# Controller A recovery and automated closeout checkpoint — 2026-08-06

Status: implementation and deployment chain ready; exact S4 measurement is running
Type: evidence
Updated: 2026-08-06
Next Action: let the persistent Controller A chain finish S4, identity-local S0/S5/S6, final AFTER cycles, five recovery cases, automated regression, post-campaign scrub, and final observation
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md
Canonical Truth: docs/hpt2-measurement-matrix-v1.md

## Standing execution contract

The owner authorized the complete Controller A lab run without repeated
operator approval stops. Controller A programming, measurement, qualified
whole-controller power cycles, recovery, regression, and post-campaign scrub
are in scope. Controller B remains disabled and untouched. Powered SD-card
insertion or removal is not part of the campaign.

## Persistent measurement chain

The Pi user services continue in this fail-closed order:

1. `sdq-controller-a-s4-matrix-v3.service` completes ordinary S4 regions.
2. `sdq-controller-a-after-ordinary.service` collects fresh S0-S3, S5, and S6
   evidence under the exact S4 firmware identity.
3. `sdq-controller-a-final-after.service` collects all three terminal
   `129600 / AFTER` observations with qualified Controller A cycles.
4. `sdq-controller-a-after-final.service` deploys the reviewed recovery image
   and executes all five interrupted-session recovery cases.

The S4 runner retries only unstable read-only status observations. It never
replays a Start or Stop after target access. One transient status-read failure
on run `09c9ddd9-541f-418d-93c7-3af88997946d` was resumed from durable exact
state without replay; the eventual Stop and evidence publication remained
one-shot.

At this checkpoint, all `1440` regions are `3/3`, `2880 / BEFORE` is `3/3`,
and `2880 / AT` is in progress. The service is active and Controller B remains
at `INTAKE`.

Pre-execution audit found that checkpoint-held S4 rows cannot be assumed to
fill the S1/S2 base-case minimums. The deployed post-S4 runner now measures
fresh observed S1 and S2 boundaries until both are at least `10/10`, while
retaining every valid S3 observation. It uses a bounded eight-offset sequence,
at most 120 fresh one-shot runs, and requires every run to add exactly one
observed S1/S2/S3 adjudication. Start and Stop publication remain one-shot.

## Recovery implementation identity

Pi commit `d47a9b1923ceac89fa3bd6e9381fda49c28afa6d` adds append-only,
no-replay evidence producers for:

- disconnect before publication;
- disconnect after publication but before acknowledgement;
- disconnect after acknowledgement but before terminal observation;
- Pi application restart with an unresolved publication; and
- qualified whole-controller power interruption during an active run.

Exact release `hpt2-recovery-d47a9b1`, image
`sha256:3fe6033aeed0981376e31ebd674bbc7a9ffc2705f6f1bd89bc50388142bbfd45`,
passes the complete `228/228` application test suite. Deployment is staged
behind the zero-active-run gate and does not change firmware or card identity.

## Automated regression and final scrub

A hidden Windows orchestrator is waiting on the recovery service. After the
five-case recovery gate passes, it runs only Controller A operations:

- exact flash/CID/HPT and system-error identity capture;
- normal logging and retained chart rebuild;
- graph open, zoom, and pan review commands;
- reversible configuration save followed by exact setpoint/VEEPROM restore;
- lane append/read, retained readback, and wrap/export-core diagnostics;
- the four established USB Mass Storage/BOT source and model regressions;
- a CID-linked `15,728,640`-sector post-campaign full-address scrub; and
- a final exact-flash, CID, three-lane, zero-error read-only observation.

All final raw output remains under ignored generated-evidence roots. The Pi
records a small immutable regression summary plus the scrub and observer
bindings. The chain explicitly asserts that neither Controller B nor T00 was
contacted.

No identified representative USB specimen is installed in Controller A, and
the bench has no actuator or USB mux that can insert a drive and later move it
to an independent reader. The automated chain therefore preserves the USB
customer-publication/independent-reader item as a precise physical gate instead
of claiming it passed. This gate does not stop the remaining automated
Controller A work.
