# Controller A HPT2 S6 qualifier predeployment checkpoint — 2026-08-05

Status: complete; superseded by the Controller A S6 runtime matrix pass
Type: evidence
Updated: 2026-08-05
Next Action: see work/evidence/controller-a-hpt2-s6-runtime-matrix-pass-20260805.md
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md
Canonical Truth: docs/hpt2-measurement-matrix-v1.md

## Checkpoint result

Work stopped before any live deployment or controller access. The live Pi
application remains release `hpt2-runtime-map-6dc1c3c`, source
`6dc1c3caf69859df2f6a7c9dc3997a369ba61fb4`, image
`sha256:b550a9a5dd9907105a14f364d48ab3f56be4c8f9b36168c1317b1e7e13b52fce`.
The database has zero active runs. The default non-loopback firewall drop is
present for both J-Link ports `19120` and `19121`. Controller B was not
accessed.

Pi commit `7cf2cb82c07ad7145b1169add598397f0fcc52df` corrects the reviewed
`hpt_tc_store` sequence field order, expands runtime health capture to include
`records_per_segment`, and proves a profile-owned segment transition from the
exact baseline/terminal sequence delta and all three lanes' geometry,
generation, active-segment, active-record, and active-first-sequence movement.
The corrected runtime producer is version 2; historical version-1 S5 evidence
remains readable for its unaffected queue proof.

The exact candidate image
`srv-rpi00-sd-qualifier:hpt2-s6-runtime-7cf2cb8` was built from a detached Pi
worktree and passed all `214/214` tests in `45.252 s`. Its immutable identity is:

- image: `sha256:dd1892d308d4a1fa012bc9f7479f5223b9a3a899155b9e0361850f97ff1e30de`;
- release label: `hpt2-s6-runtime-7cf2cb8`;
- source label: `7cf2cb82c07ad7145b1169add598397f0fcc52df`.

At the predeployment checkpoint, the candidate had not been packaged as release
media, tagged as the live image, migrated, or started. No S6 run had been
admitted. Existing campaign
counts remain A S0 `3/3`, S1 `13/10`, S2 `20/10`, S3 `12/10`, S5 `10/10`,
and S4/S6 zero; the A-local gate remains false, B remains disabled, and
`stop_deadline_ms` remains `null`.

## Deployment continuation

The owner clarified that the resource detour applied to another system, so the
campaign continued. Release `hpt2-s6-runtime-7cf2cb8` is now packaged and
deployed from the exact tested image. Release manifest SHA-256 is
`c4a9cb839b6a6e7f2fd286e21ca69b14c8c7cb49597fb4bd9c92be585fe28b16`.
All package checks passed, backup
`/backups/sd-qualifier-20260805T231938Z.dump` passed restore verification, no
migration was pending, storage preflight passed, and web/command/notification
services all run image `sha256:dd1892d...e30de` with the exact source label.

The post-deployment audit preserves 45 base rows and 10 extended rows with the
same A counts, S6 zero, A-local false, B disabled, and deadline `null`. Active
runs remain zero, the default firewall drop is restored for both target ports,
and no residual controller tool container exists. Deployment did not access a
controller.

The first 75-second S6 run was preserved as clean bounded-stop run
`d67f27ce...eb75` but received no extended credit. Its Stop boundary legitimately
advanced one in-flight work unit from `1153/1153/1152` to `1154/1154/1154`.
Pi commit `05331ff` corrected that validator and passed `215/215` tests. Runtime
evidence then showed `1154` profile records plus two drained production-log
records and one total segment transition, so either production append could
have owned the transition. The qualifier correctly continues to reject that
ambiguous transition.

Pi commit `9815f59` implements the conservative writer bound: exact total
sequence movement must equal profile records plus drained, zero-loss production
appends, and transition credit requires total transitions to outnumber those
production appends. Exact image `sha256:781be825...bad56` passed `216/216` tests
and is deployed as `hpt2-s6-writer-bound-9815f59`; manifest SHA-256 is
`be081f239ec8b3af97411b9ca40bb03e5f643f6b5d23b4ec8375b1a1acc68090`.
Backup `/backups/sd-qualifier-20260805T233337Z.dump`, restore, storage, health,
audit, zero-active-run, firewall, and residual-tool gates pass.

## Exact resume boundary

1. [x] Confirm both repositories are clean at root commit `27ea111f` and Pi commit
   `7cf2cb8`; both commits are already pushed to their existing PR branches.
2. [x] Package and checksum the exact candidate image, then use the established
   backup, restore-check, migration, storage-preflight, health, identity,
   firewall, and residual-tool deployment gates.
3. [x] Run the live matrix audit without controller access and confirm counts,
   zero active runs, A-local false, B disabled, and deadline `null`.
4. [x] Promote the exact multi-work transition rule into
   `docs/hpt2-measurement-matrix-v1.md` and create the S6 runner from the
   proven S5 one-shot Start/Stop pattern with version-2 baseline and terminal
   runtime captures.
5. [x] Execute Controller A only until ten valid S6 observations include APPEND,
   READ, and SEGMENT_TRANSITION. Stop fail-closed on any identity, ownership,
   lane, terminal, firewall, or audit discrepancy.
6. [x] Record a compact immutable manifest, then synchronize the two PRs and
   Marshal. Do not enable Controller B until every A-local gate passes.

Completion evidence is recorded in
`work/evidence/controller-a-hpt2-s6-runtime-matrix-pass-20260805.md`. Controller
A reached ten valid S6 observations with APPEND, READ, and SEGMENT_TRANSITION
coverage; the firmware and Pi PRs and Marshal project/task state were then
synchronized. Controller B remained disabled.

## Repository state

- Firmware/root branch `codex/firmware-00-05-00-hpt-filesystem` is clean at
  `27ea111f4c5c21c892a3cbabdf73ac1eedf335ce` before this checkpoint update.
- Pi branch `codex/full-address-scrub-adapter` is clean at
  `7cf2cb82c07ad7145b1169add598397f0fcc52df` and pushed to GitHub PR #32.
- Firmware/root work remains on GitHub PR #4.
