# Pi HPT2 S4-S6 fail-closed matrix audit

Status: complete software/deployment gate; extended target execution remains blocked on explicit evidence-contract corrections
Type: evidence
Updated: 2026-08-05
Next Action: resolve the S4 final-checkpoint and S6 cross-variant sequencing contradictions, then implement and software-qualify evidence producers before further target execution
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-resolve-hpt2-s4-s6-evidence-contract-gaps.md

## Result

Pi commits `daff6666ce75a6e4e09fe585f9f7a4ea26a66d2f` and
`fda4daba8aa6bd075ef83b41cbc1368526c694cc` add a read-only,
fail-closed HPT2 matrix audit. It applies supplemental-over-original precedence
for S0-S3, requires explicit distinct proof for S4-S6, rejects malformed
extended rows, keeps Controller B disabled, and leaves
`profile_stop_deadline_ms=null`.

The exact final image passed `198/198` tests and was deployed healthy as
`hpt2-matrix-audit-fda4dab`, image
`sha256:dcbd041658da4885566cbaa4f81c7293231427158606f723b89c4404a4e738ed`.
The release-package manifest SHA-256 is
`684e2b8ddc9aecc95b4e6194396e646eef26419aaee60c8dfe11457d0487b819`;
all packaged checksums passed. Backup
`/backups/sd-qualifier-20260805T215149Z.dump` restored successfully to the
disposable check database, migrations were empty, and storage preflight passed.

## Live audit

The deployed audit reports 35 effective base adjudications for campaign
`7f13c433-e904-4320-a0d1-33d503057f69`:

- Controller A S0 `3/3`, S1 `12/10`, S2 `11/10`, S3 `12/10`;
- S4 `0`, S5 `0`, S6 `0`;
- Controller B execution allowed: false;
- matrix pass: false;
- production deadline: null.

The audit exposes these implementation/method gaps instead of granting credit:

1. S4 needs a checkpoint-region evidence producer with three observations for
   each BEFORE/AT/AFTER region at each configured checkpoint.
2. S5 needs durable proof that real production-log queue contention occurred,
   production logging retained priority, and queue-drop/log-loss deltas were
   zero.
3. S6 needs durable max append/read/end-to-end timing plus explicit append,
   read, segment-transition, or reclaim path identity.
4. The requested S4 AFTER region for the final 129600 checkpoint is unreachable
   in profile v1 because the same service slice transitions immediately to
   `COMPLETED`.
5. S6 requires both controller variants, while the execution rule prohibits
   Controller B until Controller A's complete measurement set passes. The
   sequencing/acceptance contract must be corrected before B access.

The audit does not create extended evidence and cannot authorize a target
operation. It makes missing proof and contradictory requirements machine
visible so they cannot be normalized into a pass.

## Cleanup

All application containers run the exact final image and are healthy. The
default firewall drops non-loopback ports `19120` and `19121`; no observer,
programmer, scrub, or HPT2 command-adapter tool container remains. No card,
power, firmware, Controller A, or Controller B operation occurred during this
software/deployment work.
