# Checklist: HPT2 bounded-stop, recovery, and regression measurement

Status: active; representative A/B regression is reconciled, while the current-image matrix, Controller B recovery, post-campaign closeout, and dispositions remain incomplete
Type: checklist
Updated: 2026-08-12
Next Action: review the Aug. 12 deterministic A 10080/BEFORE and B 1440/BEFORE S4 adjudications and choose the next separately admitted pair before the remaining B recovery and both-card closeout gates
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Profile Contract: docs/hpt2-endurance-baseline-v1.md
Adapter Contract: docs/hpt2-live-command-adapter-v1.md
Authorization Matrix: work/decisions/decision-remaining-qualification-authorization.md
Measurement Contract: docs/hpt2-measurement-matrix-v1.md

## Purpose and authorization boundary

### 2026-08-12 deterministic S4 A/B continuation

The fourth separately authorized pair used firmware-held exact S4 boundaries
after evidence showed B's fixed-delay Stop could advance by two records and
correctly earn no base credit. A run `9eb4f195...` passed `10080/BEFORE` with
`10079/10079/10079`; after the required three healthy A proving snapshots, B
run `0cfda2bf...` passed `1440/BEFORE` with `1439/1439/1439` while A remained
active. Both extended S4 adjudications are credited, and each terminal state
also adds one valid S3 observation. Current base counts are A: S0 `0/3`, S1
`5/10`, S2 `3/10`, S3 `6/10`; B: S0 `0/3`, S1 `0/10`, S2 `0/10`, S3 `5/10`.
The new extended counts are A `10080/BEFORE 1/3` and B
`1440/BEFORE 1/3`. Both cards are idle at `AWAITING ADMISSION`, both
supervisors are healthy, and no command remains unsettled. No further case is
authorized by these results. See
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-12 idle badge correction and authorized A/B S3 continuation

Release `qualification-awaiting-admission-84bf5d9` now renders an incomplete
automated traveler row with no open run as `AWAITING ADMISSION`, while a
genuinely open run still renders `RUNNING`; its exact image passes `343/343`
tests and production verifies both branches. The additionally authorized A
900-second and B 600-second planned S3 cases both passed bounded stop. Neither
hit S3: A credits S2, advancing A S2 to `3/10`; B credits no case. Current A
base counts are S0 `0/3`, S1 `5/10`, S2 `3/10`, S3 `5/10`; B remains S0
`0/3`, S1 `0/10`, S2 `0/10`, S3 `4/10`. Both supervisors are healthy and
both idle pages correctly show `AWAITING ADMISSION`. No further controller
case is authorized by these results. See
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-12 second authorized A/B S1 continuation

One additional separately admitted S1 case ran on each controller. Both
bounded stops passed, all Start/Stop operations are acknowledged, and both
transient services exited successfully. A's planned S1 trigger was not met but
its evidence credits S3, advancing A S3 to `5/10`; B's planned S1 trigger was
not met and credits no matrix case. The audit remains false: A base counts are
S0 `0/3`, S1 `5/10`, S2 `2/10`, S3 `5/10`; B base counts are S0 `0/3`, S1
`0/10`, S2 `0/10`, S3 `4/10`. Both current supervisors are healthy and both
web cards remain `IN PROGRESS`. No further case is authorized by these
results. See
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-11 authorized A/B S1 continuation

One separately authorized S1 case ran on each controller. Both bounded stops
passed and both transient services exited successfully with acknowledged Start
and Stop operations. A's planned S1 trigger was not met but its evidence
credits S2, advancing A S2 to `2/10`; B's planned S1 trigger was not met and
credits no matrix case. The audit remains false: A base counts are S0 `0/3`,
S1 `5/10`, S2 `2/10`, S3 `4/10`; B base counts are S0 `0/3`, S1 `0/10`,
S2 `0/10`, S3 `4/10`. Both current supervisors are healthy and both web cards
remain `IN PROGRESS`. No further case is authorized by these results. See
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-11 terminal supervisor and campaign handoff correction

The completed Controller A S1 run is now `HEALTHY`; its inactive successful
transient runner is accepted only with matching STOPPED terminal proof,
observed Stop, finalized evidence, and no unknown command outcome. The web no
longer labels either inactive handoff as automated work in progress. F1-A1
requests review of `CASE_PASS`; F1-B1 requests review of
`BOUNDED_STOP_PASS_CASE_TRIGGER_NOT_MET`. This status authorizes no controller
command. See
`work/evidence/sd-qualifier-terminal-supervisor-handoff-deployment-20260811.md`.

### 2026-08-10 traveler qualification-reference deployment

Production release `qualification-traveler-reference-0acdb5e`, image
`sha256:a17164e...767881`, adds a visible detailed-qualification link to every
one of the eight QA traveler steps. Each reference section states the method,
pass criteria, evidence, failure handling, and operator/safety boundary, with
an exact return link to the traveler. Exact ARM64 tests pass `309/309`, and
Playwright exercised all eight forward and return links in production. Both
runner invocation IDs and role observers were preserved; both supervisors are
healthy and current interventions remain zero. See
`work/evidence/sd-qualifier-traveler-reference-deployment-20260810.md`.

### 2026-08-10 dashboard and active-card page performance pass

Production release `qualification-page-performance-e2bc362`, image
`sha256:d7c5a855...cc3552`, removes the run×event aggregation that made page
latency grow with campaign history. Authenticated Playwright improved from
`11.666 s` to `1.080 s` for the dashboard and from `5.881 s` to `1.745 s` for
F1-A1; F1-B1 loads in `1.644 s`. Exact ARM64 tests pass `307/307`. Both parent
runner invocations and observers are preserved, both live runs continued to
heartbeat, and current intervention/supervisor-alert counts are zero. See
`work/evidence/sd-qualifier-card-page-performance-correction-20260810.md`.

### 2026-08-10 current intervention projection and recovered-alert closure

Production release `qualification-current-interventions-e4bf6e5`, image
`sha256:99ff23bd...37e2db`, and manifest `ff7a182b...34089f` separate
authoritative current supervisor blocks from delivered notification history.
Recovered supervisor alerts and deliveries now close with an audit event, so
they remain historical but do not look actionable or send reminders. Future
watchdog email carries the exact run/controller. The ARM64 suite passes
`306/306`; authenticated production rendering has no current intervention or
supervisor-block banner, while campaign history remains visible. All `185`
recovered supervisor notifications are closed, both live supervisors are
healthy, and zero command operations are unresolved. See
`work/evidence/sd-qualifier-current-intervention-projection-and-recovery-closure-20260810.md`.

### 2026-08-10 parallel S4 recovery and watchdog run-boundary pass

Unified release `qualification-watchdog-91bfd8a`, image
`sha256:819e12a...fcf7e4`, and manifest `6bc6e768...74cd4d` correct the
cross-role runner failure, exact S4 stage binding, proving cadence, and
cross-run heartbeat baseline. Operations tests pass `44/44`; focused watchdog
tests pass `28/28`; the exact ARM64 suite passes `305/305`. Both runner IDs
survived deployment with healthy new-manifest supervision and no unresolved
command. B credited S4 `10080 / BEFORE` observation 2 and immediately admitted
observation 3 as run `79a3a85f...db41`; its first new-run snapshot was healthy
at `76/75/75`, proving the false heartbeat-regression transition is removed.
Final live verification found A at `3213/3213/3212`, B at
`1451/1451/1450`, both parent services and both role observers active, both
supervisors healthy, and no unresolved command. No card was moved or controller
rebooted. See
`work/evidence/s4-parallel-restart-watchdog-run-boundary-deployment-20260810.md`.

### 2026-08-09 Controller B base pass and supervised S4 launch

Controller B base coverage is S0 `7/3`, S1 `11/10`, S2 `37/10`, and S3
`10/10`, all PASS. Operations commit `e0a1a95` corrects the forced-stop
watchdog cleanup gap with dead-owner-only `ExecStopPost` rule removal; the
focused cleanup gate and complete operations suite pass. Commit `beb5a57`
adds role-scoped, exact-resume S4 execution. B S4 service
`sdq-controller-b-s4-matrix-v1.service`, invocation
`37c155294d11410eba9cc108b274dedd`, completed and credited the first
`1440 / BEFORE` observation without replay. A transient adjudication-command
exit was corrected by durable-evidence confirmation in commit `c4990b2`.
Successor invocation `c0e283d128d04dcfa5d7f94a5bcb2d4e` completed and
credited observation 2 with both adjudicators confirmed on attempt 1, then
began observation 3 from credited count 2. A remained on invocation
`8bf2ff84f9cb432db4b74edffe00ee6c` and advanced to
`36211/36211/36210`. No card was moved and both identities are unchanged. See
`work/evidence/controller-b-base-matrix-pass-and-s4-parallel-launch-20260809.md`.

### 2026-08-09 final watchdog cleanup and B parent restart

Production release `qualification-runner-supervision-e82398a`, manifest
`a25039e4a...fb1fc`, preserves per-controller serialization and cleans
same-role stale observer rules after forced stops. Guarded operations commit
`9c00886` completed admitted B run `a773727d...207f` from its one exact
prepared Start without replay; evidence `2470/2473` is durable and B has zero
unresolved commands. B restarted at S0 `3/3`, S1 `2/10`, S2 `6/10`, S3
`3/10` under parent invocation `8bd7f82b0afe4c63ab33115e4557d532`.
Controller A remains active on its original invocation. Post-matrix work stays
blocked until the combined audit passes. See
`work/evidence/progress-aware-runner-supervision-and-controller-b-s0-3-20260809.md`.

### 2026-08-09 serialized target access and Controller B base-matrix continuation

Production release `qualification-runner-supervision-f664bf5` adds separate,
bounded per-controller J-Link locks shared by target-bearing campaign commands
and watchdog snapshots. The previously ambiguous B Start was reconciled
read-only without replay and completed with its paired Stop, crediting S1. A
subsequent clean run credited S2. Immutable operations commit `366afbb` adds
durable adjudication confirmation and now runs the B parent and child from one
tree. Verified B coverage is S0 `3/3`, S1 `1/10`, S2 `2/10`, S3 `3/10`; the
parent invocation is `9e0a35802e604904b783ce22ebf49fc6`. A remains on
invocation `8bf2ff84f9cb432db4b74edffe00ee6c` and reached
`26716/26716/26715`. See
`work/evidence/progress-aware-runner-supervision-and-controller-b-s0-3-20260809.md`.

### 2026-08-09 runner supervision repaired and Controller B S0 complete

Production release `qualification-runner-supervision-ffbf93e` binds the actual
matrix/dependent service chain, uses a record-progress lease plus separate hard
ceiling, and launches all campaign adapters from the immutable protected
Compose context. Controller A exact run `de340af2-d505-495e-a14f-5159e55b1633`
resumed without Start replay and is healthy at `22321/22321/22320`; the
watchdog names runner invocation `8bf2ff84f9cb432db4b74edffe00ee6c`.

Separately authorized B run `c20498c3-9ba6-476d-b240-d868b7937044`
completed a same-session S0 Start/Stop with unchanged CID and boot identity,
making B S0 `3/3`, PASS. No unresolved B operation or temporary firewall rule
remains. Independent B supervision then passed on live S1 run
`fdf1d523-1a36-402d-b45d-257e6e58ab38` without changing A's healthy
projection; the untriggered zero-delay S1 attempt was correctly not credited. See
`work/evidence/progress-aware-runner-supervision-and-controller-b-s0-3-20260809.md`.

### 2026-08-09 after-matrix ship gate audit

The live matrix remains incomplete and the post-matrix recovery/regression
route is not admitted. Read-only audit found the current A run healthy and
progressing, but `sdq-controller-a-s4-matrix-v3.service` and all dependent
continuation services are failed. The prior runner exhausted a fixed 28,800-
second wait while still making healthy progress; the Stage-4 recovery created a
new run without restoring the chain. The production watchdog projects A healthy
because it names only the observer service, not the missing matrix runner.

Treat this as a reopened infrastructure gate. Do not start the five recovery
cases, regression, final scrubs/CID captures, A/B review, or deadline derivation
until the corrected runner/watchdog contract passes and the full A/B matrix
audit reports PASS. See
`work/evidence/after-measurement-matrix-ship-readiness-gate-audit-20260809.md`
and
`work/wp/completed/wp-repair-progress-aware-measurement-runner-supervision.md`.

### 2026-08-09 Controller B S0 observation 2 credited

Run `e7eb0d5f-4dc7-42fe-b7fe-1c6bca515ba7` completed one exact same-session,
replay-disabled Start/Stop pair. Stable stopped-clean evidence produced S0
`CASE_PASS`; adjudication evidence `2005` credits S0 observation 2 of 3. CID
and boot identity remained unchanged, A remained healthy and running, and B is
firewalled at rest. See
`work/evidence/controller-b-s0-observation-2-20260809.md`.

### 2026-08-09 Controller B Stage 7 S0 credited

Fresh exact authority and final unchanged-CID identity preceded one
same-session, replay-disabled Start/Stop pair for run
`ffb59651-0bb0-4d9b-a729-0099cc0f5690`. Two stable stopped-clean observations
classified S0 `CASE_PASS`; adjudication evidence `1975` credits S0 observation
1 of 3 and its observed S3 contribution. A remained healthy and running, B's
temporary firewall allowance was removed, and the traveler/database/service
state agree. See
`work/evidence/watchdog-stage-7-controller-b-start-and-observation-20260809.md`.

### 2026-08-09 Controller B Stage 6 preflight complete

The owner's power-off installation confirmation is immutable evidence `1842`.
The complete B scrub passed all `15,728,640` sectors with zero failures,
recoveries, or identity mismatches; HPT media-2 initialization and fresh CID
capture passed; and S0 run `ffb59651-0bb0-4d9b-a729-0099cc0f5690` is admitted
at `HPT2_MEASUREMENT_READY` without target access. Commit `5b80fda` corrects
same-card lifecycle matching and passes `303/303` tests on SQLite and
PostgreSQL 17. Event `260` and the rendered UI report exact S0 Start readiness.
B still has zero authorization and zero HPT2 command operations and is
firewalled at rest. See
`work/evidence/watchdog-stage-6-controller-b-preflight-complete-20260809.md`.

### 2026-08-09 Controller B Stage 6 power-confirmation gate

B now has the exact campaign firmware, complete-readback proof, post-reset CID
capture, campaign identity record, and passing corrected read-only scrub
preflight. Parallel-running baseline scrub integration commit `92702f8` passes
`22/22` focused and `302/302` full tests on SQLite and PostgreSQL 17 and is
deployed as image `sha256:192f8abf...f8d2`. No B scrub, initialization, run,
HPT2 operation, or Start intent exists. Resume only after the operator confirms
F1-B1 was installed while Controller B was powered off and has not been
removed/reinserted since. See
`work/evidence/watchdog-stage-6-controller-b-preflight-power-confirmation-gate-20260809.md`.

### 2026-08-09 Controller B parallelization policy deployed

Watchdog campaign Stage 5 passes. Accepted ADR
`work/adr/adr-controller-b-parallel-qualification-entry-policy.md` separates B
Preflight from B Start, removes the old matrix-derived scheduling effect, and
enforces the gate before B observation, intent creation, and publication.
Exact source `dc492e4` and image `sha256:6543e1ea...3db7` pass `11/11`
focused and `299/299` full tests on SQLite and PostgreSQL 17. Live event 251
reports `preflight_allowed=true` and
`controller_b_execution_allowed=false`. A remains healthy; B remains at
`INTAKE`, with zero runs and operations. Continue only with the full B
preflight. See
`work/evidence/watchdog-stage-5-controller-b-parallelization-policy-20260809.md`.

### 2026-08-09 watchdog-gated A recovery and resume

Watchdog campaign Stages 0–4 pass. The previously held A run was stopped once
and finalized without Start replay; extended adjudication preserved S4
`44640 / AFTER` observation 1 of 3. Audit-selected replicate 2 run
`de340af2-d505-495e-a14f-5159e55b1633` then received one acknowledged Start.
Exact production supervisor image
`sha256:14094d1659c54a9ccf9738022b5d84498e1ae0a021bec0fb16652042580e40ad`
corrects an observed in-flight read-lane false positive and passes `295/295`
tests. Four consecutive snapshots were healthy while verified records advanced
`1070 -> 1124 -> 1179 -> 1232`, with unchanged CID/boot/run/firmware identity
and no latched failure. Controller B remains at `INTAKE` and was not started.
See
`work/evidence/watchdog-stage-4-controller-a-recovery-resume-20260809.md`.

### 2026-08-07 section-completion forecasts deployed

All eight SD Qualifier traveler rows now show a completion timestamp and an
explicit `ACTUAL`, `HISTORY-BASED`, `MIXED HISTORY/ESTIMATE`, or
`ROUGH ESTIMATE` basis. The live matrix forecast uses remaining registered-plan
observations plus measured run history; later no-history allowances are visibly
labeled and operator waits/interventions are excluded. Exact merge tests pass
`260/260`, health is good, and all workers and four Controller A continuation
services remained continuous. The admitted row advanced to S4 44640/AT
observation 3 of 3. See
`work/evidence/sd-qualifier-section-completion-forecasts-deployment-20260807.md`.

### 2026-08-07 operator-facing matrix status correction

The SD Qualifier bounded-stop card now projects the validated matrix
adjudication: four completed S4 observations are labeled `CREDITED`, the active
S4 44640/AT observation 2 of 3 is labeled `RUNNING`, and the page no longer
shows `BOUNDED_STOP_PASS_CASE_TRIGGER_NOT_MET`. Current-campaign and earlier
Engineering attempt counts are separated. Exact merged image tests passed
`258/258`, live health is good, and the Controller A runner and workers were not
restarted. Continue the existing admitted chain without replay or interruption.
See
`work/evidence/sd-qualifier-matrix-status-projection-deployment-20260807.md`.

### 2026-08-06 S4 44640 / BEFORE live checkpoint

Read-only checkpoint `2026-08-07T00:19:18Z` records active Controller A run
`b58be682-69cd-4982-b3bf-8f78972458a3` at attempted `13778 / 44640`
(`30.9%`), with its one-shot START acknowledged and no STOP yet issued. All
four persistent continuation services are healthy. The CID remains
`05000C61736466672200001C8901A34F`; Controller B remains at `INTAKE` with no
active run, and the default two-port firewall drop is restored between polls.
Continue without replay or interruption. See
`work/evidence/controller-a-s4-44640-before-live-checkpoint-20260806.md`.

### 2026-08-06 recovery and automated closeout checkpoint

Pi commit `d47a9b1` implements all five reviewed interrupted-session recovery
evidence paths and passes `228/228` exact-image tests. Release
`hpt2-recovery-d47a9b1`, image `sha256:3fe6033a...fd45`, is staged behind the
zero-active-run gate. Persistent services now chain the exact S4 matrix,
identity-local S0-S3/S5/S6, terminal AFTER observations and qualified A-only
cycles, recovery deployment, and the five recovery cases.

A hidden local orchestrator then executes every automatable Controller A
regression, the CID-linked post-campaign full-address scrub, and final observer.
It asserts that Controller B and T00 are not contacted. The physical USB
publication/independent-reader move remains explicitly pending because the
bench has no actuator or USB mux; it does not stop the automated chain. See
`work/evidence/controller-a-recovery-and-automated-closeout-checkpoint-20260806.md`.

### 2026-08-06 Controller A full-run authorization and first S4 pass

The owner explicitly authorized Controller A programming and the complete
remaining A-local run, reconfirming that the controls are isolated lab units
with no machine, heater, or production load. New campaign
`648ba10c-0bc0-4319-8089-78a0cce287ce` records that scope while keeping
Controller B disabled and powered SD manipulation prohibited.

Exact bundle `smi-00-05-00-660433743898-bcf70c2de65c-release` was programmed
and complete-readback verified. Independent flash/CID observation, a zero-error
`15,728,640`-sector baseline scrub, canonical HPT initialization, and the first
S4 `1440 / BEFORE` repetition all pass. Extended Evidence `1121` records exact
`1439/1439/1439`, checkpoint `0`, stable `STOPPED_CLEAN`, and proof `0x1F`.
See
`work/evidence/controller-a-hpt2-s4-program-baseline-first-pass-20260806.md`.

Because the immutable firmware/profile identity changed, the prior campaign's
S0-S3/S5/S6 evidence remains historical rather than being copied into this
campaign. Fresh identity-local rows are required before Controller A is
complete.

### 2026-08-05 S4 checkpoint-region producer candidate

Firmware commits `20e2cb40` / `1e566bee` add a qualification-only exact S4
boundary hold without changing the request/status ABI or ordinary workload.
Managed Debug and Release rebuilds, static invariants, and 17 model tests pass.
Release bundle `smi-00-05-00-660433743898-bcf70c2de65c-release` is hash-valid
and imported on the Pi as valid, unadmitted, scope `none`.

Pi commit `b586704` admits exact S4 target/region plans, encodes only reviewed
tokens, binds adjudication back to the admitted boundary, and passes `224/224`
tests. Release `hpt2-s4-boundary-b586704` is deployed after package,
backup/restore, migration, storage, health, audit, and isolation gates. No
controller was accessed; the live campaign remains bound to the prior firmware,
S4 remains zero, and B remains disabled. See
`work/evidence/hpt2-s4-checkpoint-producer-candidate-20260805.md`.

### 2026-08-05 Controller A S6 runtime matrix pass

Ten valid Controller A S6 adjudications now cover APPEND, READ, and
SEGMENT_TRANSITION. All runs ended cleanly with immutable runtime/status proof,
unchanged CID and boot witness, one-shot Start/Stop publication, and observation
upper bounds from `2024` to `2089 ms`. Pi commit `4ad60e4` and live release
`hpt2-s6-boundary-4ad60e4` add append-only interval snapshots while rejecting
unstable and mid-append lane states; the exact-image suite passes `217/217`.

The live audit is A S0 `3/3`, S1 `20/10`, S2 `27/10`, S3 `13/10`, S5
`10/10`, and provisional S6 `10/10`; S4 remains zero. Therefore the A-local
gate is still false, B remains disabled, and `stop_deadline_ms` remains `null`.
See `work/evidence/controller-a-hpt2-s6-runtime-matrix-pass-20260805.md`.

### 2026-08-05 S6 qualifier deployment

Pi commit `7cf2cb8` fixes reversed runtime sequence decoding and adds exact
multi-record segment-transition proof from stable sequence and three-lane
geometry. Exact image `sha256:dd1892d...e30de` passed `214/214` tests and is
packaged and deployed after backup/restore, migration, storage, health, audit,
and isolation gates. Active runs are zero, firewall isolation is restored, and
deployment did not access a controller. Continue from
`work/evidence/controller-a-hpt2-s6-qualifier-predeployment-checkpoint-20260805.md`.

### 2026-08-05 Controller A S5 matrix pass

Ten separately admitted Controller A S5 runs each prove production queue deltas
queued/completed/drop/loss `2/2/0/0`, clean terminal proof, and exactly one
acknowledged Start and Stop without replay. The S5 upper bounds span `2020` to
`2054 ms`. Live audit totals are A S0 `3/3`, S1 `13/10`, S2 `20/10`, S3
`12/10`, S5 `10/10`, and S4/S6 zero. The A-local gate remains false, B remains
disabled, and `stop_deadline_ms` remains `null`. See
`work/evidence/controller-a-hpt2-s5-runtime-matrix-pass-20260805.md`.

### 2026-08-05 first Controller A S5 runtime-evidence pass

Pi commit `6dc1c3c` corrects exact GNU map parsing for section-owned symbols and
passes `212/212` exact-image tests. Release `hpt2-runtime-map-6dc1c3c`, image
`sha256:b550a9a5...52fce`, is deployed after package, backup/restore, migration,
storage, health, firewall, and residual-tool gates. Firmware and target identity
are unchanged.

Run `0703f83e...7f00` published each Start/Stop intent exactly once, used
read-only reconciliation after ambiguous Start output, and completed with clean
terminal proof and a `2023 ms` observation upper bound. Controller runtime
Evidence `658`/`669` proves queue deltas queued `2`, completed `2`, dropped `0`,
lost `0`; extended adjudication Evidence `672` credits S5. The live audit is A
S0 `3/3`, S1 `12/10`, S2 `12/10`, S3 `12/10`, S5 `1/10`, S4/S6 zero. B remains
disabled and `stop_deadline_ms` remains `null`. See
`work/evidence/controller-a-hpt2-s5-runtime-evidence-first-pass-20260805.md`.

### 2026-08-05 selected S4/S6 contract

The owner selected terminal `COMPLETED` as the final S4 `129600 / AFTER`
observation and selected A-local S6 as provisional until Controller B adds
valid cross-variant evidence. The Pi audit may enable B only after all A-local
S0-S6 gates pass; final S6 still requires both variants. Exact region formulas,
producer provenance, and fail-closed rules are canonical in
`docs/hpt2-measurement-matrix-v1.md`. The first implementation adds the S4
stopped/completion producers, nominal APPEND/READ S6 derivation, and executable
A-local gate. S5 and transition/reclaim telemetry remain open, so no target run
is authorized by this checkpoint.

Pi release `hpt2-contract-8094047`, exact image
`sha256:70ac8f82...b3dc`, passed `205/205` tests and is deployed healthy after
package verification, backup, and restore check. Its live audit records both
selected decisions but grants zero S4-S6 credit, reports the A-local gate false,
and keeps B disabled. See
`work/evidence/pi-hpt2-selected-contract-and-producer-deployment-20260805.md`.

Pi release `hpt2-runtime-9d7e0f0`, exact image
`sha256:24bb3439...69ee`, passed `210/210` tests and adds controller-sourced S5
and S6 transition/reclaim proof from the unchanged exact firmware map. Package,
backup/restore, storage, health, firewall, and residual-tool gates pass. No
target was accessed, so live counts remain unchanged and B remains disabled.
See
`work/evidence/pi-hpt2-unchanged-firmware-runtime-evidence-deployment-20260805.md`.

### 2026-08-05 fail-closed S4-S6 audit

Pi release `hpt2-matrix-audit-fda4dab`, exact image
`sha256:dcbd0416...38ed`, passed `198/198` tests and is deployed healthy. Its
live read-only audit confirms A's S0-S3 pass but grants zero S4-S6 credit and
keeps B disabled. It also reports that S4 AFTER the final 129600 checkpoint is
unreachable under profile v1 and that S6's both-variant requirement conflicts
with the A-complete-before-B rule. That finding is historical and is superseded
by the selected contract and deployed audit above. See
`work/evidence/pi-hpt2-s4-s6-fail-closed-matrix-audit-20260805.md`.

### 2026-08-05 Controller A S0-S3 strict matrix pass

The append-only ledger now contains 35 current adjudications and passes the
strict Controller A minimums at S0 `3/3`, S1 `12/10`, S2 `11/10`, and S3
`12/10`. The largest observation upper bound is `2089 ms`. There are zero
active runs and zero unresolved operations; default J-Link firewall isolation
is restored. S4-S6 remain zero because their distinct evidence paths are not
implemented, Controller B remains untouched, and production
`stop_deadline_ms` remains `null`. See
`work/evidence/controller-a-hpt2-s0-s3-observed-boundary-matrix-pass-20260805.md`.

### 2026-08-05 observed-case classifier correction

Pi commit `3fdd4c9` removes planned-label credit and derives S0-S3 solely from
the immutable pre-Stop and terminal counter boundaries. Append-only Evidence
`273`-`277` corrects five prior planned-S3 labels to three observed S1 and two
observed S2 contributions. Four post-deployment runs then added two S3, one S1,
and one S2 observations under the strict classifier. Current Controller A
totals are S0 `3/3`, S1 `4/10`, S2 `3/10`, and S3 `5/10`; S4-S6 remain zero
until their distinct evidence paths exist. Production `stop_deadline_ms`
remains `null`, and Controller B remains untouched. See
`work/evidence/controller-a-hpt2-observed-case-classifier-correction-20260805.md`.

### 2026-08-05 S0 matrix pass

Superseding campaign `7f13c433-e904-4320-a0d1-33d503057f69` binds Controller
A/F1-A1 to exact qualification bundle
`smi-00-05-00-52edddc39e30-054d5386ad9d-release`. Programming, independent
flash/CID verification, a zero-error full-address scrub, canonical HPT
initialization, and post-initialization CID capture passed before HPT2
admission.

Three planned-S0 runs then completed no-replay acknowledgement-gated
same-session Start/Stop sequences. Each measured a `0 ms` host-side gap,
provided two stable `STOPPED_CLEAN` observations with proof `0x1F`, and
finalized/adjudicated `CASE_PASS`. Controller A progress is now S0 `3/3` and
S3 `5/10`. Production `stop_deadline_ms` remains `null`, Controller B remains
untouched, and the default firewall/tool-container boundary is restored. See
`work/evidence/controller-a-hpt2-s0-matrix-pass-20260805.md`.

### 2026-08-05 live measurement checkpoint

Controller A/F1-A1 is initialized under the exact
`smi-00-05-00-b845d4b9bcfe-4f37e97877d8-release` bundle, and same-run CID
capture `12` preserves raw CID `05000C61736466672200001C8901A34F` with a
valid representative-sector read. Pi release
`hpt2-sequential-admission-686a61e` has now completed two one-shot Start/Stop
runs. Both reached stable `STOPPED_CLEAN` with proof `0x1F` and contribute S3;
the run planned for S0 stopped after substantial work and was correctly not
counted as S0. Controller A progress is S3 `2/10`, S0 `0/3`; B remains at
intake. The maximum current observation upper bound is `2051 ms`, but
production `stop_deadline_ms` remains `null`. See
`work/evidence/controller-a-hpt2-bounded-stop-measurement-checkpoint-20260805.md`.

The separate-process and fully optimized same-JLink-session paths are now both
exhausted. Even a measured `0 ms` host-side acknowledgement-to-Stop-write gap
ended at `3/3/3`, including the batched-Stop run; no new run contributes a
case. Firmware therefore adds exact qualification-only token `0x53304844` to
hold before first work without changing normal requests. The profile hash is
`a94bf5b4...d3ea`; Debug/Release builds and the `15/15` contract/model suite
pass. Candidate bundle `smi-00-05-00-52edddc39e30-054d5386ad9d-release` is
hash-verified and imported valid but unadmitted. Pi release
`hpt2-s0-hold-86ac4c2` is deployed at image `sha256:826b43fa...3030` after
`51/51` focused and `188/188` exact-environment tests plus backup/restore.
Controller A was not programmed. Counts remain S3 `2/10`, S0 `0/3`;
`stop_deadline_ms` remains `null`.

Operation `6279f027-759c-46be-b3ce-ad70766c5707` reconciled read-only to
`FULL_ADDRESS_SCRUB_PASS`, and post-result Evidence `28` / CID capture `6`
confirmed the complete unchanged `F1-A1` identity. The baseline no longer
blocks this checklist. The next transition is destructive initialization, but
the deployed appliance has no admitted initialization adapter or machine-intent
execution path and reports state-changing profiles disabled. See
`work/evidence/controller-a-baseline-scrub-readonly-reconciliation-20260805.md`.

Measure the exact fixed-mailbox firmware's worst observed bounded-stop behavior
on both controller variants, prove no-replay interrupted-session recovery, and
execute the representative regression needed to derive a reviewed positive
`stop_deadline_ms`. The Pi application is the only coordinator and system of
record.

The owner's 2026-08-02 direction to proceed authorizes this reviewed readiness
slice and later execution of these exact cases only after every case entry gate
below passes. It does not waive the profile's immutable short-lived
authorization, expendable-media, CID, safety, evidence, or role/endpoint gates.
It does not authorize T00 work, powered SD removal/insertion, arbitrary J-Link
commands, retries/replay, automatic reset/power recovery, or specimen-specific
firmware behavior.

The removed Controller A and still-installed Controller B SanDisk EDGE control
cards, CIDs `035344535330384780976F0084018559` and
`035344535330384780976F0085018507`, are non-expendable references and must not
be used for Start/Stop measurement. The Pi production database now contains
the two KEXIN samples and zero HPT2 operations. The preserved prior campaign
contains its historical `F1-A1` CID capture; corrected campaign
`d2263f26-6ac7-4a90-ad80-8875c0c24d2a` intentionally contains zero
operation-admitted CID captures pending post-program observation.

## Frozen implementation and coordinator identities

- Firmware bundle:
  `smi-00-05-00-868598ee08d9-404826a5be8e-release`.
- Firmware manifest/content address: `0fdff39a...9182761`.
- Candidate complete code flash: `2236f68b...8a166`.
- Firmware source: reviewed working-tree snapshot
  `868598ee08d91fcbe76f346fdf9c315d02ad27083e364d3b180d78e42469800f`
  over base commit `48181bd31c769addf9c1c825982e31d0b1ad62a0`.
- Profile: `HPT2_ENDURANCE_BASELINE_V1` version 1, SHA-256
  `945ebbc67c1673ecef3d8d185de415a4613bd6050d13e1b0f1d12d260e434e00`.
- Controller A: assembly `1751136`, variant `0`, probe `69664082`, protected
  port `19120`.
- Controller B: assembly `1751219`, variant `1`, probe `69660123`, protected
  port `19121`.
- Pi source/release: commit `32b636c048fdf680f9de49b4aa164f6dc59dd817`,
  release `readiness-gates-32b636c`, image
  `sha256:ffef68210a538d9868b0b1056124f14f6428b8b5ae92000b45dd36dfa27cdd4b`;
  retained rollback image
  `sha256:83bad7d83b9f25e0559386eb807832b60a8cbfeebdc2c644d07271fdc3c0249b`.
- Corrected campaign: `d2263f26-6ac7-4a90-ad80-8875c0c24d2a`, fixture-only
  `INTAKE`; preserved prior campaign `49024955...8434` is `BLOCKED`.
- Protected registry: both roles still bind the installed prior
  `5df475bd...176ce` firmware and remain `enabled_for_qualification=false`;
  rebinding and programming require explicit authorization.

Any changed firmware, profile, mapping, Pi source/image, controller identity,
or card CID invalidates the affected prepared operation and requires a new
reviewed instance. The deadline derived here applies only to this immutable ABI
and profile.

## Software and appliance entry gate

- [x] Firmware request, mailbox, acknowledgement, coherent status, duplicate
  rejection, stop boundary, terminal proof, and model/static/build gates pass.
- [x] Pi durable intent, exact serializer, fixed write allowlist, one-shot
  publish, post-write no-retry, transcript validation, and read-only
  reconciliation exist.
- [x] PostgreSQL-specific HPT2 preparation locks pass 33 focused and 129 full
  application tests; the complete SQLite suite also passes 129 tests.
- [x] Pi PR #30 is merged, exact release media is checksum-verified, backup
  restore passes, and the deployed appliance is healthy and fixture-only.
- [x] HPT2 command roles and endpoints remain empty; no adapter, observer, or
  programmer tool container remains.
- [x] Firewall permits only loopback access to J-Link ports by default; both
  J-Link services and the firewall unit are active.
- [x] Record a clean pre-run appliance status, queue state, evidence capacity,
  exact image identity, registry hash, rollback image, and release package.
  Evidence: `jong@srv-rpi00.local:~/dev/sd_qualification/work/evidence/kexin-f1-ab-pre-run-appliance-status-20260803.md`.

Any software, database, evidence-path, worker, clock, registry, J-Link,
firewall, or queue discrepancy stops before target access.

## Physical sample and safety entry gate

Complete all items independently for `F1-A1` and `F1-B1`:

- [x] Record vendor/listing/printed model, package/SKU/lot, receipt reference,
  both card-face and package photographs, custody, capacity, and physical label
  in `/sd-qualifier`.
- [x] Mark the exact card expendable and accept permanent loss of its contents.
- [x] Assign `F1-A1` to Controller A and `F1-B1` to Controller B; both must be
  a consistent initial retail family unless reviewer disposition says otherwise.
- [x] Create the immutable campaign evidence root and verify ignored raw-output
  storage capacity before any long run.
- [x] Record the owner's confirmation that Controllers A and B are isolated test
  controls with no production, heater, or load connection. This standing bench
  fact replaces repeated heat, alarm, and production-safety reviews for this campaign.
- [x] Command the applicable controller off through the qualified Pi power path
  and electronically confirm power-off before giving the operator the card-swap
  instruction. Never hot-remove or hot-insert SD media.
  - [x] Controller A coordinated-off operation
    `9ca65506-f4c9-4eb8-9e06-d6d61b0e23d6` succeeded; controller supply is off
    and J-Link `69664082` is absent.
  - [x] Controller B was powered off when `F1-B1` was installed; the card has
    not been removed or reinserted since.
- [x] After verified power-off, instruct the operator to replace only the named
  card and wait for the operator's completion confirmation before restoring power.
  - [x] Controller A: operator confirmed `F1-A1` installation before power was
    restored under coordinated-on operation
    `9bc8d582-63ee-4621-a0e3-2e6eb1971382`.
  - [x] Controller B: owner confirmed `F1-B1` was installed while power was off.
- [x] Boot and capture protocol/card status, CID-valid state,
  representative-sector-read state, decoded identity, and full raw 128-bit CID.
  - [x] Controller A / `F1-A1`: capture `05000C61736466672200001C8901A34F`
    registered in the Pi app; evidence manifest
    `jong@srv-rpi00.local:~/dev/sd_qualification/work/evidence/kexin-f1-a1-baseline-cid-20260803.md`.
  - [x] Controller B / `F1-B1`: boot witness `F54F10127F443248`, full CID
    `05000C61736466672200001C8201A379`; protocol, CID-valid, and representative
    sector-read gates passed.
- [x] Pass the authorized full-address baseline scrub with zero unreadable or
  retry-recovered sectors.
  - 2026-08-03: operation `e36882de-ebf5-4b35-93ef-698e352a553c` failed
    before geometry or any sector read (`state=3`, `hpt_status=3`,
    `identity_mismatch=1`, attempts/sectors `0`). Read-only reconciliation
    confirmed the stable failure and command `0`; no retry/replay occurred.
    Current firmware requires `RAW_HPT`, `HPT_READY`, and an open HPT store,
    which conflicts with this required pre-initialization gate. See
    `jong@srv-rpi00.local:~/dev/sd_qualification/work/evidence/kexin-f1-a1-full-address-scrub-baseline-failure-20260803.md`.
  - 2026-08-04: cadence-mitigated operation
    `3b04cc35-ce17-4201-88f9-7a885a9300ab` read all `15,728,640` sectors with
    zero failed/retry-recovered sectors, target state `PASSED`, unchanged CID,
    and controller run delta `1,348`. The Pi marked the operation failed solely
    because the event-driven HMI run delta was zero. The immutable result is
    preserved and the campaign is blocked as a method failure; a reviewed Pi
    policy correction and fresh operation authorization are required.
  - 2026-08-09: Controller B completed the authorized full-address scrub with
    unchanged CID and passed the Stage-6 readiness gate; see
    `work/evidence/watchdog-stage-6-controller-b-preflight-complete-20260809.md`.
- [x] Complete separately recorded HPT media-2.0 initialization and reopen proof;
  initialization is not hidden inside the endurance Start operation.
- [x] Recapture the full CID block after initialization and bind it to the exact
  campaign/run identity.
- [x] Verify three active lanes, no replacement request, no unresolved first
  failure, and unchanged controller/probe/firmware identities.

No Start intent may be prepared until every item above passes for that role.

## Execution order and operation discipline

Controller A remains the HPT lead. B may proceed independently only after the audit reports
`controller_a_local_gates_pass=true` and
`controller_b_execution_allowed=true`, and A's evidence contains no systemic
firmware, adapter, evidence, or safety failure. A-local S6 is provisional; final
S6 requires valid evidence from both variants. Each row below uses a new request
ID, run ID, command sequence, publication sequence, and short-lived
authorization.

For every Start or Stop:

- [ ] Prepare immutable intent in the authenticated Pi UI from server-owned
  bundle, registry, boot-witness, CID, and evidence values.
- [ ] Enable exactly one role and its protected endpoint only for the named
  one-shot operation; leave the other role absent.
- [ ] Publish exactly once through `hpt2-command-adapter`; never rerun a publish
  command after target access begins, regardless of exit status.
- [ ] Remove role/endpoint access immediately after the one-shot container exits.
- [ ] Reconcile with a distinct read-only invocation and retain two coherent,
  identical mailbox/acknowledgement/status passes.
- [ ] Hash and retain intent, mailbox bytes, J-Link transcript, reconciliation
  transcript, raw snapshots, decoded result, and append-only phase history.
- [ ] Confirm the CPU remains running and normal logging/control work keeps
  priority throughout.

## Bounded-stop measurement matrix

Current live audit has both controllers' base cases above their minima and both
ordinary S4 matrices running. Controller B is S0 `7/3`, S1 `11/10`, S2
`37/10`, and S3 `10/10`, all PASS. Historical A runs
`7991b71b...9234d5` and `259a9a0d...232e` remain immutable valid S3 evidence;
the newer accepted S0 runs contribute three additional S3 boundaries. The
historical first run's planned S0 classification was rejected rather than weakened;
the observability gap is tracked by
`work/tickets/ticket-hpt2-s0-observable-stop-trigger.md`.

For each controller, collect valid stops at every observable phase. A phase is
identified only from coherent firmware status; wall-clock timing alone may not
declare a phase.

| Case | Stop trigger | Minimum valid observations per controller | Required proof |
| --- | --- | ---: | --- |
| `S0` | Start acknowledged, before the first committed work unit when observable | 3 | no duplicate Start; Stop acknowledged once; zero or one completed work unit is explained |
| `S1` | append in progress: attempted exceeds committed | 10 | the in-progress append and same-unit read finish; no second work unit begins after Stop latch |
| `S2` | readback in progress: committed exceeds verified | 10 | same-sequence read finishes; no new append begins after Stop latch |
| `S3` | clean work-unit boundary: attempted equals committed equals verified | 10 | prompt `STOPPED_CLEAN` and full terminal proof |
| `S4` | exact counter region immediately before/at/after each progress checkpoint; final 129600 AFTER uses stable terminal COMPLETED | 3 per ordinary checkpoint region; 1 per 129600 region | checkpoint is observation-only; no hidden scan or media operation occurs; final completion is S4 evidence, not a bounded-stop or automatic profile PASS; new 129600 admission remains intentionally held pending exact-read scaling review |
| `S5` | normal production log queue contention | 10 | production logging retains priority; stop remains bounded without loss or queue drop |
| `S6` | slowest legal observed append/read, segment transition, or reclaim path | A-local provisional: at least 10 with path breadth; final: at least 10 total including both variants | terminal status captures `MaxAppendTicks`, `MaxReadTicks`, and the end-to-end maximum; transition/reclaim identity must be controller-sourced |

If the bounded internal retry path is not actually observed on both variants,
do not infer it from nominal samples. Keep the deadline unset and review a
separate deterministic diagnostic-fault measurement that preserves the same
production retry policy and uses only expendable media. No retry, delay, or
fault behavior may be added to production merely to make the measurement pass.

For each valid stop record:

- J-Link publication completion time;
- acknowledgement observation time;
- `STOPPED_CLEAN` observation time;
- firmware Start/End ticks, `MaxAppendTicks`, and `MaxReadTicks`;
- counts and last committed sequence before Stop, at acknowledgement, at
  terminal state, and in two later stable reads;
- stop request/acknowledgement sequence equality and terminal proof `0x1F`;
- lane masks, retirements, mismatch/loss/replacement fields, HPT/driver status,
  first failure, CID, boot witness, CPU state, and controller health.

## Deadline derivation and acceptance

`stop_deadline_ms` is not written until all required A/B observations and any
required retry-path measurement pass. Let `M` be the largest valid measured
wall time from completion of the one Stop publication to the first coherent
`STOPPED_CLEAN` snapshot, including Pi/J-Link observation overhead. The reviewed
candidate deadline is:

```text
ceil_to_100_ms(max(2 * M, M + 1000 ms))
```

This predeclared margin prevents selecting a value to fit a desired result.
Firmware ticks and the measured Pi wall time must be mutually consistent. Any
outlier is retained and investigated; it is never discarded merely to reduce
the deadline. The firmware owner must review the raw maximum, margin, timer
conversion (`100` ThreadX ticks/second), and evidence before the profile/bundle
receives a positive value.

Every valid case must satisfy:

- one Start and one Stop publication only; no replay or automatic resume;
- acknowledgement identity exactly matches command/request/run/boot identity;
- `STOPPED_CLEAN`, terminal reason none, terminal proof `0x1F`;
- no new profile work after the latched stop boundary and stable terminal reads;
- no first failure, loss, mismatch, new retirement, replacement request,
  unreadable/retry-recovered sector, reset, watchdog, or control deadline failure;
- complete immutable evidence with no missing or contradictory snapshot.

`STOPPED_CLEAN` proves the stop mechanism only and is not an endurance PASS.

## Interrupted-session recovery matrix

Use new operations and expendable media. Never intentionally disconnect a
session by killing an untracked process; use the reviewed harness case and
preserve its first result.

- [ ] Disconnect before probe identity/publication: no target write; operation
  remains safely unconsumed and is dispositioned without claiming a Start.
- [ ] Disconnect after publication but before acknowledgement: classify
  `INTERRUPTED_UNKNOWN`, run read-only reconciliation, and prove no replay.
- [ ] Disconnect after acknowledgement but before terminal observation:
  reconcile the existing run only; never send Start or Stop again.
- [ ] Restart the Pi application during an acknowledged active run: durable
  operation/phase state survives and permits read-only reconciliation only.
- [ ] Through the separately admitted G-PWR service on the isolated bench controller,
  interrupt the whole controller during one expendable-media active run;
  recapture boot identity and full CID, classify `INTERRUPTED_UNKNOWN`, and
  prove there is no automatic resume, format, repair, or command replay.
- [ ] Preserve any changed CID, unusable boot witness, missing run identity, or
  unprovable in-flight state as `BLOCKED`; do not normalize it into recovery.

## Representative regression after stop/recovery passes

- [ ] Repeat exact read-only firmware/mapping/CID/HPT identity on A and B.
- [ ] Prove normal logging, event bursts, chart reads, configuration saves,
  communications, alarms, and control monitoring remain functional.
- [ ] Reopen HPT, append and read one known record, rebuild the retained chart,
  and produce a complete customer export with zero loss/mismatch/retirement.
- [ ] Run the established representative standards-based USB Mass Storage
  publication matrix for the unchanged bundle. Do not add device rules, delays,
  retries, resets, VBUS cycling, or lifecycle steps.
- [ ] Keep T00 closed as unresolved no-action architecture evidence. This
  regression neither contacts T00 nor claims its missing-CSW cause resolved.
- [ ] Complete post-run CID-linked full-address scrub on each expendable sample.
- [ ] Power off before any sample removal/reinsertion and recapture CID after
  every relevant replacement or reboot.
- [ ] Review Controller A/B results together; a variant-specific or systemic
  failure blocks admission and later media samples.

## Stop conditions and cleanup

Stop the current case immediately and do not continue to the other controller
on any identity mismatch, unexpected power state or fixture connection,
evidence-path problem, missing
acknowledgement, deadline overrun, unexpected reset, communication loss after
target access, CID change, media/HPT error, new retirement, mismatch/loss,
replacement request, partial evidence, or unprovable command disposition.

On every exit:

- remove the temporary role/endpoint and bridge-specific firewall rule;
- confirm no one-shot adapter/observer/programmer container remains;
- retain only the default non-loopback J-Link-port drop;
- preserve the first failure and immutable evidence; never retry automatically;
- leave live admission and state-changing profile flags false until the entire
  matrix, deadline review, recovery evidence, and regression are approved;
- publish a small manifest rather than raw generated evidence into Git.

## Exit

This checklist passes only when both variants complete the required matrix, a
positive deadline and its margin are firmware-owner approved, interrupted-
session recovery and representative regressions pass, exact evidence is
reviewed, and the Pi remains independently runnable and fail-closed. Physical
media-family endurance remains a later exact campaign gate.
