Skip to content
RPRichard PruittTech & Cyber
Navigation
repo://poppyup/docs/12-risks-open-questions.md

docs/12-risks-open-questions.md

27 KB · 99 lines · markdown · View source · Download from the repository page

12 — Risks & Open Questions

Baseline: ADR v0.3 (2026-09-27). Scope: Phase 1 hardware architecture. Ranked by exposure = likelihood × impact on schedule, cost, or product viability. Each risk names an owner discipline, a mitigation already baked into the design (see 00-architecture-decisions.md), a residual mitigation for the next phase, and the stage at which it must be retired (13-roadmap.md).

Scoring: L = likelihood (1–5), I = impact (1–5), E = L × I. v0.3: register re-scored after owner decisions D1–D13 and re-sorted by E; rows are renumbered, and the v0.2 # column keeps the old number so cross-references in the ADR §15 change record (which cite v0.2 numbers) stay readable. Closed risks keep a row at the bottom, marked closed.

1. Ranked risk register

# v0.2 # Risk L I E Owner Built-in mitigation Next mitigation Retire by
R1 R1 Mode-switch hot path (PCIe mux + REFCLK mux + reset sequencing). Switching the CFe B slot between the RK3588 root port and the ASM2464PD while guaranteeing clean link retraining and no card corruption is the most novel piece of hardware in the product. 4 3 12 HW / EC firmware EC is sole arbiter; slot is power-cycled and PERST# held across every switch; separate Port C connector avoids muxing USB4 lanes; the universal gadget path on Port A works even if Port C fails. D7: Port C / ASM2464PD is Pro-only and decoupled from Base launch — firmware feature flag, Base FCT does not exercise Port C, Pro regulatory addendum — so a failure here moves the Pro date, not Base ship. Impact lowered 5 → 3 on that basis. PoC rig with PI3DBS16412 eval board + ASM2464PD enclosure board: 1,000-cycle switch test, link-training margin, RK3588 hot rescan behavior, lspci re-enumeration timing. Fallback: Port C becomes a static configuration (user selects via button before plugging in), or ships in a later Pro revision (13-roadmap.md §2.7). PoC → EVT (Pro track)
R2 R14 Port C read-only enforcement. Source media must never be modified without explicit consent (D8), but on Port C the host talks to the card directly. NVMe Namespace Write Protection (Feature 0x84) works in native USB4 and UAS modes but only on cards reporting NWPC (Identify Controller byte 531) — expected a minority; the ASM2464PD bridge write-protect (SCSI WP / RO firmware config) is unverified and applies only in UAS/BOT fallback, never in native USB4 mode. If neither applies, RO cannot be enforced by hardware or firmware. Two side effects add scope: NWPC state 1 persists on the card, so a card pulled mid-session stays write-protected until re-inserted (OLED warning; cleared on re-insertion), and for non-NWPC cards the bridge must enumerate before the mux flips to learn native-USB4 vs UAS (reverses the v0.2 sequence). 4 3 12 FW / UX / HW Port A gadget path: SCSI WP bit on every LUN, RO by default, app toggle per session (fully enforced, all SKUs). Port C, in order: (1) SoC sets NVMe namespace WP state 1 before flipping the mux; (2) bridge WP if ASMedia's tool exposes it; (3) fallback = no automatic switch — OLED/app ask "Mac wants write access to CFe B — allow?", explicit per-session consent, logged, full re-verification (identity + directory/mtime scan) on return with a changed/added-files report (ADR §4.2). Port C is Pro-only (D7), so Base is unaffected. PoC: NWPC survey across the card library (nvme id-ctrl byte 531) and ASM2464PD RO configuration check with the owner's ASMedia-access team (13-roadmap.md §1.3 P13/P14). Phase 2: consent UX and re-verification report; product copy states that Port C is read-only only when the card supports it, otherwise consent-gated. PoC (mechanism) → DVT (UX)
R3 R3 Thermal ceiling in a sealed IP54 enclosure (magnesium, desk, free air). Passive dissipation with the AZ91D chassis is ~10.0 W at 25 °C / ~5.7 W at 35 °C shutter closed and ~9.5 / ~5.4 W shutter open — ~1–2 K lower per-mode ambient ceilings than the v0.2 aluminum figures. Wi-Fi upload at 80 MB/s and USB4 reader mode are marginal at 25 °C (ceilings 25 / 24 °C and 25 / 23 °C); 5GbE upload (~14.9 W) is a ~17 min burst from 25 °C. The in-bag operating scenario is removed from scope (D2: bag = transport only). 3 4 12 Thermal / ME Magnesium chassis as heat spreader with ribs and masked bare-conversion gap-pad bosses; battery on the cool side; ~500 J/K thermal mass absorbs 15-minute bursts; throttling ladder in 06-thermal.md; thermal safety rule (D2): skin ≥ 52 °C / air ≥ 60 °C / battery ≥ 55 °C → checkpoint all jobs → standby → auto-resume at ≤ 42 / 45 °C, app notified, 48 °C mechanical switch as backstop; sealed tunnel-fan envelope reserved. EVT thermocouple map + IR on machined AZ31B units, shutter closed and open, corrected for AZ31B→AZ91D conductivity (~30 %); EVT-exit fan gate (D5, 13-roadmap.md §2.5) — any fail → fan designed into DVT; DVT chamber and sun-load tests on AZ91D parts. EVT exit (gate) / DVT
R4 R4 RK3588 software maturity for our specific uses. Mainline is good but: USB gadget UAS (f_tcm) throughput and stability with iOS; PCIe hotplug/rescan on DesignWare root ports; ASPM quirks with switches; USB tethering stack (ipheth trust prompt, RNDIS/NCM quirks) validated at PoC. 3 4 12 FW / HW Gadget path has BOT (f_mass_storage) fallback; rescan via sysfs is acceptable given the EC sequences resets; the tether path has a Wi-Fi-hotspot fallback that needs no USB class driver. PoC: measure f_tcm vs f_mass_storage to iPhone 15/16/17 Pro and Mac; keep a Rockchip BSP kernel option for EVT only, target mainline LTS for DVT. PoC / EVT
R5 R5 iPhone (iOS Files app) behaviour with our gadget and with ASM2464PD fallback. UAS support, multi-LUN handling, exFAT volumes > 2 TB, unmount semantics, power negotiation (iPhone as source). 3 4 12 FW / HW Multi-LUN BOT is the most conservative profile; ASM2464PD fallback mode is the same as commercial CFexpress 4.0 readers already in the field with iPhones. PoC test matrix across iPhone 15 (USB 2), 15 Pro/16 Pro/17 Pro (USB 3), iPad Pro (USB4), macOS 15/26, Windows 11. PoC
R6 R7 Sliding shutter reliability (wear, grit, drop deformation, seal). A moving metal plate on a rugged device is a wear item and a sealing dependency. Two-slat roll-top approved unchanged (D11); only the open-shutter thermal effect is new (R3). 3 4 12 ME POM rails carry the hard-anodized Al slats (never touching the Mg chassis — galvanic, see R7), self-cleaning open channels, replaceable slats, detents with end stops retained during drop, IP54 claim only when closed. EVT: 10 k-cycle wear rig, sand/dust test, drop with shutter open and closed (unchanged); DVT: IP54 test. EVT / DVT
R7 new Magnesium corrosion / galvanic (coating, fasteners, salt fog). Magnesium is anodic to every other metal in the assembly; a coating defect, a stainless fastener in bare Mg, or an EMI gasket on a powder-coated land turns into corrosion, loss of thread, or loss of shielding contact. 3 3 9 ME ADR §8 coating stack: chromate-free conversion coat (Gardobond X 4707 / Alodine 5200 class) over the whole casting + 40–60 µm matte grey powder/e-coat outside; masked bare-conversion pads only at gap-pad bosses and EMI-gasket lands; zinc-nickel-plated steel or Al 5056/6061 screws with Al washers; no stainless helicoils (Al or Zn-Ni inserts); stainless detent balls/springs in POM housings; anodized Al slats isolated by POM tracks and silicone seals; PEO alternate for a later salt-fog claim. EVT coupon tests: 500 h neutral salt fog (ASTM B117, verify) on coated AZ91D coupons with fasteners, inserts and gasket lands; EMI-gasket contact resistance before/after; coating adhesion (cross-hatch) and thermal-cycle check; coating-supplier qualification via the ODM (13-roadmap.md §2.0, §6). EVT (coupons) / DVT (on castings)
R8 new Magnesium thermal fidelity. Machined AZ31B prototypes (k ≈ 96 W/m·K) conduct ~30 % better than production AZ91D die-castings (k ≈ 72 W/m·K, all verify); die-cast porosity and boss-face flatness further degrade the gap-pad path. Uncorrected EVT data would call the fan gate (D5) optimistically. 3 3 9 Thermal / ME ADR §8 flags the correction explicitly; boss faces machined to 0.10 mm flatness after casting; 1.6 mm walls (thicker than the castable minimum) for drop and spreading; thixomolded / T0 AZ91D units are the EVT/DVT alternative to machined AZ31B. EVT: run the thermal map on AZ31B and apply the conductivity correction in the 06-thermal.md model (spreading-uniformity 0.80) before calling the gate; or build the EVT thermal units from thixomolded AZ91D; DVT: re-measure on soft-tool AZ91D shots and bound porosity with sectioned samples. EVT exit (gate) / DVT
R9 new ODM dependency (schedule, IP, RK3588 board-down reference quality, tooling ownership). The ODM owns layout/DFM review, FCT/ICT fixtures, line NRE, hard tooling from DVT exit, and sourcing of the Mg die-cast, coating and battery-pack suppliers (D12). Their queue, their reference-design quality (if the board-down SoC path is chosen) and who owns the tool steel and test IP become program risks. 3 3 9 Program / Sourcing ODM design-review package before EVT schematic kick-off (13-roadmap.md §2.0) surfaces capability gaps early; we retain architecture, firmware, verification and compliance; SoM paths (Firefly / Forlinx) remain as alternatives to board-down until PoC exit; tooling ownership and design-file escrow to be written into the ODM agreement. Contract terms (tool ownership, IP, exit rights, NRE schedule) before EVT-B; board-down reference design audited at PoC (schematic review, DDR sign-off, boot-firmware status) before it can win the SoM bake-off; second ODM identified as fallback for DVT. PoC exit (SoM path) / EVT (agreement)
R10 R12 SoM selection, longevity & single-source. Carrier form undecided (D12): Firefly Core-3588J vs Forlinx FET3588-C (pin-incompatible) vs ODM board-down RK3588J. SoM vendors are small with 5–10-year statements; board-down removes the SoM vendor but adds DDR/PMIC layout and boot-firmware work. 3 3 9 Sourcing / HW PoC bake-off on three rigs with the ADR §3.1 criteria (bifurcation/lane exposure, USB OTG gadget behaviour, thermal interface, longevity/EOL terms in writing, price, pin-compatibility/second source, ODM support); carrier board designed to a documented pinmap; RK3588 itself is high-volume. Decide at PoC exit; EOL clauses in the supply agreement; second-source adapter board at DVT if a SoM is chosen; if board-down, ODM reference design audited (R9). PoC exit (decision) / DVT
R11 R13 High-speed signal integrity (USB4 20 GBd, PCIe Gen4 through a mux, Gen3 across a mezzanine). First-spin failure here costs a board spin (~8 weeks). 3 3 9 HW / SI Hybrid low-loss stackup, ≤ 60 mm USB4 route, ≤ 120 mm mux path, Gen4-rated mezzanine, back-drilling; channel simulation required before EVT fab (09-pcb-architecture.md); the USB4 lanes are on the Pro track (D7). Budget one EVT re-spin; add redriver footprints (e.g. PI3EQX16 class) as DNP options on the Gen4 path; ODM layout/DFM review before EVT-B. EVT
R12 R9 Cellular reach depends on the user's phone / a USB adapter. The physics is unchanged — real-world sub-6 uplink is 20–80 Mbps (2.5–10 MB/s), 2–3 orders of magnitude below card read rate, and a 256 GB card takes 7–28 h over cellular — but since v0.2 it is the phone's uplink, not ours (confirmed final, D1). The exposure is market/positioning: "no built-in 5G" is a perceived gap, and the phone's battery and hotspot behaviour become part of the field kit. 3 3 9 Product / Systems Link policy Ethernet > Wi-Fi STA > USB tether; hotspots/tethers default to metered with per-link caps and data-cap warnings (P0); Port B charges the phone at 1.5 A by default (3 A only with external PD present, D13); a USB LTE/5G adapter works without a phone. Firmware phase: honest in-app ETA, "selects first" prioritisation (proxies/stills before RAW), multi-connection uploads. Product: optional USB-adapter bundle; position as "uses the cellular you already carry", not "dump a card over 5G". PoC (measure via phones), DVT (UX)
R13 R10 Certification cost & time (FCC/ISED/CE incl. Wi-Fi SAR and EN 18031, UN38.3, IEC 62133-2, UL 62368-1). ~$150–200 k one-time and ~2–3.5 months after DVT samples for the radio grants; no PTCRB/GCF/carrier programs, so nothing is serial with the FCC grant and certification no longer gates MP. 3 3 9 Program / Compliance Both radios on modular-certified modules; antennas kept within the MT7925 grant gains; no cellular, no mmWave; pack < 100 Wh; one radio SKU worldwide; Base certified first — the Pro USB4 / Port C PD-sink population is a later 15B SDoC addendum, RED technical-file update and 62368-1 variation (~$8–15 k, verify) that never gates Base (D7); Cr(VI)-free Mg coating keeps RoHS clean. Pre-compliance scan at EVT; full pre-scan on DVT-0 before formal labs; EN 18031 self-assessment started with DVT firmware; mandatory PVT drop/IP re-test on production AZ91D castings (11-certification.md §8). DVT → PVT
R14 R11 USB tethering UX and robustness across iOS/Android versions. iOS "Trust this computer" prompt on first attach, Personal Hotspot timeouts when idle, iOS USB tethering being USB 2.0-class (~30–40 MB/s ceiling, well above any cellular uplink), Android RNDIS-vs-NCM behaviour per vendor, phone thermal throttling while charging and transmitting. 3 3 9 FW / Product Tether is treated as just another metered link in the job engine; Wi-Fi hotspot is an always-available fallback needing no USB class driver; Port B charge current is EC-capped at 1.5 A on battery to keep the phone cool and the runtime honest. PoC test matrix iPhone 15/16/17 + Pixel/Galaxy on a USB 3.2 host dev board (enumeration, uplink vs phone speed test, attach/detach cycling, charge-current control); publish a recommended USB adapter list. PoC → DVT
R15 R2 ASMedia parts documentation / firmware access (ASM2812, ASM2464PD, ASM3142, ASM1064). Datasheets and firmware tools are NDA-gated. D12: the owner has a team with ASMedia parts and documentation access — likelihood lowered 4 → 2. 2 4 8 Sourcing / HW ASMedia primary; public-datasheet alternates identified for the switch (Broadcom PEX8724) and host controller (SoC OTG0 at 5 Gbps); ASM2464PD and ASM2812 are available on off-the-shelf boards for PoC without NDA. Owner's ASMedia-access team owns the NDA, firmware tools and the ASM2464PD write-protect question (R2) from PoC start; PEX8724 fallback retained as insurance at EVT freeze (+2 W, +$15) with Port C then a purchased ASM2464PD module. EVT freeze
R16 R15 Battery cert & transport. UN38.3 on a custom pack; pack must be tested per design change; airline 100 Wh rule requires clear Wh labeling. 2 4 8 Compliance Cells pre-certified (UN38.3, IEC 62133-2); 72 Wh confirmed (D13) leaves margin; pack is a subassembly so re-test scope is limited; pack vendor sourced via the ODM. Freeze pack design at DVT; run UN38.3 on DVT packs. DVT
R17 R6 Weight vs. runtime. 72 Wh of 21700 cells is 276 g. D4 decided magnesium: bottom-up ~828 g (AZ91D, 1.6 mm walls) against the 850 g target / 950 g max; aluminum (~935 g) is no longer planned — likelihood lowered 4 → 2. Residual: machined AZ31B EVT/DVT units ≈ 830–840 g; casting wall growth or added ribs could eat the 22 g margin. 2 3 6 ME / Product Mass budget in 08-mechanical.md; 2S2P chosen over 3S2P; magnesium end-cap variant is an EVT option costed against the margin. Weigh EVT units; hold the mass budget through DFM (rib/boss additions) at the ODM design review; DVT castings weighed against ~828 g. EVT / DVT
R18 R16 Wi-Fi AP + STA concurrency and 6 GHz rules. Same-channel concurrency limits AP performance; 6 GHz AP is LPI-indoor-only in the US. 3 2 6 FW / RF AP defaults to 5 GHz; BLE (on the EC) is the primary control channel so AP is a convenience path. Validate mt7925 multi-vif in PoC; fallback: management over BLE + wired NCM only. PoC
R19 R18 Perceived feature gap vs. competitors with built-in LTE/5G. Spec-sheet comparisons and reviewers may count "no modem" against us even though the achievable uplink is identical. 3 2 6 Product / Marketing Tethered uplink is a first-class mode (OLED "UPLOADING via iPhone"), not a workaround; Port B charges the phone; optional USB LTE/5G adapter gives phone-free cellular. Launch messaging and comparison table built around measured uplink and total field-kit cost (no second data plan); bundle/recommend a USB adapter. Launch
R20 R19 Metered hotspot / tether data-plan cost surprises. Large uploads over the phone's metered plan or a travel eSIM on a USB adapter. 2 2 4 FW / Product Hotspots and tethers default to metered; per-link caps and warnings are P0; the phone's own data counters remain the user's reference. Per-link usage counters in the app (FR-025); optional pause-on-metered default for RAW. DVT
R21 R20 Cold-weather performance. Li-ion cannot charge < 0 °C; SD/CFe cards and OLED are fine to −20 °C; e-paper was rejected partly for this. 2 2 4 HW JEITA charge windows; discharge permitted to −20 °C with derating. DVT thermal chamber. DVT
R22 R21 Trademark/logo licensing (CFexpress, SD, USB4). Using logos requires memberships/certification; "Thunderbolt" must not be claimed. 2 2 4 Legal / Compliance Documented in 11-certification.md. Join CFA and SDA at EVT; USB-IF optional (Pro track). EVT
R23 R8 XQD is not supportable — CLOSED (D10). XQD uses a proprietary PCIe protocol with no Linux driver; physical fit in the CFe B slot will tempt users. Decision: unsupported, not marketed, no licensing, no USB-reader workaround; removed from every supported-media list, spec table, card library and product copy. 5 2 (10) Product Slot firmware detects a non-NVMe PCIe device in the CFe B slot and shows "XQD not supported" — the only XQD-related behaviour that remains. None — closed. Closed (v0.3)
R24 R17 Ethernet speed decision regret (5 vs 10 GbE) — CLOSED, accepted (D6). Pro venues increasingly have 10 G; most 10 G ports negotiate 5 G/2.5 G, some older ones don't. Decision: RTL8126 5GBASE-T only; no RTL8127 footprint option or EVT watch item; the risk is accepted for power/thermal reasons. 2 3 (6) Product / HW RTL8126 negotiates 5/2.5/1 G/100M. None — closed and accepted. Closed (v0.3)

2. Top five, in prose

R1 — Mode-switch hot path. The design deliberately avoids the fragile version of this problem (muxing 20 GBd USB4 lanes at a single connector while two PD controllers argue about who owns the port) by giving the USB4 bridge its own connector and only muxing PCIe Gen4 ×2 at the card slot with the link down. What remains is a sequencing problem owned by the EC, and it is testable on a bench in month two. Since D7 it is also no longer a Base-launch risk: Port C is Pro-only, behind a firmware feature flag, outside the Base FCT and Base regulatory filings, and allowed to slip to a later Pro revision. It stays at the top of the register on likelihood, but its impact is now "moves the Pro date", not "moves the product".

R2 — Port C read-only enforcement. The read-only promise is fully enforced on Port A (SCSI WP bit) but only partially enforceable on Port C, where a native USB4 host talks to the card with no bridge logic in the path. NVMe namespace write protection is the right tool and is expected to work on only a minority of camera cards; the ASM2464PD bridge write-protect is unverified and covers only the UAS fallback. The PoC therefore surveys NWPC across the card library and asks the ASMedia team the bridge question, and the design already carries the honest fallback: no automatic switch, an explicit per-session consent prompt, a log entry, and a full re-verification report on return. The risk is that the fallback becomes the common case and the "read-only reader" message needs careful wording.

R3 — Thermal. The sealed magnesium enclosure sets a hard passive ceiling of ~10.0 W at 25 °C (shutter closed; ~9.5 W open) — ~1–2 K of per-mode ambient ceiling below the v0.2 aluminum figures. On a 25 °C desk every mode except the two 5GbE/NVMe bursts runs indefinitely, but Wi-Fi at 80 MB/s and the USB4 reader are marginal and will throttle on a warm desk. The in-bag scenario is out of scope (D2); the firmware thermal safety rule (checkpoint → standby → auto-resume) protects a device packed away mid-job. The decision is made on measured data, not the model: EVT thermal units in machined AZ31B, corrected for the ~30 % conductivity difference to AZ91D (R8), shutter open and closed, against the D5 pass criteria — any fail designs the reserved tunnel fan into DVT.

R4 — RK3588 software maturity. The gadget path (f_tcm UAS to iOS), PCIe hot rescan on DesignWare root ports and ASPM with a switch are the three kernel behaviours the product depends on that are not exercised by mainstream RK3588 boards; the USB tethering stack (ipheth, NCM/RNDIS, MBIM/QMI adapters) is well-trodden Linux but new to us. All four are measured at PoC on the three bake-off rigs, with BOT, sysfs rescan and Wi-Fi hotspot as fallbacks — and the bake-off itself (R10) uses these behaviours as selection criteria.

R5 — iPhone behaviour. Whether iOS Files handles our multi-LUN gadget and the ASM2464PD UAS fallback cleanly decides the "plug into your iPhone" story. The conservative BOT profile and the fact that ASM2464PD readers already ship for iPhones bound the downside; the PoC matrix across iPhone 15/15 Pro/16 Pro/17 Pro, iPad Pro and macOS/Windows retires it in month two.

Just below the top five sit the shutter (R6, unchanged, D11) and the three new v0.3 items at E = 9 — magnesium corrosion/galvanic (R7), magnesium thermal fidelity (R8) and ODM dependency (R9) — followed by SoM selection (R10, decided at PoC exit), signal integrity (R11) and the three cellular-adjacent items (R12–R14). ASMedia access (R15) has dropped from 16 to 8 thanks to the owner's access team, and weight (R17) from 12 to 6 now that magnesium is decided at ~828 g.

3. Owner decisions — status after the v0.3 review

This table mirrors 00-architecture-decisions.md §13 exactly so this document can be read standalone. Closed items keep their number; the decision is bold.

# Question Status / decision
Q1 Port C USB4 pass-through Closed (D7): Pro SKU only, depopulated on Base; decoupled from Base launch; PD sink added on Port C (Pro).
Q2 Ethernet 5GbE vs 10GbE Closed (D6): 5GBASE-T RTL8126 only; no RTL8127 footprint or watch item.
Q3 CFast slot Closed (D3): keep; device stays 190 mm.
Q4 XQD Closed (D10): unsupported, not marketed, no licensing, no USB-reader workaround; only the "XQD not supported" detection message remains.
Q5 Battery Closed (D13): 72 Wh, 4 × 21700, 2S2P.
Q6 Display Closed (D13): 2.42" monochrome OLED.
Q7 Port A host-mode behaviour Closed (D9): uploads pause by default; concurrent read-only sharing is an opt-in app setting.
Q8 Host-mode write access Closed (D8): read-only by default on both Port A and Port C, app toggle per session; Port C enforcement per ADR §4.2 (NVMe namespace WP → bridge WP → explicit per-session consent).
Q9 mmWave Closed: moot (no cellular).
Q10 GNSS / geotagging Closed (D13): no GPS receiver; location comes from the iPhone app over BLE / NCM and is stored in job metadata and the upload manifest.
Q11 SoM vendor OPEN (D12): PoC bake-off of Firefly Core-3588J, Forlinx FET3588-C and ODM board-down RK3588J; decide at PoC exit (criteria ADR §3.1).
Q12 Cellular Closed (D1): no built-in modem, confirmed; no reinstatement provisions.
Q13 Thickness Closed (D3): 38 mm; slack to SoM boss and gap pads; no redraw.
Q14 Port B tether charging Closed (D13): 1.5 A default; 3 A only with external PD present (EC-enforced); 0.5 A selectable.
Q15 Chassis material Closed (D4): magnesium AZ91D die-cast; EVT/DVT units in machined AZ31B or thixomolded AZ91D.
Q16 Active cooling Closed as "decide at EVT exit" (D5): passive for EVT, fan envelope reserved, gate criteria ADR §12 / 13-roadmap.md §2.5.
Q17 Port C as a power input Closed (D7): yes, OR-ed PD sink on Port C, Pro only.

Remaining open (v0.3):

  1. SoM / board-down (Q11) — PoC bake-off, decide at PoC exit (R10).
  2. Fan (Q16) — EVT-exit gate on AZ91D-corrected thermal data, shutter closed and open (R3, R8).
  3. Port C read-only mechanism — NWPC support across the card library, ASM2464PD write-protect availability, bridge-before-mux enumeration timing, NWPC clear-on-return / pulled-card handling, and which PD entity owns Port C (external TPS25750 sink with the ASM2464PD PD block passive — ADR §3.4); verify at PoC (R2). Until then the consent fallback is the design assumption.
  4. Magnesium coupon and thermal-correction results — 500 h salt fog, gasket contact resistance, AZ31B→AZ91D correction; EVT (R7, R8).
  5. Target retail price and program budget ceiling — not yet set by the owner; the BOM-implied MSRP band is in 10-bom.md and the full program cost view in 13-roadmap.md §8; gap analysis deferred until a target exists.

4. Assumptions this analysis rests on

  1. Desk operation (D2). PoppyUp operates on a desk or table (studio, venue, hotel, vehicle), lying flat or standing on its bottom edge, in free air. A bag is for transport only; the device is not expected to operate inside a closed bag. Thermal ceilings, runtime claims and the throttling ladder assume this; the thermal safety rule (ADR §3.5) is the protection if the assumption is violated mid-job. The rugged targets (drop, IP54) cover transport.
  2. Users work mostly on Ethernet or Wi-Fi at studios, venues and hotels; cellular is for urgent selects and remote locations, and is reached via the user's phone (hotspot or USB tether) or a USB adapter on Port B.
  3. Camera cards are exFAT (occasionally FAT32); no proprietary filesystems in v1.
  4. Volumes of 1 k units in year one, 10 k in year two, justify the SoM-or-board-down decision at PoC exit and the machined-AZ31B → thixomolded → die-cast AZ91D tooling transition.
  5. A single worldwide radio SKU is acceptable — trivially true since v0.2: Wi-Fi 7 and BLE only, with regional band limits handled in firmware power tables; no cellular regional variants exist.
  6. The iPhone app (Phase 3) is the primary UI; the OLED is a glanceable secondary. The app is also the source of job location (D13) and the consent channel for Port C write access (D8).
  7. An ODM/CM is engaged from the EVT design review onward and owns fixtures, line NRE and hard tooling from DVT exit (D12); we retain architecture, firmware, verification and compliance.
  8. Component and material specs marked "(verify)" in the topic documents — including the AZ91D/AZ31B thermal properties and the Mg tooling premium — are to be confirmed against current vendor datasheets during PoC/EVT; none of them changes the architecture if off by a normal margin.