# Controller A HPT2 bounded-stop measurement checkpoint

Status: partial-pass
Type: evidence
Updated: 2026-08-05
Next Action: obtain an exact new-bundle programming/admission envelope, program and independently verify Controller A, recapture boot/CID identity, then resume S0 measurement
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md

## Result

The Pi coordinator now admits, observes, finalizes, and adjudicates bounded
HPT2 measurement runs without treating measurement safety ceilings as a
production deadline. Two exact Start/Stop runs on Controller A reached stable
`STOPPED_CLEAN` with terminal proof `0x1F`, unchanged boot/CID identity, all
three lanes active, no failure, retirement, mismatch, loss, or replacement
request, and exactly one acknowledged Start and Stop publication per run.

Both runs contribute valid S3 clean-boundary observations. The first run was
planned for S0 but its Stop arrived after substantial verified work; it is
therefore retained as S3 and does not count toward S0. Current Controller A
matrix progress is S3 `2/10` and S0 `0/3`. No Controller B HPT2 operation has
started.

The largest observed upper bound from Stop publication completion to the first
coherent terminal observation is `2051 ms`. This is only an observation. The
profile's production `stop_deadline_ms` remains `null` until the complete A/B
matrix, required retry/recovery evidence, representative regression, and owner
review pass.

## Frozen identities

- Campaign: `8f3fe483-c783-4170-a720-3c2df3a48fd6`, version 4, state `RUNNING`.
- Controller A assignment: `13`, stage `HPT2_MEASUREMENT_PARTIAL`.
- Controller B assignment: `14`, stage `INTAKE`.
- Firmware bundle: `smi-00-05-00-b845d4b9bcfe-4f37e97877d8-release`.
- Complete code-flash SHA-256: recorded by the Pi evidence as
  `aed8...242` (abbreviated here; the immutable evidence row retains the full
  digest).
- Boot witness: `5C940A1276443248`.
- HPT2 matrix authorization envelope:
  `20052051-7bc9-4bca-bc6a-37ea5ce9d208`.
- Profile: `HPT2_ENDURANCE_BASELINE_V1` version 1; production
  `stop_deadline_ms=null`.
- Measurement context only: heartbeat observation ceiling `3000` ticks and
  stop observation ceiling `30000` ticks, explicitly classified
  `MEASUREMENT_OBSERVATION_CEILING_NOT_PRODUCTION_DEADLINE`.

## SD identity block

The baseline and both measurement preflights report the same card identity.
Latest capture is CID capture `12`, linked to the second run's same-run
preflight evidence.

- Protocol/card status: `DETECTION_READY; RAW_HPT; DRIVER_OK`.
- CID-valid status: true.
- Representative-sector-read status: true.
- Manufacturer: KEXIN / unknown decoded manufacturer name; MID `0x05`.
- OEM/application ID: `0x000C`.
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7305` (`0x00001C89`).
- Manufacturing date: 2026-03.
- Complete raw 128-bit CID: `05000C61736466672200001C8901A34F`.

## Run evidence

### Planned S0, adjudicated S3

- Run: `7991b71b-7540-46be-8510-85992b9234d5`.
- Start operation: `44512b15-ab21-4d36-a40c-13e2a0d03579`; request
  `ec2c6aad-9622-4f69-8cc7-ba18885fbfcc`; command/publication sequences
  `1/2`; mailbox SHA-256
  `67d7efa276670a041d9a564ac0636e41d0af3a0811ee8f7dce59b7ed3dd53924`.
- Stop operation: `0701373d-0a08-45b4-be17-e6148c154c8b`; command/publication
  sequences `2/4`; mailbox SHA-256
  `de702e90ad81b1ad42c72d4f58c7ac4c8e03af409a875ea17b1c3bb4460af32f`.
- Stable terminal Evidence `51`/`52` has one raw status SHA-256
  `d0d5c26a...e61021` (abbreviated here).
- Attempts/committed/verified: `1336/1336/1336`; max append/read: `3/3`
  ticks; Stop-to-terminal observation upper bound: `2051 ms`.
- Result Evidence `53`, SHA-256 `e9acbba...d0dfa` (abbreviated here).
- Append-only case adjudication Evidence `54`, SHA-256
  `e2c0deb...ba126` (abbreviated here):
  planned S0 rejected, valid S3 contribution accepted. The coherent status
  captured immediately before Stop publication was clean RUNNING at
  `1335/1335/1335`; terminal status added exactly one finishing unit.

### Planned and adjudicated S3

- Run: `259a9a0d-0e70-45b3-baa8-3df850b5232e`.
- Start operation: `e8b2a57a-6e63-4bae-8a0b-2ed60f34c3c7`; request
  `dc2ebd04-6844-4e00-a52f-6d7e43372581`; command/publication sequences
  `3/6`; mailbox SHA-256
  `97bc300db6ee52b5b6dafe94380fadb0dcd3fc5bc0535717ebfd0a9191fa3af8`.
- Stop operation: `64ae8ed6-3943-42a3-9860-2733953521d6`; command/publication
  sequences `4/8`; mailbox SHA-256
  `e4c7880db236e10bbf2252a965973267ab814d3cf03410306f83e064f13df064`.
- Stable terminal Evidence `65`/`66`: `STOPPED_CLEAN`, reason `0`, proof
  `0x1F`; Stop-to-terminal observation upper bound: `2036 ms`.
- Result Evidence `67`, SHA-256 `94cf2b0...8c010` (abbreviated here).
- Append-only case adjudication Evidence `68`, SHA-256
  `a189aca...92ceb` (abbreviated here):
  planned S3 accepted as `CASE_PASS`.

## Coordinator implementation and verification

Pi commits `5e0e6cf`, `c92fb17`, `fd380b0a`, and `686a61e` add measurement
admission, exact status observation, bounded-stop finalization, append-only case
adjudication, and clean sequential-run admission. The deployed release is
`hpt2-sequential-admission-686a61e`, source
`686a61e5dad722f7d9e8c6f2baaf723de035a10c`, image
`sha256:c8abfc0e1dbaa38f015b2f20309c85f21e51ffb3700b0473b8aba043db93b0fa`.

Focused tests pass `41/41`; the full host suite passes `173/173`. Pre-change
database backups and restore checks passed for
`sd-qualifier-20260805T151000Z-pre-hpt2-measurement.dump` and
`sd-qualifier-20260805T152000Z-pre-hpt2-finalizer.dump`.

Post-run health remains ready for database, evidence storage, clock, web, and
both workers. State-changing/live profile readiness and bounded-stop/recovery
claims remain false. The default firewall again drops non-loopback access to
ports `19120`/`19121`; temporary roles/endpoints were removed; no observer or
command-adapter tool container remains; Controller B stays disabled.

## Automated S0 attempt and reconciliation correction

Pi commit `7c45de38a5f13deff774e81c666750d1fe5de508` added a
measurement-only S0 sequencer that publishes a prepared Start exactly once,
reconciles it read-only, derives a distinct immutable Stop only after Start is
acknowledged, then publishes and reconciles Stop. Focused tests passed `43/43`
and the exact-environment suite passed `175/175`. Backup
`sd-qualifier-20260805T160141Z-pre-s0-sequencer.dump` has SHA-256
`7e00364b41c4dce3d4590a78514ed54852483304e4d764dc42d86c08625cc864`
and passed `pg_restore --list`. Release `hpt2-s0-sequencer-7c45de3`, image
`sha256:0e418fa19c21bc6a7f08b33ff056db10709f32755083b0d46bb01acc2b2b8eb3`,
was packaged with all release hashes verified and deployed before execution.

Run `7c7d9812-fbff-4cc0-9920-13e801cdee3a` was admitted as S0 under the
existing exact matrix envelope. Its Start operation
`b115baa7-8762-4abd-b081-f5ab9160da5f` used authorization `6`,
command/publication sequences `5/10`, and mailbox SHA-256
`5a096f847e2df1d83596f0e68b5d428b2b22629791da88cd3f6061b8ec556eb9`.
The sequencer published it once. Initial read-only reconciliation detected
changing RUNNING status and left the operation reconciliation-required; a
separate read-only retry then acknowledged the same operation without replay.

After acknowledgement, Stop operation
`9eaa48e6-9866-41f9-8fb5-985f84e9d823` was derived under the same envelope.
It used authorization `7`, command/publication sequences `6/12`, and mailbox
SHA-256
`cf533ee5db6b41b647cea01acc292641a36579b9bd7f2cb5189d543dea86510c`.
It was published once and acknowledged. Stable terminal Evidence `79`/`80`
reported `STOPPED_CLEAN`, proof `0x1F`, unchanged boot/CID, and
attempted/committed/verified `2005/2005/2005`. Final result Evidence `81`,
SHA-256
`43e346a658dc4db9b960c0228b839a8ddc82cb7e5aceeed9f09a1354bd08fe87`,
passed bounded stop with a `2023 ms` observation upper bound and maximum
append/read durations `27/12` ticks.

Append-only adjudication Evidence `82`, SHA-256
`aa170604cc112597bab42fdc3ec2f9bf0468417263bf73d056641089591449e2`,
correctly contributes no case. Its pre-Stop state was RUNNING at
`2005/2004/2004`, with no Stop sequence, and its terminal state was
`2005/2005/2005` with one acknowledged Stop. This is S1-shaped evidence but is
not counted until supported by a separate supplemental adjudication. Matrix
counts therefore remain S3 `2/10` and S0 `0/3`.

Pi commit `40bbf2e13fa712598e430722695b5d3e569950ac` corrected the reconciliation
race with two guard/body/guard status snapshots. It requires stable mailbox and
acknowledgement, coherent nonzero-even status guards, exact identity binding,
and nondecreasing progress. Focused tests pass `45/45`; the exact-environment
suite passes `177/177`. Backup
`sd-qualifier-20260805T161449Z-pre-seqlock-deploy.dump` has SHA-256
`38aad5e944fb06b24b86bebca339876c33bb0d52077840dc6004c88a6e6f7116`
and passed restore-list verification. Current release
`hpt2-reconcile-seqlock-40bbf2e` uses image
`sha256:e56f9e8ac45bb0f3ca21d4b57d6c0dba316dd522aa6a05a313737843f6b3fb4c`;
all package hashes passed and post-deployment health/worker/storage/clock gates
are healthy.

The same-run controller baseline and terminal observations retained boot
witness `5C940A1276443248`, representative-sector-read success, CID-valid
status, and complete raw CID `05000C61736466672200001C8901A34F`. No card was
removed, inserted, or replaced. Controller B remained disabled. Temporary
Controller A access was removed; the default firewall again drops external
ports `19120`/`19121`, and no observer or command-adapter container remains.

The separate-process sequencer is proven too slow for S0.

## Same-session exhaustion and qualification-only S0 hold

Pi commits from `70ba776` through `66f2b681` implemented one durable
same-J-Link-session Start/Stop process, PTY transport, terminal echo handling,
prefix-safe transcript parsing, bounded acknowledgement polling, and batched
Stop writes. Interrupted or malformed attempts were reconciled without replay.
Runs `20664f05...`, `fc4d603c...`, and `438254d1...` recovered to exact clean
Stop; their final/adjudication evidence pairs are `97/98`, `109/110`, and
`121/122` and contribute no case.

Run `81330ab2-c87c-402c-9c86-3d2c7812d5f5` was the first complete
same-session execution. Both intents were durable before target access, Start
acknowledgement required two bounded in-process reads, and the measured
acknowledgement-to-first-Stop-write gap was `0 ms`. Prewrite state was
`1/1/0`; terminal state was clean `3/3/3`; Evidence `135/136` correctly
contributes no S0 case. Batched-Stop run
`fd530a42-9ea9-4aa6-baac-414c7f53cf8b` also measured `0 ms`, observed
prewrite `1/0/0`, and ended clean `3/3/3`; Evidence `149/150` contributes no
case. Host stdin batching therefore cannot make the existing 65 exact J-Link
writes reach S0. Counts remain S3 `2/10`, S0 `0/3`.

Firmware now implements a qualification-only pre-work hold using exact token
`0x53304844` in the existing request reserved word. It publishes normal
`RUNNING` identity but performs no append/read work before the exact bound
Stop. Normal requests remain zero and unchanged; there is no delay, deadline,
automatic release, retry, or replay. The canonical profile SHA-256 is now
`a94bf5b4b5d4556c348594ae9b13e2da2ab110f0dfe5ca66760ba1f056c1d3ea`.
The contract/model suite passes `15/15`, and canonical managed Debug and
Release rebuilds pass.

Candidate bundle `smi-00-05-00-52edddc39e30-054d5386ad9d-release` has SREC
SHA-256 `054d5386ad9d88585c493a1b66dbf85b544ed803c00688646947f8c26f949d5e`,
mapping SHA-256 `91555e7ef99ca7dd951b92123ccb46c813a8f78beef17a8dbd1ce9f8c31004d3`,
and manifest file SHA-256
`287270444f104846db0b375520c6d08d4d9a4b79dbe42b9aaf8c62daceee0822`.
Every manifest member passed hash/size validation. The Pi imported it as valid
but unadmitted under canonical manifest identity
`e2561cdd82b6e1fc69585b2149d27f3bf3ca2690df5e5a2fc6356dd825c2e638`.

Pi commits `2434f87` and `86ac4c2` serialize the token only for an exact
measurement-only S0 plan and fail closed unless the exact bundle mapping
declares the capability. Legacy mappings remain normal-operation-only.
Focused tests pass `51/51`; the exact-environment full suite passes `188/188`.
Release `hpt2-s0-hold-86ac4c2`, source
`86ac4c27e2499175845be98aadc26f3e7298a838`, image
`sha256:826b43fabb3b800eeca445de4d416d8d067ab7f9bdc6f1761f52e26f01d73030`,
is packaged and deployed. Backup `sd-qualifier-20260805T181055Z.dump` passed a
complete restore check; post-deployment health, workers, storage, clock, and
the default firewall gate pass.

No controller was programmed and no SD card was handled. Controller A still
runs the prior exact bundle and retains the last observed boot witness and CID
listed above. The candidate needs an exact programming/admission envelope,
independent flash verification, and a new same-run boot/CID identity capture
before any live S0 observation.

## Remaining gates

- Eight additional valid Controller A S3 observations.
- Exact candidate programming/admission, independent flash verification, and
  a new same-run boot/CID capture, followed by three valid S0 observations.
- Controller A S1, S2, S4, S5, and applicable S6/retry-path measurements.
- Controller A recovery and representative regression gates.
- Review of the complete Controller A set before beginning Controller B.
- Complete Controller B matrix/recovery/regression and reviewed deadline
  derivation before changing the production profile.
