# Pi HPT2 selected contract and producer deployment — 2026-08-05

Status: pass; selected contract and first fail-closed producers deployed, no target access performed
Type: evidence
Updated: 2026-08-05
Next Action: implement controller-sourced S5 contention and S6 segment-transition/reclaim identity before further target execution
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-resolve-hpt2-s4-s6-evidence-contract-gaps.md
Canonical Truth: docs/hpt2-measurement-matrix-v1.md

## Result

The selected contract is implemented and deployed on `srv-rpi00.local`:

- final S4 `129600 / AFTER` accepts only two stable terminal `COMPLETED`
  snapshots with exact final counters and proof;
- ordinary S4 regions are derived from exact immutable pre-Stop and stable
  terminal counters, not a planned case label;
- Controller A-local S6 is provisional and can enable B only after every
  A-local S0-S6 gate passes;
- final S6 still requires both controller variants;
- nominal S6 APPEND/READ maxima are derived from immutable terminal counters;
- wrong-producer, mutable, malformed, caller-declared, ambiguous, or
  contradictory extended rows fail closed.

No controller endpoint was opened, no command adapter or observer was run, no
target write occurred, and no campaign evidence row was appended during this
software deployment.

## Exact image and package

- Pi source commit: `80940471aeab417ddaff3396e7809ee2c530573d`.
- Release identity: `hpt2-contract-8094047`.
- Deployed image: `sha256:70ac8f82b33b025f176e66178c6678b76425bd1449240bafdb943fd2f1c8b3dc`.
- Release manifest SHA-256:
  `141c948d7834d74e84de5709f036eb31281e1fa9306cd8defd308ac68fbc135b`.
- `SHA256SUMS` verified every packaged file, image archive, SBOM, and manifest.
- The three application services report the exact release identity, source
  commit, and image digest above.

## Verification

- Python compilation passed for the audit, new producer/finalizer, management
  commands, and tests.
- The exact image discovered and passed `205/205` tests in `44.533 s` with
  `SDQ_EVIDENCE_ROOT=/tmp/evidence`.
- An earlier standalone-container invocation omitted a writable evidence root;
  its only two errors were existing S0 tests failing to create `/app/evidence`.
  The corrected invocation changed only the test mount/environment and passed
  the identical image.
- Backup `/backups/sd-qualifier-20260805T221139Z.dump` completed, and an isolated
  restore check passed before service replacement.
- Migrations reported no pending changes.
- Storage preflight passed with atomic rename/readback verification and no
  findings.
- Web became healthy; command and notification workers remained running.
- Default nftables isolation still drops non-loopback TCP ports `19120` and
  `19121`.
- No observer, programmer, scrub, HPT2-command, or initialization tool
  container remained.

## Live fail-closed audit

Campaign `7f13c433-e904-4320-a0d1-33d503057f69` reports:

- Controller A: S0 `3/3`, S1 `12/10`, S2 `11/10`, S3 `12/10`;
- S4 `0`, S5 `0`, S6 `0` and zero extended adjudication rows;
- `final_s4_after_region=TERMINAL_COMPLETED_SNAPSHOT`;
- `controller_a_s6_disposition=PROVISIONAL_UNTIL_CONTROLLER_B`;
- `controller_a_local_gates_pass=false`;
- `controller_b_execution_allowed=false`;
- `matrix_pass=false` and `profile_stop_deadline_ms=null`.

The remaining implementation gaps are the real producer surfaces for S4
campaign observations, S5 production-queue contention, and S6 slow-path
identity. The S4 software producer exists but correctly contributes nothing
until new immutable controller observations are collected. Current firmware
does not expose segment-transition/reclaim identity, so S6 cannot unlock B yet.
