while propagating v0.3 (not owner decisions): Port B 3 A step requires a ≥ 45 W PD contract (§3.5); ASM2464PD enumerates before the mux flips for non-NWPC cards, and NWPC state is cleared on return / re-insertion (§4.2); external TPS25750 owns Port C PD (§3.4); Throttle 2 in the ladder moves 52 → 50 °C skin so the 52 °C thermal safety rule owns its threshold (06-thermal.md §7.2); the v0.1 48 °C mechanical thermal switch is re-rated to a 60 °C-class backstop (§3.5).

Key numbers that moved v0.2 → v0.3: mass ~935 g Al → ~828 g Mg; passive ceiling 10.6 / 6.0 W → 10.0 / 5.7 W closed, 9.5 / 5.4 W open; 5GbE burst before throttle 20 → ~17 min (25 °C); per-mode ambient ceilings −1…−2 K (§6.2); Base BOM $476/$321 → ~$490/$325; Pro $559/$389 → **$575/$400**; tooling $189 k → **$195 k**; hardware program ≈ $1.0–1.3 M → ≈ $1.1–1.4 M; full program ≈ $3.2–6.5 M depending on staffing model. Runtimes unchanged (Port B 3 A is no longer a battery case).

docs/00-architecture-decisions.md