# Controller A HPT2 S6 runtime matrix pass — 2026-08-05

Status: pass; Controller A provisional S6 minimum is 10/10 with full required path coverage
Type: evidence
Updated: 2026-08-05
Next Action: implement and qualify Controller A S4 checkpoint-region evidence; keep Controller B disabled until every A-local gate passes
Campaign Reason: Historical record from campaign 009-complete-clean-contract-bound-a-b-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md
Canonical Truth: docs/hpt2-measurement-matrix-v1.md

## Result

Campaign `7f13c433-e904-4320-a0d1-33d503057f69` now contains ten valid,
separately admitted Controller A S6 extended adjudications. Coverage is three
APPEND, five READ, and two SEGMENT_TRANSITION observations. Every row has clean
terminal state `STOPPED_CLEAN`, reason `0`, terminal proof `0x1F`, immutable
baseline/terminal runtime evidence, and exactly one acknowledged Start and Stop
without replay. Observation upper bounds span `2024` to `2089 ms`.

The transition rows use exact controller path telemetry. Evidence `927` proves
transition sequence `36829` from synchronized append-only interval captures;
Evidence `961` proves sequence `37852` over the complete run. Each has one
observed transition and a conservative profile-owned lower bound of one after
accounting for production-log appends. Unstable seqlock attempts and
mid-append lane imbalance created no runtime evidence. Run
`ade086be-9668-4746-9648-bb657a30e58b` was preserved as a clean completed run
but correctly received no S6 extended credit because one concurrent production
append could account for its only observed transition.

## Exact deployed qualifier

- Pi source: `4ad60e4675af4bf8b819d26c1a2bbc1f4130318f`.
- Release: `hpt2-s6-boundary-4ad60e4`.
- Image: `sha256:5e9e6b0aee26e2f451c2820c7a2c55c1ffff094f3a95c13ca9b4b0ba4ccd8ecf`.
- Release manifest SHA-256: `6875bb00554b0fcbc565ab8eb1f718d15a8c8e09254e3f599f6dccea92ca8c30`.
- Exact-image test result: `217/217` passed.
- Predeployment backup: `/backups/sd-qualifier-20260806T000332Z.dump`, restore check passed.
- Firmware bundle: `smi-00-05-00-52edddc39e30-054d5386ad9d-release`.
- Bundle map SHA-256: `ca774f3fd897487ab41161b161bdecd83fffc3146db9347074f815e1620b0dc4`.

Packaging, migration, storage preflight, service health, exact image/source
identity, firewall, and residual-tool cleanup all passed. The production
firmware image was unchanged by this qualifier work.

## Compact immutable manifest

| Run | Extended evidence | SHA-256 | Path | Append/read ticks | Upper bound |
| --- | ---: | --- | --- | --- | ---: |
| `ea59cc4e-4f13-4c4c-a887-32f7cc8e3ac1` | 927 | `d9659071d3f4aa7a05ac1d2898dd9188dee6f19329ef6653bb03e55462686bd1` | SEGMENT_TRANSITION (`36829`) | 23 / 28 | 2056 ms |
| `c31afd7f-0322-49f9-9095-72cfc575ee67` | 944 | `32c9d5b768ca3e4e5827bdaff5f5ac65df4e899f6ee62eba298e893324d77f3b` | READ | 7 / 8 | 2089 ms |
| `4e6da43d-653a-4169-90e9-edf2482cee5d` | 961 | `08f0bcb82e77f7708fec87e0b179375d33a758a79b669001ef6cfee2a7362fec` | SEGMENT_TRANSITION (`37852`) | 9 / 8 | 2047 ms |
| `2ab27e7a-a474-4608-9bd3-94ddd0b05143` | 978 | `83363b0b03a3c6b94e0b3034eb02a6edf0763377e5b52abee0d4059881e3c435` | READ | 6 / 8 | 2034 ms |
| `abee4833-be30-4863-b3ac-9c990baf277a` | 995 | `63d8f9969c854127c5ea207860e809c060ab85cab45b810dc9daf3ce189ae636` | APPEND | 11 / 8 | 2024 ms |
| `86f689a7-e016-42b6-8433-7e8b918858ae` | 1012 | `250acc513ab43d0700b7f891818fe9aa883c315e797b9f9ec58f2fb308bee5d5` | READ | 6 / 8 | 2041 ms |
| `20f3c890-725b-4c41-84f7-bce31fe08d24` | 1029 | `a275c965e55033d0ae53a12ebfa498a12a477e6f3a3d63a107e9dcd4a47406e0` | READ | 6 / 8 | 2059 ms |
| `ecdb8e26-cd0b-4f82-a7f1-f97188f6c900` | 1062 | `be2574eca00bdaef57a6e61046491f4b9b2ee7cc28845107b56f75c7539497a0` | APPEND | 9 / 8 | 2033 ms |
| `a9cc8d41-d457-4430-a6eb-83e9750a46c2` | 1079 | `5c1d92d36bfb4cc2ca356829cf8988178ba4fe13ea387c4c55e3b530e8d5bc3e` | READ | 6 / 8 | 2054 ms |
| `db8c951a-437a-4ad3-b047-fa07ecfde647` | 1096 | `387bac86150371c2dee7554f32303317a6858f68b970df163387f891a80e8cfa` | APPEND | 28 / 21 | 2060 ms |

## SD identity

The run baseline and every stable terminal capture bind the same Controller A
sample F1-A1, CID, and boot-session witness. No card removal, insertion,
replacement, reboot, or powered media manipulation occurred during this
collection.

- Protocol/card status: `DETECTION_READY; RAW_HPT; DRIVER_OK`.
- CID-valid status: true.
- Representative-sector-read status: true.
- Manufacturer: unknown CID manufacturer, retail brand KEXIN; MID `0x05`.
- OEM/application ID: `0x000C`.
- Product name: `asdfg`.
- Product revision: `2.2`.
- Serial number: `7305` (`0x00001C89`).
- Manufacturing date: 2026-03.
- Complete raw 128-bit CID: `05000C61736466672200001C8901A34F`.
- Boot-session witness: `DEE10A12EC443248`.

## Live audit and remaining gates

The final live audit reports 60 base rows and 20 extended rows with no invalid
extended evidence. Controller A is S0 `3/3`, S1 `20/10`, S2 `27/10`, S3
`13/10`, S5 `10/10`, and provisional S6 `10/10`. S4 remains zero across all
15 target/region cells, so the Controller A-local gate remains false,
Controller B execution remains disabled, the final cross-variant S6 result is
still false, the complete matrix remains incomplete, and
`stop_deadline_ms` remains `null`.

Postflight found zero active runs and retained the default non-loopback firewall
drop on ports `19120` and `19121`. Controller B was not accessed.
