# Campaign 009 Controller A initialization admission blocker — 2026-08-17

Status: BLOCKED; the approved Controller A erase did not start because the deployed application has no supported post-scrub admission transition
Type: evidence
Updated: 2026-08-17
Next Action: authorize the bounded SD Qualifier post-scrub binding/promotion repair, validation, production deployment with rollback, and continuation into the already-approved Controller A initialization
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/00-campaigns/abandoned/009-complete-clean-contract-bound-a-b-qualification.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Authorized scope and result

The operator authorized exactly Controller A / `F1-A1` HPT media 2.0
initialization and whole-card erasure against bundle
`smi-00-05-00-cae69f7c7943-75f108d5e2e7-release` and CID
`05000C61736466672200001C8901A34F`, with the isolated non-heating bench safe
state confirmed. The authority did not include Controller B, programming,
power actions, SD movement, command replay, or later qualification nodes.

No initialization authorization envelope or durable initialization operation
was created, no initialization mailbox was prepared or published, and no
controller or SD write occurred. Production stayed fail-closed before target
access because the protected application prerequisites cannot be reached by
the current campaign workflow.

## Revalidated durable state

Production release `campaign006-baseline-ready-137206b` remains at source
commit `137206b466e388070427aa75690b76b9fec142d0` and image SHA-256
`7e308a7e7ec2ec3154aac90499de0ad3902e3eb1d0ccc3cb6e4113e6457b8dc9`.
HTTP `/sd-qualifier/healthz` remained `200 status=ok`, with database, evidence
storage, clock, and workers ready; live admission and state-changing profiles
remained disabled.

Campaign `a17fc306-8810-4e5a-bbc4-612adc47ce7c` is immutable at `RUNNING`,
version `5`, and still `fixture_only=true`. Coordinator `3` is
`WAITING_OPERATOR` at `initialization.complete.a` with stop code
`PLAN_NODE_REQUIRES_OPERATOR`. Assignment `27`, `F1-A1`, remains at stage
`INTAKE`. Its exact baseline scrub operation
`1231283a-6a7d-4d76-b24d-ea80918fd94a` is nevertheless durably
`COMPLETED/FULL_ADDRESS_SCRUB_PASS`. Before this continuation the campaign had
zero HPT initialization envelopes and zero HPT initialization operations; it
still has both after the admission check.

Authenticated Playwright inspection showed the same conflict. The execution
tree reports read-only baseline `4/4 PASS` and waits on Controller A
initialization, while the specimen remains `Controller A · INTAKE`. The
initialization history says authorization is unavailable for fixture
campaigns and exposes no envelope form.

## Fresh post-scrub read-only observation

A new read-only Controller A observation was collected automatically because
observation, evidence publication, cleanup, and reconciliation remain within
the recorded operation scope. It did not halt, reset, program, operate power,
move media, or write target memory. A temporary exact Controller A firewall
allowance was installed only for the observation and removed by an exit trap.
Final firewall state again contains the existing Controller B supervisor
allowance and the default non-loopback drop for ports `19120/19121`; no
controller-observer or HPT-initialization adapter container remains.

- Operation: `d1d8ef42-4c46-4cda-baad-50bc2540fee2`.
- Started/completed: `2026-08-17T20:02:17.546670Z` /
  `2026-08-17T20:02:40.657137Z`.
- Classification: `PASS`; read-only `true`; qualification outcome changed
  `false`.
- Controller: role A, assembly `1751136`, probe `69664082`, hardware variant
  `0`, VTref `3.275 V`, CPU running before and after.
- Bundle manifest SHA-256:
  `3b3470483906ec521df4814dffdcb90e9754ca9701f36f37c6210fda700bfe12`.
- Expected and observed complete flash SHA-256:
  `6eef5db83ce2ae71aeb63d598ecad1cfa7d68475ebfe052301f4fc2a0f97dfc4`.
- Result SHA-256:
  `e6b9a5dbd47c32203cb3d42a0759303ec795c44e67448876dfa606c830f163b3`.
- J-Link transcript SHA-256:
  `138e21fdfc6a43b9799d995601f5135e2bb0588c983c821569ed7d44adb8fd50`.

### CID identity block

- Protocol/card status: `sd_state=6; detection_state=5; driver_status=0`.
- CID-valid status: pass.
- Representative-sector-read status: pass.
- Manufacturer name: unknown CID manufacturer.
- MID: `0x05`.
- OEM/application ID: raw `0x000C`, decoded `??`.
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7305` (`0x00001C89`).
- Manufacturing date: `2026-03`.
- Complete raw 128-bit CID: `05000C61736466672200001C8901A34F`.

CID is identity evidence, not proof of authenticity.

## Application defect and next gate

The deployed protected promotion path requires all of the following:

- campaign state `INTAKE`;
- assignment stage `BASELINE_SCRUB_PASSED`;
- immutable `controller-readonly-observation` evidence linked to the exact
  completed scrub through `full_address_scrub_operation_id`.

The normal website path instead binds the initial observation while the
campaign is `BASELINE_READY`, leaves the assignment at `INTAKE`, permits the
campaign to advance to `RUNNING`, and has no production service that binds a
fresh post-scrub observation to the scrub or advances the assignment to
`BASELINE_SCRUB_PASSED`. The protected envelope service independently rejects
any assignment not at that stage. Manually editing PostgreSQL state would
bypass the reviewed evidence transition and is prohibited.

The smallest safe continuation is a bounded SD Qualifier source repair that
adds the missing exact post-scrub observation binding and current-coordinator
promotion path, with focused regression coverage, full validation, production
build/deployment, rollback preservation, and target-environment verification.
It must accept only this immutable campaign's passed scrub, fresh observation,
bundle, controller, and CID identity while still performing no target access
during promotion. After that deployment, the already-approved Controller A
envelope can be minted and the one-shot initialization executed; Controller B
and later nodes remain separate gates.
