# SD Qualifier natural-completion detour evidence — 2026-08-13

## Scope

Application-only detour required to recover and continue campaign
`8c7a2b1a-7e67-48ac-8895-7999d76c4c2a`. No firmware change, card removal,
card insertion, controller programming, or powered-media operation was used.

## Original contradiction

- Run `5615cadf-8a0d-4188-88b7-d8cc2cb90ba6` remained `RUNNING` in the app.
- Authoritative Controller B status was clean `COMPLETED` with attempted,
  committed, and verified counters all `129600`, checkpoint `5`, terminal
  proof `31`, CID `05000C61736466672200001C8201A379`, and boot witness
  `B0701112D9443248`.
- Start `ee2cb847-3145-4df9-afdc-948d8803fa59` was acknowledged.
- The later Stop `0c815f7d-8a34-4ac7-9c27-fdef1d4901ba` was durably rejected
  with API status `29` and rejection reason `6` because the session had
  already completed.

## Delivered correction

- Integrated deployed coordinator commit `8eaa33e` and web closeout commit
  `520014c` from common base `928d2ce`.
- Added clean terminal-completion observation and finalization for HPT2 cases
  that naturally finish before an accepted Stop.
- The finalizer accepts only one acknowledged Start and, optionally, the exact
  read-only already-completed Stop rejection. It requires two stable identity-
  matched clean completion observations.
- Natural completion is recorded as
  `NATURAL_COMPLETION_CASE_TRIGGER_NOT_MET`, closes the controller session,
  and awards no case or matrix credit.
- Base runners check for natural completion before preparing Stop and after a
  rejected Stop. The helper is installed beside the runtime runners and is
  sourced relative to the executing script.
- Existing S5 and S6 runners and immutable evidence producers were confirmed
  present; their prior “producer required” findings represented zero evidence,
  not missing implementation.

## Validation

- ARM64 image build succeeded.
- Focused tests: 28 of 28 passed (`test_hpt2_extended`,
  `test_hpt2_measurement`, and `test_campaign_coordinator`).
- Adjacent mailbox/closeout/view regression: 119 tests passed in the combined
  run; the two environment-only failures caused by an unwritable `/app/evidence`
  test path passed when rerun with the required writable tmpfs (2 of 2).
- Shell syntax validation passed for the installer, helper, and both base
  runners.
- Pre-deployment database backup and restore check passed at
  `/backups/sd-qualifier-20260813T122315Z.dump`.
- A second pre-redeploy backup was recorded at
  `/backups/sd-qualifier-20260813T122956Z.dump`.

## Deployment and live recovery

- Active release: `campaign-completion-7e836bf`.
- Source commit: `7e836bf15920aac5daa4b599183af0193176fc82`.
- Image ID: `sha256:79dd603c79eec179d0d6e1de363620ed6e605e9a98d6db1ebb7f6d4c7b1a48c8`.
- Web, command worker, campaign coordinator, notification worker, and
  qualification watchdog all run that exact image and source identity.
- Live recovery completed run `5615cadf-8a0d-4188-88b7-d8cc2cb90ba6`
  without replaying Start or issuing another Stop.
- Completion evidence `16959` records `session_closed_cleanly: true`,
  `case_accepted: false`, the rejected Stop operation ID, and two stable
  terminal observations.
- Controller B S1 remained truthfully at `2 / 10`; no matrix credit was
  manufactured.
- The failed coordinator task was reconciled through the web with exact
  evidence and resumed. A subsequent installed-helper path defect failed
  before admission with zero active runs; it was corrected in `d4df0f2`,
  reconciled through the web, and resumed.
- Live continuation then admitted Controller A S1 run
  `5729773a-8957-4f58-a857-e20f472f7f3a` and Controller B S1 attempts under
  the reviewed parallelization gate.
- The continuation exposed two further application-control defects. Stop
  preparation and the terminal pre-write capture occurred too early for a
  useful exact boundary, and an exhausted B attempt budget continued to launch
  A-only proving windows. The deployed correction stages the mailbox under its
  odd sequence, captures status immediately before the single even publication
  write, and exits the task when B's bounded budget is exhausted.
- A killed runner left task `403b9e4a-1f28-40bc-a0f5-4df736322cfb` in an
  expired `CLAIMED` lease. Release `7e836bf` adds the same reviewed web
  reconciliation control for an expired claim that already existed for a
  failed task; it never auto-replays the task.
- Exact-image ARM64 validation passed `94 / 94` focused mailbox, measurement,
  coordinator, and natural-completion tests. Backup and restore-check passed at
  `/backups/sd-qualifier-20260813T130850Z.dump` before deployment.
- All stranded A/B runs were closed with one acknowledged Stop each and stable
  terminal proof. Evidence `17215`-`17216` and `17226`-`17227` preserves the
  no-trigger B and observed-S3 A outcomes; no planned S1 credit was inferred.
- The expired task was reconciled through the web using those evidence IDs,
  resumed, and claimed as attempt 4. The corrected B run
  `282ef6dd-47ef-498f-8332-1199d7fcec23` then passed S1 from immutable observed
  counters, proving the staged publication correction on the target.
- Attempts 4 and 5 terminated with zero active runs and zero unresolved command
  operations. A pre-admission cleanup added in `61e77a7` prevents a failed B
  preflight from leaving an empty `RUNNING` row.
- Attempt 5 exposed an appliance support fault rather than a qualification
  result: Controller B J-Link Remote Server `69660123` was listening but failed
  read-only target access. Only `jlink-remote@jlink-69660123.service` was
  restarted; Controller A, firmware, power, and media were untouched. A fresh
  read-only Controller B capture then succeeded.
- Attempt 6 recorded three consecutive truthful Controller B S1 passes,
  increasing S1 from `7 / 10` to `10 / 10`. Controller B base progress is now
  S0 `3 / 3`, S1 `10 / 10`, S2 `1 / 10`, and S3 `19 / 10`.
- Commit `831e65c` adds a narrow runtime release signal for the long Controller
  A proving window. Once useful B work ends, it publishes A's already-prepared
  Stop instead of idling to the 25-minute safety ceiling. The source and
  installed runtime scripts have matching SHA-256 values, and Pi shell syntax
  checks plus the focused packaging tests passed.

## Current state

The original natural-completion correction and the required appliance-support
detours are proven in the target environment. Controller B S1 is complete; the
coordinator has advanced to Controller B S2 and will use the released proving
window behavior beginning with that node. The campaign remains active until
the remaining matrix and closeout nodes produce a final conclusion.
