# Ticket: Resolve HPT2 S4-S6 evidence contract gaps

Status: complete
Type: ticket
Updated: 2026-08-05
Next Action: none; controlled Controller A S4-S6 collection continues in the parent checklist
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md

## Problem

At ticket opening, the strict Controller A S0-S3 matrix passed, but the
firmware/coordinator ABI could not durably prove S4 checkpoint regions, S5
normal production-log queue contention, or S6 segment-transition/reclaim
identity. Two requirements were also internally contradictory:

- profile v1 transitions to `COMPLETED` in the same service slice that reaches
  the final 129600 checkpoint, so a later RUNNING/STOPPED_CLEAN S4 AFTER region
  cannot exist;
- S6 requires both controller variants, but Controller B is prohibited until
  Controller A's complete measurement set passes.

The selected disposition is now canonical in
`docs/hpt2-measurement-matrix-v1.md`: two stable terminal `COMPLETED` snapshots
provide the final S4 `129600 / AFTER` observation, and A-local S6 is provisional
until B contributes valid cross-variant evidence. The audit must not enable B
until every A-local S0-S6 gate passes.

## Expected Behavior

The reviewed contract must define reachable S4 regions and an unambiguous A/B
sequence for cross-variant S6. Firmware and Pi must then expose and preserve the
smallest evidence surface needed to prove checkpoint observation, genuine
production queue contention without loss, and the slow append/read/segment or
reclaim path. Qualification instrumentation must remain separate from normal
production behavior.

## Acceptance Criteria

- [x] Decide whether final-checkpoint S4 AFTER is removed, redefined as the
  terminal completion snapshot, or made reachable by an explicitly
  qualification-only observation state.
- [x] Reconcile the A-first gate with S6's both-variant requirement without
  authorizing B prematurely.
- [x] Define immutable S4 metadata for checkpoint target/region and prove that
  checkpoints remain observation-only with no hidden media operation.
- [x] Define immutable S5 queue-depth/contention, priority, drop, and loss
  evidence sourced from production logging rather than a synthetic queue.
- [x] Define immutable S6 path identity and timing fields for append, read,
  segment transition, and reclaim, including both hardware variants.
- [x] Implement append-only evidence producers and negative tests that reject
  missing, malformed, caller-declared, or contradictory proof.
- [x] Pass the full exact-image suite and deploy after backup/restore; retain
  `stop_deadline_ms=null` and Controller B disabled until the corrected gate
  explicitly allows the next step.

## Verification

Run `python manage.py audit_hpt2_measurement_matrix --campaign-id <id>` against
fixtures for every valid and invalid S4-S6 proof shape, then against the live
campaign. Verify exact-image tests, release labels/package hashes, backup and
restore, healthy services, default firewall isolation, zero residual tool
containers, and no extended credit before a real producer exists. Deployment
evidence is in
`work/evidence/pi-hpt2-s4-s6-fail-closed-matrix-audit-20260805.md`.

## 2026-08-05 implementation checkpoint

The Pi implementation now derives ordinary S4 regions from exact immutable
pre-Stop/terminal counters, derives the final S4 AFTER region only through a
separate two-snapshot terminal-completion finalizer, and rejects wrong-producer
or caller-declared rows. It also derives unambiguous APPEND or READ S6 maxima
from terminal counters and implements the provisional A-local S6/B-enable
gate. S5 controller-sourced contention and S6 segment-transition/reclaim path
identity remain open, so the live campaign still receives no new credit and B
remains disabled.

Exact image `sha256:70ac8f82...b3dc` passed `205/205` tests and is deployed as
`hpt2-contract-8094047` after package verification, backup, and successful
restore check. The live audit records both selected contract decisions while
keeping all unsupported extended counts at zero. See
`work/evidence/pi-hpt2-selected-contract-and-producer-deployment-20260805.md`.

Pi commit `9d7e0f0` closes the remaining producer gap from the unchanged exact
firmware map. Image `sha256:24bb3439...69ee` passed `210/210` tests and deployed
after verified package, backup, and restore. S5 and transition/reclaim proof now
have strict controller-sourced, append-only paths; no target was accessed and
the live audit remains unchanged. See
`work/evidence/pi-hpt2-unchanged-firmware-runtime-evidence-deployment-20260805.md`.
