# SD qualifier S4 final-target admission policy release — 2026-08-10

## Result

The Pi qualifier release `s4-admission-policy-2167623` is deployed from source
commit `21676239b350deb23a8817f4f817e6f79c08ac96`, image
`sha256:c960588ab5e7c7c48b680c3bd3996e82d9243e797a878470c27b6ddb786d0c3e`.
The release package at
`/home/jong/releases/s4-admission-policy-2167623` passed its SHA-256 manifest,
Compose resolution, image identity, and Django system checks.

The focused ARM64 policy/matrix/view suite passed 52/52. The full ARM64 suite
passed 314/314 with `SDQ_EVIDENCE_ROOT=/tmp/evidence`. The exact final commit
then changed only Compose propagation and passed exact-image build, Compose
validation, and Django system checks.

## Live verification

- `44640` admission: allowed.
- `129600` admission: rejected with `S4_129600_PLANNED_HOLD` before controller
  observation or run creation.
- Web, command worker, notification worker, and watchdog: running the new image;
  web health passed.
- Controller A runner invocation:
  `496dbd96a55e45aaa6333b7fbd8f5a67`, unchanged.
- Controller B runner invocation:
  `fa196d1f1db54a6c8a4fd9c806f48c00`, unchanged.
- A continued at S4 44640 AFTER with monotonic progress; B continued at S4
  44640 BEFORE with monotonic progress.
- Both supervisors reported `QUALIFICATION_SUPERVISOR_HEALTHY` and there were
  zero open interventions.
- Each current run retained only its acknowledged Start; no Stop was prepared
  by deployment and no unintended controller command was issued.

The rendered-view suite verifies the planned-hold callout and withheld
downstream dates. Live visual browser inspection was unavailable because no
in-app or extension browser was connected in the session; this is an
unperformed visual check, not a product failure.

## Rollback

The prior image and override remain available as
`qualification-traveler-reference-0acdb5e`. Rollback must not interrupt a
current controller session and must preserve the new-run gate until its safety
condition is reviewed.
