# SD Qualifier cross-campaign evidence admission audit — 2026-08-13

Status: complete; synthetic qualification rejected, partial rows remain reviewable
Type: evidence
Updated: 2026-08-13
Parent: work/checklists/checklist-sd-card-supply-change-project-closeout.md
Audit ID: SDQ-XCAM-ADMISSION-20260813-R1
Contract: SMI-SDQ-CONTRACT-V1 revision 1

## Decision

The existing campaigns cannot be combined into one successful card-family
qualification, even as an exception. The same two physical cards and the same
Controller A/B roles are present, but the proof was collected under multiple
different firmware bundles and no individual or combined evidence set covers
all required contract leaves.

Do not relabel, merge, approve, or resume any historical campaign. A future
`CARD_FAMILY_INITIAL` campaign may reference the exact-bundle rows classified
`REVIEW` below through an immutable, reviewer-signed migration record. No row
is classified `ADMIT` by this audit because the target bundle is currently
`admitted=false`, admission scope `none`, the Aug. 10 campaign is a closed
legacy `CHANGE_IMPACT` campaign not bound to `SMI-SDQ-CONTRACT-V1`, and no
reviewer-signed migration exists.

## Scope and method

The audit was read-only. It did not publish a controller command, change a
campaign, alter a card result, or access controller hardware.

- Source backup: `/backups/sd-qualifier-20260814T012724Z.dump`
- Backup size: `3,990,011` bytes
- Backup SHA-256:
  `920889319087c99910e307765245ee48b8c840ddac120f394ee3856e5bc034a4`
- Restore check: passed; `11` campaigns
- Audit database: disposable `sdqualifier_cross_campaign_audit`
- Transaction: PostgreSQL `REPEATABLE READ READ ONLY`
- Audit database after collection: deleted and verified absent
- Live database after collection: `11` campaigns; application services remain
  running and healthy
- Machine contract SHA-256:
  `865b478e21ef97f5b0b11a4b7336257e1ad68aa317276348de56e068ff11813e`
- Generated audit source:
  `work/evidence/generated/sdq-cross-campaign-admission-audit-source-20260814T012724Z.json`
- Generated audit source size: `836,627` bytes
- Generated audit source SHA-256:
  `046a99aad94e57b3272e67abd4ecf55609db00c4746de1bec65169aa9bc22c5a`
- Selected immutable proof verification: `1,271 VERIFIED`, `0 MISMATCH`,
  `0 MISSING_FILE`

Classification meanings:

- `ADMIT`: all identity, bundle, profile, producer, proof-shape, hash, and
  reviewer-admission gates are complete.
- `REVIEW`: exact target-bundle proof is present and mechanically valid, but
  contract/bundle admission or reviewer migration is still required.
- `REJECT`: a candidate row cannot support the target qualification, most
  commonly because its firmware bundle differs.
- `MISSING`: no candidate proof satisfies the leaf.

## Frozen target identity

The only defensible target for this exception review is the Aug. 10 hotfix
bundle because it is the newest firmware identity exercised by both cards.

| Field | Frozen value |
| --- | --- |
| Campaign | `8c7a2b1a-7e67-48ac-8895-7999d76c4c2a` |
| Campaign state | `ABORTED`; permanent INCONCLUSIVE administrative closeout |
| Campaign type represented by reason | `CHANGE_IMPACT` |
| Bundle | `smi-00-05-00-389167c1d57f-37ff5c0c6f48-release` |
| Bundle manifest SHA-256 | `624eff9a7b9e96e98b959727257441678d2970a94f8bcd8f3ea1b04fdea0e62d` |
| Source/freeze commit | `77be6e40e87ed6ed45b19b8bc548a550443be265` |
| ELF SHA-256 | `88e9654ff2bfa4cff1c3801978558a95cbd94421043550206112ca2da0c4b1d2` |
| S-record SHA-256 | `37ff5c0c6f48576396c8ef3807aae9c8f1ddab742a72c47a4c1055454da906f0` |
| Test catalog | `hpt2-exact-read-hotfix-impact-2026-08-10-v1` |
| Profile | `HPT2_ENDURANCE_BASELINE_V1/v1-b0d5247f` |
| Bundle admission | valid, but `admitted=false`, scope `none` |

Exact sample identity is coherent across the audited campaigns:

| Role | Sample | Raw CID | Aug. 10 valid captures |
| --- | --- | --- | ---: |
| A | `F1-A1` | `05000C61736466672200001C8901A34F` | 105 |
| B | `F1-B1` | `05000C61736466672200001C8201A379` | 85 |

All Aug. 10 captures in the snapshot report CID-valid and representative-
sector-read-valid. This establishes physical identity, not authenticity or
qualification. Intake has another review finding: the same single
`CARD_PHOTO` hash is assigned to both sample records. A reviewer must confirm
that the image actually depicts and distinguishes both physical cards before
intake can be admitted.

## Firmware-boundary finding

Eight historical campaigns reference `F1-A1` and/or `F1-B1`. Every substantive
campaign used a different bundle manifest from the Aug. 10 target. The earlier
baseline, initialization, S4, S5, and S6 passes therefore remain valuable
engineering history but are rejected as target-bundle qualification credit.
Same card plus same controller is necessary; it is not sufficient when the
firmware bundle, catalog, or producer contract changed.

## Contract phase admission map

| Contract phase | Controller A | Controller B | Finding |
| --- | --- | --- | --- |
| 1. Intake and assignment | REVIEW | REVIEW | Exact labels, roles, custody fields, photos, and stable CIDs exist; shared card-photo attribution and formal migration review remain. |
| 2. Read-only baseline | REJECT | REJECT | Both passing 100% scrubs exist only under older bundle `smi-00-05-00-660433743898-bcf70c2de65c-release`; the target bundle has no baseline scrub. |
| 3. Initialization and identity recheck | REVIEW | REVIEW | Target-bundle continuity adjudications and post-program observations exist, but the actual passing initialization operations used the older `660433...` bundle. Reviewer must either accept the explicit continuity exception or require new target-bundle initialization. |
| 4. S0–S6 matrix | MIXED | MIXED | Detailed map below: 13 target leaves are REVIEW, 23 older-bundle candidates are REJECT, and 6 leaves are MISSING. |
| 5. Controlled recovery | REVIEW (5/5) | MISSING (0/5) | All five A cases passed under the target bundle; no B recovery result exists. |
| 6. Minimum endurance | MISSING | MISSING | No 72-hour continuous run, three-wrap/reclaim proof, concurrent product workload, or zero-limit-violation result exists for either sample. The older approximately one-hour extended-runtime observations cannot be summed or promoted. |
| 7. Representative regression | REVIEW | REVIEW | Exact target-bundle reconciliation rows `7624` and `7625` pass and their source hashes verify; formal admission remains. |
| 8. Scrub and identity closeout | MISSING | MISSING | No target-bundle post-campaign full-address scrub or final card observation exists for either role. |
| 9. Per-card review | MISSING | MISSING | Both assignment results remain `PENDING`; there is no reviewer disposition. |
| 10. Paired-family review | MISSING | MISSING | No two-sample family conclusion or reviewer signature exists. |

## Matrix leaf admission map

The target plan contains 42 matrix leaves. The application evaluator reports
13 complete target-bundle leaves. These are `REVIEW`, not `ADMIT`, until the
bundle and a versioned migration are approved. Of the remaining 29 leaves, 23
have a passing candidate only in an older bundle and are `REJECT`; six have no
passing candidate anywhere and are `MISSING`.

| Matrix leaf | Controller A | Controller B | Basis |
| --- | --- | --- | --- |
| S0 | REVIEW | REVIEW | Exact target bundle meets repetition/proof rules. |
| S1 | REVIEW | REVIEW | Exact target bundle meets repetition/proof rules. |
| S2 | REVIEW | REJECT | A meets target rules; B pass exists only in older bundle. |
| S3 | REVIEW | REVIEW | Exact target bundle meets repetition/proof rules. |
| S4 1440 BEFORE | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 1440 AT | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 1440 AFTER | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 2880 BEFORE | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 2880 AT | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 2880 AFTER | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 10080 BEFORE | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 10080 AT | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 10080 AFTER | REJECT | REJECT | Passing coverage only in older bundle. |
| S4 44640 BEFORE | REJECT | MISSING | A pass is older-bundle only; no B pass exists. |
| S4 44640 AT | REJECT | MISSING | A pass is older-bundle only; no B pass exists. |
| S4 44640 AFTER | MISSING | MISSING | No passing candidate exists. |
| S4 129600 BEFORE | REVIEW | REVIEW | Exact target bundle meets final-target proof rule. |
| S4 129600 AT | REVIEW | REVIEW | Exact target bundle meets final-target proof rule. |
| S4 129600 AFTER | REVIEW | REVIEW | Exact target bundle meets stable-terminal proof rule. |
| S5 | REJECT | MISSING | A pass is older-bundle only; no B pass exists. |
| S6 | REJECT | MISSING | A pass is older-bundle only; no B pass exists. |

Matrix classification totals:

- `ADMIT`: 0
- `REVIEW`: 13
- `REJECT`: 23
- `MISSING`: 6

The older campaigns do not collectively pass the matrix either. The strongest
older S4 campaign passed 11 of 15 A regions and 9 of 15 B regions; its S5 and
S6 counts were zero. The older S0-hold campaign passed A S5 and A S6 but had
no B coverage. Combining them would still leave the six `MISSING` leaves above
and would cross firmware boundaries.

## Exact target rows that remain reviewable

Twenty Aug. 10 plan leaves have mechanically complete, hash-verified target-
bundle evidence:

- 13 matrix leaves listed as `REVIEW` above;
- all five Controller A recovery cases; and
- both Controller A/B representative regression rows.

The two initialization-continuity adjudications are also reviewable exception
inputs, but they are not counted as complete initialization operations. Intake
identity/custody is reviewable subject to resolving the shared-photo finding.

Formal admission of any of these rows requires all of the following in one
immutable migration record:

1. admit the exact target bundle and producer versions for live qualification;
2. bind a new `CARD_FAMILY_INITIAL` execution plan to
   `SMI-SDQ-CONTRACT-V1`;
3. name each source evidence ID/hash, sample CID, controller role, bundle
   manifest, catalog/profile, producer/version, proof rule, and destination
   leaf;
4. record an explicit reviewer identity, timestamp, rationale, and
   `ADMIT`/`REJECT` decision per row; and
5. preserve every contradictory or failed attempt without outvoting it.

## Minimum remaining physical qualification

Even if a reviewer admits every reviewable exception row, a successful family
campaign still requires, at minimum:

- target-bundle baseline scrub and linked CID capture for A and B;
- a decision on the initialization-continuity exception, with target-bundle
  initialization/recheck for either role not admitted;
- the six genuinely missing matrix leaves;
- all five Controller B recovery cases;
- at least 72 continuous hours of endurance per sample with at least three
  wrap/reclaim cycles, concurrent representative product activity, continuous
  heartbeat/progress, and zero acceptance-limit violations;
- target-bundle final 100% scrubs and final CID observations for A and B;
- reviewed A and B sample dispositions; and
- the paired-family conclusion and signed report.

The 72-hour requirement is inherently non-combinable: broken intervals and
different campaigns cannot be summed. This alone prevents an administrative
closeout from producing a successful qualification.

## Routing

Keep the Aug. 10 campaign closed and immutable. Complete Gate 1 stale-campaign
disposition first. Then consolidate and admit one release baseline, register a
contract-complete `CARD_FAMILY_INITIAL` plan, attach a reviewed row-admission
manifest, and execute only the remaining leaves. This audit is evidence for
that future migration decision; it is not a card-family approval.
