# SD qualifier web campaign coordinator deployment — 2026-08-12

Status: complete
Result: verified; fixture execution reaches the reviewer gate and survives restart without replay
Type: evidence
Updated: 2026-08-12
Next Action: review and publish the protected marker for restore-verified backup 20260812T163441Z, renew the current live campaign's exact A/B authorization for the full bounded matrix, then have a normal production operator start it from the website; Controller B coordinated-cycle capability and reviewed post-campaign scrub authority remain later genuine gates
Campaign: 006-start-clean-contract-bound-sd-qualification-campaign
Parent: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Outcome

Release `campaign-coordinator-0490369`, source
`04903698c1548cb843740dd8e1bed428c0be3dd4`, and ARM64 image
`sha256:db0355a6ddef28672977a138085f9fe994400effbb9fe09e830331173e65b2a8`
are deployed on `srv-rpi00`. The application owns a durable exact-plan
coordinator, a persistent leased host task runner, bounded allowlisted HPT2,
recovery, regression, scrub, observation, and final-review actions, and web
Start/Pause/Resume controls. Final disposition remains a reviewer action.

No physical SD card was removed, inserted, replaced, or otherwise disturbed.
No live controller or media action was admitted during deployment or fixture
acceptance.

## Validation

- Exact ARM64 Django suite: `348/348` passed.
- Standalone contract/runtime/packaging suite: `49/49` passed.
- Coordinator suite against PostgreSQL 17: `5/5` passed.
- Migration drift check reported no changes; migration `0022` applied.
- Release package SHA-256 verification passed; final manifest SHA-256 is
  `b154bcbd75274f3cb6a89ee8f6b75b2b9ef9dfd914aeb6311a7fcbbcba93cb2d`.
- Backup `sd-qualifier-20260812T163441Z.dump` passed disposable restore.
- Web, command worker, campaign coordinator, notification worker, watchdog,
  and host task runner are healthy on the exact release. No transient
  observer, programmer, scrub, HPT2 command, or initialization adapter remains.

Authenticated Playwright created fixture campaign
`807a7038-1726-4fd7-a172-ade4b3f0b2ef`, assigned synthetic A/B fixture
specimens, advanced the ordinary web gates, and selected `Run full
qualification`. Five fixture actions completed: matrix continuation,
controlled recovery, representative regression, closeout scrub, and final CID
observation. The coordinator then stopped at `disposition.a` with
`FINAL_DISPOSITION_REQUIRES_REVIEW`; neither card was auto-dispositioned.

The first deployed attempt exposed a PostgreSQL-only lock error: `FOR UPDATE`
was propagated to nullable outer joins. Source `0490369...` restricts the lock
to the coordinator row. The failure was reproduced, corrected, tested against
PostgreSQL, and redeployed. After restarting web, the coordinator worker, and
the host task runner, the same five durable task IDs remained `COMPLETED` with
attempt `0`; no task or controller action was replayed. Playwright reconfirmed
the reviewer gate after restart with zero console errors. The temporary
verification operator was signed out, disabled, and given an unusable
password.

## Remaining live gates

The dashboard still projects `DATABASE_BACKUP_STALE` because the protected
current-backup marker has not been reviewed and published for the new
restore-verified dump. The dump itself passed restore; this evidence does not
authorize mutation of that external controlled marker.

The current live Aug. 10 campaign has active HPT2 envelopes, but their A/B
lifetimes end at `2026-08-12T18:43:10Z` and `2026-08-12T18:59:17Z`; they do
not cover the full bounded matrix and later recovery duration. A normal
production operator must use reviewed replacement authority before selecting
Run in the website. The appliance also proves that Controller B status exists
but a protected Controller B coordinated whole-controller cycle action does
not, and there is no reviewed post-campaign scrub envelope. Those are explicit
durable stops, not reasons to bypass the web coordinator or select cases over
SSH.
