# Services 469, 470, and 474 implementation and target status

Status: historical evidence; service 470 qualification complete, service 469 campaign invalidated by the 2026-07-22 card failure and incomplete export
Type: evidence
Updated: 2026-07-22
Next Action: do not resume 469 on retained media; use the linked incident for fail-closed export and systemic media investigation
Campaign Reason: Historical record from campaign 010-qualify-firmware-negative-and-recovery-behavior; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-sd-card-degraded-boot-and-logging-integrity.md
Canonical Truth: E:/dev/high_point/7520553_SMI_FW/docs/

## Image

- Firmware: production 00-04-13.
- Release S-record SHA-256 after service-469 implementation:
  `A3B382F1D2DCF907B87C477F70095C63C7438D525E93B2DA68F1EED0FDE254F9`.
- Clean isolated Debug and Release builds passed on 2026-07-21.
- Controller A / assembly 1751136 / J-Link 69664082 was programmed with the
  Release image and booted with SD ready.

## Service 470 qualification

- Service 470 is the non-formatting continuous background SD endurance test.
- Controller A completed run 03305; Controller B completed run 04904.
- Both demonstrated normal controls and logging, background verified A/B
  traffic, dashboard exit/re-entry, controlled stop, retained evidence,
  explicit cleanup, and free-space recovery with zero SD, mirror, or normal-log
  failures.
- Controller A's first power-cycle exposed an unbounded whole-volume FileX
  media check that exceeded the production watchdog. The recovery path was
  corrected to use committed-pair verification without the unbounded check.
  Clean builds and repeat power-cycle qualification passed afterward.
- Ownership behavior passed: 470 stops 474 only when it started that monitor;
  a pre-existing 474 remains independent. The dashboard reports recovered
  interruptions as `Resumes`.

## Service 469 implementation

- Service 469 creates export-compatible signed, mirrored normal-log fixtures
  covering 365 days without changing the production 90-day export policy.
- Existing hourly files are preserved. Missing hours receive 60 normal-sized
  minute records in both A and B trees.
- Destructive actions validate record framing, exact hour timestamp, private
  magic, and complemented sequence before deleting only fixture files.
- Guarded stages generate/scan one year, trim to exactly 90 days, trim to 89
  days, and delete all remaining signed fixture files.
- Normal logging, graph, export, format, evaluator, and control work retain
  priority; the live dashboard has no inactivity timeout.

## Controller A live evidence

At 2026-07-21 15:37:19 PDT:

- Service 469 state/action: generating year / generate 365 days.
- Hours scanned: 7,699 / 8,760.
- Existing hours preserved: 2,079.
- Missing hours written: 5,620.
- Fixture records written: 337,200.
- Fixture files deleted: 0.
- Fixture/FileX last status: `0x0000`.
- SD state: ready; SD I/O status: `0x0000`.

The immediately preceding normal-datalogger check reported queued 56,
completed 56, dropped 0, mirror-A failures 0, mirror-B failures 0, and SD I/O
failures 0 while service 469 was running. Service 474 was stopped and therefore
was not providing independent readback monitoring during this fixture run.

## 2026-07-22 disposition

Controller A was powered down after a USB export requested through
2026-07-22 produced only a continuous prefix ending 2026-06-17. Host inspection
through Linux and Windows then proved repeatable hardware read failures,
including sectors inside the card's sole FAT. The card is retired as evidence.

This campaign does not close the greater-than-90-day, exact-90-day, 89-day, or
signed-cleanup qualification. It demonstrates that 469 can generate signed
fixtures, but it also shows that the existing export path can silently serialize
a partial prefix after SD traversal aborts. See
`work/incidents/incident-control-a-sd-card-read-failure-20260722.md`.

## Superseded remaining qualification

- Do not continue these steps on the failed card.
- Test USB export behavior with more than 90 days present.
- Use the guarded service action to trim signed fixtures to exactly 90 days and
  test both Graph and Menu Settings export entry points.
- Trim to 89 days and repeat representative export behavior.
- Delete all signed fixture files and prove normal production logs remain.
- Decide whether service 469 requires Controller B coverage before release.
