# Watchdog Stage 0 preservation baseline — 2026-08-09

Status: PASS; first hard gate satisfied without a controller-state command
Type: evidence
Updated: 2026-08-09
Next Action: implement Stage 1 supervisor source and fixture tests; keep Controller A held and Controller B not started
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-watchdog-gated-controller-a-recovery-and-controller-b-start.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Scope and authority

The owner authorized `ts:ship to first gate`, defined by the parent
workpackage as Stage 0 only. This authorized a database backup/restore check,
read-only Controller A/B identity and status captures, and orchestration,
application, process, deployment, storage, and notification inventory.

No Start, Stop, reset, halt, power, programming, initialization, scrub, media
write, database reconciliation, campaign disposition, service restart, process
termination, or card movement was authorized or performed. Both observer
operations report `read_only=true`,
`qualification_outcome_changed=false`, and a running CPU before and after.

Capture interval: `2026-08-09T18:51:10Z` through
`2026-08-09T18:56:19Z` (`11:51:10` through `11:56:19` PDT).

## Database backup and restore proof

- Backup: `/backups/sd-qualifier-20260809T185110Z.dump` in Docker volume
  `sd_qualifier_postgres_backups`.
- Size: `510670` bytes.
- SHA-256:
  `34404632930134bb78e33f27883e9746129d13941380640c6b3964d84d16e124`.
- Sidecar and independently computed host-volume digest match.
- Disposable PostgreSQL restore: PASS with `8` campaign records and
  `restore-check=passed`.
- Backup inventory after capture: `46` dump files using `11M`.
- The live PostgreSQL data volume was not restored or modified by the check.

The first extra host-side sidecar check incorrectly interpreted the sidecar's
container path `/backups/...` as a host path. The already completed disposable
restore remained valid. A corrected same-file digest comparison passed without
creating another backup.

## Controller A exact read-only identity

Observation `5feaf9e7-0e36-44f0-9fb5-6890fffc003d` passed.

- Controller role/assembly/probe: `A` / `1751136` / `69664082`.
- Hardware variant: `0`; VTref: `3.282 V`.
- CPU running before and after: true.
- Bundle: `smi-00-05-00-660433743898-bcf70c2de65c-release`.
- Bundle manifest SHA-256:
  `d5da9437a9498b3ca82f6ee418dde82332159db463d51a1ef7a120abf29162fe`.
- Expected and observed complete 4 MiB flash SHA-256:
  `507e5b91d53afeb1b2d9d16442e3f6ff0391dcc7a53cead269cb11396dfcf246`.
- Source commit: `1e566bee8bd246f8eb77511966615a79a97a0e6f`.
- Mapping SHA-256:
  `16dd780496778847d2a4996926aad91d7e27c858ca800af379c4de43c53cfbdc`.
- Main system, SD, HPT, and SSP status: `0`; HPT state `5`.
- Diagnostics: `4095` pass mask, `0` failure mask.
- Lane mask: `7`; mismatch/lost counts: `0/0`; replace media: false.
- Retired segments: `[0, 0, 0]`; first error sector: `0`.
- Protocol detection state `5`, CID-valid true, representative-sector-read
  true, driver status `0`.
- Manufacturer/MID: unknown retail KEXIN / `0x05`.
- OEM/application ID: `??`; product: `asdfg`; revision: `2.2`.
- Serial: `7305`; manufacturing date: `2026-03`.
- Complete raw CID: `05000C61736466672200001C8901A34F`.

Artifacts:

- Result:
  `foundation/controller-observations/5feaf9e7-0e36-44f0-9fb5-6890fffc003d/result.json`,
  `3051` bytes, SHA-256
  `402899c18b8d34a1e54aeb8c8bbd74faf79b72f088c72818c62b052cd1e57895`.
- Transcript:
  `foundation/controller-observations/5feaf9e7-0e36-44f0-9fb5-6890fffc003d/jlink-transcript.log`,
  `6835` bytes, SHA-256
  `a4d7e775cbab296130e245d94fb93b50a5197b11f0ed684c0ad1b8354ba27905`.

## Controller A exact held-run status

HPT2 status observation `9d5610ed-8288-4e7a-8c31-fa55f4925c47`
passed two identical reads of the fixed status object.

- Run ID: `717ae30c-736d-430c-8ce5-529c97b3920a`.
- Request ID: `fa3e42a8-eb7f-43be-9a01-86b27bb96451`.
- Boot-session witness: `26B10B1280443248`.
- State/checkpoint: `2` / `4` (held at the required ordinary S4 boundary).
- Attempted/committed/verified: `44641 / 44641 / 44641`.
- Profile record target: `129600`; campaign node: S4 `44640 / AFTER`.
- Heartbeat: `223207`; publish sequence: `4421048`.
- Start/Stop sequences: Stop requested `0`, acknowledged `0`.
- Terminal proof/reason: `0/0`.
- Driver/HPT status: `0/0`; lane masks: `7/7`.
- First failure sequence/status/step: `0/0/0`.
- Mismatch/lost counts: `0/0`; replace media: false; retired segments:
  `[0, 0, 0]`.
- Raw status SHA-256:
  `6567fbdf15a529634d24aa982f1936c5755672f5cab2c6a8f5ac26d7d7db3cbe`.

Artifacts:

- Result:
  `foundation/hpt2-status-observations/9d5610ed-8288-4e7a-8c31-fa55f4925c47/result.json`,
  `2263` bytes, SHA-256
  `7434cbc96412f3b516a828f14e91a63c01439a2d80a59944d8b2d3347ac6f698`.
- Transcript:
  `foundation/hpt2-status-observations/9d5610ed-8288-4e7a-8c31-fa55f4925c47/jlink-transcript.log`,
  `3375` bytes, SHA-256
  `b5bb38f271d34645b80ea22e4bc17e5f1122907361462b52729ad4e033051db1`.

This proves that A remains recoverable at the Stage 0 boundary. It does not
authorize or perform finalization or resumption.

## Controller B exact read-only identity

Observation `3632e9de-841f-45aa-a393-e33a3b915700` passed.

- Controller role/assembly/probe: `B` / `1751219` / `69660123`.
- Hardware variant: `1`; VTref: `3.303 V`.
- CPU running before and after: true.
- Bundle: `smi-00-05-00-bc0b6ce4d066-release`.
- Bundle manifest SHA-256:
  `5df475bd0b2de8792f40bc2bd49efde37fce66f9b80bd24b4bb2e675fc1176ce`.
- Expected and observed complete 4 MiB flash SHA-256:
  `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28`.
- Source commit: `bc0b6ce4d0666cacd65e19efd2c3b56add39a50f`.
- Mapping SHA-256:
  `0b8b68c32955177a731f55e3dce6637100a3bcaf016ef9da729721295ef24770`.
- Main system, SD-last, and SSP status: `0`; replace media: false.
- Protocol detection state `4`, CID-valid true, representative-sector-read
  true, driver status `0`.
- HPT state/status: `1/5`; sector count and lane/diagnostic evidence are not
  initialized (`0`). This is a preflight blocker, not a Stage 0 failure.
- Manufacturer/MID: unknown retail KEXIN / `0x05`.
- OEM/application ID: `??`; product: `asdfg`; revision: `2.2`.
- Serial: `7298`; manufacturing date: `2026-03`.
- Complete raw CID: `05000C61736466672200001C8201A379`.

Artifacts:

- Result:
  `foundation/controller-observations/3632e9de-841f-45aa-a393-e33a3b915700/result.json`,
  `3022` bytes, SHA-256
  `f6f207225be6d9a1f115b2de2830d93919b6df248060af5799673923b0d74077`.
- Transcript:
  `foundation/controller-observations/3632e9de-841f-45aa-a393-e33a3b915700/jlink-transcript.log`,
  `7079` bytes, SHA-256
  `0643851adbad12975ddf146f52b12e0db5aebe9d94462c8d17b32cd6e1d2c465`.

B has a distinct KEXIN CID, but the campaign assignment still has no linked B
CID capture and no B run. This snapshot is identity/baseline evidence only; it
does not satisfy B preflight or qualification admission.

## Application and database truth

Final database capture: `2026-08-09T18:56:19.411745Z`.

- Campaign `648ba10c-0bc0-4319-8089-78a0cce287ce`: `RUNNING`.
- A assignment: `F1-A1`, stage `HPT2_MEASUREMENT_READY`, result `PENDING`.
- A active run: `717ae30c-736d-430c-8ce5-529c97b3920a`, database state
  `RUNNING`, stale heartbeat `2026-08-07T23:21:23.241043Z`.
- Its sole command is acknowledged START
  `dbba74bc-d652-4eab-90f3-7735b0708afe`; no Stop operation exists.
- The A `next_action` still incorrectly says no target access occurred.
- B assignment: `F1-B1`, stage `INTAKE`, result `PENDING`, zero runs, no
  campaign CID capture.
- Campaign evidence rows before these foundation-only snapshots: `511`.
- Campaign notifications: `0`, despite configured intervention subscription.
- Command and notification worker heartbeats were current and `RUNNING`.
- Internal health returned `status=ok`, database/storage/clock/workers true,
  but correctly retained `fixture_only=true`, `live_admitted=false`,
  `state_changing_profiles_enabled=false`, `bounded_stop_supported=false`, and
  `recovery_supported=false`.

The green appliance health therefore remains insufficient as qualification
health; it does not incorporate the failed campaign services or stale run.

## Orchestration and process inventory

- Six `sdq-controller-a-*` user units are failed; no qualification unit or
  qualification timer is running.
- Four current continuation units have `Restart=no`, empty `OnFailure`, result
  `exit-code`, and status `1`.
- Matrix v3 ran from `2026-08-06 03:38:31 PDT` through
  `2026-08-08 00:21:41 PDT`; downstream waiters failed immediately afterward.
- Current 20-file Pi continuation-script manifest SHA-256:
  `e2638fe87dd142984ba5882e9d7538733c50ab64e24eca34ae0df4987705494f`.
- Four-unit manifest SHA-256:
  `9c84b1446f7701a537c5797b860556cadc457237b65372c11aab936d1150a347`.
- `run-one.sh` SHA-256:
  `51af39caf5768741690d223c7f475aee2c3fae9bfa417657dedd877588f262ed`.
- `run-matrix.sh` SHA-256:
  `e0f018feea20090371a623f390f427f9d0eb780a49dd02710024fbc6024ce913`.
- Windows orchestrator PID `39428` remains alive from
  `2026-08-06T04:13:21-07:00`; script SHA-256
  `9a35e482df83e3f53f7d43f836e6eab6760e0755e5be4225a029498446340469`.
- Windows held `103` SSH processes: `94` older than 24 hours, `80` older than
  72 hours, `83` with a missing parent, oldest `310.2` hours.
- No process or unit was terminated or restarted in Stage 0.

## Deployment and storage inventory

- Pi source checkout: branch `codex/full-address-scrub-adapter`, commit
  `9d7e0f0584fd2589ba7a823d462f7ddce6e9023b`; only generated work indexes are
  modified.
- Web: release `section-estimates-abca3b0`, revision
  `abca3b08c788e467f6be7ff5ad783d106ba34b4c`, image
  `sha256:2a42efc92df3357fc582666bd08911b01cf97cdd71432d222546044670f39e96`.
- Command worker: release `hpt2-s4-boundary-b586704`, revision
  `b586704a69e6e351ce4363e7e21d5cc311021046`, image
  `sha256:4237e644eec42d742be75942a9ff2f8013812ebc309e0f416f306b70aefbd9c7`.
- Notification worker: release `account-notifications-b9ccca1`, revision
  `b9ccca10424791119140b6cf43c8b7a7468218c2`, image
  `sha256:ea8fbb3a0f449f4abcffe13cd4fffbfc10b451342f884aa8541bbf97be62c371`.
- PostgreSQL is healthy on the digest-pinned 17.5 image.
- Evidence storage preflight: PASS, atomic rename true, no findings,
  `68167434240` free bytes.
- Filesystem: `117G` total, `49G` used, `64G` available (`44%`).
- Pi source evidence: `81M`, `11744` files; host runner area: `19M`, `1660`
  files.
- The six new read-only result/transcript files have aggregate manifest
  SHA-256
  `4be526fb1d37f87d0174c51a7e0db0c1205ba59918946f5aac61de33e3fb99b4`.

Mixed application revisions and unversioned host runner scripts are preserved
as Stage 1 deployment-manifest findings; Stage 0 did not normalize them.

## Cleanup and failed-attempt accounting

Two pre-target wrapper attempts were invalid and are retained as method
evidence:

1. The first A observer wrapper failed while extracting the temporary nftables
   handle. No observer container or target access occurred. Exact temporary
   rule `sdq-stage0-a-1431754`, handle `5353`, was removed before retry.
2. The first HPT2 status wrapper opened an empty Django shell because the
   encoded read script was not forwarded. No status read or target access
   occurred. Its temporary rule was removed before retry.

After every successful and failed attempt:

- the only J-Link firewall state was the default non-loopback drop for ports
  `19120` and `19121`;
- no observer, programmer, HPT2-command, initialization, or scrub container
  remained;
- no `sdq*` qualification service was started;
- Controller A remained held at `44641`; Controller B remained not started.

## Gate disposition

Stage 0 exit evidence passes:

- [x] Database backup created, hash-verified, and restored into a disposable
      database.
- [x] Compact aggregate manifest created with exact paths and hashes.
- [x] Fresh exact read-only Controller A identity and held-run status captured.
- [x] Fresh exact read-only Controller B identity captured.
- [x] Pi services, scripts, deployment, storage, notification, firewall, and
      Windows process state inventoried.
- [x] Controller A remains recoverable and held; Controller B has zero runs and
      remains at intake.

Stage 1 may begin only as source/fixture supervisor work. Controller mutation,
A recovery, B preflight mutation, and B Start remain outside this gate.
