# HPT export retained-start adjustment evidence

Status: complete; implementation, A/B operator review, and real USB publication passed
Type: evidence
Updated: 2026-07-26
Next Action: none

Parent: work/tickets/ticket-clamp-export-start-to-retained-data.md
Canonical Truth: docs/sd-card-operation-and-recovery.md

## Candidate

- Debug S-record SHA-256:
  `91D05B3593D58DD525FFA2EDA74E165D25967652EBE3D0B885CC8368F180CCB5`
- Debug ELF SHA-256:
  `FD76AF644A92AEF4827975118A2D9101736C76591EA41BA9D7901B315CBE8C05`
- Debug map SHA-256:
  `5B48528FD86BFEC41756758406F12E5244CECE870DF8D2DC7220D63749CC703F`
- Production-name package: `7520553_SMI_FW_00_05_00`
- Source commit recorded by the capture tooling:
  `3af85b2311db42fc704066106ebf548cf6e05177`

The implementation publishes the oldest recoverable customer record during
the startup graph-cache scan. Start Date submission from either Graph or
Settings now selects the later of the entered start, the retained-data bound,
and the minute-safe 90-day boundary. An adjustment notice explains whether
earlier data is unavailable or the 90-day limit applies. Next opens the normal
End Date screen; Back returns to Start Date. The adjusted start feeds the
existing end checks and filename. CSV metadata preserves both the
operator-entered start and the effective exported range.

The hash above is the implementation-stage image. Final A/B operator review
and the two current exports ran on cumulative successor S-record
`D3D3615586FD522A9472504EAB55BC8A6F4955956AAE3229CCD397A0AD1A1EAF`,
which retains the retained-start change.

## Software and build gates

- Export-start boundary model: PASS for unchanged, retained clamp, 90-day
  clamp, no data, future start, normal end checks, and adjusted filename.
- Customer export checks: `21/21` PASS.
- Graph cache checks: `15/15` PASS.
- HPT commissioning: `95/95` PASS.
- Full-address scrub: `9/9` PASS.
- SD CID: `25/25` PASS.
- Version-5 routing: `11/11` PASS.
- Every repository `script/check-*.ps1` suite: PASS.
- Clean managed Debug rebuild: PASS.
- Production-name packaging and scoped `git diff --check`: PASS.

## A/B target result

| Metric | Controller A | Controller B |
| --- | ---: | ---: |
| Assembly / J-Link | `1751136 / 69664082` | `1751219 / 69660123` |
| Raw CID | `035344535330384780976F0084018559` | `035344535330384780976F0085018507` |
| Protocol / CID / representative read | `6 / 1 / 0` | `6 / 1 / 0` |
| System errors / dropped logs | `0 / 0` | `0 / 0` |
| Records scanned / selected | `1058 / 1057` | `1012 / 1007` |
| Traversal / total cache load | `1.24 / 2.09 s` | `1.14 / 1.98 s` |
| Read commands / blocks / max | `210 / 6450 / 32` | `181 / 5764 / 32` |
| Bulk refills / scalar fallbacks | `68 / 0` | `65 / 0` |
| Retained oldest sequence | `2` | `2` |
| Retained oldest timestamp | `301739760` | `301741860` |
| Retained oldest UTC | `2026-07-25 08:36` | `2026-07-25 09:11` |
| Graph cache ready | yes | yes |
| Projected 30-day cache load | `51.5 s` | `49.5 s` |

The prior bulk candidate measured `1.98 s` total on A and `1.88 s` on B.
The new captures contain 62 more scanned records on A and 68 more on B.
Normalized traversal is `853.2 records/s` on A and `887.7 records/s` on B,
versus `866.1` and `907.7 records/s` in the preceding captures. B's
per-record time is effectively unchanged and A differs by about 1.5%. Fixed
non-traversal time changed from `0.83` to `0.85 s` on A and remained `0.84 s`
on B, so retained-bound discovery adds no material startup cost in this sample.
Cache load remains a scan of the retained snapshot, not a ten-second-per-day
operation. Scaling current traversal rates plus fixed overhead projects about
`49.5` to `51.5 s` for 30 days of one-minute records.

Controller B was programmed first. Its card was not formatted, initialized,
replaced, or removed. Its abnormal layout remains preserved: first sequences
`86/86/1`, active records `930/930/1015`, and retired segments `2/1/0`.
Mirror mismatches and lost records remained zero.

## Operator review surface

On B, entering a Start Date before the retained record should change the start
to the displayed equivalent of HPT timestamp `301741860` and show:
`No earlier logged data is available.` Pressing Next must open End Date, where
the normal after-start, five-minute-minimum, and no-future checks apply. The
default filename must contain the adjusted start. Repeat the entry/navigation
review on A, whose retained bound is HPT timestamp `301739760`.

The installed cards do not contain more than 90 days of records, so the
90-day-specific notice is software/model qualified but cannot be naturally
provoked on these preserved media. A real bounded USB export and review of its
CSV entered/effective metadata are complete on both controls. The
90-day-specific screen remains model-qualified rather than naturally
target-provoked on these retained datasets.

## Controller B USB export result

The operator completed a real adjusted-start export on B and connected the
stick to `srv-rpi00.local`. The stick was mounted read-only for review and
returned to its original unmounted state afterward.

- File:
  `SMI7_00112233_20260725t0911-20260726t0212.csv`
- CSV SHA-256:
  `C59A253E6CAC825FF8F304B85939F7DFFFD88C4E17C0E01298F8B4432A7C0044`
- Operator-entered start: `301716741`
- Adjusted/requested start: `301741860`
- Requested end: `301803151`
- Actual range: `301741860` through `301803120`
- Records published: `1024`; healthy `943`; degraded `81`
- Snapshot and requested-range gaps: `0 / 0`
- CSV structure: 1,024 contiguous line numbers, seven columns per record,
  monotonic timestamps, and matching COMPLETE trailer
- Target export status: published, complete, HPT/USB status `0 / 0`, no
  scalar bulk fallbacks
- Measured HPT scan/staging time: `284 ticks / 2.84 s`, or approximately
  `360.6 records/s`

Scaling the measured staging rate to 129,600 one-minute records gives
`359.4 s`, approximately `6.0 minutes`, for 90 days. The corresponding CSV is
projected at about `6.59 MB` (`6.29 MiB`) before allowing for additional event
records. This is a projection from the current 1,024-record target run.

The current firmware does not retain a separate timer around CSV formatting,
the per-record FileX writes, file close, media flush, temporary-file rename,
and final flush. Therefore `2.84 s` is the measured HPT scan/staging time, not
the complete operator-visible export duration. A separate USB-publication
timer is required before claiming an exact 90-day end-to-end duration.

## Final cumulative-candidate A/B result

On 2026-07-26 the owner reported that both controls passed Graph entry,
legend, Return, export entry, cancellation, retained-start adjustment, End
Date transition/validation, and adjusted-filename review on cumulative
candidate `D3D36155...A1EAF`. The owner then completed a fresh real export
from each control.

| Field | Controller A | Controller B |
| --- | ---: | ---: |
| Entered start | `301670006` | `301670062` |
| Adjusted/requested start | `301739760` | `301741860` |
| Requested end | `301842812` | `301842867` |
| Actual range | `301739760..301842780` | `301741860..301842840` |
| Records scanned / selected | `1736 / 1735` | `1689 / 1684` |
| Healthy / degraded | `1735 / 0` | `1603 / 81` |
| Snapshot / range gaps | `0 / 0` | `0 / 0` |
| Complete / published | `1 / 1` | `1 / 1` |
| HPT / USB status | `0 / 0` | `0 / 0` |
| HPT scan/staging | `2.18 s` | `2.08 s` |
| HPT staging throughput | `795.9 records/s` | `809.6 records/s` |
| Projected 90-day HPT staging | `162.8 s / 2.71 min` | `160.1 s / 2.67 min` |
| Bulk fallbacks | `0` | `0` |

Read-only review on `srv-rpi00.local` matched those manifests to:

- Controller A:
  `SMI6_07162026_20260725t0836-20260726t1313.csv`,
  `87,763` bytes, `1,735` records, SHA-256
  `EFB43A7536408AF5D72741DD4997BBD181C7DB1DE61C74D24464793E3A1B863C`.
- Controller B:
  `SMI7_00112233_20260725t0911-20260726t1314.csv`,
  `85,180` bytes, `1,684` records, SHA-256
  `9C0C34ABC1955D9519E748DDB35C6D5B1B9F70DBDD2E0DF63F9024B100E0E75C`.

Both files have contiguous CSV row numbering, seven fields per record, no
malformed records, and matching `COMPLETE` trailer counts. Event timestamps
are not asserted to be strict one-minute cadence: A includes a one-second
reverse `Power Off` event and B includes a same-second `Power Off` event.
Those source events do not create sequence or requested-range gaps.

## Raw target captures

- A:
  `work/evidence/hpt-log-store-circular-mirror/controller-a/export-start-adjustment-20260726/`
- B:
  `work/evidence/hpt-log-store-circular-mirror/controller-b/export-start-adjustment-20260726/`
  including `hpt-export-status.json`

The compact JSON files are the review surface. Binary J-Link captures remain
supporting evidence and should not be reviewed through per-file diffs.
