# Inventory: Triple-mirrored datalog consumer migration

Status: completed
Type: inventory
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-triple-mirrored-circular-hpt-log-store.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Scope

Every production or historical routine that creates, reads, updates, deletes,
formats, graphs, reports, diagnoses, or exports internal-SD datalog content.
USB-stick FileX remains independent and is not internal datalog ownership.

## Items

| Item | Current Location | Decision | Reason |
| --- | --- | --- | --- |
| Periodic temperature/system samples | `src/Thread_Controller_entry.c` -> `SdCardSubmitLogRecord()` | migrated | Immutable queue record is appended by the SD owner through `HptLogQualificationAppend()` into all three circular lanes |
| Event, alarm, warning, door, and power records | `src/Thread_SystemMonitor_entry.c` -> `SdCardSubmitLogRecord()` | migrated | Uses the same bounded queue and triple append path as periodic samples |
| Queue consumption and completion | `serviceQueuedLogRecord()` in `src/Thread_SdCard_entry.c` | migrated | HPT-ready raw ownership is required; impossible ownership fails closed; queue servicing also continues during long chart traversal |
| Temperature graph initial load and refresh | `loadHptChartRecords()` / `loadAllChartLogs()` | migrated | Reads a bounded retained suffix through the triple iterator, validates envelope/timestamp/copy agreement, and preserves event priority |
| Graph export entry point | `src/HMI_MainEventHandler.c` | migrated | Queues `gIsNewUsbExportLogProcess`, which starts the raw-HPT immutable export snapshot |
| Menu Settings export entry point | `src/HMI_MainEventHandler.c` | migrated | Uses the same range validator and raw-HPT export path as Graph |
| Customer export traversal | `beginHptCustomerExport()` / `serviceHptCustomerExport()` | migrated | Pins media generation and sequence end, validates quorum payloads, fails closed on gaps/reclamation/capacity, and stages only a complete result |
| USB CSV publication | `copyExportFromSdToUsb()` in `src/Thread_Usb_entry.c` | retained as output adapter | Consumes only a complete staged HPT snapshot; FileX ownership is for the removable USB device, not the internal SD card |
| Installed/unformatted-card notification | `serviceSdMissingHomeNotice()` | migrated | Offers the guarded HPT Format action only for the installed/readable/eligible state |
| Whole-card formatting/reinitialization | `SdCardRequestHptInitialization()` / `initializeHptWholeCard()` | migrated | Rechecks CID and representative read, uses HPT triple format, reopens twice, and verifies a commissioning record before enabling writes |
| Service 468 diagnostics and format | `appHptMediaDashboard()` | migrated | Uses live triple-store status and the same two-confirmation format workflow |
| Lane/readback/wrap/power-cut diagnostics | `src/Thread_SdCard_entry.c` HPT diagnostic routines | migrated | Directly exercise triple append/read/iterate/reopen/retirement boundaries |
| Full-address media scrub | `serviceHptFullAddressScrub()` | retained raw-media diagnostic | Read-only card qualification, identity-pinned; it deliberately operates below the datalog format |
| FAT32 `saveLogRecord()` and `LoadLogRecords()` | `src/Thread_SdCard_entry.c` | retired historical path | Reachable only in `SD_CARD_STATE_READY`, which version-5 internal media classification never publishes |
| FAT32 `formatSDCard()` | `src/Thread_SdCard_entry.c` | retired historical path | No production main-loop call remains; all current formatting uses HPT initialization |
| Direct per-day USB/FAT32 exporter | `processExportLogDataToUsb()` in `src/Thread_Usb_entry.c` | retired historical path | Its dispatch is commented out; both live HMI export entry points use staged raw-HPT export |
| Services 469/470/471/472/474 and FileX evaluator/soak/continuous fixtures | HMI and SD service code | retired historical evidence | Public start APIs return unavailable and the HMI routes to the version-5 retirement notice |
| `gIsEraseAllLogRecords` FAT32 erase request | HMI/SD legacy variables | retired historical path | No active HMI caller remains and raw-HPT ownership never executes the FAT32 erase/format branch |

## Recommendations

- Keep legacy FAT32 bodies only as history until the final release cleanup; do
  not reconnect them to production dispatch.
- Treat any new internal-datalog consumer as incomplete unless it uses the
  triple append/read/iterator/format interfaces and has an automated invariant.
- Run final human review only for the graph rendering and notification/warning
  screen presentation; functional state and storage results should be captured
  through J-Link.

## Verification

- `script/check-version5-hpt-only-sd.ps1`
- `script/check-hpt-commissioning.ps1`
- `script/check-graph-data-policy.ps1`
- `script/check-hpt-customer-export.ps1`
- managed Debug and Release builds
- development J-Link graph/status/format-eligibility evidence:
  `work/evidence/hpt-log-store-circular-mirror/pre-freeze-integration-20260725.md`
- frozen-candidate repetition after source/artifact freeze

## Owner-directed reconciliation — 2026-09-23

Reconcile stale active lifecycle to the previously documented completed disposition; no new test or broader acceptance claim.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: complete for pre-freeze source integration
> Next Action: retain as the pre-freeze audit and repeat the named behaviors on the frozen candidate

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
