# Build the standalone Pi SD qualification operator application Workpackage

Status: active
Type: workpackage
Updated: 2026-09-21
Next Action: reconcile the current Stage 3 fixture-only Pi implementation against this operator journey, then hand off the next bounded application slice from the central plan; keep live qualification disabled until its separate admission and physical gates pass
Campaign Reason: Historical record from campaign 014-complete-standalone-sd-qualifier-acceptance; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Canonical Truth: `jong@srv-rpi00.local:~/dev/sd_qualification/README.md` and `docs/`

## Continuation Checkpoint

### 2026-09-21 application direction reconciliation

The Aug. 10 change-impact campaign is terminal `ABORTED`, recorded as
`INCONCLUSIVE — no card rejection`; its earlier paused-state and migration
decision notes below are retained as history. The Pi workspace README now
describes Stage 3 operator-facing work on the fixture-only application. Live
qualification access remains disabled and separately authorized. This central
workpackage remains active for the application handoff, with the next bounded
slice to be selected from current Pi source, tests, and the operator journey.

### 2026-08-13 qualification contract first pass

The owner adopted the contract-first recommendations. The governing front door
is `docs/sd-card-qualification-contract.md`; the decision record is
`work/decisions/decision-sd-qualification-contract-reconciliation.md`. The Pi
source now contains selected machine-readable contract
`SMI-SDQ-CONTRACT-V1`, canonical SHA-256
`865b478e21ef97f5b0b11a4b7336257e1ad68aa317276348de56e068ff11813e`,
its Draft 2020-12 schema, loader, and seven passing focused tests. It is
deliberately not registered as the live execution plan.

The web pause request is durable: coordinator state and desired state are both
`PAUSED`, and there are no claimed or pending coordinator tasks. The campaign
remains paused at node `matrix.s2.b`; both role supervisor projections are now
healthy. The earlier Controller A proving run is no longer open. Controller B
S2 run `efdeaec7-f0e7-4458-8012-7580dab9f18f` is also closed.

Read-only ledger reconciliation proved its Start acknowledged without replay.
The application then minted exact Stop intent
`f1492992-f957-4baa-a676-471b8c2f995f`; it was published once and acknowledged
as `MAILBOX_COMMAND_ACKNOWLEDGED` with automatic replay disabled. The required
independent `STOPPED_CLEAN` path later supplied matching terminal observations
`19267` and `19268`. The supported non-promoting finalizer created result
`19269` with `BOUNDED_STOP_PASS_CASE_TRIGGER_NOT_MET` and
`case_accepted=false`; no S2 credit or command replay occurred. Do not resume
the campaign until the explicit migration-versus-INCONCLUSIVE decision.

### 2026-08-12 audited campaign closeout deployed

Web-only release `campaign-closeout-520014c`, local source commit
`520014c4673e7e14de6c051a90d1153c7fc4a0e6`, and ARM64 image
`sha256:1edb079d...6c3c7a` add an explicit Overview closeout action with a
required reason, confirmation, append-only actor event, preserved evidence,
active-work refusal, and History presentation as `CLOSED` without a
qualification conclusion. The exact image passed 40 focused tests and the
no-migration check. Authenticated desktop/mobile Playwright verification
passed; only the web container was recreated; all durable workers retained
identity; and the Aug. 10 campaign remained unchanged. The branch is local
only and was not pushed. Evidence:
`work/evidence/sd-qualifier-campaign-closeout-deployment-20260812.md`.

### 2026-08-12 campaign workspace first pass deployed for owner evaluation

Web-only image `campaign-workspace-ui-7a31b3e`, source
`7a31b3ea3ddf1a33122a84ddf649bdeda93c032f`, replaces the prior long-form
operator surface with a campaign-first dashboard, shared application shell,
campaign phase rail, status/progress/current-step/forecast summary, and short
tabbed campaign sections. Detailed plan and historical run evidence are
collapsed but remain available on demand. The final CSS-only containment
change passed focused responsive tests; the immediately preceding application
candidate passed `355/355`. Authenticated Playwright verifies desktop and
390-pixel mobile paths without document-level horizontal overflow, console
errors, or failed dynamic requests. Only the web container was recreated; all
campaign workers retained identity and start time. This is a first-pass owner
evaluation deployment, not final release hardening. Evidence:
`work/evidence/sd-qualifier-campaign-workspace-first-pass-deployment-20260812.md`.

### 2026-08-12 web campaign coordinator deployed and fixture-verified

Release `campaign-coordinator-0490369`, source
`04903698c1548cb843740dd8e1bed428c0be3dd4`, and ARM64 image
`sha256:db0355a6...65b2a8` deploy the durable exact-plan coordinator and leased
host runner. Exact ARM64 tests pass `348/348`, standalone runtime tests pass
`49/49`, PostgreSQL coordinator tests pass `5/5`, package/backup/restore and
health gates pass, and authenticated Playwright drove a fresh A/B fixture
campaign from the website to `FINAL_DISPOSITION_REQUIRES_REVIEW`. Restarting
web, the coordinator worker, and task runner preserved the same five completed
task IDs at attempt zero with no replay. Live cards remained untouched. The
protected current-backup marker still projects `DATABASE_BACKUP_STALE`, and the
current live envelopes do not cover the complete remaining bounded campaign;
Controller B coordinated-cycle support and post-campaign scrub authority are
also genuine later gates. Evidence:
`work/evidence/sd-qualifier-web-campaign-coordinator-deployment-20260812.md`.

### 2026-08-12 product goal corrected to web-started end-to-end execution

The governing acceptance test is now: from a fresh web-created campaign, one
campaign authorization and one Run action advance both physical-card travelers
to completion or the next genuine failure/physical-action gate without SSH,
agent-selected cases, or per-case operator handoffs. The deployed execution
tree is currently a read-only projection; live case selection still occurs in
host scripts. Further manually selected target cases are held while
`work/tickets/ticket-implement-web-started-persistent-sd-qualification-campaign-coordinator.md`
adds durable execution state, a persistent appliance coordinator, automatic
HPT2 continuation, traveler steps 5–8, web controls, and restart/no-replay
verification.

### 2026-08-12 deterministic S4 A/B pair complete

The fourth separately authorized pair replaced fixed-delay boundary guessing
with existing firmware-held exact S4 checkpoints. A run `9eb4f195...` passed
`10080/BEFORE` at `10079/10079/10079`; after three healthy A snapshots opened
the policy gate, B run `0cfda2bf...` passed `1440/BEFORE` at
`1439/1439/1439` while A remained active. Both bounded stops, Start/Stop
acknowledgements, runner exits, extended S4 adjudications, and restored
supervisors pass. Each terminal state also adds one valid S3 observation, so A
S3 is `6/10` and B S3 is `5/10`. Both cards return to `AWAITING ADMISSION` and
remain `IN PROGRESS`. Evidence:
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-12 idle badge correction and third A/B pair complete

Source `84bf5d9974db5e77512bc2977294640fc1fde973`, release
`qualification-awaiting-admission-84bf5d9`, and image
`sha256:fa8838dc...d62cd8` replace the misleading idle `RUNNING` badge with
`AWAITING ADMISSION` without changing durable workflow state. Exact-image tests
pass `343/343`; production verifies idle and genuinely active rendering; the
web and observers are healthy; and durable workers retained identity. The
authorized A/S3 900-second and B/S3 600-second cases both passed bounded stop.
A observed S2 and advances to `3/10`; B observed no credit. The matrix remains
false and both cards remain `IN PROGRESS`. Evidence:
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-12 second authorized A/B S1 continuation complete

The separately authorized A 600-second and B 240-second S1 cases completed
with clean bounded stops, acknowledged Start/Stop operations, successful runner
exits, and healthy restored read-only supervisors. Neither hit S1. A's
adjudication credits S3, advancing A S3 to `5/10`; B credits no case. The
matrix remains false and both cards remain `IN PROGRESS`. The protected web
views show the latest evidence and operator handoff, but step 4 retains the
generic `AUTOMATED RUNNING` badges despite zero open runs; that residual wording
ambiguity is not evidence of an active runner. Evidence:
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-11 authorized A/B S1 continuation complete

The separately authorized A 480-second and B 180-second S1 cases completed
with clean bounded stops, acknowledged Start/Stop operations, unchanged exact
card identities, successful runner exits, and healthy restored read-only
supervisors. Neither hit S1. A's adjudication credits S2, so A S2 advances to
`2/10`; B credits no case. The matrix remains false and both cards remain
`IN PROGRESS`. Protected deployed views show the current evidence and exact
operator handoff. Evidence:
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-11 terminal supervisor and inactive-run handoff shipped

Source commit `3f1042fca1f7530ae0ef4e11f889c32e53234b4d` reconciles the
completed Controller A S1 terminal tuple without replay. Release
`qualification-handoff-guidance-55ed692`, source
`55ed6927861046e2f15286a0da9aa9b7200dc145`, includes that correction and
distinguishes an incomplete automated traveler row from a currently active
run. Its exact-image suite passes `343/343`; the live supervisor is healthy;
health is OK; worker identities
are unchanged; and Playwright shows exact `OPERATOR REVIEW` campaign handoffs
for both cards. Both qualifications remain `IN PROGRESS`. Evidence:
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-11 representative-regression evidence reconciliation

Release `qualification-regression-reconcile-pgfix-3bb6703`, source
`3bb6703bef1a886991a3f40b0bf19f07ddf64087`, and ARM64 image
`sha256:00496c89908665ab91fb09da4dcda01ff500c72249bc1657cd60c0513c075300`
add a hash-pinned, idempotent reconciliation command for external
representative A/B regression evidence. Evidence IDs `7624` and `7625` credit
traveler step 6 for F1-A1 and F1-B1 only. The matrix, recovery,
post-campaign scrub, and disposition gates receive no credit. The exact image
passes `341/341`; the web-only deployment is healthy; command, notification,
and watchdog container identities are unchanged; and authenticated Playwright
verification shows both cards remain `IN PROGRESS`. F1-A1 recovery remains
PASS, F1-B1 recovery remains NOT RUN, both post-campaign scrubs and both final
dispositions remain NOT RUN, and the matrix audit remains false with no Stop
deadline. Evidence:
`work/evidence/sd-qualifier-representative-regression-reconciliation-deployment-20260811.md`.

### 2026-08-11 site-audit recommendations shipped

Release `qualification-site-audit-dda5b0d`, source
`dda5b0dae617a68444e8a706598c3ee0a1ea9669`, and ARM64 image
`sha256:d0706d1f47317b9c30f2d3426d6c228f60efba204175e127c34604e575340fd6`
scope card operator actions to the selected current campaign, make health fail
when any required-now gate fails, and remove closed tooltips from desktop
overflow. Exact tests pass `337/337`; the web-only deployment is healthy; all
three durable worker containers retained identity and start time; the restored
read-only host observer makes health report `required_now_ready=true` and
`workers=true`; authenticated desktop/mobile and event-polling verification
passes. F1-B1 no longer inherits the Aug. 6 alert. F1-A1 now shows a genuinely
current Aug. 10 supervisor block, `ORCHESTRATOR_SERVICE_DIVERGENCE`, because its
configured expected service is inactive; review that evidence without replaying
a controller command. Evidence:
`work/evidence/sd-qualifier-site-audit-recommendations-deployment-20260811.md`.

### 2026-08-11 deterministic current-campaign selection

Release `qualification-card-current-47b1fb5` makes fixed-card status and the
global supervisor banner follow
explicit campaign lineage instead of generic event recency and fails closed on
ambiguous successor branches or a displaced campaign with an open run. The
Aug. 10 campaign now explicitly supersedes the Aug. 6 campaign through audited
event `316`. The exact ARM64 suite passes `333/333`; the web-only deployment is
healthy; both dashboard cards and card travelers select the Aug. 10 campaign;
the campaign table remains `20/24`, zero open, four needing attention; the
superseded Aug. 6 alert is absent (both Aug. 10 supervisors are healthy); event
polling returns HTTP `200`; F1-A1 step 5 now reports its five recorded recovery
passes while steps 6–7 remain not run; and all three existing workers retained
identity and start time. The exact suite passes `334/334`. Evidence:
`work/evidence/sd-qualifier-current-campaign-selection-20260811.md`.

### 2026-08-11 operator-guidance visual closeout

Authenticated Playwright review found and corrected one mobile overflow caused
by a long campaign token. Exact ARM64 tests pass `329/329`; the corrected
web-only image is healthy; dashboard and both fixed card travelers have zero
desktop/mobile overflow; operator/system actions and all traveler badges are
present; and the command worker, notification worker, and qualification
watchdog retained their identities and start times. The temporary browser user
was removed. Evidence:
`work/evidence/sd-qualifier-card-operator-guidance-20260811.md`.

### 2026-08-10 traveler qualification-reference deployment

Release `qualification-traveler-reference-0acdb5e` adds a visible link from
each of the eight fixed traveler steps to a detailed, read-only qualification
reference. Every reference states what is performed, pass criteria, evidence,
failure handling, and the operator/safety boundary, then returns to the exact
traveler step. Exact ARM64 tests pass `309/309`; authenticated Playwright
exercised all eight forward and return links. Both active runner invocation IDs
and both role observers survived the scoped application-container rollout;
both supervisors are healthy and current interventions are zero. Evidence:
`work/evidence/sd-qualifier-traveler-reference-deployment-20260810.md`.

### 2026-08-10 operator-page performance correction

Release `qualification-page-performance-e2bc362` replaces a growing
run×campaign-event aggregation with a correlated latest-event lookup while
preserving displayed status and activity truth. Authenticated Playwright
improved from `11.666 s` to `1.080 s` on the dashboard and from `5.881 s` to
`1.745 s` on F1-A1; F1-B1 is `1.644 s`. Exact ARM64 tests pass `307/307`.
Deployment preserved both parent runner invocations and both observers; both
live runs continued to heartbeat, with zero current interventions and zero
nonhealthy supervisor states. Evidence:
`work/evidence/sd-qualifier-card-page-performance-correction-20260810.md`.

### 2026-08-10 current-state intervention presentation corrected

Release `qualification-current-interventions-e4bf6e5` makes the dashboard's
current-action surface derive from authoritative supervisor state and retains
recovered alerts only as closed campaign history. Future alerts carry exact
run/controller attribution. All `185` recovered supervisor notifications and
deliveries are closed with role-specific audit events; no reminders remain
eligible. Exact ARM64 tests pass `306/306`, production rendering and health
pass, both A/B parent invocations are preserved, and both supervisors are
healthy with zero unresolved commands. Evidence:
`work/evidence/sd-qualifier-current-intervention-projection-and-recovery-closure-20260810.md`.

### 2026-08-10 run-boundary watchdog correction and exact A/B continuation

Production release `qualification-watchdog-91bfd8a`, source
`91bfd8a1709ea87aa9be393ac1a3bab086c77feb`, exact image
`sha256:819e12a233a867d4fedd28c1f45c8247b4d1b27bcfe6f0792dcb265765fcf7e4`,
and manifest
`6bc6e768fb82728e8d1ec6af3a64be1f8ea8ac0c43c350c251c939ed3374cd4d`
are deployed and verified. The observer now scopes runner lifecycle to its
controller role, binds exact S4 target/region transitions, samples at a cadence
that can satisfy the proving window, and resets heartbeat/counter monotonicity
at a new run boundary. Operations tests pass `44/44`, focused watchdog tests
pass `28/28`, and the exact combined ARM64 suite passes `305/305`.

Controller A run `a2dbfca4-805b-4fca-bf69-b01717e0f083` is healthy and
progressing on S4 `44640 / AFTER` observation 3. Controller B run
`c46bc49d-c200-4dfe-a00d-ec38cfca7b2c` completed and credited S4
`10080 / BEFORE` observation 2 with one Start, one Stop, two stopped-clean
observations, and both adjudicators. The same B parent then admitted observation
3 as run `79a3a85f-3433-4d49-97a6-5bd539cadb41`; its first new-run snapshot
was immediately healthy, directly exercising the correction. Both controller
CIDs and boot identities remain unchanged, and neither card was removed,
reinserted, or replaced. Post-matrix recovery remains closed. Evidence:
`work/evidence/s4-parallel-restart-watchdog-run-boundary-deployment-20260810.md`.

### 2026-08-09 Controller B base pass and independent S4 launch

Controller B base coverage passes at S0 `7/3`, S1 `11/10`, S2 `37/10`, and
S3 `10/10`. Operations commit `e0a1a95` deploys dead-owner-only observer
firewall cleanup after the forced-stop path, and commit `beb5a57` adds
role-scoped S4 admission, resume, progress, supervisor, and exit checks. All
`44/44` operations tests pass. B service v1 credited the first
`1440 / BEFORE` observation without replay, then exposed a transient
post-finalization adjudication exit. Commit `c4990b2` adds durable-evidence
confirmation; successor invocation `c0e283d128d04dcfa5d7f94a5bcb2d4e`
completed and credited observation 2 with both adjudicators confirmed, then
began observation 3 from credited count 2. A remained
uninterrupted on invocation `8bf2ff84f9cb432db4b74edffe00ee6c`. Evidence:
`work/evidence/controller-b-base-matrix-pass-and-s4-parallel-launch-20260809.md`.

### 2026-08-09 final watchdog cleanup and exact B continuation recovery

Production release `qualification-runner-supervision-e82398a`, manifest
`a25039e4a9d3f364e8e08cd5210d874a14b98ba3266b42954b516074125fb1fc`,
adds forced-exit cleanup and same-role stale-firewall-rule removal to the
serialized observer. Backup `sd-qualifier-20260810T020831Z.dump` passed restore.
Guarded operations commit `9c00886` recovered admitted B run
`a773727d-d757-4a51-bf03-18eef733207f` through its one exact prepared Start
without replay; result/adjudication evidence `2470/2473` is durable and B has
zero unresolved operations. B coverage at parent restart was S0 `3/3`, S1
`2/10`, S2 `6/10`, S3 `3/10`. Parent invocation
`8bd7f82b0afe4c63ab33115e4557d532` and its independent observer are active;
A remains on invocation `8bf2ff84f9cb432db4b74edffe00ee6c`.

### 2026-08-09 serialized A/B watchdog target access and active B base matrix

Production release `qualification-runner-supervision-f664bf5`, manifest
`e5acc324991d8a3ae57c82d4c194d4b40ed0631812c5f0cca0089b3559662701`,
serializes each controller's watchdog reads and campaign J-Link commands with
separate bounded host locks. The ambiguous B Start was reconciled read-only
without replay, its paired Stop passed, and the run supplied one valid S1
observation. A following stopped-clean run supplied S2 after durable
adjudication confirmation. Immutable operations commit `366afbb` is active as
parent invocation `9e0a35802e604904b783ce22ebf49fc6`; first verified
coverage is S1 `1/10`, S2 `2/10`, S3 `3/10`. A remains on invocation
`8bf2ff84f9cb432db4b74edffe00ee6c` and continues independently. Evidence:
`work/evidence/progress-aware-runner-supervision-and-controller-b-s0-3-20260809.md`.

### 2026-08-09 runner-aware A supervision and Controller B S0 3/3

Release `qualification-runner-supervision-ffbf93e` corrects the fixed-timeout
runner and observer-only false-green condition. The exact A run resumed without
Start replay, all dependent services are active, and three new-manifest
snapshots prove the watchdog names the real runner and tracks monotonic
progress. Separately authorized B run
`c20498c3-9ba6-476d-b240-d868b7937044` completed S0 `CASE_PASS`, making B S0
`3/3`; no unresolved operation or B firewall allowance remains. Evidence:
`work/evidence/progress-aware-runner-supervision-and-controller-b-s0-3-20260809.md`.

Independent B observer unit `sdq-qualification-observer-b.service` then passed
live S1 run `fdf1d523-1a36-402d-b45d-257e6e58ab38` without changing A's
healthy projection. The zero-delay S1 trigger was not met and was correctly not
credited; the supervisor, bounded Stop, operation reconciliation, and cleanup
all passed.

### 2026-08-09 Controller B S0 observation 2 credited

Run `e7eb0d5f-4dc7-42fe-b7fe-1c6bca515ba7` completed one exact same-session,
replay-disabled Start/Stop pair and stable stopped-clean proof. Measurement
evidence `2004` classified S0 `CASE_PASS`; adjudication evidence `2005` credits
S0 observation 2 of 3. CID and boot identity remained unchanged, A remained
healthy and running, and no B firewall allowance or unresolved command remains.
Evidence: `work/evidence/controller-b-s0-observation-2-20260809.md`.

### 2026-08-09 Controller B Stage 7 S0 credited

Watchdog Stage 7 passes. Fresh exact authority and final unchanged-CID identity
preceded one same-session, replay-disabled Start/Stop pair. Stable stopped-clean
evidence classified S0 `CASE_PASS`; evidence `1975` credits S0 observation 1
of 3. Policy correction `b14dc8e`, image `sha256:f53c0101...78d0`, and
manifest `0069893a...9713` pass `304/304` tests on SQLite and PostgreSQL 17
and are deployed healthy. A remains healthy and running; B is firewalled at
rest and any later case requires separate admission. Evidence:
`work/evidence/watchdog-stage-7-controller-b-start-and-observation-20260809.md`.

### 2026-08-09 Controller B Stage 6 preflight complete

Watchdog Stage 6 passes. Owner power-state evidence, the complete B scrub,
same-CID post-scrub observation, HPT media-2 initialization, and S0 admission
all pass. Policy correction `5b80fda`, exact image `sha256:931cfce...d950`,
and manifest `2fac279c...fe88` pass `303/303` tests on SQLite and PostgreSQL
17 and are deployed healthy. Event `260` reports
`controller_b_execution_allowed=true`; the UI names the exact S0 Start action.
B has zero authorizations and zero command operations, and remains firewalled
at rest. Evidence:
`work/evidence/watchdog-stage-6-controller-b-preflight-complete-20260809.md`.

### 2026-08-09 Controller B parallelization policy

Watchdog Stage 5 passes. Accepted ADR
`work/adr/adr-controller-b-parallel-qualification-entry-policy.md` and Pi
source `dc492e4` implement separate evidence-backed B Preflight and Start
decisions. Exact image `sha256:6543e1ea...3db7` passes `299/299` tests on
SQLite and PostgreSQL 17 and is deployed healthy. Live event 251 reports
Preflight allowed while Start remains blocked on the complete B readiness
chain. A remains healthy and progressing; B remains `INTAKE` with no run or
command operation. Evidence:
`work/evidence/watchdog-stage-5-controller-b-parallelization-policy-20260809.md`.

### 2026-08-09 watchdog production qualification and A resume

The watchdog-gated recovery campaign passes Stages 0–4. Production now runs
supervisor commit `6e26d778852ae24094af5939cb84936c639470f2`, exact image
`sha256:14094d1659c54a9ccf9738022b5d84498e1ae0a021bec0fb16652042580e40ad`.
The held A observation was finalized without Start replay; the audit-selected
next S4 `44640 / AFTER` run received exactly one Start and demonstrated four
healthy monotonic supervisor cycles. Controller B remains at `INTAKE`. Stage 5
policy work, not a manual bypass, is the next gate. Evidence:
`work/evidence/watchdog-stage-4-controller-a-recovery-resume-20260809.md`.

### 2026-08-07 section-completion forecasts deployed

SD Qualifier merge `abca3b0`, exact image `sha256:2a42efc9...9e96`, adds a
completion time and visible evidence-basis label to each of the eight physical
card traveler rows. Sections 1–3 render recorded actual times. The active matrix
uses remaining plan observations and completed-run history; sections without
comparable history are explicitly rough estimates. Exact-image tests pass
`260/260`, health is good, and the web-only deployment preserved both workers
and all four Controller A continuation services. The admitted row advanced to
S4 44640/AT observation 3 of 3. Evidence:
`work/evidence/sd-qualifier-section-completion-forecasts-deployment-20260807.md`.

### 2026-08-07 matrix-status projection deployed

SD Qualifier merge `5b0f4dd`, exact image `sha256:b032bd3b...71b37`, now
presents extended S4 adjudication as the operator result. Four completed rows
are `CREDITED`, the admitted S4 44640/AT observation 2 of 3 is `RUNNING`, and
current-campaign history is separated from earlier Engineering attempts. The
raw base-classifier code is absent from the authenticated production render.
All `258/258` exact-image tests and live health passed, while the workers and
Controller A qualification service remained continuous. Evidence:
`work/evidence/sd-qualifier-matrix-status-projection-deployment-20260807.md`.

### 2026-08-06 Controller A live-run repository checkpoint

At `2026-08-07T00:19:18Z`, active S4 `44640 / BEFORE` run
`b58be682-69cd-4982-b3bf-8f78972458a3` had advanced to attempted
`13778 / 44640` (`30.9%`). Its single START is acknowledged, no STOP exists,
all four persistent continuation services are healthy, and the unchanged CID
is `05000C61736466672200001C8901A34F`. Controller B remains at `INTAKE` with
no active run. Continue the existing chain without replay or interruption.
Evidence:
`work/evidence/controller-a-s4-44640-before-live-checkpoint-20260806.md`.

### 2026-08-06 account notification subscriptions deployed

SD Qualifier PRs #43 and #44, final merge `b9ccca1`, and exact ARM64 image
`sha256:ea8fbb3a...62c371` deploy administrator-managed username/email opt-ins
for intervention and qualification completion. Exact-image tests pass
`257/257`; PostgreSQL migration/history and lease locking pass; authenticated
production rendering and SMTP provider acceptance pass. Live `jon` /
`jong@sheldonmfg.com` is enabled for both topics. Health is OK, the command
worker is unchanged, and all four Controller A services continue at exact S4
`44640 / BEFORE`. Evidence:
`work/evidence/sd-qualifier-account-notification-subscriptions-20260806.md`.

### 2026-08-06 account-based notification subscription correction

Ship
`work/tickets/ticket-configure-account-notification-subscriptions.md` so email
routing is an explicit administrator-managed opt-in by username/account email,
not an implicit campaign-creator address. Add intervention and qualification
completion topics, durable per-recipient delivery, deduplication, and a compact
settings page. Configure the live `jon` account at `jong@sheldonmfg.com` for
both topics after migration. Do not interrupt Controller A or start Controller
B; restore the exact live campaign next action after deployment.

### 2026-08-06 automated recovery power-cycle classification corrected

The action badges describe operator involvement. SD Qualifier PR #42, merge
`d332449`, and exact ARM64 image `sha256:83473ed7...7da64` therefore classify
step 5 recovery as `AUTOMATED`: the RPi performs the qualified controller
power cycle, no operator action is required, and the SD card remains installed.
Candidate and exact-merge suites both pass `252/252`; authenticated production
rendering and web-only continuity pass. Controller A continues at exact S4
`44640 / BEFORE`, and Controller B remains not started. Evidence:
`work/evidence/sd-qualifier-card-operator-guidance-20260806.md`.

### 2026-08-06 card operator-action guidance deployed

SD Qualifier merge `95881c3` and exact ARM64 image
`sha256:8cdb706f...29f69` add fixed automated/operator-review/physical-action
badges, a separate live next-operator-action decision, exact-card intervention
overrides, dashboard summaries, and explicit safe power/card-handling wording.
Both exact-image suites pass `252/252`; authenticated live rendering, health,
and web-only continuity pass. F1-A1 reads `NONE` while the S4 matrix runs;
F1-B1 remains `NOT STARTED` with a before-start review. The in-app browser was
not connected, so only the visual-only desktop/mobile confirmation remains on
the ticket. Resume Controller A at `44640 / BEFORE` and do not start B.
Evidence: `work/evidence/sd-qualifier-card-operator-guidance-20260806.md`.

### 2026-08-06 operator-action guidance enhancement

Ship
`work/tickets/ticket-show-operator-action-requirements-on-card-qa-traveler.md`
as a web-only clarification while the authorized Controller A run continues.
Classify every fixed traveler row as automated, operator review, or physical
action; add a separate prominent next-operator-action decision; and make the
power-interruption versus SD-card-handling distinction explicit. Do not
interrupt A, start B, or introduce any powered-removal instruction. After
deployment, restore the Controller A exact-identity S4 next action.

### 2026-08-06 fixed physical-card QA traveler deployed

SD Qualifier final merge `fe27ecd` and exact ARM64 image
`sha256:e6dd3742ee69b0ce85ce86384a9935837a2ad0549336f61f8ab03fcca2c5a503`
replace the campaign-first card page with an eight-row QA traveler. Exact-image
tests pass `250/250`; authenticated desktop/mobile verification passes with no
horizontal overflow and compact five-attempt row previews. Live truth is
F1-A1 `IN PROGRESS`, continue `YES`, bounded-stop matrix active, zero card
failures and five invalid attempts; F1-B1 is `NOT STARTED`. Only the web
container was replaced. Both workers retained their image/start times and all
four Controller A services remained active. Resume A at the recorded S4
`44640 / BEFORE` next action; do not start B. Evidence:
`work/evidence/fixed-physical-card-qa-traveler-20260806.md`.

### 2026-08-06 fixed physical-card QA sheet correction

The owner rejected the campaign-first physical-card screen because it reads as
an engineering incident log rather than a QA traveler: method failures appear
to be card failures, raw campaign count appears to be required test count, and
the screen does not answer whether qualification should continue. Ship
`work/tickets/ticket-replace-campaign-first-card-status-with-fixed-qa-sheet.md`
as the current software-only ground task while the already authorized
Controller A sequence continues independently. Present a fixed ordered test
sheet with explicit `NOT RUN`, `RUNNING`, `PASS`, `FAIL`, `INVALID ATTEMPT`,
and `BLOCKED` semantics; show overall result, continue decision, actual card
failures, current test, and next action; nest immutable campaign/operation
attempt history under the applicable test; keep A and B independent and retain
the final paired gate. Do not rewrite evidence, infer card failure from method
failure, start Controller B qualification, or interrupt Controller A.

### 2026-08-06 authoritative live campaign progress UI

Pi commit `61aab94` and image `sha256:26b06ec6...d7e23` add durable
recorded/completed/open/attention run counts, current Controller A specimen and
S4 checkpoint context, latest event/activity, read-only refresh, distinct
appliance-admission labeling, unique repeated-form IDs, and responsive overflow
repairs. The complete Linux suite passes `230/230`; exact-image and production
authenticated desktop/mobile review pass. PR #33 is merged at `3780ca8`.

Production uses a web-only Compose override so the approved Controller A matrix
continues uninterrupted: web runs the candidate, while workers, `:local`, and
all one-shot controller tools remain on qualified image
`sha256:4237e644...d9c7`. A restore-checked backup and rollback tag are retained.
The campaign advanced between candidate preview and production review and
remains one-open-run healthy. Evidence:
`work/evidence/sd-qualifier-authoritative-progress-candidate-20260806.md`.

### 2026-08-06 Controller A S4 candidate baseline and first pass

The owner authorized the complete remaining Controller A run. Campaign
`648ba10c-0bc0-4319-8089-78a0cce287ce` binds exact S4 bundle
`smi-00-05-00-660433743898-bcf70c2de65c-release`. Programming and complete
readback, independent flash/CID observation, the full-address baseline scrub,
canonical HPT initialization, and the first `1440 / BEFORE` S4 observation all
pass. Controller B remains disabled and untouched. Evidence:
`work/evidence/controller-a-hpt2-s4-program-baseline-first-pass-20260806.md`.

The firmware/profile identity changed, so prior S0-S3/S5/S6 rows remain
historical; the new campaign will collect fresh identity-local rows rather
than relabeling prior evidence.

### 2026-08-05 S4 checkpoint-region producer candidate

Pi commit `b586704` implements exact target/region admission, immutable token
encoding, bundle-capability validation, and result-to-plan contradiction checks.
Exact image `sha256:4237e644...d9c7` passes `224/224` tests and is deployed as
`hpt2-s4-boundary-b586704` after all release gates. Firmware bundle
`smi-00-05-00-660433743898-bcf70c2de65c-release` is imported valid but
unadmitted. The active campaign bundle is unchanged, S4 stays zero, no
controller was accessed, and B remains disabled. Evidence:
`work/evidence/hpt2-s4-checkpoint-producer-candidate-20260805.md`.

### 2026-08-05 Controller A S6 runtime matrix pass

Controller A provisional S6 is `10/10` with APPEND, READ, and
SEGMENT_TRANSITION coverage. Pi source `4ad60e4` is deployed as
`hpt2-s6-boundary-4ad60e4`, image `sha256:5e9e6b0a...8ecf`, after `217/217`
tests and complete packaging, restore, migration, storage, health, identity,
firewall, and cleanup gates. The ledger has zero active runs and no invalid
extended evidence. A S4 remains zero, so the A-local gate is false, B remains
disabled, and the deadline remains `null`. Evidence:
`work/evidence/controller-a-hpt2-s6-runtime-matrix-pass-20260805.md`.

### 2026-08-05 S6 qualifier deployment

Pi commit `7cf2cb8` and exact candidate image `sha256:dd1892d...e30de` pass
`214/214` tests and are now packaged and deployed. Backup/restore, migration,
storage, health, audit, and isolation gates pass. There are zero active runs,
both target ports retain the default firewall drop, and deployment did not
access either controller. Exact identities are in
`work/evidence/controller-a-hpt2-s6-qualifier-predeployment-checkpoint-20260805.md`.

### 2026-08-05 Controller A S5 matrix pass

Ten Controller A S5 extended adjudications pass with per-run queue deltas
`2/2/0/0`, clean terminal proof, and no replay. The live audit is A S0 `3/3`,
S1 `13/10`, S2 `20/10`, S3 `12/10`, S5 `10/10`, S4/S6 zero. B remains
disabled and the deadline remains `null`. Evidence:
`work/evidence/controller-a-hpt2-s5-runtime-matrix-pass-20260805.md`.

### 2026-08-05 first Controller A S5 runtime-evidence pass

Pi commit `6dc1c3c` passes `212/212` exact-image tests and is deployed as
`hpt2-runtime-map-6dc1c3c`. The first controller-runtime run proves two queued
and completed normal logs with zero drop/loss, clean terminal proof, and a
`2023 ms` bounded-stop observation upper bound. Controller A S5 is now `1/10`;
S4/S6 remain zero, B remains disabled, and the deadline remains `null`.
Evidence:
`work/evidence/controller-a-hpt2-s5-runtime-evidence-first-pass-20260805.md`.

### 2026-08-05 Controller A S0-S3 strict matrix pass

The corrected append-only ledger has 35 current adjudications. Strict observed
totals are S0 `3/3`, S1 `12/10`, S2 `11/10`, and S3 `12/10`; the maximum
observation upper bound is `2089 ms`. Zero runs or command operations remain
active, firewall isolation is restored, Controller B remains untouched, and
the production deadline remains `null`. S4-S6 stay at zero pending distinct
coordinator evidence paths and software qualification. Evidence:
`work/evidence/controller-a-hpt2-s0-s3-observed-boundary-matrix-pass-20260805.md`.

### 2026-08-05 strict observed-case correction and continuation

Pi commit `3fdd4c9` is deployed as
`hpt2-observed-case-classifier-3fdd4c9`, exact image
`sha256:c03e2521...6dd0`, after `194/194` full tests. It derives S0-S3 from
the exact pre-Stop boundary and no longer grants the planned label merely
because bounded Stop passed. Supplemental Evidence `273`-`277` preserves and
supersedes five erroneous planned-S3 classifications. Four later strict runs
added S3, S3, S1, and S2 respectively. Current Controller A totals are S0
`3/3`, S1 `4/10`, S2 `3/10`, and S3 `5/10`; S4-S6 remain unimplemented as
distinct evidence cases. The production deadline stays `null`, no Start was
replayed after ambiguous output, and Controller B remains untouched. Evidence:
`work/evidence/controller-a-hpt2-observed-case-classifier-correction-20260805.md`.

### 2026-08-05 Controller A S0 matrix pass

Controller A now runs exact bundle
`smi-00-05-00-52edddc39e30-054d5386ad9d-release`; independent observation
verified complete flash SHA-256 `862b8122...7efe`, unchanged CID, and a readable
representative sector. The fresh full-address scrub passed all `15,728,640`
sectors with zero failures, recoveries, or identity mismatch. Canonical HPT
initialization then completed with all three lanes and clean terminal proof;
only read-only reconciliation resumed after the Pi decoder defect was found.

Pi commits `e81e168` and `c6000e6` correct the current initialization seqlock
decoder and admit the canonical completed initialization PASS for HPT2. The
exact-image suite passes `191/191`; release
`hpt2-canonical-init-admission-c6000e6`, image
`sha256:74e3cc95...72b4`, is deployed healthy after backup/restore validation.

Runs `2b143453...7a916`, `df613d0e...78c53`, and
`bd937453...ae42b` each completed one no-replay same-session S0 sequence with
a measured `0 ms` acknowledgement-to-Stop-publication gap, two stable
`STOPPED_CLEAN` observations, terminal proof `0x1F`, and unchanged boot/CID
identity. All three finalized and adjudicated `CASE_PASS`. Current Controller A
progress is S0 `3/3` and S3 `5/10`; production `stop_deadline_ms` remains
`null`; Controller B has not started. Evidence:
`work/evidence/controller-a-hpt2-s0-matrix-pass-20260805.md`.

### 2026-08-05 qualification-only S0 hold candidate and Pi deployment

Same-JLink-session runs, including batched Stop writes, preserved exact
one-shot intents and measured a `0 ms` host-side gap but still completed three
work units. They correctly contribute no S0 case. Firmware now accepts exact
qualification-only token `0x53304844` in the existing reserved word and holds
before first work until exact Stop; normal requests remain unchanged. The
contract/model suite passes `15/15`, and managed Debug/Release rebuilds pass.

Candidate bundle `smi-00-05-00-52edddc39e30-054d5386ad9d-release` is fully
hash-verified and imported valid but unadmitted. Pi commits `2434f87` and
`86ac4c2` bind token emission to both an exact S0 plan and the exact declared
firmware capability. Release `hpt2-s0-hold-86ac4c2`, image
`sha256:826b43fabb3b800eeca445de4d416d8d067ab7f9bdc6f1761f52e26f01d73030`,
is packaged and deployed after `51/51` focused and `188/188` full tests and a
restore-checked backup. Health and firewall gates pass. No controller was
programmed; counts remain S3 `2/10`, S0 `0/3`, and the deadline remains null.

### 2026-08-05 automated S0 attempt and seqlock reconciliation deployment

Pi commits `7c45de38...508` and `40bbf2e1...ac` implemented the first
automated S0 sequence and corrected read-only reconciliation for coherent
status progress. The current deployed release is
`hpt2-reconcile-seqlock-40bbf2e`, image
`sha256:e56f9e8ac45bb0f3ca21d4b57d6c0dba316dd522aa6a05a313737843f6b3fb4c`;
focused tests pass `45/45`, the exact-environment suite passes `177/177`, both
pre-deployment backups passed restore-list validation, and post-deployment
health/firewall/container cleanup gates pass.

Fresh Controller A run `7c7d9812...dee3a` published one immutable Start and
one immutable Stop, never replayed either, retained exact flash/boot/CID
identity, and ended `STOPPED_CLEAN` at `2005/2005/2005` with a `2023 ms`
observation upper bound. Pre-Stop state `2005/2004/2004` makes the run
S1-shaped rather than S0; append-only adjudication currently contributes no
case. S3 remains `2/10`, S0 remains `0/3`, and the production deadline remains
`null`. Separate Start reconciliation and Stop processes are proven too slow;
the next implementation must durably prepare both exact intents and execute
Start-acknowledgement/Stop in one J-Link session.

### 2026-08-05 Controller A HPT2 measurement partial pass

Pi commits through `686a61e5...a10c` implement and deploy run-bound HPT2
measurement admission, exact status observation, stable-terminal finalization,
append-only case adjudication, and sequential admission. Focused tests pass
`41/41`, the full host suite passes `173/173`, backup/restore passes, and live
health/cleanup gates remain good.

Controller A runs `7991b71b...9234d5` and `259a9a0d...232e` each published
one Start and one Stop and reached stable `STOPPED_CLEAN` with terminal proof
`0x1F`, unchanged flash/boot/CID identity, three lanes, and no media failure.
Both contribute valid S3 observations. The first was planned S0 but correctly
rejected for that case because Stop followed substantial verified work.
Current A progress is S3 `2/10`, S0 `0/3`; maximum observed upper bound is
`2051 ms`; production `stop_deadline_ms` remains `null`; B has not started.
Evidence:
`work/evidence/controller-a-hpt2-bounded-stop-measurement-checkpoint-20260805.md`.

### 2026-08-05 HPT initialization adjudicated pass

Owner-authorized operation `d909a40c...32c5` consumed its initialization
mailbox exactly once. A Pi evidence-field length defect occurred after
publication; commit `f4f17af...` plus migration `0017` corrected it, and only
the read-only reconciliation path resumed. The original result remains
`FAILED` because its terminal snapshot lost the transient commissioning
`LastLaneMask` across store reopen. Every other terminal field showed complete,
clean commissioning.

Independent observation `d1c51d83...0cab` then proved exact flash, unchanged
CID, representative-sector readability, `RAW_HPT/HPT_READY`, all three lanes,
and clean health. Pi Evidence `40` adjudicates the physical result
`HPT_INITIALIZED` without altering the original failure or permitting replay.
The firmware source now preserves and requires the three-lane commissioning
mask; `97/97` commissioning checks and the canonical Debug rebuild pass. The
correction was not programmed and HPT2 was not started. Evidence:
`work/evidence/controller-a-f1-a1-hpt-initialization-adjudicated-pass-20260805.md`.

### 2026-08-05 exact-candidate programming and baseline pass

Controller A now runs superseding bundle
`smi-00-05-00-b845d4b9bcfe-4f37e97877d8-release`; guarded programming preserved
VEEPROM and option memory, and independent full-flash/CID observations passed.
Exact-candidate baseline scrub `abc4be6b...8586` passed all `15,728,640`
sectors with zero failures, recoveries, or identity mismatches. Pi commit
`ec2dd1b...` corrects the PostgreSQL scrub-envelope row lock and is deployed
healthy as image `sha256:a09c4193...fe9`. Campaign
`8f3fe483-c783-4170-a720-3c2df3a48fd6` records
`BASELINE_SCRUB_PASSED`. Both controllers are disabled and no tool container
remains. Initialization/whole-card erasure was not performed. Evidence:
`work/evidence/controller-a-b845d4b9-program-verify-baseline-scrub-pass-20260805.md`.

### 2026-08-05 continued coding through remaining software gates

The obsolete bit-3 multi-block rejection diagnostic is corrected to require a
successful bounded two-block read into a safe aligned 1,024-byte static buffer.
Commissioning checks pass `96/96`, managed Debug/Release builds pass, and
superseding bundle `smi-00-05-00-b845d4b9bcfe-4f37e97877d8-release` is imported
valid but unadmitted.

Pi commits `58f4acf...` and `d7547a4...` implement the protected external
approval trust-store reader plus authenticated preparation-only initialization
envelope/status UI. The PostgreSQL lock scope is corrected, `57/57` focused and
`6/6` Compose tests pass, and release `hpt-initialization-ui-d7547a4` is deployed
healthy fixture-only at image `sha256:a999e305...388243`. Live admission,
profiles, roles, endpoints, and tools containers remain disabled. Evidence:
`work/evidence/hpt-initialization-readiness-software-continuation-20260805.md`.

### 2026-08-05 guarded HPT initialization software deployment

Firmware now exposes the fixed 176-byte initialization request, 256-byte
mailbox, 80-byte acknowledgement, and 160-byte progress/terminal status ABI.
The SD-owner thread performs identity, boot, expiry, safe-state, conflict, and
duplicate checks before the existing initialization routine; HMI service 468
cannot publish it. Canonical Debug/Release builds, `95/95` commissioning
invariants, HPT2 checks/model, and `15/15` initialization ABI checks pass.

Pi commit `1572ed39...` and fixture-only release
`hpt-initialization-adapter-1572ed3` add the exact authorization envelope,
durable non-replay operation, one-shot adapter, finite read-only
reconciliation, and post-initialization CID requirement. Focused tests pass
`54/54` plus `5/5` Compose policy checks. Migration `0016` is applied and the
deployment is healthy with all roles/endpoints empty and live admission false.

New bundle `smi-00-05-00-c9ada4d5122b-e51ae77e9fab-release` is imported valid
but unadmitted. No target was contacted or programmed and no card was
initialized. Because this is a different exact firmware image, the earlier
baseline scrub cannot qualify it. Stop at owner review/admission and separate
programming authorization; after programming, recapture full flash/CID and run
a fresh baseline scrub before minting an initialization intent. Evidence:
`work/evidence/hpt-initialization-mailbox-adapter-software-deployment-20260805.md`.

### 2026-08-05 Controller A baseline scrub reconciliation pass

Legacy operation `6279f027-759c-46be-b3ce-ad70766c5707` reconciled through the
dedicated read-only path to `COMPLETED/FULL_ADDRESS_SCRUB_PASS`. Command zero,
all `15,728,640` sectors complete, zero failed or retry-recovered sectors, zero
identity mismatch, HPT status zero, and controller run delta `1,349` passed.
The run word was not replayed.

Post-result observation `c59cb0db-1c00-4226-bd6b-8ed60c5c2f67` passed exact
complete flash, running Controller A/J-Link identity, and the full unchanged
`F1-A1` CID block. Pi Evidence `26`/`27` are the reconciliation transcript and
result; Evidence `28`, CID capture `6`, and campaign event `51` bind the fresh
identity closeout to the same scrub. All temporary A-only registry/firewall
access was removed and HTTP health remained 200.

Campaign assignment `11` is now `BASELINE_SCRUB_PASSED`. The next transition
is destructive HPT initialization. The deployed appliance has no admitted
initialization adapter or machine-intent path and all state-changing profiles
remain disabled, so no manual initialization was attempted. Evidence:
`work/evidence/controller-a-baseline-scrub-readonly-reconciliation-20260805.md`.

### 2026-08-04 Pi HMI-policy deployment and volatile reset gate

Pi commit `d7eb2da...` and deployed image `sha256:09225b...b8fae6` pass
focused, complete, and exact-image test gates. Fresh campaign
`c0b1b669-4828-476f-8879-c1077f139a26` and Controller A observation
`2013ace7-e953-44af-bfe3-31deb34fe384` pass exact flash, running state, and
fresh `F1-A1` CID.

Read-only scrub preflight then found the prior successful terminal structure
latched in volatile SRAM and stopped before minting an operation or writing a
command. Explicit reset/run authorization is required to clear it. Evidence:
`work/evidence/pi-full-address-scrub-hmi-policy-correction-and-reset-gate-20260804.md`.

### 2026-08-04 Controller A target pass and Pi method block

The cadence-mitigated bundle is imported and bound to Controller A. Exact
program/verify/reset/run operation `f38afdd2-45ee-4cb5-9915-593cb018cd88`
and independent observation `e1d03af3-12e0-4398-a85d-1da6e79ea9e9`
passed complete flash, preserved option/VEEPROM, running state, mapping, and
fresh `F1-A1` CID. Scrub operation
`3b04cc35-ce17-4201-88f9-7a885a9300ab` then completed all `15,728,640`
sectors with zero failures, zero recovered retries, and controller run delta
`1,348`.

The Pi classified failure solely because the event-driven HMI thread run delta
was zero, despite the firmware's established contract that the periodic
controller thread is the required liveness witness. Campaign
`738c4a65-acf3-4492-8d17-244ade322670` is blocked with method attribution.
Do not replay, initialize, or proceed to bounded-stop execution. Evidence:
`work/evidence/controller-a-cadence-promotion-and-scrub-liveness-policy-block-20260804.md`.

### 2026-08-04 cadence mitigation and replacement bundle freeze

The baseline timeout was traced to the one-second degraded-media retry backoff
remaining active after every bounded pre-initialization scrub slice. Firmware
now bypasses that backoff only while the scrub is running and retains both the
ordinary retry cadence and the active scrub's one-tick yield. Focused gates,
the deterministic model, commissioning and lifecycle regressions, and
canonical managed Debug and Release builds pass.

Immutable local bundle
`smi-00-05-00-3861b4a2c040-e75e6df95e01-release` passed independent manifest,
source-binding, scrub-ABI, read-only, and S-record review. It was not imported
or programmed, and no target or media was accessed. The old operations remain
consumed, the campaign remains blocked, and `F1-A1` remains uninitialized.
Evidence:
`work/evidence/hpt-full-address-scrub-cadence-mitigation-reviewed-bundle-20260804.md`.

### 2026-08-04 Pi import, new campaign binding, and restored A identity

The reviewed bundle is imported valid but unadmitted at content address
`0fdff39a47a2aeb9a22fe574e83242b322a2a9fafd812020ead5e056f9182761`;
an idempotent second importer pass and the deployed scrub contract loader pass.
Prior campaign `49024955-703c-4990-bed8-225ff3ef8434` is now `BLOCKED` with
its failed operation preserved. New change-impact campaign
`d2263f26-6ac7-4a90-ad80-8875c0c24d2a` is fixture-only `INTAKE`, bound to the
exact new bundle, and assigns `F1-A1`/A and `F1-B1`/B.

After the owner reported canonical Controller A reconnected, one bounded
read-only observation reconfirmed assembly `1751136`, variant `0`, probe
`69664082`, old complete flash `68029e19...7bb28`, and KEXIN CID
`05000C61736466672200001C8901A34F`. The result is linked to the new campaign
as pre-program evidence only; it creates no operation-admitted CID capture.
No target mutation occurred and temporary access was removed. Evidence:
`work/evidence/hpt-preinitialization-scrub-bundle-pi-import-campaign-binding-20260804.md`.

The next gate is explicit code-flash authorization. Post-program exact-flash
observation and fresh boot-relevant CID remain mandatory before scrub.

### 2026-08-04 independent review and immutable bundle freeze

Fresh-context source and package review passed. Exact reviewed candidate
`smi-00-05-00-868598ee08d9-404826a5be8e-release` is frozen read-only under
`tmp/candidate-bundles/`; `bundle-manifest.json` SHA-256 is
`b4422747feaad383df398becda58b94e20fbc5aa0ca5ccde2bf4a7ef415da3e2`.
The content-derived source snapshot is
`868598ee08d91fcbe76f346fdf9c315d02ad27083e364d3b180d78e42469800f`,
and the mapping exports the unchanged scrub command/status ABI. No controller
or SD card was accessed. See
`work/evidence/hpt-preinitialization-full-address-scrub-reviewed-bundle-20260804.md`.

The next gate is Pi import and exact campaign binding, not hardware execution.
Programming, operation, and fresh boot-relevant CID evidence remain separately
required, and `F1-A1` must remain uninitialized and unwritten.

### 2026-08-04 pre-initialization scrub software correction

The source-only resume task is implemented and passes focused tests plus
canonical managed Debug and Release rebuilds. The scrub can now acquire and
release its own bounded raw-media session when the card is still
`NEEDS_INITIALIZATION`; initialized HPT scrubs retain their existing open-store
path. CID is rechecked after acquisition and at termination, the direct scrub
path remains read-only, and active execution blocks background
reclassification. The fixed Pi/J-Link command/status ABI remains unchanged at
`0x20055F80/0x04` and `0x20055F90/0x68`.

Evidence and exact hashes are recorded in
`work/evidence/hpt-preinitialization-full-address-scrub-software-gate-20260804.md`.
This is not an immutable candidate or physical qualification. No hardware was
contacted or programmed, and the last verified physical state remains the
preserved first-failure checkpoint. Next review/freeze the source, create a new
bundle and Pi campaign binding, and obtain separate programming/operation
authorization plus fresh boot-relevant CID evidence before any new scrub.

### 2026-08-04 office-move handoff

The workspace is safely paused. No hardware action, operation replay, firmware
programming, HPT initialization, or media write is authorized by this handoff.
Resume from the 2026-08-03 failure checkpoint below; do not reread the archived
raw evidence unless a specific historical capture is needed.

- The local firmware workspace remains intentionally dirty and uncommitted;
  preserve all existing user changes. The standalone Pi application repository
  is clean on `codex/full-address-scrub-adapter`.
- The compact archive record is
  `work/evidence/work-evidence-external-archive-20260803.md`. Raw evidence is
  retained outside Git at
  `E:/dev/high_point/evidence-archive/7520553_SMI_FW/work-evidence-raw-20260803.tar`
  with SHA-256
  `7f1cd4c6235873816d80009bf1a5a74a1b3b59b7974409fc9204c71e4c5856e2`.
- Four ignored staging copies under `tmp/` were verified untracked and removed
  under the owner's cleanup approval: `bc0b6ce4-bundle-worktree`,
  `hpt-v0.5-extract-20260802`, `hpt-validator-stage`, and
  `sd-qualification-stage` (`18,771` files; `486,520,866` bytes). They were
  disposable clones/extractions, not canonical evidence or source.
- The terminal operation and target state remain the ones recorded below:
  preserve operation `e36882de-ebf5-4b35-93ef-698e352a553c`, leave `F1-A1`
  uninitialized and unwritten, and keep production roles/endpoints empty.
- The exact first task on return is source-only: review
  `hptFullAddressScrubPreconditions()` and design a bounded raw-card read path
  that is valid before HPT initialization. Do not flash or run hardware until
  that correction has been reviewed and separately authorized.

No operator action is required during the move.

### 2026-08-03 full-address scrub adapter and first-failure checkpoint

This checkpoint supersedes the older implementation-next-action bullets below.
The Pi-owned adapter is implemented, tested, deployed, and read-only
preflight-qualified, but the first real baseline operation exposed a firmware
method defect and failed before reading media.

- Pi commits `c86c58f` and `df7ddc9` implement the exact bundle/map/S-record,
  exact controller/CID, full-flash, single-word allowlist, durable non-replay,
  finite polling, immutable evidence, and read-only reconciliation paths.
- All `142` final SQLite application tests pass; the final `12` focused tests
  and migration 0014 pass against isolated PostgreSQL. The earlier complete
  PostgreSQL suite passed with its required executable fixture mount.
- Migration 0014 is deployed. Final image
  `sha256:46a75399538c0a7c34ab48b6135c3532f0f2ae1d2de9a9bf4c0ce9e5c46173bb`
  is labeled `full-address-scrub-reconcile-df7ddc9` / source `df7ddc9...`.
  Pre-migration backup `sd-qualifier-20260803T200405Z.dump` passed restore-check.
- Exact read-only preflight passed Controller A/F1-A1: flash
  `68029e19...7bb28`, CID `05000C61736466672200001C8901A34F`,
  CID-valid and representative-sector-read true, command zero, idle status,
  command/status addresses `0x20055F80`/`0x20055F90`.
- Durable one-shot `BASELINE` operation
  `e36882de-ebf5-4b35-93ef-698e352a553c` consumed the run command once and was
  never retried. Read-only reconciliation records stable
  `FAILED/FULL_ADDRESS_SCRUB_FAILED`: state `3`, HPT status `3`, identity
  mismatch `1`, read attempts `0`, geometry/sectors `0`, controller/HMI run
  deltas `8638`/`21`, command `0`.
- Root cause is architectural: frozen
  `hptFullAddressScrubPreconditions()` requires `RAW_HPT`, `HPT_READY`, and an
  open HPT store, while the required baseline occurs before initialization and
  F1-A1 is correctly `NEEDS_INITIALIZATION`. The diagnostic therefore rejects
  the card before geometry or any read. Its terminal CID refresh returned
  driver status `7` and cleared the identity payload.
- Authoritative Pi failure manifest:
  `jong@srv-rpi00.local:~/dev/sd_qualification/work/evidence/kexin-f1-a1-full-address-scrub-baseline-failure-20260803.md`
  (SHA-256 `3ee7b01012553d35d37d99e97522aaba892f5768631dd4cda905099a25deab42`).
- Persistent roles/endpoints are empty, production registry hash remains
  `47f0839e...83d15`, temporary firewall rules are removed, only the default
  non-loopback J-Link drop remains, no one-shot container remains, and the card
  has not been initialized or written.

Do not replay this operation or bypass the Pi system of record. The next work
requires a reviewed firmware-method correction (or a formally equivalent
pre-write qualification method), a new immutable firmware bundle and campaign
binding, code-flash promotion authorization, and fresh boot-relevant CID
evidence. Hardware programming remains separately gated and is not authorized
by this checkpoint.

Restart from this checkpoint after 2026-08-03. No operator action is currently
required.

- Campaign `49024955-703c-4990-bed8-225ff3ef8434` remains fixture-only in
  `INTAKE`; KEXIN samples `F1-A1` and `F1-B1` are inventoried, photographed,
  permanently labelled, expendable, and assigned to A/B respectively.
- Controller A is powered on with `F1-A1` installed. Qualified power operations
  `9ca65506-f4c9-4eb8-9e06-d6d61b0e23d6` (off) and
  `9bc8d582-63ee-4621-a0e3-2e6eb1971382` (on) both passed. Do not ask the
  operator to move this card.
- Read-only observation `0759befe-4efe-4652-ba6b-94f61180bee4` passed against
  exact flash `68029e19...7bb28`; the observer container exited and the
  temporary firewall rule was removed. Default loopback-only J-Link-port
  policy is restored; all observer/programmer/HPT2 roles and endpoints remain
  empty.
- `F1-A1` baseline CID `05000C61736466672200001C8901A34F` is registered as
  `CardIdentityCapture` 1 and controller observation `Evidence` 6; CID-valid
  and representative-sector-read are true. Detection state is
  `NEEDS_INITIALIZATION`, as expected before HPT media-2.0 initialization.
- Authoritative manifests are
  `jong@srv-rpi00.local:~/dev/sd_qualification/work/evidence/kexin-f1-ab-pre-run-appliance-status-20260803.md`
  and
  `jong@srv-rpi00.local:~/dev/sd_qualification/work/evidence/kexin-f1-a1-baseline-cid-20260803.md`.
- The owner confirmed that A/B are isolated bench test controls with no heater,
  load, or production connection. Do not repeat heat/alarm safety reviews.
  Continue enforcing verified power-off before every SD insertion or removal.
- The next gate is a full-address baseline read scrub with zero unreadable or
  retry-recovered sectors. Firmware capability exists (`RUN` command
  `0x48534352`), but the deployed Pi qualifier has no live scrub adapter or
  management command. Do not bypass the Pi system of record with the older
  Windows/J-Link harness.
- In the fresh session, first inspect the frozen scrub command/status ABI and
  add the smallest exact-bundle, exact-controller, exact-CID, one-shot Pi
  adapter with fixed write allowlisting, finite polling, immutable evidence,
  no retry/replay, and cleanup. Test on PostgreSQL and SQLite, build/deploy the
  Pi image, refresh the pre-run manifest, then run the read-only scrub.
- Do not initialize or write `F1-A1` until the baseline scrub passes. After it
  passes, the already-confirmed expendable-media scope permits separately
  recorded HPT media-2.0 initialization, reopen proof, and a fresh full CID
  capture before endurance Start.

Continue through
`work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md`.

## Planning Authority and Execution Boundary

This workpackage in `E:/dev/high_point/7520553_SMI_FW/work/` is the sole active
Tool Shed plan for Pi qualification-application development. The Pi repository
at `jong@srv-rpi00.local:~/dev/sd_qualification` remains authoritative for its
source, migrations, tests, runtime/deployment configuration, application
documentation, generated qualification evidence, result ledger, reports, and
release history.

All Pi code changes are planned and statused here, then implemented and
verified in the Pi repository. The Pi repository's former active `work/` maps
and workpackages are historical planning inputs and must not create an
independent next-action queue.

This planning consolidation does not move controller execution into the
firmware process. The deployed Pi application remains the sole coordinator for
J-Link, controller, power-service, media, and endurance operations after every
applicable readiness, safety, identity, and authorization gate passes.

## Current Baseline

- Existing application: authenticated server-rendered Django UI at
  `http://srv-rpi00.local/sd-qualifier/`.
- Runtime: Django web, PostgreSQL, durable command worker, and durable
  notification worker.
- Current source status: clean `main` at `32b636c`; current deployed status:
  healthy exact fixture-only release `readiness-gates-32b636c`; live admission
  is false.
- Current mainline observed on 2026-08-02: clean `main` at `32b636c`, after
  integrating bounded notification-worker SMTP egress through PR #9,
  confining the SMTP credential to that worker through PR #10, adding
  deterministic reminder/escalation coverage through PR #11, and removing
  automatic certification-file retrieval through PR #12, exact HPT validator
  fixture admission through PR #13, explicit audit actors through PR #14, and
  retained admission-state reporting through PR #15, executing the admitted
  HPT fixture through PRs #16/#17, and adding the bundle-bound read-only
  controller observer through PR #18, the separately gated Controller A
  code-flash programmer through PR #19, and pre-target-only SEGGER Remote
  Server readiness handling through PRs #20/#21, and the explicit unsupported
  stop/recovery live-admission gate through PR #22 and the selected
  `HPT2_ENDURANCE_BASELINE_V1` fixture contract/readiness UI through PR #23,
  binding it to the linked firmware ABI through PR #24, correcting stale
  firmware-readiness wording through PR #25, and merging the fixed-mailbox
  serialization/runner/transcript/terminal-evidence core through PR #26 and
  durable authorization/phase orchestration, protected operation-only tools
  service, and read-only acknowledgement reconciliation through PR #27, then
  the authenticated preparation-only operator/reviewer UI and web/tools
  endpoint separation through PR #28, correcting cross-phase probe identity
  comparison to ignore ordinary positive VTref drift through PR #29, and
  correcting PostgreSQL HPT2 preparation row-lock scope through PR #30, and
  classifying readiness gates, admitting the immutable fixture-image identity,
  and splitting HPT2 write from bench-power/raw-media authority through PR #31.
- Stage 2 is deployed fixture-only as exact release identity
  `standalone-foundation-stage2-9327e28`. Its bundle, protected-registry,
  admission, clock, worker, lease, image/SBOM, offline media, migration,
  rollback, and disconnected fixture gates pass. Live admission remains false.
- Stage 3 introduced bundle-bound campaign identity, card/certification
  inventory, CID history, intervention acknowledgement, lifecycle gates, and
  evidence/report downloads. Its former automatic certificate-retrieval slice
  is superseded and removed; certification is now an operator-supplied,
  append-only evidence-metadata and review workflow.
- Stage 4 notifications are deployed and qualified fixture-only as exact
  release identity `notification-stage4-complete-4523e69`. Gmail DNS/TLS and authenticated SMTP
  connection pass. Only `notification-worker` joins the outbound network and
  receives the app password; web, command-worker, migrations, PostgreSQL, and
  tool services do not. One durable Gmail notification was accepted in one
  attempt, confirmed by the recipient, and append-only acknowledged with zero
  reminders/escalations. A second notification preserved a controlled failed
  attempt, honored the real retry backoff, recovered through Gmail, was
  recipient-confirmed, and was acknowledged. Deterministic tests cover action,
  reminder, and escalation without changing campaign state.
- The current exact deployed release is `readiness-gates-32b636c` at source
  `32b636c048fdf680f9de49b4aa164f6dc59dd817`, image
  `sha256:ffef68210a538d9868b0b1056124f14f6428b8b5ae92000b45dd36dfa27cdd4b`.
  Migration 0013, authenticated preparation-only HPT2 UI, and durable
  operation/phase storage are deployed fixture-only. The prior
  `hpt2-firmware-contract-1b7fa39` image is retained under an explicit rollback
  tag with a verified pre-upgrade database backup.
  The network fetch module, endpoint, form, UI, readiness check, policy file,
  release-package input, and `CERTIFICATE_FETCH_FAILED` intervention were
  removed. Manual immutable records, reviews, supersession, source references,
  hashes, evidence paths, and `CERTIFICATE_REQUIRED` remain. HPT validator
  v0.5.0 is imported under outer manifest `91135e68...e7c7` and admitted only
  at fixture scope. Its immutable fixture command/result/evidence path passes.
  Health is green with `fixture_only=true` and `live_admitted=false`; both
  protected controller entries remain disabled for qualification and
  physical-media authority remains false.
- The firmware workspace now has a host-tested profile ABI and fixed-mailbox
  source candidate:
  fixed 216-byte request, 208-byte coherent status, typed linked API descriptor,
  duplicate rejection, exact CID/boot/profile binding, first-failure latch, and
  bounded stop between complete append/readback work units. Nine profile-model,
  95 HPT commissioning, and 16 lifecycle-policy checks pass, as do clean managed
  Debug and Release rebuilds. The Pi source runner core passes 18 focused, 113
  application, and 15 interface/regression tests. The expanded durable
  orchestration/service and authenticated preparation-only UI source passes 33
  focused, 128 application, and 16 interface/regression tests. Exact merged
  image `sha256:d837e727...b40049` and release
  `hpt2-operator-ui-351182d` are packaged, hash-verified, and deployed
  fixture-only with migration 0013. The browser has no target endpoint or
  execution action, roles/endpoints remain empty, no controller was accessed,
  no live Pi command adapter is admitted, and the stop deadline is still
  unset. The exact image passes all `129` application tests on PostgreSQL and
  all `129` on SQLite; the deployed production database has zero physical
  samples, zero CID captures, and zero HPT2 command operations.
- The matching profile contract is deployed with SHA-256 `945ebbc6...e434e00`.
  The live API explicitly says the linked ABI requires target qualification
  and keeps adapter, stop, recovery, regression, and authorization blockers
  visible. All state-changing capability flags remain false.
- The newer fixed-mailbox SMI bundle
  `smi-00-05-00-bc0b6ce4d066-release` is imported valid but unadmitted and
  stored under content address `5df475bd...176ce`. Its stored profile
  `945ebbc6...e434e00`, mapping `0b8b68c3...f24770`, and fixed 256-byte
  mailbox/80-byte acknowledgement/208-byte status contract pass the deployed
  Pi validator. Both controllers remain disabled and now bind the newer
  manifest. The earlier separately authorized Controller A programmer installed
  and complete-readback verified candidate flash `d1babfa7...`; that historical
  observation passed its exact-flash/CID/HPT gate.
  Controller B's operation `7d3be985...` subsequently passed exact
  fixed-mailbox program/verify/reset/run with unchanged VEEPROM and option
  memory. Its first independent post-program read-only mapped-state/CID/HPT
  attempt stopped before result/CID/HPT
  publication because the Pi observer compared normal VTref drift as probe
  identity. PR #29 fixes that defect and is deployed. Freshly authorized
  operation `a05bc76d...` then passed exact flash, stable mapped state, a full
  same-run CID, and HPT readiness without reusing the consumed authority. The
  owner then authorized the remaining A promotion end-to-end: operation
  `ae2fe6ff...` passed exact fixed-mailbox programming with unchanged VEEPROM
  and option memory, and independent operation `e140c0f2...` passed exact flash,
  stable mapped state, its distinct fresh CID, and HPT readiness.
- Existing domain support: card families, physical specimens, campaigns,
  assignments, events, fixture runs, interventions, reviewer dispositions,
  terminal results, immutable evidence manifests, and historical review.
- Remaining operational foundation: expendable A/B sample intake, measured and
  reviewed A/B stop/recovery, command-adapter admission, authorized endurance orchestration, physical
  reader/card admission, and complete production UI/result flow.

## Goal

Deliver one independently runnable Pi application hosted on
`srv-rpi00.local`. The production website, PostgreSQL database, persistent
coordinator, workers, evidence ledger, backups, and protected controller and
power-service adapters all run on that appliance. The firmware workspace may
supply reviewed inputs and receive immutable results, but it is not a runtime
dependency.

The application has two operating modes:

1. Firmware-development qualification records complete results locally and
   returns an immutable manifest here only when firmware correction or release
   review requires it.
2. Standalone released-media qualification runs endurance and card-family
   campaigns without this workspace and retains its complete operational and
   approval history in the Pi application.

Both modes use the same UI, backend policy, controller adapter, result schema,
evidence rules, safety gates, and notification system. Do not create a second
frontend or a browser-to-controller control path.

## Governing Application-First Direction

The primary deliverable is the website-driven SD-card qualification
application at `http://srv-rpi00.local/sd-qualifier/`. The application must let
an operator start a campaign, identify and bind the physical card, follow the
required directions, allow the application to execute every automatable
qualification step, respond to explicit physical or review gates, and receive
an auditable final conclusion. Firmware, diagnostics, controller adapters,
power control, and independent media validation are supporting capabilities;
they are not separate substitutes for the application workflow.

The governing end-to-end operator journey is:

1. Open the landing page and see active, waiting, stopped, and historical
   campaigns.
2. Resume an existing campaign or start a new campaign from a versioned
   qualification definition.
3. Identify the card through operator traceability data plus the required CID
   identity capture; bind every later observation to that physical identity.
4. Review readiness, safety, firmware/profile, controller, evidence-storage,
   and authorization gates in the application.
5. Start the campaign once. The persistent coordinator advances all
   automatable steps and stops only at a terminal result or a genuine operator,
   safety, authorization, or review gate.
6. Use the campaign page to see the exact current step, completed steps,
   failures, waiting reason, completed/total work, elapsed time, and a
   continuously revised estimate to completion.
7. Follow explicit in-application directions for any required physical action.
   SD insertion, removal, or replacement always requires verified controller
   power off; powered SD hot swapping is prohibited.
8. Review the evidence-backed final `PASS`, `FAIL`, `INCONCLUSIVE`, or
   `BLOCKED` conclusion and export the immutable campaign report and manifest.

Campaign duration is derived from the versioned step definitions, measured
progress, retries, and operator gates. The application must not represent the
campaign as an arbitrary 29-day assignment or require the operator to manage a
chain of separately scheduled cases.

## Qualification Contract Gate

The application must not be built around loosely related buttons or historical
scripts. Before execution controls are considered complete, one versioned,
machine-readable qualification contract must define:

- the campaign purpose, supported card scope, required firmware/profile, and
  final disposition rules;
- every ordered step and optional substep, including its stable identifier,
  operator explanation, prerequisites, inputs, responsible executor, expected
  duration, timeout, outputs, and immutable evidence requirements;
- whether a step is automatic, operator-performed, reviewer-performed, or an
  explicitly authorized external operation;
- pass, fail, blocked, inconclusive, skipped, retry, bounded-stop, and resume
  rules, including which transitions are legal and which require new authority;
- baseline and repeat CID identity captures after every relevant card
  replacement, power-off reinsertion, initialization, or reboot;
- failure attribution, first-failure preservation, result aggregation, and the
  exact rule that produces the final campaign conclusion;
- restart, lease recovery, idempotency, and no-replay behavior for each
  state-changing operation;
- the data needed to calculate completed steps, total steps, progress, and ETA
  without inferring state from page visits or process presence.

The contract is the common source for campaign creation, left-pane navigation,
coordinator transitions, controls, notifications, result derivation, reports,
tests, and historical replay. A change creates a new contract version; it does
not silently reinterpret an existing campaign.

## Page and Navigation Contract

All authenticated pages use one template with a header, footer, left navigation
pane, and right content pane. Pages stay short; tabs divide long content into
small operational parcels.

The landing page provides:

- a prominent entry point to start a new campaign;
- active campaign cards with direct resume links;
- separate access to waiting/stopped campaigns and campaign history;
- visible state, completed/total steps, current activity or waiting reason,
  last update, and estimated completion for every nonterminal campaign.

Inside a campaign, the left pane becomes a persistent step navigator. It keeps
a clear return to all campaigns, identifies the campaign and bound card, shows
overall state/progress/ETA, and lists every step in contract order. Each step
uses both a visible label and a non-color-only icon/style for at least `NOT
STARTED`, `READY`, `RUNNING`, `WAITING`, `STOPPED`, `BLOCKED`, `PASS`, `FAIL`,
`INCONCLUSIVE`, and `REVIEW REQUIRED`. The selected/current step receives the
strongest emphasis. Tooltips available by hover and keyboard focus add exact
status, timestamps, substep progress, blocker/failure detail, and the next
required action; they do not replace visible status text.

The right pane shows the selected step's purpose, prerequisites, directions,
current activity, evidence, result, and only the controls legal in the current
state. Operators may inspect completed or future steps without changing
execution. The campaign uses compact tabs such as Overview, Card and Setup,
Qualification, Results, and Activity when the selected content would otherwise
make the page long.

## Campaign Control Contract

- Browser requests create audited intents; the browser never talks directly to
  a controller, J-Link, relay, or raw block device.
- The persistent coordinator owns the campaign state machine and schedules
  only contract-defined work through admitted adapters and durable workers.
- Controls are state-derived and explicit: start, acknowledge, request bounded
  stop, resume when legal, retry when authorized by the contract, and submit
  reviewer disposition. A control is hidden or disabled with a stable reason
  when its transition is not legal.
- Page refresh, web-process restart, worker restart, network loss, duplicate
  submission, or operator logout cannot replay a state-changing action or lose
  authoritative progress.
- `RUNNING`, `STOPPED`, and `WAITING` describe durable workflow state, not the
  mere presence or absence of a host process.
- Failures remain visible at the affected step and at campaign level. The
  system preserves first failure and later recovery evidence rather than
  overwriting either.

## Required Supporting-Detour Stop

If application work proves that a required capability is missing outside the
application, stop the affected application work and report the boundary
explicitly as:

> APP DEVELOPMENT PAUSED - SUPPORTING DETOUR

The report must identify the missing firmware function, diagnostic, operating
service, power capability, validator interface, or other dependency; show the
evidence that it is missing; explain why the qualification contract requires
it; distinguish a blocker from an optional improvement; define the smallest
supporting change; identify risks and verification; and name the exact
application acceptance gate where work resumes. Record the detour as its own
linked ticket or bounded spike. Do not silently add firmware scope, implement
specimen-specific behavior, or use a support detour to continue controller work
outside the application.

## Application-First Delivery Stages

These stages govern new work. Passing a component test, build, deployment, or
individual controller case does not advance the plan unless the stage's
operator-level exit evidence also passes.

| Stage | Outcome | Entry Evidence | Exit Evidence |
| --- | --- | --- | --- |
| 0. Inventory current application truth | Establish what the deployed application, database, coordinator, workers, adapters, pages, controls, and existing contracts actually provide | Read-only access to source, tests, deployed pages, schemas, and current runtime status | A gap inventory maps every required operator journey and qualification-contract element to present, partial, missing, obsolete, or outside-app support; no live campaign is altered |
| 1. Freeze the qualification contract | Create one versioned executable definition of the complete card-qualification process and final conclusion | Stage 0 inventory and current qualification requirements | Schema validation, transition tests, example campaign expansion, identity/evidence rules, ETA inputs, and reviewer approval pass; unresolved outside-app requirements are explicit detours |
| 2. Establish the shared application shell | Replace the current landing and campaign navigation with the agreed header/footer/left-pane/right-pane template | Frozen page/state vocabulary from Stage 1 | Authenticated desktop, keyboard, and small-screen tests prove active/history/start entry points, short tabbed pages, campaign step navigation, accessible status indicators, and no accidental actions |
| 3. Implement campaign creation and card binding | A normal operator can create a campaign, enter traceability, capture and verify CID, and see all readiness gates | Stages 1-2 and admitted read-only identity interface | A fresh fixture campaign binds an exact card identity, rejects missing/mismatched identity, records contract version, and reaches `READY` without shell access |
| 4. Implement durable campaign execution | One Start action advances every automatable step and pauses only at genuine gates | Contract, legal transition model, durable intent/lease/no-replay foundation, and admitted fixture adapters | Fixture campaigns prove run, wait, bounded stop, resume, failure, restart, duplicate submission, and no-replay behavior while UI and coordinator states remain identical |
| 5. Integrate qualification operations | Contract steps call only admitted controller, power, validator, and evidence interfaces | Stage 4 plus each separately qualified adapter and authorization boundary | Representative non-destructive and controlled state-changing fixture cases produce exact step evidence and failure attribution; any missing external capability follows the supporting-detour stop |
| 6. Complete results, review, and history | Every campaign reaches an evidence-backed terminal conclusion and remains searchable | Deterministic step outputs and aggregation rules | Pass/fail/inconclusive/blocked fixtures, reviewer disposition, immutable manifest/report export, historical reconstruction, and notification deep links all agree |
| 7. Deploy and qualify the appliance application | The exact release runs independently on `srv-rpi00.local` | Stages 0-6, release identity, backup, restore, rollback, and deployment plan | Exact-image tests, migrations, health, authenticated browser workflow, restart/recovery, backup/restore, and rollback verification pass in the target environment |
| 8. Prove the complete operator journey | A normal operator completes a controlled representative qualification solely through the website | Stage 7 and separately authorized physical/controller scope | From landing page through card identity, one Start action, genuine interventions, final conclusion, report, and history, no SSH-selected cases or hidden manual orchestration are required |

## Governing Current Tasks

- [x] Complete Stage 0 as a read-only deployed/source inventory before making
  another application design or implementation change. See
  `work/inventories/inventory-sd-qualification-project-current-state-inventory.md`.
- [ ] Reconcile the existing eight-step traveler, coordinator plan, and
  qualification documentation into the Stage 1 versioned qualification
  contract; identify gaps rather than filling them by assumption. The
  human-readable governing front door is now
  `docs/sd-card-qualification-contract.md`; the selected machine-readable
  application source and focused validation pass, while plan binding,
  transition fixtures, and current-campaign admission remain.
- [ ] Produce the state/transition table and control-availability rules used by
  both the coordinator and UI.
- [ ] Define the landing-page, campaign-shell, left-step-navigation, and
  right-pane acceptance fixtures before rebuilding the pages.
- [ ] Classify every discovered external dependency as already supported,
  missing/blocking, or optional; invoke the supporting-detour stop for any
  missing blocker.
- [ ] Implement and verify Stages 2-8 in order, preserving the current live
  campaign and unrelated workspace changes until a reviewed migration path
  explicitly covers them.

## Required Operator Experience

The existing UI must let an authenticated operator:

- import and select a reviewed immutable firmware bundle and campaign profile;
- see appliance, storage, clock, worker, registry, controller, admission, and
  authorization readiness with stable blocker codes;
- create card families and physical specimens with procurement, package,
  receipt, photo, expendable-state, custodian, and prior-use details;
- capture and review CID identity at baseline and after every relevant
  power-off replacement, initialization, or reboot;
- guide a powered-off card transfer to an identified Pi reader, invoke only the
  admitted pinned HPT validator read-only, and present its independent result
  separately from controller evidence;
- start only named, admitted, authorized qualification actions;
- monitor elapsed time, wrap count, heartbeat, current stage, controller/card
  identity, evidence health, and the latched first failure;
- request a bounded stop without exposing arbitrary shell, J-Link, memory,
  relay, or block-device controls;
- review derived `PASS`, `FAIL`, `BLOCKED`, or `INCONCLUSIVE` results, evidence
  hashes, failure attribution, dispositions, and final family approval;
- leave and resume without losing authoritative progress or intervention
  state.

## Card Certification Records

Add a first-class immutable certification-document record associated with the
exact card family and, where relevant, its package SKU, revision, or lot. It
must record:

- certification type and issuer;
- source URL or operator-supplied source reference;
- operator registration timestamp and actor;
- exact file size, media type, SHA-256, and immutable evidence reference;
- claimed product identity and its match to the registered family;
- verification status, reviewer, reason, and supersession history.

The appliance does not fetch certification files from the network. An operator
places the exact file in approved evidence storage and registers its immutable
metadata and source reference. A registered document is evidence, not proof of
card authenticity. Missing, ambiguous, unavailable, or mismatched evidence
remains visible through the certification and review workflow and must never be
silently converted into approval.

## Operator Intervention and Email Policy

Use the existing durable notification outbox and authenticated deep links.
Add versioned intervention types at minimum for:

- `CARD_SWAP_REQUIRED`;
- `CARD_DETAILS_REQUIRED`;
- `CERTIFICATE_REQUIRED`;
- `RUN_BLOCKED`;
- `FIRST_FAILURE`;
- `REVIEW_REQUIRED`.

Email is advisory. It cannot approve, authorize, resume, retry, stop, or
execute a physical action. Each message must name the campaign, specimen,
condition, requested action, current safe-state status, and authenticated UI
link. Delivery attempts, reminders, escalation, acknowledgements, and failures
remain auditable and do not change qualification outcome.

An SD-card swap instruction is valid only after controller power-off is proven
or explicitly confirmed through the approved operation. The workflow must
remain blocked until the replacement is registered and a fresh CID identity
capture passes. Powered SD insertion or removal is prohibited.

## Prior Component Delivery History (Non-Governing)

The following stages preserve how the existing components were accumulated.
They are historical inputs and do not supersede the application-first stages
or prove the end-to-end operator application complete.

| Stage | Outcome | Exit Gate |
| --- | --- | --- |
| 0. Consolidate planning authority | This workpackage is the sole active Pi coding plan; remote `work/` is historical | Local map/index and remote directives agree; no competing remote next action remains |
| 1. Integrate the UI baseline | Operator-readiness changes are reviewed and integrated in the Pi repository | Clean mainline checkpoint, application tests, deployed fixture health, and rollback identity pass |
| 2. Complete standalone foundation | Immutable bundle store, protected A/B registry, fail-closed admission, and appliance/evidence health services exist | Negative tests pass and the fixture workflow runs with firmware-development workspaces disconnected |
| 3. Complete operator frontend | Existing pages expose bundle, inventory, certificate, readiness, progress, result, evidence, review, and intervention flows | Authenticated fixture workflow passes end to end without shell access or a second application |
| 4. Qualify notifications | Production SMTP policy, retry, reminder, escalation, outage, and recovery are proven | Test delivery and failure recovery pass without changing safety or result state |
| 5. Add authorized read-only controller integration | Exact bundle/registry-backed A/B identity and snapshot adapter is available | Read-only A/B gate passes with no programming, reset, power, or media write |
| 6. Add controlled physical, independent-validation, and endurance profiles | Named controller, HPT validator, power-service, fault, recovery, and endurance operations run through the Pi app | Each profile has explicit safety/identity/authorization gates, powered-off SD transfer rules, and representative evidence |
| 7. Prove standalone operation | Released bundle and profiles run without this workspace | Restart/recovery, result retention, email intervention, review, report, backup, and restore pass |

Stages 0 through 5 are complete as of 2026-08-02. The deployed read-only
integration has passed its firmware-mismatch negative cases and exact
fixed-mailbox A/B programming plus independent flash/state/CID/HPT gates. The independently loadable
operator application is integrated and deployed fixture-only on clean `main`
at `e9edba3`. Automatic certificate retrieval has been removed by owner
decision; no provider hostname or fetch-policy gate remains. The exact HPT
v0.5.0 bundle is imported, fixture-admitted, and proven through its immutable
fixture command/result/evidence flow. This does not make exact-candidate
controller or raw-device admission ready.

## Prior Component Task Ledger

This ledger preserves completed and previously identified component work. Open
items must be reconciled into the governing stages before execution; their
presence here is not an independent next-action queue.

- [x] Consolidate active Pi planning into this Tool Shed.
- [x] Review and integrate `agent/operator-ui-appliance-status` into the Pi
  repository's mainline using its normal review workflow.
- [x] Implement the content-addressed offline bundle importer on draft PR #5.
- [x] Implement the protected controller/bench registry and admission service
  on draft PR #5.
- [x] Complete appliance, evidence-storage, clock, database, worker, and
  adapter-state health checks.
- [x] Produce exact source/image/SBOM identity and offline media containing the
  application and digest-pinned PostgreSQL runtime.
- [x] Prove baseline-to-Stage-2 migration, verified backup/restore rollback,
  disconnected fixture operation, and fixture-only deployment recovery.
- [x] Extend the current Django pages for bundle selection, registry summary,
  admission gates, resumable progress, derived results, and evidence links.
- [x] Import and admit the pinned HPT validator bundle and its result schema;
  keep validator facts distinct from controller-derived facts.
- [x] Invoke the admitted validator against an immutable fixture image and
  ingest its bounded terminal result/evidence manifest without exposing a raw
  device or controller path.
- [x] Complete physical-card inventory, photos, receipt traceability, CID
  capture/history, and certification-document workflows.
- [x] Remove automatic certification-file retrieval and its provider-hostname
  policy while retaining manual immutable records, review, and
  `CERTIFICATE_REQUIRED`.
- [x] Configure Gmail SMTP, prove authenticated transport, and confine its app
  password to the notification worker without storing it in Git or logs.
- [x] Implement bounded intervention types, auditable acknowledgement, and the
  non-resuming notification outbox behavior.
- [x] Qualify one durable Gmail delivery and append-only operator
  acknowledgement without changing campaign safety or result state.
- [x] Qualify SMTP retry, reminder/escalation, outage, and recovery using
  protected configuration without changing safety or result state.
- [x] Implement, test, review, merge, and deploy the separately authorized,
  bundle/registry-bound read-only Controller A/B observer with roles and
  endpoints disabled by default.
- [x] Prove the Controller A firmware-mismatch negative gate without mapped RAM
  access and prove Controller B is rejected before endpoint access.
- [x] Program/verify/reset/run the exact candidate on Controller A through the
  separately gated Pi tool, preserve VEEPROM and option memory, and pass the
  post-program read-only firmware/CID/HPT gate.
- [x] Establish exact fixed-mailbox Controller A/B read-only identity before any
  qualification campaign. Both roles bind `5df475bd...176ce`; B operations
  `7d3be985...`/`a05bc76d...` and A operations
  `ae2fe6ff...`/`e140c0f2...` pass programming, independent exact-flash/stable
  state, fresh CID/HPT, and cleanup.
- [x] Expose and fixture-test `BOUNDED_STOP_RECOVERY_UNSUPPORTED` in the health,
  appliance-status, and operator UI surfaces; keep every state-changing
  profile disabled.
- [x] Select `HPT2_ENDURANCE_BASELINE_V1` as the first state-changing HPT media
  2.0 profile; define its normal production-path work unit, exact request and
  identity requirements, acknowledgement, between-committed-work-unit stop,
  terminal/stopped-activity proof, no-replay recovery, exclusions, and live
  blockers in `docs/hpt2-endurance-baseline-v1.md`; fixture-validate and expose
  the selected contract in the Pi UI/API without adding a Start or Stop action.
- [x] Implement the selected profile's firmware request/duplicate-rejection,
  coherent heartbeat/status, bounded-stop, terminal proof, fixed command
  mailbox, and interrupted-session recovery ABI with deterministic host/model
  coverage.
- [x] Implement and merge the Pi fixed-mailbox serialization, exact command
  allowlist, one-shot runner, pre-target-only reconnect, post-write no-replay,
  transcript validation, and terminal-evidence core through PR #26 without a
  service, UI, deployment, or live admission path.
- [x] Bind the Pi core to durable pre-target intent and append-only phase state,
  exact bundle/registry/authorization checks, and read-only acknowledgement
  reconciliation behind a protected one-shot operation-only tools service with
  roles and endpoints disabled by default through PR #27.
- [x] Implement, software-test, review, and merge the authenticated
  operator/reviewer UI through PR #28 for
  exact authorization, immutable operation preparation, and phase/evidence
  display. The web process must not publish/reconcile, choose endpoints, or
  accept raw target data.
- [x] Build and Pi-test exact merged image `sha256:d837e727...b40049`, package
  release `hpt2-operator-ui-351182d`, and verify every offline release member.
- [x] Execute the separately authorized fixture-only backup/restore, migration
  0013, exact service recreation, identity/health/UI boundary, SMTP confinement,
  rollback-retention, and no-controller deployment checklist.
- [x] Reproduce, transfer, import, and review fixed-mailbox firmware bundle
  `smi-00-05-00-bc0b6ce4d066-release` as valid but unadmitted content
  address `5df475bd...176ce`; independently load its exact stored mailbox
  contract while initially leaving the protected registry and controller state
  unchanged.
- [x] Review the exact B-first candidate-promotion plan for
  `5df475bd...176ce`, including role-by-role registry binding, authorized
  current/candidate flash identities, automatic same-operation rollback,
  independent same-run CID/HPT observation, stop conditions, and cleanup.
- [x] Obtain explicit Controller B-only state-changing authorization before
  applying the first registry rebind or one-shot program/verify/reset/run
  operation; plan approval and bundle import are not controller authority.
- [x] Under explicit Controller B-only authority, atomically rebind only role B
  and complete operation `7d3be985-9de8-4912-ad3a-54556321b1bb` with
  `PASS/PROGRAM_VERIFY_RESET_RUN_COMPLETE`, exact flash
  `68029e19...7bb28`, unchanged VEEPROM/option memory, and final cleanup.
- [x] Consume one separate Controller B read-only authorization without retry;
  stop pre-publication on the exact-VTref comparison defect, clean up access,
  fix it through Pi PR #29, pass 9 focused and 129 application tests, and deploy
  exact fixture-only release `observer-vtref-fix-3e13198`.
- [x] Obtain fresh authorization and pass operation `a05bc76d...` as the new
  independent Controller B read-only fixed-mailbox
  firmware/mapped-state/CID/HPT gate; preserve exact result/transcript hashes
  and final cleanup before considering A.
- [x] Reconcile obsolete bit 3 as `HPT_DIAG_MULTI_BLOCK_READ_SUPPORTED`, require
  a successful bounded read, and use a correctly sized aligned static buffer.
  Source gates and both canonical builds pass; future target evidence must
  retain the raw masks.
- [x] Consume the end-to-end Controller A fixed-mailbox promotion authorization:
  atomically rebind only A, pass one-shot program/verify/reset/run operation
  `ae2fe6ff...`, pass independent observation `e140c0f2...`, publish immutable
  hashes, and remove all access while both qualification flags remain false.
- [x] Fix PostgreSQL's nullable-outer-join HPT2 preparation lock failure through
  Pi PR #30; pass 33 focused PostgreSQL tests plus the complete 129-test suite
  on PostgreSQL and SQLite, package release `hpt2-postgres-lock-e9edba3`, and
  deploy it fixture-only with roles/endpoints empty.
- [x] Clarify the operator readiness UI through Pi PR #31: configure and verify
  the immutable HPT fixture-image hash, classify every gate, retain the
  approval trust-store blocker until its protected implementation, and split HPT2 media-write
  authority from bench power/raw-media authority. All 130 application tests
  pass on PostgreSQL and SQLite; live roles/endpoints remain empty.
- [x] Implement and fixture-deploy the protected approval trust store plus the
  authenticated preparation-only HPT initialization envelope/status UI. The
  web path cannot contact a controller or prepare, publish, execute, or
  reconcile an operation.
- [x] Review and freeze the exact A/B bounded-stop, no-replay recovery,
  deadline-margin, representative SD/USB regression, stop-condition, and
  cleanup plan in
  `work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md`.
- [x] Receive, photograph, label, inventory, and assign the first expendable
  same-family A/B pair in the Pi system of record as KEXIN `F1-A1`/`F1-B1`.
- [ ] Install each assigned sample only after Pi-commanded and electronically
  verified controller power-off, then CID-bind it after boot; the installed
  SanDisk controls remain non-expendable.
- [ ] Derive the live stop deadline only from separately authorized A/B
  measurements and firmware-owner review; do not guess it or enable the live
  adapter meanwhile.
- [ ] Implement and qualify named endurance profiles only after read-only,
  stop/recovery, power, media, evidence, and destructive-operation gates pass.
- [ ] Add powered-off SD transfer, Pi-reader admission, independent validation,
  reinsertion, and fresh controller CID stages to applicable campaigns.
- [ ] Demonstrate a complete standalone campaign with this workspace
  disconnected.

## Completion Standard

Complete when the existing Pi UI can independently intake cards, manage exact
firmware/profile identities, obtain and preserve certification evidence,
coordinate an authorized endurance campaign on SMI controllers, notify the
operator of required interventions, survive restart and communication loss,
derive and present auditable results, and retain the complete qualification
history on `srv-rpi00.local` without runtime interaction with this workspace.

## Historical Remote Planning Inputs

The following paths in `~/dev/sd_qualification` are preserved as historical
planning inputs; their remaining requirements are carried here:

- `jong@srv-rpi00.local:~/dev/sd_qualification/work/maps/map-standalone-sd-qualification-appliance.md`;
- `jong@srv-rpi00.local:~/dev/sd_qualification/work/maps/map-sd-qualification-web-ui-workflow.md`;
- `jong@srv-rpi00.local:~/dev/sd_qualification/work/wp/active/wp-standalone-pi-qualification-appliance-foundation.md`;
- `jong@srv-rpi00.local:~/dev/sd_qualification/work/wp/active/wp-operator-ui-and-appliance-backend-integration.md`;
- `jong@srv-rpi00.local:~/dev/sd_qualification/work/wp/active/wp-sd-qualifier-fixture-first-web-application.md`.
