# Controller B base matrix pass and S4 parallel launch — 2026-08-09

Status: PASS for B base coverage and watchdog cleanup; Controller B S4 is active under independent supervision
Type: evidence
Updated: 2026-08-09
Next Action: preserve both active S4 runners; let the ordinary A/B S4 matrices finish, then run the combined audit before admitting recovery or regression
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Controller B base result

The serialized Controller B base campaign finished with strict audit coverage:

- S0: `7/3`, PASS;
- S1: `11/10`, PASS;
- S2: `37/10`, PASS;
- S3: `10/10`, PASS.

The final three S3 contributions came from independently observed clean
boundaries during guarded S0 hold cases; no case label or acceptance threshold
was weakened. The prior base parent completed and was collected only after its
broader whole-matrix audit remained non-pass, as expected while S4-S6 were
still open. Controller B then had no active run, unresolved prepared/published
operation, observer, or temporary firewall allowance.

## Forced-stop watchdog cleanup correction

Stopping the final B observer exposed a dead-owner firewall allowance after
systemd exhausted `TimeoutStopSec=30s` while a root-owned adapter client
remained in the unit cgroup. The exact stale rule was handle `7001`, owned by
dead observer PID `2310272`; only that handle was removed.

Operations commit `e0a1a95` adds `ExecStopPost` cleanup to both observer units.
The cleanup validates role A/B, parses only `sdq-supervisor-{role}-{pid}`
comments, refuses to remove a rule whose owner PID is alive, and deletes only
dead-owner handles. Verification included shell syntax, 16 focused tests, and
a live synthetic dead-owner rule: B handle `7019` was present before cleanup
and absent afterward. Both deployed units report the exact cleanup command.
Controller A's observer and S4 runner were not restarted; A retained invocation
`8bf2ff84f9cb432db4b74edffe00ee6c`.

## Controller B S4 route and live proof

Operations commit `beb5a57` makes the proven progress-aware S4 runner
role-scoped while preserving A defaults. B is bound to sample `F1-B1`, CID
`05000C61736466672200001C8201A379`, endpoint port `19121`, role-B admission,
role-B status capture, exact-boundary resume assertions, and the independently
configured B observer. Exit cleanup stops the B observer and verifies that no
role-B supervisor rule or unresolved command remains. The complete operations
suite passes `44/44`, plus shell syntax and `git diff --check`.

Transient service `sdq-controller-b-s4-matrix-v1.service` started as invocation
`37c155294d11410eba9cc108b274dedd`. Its first exact S4 run was
`56fae1e7-8dc7-4d8b-bf6b-c114e53228f1` at `1440 / BEFORE`; Start operation
`fa169129-c471-4d8e-9275-966b3c8f0345` was acknowledged once. The B observer
bound expected stage S4, the exact runner service/invocation, and transition
`B_S4_NEXT`. Live progress advanced from `184/184/183` to `698/698/697`
attempted/committed/verified records with checkpoint `0` and terminal reason
`0`.

That first run then reached the exact `1439/1439/1439` boundary, acknowledged
Stop `7c93f8e6-930b-448c-bfda-919bf1a695f2` once, and passed two stable
stopped-clean observations. Its parent exited when the first base-adjudication
command returned transiently after finalization; the EXIT path stopped the B
observer and left the firewall deny-only. Re-running the append-only
adjudication without controller access produced evidence `3570`; extended
evidence `3571` credited S4 `1440 / BEFORE` observation 1 of 3. No Start or Stop
was replayed.

Operations commit `c4990b2` applies the base runner's durable-evidence
confirmation pattern to both S4 adjudicators and retains the `44/44` passing
suite. Successor service `sdq-controller-b-s4-matrix-v2.service`, invocation
`c0e283d128d04dcfa5d7f94a5bcb2d4e`, resumed from credited count 1. Its second
run `54cfeb8f-2fbb-42f9-ac22-a1572f873935` acknowledged Start
`216a6e34-047b-4157-abbd-a6ec54f94900` once, reached the exact boundary,
passed both stable stopped-clean observations, and confirmed both adjudicators
on attempt 1. The parent credited observation 2 of 3, stopped the observer with
no stale B rule, and immediately began observation 3 from credited count 2.

Controller A remained active on run
`de340af2-d505-495e-a14f-5159e55b1633`, the same runner invocation, and
advanced to `36211/36211/36210` at S4 `44640 / AFTER`. A and B target access
uses separate bounded locks, and the firewall returned to default deny between
observations. No SD card was removed, inserted, or reinserted; B retains boot
witness `F54F10127F443248` and the same full CID.

## Remaining boundary

This evidence does not close the measurement campaign. Both ordinary S4
matrices, final `129600 / AFTER`, identity-local S5/S6 coverage, recovery,
representative A/B regression, final full-address scrubs/CID captures, combined
review, and production Stop deadline approval remain open. Post-matrix work
stays blocked until the combined audit passes.
