# SD Qualifier Aug. 10 campaign snapshot audit and disposition recommendation

Status: complete; recommendation accepted and implemented without card rejection
Type: evidence
Updated: 2026-08-13
Next Action: none; closeout result is recorded in work/evidence/sd-qualifier-aug10-campaign-inconclusive-closeout-20260813.md
Campaign Reason: Historical record from campaign 014-complete-standalone-sd-qualifier-acceptance; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-sd-card-supply-change-project-closeout.md
Canonical Truth: docs/sd-card-qualification-contract.md and docs/ecr-sd-card-supply-change-resolution.md

## Outcome

The Aug. 10 `CHANGE_IMPACT` campaign was preserved and audited without
resuming controller execution. The database snapshot restored successfully,
all campaign evidence-ledger file references matched their declared size and
SHA-256, all runs and HPT2 command operations were terminal, and both physical
card identities were stable across every recorded capture.

The audit recommends closing this campaign `INCONCLUSIVE` without rejecting
either card. Its sound immutable evidence should remain available as history,
but the campaign should not be migrated and resumed because the active legacy
plan is not bound to `SMI-SDQ-CONTRACT-V1`, its firmware bundle is recorded as
not admitted, state surfaces disagree, and the required matrix remains
materially incomplete. A clean versioned campaign provides a smaller and more
auditable path than carrying those contradictions forward.

This audit itself made no mutation. The owner later accepted the recommendation,
and the separately evidenced application closeout completed without controller
execution or card rejection. See
`work/evidence/sd-qualifier-aug10-campaign-inconclusive-closeout-20260813.md`.

## Preserved snapshot

The documented Compose backup service created:

- dump: `/backups/sd-qualifier-20260813T230526Z.dump` in Docker volume
  `sd_qualifier_postgres_backups`;
- size: `3,973,134` bytes;
- SHA-256:
  `59aca717b862bec56e8d948f1b04b90d7fb59cbb963ad11016e610d832702ac7`;
- disposable PostgreSQL 17 restore check: passed, with `11` campaigns.

The exact dump was restored a second time into disposable database
`sdqualifier_aug10_audit`. The campaign audit ran under one PostgreSQL
repeatable-read, read-only transaction against that frozen copy. The disposable
database was then dropped and verified absent.

Raw audit output is retained on the appliance at:

`/home/jong/.local/share/sd-qualifier/audits/aug10-campaign-readonly-audit-20260813T230526Z.json`

It is also copied to the ignored local generated-evidence path:

`work/evidence/generated/aug10-campaign-readonly-audit-20260813T230526Z.json`

The JSON is `201,395` bytes with SHA-256
`6e98fb86b8ff97f40ecb319bad015b63cb33c0a6422fc0e8524662dc1d7b2428`.

## Quiescence and non-replay proof

At the frozen database instant and again against the live database after the
audit:

- campaign state was `RUNNING` while coordinator state and desired state were
  both `PAUSED`;
- lane A was paused at `matrix.s4.1440.before.a` and lane B was paused at
  `matrix.s2.b`;
- all `187` runs were terminal: `180 COMPLETED`, `4 ABORTED`, and `3 BLOCKED`;
- there were no `CREATED`, `QUEUED`, `RUNNING`, or `WAITING_OPERATOR` runs;
- all `361` HPT2 operations were terminal: `359 ACKNOWLEDGED`, `1 BLOCKED`, and
  `1 REJECTED`;
- there were no staged, prepared, publishing, or reconciliation-required HPT2
  operations and no duplicate Start or Stop kind for any run;
- there were no active generic commands, initialization operations, or scrub
  operations;
- the five coordinator tasks were `2 COMPLETED` and `3 FAILED`, with no
  `PENDING` or `CLAIMED` task.

The HPT2 operation digest is
`4f55f43f7cc735694fd5163d8a2fb627809068119420f3a18556f1d7e6a1e986`.
The live operation count remained exactly `361` after backup, restore, audit,
and cleanup. All six long-running service container IDs were unchanged and the
web container remained healthy.

## Card identity evidence

CID is identity evidence, not authenticity evidence.

### Controller A / sample F1-A1

- protocol status: `DETECTION_READY; RAW_HPT; DRIVER_OK`
- CID valid: `true`
- representative-sector read valid: `true`
- manufacturer: `unknown CID manufacturer; retail brand KEXIN`
- MID: `0x05`
- OEM/application ID: `0x000C`
- product name: `asdfg`
- product revision: `2.2`
- serial number: `7305`
- manufacturing date: `2026-03`
- raw 128-bit CID: `05000C61736466672200001C8901A34F`

All `105` campaign captures used that same raw CID; none lacked valid CID or
representative-sector-read status. Latest capture was identity row `399`,
reason `HPT2_S2_MEASUREMENT_PREFLIGHT`, at
`2026-08-13T15:41:13.579Z`.

### Controller B / sample F1-B1

- protocol status: `DETECTION_READY; RAW_HPT; DRIVER_OK`
- CID valid: `true`
- representative-sector read valid: `true`
- manufacturer: `unknown CID manufacturer; retail brand KEXIN`
- MID: `0x05`
- OEM/application ID: `0x000C`
- product name: `asdfg`
- product revision: `2.2`
- serial number: `7298`
- manufacturing date: `2026-03`
- raw 128-bit CID: `05000C61736466672200001C8201A379`

All `85` campaign captures used that same raw CID; none lacked valid CID or
representative-sector-read status. Latest capture was identity row `403`,
reason `HPT2_S2_MEASUREMENT_PREFLIGHT`, at
`2026-08-13T15:49:13.633Z`.

## Immutable ledger audit

The frozen snapshot contained `13,043` campaign evidence rows at `13,043`
unique confined paths and `32,873,546` declared bytes. Every row was included
in canonical ID order in database-row digest
`81dc8e5c1f160080f5bb581cf75cc8329cd94b5aea8f81aebe09d3ba9a80e7ca`.

- immutable rows: `13,043 / 13,043`;
- missing paths: `0`;
- size mismatches: `0`;
- SHA-256 mismatches: `0`;
- audit-event sequence: contiguous `1..1690`, with no gaps;
- event digest:
  `4a74c0cb01405eb9501610e20af8a0c0dd009ef92f1172d674841a4261566bf8`.

Three campaign-level rows intentionally have no run: A and B initialization
continuity adjudications `6465` and `6468`, and Controller A power-cycle result
`7432`. They are not orphaned run evidence.

The effective base adjudication selected one final row per run, preferring the
supplemental row where present:

- effective rows: `173`, digest
  `fdfdbf1c177348be95c8f920dfd2a3d99368bb2dc139dc39d29c933805adf5e5`;
- credit-bearing rows: `136`, digest
  `24054f632e9d6a6b25e06af35ee37e2bc64857b3b04a30173caf4cef30cbd01f`;
- no-credit rows: `37`;
- valid extended adjudication rows: `12`, digest
  `d97f2b5c8f62c49840f7da39ee5b858134f659b3a44e61a4582161baaae88686`;
- invalid extended rows: `0`.

Credited S0-S3 counts were:

| Role | S0 | S1 | S2 | S3 |
| --- | ---: | ---: | ---: | ---: |
| A | 4 / 3 | 45 / 10 | 12 / 10 | 36 / 10 |
| B | 3 / 3 | 17 / 10 | 2 / 10 | 24 / 10 |

The final acknowledged-stop Controller B S2 attempt remains among the
no-credit evidence. No audit step promoted it or replayed a command.

## Contract and state reconciliation

The selected machine-readable contract is `SMI-SDQ-CONTRACT-V1`, SHA-256
`865b478e21ef97f5b0b11a4b7336257e1ad68aa317276348de56e068ff11813e`.
It requires a read-only three-plane reconciliation, explicit permitted
change-impact conclusion, row-by-row admission, versioned migration record,
and fixed remaining budgets before resume. Failure to admit routes to
`CLOSE_INCONCLUSIVE_NO_CARD_REJECTION`.

The campaign is not bound to that contract. Its only active plan is legacy
`persistent-end-to-end-sd-qualification` revision 1, a six-node definition
with SHA-256
`d79371e1542dab1b9772ac9a2d5932140317938138d93c0a599daa694d9065aa`.

The frozen bundle identity is internally consistent and valid:

- bundle: `smi-00-05-00-389167c1d57f-37ff5c0c6f48-release`;
- manifest SHA-256:
  `624eff9a7b9e96e98b959727257441678d2970a94f8bcd8f3ea1b04fdea0e62d`;
- source/freeze commit:
  `77be6e40e87ed6ed45b19b8bc548a550443be265`;
- S-record SHA-256:
  `37ff5c0c6f48576396c8ef3807aae9c8f1ddab742a72c47a4c1055454da906f0`.

However, the bundle record says `admitted=false` and
`admission_scope=none`. The event ledger also records repeated deployment
manifest and orchestration transitions across the campaign lifetime.

The matrix audit is not complete:

- Controller B S2 is `2 / 10`;
- S4 is incomplete on both controllers; only three individual regions per
  controller currently meet their repetition count;
- S5 is `0 / 10` on both controllers;
- S6 is `0 / 10` and has no A/B slow-path coverage;
- no durable initialization or full-address-scrub operation is attached to
  either assignment;
- both samples remain `PENDING` at `HPT2_MEASUREMENT_PARTIAL`;
- no reviewer or paired conclusion exists.

The live state surfaces also do not yet agree. Campaign is `RUNNING` while the
coordinator and both lanes are intentionally `PAUSED`. At the frozen instant,
Controller A supervisor projection was `BLOCKED / DATABASE_BACKUP_STALE`.
Controller B still stored `HEALTHY`, but its observation lease had already
expired. The fresh dump and restore check prove a backup exists, but the
protected supervisor backup marker was not changed by this read-only audit.

## Disposition matrix

| Criterion | Explicit migration and resume | Close `INCONCLUSIVE` and start clean |
| --- | --- | --- |
| Preserve existing immutable evidence | Yes, after 173-row admission mapping | Yes, unchanged as historical evidence |
| Contract-bound execution | Requires a new migration record and plan revision inside a campaign that already ran under the legacy plan | New campaign starts with the selected contract and immutable plan identity |
| Bundle admission | Must explain or repair `admitted=false / scope=none` after 361 terminal operations | Historical contradiction remains visible; new campaign requires admission before execution |
| Current state agreement | Requires campaign/coordinator/task/supervisor reconciliation before any resume | Terminal closeout can state exactly why no further credit is inferred |
| Remaining execution | B S2, most S4, all S5/S6, closeout, and review still remain | Same required work can be planned cleanly with fixed budgets and no legacy frontier |
| Audit and handoff risk | High: many release transitions, 17 task-failure events, 15 retry reconciliations, and legacy/current contract mapping | Lower: old record is immutable and the new record has one definition and one release baseline |

## Recommendation

Close campaign `8c7a2b1a-7e67-48ac-8895-7999d76c4c2a` as:

`INCONCLUSIVE — legacy change-impact campaign cannot be unambiguously bound to SMI-SDQ-CONTRACT-V1; retain all admitted and no-credit evidence; no card rejection.`

Do not convert this campaign into card-family approval and do not discard its
136 credit-bearing rows. They remain useful evidence for engineering review,
but they should not be silently transplanted into a family conclusion.

After owner acceptance, use a reviewed application transition that performs
no controller action to record the terminal disposition and reconcile the
campaign/coordinator/report/dashboard surfaces. Then create a clean versioned
`CHANGE_IMPACT` campaign for any remaining exact-read change evaluation. A
later `CARD_FAMILY_INITIAL` campaign must independently satisfy the full family
contract before either KEXIN specimen or family can be qualified.

## Work2 verification

- logical backup: passed;
- disposable restore check: passed;
- frozen-copy repeatable-read audit: passed;
- all evidence file size/SHA-256 checks: passed;
- disposable audit database cleanup: passed and verified absent;
- live post-audit state: `RUNNING / PAUSED / PAUSED`, zero active runs, `361`
  HPT2 operations, zero unresolved operations;
- service continuity: PostgreSQL, web, coordinator, command worker,
  notification worker, and watchdog retained their container identities; web
  and PostgreSQL remained healthy;
- deployment: inapplicable because this Work2 outcome is a read-only audit and
  Tool Shed evidence recommendation, not an application change.
