# Ticket: Clamp export start to retained data



Status: complete; A/B retained-start UX and real adjusted-range publication passed
Type: ticket
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Parent: work/wp/completed/wp-optimize-hpt-triple-mirror-read-performance.md
Canonical Truth: docs/sd-card-operation-and-recovery.md

## Problem

The start-date picker rejects a date older than 90 days, and the raw-HPT export
does not discover that a requested start predates retained customer records
until the SD traversal is already running. The operator must guess a usable
date, and the resulting filename cannot reliably represent an automatically
usable range.

## Expected Behavior

When the operator submits Start Date from either Graph or Settings, firmware
computes:

`effective start = max(entered start, oldest recoverable customer record, now - 90 days)`

If the entered start is earlier than the effective boundary, firmware replaces
the selection with that boundary and displays a reason-specific notification.
The notification's forward action opens the normal End Date picker. All
existing end-date checks run against the adjusted start. The default and final
USB filename use the adjusted start. CSV metadata retains the operator-entered
start and the effective exported range.

If no recoverable customer record exists, firmware reports that no logged data
is available and returns to Start Date rather than opening End Date.

## Acceptance Criteria

- [x] The SD owner publishes the oldest currently recoverable `STRT` or `EVNT`
  timestamp and sequence after validating the same envelope and mirror result
  used by export.
- [x] A submitted start at or after the effective boundary is unchanged and
  opens End Date without an adjustment notice.
- [x] A submitted start before retained data is changed to the oldest
  recoverable customer record and the notification explains that earlier data
  is unavailable.
- [x] A submitted start before the 90-day boundary is changed to the
  minute-safe 90-day boundary when retained data extends farther back, and the
  notification explains the 90-day limit.
- [x] A notification forward action opens the normal End Date screen; Back
  returns to Start Date.
- [x] Future/equal-now starts remain invalid. Normal end-after-start,
  five-minute minimum, and no-future-end checks use the adjusted start.
- [x] No retained customer data produces a no-data notice and does not proceed
  to End Date, filename entry, SD traversal, or USB publication.
- [x] Graph and Settings use one adjustment implementation and equivalent
  navigation.
- [x] The generated filename contains the adjusted start. CSV metadata records
  both entered and effective start timestamps.
- [x] Existing fail-closed gap, ambiguity, snapshot, capacity, SD I/O, and USB
  publication behavior remains unchanged.
- [x] Focused models/static checks, every repository `check-*.ps1`, clean
  managed Debug rebuild, and packaging pass.
- [x] The exact candidate is programmed on B without format/reinitialization
  and then A; both preserve CID and graph readiness.

## Verification

- Boundary model covers unchanged, retained-clamp, 90-day-clamp, equal
  boundaries, future start, no data, and post-adjustment end checks.
- Static checks prove both UI entry paths, reason messages, next-screen
  callbacks, adjusted filename source, SD-published retained bound, and CSV
  entered/effective metadata.
- Target captures prove current retained bounds, CID, graph cache, errors,
  drops, and candidate hash on B then A.
- Operator confirms the two notification reasons, End Date transition,
  filename, and bounded export in the final review.
- Electronic evidence:
  `work/evidence/hpt-export-start-adjustment-20260726.md`.
- B bounded export: PASS; 1,024 records, adjusted filename/start metadata,
  zero gaps, COMPLETE publication, and `2.84 s` HPT staging.

## Operator Acceptance

On 2026-07-26 the owner reported `PASS` on both A and B using cumulative
candidate `D3D36155...A1EAF`, including the retained-data adjustment notice,
End Date transition and normal validation, and adjusted filename. Fresh real
exports also passed:

- A: 1,735 records, zero controller-reported snapshot/range gaps, COMPLETE
  publication, matching adjusted range, and `2.18 s` HPT staging.
- B: 1,684 records, zero controller-reported snapshot/range gaps, COMPLETE
  publication, matching adjusted range, and `2.08 s` HPT staging.

The exact CSV hashes and read-only host review are recorded in
`work/evidence/candidate-identity-and-operator-graph-export-review-20260726.md`.
End-to-end USB-publication timing remains performance instrumentation work and
does not reopen this behavior ticket.

## Owner-directed reconciliation — 2026-09-23

Reconcile stale active lifecycle to the previously documented completed disposition; no new test or broader acceptance claim.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: complete; A/B retained-start UX and real adjusted-range publication passed
> Next Action: none

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
