# Watchdog Stage 6 Controller B preflight complete — 2026-08-09

Status: PASS; Controller B is admitted and ready for one separately authorized S0 Start, but no Start intent exists
Type: evidence
Updated: 2026-08-09
Next Action: Stage 7 requires fresh exact B Start authority and a final same-identity read-only snapshot before preparing the single-use Start intent
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-watchdog-gated-controller-a-recovery-and-controller-b-start.md

## Stage result

The owner confirmed that `F1-B1` was installed only while Controller B was
powered off and has not been removed or reinserted since. That attestation is
append-only evidence `1842`, SHA-256
`e62aa5642b30ae81729ff3c6e96aecbcec5599d40e7ce66d7db0a996ea59f58d`,
and campaign event `254`. No powered SD-card removal or insertion occurred.

The exact single-use baseline scrub operation
`1a9b19de-3a71-4ff4-852b-2a68e27a26f8` completed
`FULL_ADDRESS_SCRUB_PASS` over all `15,728,640` sectors. It recorded zero
failed sectors, zero retry-recovered sectors, zero identity mismatches, and no
failed-sector address. Result evidence `1865` has SHA-256
`8d8f386031b3744ddc4596257cb8b7113443efd317dca07d4b3d4648e1598c`.

The post-scrub read-only observation
`edbf230f-0a7a-4151-abf9-64a4054b2812` passed exact Controller B assembly
`1751219`, probe `69660123`, variant `1`, complete firmware readback
`507e5b91d53afeb1b2d9d16442e3f6ff0391dcc7a53cead269cb11396dfcf246`,
and unchanged CID `05000C61736466672200001C8201A379`. Campaign event
`255` binds that observation to the passed scrub.

HPT media-2 initialization operation
`799a5a61-3392-4857-b4dc-43d42d817db4` completed
`HPT_INITIALIZATION_PASS`: media state `5`, lane mask `7`, retired segments
`[0,0,0]`, zero mismatches, zero lost records, no replace-media request,
terminal proof `15`, and new boot witness `F54F10127F443248`. Fresh identity
capture `122` records protocol `READY; RAW_HPT; DRIVER_OK`, valid CID,
representative-sector read, decoded fields, and the unchanged complete raw CID.
CID is identity evidence, not proof of authenticity.

Required post-initialization CID identity block:

- Protocol card status: `READY; RAW_HPT; DRIVER_OK`.
- CID valid: true.
- Representative-sector read: true.
- Manufacturer: unknown CID manufacturer; retail brand KEXIN; MID `0x05`.
- OEM/application ID: raw `0x000C`.
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7298`.
- Manufacturing date: `2026-03`.
- Complete raw 128-bit CID: `05000C61736466672200001C8201A379`.

Admission capture `123` links to that same-run post-initialization identity
block. There was no intervening card replacement, power-off reinsertion,
initialization, or reboot, and its complete raw CID is unchanged.

The application admitted exact S0 measurement run
`ffb59651-0bb0-4d9b-a729-0099cc0f5690` at
`HPT2_MEASUREMENT_READY`. Its immutable next action is:

> Prepare the exact S0 Start intent; no target access has occurred.

No B `Authorization` and no B `Hpt2CommandOperation` exists. Stage 6 did not
prepare, publish, or acknowledge a Start.

## Lifecycle-policy correction and validation

Live evaluation exposed a second integration defect: the policy had required
the passed scrub and initialization operations to reference the newest CID
capture row, even though successful initialization and HPT2 admission correctly
append later same-card captures. Commit
`5b80fdae997e063eaa041d85260d65c77c183b09` now requires an immutable
same-CID, same-firmware-bundle, Controller-B chain with exact scrub and
initialization PASS codes. It does not equate database row recency with a card
replacement.

The focused lifecycle/scrub tests pass `23/23`. The complete ARM64 image suite
passes `303/303` on disposable SQLite and `303/303` on disposable PostgreSQL
17. The disposable PostgreSQL container and network were identity-checked,
removed, and verified absent.

Production runs release `qualification-watchdog-5b80fda`, source commit
`5b80fdae997e063eaa041d85260d65c77c183b09`, image
`sha256:931cfce616fd59fbc084fdba515515a645edcf29fcf078bf7bd3dcd9efe9d950`,
and deployment manifest
`2fac279c715146fbb281c91414d1e4b6e8d6990b34b5a15c360614b5ddbcfe88`.
Fresh backup `/backups/sd-qualifier-20260809T231046Z.dump` is `586870` bytes,
has SHA-256
`2d16818872267923ab41ea2d420bb637fd3d33f4f865f95607aaaa4661117895`,
and passed a disposable restore check.

The first recreation attempt failed closed before migration or service
replacement because host bind-path variables were not preserved through
`sudo`. The old application containers remained live. Two unused created-state
replacement containers were identity-checked and removed. The corrected
`sudo -E` deployment recreated all four application services successfully;
the web health endpoint, database, evidence storage, clock, and workers pass.

After three new-manifest Controller A observations spanning the policy window,
campaign event `260` records `CONTROLLER_B_EXECUTION_ALLOWED` with no base or
Start blockers. The authenticated card template renders the exact S0 next
action and `B Start allowed`. This is readiness, not authority: Stage 7 must
create fresh exact authority before any intent.

## Preserved safety boundary

Controller A run `de340af2-d505-495e-a14f-5159e55b1633` remains `RUNNING`
and `HEALTHY` under the Pi-owned observer. At rest the host firewall permits
only A read-only observation on `19120`; its default rule drops ports `19120`
and `19121`, so B has no reachable command allowance. Runtime command policy
enables role `B`, binds only B to `host.docker.internal:19121`, and leaves A's
HPT2 command endpoint empty. A B allowance may exist only around a separately
authorized Stage 7 command and must be removed afterward.

Stage 6 is complete. Stage 7 remains an explicit new action and was not begun.
