Field note
Who owns the bootloader when three teams touch flash
Ownership patterns that reduce thrash when platform, application, and manufacturing all write to the same device.
On many products, platform engineers own early boot, application teams own everything after main, and manufacturing owns a programming jig that silently rewrites partitions. Without a named owner for layout and signing keys, each group invents a local truth.
Assign a layout steward
One person (with a backup) owns the memory map document and approves changes. That steward does not write every byte; they refuse contradictory layouts. Publish the map where hardware and test can see it, not only in a firmware private repo.
Separate keys from heroes
If only one engineer can sign images, vacation becomes a delivery risk. Document key custody and rehearsal of the signing path before the first field update, not during an incident.
Make manufacturing a stakeholder
Invite the fixture owner to layout reviews. Their constraints — programming time, verify steps, recovery when power drops — belong in the same conversation as secure boot ambitions.