# Watchdog Stage 6 Controller B preflight power-confirmation gate — 2026-08-09

Status: RESOLVED; owner power-off installation confirmation was recorded and Stage 6 subsequently passed
Type: evidence
Updated: 2026-08-09
Next Action: see work/evidence/watchdog-stage-6-controller-b-preflight-complete-20260809.md for the completed scrub, initialization, admission, and preserved no-Start boundary
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-watchdog-gated-controller-a-recovery-and-controller-b-start.md

## Safe preflight completed

- Controller B is exact: assembly `1751219`, probe `69660123`, hardware
  variant `1`, endpoint `19121`, with A independently bound to endpoint
  `19120` and probe `69664082`.
- Read-only baseline observation
  `29f2be0a-6d8c-4a37-97e2-d79f9d9357f8` passed against the previously
  installed firmware and confirmed the installed card CID
  `05000C61736466672200001C8201A379`.
- Restore-verified backup `/backups/sd-qualifier-20260809T215931Z.dump` is
  `560048` bytes with SHA-256
  `6280d609365dc604b182645b16488ef7b05f9c7a5b18586f74bf4c6c892d24b8`.
- Programming operation `d12e5a58-a948-47d6-97cf-c164c48fc9a6` passed for
  exact Release bundle `smi-00-05-00-660433743898-bcf70c2de65c-release`.
  Complete code-flash readback is
  `507e5b91d53afeb1b2d9d16442e3f6ff0391dcc7a53cead269cb11396dfcf246`;
  option memory and VEEPROM remained byte-identical, and the CPU returned to
  running state.
- Post-reset read-only observation
  `bd63572b-294f-4ab3-b8d5-05ad3f8ad84d` passed with the same complete flash,
  assembly/probe/hardware identity, valid protocol identity, representative
  sector read, and complete raw CID. Its immutable result SHA-256 is
  `25b93bc47f7b46db9ec8f69126fa9fff34da534073d85f6527582161642bc667`.
- Campaign identity capture `121`, evidence `1801`, and event `252` bind that
  exact post-reset observation to `F1-B1`. The record explicitly marks power
  state evidence pending rather than inferring it.

Required CID block:

- Protocol status: detection state `4` (`NEEDS_INITIALIZATION`), raw HPT media,
  driver status `0`.
- CID valid: true.
- Representative-sector read: true.
- Manufacturer: unknown CID manufacturer; retail brand KEXIN; MID `0x05`.
- OEM/application ID: raw `0x000C`.
- Product: `asdfg`; revision `2.2`; serial `7298`; manufactured `2026-03`.
- Complete raw 128-bit CID: `05000C61736466672200001C8201A379`.

CID is identity evidence, not proof of authenticity.

## Parallel-scrub gate correction

Live execution exposed a Stage 5 integration defect: the reviewed policy
allowed independent B preflight while the baseline-scrub adapter still
required the campaign-wide state `INTAKE`, which was impossible while A made
the shared campaign `RUNNING`. No SD write had begun.

Commit `92702f8207ddd771b586f1aa81586bae7dcd920a` permits only Controller B's
policy-admitted baseline preflight in a running campaign; A and every other
state remain fail-closed. Focused tests passed `22/22`; the complete suite
passed `302/302` on isolated SQLite and PostgreSQL 17.

Production runs exact image
`sha256:192f8abf435d0396a029d04c0cb3f225aa9473d4377401d8735982770029f8d2`
and deployment manifest
`ab7092e314026a334ed0cc476db94e526af12894add8675e3f4345bd6f4b6014`.
All four app services and the systemd observer run the new source. The manifest,
web health, workers, evidence storage, and clock pass.

The corrected read-only full-address scrub preflight passed at
`2026-08-09T22:17:19Z`: exact flash/CID/role/probe/hardware identity, command
word `0`, idle state, and zero failed, recovered, mismatched, or attempted
sectors.

## Preserved stop boundary

No full-address scrub operation, HPT initialization, B run, HPT2 command
operation, or B Start intent exists. B endpoint access was command-scoped and
removed after each operation. A remains `RUNNING` under its independent
observer. Storage preflight passes with `67,016,024,064` free bytes; the
notification path has current successful deliveries and no active delivery
error.

Stage 6 cannot truthfully close until the operator confirms the already
installed `F1-B1` was inserted only while Controller B was powered off and has
not been removed or reinserted since. The database stage is
`CID_BASELINE_POWER_CONFIRMATION_PENDING`. If confirmation is unavailable,
the safe alternative is a separately coordinated Controller B power-off,
power-off card reinsertion, boot, and fresh CID capture before destructive
qualification continues. Powered removal or insertion is prohibited.

## Resolution

The owner supplied the required confirmation in this campaign. It was recorded
as immutable evidence `1842` and event `254`; the exact scrub, initialization,
and S0 admission then passed. Stage 6 completion evidence is
`work/evidence/watchdog-stage-6-controller-b-preflight-complete-20260809.md`.
