# Watchdog Stage 3 production deployment evidence — 2026-08-09

Status: PASS; production-safe monitoring deployed and restart-proven without a controller command
Type: evidence
Updated: 2026-08-09
Next Action: retain as the Stage 3 entry gate for controlled Controller A recovery
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-watchdog-gated-controller-a-recovery-and-controller-b-start.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Release and rollback identity

- Source commit: `94768c9cef418260b16028357c24028495235e29`.
- Initial production release:
  `/home/jong/dev/sd_qualification-release-94768c9`.
- Initial image:
  `sha256:80e2acd20ecdd106d71492f5342db211a47487286d32c9486ee245082a1338f2`.
- Initial deployment-manifest SHA-256:
  `ddd4575977f4a274eb1a3d241ba473d3885c2ec3dde1a68d5f637ccf0db018fe`.
- Predeployment backup:
  `/backups/sd-qualifier-20260809T200729Z.dump`, `510670` bytes,
  SHA-256 `55ee649af07906a476244bddd856881339c03a30390e0ef3b448a60fcb5802dd`.
- Disposable restore check passed and returned all eight campaigns.
- The prior database credential and complete old deployment inputs remain in
  permission-restricted rollback material; no credential value is recorded in
  this evidence.

## Production gates

Migration `qualification.0021_qualification_supervisor` applied with no drift.
The evidence-storage identity marker, clock, database, workers, exact manifest,
bundle store, validator fixture/image, HPT2 profile, and controller registry
all passed. State-changing capabilities stayed deliberately disabled or
blocked: controller registry execution, live adapters, media writes,
power/media operations, and bounded-stop recovery admission were not opened by
this stage.

The host systemd observer and in-container watchdog both ran under restart
supervision. An exact watchdog-process termination changed its PID from
`1515760` to `1519159`, Docker `RestartCount` to `1`, and heartbeat instance to
`fac760fa735b:1:dc219423`; the preserved A state stayed healthy and no
controller operation was created.

## Authority retirement and incidents

Four exact stale Windows campaign processes were terminated and verified
absent: final orchestrator PID `39428`, child/status SSH `42312`, matrix monitor
`56620`, and card-gate monitor `7412`. Unrelated SSH history was not touched.
The Pi supervisor is now the sole campaign observer authority.

Deployment exposed and corrected three application-host integration issues:
production secret/environment enforcement, rollback-trap precedence, and
systemd sandbox settings that prevented the deliberately scoped `sudo -n`
Docker/nft observer operations. The first deployment attempt rolled back
before controller access. Diagnostic cycles created and delivered transient
missing-snapshot, observer-divergence, stale-observer, and manifest-mismatch
interventions; they remain historical evidence and do not represent a card
failure.

Stage 3 issued no Start, Stop, reset, power, programming, initialization,
scrub, or media command to either controller.
