# Complete clean contract-bound A/B qualification

Status: abandoned
Type: campaign
Updated: 2026-08-26
Next Action: none
Campaign ID: 009-complete-clean-contract-bound-a-b-qualification
Campaign Number: 009
Outcome: Advance the clean website-created campaign through the exact A/B S0-S6 matrix, Controller B recovery, representative regression, post-campaign scrubs and CID captures, per-card dispositions, and the paired first-family gate.
Primary Focus Areas: qualification-release
Supporting Focus Areas: smi-firmware, hpt-media-logging, usb-host-publication, sd-qualifier-app, controller-automation, power-fault-control
Depends On: 006-start-clean-contract-bound-sd-qualification-campaign
Decision: none
Detour For: none
Return To: none
Completion Gate: One immutable clean campaign reaches reviewed terminal A/B and paired-family conclusions with complete identity-linked evidence, no replay or hidden case selection, all safety gates satisfied, and no unresolved contradictory result.
Completion Evidence: none
Disposition: Superseded by the owner decision to change SD-card qualification direction; preserve all partial results as history without claiming qualification completion or card rejection.; replacement: Replacement roadmap, milestones, and campaigns are pending the owner follow-up discussion; requirements remain captured in work/spikes/spike-firmware-service-code-sd-qualification-direction.md and work/spikes/spike-hpt2-service-life-retrieval-performance-requirements.md.

## Request

Primary checklist: `work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md`.
Related workpackages: controller-neutral A/B execution, triple-mirrored HPT,
and accelerated media qualification.

Continue only the new immutable campaign created by request `006`. Use the
website's durable high-level controls and exact per-operation authorization;
never select hidden cases through SSH or replay a command. Capture the complete
CID identity block at baseline and after every relevant reboot or powered-off
card replacement. SD insertion/removal while powered is prohibited.

## Completion Check

One immutable clean campaign reaches reviewed terminal A/B and paired-family conclusions with complete identity-linked evidence, no replay or hidden case selection, all safety gates satisfied, and no unresolved contradictory result.

## Current Checkpoint

- Controller A S6 task `957bd579-e206-4a1a-94b8-f209c0978241` exhausted its
  first observation budget after ten clean completed runs produced no credited
  S6 row. The evidence audit found active snapshots, but the producer decoded
  the newer `0xD4B8` firmware layout with the legacy 72-byte lane stride;
  lanes 1 and 2 were therefore misaddressed and every synchronized-lane
  attribution failed closed.
- SD Qualifier commits `9499f3f85d2b42c8d3bd742065df2050eb1ab95b`,
  `20c96b501f6cd67139dd74900bac830c03c8b588`, and
  `5a4b109594e801ee646ba8708e9245d7ae39afb0` select the reviewed 72- or
  88-byte lane layout from the exact bound map, capture in firmware append
  commit order while preserving exact duplicate reads, and skip only
  transient incomplete production intervals while keeping drop or loss fatal.
  The focused runtime and extended-adjudication suites pass 22/22. Live
  read-only probes produced three identical coherent sweeps and exact interval
  `24901` to `24905` attributes two profile-owned segment transitions.
- Release `campaign009-s6-series-5a4b109` is deployed to all five application
  services as image
  `sha256:173263bbea5542c461f2e779701a9ed50f05d236ce5a3120fbc189474d48dbab`.
  Storage preflight, exact image labels, both host supervisors, and deployment
  manifest SHA-256
  `da4d61a15fbb9b30f06a91af24ae336ad364eded5a1b2584ce8290d66feddc83`
  were verified. Web health returned healthy after the exact-task lease
  heartbeat was restored.
- Staff reviewer `jon` reconciled only task `957bd579-e206-4a1a-94b8-f209c0978241`
  as `DURABLE_PARTIAL_PROGRESS_NO_ACTIVE_ACTION` in event sequence `2271`;
  there were zero active runs and zero claimed A actions. Resume A created
  attempt `2/2` and fresh run `ac3f2dba-99b1-4330-8881-bea4aeb22965` without
  replay. That run completed with the first exact attributable interval but
  the pre-fix adjudicator stopped at an earlier transient pending interval.
  The bounded task then completed runs
  `c98e8c3a-fb27-4776-9d87-8a19825ff3cf` and
  `119602c3-471c-4ef0-8473-7ca4d9d2f9c0`; automatic adjudication created
  immutable extended evidence `24962` and `25009`. Each run credited
  `SEGMENT_TRANSITION` from synchronized exact runtime intervals with bounded
  stop pass and no audit implementation gap. Run
  `f54c301d-3ca4-4252-8f72-cec960398fc0` started automatically as the fourth
  corrected observation. A
  transient lease renewer is bound to the existing task runner PID and exits
  with it; it cannot claim or start work. Postdeployment adjudication of the
  completed immutable first run created evidence `24943`; together the three
  corrected runs credit Controller A S6 at `3/10` with
  `SEGMENT_TRANSITION`, and the audit reports no S6 implementation gap.
  Controller B remains desired paused before
  `matrix.s4.44640.after.b`.
- Release `campaign009-watchdog-deadlock-ffddac1`
  (`ffddac1296c24fa299c4cdbe82deccf077b40200`, image
  `sha256:b613ebc07730bbb1fafe3c67a79d9d5f68838081203eea05ada4fc6412eded4c`)
  is deployed to all five application services. It includes the generalized
  watchdog lock-order correction plus lane-specific reconciliation UI and
  exact-lane-frontier task selection. Web health is healthy and required-now
  database, storage, clock, and worker gates are ready.
- The S5 deadlock was the runtime observer's Run-to-Campaign deferred-FK order
  crossing the missing/stale watchdog's Campaign-to-Run order. Both affected
  watchdog projectors now serialize on per-controller supervisor state without
  taking the shared Campaign row.
- Focused PostgreSQL watchdog validation passed 41/41 and the full
  fixture-isolated PostgreSQL suite passed 422/422. The lane reconciliation
  coordinator/view suite passed 64 tests, and the exact-frontier regression
  passed 14/14. Backup `/backups/sd-qualifier-20260818T181116Z.dump` restored
  successfully with SHA-256
  `b766b7e58a8eefb8a5f543d59304e69d8403bf56622e8071771c937b95e04a1f`.
- An authenticated staff reviewer reconciled exhausted A task
  `f5df9729-e23b-470a-b790-038670f75b7b` as durable partial progress with no
  active action, then used the visible lane-specific Resume A control. The
  append-only task is now attempt `4/4`; B remains paused before
  `matrix.s4.44640.after.b` and no hidden case was selected.
- Attempt 4 admitted run `f232c04a-7dae-4056-9072-5f09dddf9344`, persisted
  the former deadlock-point S5 BASELINE observation as evidence `24294`, and
  reconciled START operation `2476af96-9c58-4b53-a143-9fc6feb3c4ad`
  read-only. Eight postrepair bounded observations completed with no deadlock,
  replay, open command, or unresolved HPT2 operation; the S5 row reached
  `10/10`, task `f5df9729-e23b-470a-b790-038670f75b7b` completed, and A
  advanced to `matrix.s6.a`.
- The authenticated page then exposed `SUPERVISOR_SNAPSHOT_MISSING`: both host
  observers were inactive and the A environment still named an old S4 run.
  Exact live-run rebinding restored snapshots and exposed the current-backup
  gate. Fresh backup `/backups/sd-qualifier-20260818T203828Z.dump` is
  5,054,370 bytes with SHA-256
  `8c8545819f7448555e38a81091d5449095af686250d3ee89db0ea3f3f70e6d9e`;
  its disposable restore check passed with 14 campaign rows and the protected
  current-backup marker was updated with the prior marker retained.
- SD Qualifier host commit `546bf92a27b17ebc9268745958438b4cb4bdd3dc`
  makes every extended S5/S6 run bind and clean its role-specific supervisor
  before START. Bash syntax, nine focused tests, and the live transition from
  S6 service `...-1` to `...-2` passed: supervisor run ID
  `8fe07068-1dc4-4117-a2e3-5cb9519ed6ad` exactly matched the active run,
  status was `QUALIFICATION_SUPERVISOR_HEALTHY`, and no unresolved command or
  stale firewall rule remained.
- Campaign UUID `a17fc306-8810-4e5a-bbc4-612adc47ce7c` remains bound to manifest `3b3470483906ec521df4814dffdcb90e9754ca9701f36f37c6210fda700bfe12`.
- Controller A preflight identity capture `634` records protocol
  `DETECTION_READY; RAW_HPT; DRIVER_OK`, CID-valid and representative-sector
  read valid, MID `0x05`, OID `??`, product `asdfg`, revision `2.2`, serial
  `7305`, manufacturing date `2026-03`, and raw CID
  `05000C61736466672200001C8901A34F`. Controller B CID remains
  `05000C61736466672200001C8201A379`.
- Release `campaign009-snapshot-lock-24bdcf7` (`24bdcf7c64d626e41aeb7ce19c9198d772f78676`, image `sha256:39bd9ab8f22c71b7390cd8aa84c057a3e3a3e94459c0baace79162fb0f937ca4`) is deployed to all five application services and the web health gate is healthy.
- Predeployment database backup `/home/jong/.local/share/sd-qualifier/backups/sd-qualifier-20260818T014154Z.dump` restored successfully with SHA-256 `5c76a22e7767635da688e4149e572c14d3d202810d43b07d7ae22fe73ed4b726`.
- Release `2d4d9d1` removed the event-stream Campaign lock but exposed one remaining concurrent supervisor-snapshot Campaign lock deadlock at `2026-08-18T01:29:25Z`; `24bdcf7` removes that shared lock while retaining per-Run and per-role serialization.
- The focused watchdog suite passed 38/38 and the full isolated PostgreSQL suite passed 417/417 for `24bdcf7`.
- Two complete postdeployment concurrent A/B 10,080-record cycles passed admission, repeated supervisor snapshots, Stop, finalization, and adjudication with no PostgreSQL deadlock, duplicate event, panic, or fatal log finding.
- A completed 10,080 BEFORE and AT at 3/3 and has 2/3 at AFTER; B completed 10,080 BEFORE and AT at 3/3 and advanced to AFTER.
