# SD qualifier terminal-supervisor and campaign-handoff deployment — 2026-08-11

Status: verified; false terminal supervisor block removed and inactive-run guidance corrected
Type: evidence
Updated: 2026-08-12
Next Action: review the latest Aug. 12 A/B `BOUNDED_STOP_PASS_CASE_TRIGGER_NOT_MET` handoff and select the next separately admitted matrix cases; no further controller command is authorized by this evidence
Campaign Reason: Historical record from campaign 014-complete-standalone-sd-qualifier-acceptance; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Outcome

The completed Controller A S1 run was valid, not an active-run failure. Its
durable run state was `COMPLETED`; the controller was `STOPPED` with terminal
proof; Stop was observed; evidence was finalized; command outcomes were known;
and the transient runner had exited `inactive/dead/success`. The persistent
read-only observer had continued polling that collected transient service and
the watchdog incorrectly projected `ORCHESTRATOR_SERVICE_DIVERGENCE`.

Source commit `3f1042fca1f7530ae0ef4e11f889c32e53234b4d` now accepts an
inactive runner only for that complete clean-terminal tuple. Open runs, failed
services, missing terminal proof, identity changes, controller/lane failures,
and unknown command outcomes remain fail-closed. Completed terminal snapshots
are no longer invalidated by progress or hard-review leases intended for active
work.

The browser verification then found a separate projection error: both cards
said automated work was running although no current run was open. Source commit
`55ed6927861046e2f15286a0da9aa9b7200dc145` distinguishes an incomplete
automated traveler row from an active run and presents an `OPERATOR REVIEW` /
`CAMPAIGN HANDOFF` when the next exact case must be reviewed and admitted.

## Release and validation

- Observer/web release: `qualification-handoff-guidance-55ed692`, ARM64 image
  `sha256:5cbd0a98e4793984bca9b7ebb4e7c31c23fdb58a387a93fd1135c955830690b6`,
  labeled with exact source commit
  `55ed6927861046e2f15286a0da9aa9b7200dc145`.
- Focused watchdog tests: `37/37`; focused handoff-view tests: `2/2`.
- Exact final-image qualifier suite: `343/343`; Django system check clean.
- The observer-only override changes only `controller-observer`; the admitted
  controller deployment-manifest SHA remains
  `f8bda89343c41fe846ec36f805a0ecd6d0203af000cdda261bf0fe79e9ce8936`.
- Live supervisor state recovered to `HEALTHY` / `QUALIFICATION_SUPERVISOR_HEALTHY`.
  Events `320` and `321` closed the earlier interventions and recorded recovery.
- Authenticated Playwright found no supervisor alert. F1-A1 remains
  `IN PROGRESS` with steps 1/2/3/5/6 PASS, step 4 RUNNING, and steps 7/8 NOT
  RUN. F1-B1 remains `IN PROGRESS` with steps 1/2/3/6 PASS, step 4 RUNNING,
  and steps 5/7/8 NOT RUN.
- F1-A1 now requests review of `CASE_PASS`; F1-B1 requests review of
  `BOUNDED_STOP_PASS_CASE_TRIGGER_NOT_MET`. Neither page claims a runner is
  active.
- Health returned `status=ok`, `required_now_ready=true`, and database,
  storage, clock, and workers true. Live admission and state-changing profiles
  remain disabled.
- Command worker `0d1a7d42b323`, notification worker `e9422966382e`, and
  qualification watchdog `9c8d7c43aaa1` retained identity.

No migration, firmware build, controller command, media operation, runner
start, physical card handling, or disposition was performed.

## Authorized A/B matrix continuation

The operator separately authorized one next S1 case per controller. Controller
A ran first as service
`sdq-controller-a-authorized-s1-480s-20260811.service`, run
`ce65a6ef-f399-4770-88fd-8400cab50364`, with a 480,000 ms phase offset. Three
healthy A proving snapshots spanning 75 seconds opened Controller B preflight
under policy `controller-b-parallel-entry-2026-08-09`. Controller B then ran as
service `sdq-controller-b-authorized-s1-180s-20260811.service`, run
`bc022abf-1797-4fc8-a1f9-f65f829f0453`, with a 180,000 ms phase offset.

Both services exited `inactive/dead/success`. Each run is `COMPLETED`; each
Start and Stop operation is `ACKNOWLEDGED`; both CIDs remained exact; and the
default J-Link-port drop was the only remaining firewall rule. No transient
adapter, observer, programmer, scrub, or initialization container remained.

- Controller A bounded stop passed in 2,038 ms upper-bound observation time.
  The planned S1 trigger was not met, but the immutable adjudication credits an
  observed S2 boundary. Result SHA-256:
  `a680012f2503188b2aa90c5db6ea4cd9f82efa487539a5584816f8d5c7cebc18`;
  adjudication SHA-256:
  `47384b2be68227c001d9e784d31b668509b6be1d9704fa9a87b121f2dcc64246`.
- Controller B bounded stop passed in 2,113 ms upper-bound observation time.
  The planned S1 trigger was not met and no matrix case was credited. Result
  SHA-256:
  `71640a85601593069eb8eae97091b5ec7d67e454deb8a128657752ca62ce9004`;
  adjudication SHA-256:
  `4e2f92321b2060c7a0429dae0fdb3837998ea2649a8448269911186896e45dbe`.

The post-run audit remains `matrix_pass=false`. Current base counts are A:
S0 `0/3`, S1 `5/10`, S2 `2/10`, S3 `4/10`; B: S0 `0/3`, S1 `0/10`, S2
`0/10`, S3 `4/10`. S5 and controller-local S6 remain `0/10` on both roles,
and the documented S5/S6 evidence-producer gaps remain open.

The read-only A and B observers were restored against release
`qualification-handoff-guidance-55ed692`; both current supervisor states are
`HEALTHY` / `QUALIFICATION_SUPERVISOR_HEALTHY`, and the web container is
healthy. The deployed protected views return HTTP 200 and show both cards
`IN PROGRESS`, current 5:30 p.m. evidence, and an `OPERATOR REVIEW` handoff.
F1-A1 shows the new S1 run as uncredited but credited to S2; F1-B1 shows the
new S1 run as uncredited with no matrix credit. The page's `15 completed` (A)
and `7 completed` (B) values count completed run attempts, not completed matrix
requirements; the matrix audit above remains the qualification authority.

The Playwright browser session had no SD Qualifier authentication and verified
only the live login page. Protected-view verification used the deployed
Django views with `jon` inside a rollback-only transaction; no session or
database mutation persisted.

## Second authorized A/B matrix continuation — 2026-08-12

The operator authorized one additional separately admitted S1 case per
controller. Controller A ran first as service
`sdq-controller-a-authorized-s1-600s-20260812.service`, run
`8a3d7147-18fa-4582-89bc-2ad19be3fa37`, with a 600,000 ms phase offset. Three
healthy A proving snapshots spanning 75 seconds opened Controller B preflight.
Controller B then ran as service
`sdq-controller-b-authorized-s1-240s-20260812.service`, run
`a3f1e474-ca17-4b4d-a861-c1db0a88b078`, with a 240,000 ms phase offset.

Both transient services exited `inactive/dead/success`; both runs are
`COMPLETED`; and all four Start/Stop operations are `ACKNOWLEDGED`. The B Start
and Stop publications each briefly required read-only reconciliation; neither
command was replayed. Exact campaign, bundle, role, sample, and full CID gates
passed for both admissions.

- Controller A bounded stop passed in 2,063 ms upper-bound observation time.
  The planned S1 trigger was not met, but the immutable adjudication credits an
  observed S3 boundary. Result SHA-256:
  `f23b9878bb962262a1ebf49c119abd0034c634bb9cab402e2ee6ce80fad89c7f`;
  adjudication SHA-256:
  `8148f73a11a3c8b59648e745db9b497bf8930d866233b52c50f41fe8f7b4245d`.
- Controller B bounded stop passed in 2,108 ms upper-bound observation time.
  The planned S1 trigger was not met and no matrix case was credited. Result
  SHA-256:
  `011069ec84ef53ce618cd605abe603bc825b176526ee58a2a6e00a2e977cd474`;
  adjudication SHA-256:
  `8d066dd4318f54f9f319bb1147567c061e01a8d31281ef81583824177fc1df27`.

The post-run audit remains `matrix_pass=false`. Current base counts are A:
S0 `0/3`, S1 `5/10`, S2 `2/10`, S3 `5/10`; B: S0 `0/3`, S1 `0/10`, S2
`0/10`, S3 `4/10`. S5 and controller-local S6 remain `0/10` on both roles,
and the S5/S6 evidence-producer gaps remain open. There are no open runs or
unsettled current-campaign operations. Only the default non-loopback J-Link
port drop remains, with no transient target tool container.

Both read-only observers were restored against release
`qualification-handoff-guidance-55ed692`; both supervisor states are
`HEALTHY` / `QUALIFICATION_SUPERVISOR_HEALTHY`, and the deployed web container
is healthy. The protected dashboard and card views return HTTP 200 and show
both cards `IN PROGRESS`, the current 4:38 a.m. evidence, and `OPERATOR REVIEW`
handoffs. F1-A1 shows the new S1 attempt as uncredited but credited to S3;
F1-B1 shows it as uncredited with no matrix credit.

The traveler now reports `16 completed` for A and `8 completed` for B; those
are completed run attempts, not completed matrix requirements. A residual UI
ambiguity remains: despite zero open runs and the correct operator-review
handoff, step 4 still displays the generic badges `AUTOMATED RUNNING` because
the matrix row uses `RUNNING` for an incomplete current qualification section.
The badge does not describe an active runner, but its wording can imply one and
should be corrected in a separately authorized web change.

Playwright again verified the production login surface but had no authenticated
SD Qualifier session. Protected-view verification used the deployed Django
views with `jon` inside a rollback-only transaction; no session or database
mutation persisted.

## Idle badge correction and third authorized A/B continuation — 2026-08-12

Source commit `84bf5d9974db5e77512bc2977294640fc1fde973` preserves the
durable matrix workflow state as `RUNNING` but adds a separate presentation
value. An incomplete automated row with no open run now renders `AWAITING
ADMISSION`; a genuinely open run still renders `RUNNING`. Focused active/idle
tests pass `2/2`, and the exact commit-labeled ARM64 image passes the complete
`343/343` suite with writable isolated test evidence under `/tmp`.

Release `qualification-awaiting-admission-84bf5d9`, image
`sha256:fa8838dce713bb55efd91119fee6aa527677e46fd01d8e2cfb63c71078d62cd8`,
is deployed to web and the read-only observer. The first recreate command was
rejected because it omitted the supervisor env file that supplies production
bind paths; the old web container remained healthy. Repeating with the complete
env stack and the web override last replaced it successfully. No migration or
database mutation was involved. The command, notification, and watchdog worker
container identities and start times remained unchanged.

Protected production views verified both display branches: with zero open
runs, both cards showed `AWAITING ADMISSION`, `OPERATOR REVIEW`, and no
`AUTOMATED RUNNING`; while Controller A was active, F1-A1 showed `AUTOMATED
RUNNING` and the active-run guidance. Playwright verified the live production
login surface but had no authenticated session; protected verification used a
rollback-only Django transaction.

The operator also authorized one more separately admitted pair. Based on the
observed boundary history, both were planned as S3 rather than extending the
unproductive B/S1 sequence:

- Controller A service
  `sdq-controller-a-authorized-s3-900s-20260812.service`, run
  `00945a2b-7067-48ec-ae63-ece25127d93c`, used a 900,000 ms phase offset.
  The bounded stop passed in 2,040 ms upper-bound observation time. Planned S3
  was not accepted, but immutable adjudication credits S2. Result SHA-256:
  `45c17d6bc8e252f2235a18d9bae7568f6268fd91ff1540f26ce7c07f3f1f3caa`;
  adjudication SHA-256:
  `eef893f2db9235c2515e3910890b103ddc3eac737191cce05232474321ab913c`.
- Three healthy A proving hashes opened B preflight. Controller B service
  `sdq-controller-b-authorized-s3-600s-20260812.service`, run
  `46f79272-6706-4b07-961c-f0de1a7c27fb`, used a 600,000 ms phase offset.
  The bounded stop passed in 2,389 ms upper-bound observation time. Planned S3
  was not accepted and no matrix case was credited. Result SHA-256:
  `39f38c6c7e80d8cba4eb0d7e56972beccc043de6abd97abd9aa970761d8d3f88`;
  adjudication SHA-256:
  `2bac7d87d991a3d06ce7988d3d0c97198b3341021a3d1b7b4876774dc3a82424`.

Both services exited `inactive/dead/success`; both runs are `COMPLETED`; all
four Start/Stop operations are `ACKNOWLEDGED`; and no open run or unsettled
current operation remains. Only the default non-loopback J-Link-port drop
remains, with no transient target tool container. The persistent A/B observers
were restored on the new observer image, both supervisor states are `HEALTHY`,
and web health is OK.

The audit remains `matrix_pass=false`. Current base counts are A: S0 `0/3`,
S1 `5/10`, S2 `3/10`, S3 `5/10`; B: S0 `0/3`, S1 `0/10`, S2 `0/10`, S3
`4/10`. S5 and controller-local S6 remain `0/10` on both roles, with their
evidence-producer gaps still open. The idle protected pages now show both new
run IDs and their exact credited/no-credit descriptions while correctly
returning to `AWAITING ADMISSION`.

## Recovery

## Fourth authorized A/B continuation — deterministic S4 boundaries — 2026-08-12

The operator authorized exactly one additional separately admitted A/B pair.
Review of the previous Controller B result showed why another long fixed delay
was inappropriate: its Stop pre-write snapshot was S1-shaped at
`19459/19458/19458`, but the terminal snapshot advanced by two records to
`19461/19461/19461`. The immutable classifier permits at most one catch-up
record, so the no-credit result was correct.

The continuation therefore used the existing exact-boundary S4 runner rather
than another timing guess. Its firmware-held checkpoints require exact
attempted/committed/verified counters before Stop:

- Controller A service
  `sdq-controller-a-authorized-s4-10080-before-20260812.service`, run
  `9eb4f195-81b1-4a78-912f-ae576830ea99`, stopped at the exact
  `10080/BEFORE` boundary with `10079/10079/10079`. The bounded stop passed in
  2,036 ms upper-bound observation time. Extended S4 evidence SHA-256:
  `34c3353da674247c944ef8e8e30ad0b6711fe05d8bae0fbe1622cec0a7771bd3`;
  result SHA-256:
  `fd5613712f9b3081718e94a789e70abe886f9bf195b7cdc1628644ebef6195c1`.
- Three healthy A proving snapshots spanning the required policy window opened
  B preflight. Controller B service
  `sdq-controller-b-authorized-s4-1440-before-20260812.service`, run
  `0cfda2bf-67a7-415e-86db-7ed5539d6d7a`, then stopped at the exact
  `1440/BEFORE` boundary with `1439/1439/1439` while A remained active. The
  bounded stop passed in 2,135 ms upper-bound observation time. Extended S4
  evidence SHA-256:
  `b10503c4d625d95b3725f26c4e7dcc6bc956fdbce229870a7287c406b2bf5989`;
  result SHA-256:
  `bb888bc31703900553788d1b1055ba2a0bd49c289020f264402b0a1dae8d40e2`.

Both extended S4 observations are credited. Each same-run terminal state also
legitimately contributes one S3 base observation, advancing A S3 from `5/10`
to `6/10` and B S3 from `4/10` to `5/10`. The audit now contains 23 base and
12 extended adjudication rows. The exact new S4 counts are A
`10080/BEFORE 1/3` and B `1440/BEFORE 1/3`; the matrix remains false and both
cards remain `IN PROGRESS`.

Both transient services exited `inactive/dead/success`; both runs are
`COMPLETED`; all Start/Stop operations are `ACKNOWLEDGED`; and no open run or
unsettled operation remains. The persistent A/B read-only observers were
restored and both supervisor states are `HEALTHY`. Temporary command-adapter
containers and firewall allowances are absent. Internal health returns HTTP
200 with database, storage, clock, and workers ready.

Protected rollback-only view checks show both cards at `AWAITING ADMISSION`,
not `AUTOMATED RUNNING`, and show the new exact S4 targets. Playwright verified
the live production login page with no console errors; no authenticated
browser session was available. This result authorizes no additional
controller case. Review these two exact extended adjudications before choosing
the next separately admitted pair.

The pre-correction supervisor environment is backed up at
`/home/jong/.config/sd-qualifier/qualification-supervisor.env.pre-3f1042f-20260811T2230Z`.
The prior web image
`srv-rpi00-sd-qualifier:qualification-regression-reconcile-pgfix-3bb6703` and
observer image `srv-rpi00-sd-qualifier:qualification-power-session-9df09da`
remain available.
