# Watchdog Stage 7 Controller B Start and observation — 2026-08-09

Status: PASS; one governed Controller B S0 Start/Stop completed and was credited while Controller A remained healthy
Type: evidence
Updated: 2026-08-09
Next Action: preserve this gate as history; admit any later Controller B case separately while the continuing A campaign remains under the production watchdog
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-watchdog-gated-controller-a-recovery-and-controller-b-start.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Stage result

Stage 7 completed the exact admitted Controller B S0 run
`ffb59651-0bb0-4d9b-a729-0099cc0f5690`. Fresh owner authority was bound to
envelope `5ef65727-8279-4cfa-88ca-979acc5393b2`, machine authorization `209`,
and the single prepared Start operation
`dfc19fc3-a736-446f-98a7-a142f20e2979`. The Start remained `PREPARED` with
`target_access_started=false` until all live gates passed.

The final pre-Start read-only observation
`add8872e-fdb6-44ce-8b0b-592fa12dd837` passed exact assembly `1751219`, probe
`69660123`, variant `1`, firmware readback
`507e5b91d53afeb1b2d9d16442e3f6ff0391dcc7a53cead269cb11396dfcf246`,
bundle manifest
`d5da9437a9498b3ca82f6ee418dde82332159db463d51a1ef7a120abf29162fe`,
and unchanged Controller B/card identity. Evidence `1935` has SHA-256
`b3271fafb7d09a9cb8529edbbb0319723062b0a2cf115c8b8448e3941e888e2f`.
The independent idle-status observation was evidence `1933`, SHA-256
`05320bd820fdf1b6651d61b81bcd2c1619bc55433edaae24c90f00ca86a6fa54`,
with boot witness `F54F10127F443248`.

Required final pre-Start CID identity block:

- Protocol card status: `READY; RAW_HPT; DRIVER_OK`.
- CID valid: true.
- Representative-sector read: true.
- Manufacturer: unknown CID manufacturer; retail brand KEXIN; MID `0x05`.
- OEM/application ID: raw `0x000C`.
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7298`.
- Manufacturing date: `2026-03`.
- Complete raw 128-bit CID: `05000C61736466672200001C8201A379`.

No card replacement, power-off reinsertion, initialization, or reboot occurred
between the Stage 6 identity capture and this final capture. No powered card
removal or insertion occurred. CID is identity evidence, not proof of
authenticity.

## Publication-policy correction

The prepared-operation dry run found a fail-closed integration defect before
target access: the ordinary Controller B policy correctly rejected an existing
Start, but the same-session S0 publisher did not pass the exact prepared Start
as its permitted operation. Commit
`b14dc8e90e6484857a4dcd8f529e667a5fa169fb` now excludes only the exact B
`START/PREPARED` operation during its final publication recheck. Generic policy
continues to report `CONTROLLER_B_COMMAND_OUTCOME_UNRESOLVED` and
`CONTROLLER_B_START_ALREADY_EXISTS`.

Focused tests passed `67/67`; the complete exact ARM64 suite passed `304/304`
on disposable SQLite and `304/304` on disposable PostgreSQL 17. The disposable
container and network were identity-checked, removed, and verified absent.

Production was backed up to
`/backups/sd-qualifier-20260809T233852Z.dump`, `596659` bytes, SHA-256
`0b116f553c064bda3d11bc281cfc3aa98aa1c69c3ad5efc33de24bcf6a8d38c9`;
its disposable restore check passed. Production now runs release
`qualification-watchdog-b14dc8e`, image
`sha256:f53c01017249e37afa93d06012ec3d9704159fcd72da66a8fbd30f03594a78d0`,
and deployment manifest
`0069893a8301710a71579a2e53b21980073d98a53245a431cb24f085bd4c9713`.
Migration reported no pending changes, all four application services were
recreated on the exact image, web health passed, and the user observer
restarted. Rollback material is preserved at
`/home/jong/.local/share/sd-qualifier/rollback-stage7-b14dc8e-20260809T2345Z`.

Three new-manifest A snapshots spanning more than 60 seconds passed. Generic
policy remained blocked by the prepared Start, while the exact-operation
recheck returned `CONTROLLER_B_EXECUTION_ALLOWED` with no base or Start
blocker.

## Exact S0 execution and proof

One command-scoped firewall allowance exposed only Controller B port `19121`
during the same-session S0 operation and was removed by the wrapper trap. The
existing A-only `19120` rule and default `{19120,19121}` drop rule are the
verified at-rest state.

The S0 sequencer staged Stop before target access, acknowledged the prepared
Start, published Stop in the same J-Link session, acknowledged Stop, and
disabled automatic replay:

- Start operation: `dfc19fc3-a736-446f-98a7-a142f20e2979`, command sequence
  `1`, publish sequence `2`, mailbox SHA-256
  `aebfbc7fe13e339afa768baab84efe5db95e83615d81731de6a85fa4e7b11888`.
- Stop operation: `26701053-6ba0-4cbc-ae71-52331b58583a`, command sequence
  `2`, publish sequence `4`, mailbox SHA-256
  `241711775c466bf7043c3d3fc0842fb44c8108f08510e4fa753f3d10432425c2`.
- Shared request: `38b0dc1e-cfbd-4546-84f3-1bf7c610e4c8`.
- Both operations: `ACKNOWLEDGED`, terminal code
  `MAILBOX_COMMAND_ACKNOWLEDGED`, `automatic_replay_allowed=false`.
- Same-session evidence: `1967`, SHA-256
  `14e41fd7cc2dcc2380bef043b08a81a3f416629d9287dc2d736f561e0dfbb833`;
  measured Start-acknowledgement to Stop-publication delay `0 ms`.

The defined S0 proving window is the bounded same-session state transition,
not an endurance-record interval. Controller B advanced monotonically from
state `2` to stopped-clean state `5`, heartbeat `2` to `4`, publish sequence
`4` to `8`, and tick `636163` to `636183`. It intentionally produced zero
records. Both stopped-clean observations retained boot witness
`F54F10127F443248`, CID `05000C61736466672200001C8201A379`, terminal reason
`0`, terminal proof `31`, zero mismatch/lost counts, and no replace-media
request:

- evidence `1969`, SHA-256
  `4a1f89ddad16fa1b84853f3510e87dc8e8382dbd08590ff13fb36dad63216f03`;
- evidence `1970`, SHA-256
  `3f8eaff88d2aef1500439f510cae9ad76efb0af22c97e85486d373b13e0732e2`.

Final measurement evidence `1972`, SHA-256
`84b340cf51bf99583240aa2e7e5d9507356f44956e1c981b71f34f183cc3567e`,
classified S0 `CASE_PASS`, bounded-stop pass, with a `2124 ms` Stop-to-terminal
observation upper bound. Case adjudication evidence `1975`, SHA-256
`93778ed6cfc52b31f333f891df87f295f267ac33b84c73386ec8da92ade97248`,
credited the planned S0 and observed S3 contribution. The traveler now shows
`S0 — observation 1 of 3`, `CREDITED`, rather than an uncredited run.

## Independent A and safety verification

Controller A remained `RUNNING` and `HEALTHY` throughout. The post-S0 snapshot
`7a136713a4b3083f9c8f8b543ef4171ec5ce376598a6965fe990243aa9857f3b`
uses the new deployment manifest; the web traveler shows A executing S4
`44640 / AFTER` observation 2 of 3. Web health and the user observer are active,
the four application services use the exact image, no B firewall allowance
remains, and the UI/database now agree that B is in progress with its first S0
observation credited. The next B case requires its own admission and authority.

## Safe diagnostic incident

The first final-observation wrapper attempt failed before target access because
its firewall-handle parser was malformed. It left only the exact temporary B
allowance tagged `sdq-stage7-b-final-observation-1749109`, handle `5682`.
That exact rule was identified, removed, and verified absent before any further
operation. The corrected wrapper uses a checked numeric handle and an exit trap.
No controller command or card write occurred in the failed attempt.
