Status: Proposed research mission; no field effectiveness established. Research orbit: ORION.
Original proposal · Domain model · Protocol
Hypothesis. Board layout encoding power, trust zones, test points, and fault isolation improves design-review accuracy. Design. Produce a layered KiCad board whose silkscreen and drawing layers identify trust boundaries, rail names, lifecycle-only debug access, recovery controls, and measurement points; encode the same boundaries in a machine-readable net-to-zone table. Evidence. Use an original schematic, BOM, stackup, design-rule report, and rendered assembly views, all from an owned prototype. Test. Randomize reviewers between conventional and trust-visible drawings; compare time and accuracy identifying injected isolation, labeling, and testability defects. Boundary. Visual clarity is an assurance aid, not electrical proof: DRC, ERC, impedance, creepage, and hardware tests remain mandatory. Sources: KiCad PCB editor and DRC manual, NIST SP 800-160 systems engineering.
Treat the statement “Board layout encoding power, trust zones, test points, and fault isolation improves design-review accuracy.” as a hypothesis with a comparator and a population, not as a demonstrated benefit. Implement the precise mechanism described above; preserve the original evidence boundary and endpoint. Use the domain model to state variables and units, but justify which assumptions apply to this particular mechanism rather than copying the model mechanically.
Observation contract: collect only the fields needed to estimate this mission's endpoint. Candidate domain fields are Update stage, verified version, active slot, power condition, temperature, sensor residual, recovery state. Bind every record to source/version, valid-time interval, missingness reason and a fixture or collection permission. The domain resource is OpenTitan device life-cycle specification; its applicability is a candidate starting point, not an assertion that every field required by this mission exists there. When fields or labels are absent, design a synthetic or owned-system fixture and report the gap.
Baseline and falsification: use the original comparison stated above and at least one applicable simple baseline from Single-slot update; checksums without versioned state; no cross-sensor redundancy. Match information, tuning, observation and resource budgets. Define an absolute acceptance floor and minimum meaningful improvement before collecting the final test results. Reject the thesis if the benefit disappears on an untouched partition, if the resource-normalized baseline dominates it or if a declared invariant fails. Choose numerical floors with the mission owner; this dossier does not invent measured thresholds.
Adverse-case matrix: Reset at every update boundary; loss of metadata write; benign sensor drift; recovery image unavailable. Choose the cases relevant to this mechanism and explain any exclusion. Add a negative control in which the intervention should have no effect. Preserve ambiguous outcomes instead of assigning unsupported truth labels.
Graduate investigation: Atomicity across reset; boot dependency; drift vs fault discrimination; measurement probe loading. Write a rival explanation for any apparent improvement; identify the smallest additional observation that distinguishes it from the proposed mechanism. Perform a sensitivity analysis over uncertain assumptions and a leave-one-environment/scenario-out evaluation. A performance difference within a synthetic fixture establishes only behavior of that fixture.
Review artifacts: model/assumption ledger; versioned input contract; baseline implementation; preregistered endpoint; adverse-case results with uncertainty; resource-use record; negative findings; independent review notes. The practical starting budget is Owned development board or emulator, current-limited supply, logic analyzer; no invasive extraction or bypass methods. Independent reviewer sign-off remains pending.
Domain references and data caveats · Applicable resource ledger