# Inventory: SMI operator warning surfaces

Status: current
Type: inventory
Updated: 2026-07-26
Next Action: apply this inventory and the canonical policy to every new message surface
Campaign Reason: Historical record from campaign 010-qualify-firmware-negative-and-recovery-behavior; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/completed/wp-operator-warning-truth-and-false-positive-prevention.md

## Scope

All current `newMsgNavScreen()` call sites in
`src/HMI_MainEventHandler.c`, grouped by evidence and operator-risk class.
This is a semantic inventory: repeated Graph/Settings variants are grouped
when they share the same decision function and evidence.

## Items

| Item | Current Location | Decision | Evidence / reason |
| --- | --- | --- | --- |
| Access-code and tenkey rejection | access handlers near lines 609 and 4221--4436 | keep | Immutable submitted input; immediate synchronous validation |
| Numeric calibration/range rejection | calibration handlers near 4572--4623 | keep | Submitted value checked against explicit bounds before mutation |
| Filename-required feedback | Graph/Settings export starts near 5244 and 5674 | keep | Submitted filename buffer is empty at action time |
| Export range rejection | `showGraphExportRangeError`, `showMenuSettingsExportRangeError` | keep | Submitted range plus retained snapshot; reason-specific policy result |
| Export start adjustment | `showGraphExportStartAdjusted`, `showMenuSettingsExportStartAdjusted` | keep as information | Successful policy adjustment; writes adjusted date and continues to End Date |
| USB precondition | Graph/Settings/update/service entry handlers | retain with availability wording | Synchronous action precondition; do not infer physical absence beyond mounted/available state |
| Cache-not-ready feedback | Settings export start | keep | Current stable cache-complete gate; informational wait, not a fault assertion |
| Destructive confirmations | SD/HPT initialize/format, factory reset, fixture deletion | keep | Exact pending action, target, and Cancel path are explicit |
| Diagnostic/start/stop confirmations | evaluator, soak, endurance, calibration, tuning | keep | Operator-requested action confirmation, not spontaneous fault warning |
| Retired-service information | service codes 469--474 | keep | Compile-time product routing fact |
| Configuration Home fault | `serviceConfigRecoveryHomeNotice` | corrected | Terminal persistence transaction, specific reason, effective-inhibit truth, final recheck, and transaction-keyed acknowledgement |
| SD/HPT Home fault | `serviceSdMissingHomeNotice` | corrected | Three stable refreshes plus final detection/media/ownership/config recheck; no physical-absence guess |
| HPT export terminal failure | `ProgressScreenEventHandler` plus `S_HptExportStatus` | corrected | Twice-read SD-owner terminal failure; other progress operations cannot borrow a stale HPT reason |
| Generic progress terminal results | `ProgressScreenEventHandler` codes 900--902/1000 | keep | Operation owner publishes terminal code; HPT reason may be used only when HPT state is terminal failed |
| Status dashboards/reports | service/diagnostic call sites | keep | Read-only informational state, not spontaneous warning |

## Enforcement

- The canonical policy is enforced by
  `script/check-operator-warning-truth.ps1`.
- Treat `GX_STRING_ID_T_WARNING` Home modals as high-risk and whitelist only
  reason-classified, final-revalidated service functions.
- Require a new inventory entry and recovered-transient/positive-fault tests
  whenever another asynchronous warning is added.
- Keep synchronous validation and explicit confirmation paths simple; adding
  asynchronous machinery there would reduce clarity without improving truth.

## Verification

Completed on the final candidate: `script/check-operator-warning-truth.ps1`,
the existing configuration,
export-range, graph, HPT, SD safety, and customer-export gates, then the clean
managed firmware build all passed. On both targets, an ordinary setpoint
transaction committed on a recovered retry without a modal; the first failure
remained diagnosable, exact original setpoint bits were restored, B retained
its CID/lane layout without formatting, and both graph caches became
operator-ready. See
`work/evidence/operator-warning-truth-and-target-proof-20260726.md`.
