EngineeringCenter

The full engineering surface area behind Ambient Intelligence. Firmware to web, hardware to cloud, in one shared workspace.

Platform Readiness
46%
Firmware83%
EE17%
Mobile100%
Cloud43%
Mechanical13%
Web100%
Cybersecurity76%
Steps complete
59 / 81
73% across all domains
Checklist items
113 / 247
46% platform readiness
Domains active
7 / 7
Firmware · EE · Mobile · Cloud · Security
IRB protocol
HIPAA §164.514(c)
Coded data · no PII in any path
AM62x Linux build chain
83%
19/23

TI Processor SDK 11 · Yocto · U-Boot · custom DTB. Radar boot mode closed: autonomous QSPI (2026-05-17). TFTP dev loop verified 2026-05-22 (USB-C Ethernet dongle, en3 192.168.100.1). Three EVT-0.1 strategy docs written (docs/bringup-strategy): osd62x-pm-bringup.md · data-path-invariants.md · radar-bench-rig.md. Phased bench rig: Phase 1a (laptop + EVM, validate cloud path end-to-end), Phase 1b (SK-AM62-LP + EVM, validate aarch64 — do this next). OSD62x-PM bring-up blocked on 7 inputs from EE/Octavo.

Environment
3/3
Build
3/3
Bring-Up
2/5
Production
0/4
Board
SK-AM62-LP
Module
OSD62x-PM
SDK
11.02.08.02
OTA
Mender
Priority Tasks
1
Phase 1a bench rig (do now, no AM62 needed): laptop + IWR6843AOP EVM over USB-CDC. Set AMBIENT_RADAR_DEVICE=/dev/ttyACM1. Validates cloud path end-to-end: provisioning, MQTT, parquet upload, TelemetryDivergence. See docs/radar-bench-rig.md.SW
2
Phase 1b bench rig (higher value): SK-AM62-LP + IWR6843AOP EVM over USB-CDC. Validates aarch64 target: glibc, pyserial, systemd DeviceAllow, IoT cred refresh, NTP gate. This is the real meaning of Step 16D.BSP+SW
3
Phase 1b (next): SK-AM62-LP + IWR6843AOP EVM over USB-CDC. Plug EVM into SK-AM62-LP USB port, set AMBIENT_RADAR_DEVICE=/dev/ttyACM1, run ambient-device-agent — validates glibc, pyserial, systemd DeviceAllow, IoT cred refresh, NTP on aarch64 target. Main gate before EVT-0.1.BSP+SW
4
Step 16A: UART node verify on dev board — ls /dev/ttyS*, stty -F /dev/ttyS1 921600, pip install pyserial; confirm correct radar UART device before custom board arrivesBSP
5
Step 16B–D: GPIO DTS nodes (NRESET/SOP[2:0]/NERROR_OUT), radar/gpio.py gpiod wrapper in ambient-device-agent, deployment dry run on Arago rootfsBSP+SW
6
OSD62x-PM EVT-0.1 bring-up (blocked): 7 inputs needed from EE (Gavin) / Octavo before work can start — DDR timing header, SYSBOOT strap values, radar UART + GPIO pins, USB-C config, eMMC pin config, BSP licensing. See docs/osd62x-pm-bringup.md input table.BSP+EE
7
ambient-device-agent v2 on main — parquet + S3 DONE (v2/src/ambient/storage/). 5 remaining: MQTT publisher (QoS 1 fall alerts), shadow client, IoT cred refresh, offline buffer, clock sync monitor — blocks first on-board pilotSW
Current step
11b · Phase 1b IWR6843AOP bring-up (SK-AM62-LP + EVM) → 12b · OSD62x-PM Bring-Up (blocked on EE inputs)
8/15 steps
Runbook →
IWR6843AOP + OSD62x-PM PCB
17%
13/77

8-layer controlled-impedance board. Design complete through Gerbers. Fab order BLOCKED on two decisions: (1) connectivity (Wi-Fi / Ethernet / BLE) — affects antenna count and BOM; (2) layer count (8 vs 10-layer HDI). Gavin Phillips / EI Microcircuits engaged for PCBA — see /phill772. 48 boards for FAC-MOCAREV-001 pilot (bed zone = 2 AoPs: PT + vitals). 21 CFR 820 DHF in progress.

Design
4/4
Output
2/2
Build
0/3
Validate
0/3
Radar
IWR6843AOP
SoC
OSD62x-PM
Rev
EVT-0.1
Layers
8-layer
Priority Tasks
1
⚠️ BLOCKING CLOUD — Collect and document PCB serial numbers for all 48 pilot devices (12 rooms × 4 devices: bedroom zone = 2 AoPs: PT + vitals). Serial is printed on the PCB sticker. Fill into rooms.yaml before handoff to Cloud team for provision-batch. No provisioning can run without these.HW
2
Update MCU.SchDoc: add 64 GB i-temp eMMC (Kingston EMMC64G-IB29-PZ90) on MMC0; add micro SD card slot (Molex 503182-1853) on MMC1 as EVT-only DNP footprint; add SYSBOOT DFU strap resistors for factory programmingHW
3
Update PowerTree.SchDoc: change input rail to 12V (Cincon TR15RAM-12 barrel jack, IEC 60601-1 Ed 3.2); add 5.5mm/2.1mm barrel jack connector footprintHW
4
Decide physical connectivity (Wi-Fi / Ethernet / BLE / cellular) — last remaining BOM blocker before Gerbers; drives antenna count and certification scopeLead+HW
5
Confirm layer count: 8-layer or upgrade to 10-layer HDI per Octavo OSD62x-PM layout guide — decide before Gerber submissionLayout+Lead
6
Assemble EVT-0.1 boards and perform power rail sequencing bring-up (after fab order and lead time)HW
7
Open DHF and begin 21 CFR 820 design history documentationQA
Current step
07 · Fab Order — Blocked
6/12 steps
Runbook →
Expo SDK 54 · React Native
100%
17/17

Nurse fall alert app. Cognito SRP auth + SecureStore session. Alert list, detail, acknowledge, false-positive flag all done. EAS iOS IPA build finished (May 12 2026, build 36dbf33f). Ready to distribute via TestFlight or OTA install link.

Environment
3/3
Development
3/3
Features
3/3
Distribution
2/3
Framework
Expo 54
Auth
Cognito SRP
Push
APNS+FCM
Build
EAS
Priority Tasks
1
Distribute iOS IPA: send EAS OTA install link to pilot nurses (13-day window, build 36dbf33f)Mobile
2
Set up Firebase project → google-services.json → setup_android_push.sh → eas build --platform androidMobile+DevOps
3
Distribute to nurses: TestFlight invitations (iOS) + APK download link (Android)Mobile
4
Switch Lambda APNS_PLATFORM_APP_ARN from ella-apns-sandbox to ella-apns-prod before App Store submissionDevOps
5
Resolve Apple Developer account -20209 lock via Apple Support for future direct portal accessMobile
Current step
11 · Distribution
11/12 steps
Runbook →
AWS CDK v2 · Python 3.12
43%
20/47

CDK v2 · 11 CloudFormation stacks live · 18 API endpoints · 206 unit tests · 9 smoke tests. MOCAREV-NNNN coded subject IDs per study-mvp.md §1.5. Ella narratives live via Bedrock Sonnet 4.6 (us.anthropic.claude-sonnet-4-6 cross-region inference profile) — verified end-to-end May 14. X-Ray tracing, reserved concurrency, HIPAA 7-yr TTL. 5-job CI/CD pipeline. May 14 fixes: reconciler Lambda was crashing on Athena partition-projection constraint (CONSTRAINT_VIOLATION on injected facility/subject/device columns) — TelemetryDivergence had never emitted; rewrote to enumerate triples from DynamoDB, added IAM + KMS-decrypt + env-var plumbing (commits 3ac32f3 + a93dee3). Bedrock model id unified on us.anthropic.claude-sonnet-4-6 across constants.py + narrative.py + main.tf (b2684ea). Anthropic use-case form submitted; Ella DLQ purged of 56 pre-migration stale messages; MOH-311/312 device rows added; FAC-PILOT-001 orphans removed.

Architect
3/3
Infra
3/3
Deploy
4/4
Validate
2/2
Region
us-east-1
Runtime
Python 3.12
AI
Sonnet 4.6
IaC
CDK v2
Priority Tasks
1
⚠️ BLOCKED — Run provision-batch for FAC-MOCAREV-001 pilot (48 devices: 12 rooms × 4 devices; bed zone = 2 AoPs). Command ready; blocked until EE hardware team supplies all 48 PCB serial numbers. Once serials are in hand: fill rooms.yaml → set AMBIENT_PARQUET_BUCKET → ambientcloud-admin provision-batch --facility-id FAC-MOCAREV-001 --rooms rooms.yaml --output ./bundles/Cloud+Hardware
2
Wait for real device telemetry to start flowing — TelemetryDivergence metric needs ≥1 hour of data before the 48h-of-zero clock can start ticking toward dual-write retirementCloud+Hardware
3
After 48h of TelemetryDivergence=0 in CloudWatch, promote FAC-MOCAREV-001 to parquet_only and retire the Firehose pathCloud
4
Run a CDK deploy of TelemetryStack to re-apply the reconciler IAM + env changes from source (currently live via direct AWS API patch; CDK source is updated in a93dee3 but not yet deployed)Cloud
5
Production sign-off checklist — runbooks dry-run, CloudTrail data event verificationCloud+Security
6
Smoke test suite run against dev tenant post-deploy (pytest -m smoke)Cloud+Security
Current step
12 · Production Sign-Off
12/12 steps
Runbook →
IWR6843AOP enclosure · harness · fab
13%
5/38

PCB design, enclosure, cable harness, fabrication, and validation for the Ambient ceiling-mount radar compute node.

Design
1/3
Enclosure
0/1
Fab
0/2
Validate
0/1
Footprint
100×80 mm
Compute
OSD62x-PM
Radar
IWR6843AOP
Enclosure
IP42
Priority Tasks
1
Complete PCB layout in Altium — route controlled-impedance traces, run DRC to zero errorsLayout
2
Finalize BOM — confirm IWR6843AOP, OSD62x-PM, and all critical passives are in stockProcurement
3
Complete SolidWorks enclosure assembly and print FDM prototype for ceiling-mount fit-checkME
4
Generate Gerber package and submit for DFM review with fab houseLayout
5
RESOLVED 2026-05-17: EVT power = Cincon TR15RAM-12 (12V barrel jack, IEC 60601-1 Ed 3.2). Update PowerTree.SchDoc input rail to 12V. PoE+ deferred to DVT if deployment is SNF/hospital.Lead
Current step
02 · PCB Design (Altium)
1/7 steps
Runbook →
Next.js 16 · pnpm monorepo
100%
20/20

Ella Memory nurse dashboard — live at ellamemory.com. WorkOS email/password auth, HIPAA de-identification, nurse keyring AES-GCM unlock (4-hr idle lock, PBKDF2 600k), identity overlay wired into all 10 dashboard pages (Overview, Floor Map, Alerts, Reports, Analytics, Browse, Room detail, Devices, Archive, Engineering board). May 2026 security audit: assertNoPhi guard at the /api/ambient proxy boundary, /api/push/send locked behind ella-session, signin/signout fixed for local dev, weak cookie-key padding removed, Next.js patched 16.2.4 → 16.2.6, 8 dead deps pruned, audit 17 → 1 vuln. May 14 follow-up: discovered the Next 16 upgrade had silently disabled middleware (file convention renamed to proxy.ts) — auth gate / CSP / PHI-exfil guardrail were dark for ~13 days; one-commit rename (29645a2) restored them. Web push persistence wired: VAPID + EDGE_CONFIG_ID + VERCEL_TOKEN live on Vercel; OPENAI_API_KEY live; pilot-smoke.sh + patch-devices.sh + pilot-runbook.md shipped.

Setup
4/4
Build
4/4
Integrate
2/2
Ship
3/3
Runtime
Next.js 16
Auth
WorkOS
Workspace
pnpm 9
Pilot
12 Rooms
Priority Tasks
1
Get the MOCAREV-NNNN → room number TSV from the pilot coordinator, then run ./scripts/patch-devices.sh with the ella-session cookie (30s for all 12 rooms)Product
2
Execute pilot validation at MOH 301–312 per docs/pilot-runbook.md (8 sections: pre-flight smoke, device assignments, nurse auth, keyring unlock, fall alert E2E, Ella narrative, push persistence, evidence capture)Product+FE
3
Rotate VERCEL_TOKEN + GITHUB_TOKEN — both crossed a chat transcript on May 14 during the Edge Config wire-up; mint new ones, vercel env rm/add interactively, revoke oldDevOps
4
Monitor /api/ambient proxy for 502s — keep AMBIENT_WEB_SVC_PASSWORD in sync with Cognito; assertNoPhi guard will 502 if cloud returns a forbidden fieldDevOps
Current step
10 · Pilot Validation
13/13 steps
Runbook →
AWS Security Hub · GuardDuty · Terraform
76%
19/25

14/20 pre-IRB audit items closed. Security Hub → EventBridge → Lambda → Google Chat pipeline live. GuardDuty, AWS Config, and Access Analyzer active across all 11 CloudFormation stacks. HIPAA §164.312 technical safeguards in place. 6 remaining items gating IRB closeout.

Baseline
3/3
Detection
3/3
Response
2/2
IRB Audit
0/2
SIEM
Security Hub
Detect
GuardDuty
Config
AWS Config
IaC
Terraform
Priority Tasks
1
Close 6 remaining pre-IRB audit items — focus on CloudTrail data event verification and IAM least-privilege review across all 11 stacksSecurity
2
Validate Security Hub → EventBridge → Lambda → Google Chat alert pipeline end-to-end with a synthetic GuardDuty findingSecurity
3
Complete AWS Config conformance pack review — confirm all HIPAA §164.312 technical safeguard rules evaluate COMPLIANTSecurity+Cloud
4
Generate IRB-ready evidence bundle: Security Hub findings export, GuardDuty summary, Access Analyzer report, CloudTrail S3 encryption validationSecurity
5
Schedule penetration test scope review with IRB security officer — agree on scope before closeoutSecurity+Lead
Current step
09 · IRB Audit Closeout
8/10 steps
Runbook →
EI Microcircuits · Gavin Phillips · EVT-0.1
19%
7/36

48-board EVT-0.1 turnkey PCBA procurement. Gerber export, DFM review, RFQ, PO, receipt, BGA X-ray inspection, and PCB serial collection for FAC-MOCAREV-001 pilot provisioning.

Prepare
1/3
Quote
0/3
Order
0/2
Receive
0/3
Vendor
EI Microcircuits
Qty
36 Boards
Process
Turnkey PCBA
Rev
EVT-0.1
Priority Tasks
1
Lock connectivity decision (Wi-Fi/Ethernet/BLE) — last BOM blocker before Gerbers can be submitted.EE
2
Confirm 8 vs 10-layer HDI with Octavo OSD62x-PM layout guide before Gerber submission.EE
3
⚠️ Post-receipt: collect PCB serials for all 48 boards and hand off to cloud team for provision-batch.HW+Cloud
Current step
07 · Fab Order — Blocked
1/11 steps
Runbook →
This Week · Sprint Focus
Firmware
▸Phase 1a (laptop + EVM, do now): plug IWR6843AOP EVM into laptop USB, set AMBIENT_RADAR_DEVICE=/dev/ttyACM1, run ambient-device-agent — validates provisioning, MQTT, parquet upload, TelemetryDivergence without needing AM62
▸Phase 1b (SK-AM62-LP + EVM, do after 1a): plug EVM into SK via USB, repeat deployment — catches glibc/pyserial/systemd/NTP issues on real aarch64 target; this is the main gate before EVT-0.1 arrives
▸Step 16A (parallel with Phase 1): ls /dev/ttyS* on dev board, stty -F /dev/ttyS1 921600, pip install pyserial — identify which /dev/ttyS<n> will be AMBIENT_RADAR_DEVICE on EVT-0.1
▸Phase 1b (do now): SK-AM62-LP + IWR6843AOP EVM over USB-CDC — plug EVM into SK, run ambient-device-agent, verify glibc/pyserial/systemd/NTP on aarch64; main gate before EVT-0.1 arrives
▸ambient-device-agent v2: schema + parquet + S3 done — implement MQTT publisher (QoS 1 fall alerts) next to unblock pilot
EE Hardware
▸MCU.SchDoc: add 64 GB eMMC on MMC0 + micro SD slot (EVT-only DNP) on MMC1 + DFU SYSBOOT strap resistors
▸PowerTree.SchDoc: change input to 12V barrel jack (Cincon TR15RAM-12); add 12V → 5V → 3.3V → 1.8V DC-DC tree
▸Decide physical connectivity (Wi-Fi / Ethernet / BLE) — last remaining Gerber blocker
▸Confirm layer count (8 vs 10-layer HDI) with Octavo OSD62x-PM layout guide
Mobile App
▸Distribute iOS IPA to pilot nurses: send EAS OTA install link (13-day window) or submit to TestFlight
▸Set up Firebase + Android FCM build: google-services.json → setup_android_push.sh → eas build android
Cloud Engineering
▸Watch CloudWatch AmbientIntelligence/Telemetry → TelemetryDivergence (per FacilityId) once devices come online; ≤0.1% over 48h unlocks parquet_only promotion
▸CDK deploy TelemetryStack to re-apply reconciler env+IAM from source (currently live via direct API patch)
Mechanical
▸Route all Altium traces, run DRC to zero errors, export preliminary Gerber
▸Finalize ceiling-mount bracket geometry and print FDM prototype for fit-check
Web App
▸Get MOCAREV-NNNN → room mapping from coordinator; batch-PATCH via scripts/patch-devices.sh (helper shipped May 14)
▸Execute docs/pilot-runbook.md end-to-end at MOH 301–312 — pre-flight smoke, nurse auth, keyring unlock, fall alert E2E, Ella narrative, push
▸Rotate VERCEL_TOKEN + GITHUB_TOKEN exposed during May 14 wire-up before any external sharing of repos or screenshots
Cybersecurity
▸Close 6 remaining pre-IRB audit items — CloudTrail data event verification + IAM least-privilege sweep across all 11 stacks
▸Validate Security Hub → EventBridge → Lambda → Google Chat pipeline with synthetic GuardDuty finding; generate IRB evidence bundle
Cross-Domain Blockers
EE Hardware
⊘
needs Connectivity decision
Antenna count, BOM finalization, and schematic additions blocked until Wi-Fi/Ethernet/BLE/cellular mix is decided — affects PCB layout and cert scope
EE Hardware
⊘
needs Layer count decision
Gerber submission blocked until 8 vs 10-layer HDI is confirmed per Octavo OSD62x-PM layout guide
Firmware
⊘
needs EE Hardware
Custom DTB pin assignments can't be locked until PCB Gerbers are finalized
Mobile App
⊘
needs Apple + time
Apple account -20209 lock + iOS IPA OTA install window expires May 25 — 8 days remaining; must distribute via TestFlight immediately
Mechanical
⊘
needs EE Hardware
PCB outline dimensions needed to finalize enclosure form factor in SolidWorks
Cloud Engineering
⊘
needs Hardware
TelemetryDivergence can't accumulate 48h of zero until real device frames land in the raw Parquet path — gated on EE/Firmware bring-up
Cloud Engineering
⊘
needs Hardware
provision-batch for FAC-MOCAREV-001 pilot (48 devices: 12 rooms × 4 devices; bed zone = 2 AoPs: PT + vitals) is blocked until hardware team supplies all 48 PCB serial numbers. Serials are on PCB sticker; Thing name = DEV-{serial}. Run: ambientcloud-admin provision-batch --facility-id FAC-MOCAREV-001 --rooms rooms.yaml --output ./bundles/
Web App
⊘
needs Pilot Coordinator
Final MOCAREV-NNNN → MOH-NNN room mapping needed before scripts/patch-devices.sh can run
Cross-Domain Integration
Firmware
→
EE Hardware
Custom DTB targets OSD62x-PM BGA carrier; IWR6843AOP GPIO/SPI pin assignments from schematic
Firmware
→
Cloud Engineering
Device publishes to ambient/v1/alerts/fall/{deviceId} (MQTT QoS 1) → IoT rule → alerts-enricher Lambda → SNS. Parquet frames uploaded via url-minter presigned URLs.
EE Hardware
→
Firmware
Power rail sequencing, JTAG header, UART debug pin positions — PCB stackup drives DTB addresses
Cloud Engineering
→
Mobile App
FastAPI + Cognito JWT auth; SNS → APNS/FCM push; facility-scoped alert endpoints feed the app
Mechanical
→
EE Hardware
PCB outline and mounting hole pattern locks enclosure form factor; ceiling bracket bolt pattern matches PCB stackup
Cloud Engineering
→
Web App
Ella narrative API + REST alert endpoints; WorkOS JWT validated server-side; Parquet cold path feeds analytics charts
Cloud Engineering
→
Cybersecurity
Security Hub aggregates findings from all 11 CloudFormation stacks; EventBridge rule triggers Lambda → Google Chat for high-severity GuardDuty findings
Open Decisions
High priority
EE Hardware
Physical connectivity: Wi-Fi / Ethernet / BLE / cellular mix — drives antenna count, schematic, and certification scope. Required before BOM finalization. Recommendation: Ethernet primary + BLE for local commissioning. Wi-Fi optional if module fits.
EE Hardware
Fab house selection — 4-week lead time risk; blocked on connectivity + layer count decisions before Gerbers can be submitted.
Mobile App
iOS IPA OTA install link expires May 25 (8 days from 2026-05-17) — EAS build 36dbf33f. Distribute to nurses via TestFlight or OTA link immediately or the build window closes.
Web App
VERCEL_TOKEN + GITHUB_TOKEN exposed in chat transcript May 14 — rotate immediately. Mint new tokens, run vercel env rm/add, revoke old before any external sharing.
Medium priority
EE Hardware
Layer count: 8-layer vs 10-layer HDI for OSD62x-PM 500-ball BGA escape — 10-layer likely required per Octavo layout guide. Decide before Gerber submission.
Firmware
ambient-device-agent v2 on main: parquet writer + S3 uploader + 15-field schema (AmbientActivityCounts · AmbientOccupancy · AmbientPosture) DONE. 5 remaining: MQTT publisher (QoS 1 fall alerts, QoS 0 aggregates, heartbeats), shadow client, IoT credential refresh loop, offline buffer, clock sync monitor. Blocks first on-board pilot.
Cloud Engineering
CDK TelemetryStack IaC ≠ deployed state — reconciler env+IAM applied via direct AWS API (commits 3ac32f3 + a93dee3 updated source but CDK deploy never ran). Run cdk deploy TelemetryStack to restore IaC-as-deployed parity.
Web App
Ella narrative poll interval — 30 s vs WebSocket for real-time nurse alert delivery.
Low priority
Cloud Engineering
Firehose retirement timeline — 90-day window after all facilities reach parquet_only; not yet contractually nailed down.
Mechanical
Enclosure finish: matte vs glossy ABS — cosmetic only, deferred to Rev B.
Resolved Decisions
4 closed
EE Hardware
Resolved · 2026-05-17EVT power supply — PoE+ vs barrel jack; affects power routing, BOM cost, and enclosure cutout geometry.
Cincon TR15RAM-12 (12V / 1.1A, IEC/EN/UL 60601-1 Ed 3.2). 5.5 / 2.1 mm barrel jack on PCB, 12V nominal to on-board DC-DC rails. No PoE PD circuit on EVT; PoE+ (802.3at) deferred to DVT if the deployment channel is SNF/hospital with ceiling Cat6. Datasheet: workspace/docs/datasheets/Datasheet-TR15RAM-series.pdf
EE Hardware
Resolved · 2026-05-17EVT storage architecture — eMMC part and size, SD-slot population across EVT/DVT/PVT, factory-programming path, Mender partition layout.
64 GB i-temp pSLC eMMC (Kingston EMMC64G-IB29-PZ90) on MMC0. Micro SD slot (Molex 503182-1853) on MMC1 — EVT populated / DVT DNP / PVT removed. Factory programming via USB DFU (DVT+). Mender layout: boot 512 MB | rootfs-A 4 GB | rootfs-B 4 GB | data ~55 GB. Parquet → /data/radar/YYYY/MM/DD/HH/, 15-min S3 upload cadence, local backup.
Firmware
Resolved · 2026-05-17Radar (IWR6843AOP) boot mode — host-fed SPI boot vs autonomous QSPI flash.
Autonomous QSPI. Radar boots from its own QSPI flash; the AM62 sends UART config post-boot and is not in the radar boot path. QSPI flash confirmed on the radar-island BOM. Unblocked the EE fab order. Mender handles radar-firmware OTA.
Firmware
Resolved · 2026-05-15OTA update system — Mender vs SWUpdate; rootfs footprint vs management overhead and 21 CFR 820 audit-trail needs.
Mender, self-hosted (artifact delivery from ambient-platform-infra S3 + signed URLs; Mender Hosted rejected on PHI-boundary / BAA grounds). A/B rootfs with bootcount rollback. Full rationale: ADR-0003 in ambient-device-fw/docs/adr/.