# ADR: Controller B parallel qualification entry policy

Status: accepted
Type: adr
Updated: 2026-08-09
Next Action: execute the complete Controller B preflight under the policy; do not prepare Start until every reported Start blocker clears
Parent: work/wp/completed/wp-watchdog-gated-controller-a-recovery-and-controller-b-start.md
Supersedes: the executable A-local-matrix-complete-before-B scheduling rule in the prior HPT2 matrix implementation
Superseded By:

## Context

The original qualification sequence required all Controller A matrix evidence
before Controller B could begin. That rule was conservative but conflated two
different questions: whether the shared firmware/orchestration/watchdog stack
is safe enough for independent B preflight, and whether A's physical card has
finished collecting every A-specific result. It doubled elapsed qualification
time even after the shared stack had survived the full fault matrix, live A
recovery without command replay, a deployment correction, and sustained
identity-stable progress.

Parallel work is acceptable only if A and B cannot share a probe, endpoint,
lock identity, command intent, evidence attribution, or supervisor projection;
if either controller cannot alter or credit the other; and if B Start remains
closed until its own complete readiness chain passes. Powered SD-card removal
remains prohibited and is unrelated to this scheduling decision.

## Decision

Replace the matrix-derived `controller_b_execution_allowed` rule with a
reviewed, protected, SHA-256-bound two-decision policy:

1. `preflight_allowed` opens only Controller B readiness work. It requires the
   exact policy, Stage 2/4 evidence identities, distinct A/B registry probes,
   distinct endpoint and lock namespaces, exact A/B assignments, and at least
   three current same-run/same-deployment A supervisor snapshots spanning 60
   seconds with stable identity and monotonic progress.
2. `controller_b_execution_allowed` opens one B Start only after the first
   decision passes and B is `HPT2_MEASUREMENT_READY` with a current valid CID,
   same-CID completed baseline scrub and HPT initialization, an admitted
   running B run, no unresolved/prior Start intent, and an explicitly enabled
   policy-matching B HPT2 endpoint.

B admission evaluates the preflight decision before any controller
observation. B Start evaluates the stricter decision before intent creation
and again immediately before target access. A later policy closure does not
block an authorized Stop for an already-started session. Effective decision
changes append one campaign event containing the policy identity, review
reference, evidence snapshot hashes, decision, and blocking reasons. The card
web page shows the same separate Preflight and Start states.

The policy permits A-specific closeout evidence and B preflight to overlap. It
does not permit A evidence to credit or dispose B, B evidence to credit or
dispose A, automatic Start/Stop, or any manual database override.

## Consequences

Positive:

- B preflight can begin while A continues its long card-specific observation,
  removing the unnecessary serial delay.
- Missing policy, stale/divergent A supervision, resource collision, and every
  incomplete B prerequisite fail closed with reviewer-visible codes.
- The old matrix result can no longer silently authorize B; the independent
  policy and Start prerequisites are auditable.

Negative:

- Deployment must maintain one additional protected policy and exact SHA-256.
- The UI and command paths perform additional database and configuration
  checks; a stale A snapshot intentionally blocks new B action.
- Stage 6 still requires all physical B preparation and evidence, so this
  decision saves scheduling time but does not shorten qualification coverage.

## Alternatives Considered

- Keep the complete A-before-B sequence: safest operationally but adds days
  without improving independence once the shared stack is proven.
- Open B after a fixed A elapsed time: rejected because time alone does not
  prove identity, progress, deployment, or resource isolation.
- Allow B from A-local matrix completion: rejected because it couples card
  evidence to orchestration authority and was the serial rule being replaced.
- Manual reviewer override: rejected because it is not reproducible,
  fail-closed, or visible to every command path.

## Supersession Notes

Current operating truth is also promoted to the Pi repository in
`docs/controller-b-parallelization-policy.md`. Earlier matrix evidence remains
historical and valid for its measurement purpose; only its B scheduling effect
is superseded.
