# Ticket: Make the HPT2 S0 stop boundary observable

Status: complete
Type: ticket
Updated: 2026-08-05
Next Action: none; retain with the Controller A S0 matrix-pass evidence
Parent: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Problem

Controller A run `7991b71b-7540-46be-8510-85992b9234d5` was planned as S0,
but the one-shot adapter observed and published Stop only after `1335` work
units were verified. The clean result is valid S3 evidence, not S0 evidence.
Polling the ordinary status path is not fast enough to reliably capture the
pre-first-commit boundary.

The first automated attempt, run `7c7d9812-fbff-4cc0-9920-13e801cdee3a`,
proved that separate Start reconciliation and Stop publication processes are
also too slow: the coherent pre-Stop snapshot was RUNNING at
`2005/2004/2004`, and terminal state was clean at `2005/2005/2005`. This is an
S1-shaped boundary observation, not S0, and remains uncounted until a separate
append-only supplemental adjudication explicitly supports that contribution.

The attempt also exposed a read-only reconciliation race when status advanced
between full reads. Pi commit `40bbf2e13fa712598e430722695b5d3e569950ac`
now uses guard/body/guard snapshots and accepts coherent nondecreasing progress
without relaxing mailbox, acknowledgement, ABI, profile, boot, request, run,
or CID binding. Focused tests pass `45/45`; the exact-environment full suite
passes `177/177`; release `hpt2-reconcile-seqlock-40bbf2e` is deployed and
healthy. The S0 design must now persist both exact immutable intents before
target access and publish Start, capture its acknowledgement, and publish Stop
inside one J-Link session, with one publication per intent and no replay.

That same-session path is now fully implemented and proven, including PTY
transport, bounded acknowledgement polling, exact transcript parsing, and a
single batch of Stop writes. Runs `81330ab2-c87c-402c-9c86-3d2c7812d5f5`
and `fd530a42-9ea9-4aa6-baac-414c7f53cf8b` each persisted both intents before
target access, acknowledged Start, published Stop with a measured `0 ms`
host-side gap, and ended cleanly at `3/3/3`. Neither qualifies as S0. This
proves that no existing host/J-Link transition can reliably reach the
pre-first-work boundary.

The smallest qualification-only firmware observability change is now built
and packaged. Exact request token `0x53304844` uses the existing reserved word
to acknowledge Start and hold before work until the exact bound Stop. It adds
no delay, retry, replay, automatic release, ABI-size change, or normal-request
behavior. Firmware contract/model checks pass; managed Debug and Release
rebuilds pass. Pi commits `2434f87` and `86ac4c2` emit the token only for an
exact measurement-only S0 plan and only when the immutable firmware mapping
declares the capability. Focused tests pass `51/51`; the exact-environment
suite passes `188/188`.

Candidate bundle `smi-00-05-00-52edddc39e30-054d5386ad9d-release` is
hash-verified and imported valid but unadmitted. Pi release
`hpt2-s0-hold-86ac4c2`, image
`sha256:826b43fabb3b800eeca445de4d416d8d067ab7f9bdc6f1761f52e26f01d73030`,
is deployed healthy. Controller A remains on the prior exact bundle; no
programming or live S0 operation was performed.

## Result

Controller A was programmed with the exact qualification-only bundle, then
independently verified, full-address scrubbed, initialized, and recaptured with
the same CID. Three fresh planned-S0 runs each persisted one immutable Start
and Stop intent, published the pair in one acknowledgement-gated J-Link
session, measured a `0 ms` Start-acknowledgement-to-Stop-publication gap, and
ended with two stable `STOPPED_CLEAN` observations. All three finalized
`CASE_PASS`, were accepted as S0, had no replay, and retained production
`stop_deadline_ms=null`.

The three results contribute S0 `3/3` and also raise clean-boundary S3 progress
from `2/10` to `5/10`. Controller B was not accessed. Complete immutable
identities, run/evidence hashes, CID data, and cleanup proof are recorded in
`work/evidence/controller-a-hpt2-s0-matrix-pass-20260805.md`.

## Acceptance criteria

- [x] Identify an existing coherent request, acknowledgement, or firmware
  status transition that distinguishes Start acceptance from first commit.
- [x] If no existing transition is sufficient, propose the smallest
  standards-neutral diagnostic/qualification-only observability change; do
  not add specimen-specific timing or alter the normal production lifecycle.
- [x] Preserve unique immutable Start and Stop intents, one-shot publication,
  exact identity binding, and no-replay behavior.
- [x] Prove in fixture/model tests that the trigger cannot count a run as S0
  when more than one work unit completes.
- [x] Deploy the separate-process sequencer and reconciliation correction only
  after focused and full coordinator regression, database
  backup/restore, exact image verification, and protected-role cleanup pass.
- [x] Collect three valid Controller A S0 observations with zero or one
  completed work unit explained by coherent pre-write and terminal evidence.

## Boundary

This ticket does not authorize a firmware deadline, retries, delays, physical
card changes, powered SD removal, Controller B execution, or replay of either
completed Start/Stop operation.
