# LAB E7 — Bounded replay-real-time perception loop

Date: 2026-07-21
Completed at: 2026-07-21T10:12:16.828Z
State: accepted replay scheduler and world-state qualification
Navigation/safety state: not accepted
Ops card: pending direct `nodedc-ops-agent` availability

## Objective

Stop treating recorded perception as a video-enhancement exercise and establish
the first measured runtime contract for the K1 as the eyes of an autonomous
platform. LAB E7 replays the immutable E6 interval at its original timing and
requires the derived perception path to:

1. publish a machine-readable world state, not only a rendered overlay;
2. keep derived work in a small bounded queue;
3. absorb short source bursts without discarding processable frames;
4. discard old derived frames under real overload instead of building latency;
5. expose result age, queue depth, drops and explicit health states;
6. preserve object identity, metric range and 3D geometry in both map and
   LiDAR-relative coordinates;
7. reject untrustworthy velocity estimates instead of publishing extreme
   motion caused by cuboid jitter;
8. emit a diagnostic polar clearance observation from the LiDAR;
9. prove the scheduler at the approximately 10 Hz source rate before connecting
   the real inference worker or live K1 stream.

This experiment qualifies the downstream scheduler, world-state contract and
diagnostic publication path. E4 segmentation, E5 detection/tracking and E6
fusion are immutable precomputed inputs. LAB E7 therefore does not claim live
inference, live sensor transport, collision avoidance or navigation fitness.

## Immutable input binding

- Session: `20260720T065719Z_viewer_live`
- Source: `sensor.camera.right`
- Camera slot: `camera_1`
- Camera job: `recorded-camera-602ac89026ed12978619801d`
- Input SHA-256:
  `602ac89026ed12978619801d4edea0cae24b5cc3afabd9f7af2858de6505a20e`
- Factory calibration SHA-256:
  `05f3ad9b38b3a4fc95388a8ec83da83c745e217709e51787b3d5aad0969f6fa9`
- E6 result:
  `e6-fusion-b4e4226674a66f6196c033785eb307c255a7bdd8493ef9809dfb1d6e5bd68eaa`
- E7 selection: E6 frames 0–600 inclusive
- Source frames: 1,000–1,600 inclusive
- Frames attempted: 601
- Replay timing span: 59.969 seconds
- Replay speed: 1.0x

The adapter spent 9.490253 seconds before the timed replay revalidating inputs,
reading the raw point/pose capture and reconstructing the exact E6 pose binding.
That preparation is measured separately and is not counted as live latency. A
real source will receive frames incrementally and must not preload a multi-hour
session into memory.

## Accepted configuration

Producer identities:

- pipeline: `bounded-latest-wins-e6-world-state-replay/v1`;
- profile schema: `missioncore.e7-replay-realtime-profile/v1`;
- profile SHA-256:
  `7222c65ddef20798a242d83edc53973cdfd6f5dec8fb9ffb6fcb5dbcef57f1c5`;
- runner SHA-256:
  `ce36b919fe5860bbb81f04b29c58a8a333915b1ba9bd7f233f256ce77163b15d`;
- runtime contract SHA-256:
  `4c65140550e47c08c528b10d51922d5f73b7d19a1c34ef07896c052f492309f5`;
- result validator SHA-256:
  `719b966ff263f196a97b4d72e946b00fd10705a0158b7df6ecf452c6c9bc4e5b`;
- E6 replay adapter SHA-256:
  `9765be5e0338b9978db7a58a739313b228bc7ceee1352a7a76af0ff2a528a953`.

Scheduler:

- one source-paced producer and one derived-state consumer;
- replay speed 1.0x using the original per-frame session timestamps;
- queue capacity: two derived frames;
- overflow policy: evict the oldest queued derived frame;
- normal consumer delay injection: zero;
- stale threshold: 300 ms;
- unavailable threshold: 1,000 ms;
- raw evidence is outside this queue and is never dropped by it.

Acceptance thresholds:

- delivery rate at least 9.5 Hz;
- p95 result age at most 300 ms;
- drop fraction at most 1%;
- maximum queue depth two;
- process RSS at most 512 MiB.

## World-state contract

Each published state uses
`missioncore.live-perception-world-state/v1` and contains:

- exact E6/source frame identity and session timestamp;
- `healthy`, `degraded`, `stale` or `unavailable` delivery health;
- the reason for every non-healthy state;
- accepted obstacle track ID, class, detector label and confidence;
- map-frame and K1-LiDAR-frame 3D positions;
- map-frame orientation and visible-surface cuboid dimensions;
- robust LiDAR range and support-point count;
- qualified diagnostic map-frame velocity or an explicit rejection reason;
- 72-sector LiDAR-relative obstacle-clearance observation.

The vehicle-body frame is explicitly
`unavailable-no-rig-to-vehicle-transform`. K1 LiDAR coordinates must not be
silently presented as the final autopilot body frame. A measured rigid
sensor-to-vehicle transform is required before behavior integration.

### Velocity policy

Naive frame-to-frame cuboid differencing produced visibly false speeds because
the supported surface moves within an object as viewpoint and point density
change. The accepted implementation uses a one-second bounded history,
pairwise slopes with at least 200 ms baselines, median velocity, a 400 ms
minimum history, a 20 m/s diagnostic bound and a 0.75 m median position-residual
gate.

The field is published only as `diagnostic-robust-history`. Observations with
insufficient history, excessive residual or an implausible speed retain the
object and range but publish no velocity.

### Clearance policy

The first clearance observation is deliberately simple and diagnostic:

- 72 horizontal sectors over 360 degrees;
- 0.5–30 m range;
- local ground estimate at the fifth LiDAR Z percentile;
- obstacle slice 0.2–3.0 m above that estimate;
- `front_m` is the nearest retained point within ±15 degrees;
- unobserved sectors remain `null`, never free by assumption.

This is obstacle clearance evidence, not a traversable free-space polygon. It
does not yet model vehicle footprint, slope, negative obstacles or a certified
ground plane.

## Pilot history and architecture correction

### Pilot 1 — rejected queue consumption policy

Result:
`e7-live-replay-a578764161fc007c8fc8f8e8b5ffc339e2e861668f13c1fee7dc017ac3c4b972`.

It processed 61/64 frames at 9.820 Hz with 10.787 ms p95 latency, but discarded
three frames during short timestamp bursts even though the consumer was fast.
The first implementation always selected the newest queued frame. This was too
aggressive for a capacity-two jitter buffer and was rejected.

The correction preserves FIFO order while capacity remains available and
evicts the oldest frame only when a new publication would overflow the queue.
This retains short processable bursts while remaining latest-wins under actual
backpressure.

### Pilot 2 — scheduler accepted, velocity rejected by review

Result:
`e7-live-replay-810e2628c756d3e3694603c4da5429a8a333e684208cd137c6a076a7e9ae8b73`.

It processed 64/64 frames with zero drops at 10.303 Hz and 5.943 ms p95
latency. Scheduler acceptance passed, but inspection of naive frame-difference
velocity found a 1,028.5 m/s maximum caused by a cuboid-center jump. The run is
retained as immutable evidence and rejected as a world-motion baseline.

### Overload negative control — accepted

Result:
`e7-live-replay-1c5ce5718d8be7c4dfcbe540c12fe96339ca04a598e8f5f2fb85e84bc0748796`.

An intentional 250 ms consumer delay was applied to 80 source-paced frames:

| Measurement | Result |
|---|---:|
| Frames attempted / processed / dropped | 80 / 33 / 47 |
| Drop fraction | 58.75% |
| Maximum / final queue depth | 2 / 0 |
| Healthy / stale states | 1 / 32 |
| End-to-end p95 | 468.525 ms |
| Peak RSS | 373.656 MiB |

The negative control proves the intended failure mode: derived output quality
degrades and old derived frames are discarded, but queue depth remains bounded
and the runtime reports staleness. It does not block or delete raw evidence.

### Pilot 3 — accepted profile freeze

Result:
`e7-live-replay-2fb63b4177900348fc876a1dc580a19015753742c3665c4a044e1f251b44a430`.

It processed 64/64 frames with zero drops at 10.303 Hz and 5.865 ms p95
latency. Robust-history velocity replaced naive differencing. In this interval
72 velocities were admitted with 0.439 m/s median, 2.046 m/s p95 and 4.811 m/s
maximum; eight noisy histories were rejected by the position-residual gate.
The configuration was then frozen for the full run.

### Preliminary full run — metrics valid, provenance incomplete

Result:
`e7-live-replay-24222ede524e2e7824e4c7e6e9d17e87aa75bf3b8768f9e88c4b97eb410b633b`.

It processed 601/601 frames with zero drops and passed every runtime threshold.
Final review found that its identity pinned the E7 runner but did not separately
pin the imported runtime contract, validator and E6 adapter. The immutable run
is retained as evidence, but it is not the reference result. Those dependencies
were added to the identity and the complete 1.0x run was repeated.

## Full qualification result

Published result:
`e7-live-replay-e339aaed75fff05ed893ae48770bd127cc0c764f3124fc4b6be94b5fd9f8389c`.

| Measurement | Result |
|---|---:|
| Frames attempted / processed / dropped | 601 / 601 / 0 |
| Delivery rate | 10.021845 Hz |
| Replay timing span | 59.969000 s |
| Actual replay wall | 59.981432 s |
| Queue capacity / maximum / final depth | 2 / 2 / 0 |
| Healthy / degraded / stale / unavailable | 526 / 75 / 0 / 0 |
| Process peak RSS | 398.047 MiB |

The 75 degraded states exactly match E6 frames that failed the strict
camera/LiDAR timing gate. They remain timestamped states with no fabricated
depth. Every fused E6 frame is healthy in this downstream replay. No frame was
lost by the accepted runtime.

### Runtime latency

| Stage | Mean | p95 | Max |
|---|---:|---:|---:|
| Scheduled tick to world-state publication | 4.880 ms | 5.927 ms | 8.895 ms |
| Producer scheduling lag | 4.124 ms | 5.019 ms | 5.644 ms |
| Queue wait | 0.071 ms | 0.144 ms | 1.154 ms |
| World projection and clearance | 0.372 ms | 0.538 ms | 1.647 ms |
| Rerun publication | 0.257 ms | 0.355 ms | 1.662 ms |

The p95 result is 50 times below the 300 ms initial laboratory threshold. This
headroom belongs only to the downstream replay/world-state stage; live decode,
network transport, E4/E5 inference and fresh E6 geometry must still be added to
the latency budget.

### Object state

| Group | Observations | Unique track IDs |
|---|---:|---:|
| Vehicle | 809 | 43 |
| Person | 96 | 12 |
| Bicycle | 13 | 1 |
| Total | 918 | 56 |

- range p50 / p95 / maximum: 10.189 / 24.126 / 37.749 m;
- 572 object observations received a diagnostic robust velocity;
- 263 retained the object but reported insufficient velocity history;
- 83 retained the object but rejected velocity due to position residual;
- admitted speed p50 / p95 / maximum: 0.600 / 2.640 / 6.431 m/s.

These velocities are behavior-facing schema candidates, not validated motion
ground truth. A 3D motion filter and annotated moving/static evaluation set are
still required.

### Clearance observation

- valid front clearance on 526 fused frames;
- front minimum / p50 / p95 / maximum:
  0.801 / 5.356 / 11.092 / 25.954 m;
- observed-sector fraction p50 / p95: 81.94% / 87.50%;
- all 75 frames without admitted LiDAR remain clearance-unavailable.

## Rerun visual QA

The standalone Rerun recording contains:

- the qualification contract;
- map-frame LiDAR point cloud and oriented obstacle `Boxes3D`;
- end-to-end latency chart;
- queue-depth chart;
- health-state chart;
- the exact 59.969-second replay timeline.

The web viewer loaded all 601 ticks and exposed real cuboid centers, half-sizes,
quaternions, labels and ranges. Latency remains approximately 0–8.9 ms, queue
depth remains 0–1 at consumption with a measured maximum of two, and health
transitions correspond to depth-unavailable E6 frames. No browser load/render
errors were observed; only Rerun web-backend warnings were present.

## Artifacts

| Artifact | Bytes | SHA-256 |
|---|---:|---|
| `world-state.jsonl` | 1,730,546 | `6078d19c6414c2bf2f7ca9d95c5164b46f388496690d5fee67c662724fb7f956` |
| `telemetry.jsonl` | 317,486 | `c25a01dc2d7a067672b8ae667e08450f2010ead3e3ccbaea7fde47ec3638119c` |
| `world-state.rrd` | 16,234,276 | `540c7d91a6c4cf8c19276994f6bbafcb267686ddb1fdbae46d7fd2aba7d2c4b9` |
| `run-report.json` | 4,163 | `04fd00324c57f6fa06cd6360256c14f70ab5c3fe51d5e662e427780bd228345d` |

The E7 validator rehashes every artifact, revalidates the complete E6 upstream
chain, checks frame/drop/queue/health accounting, validates ordered world-state
and telemetry rows, and verifies the RRF2 recording. All pilots, the preliminary
full result and the reference result occupy 44 MiB on the Mission Core host.
The AI worker and worker disks C: and D: were not accessed or modified.

## What is proven

- the accepted E6 observations can be delivered as machine world state at the
  source rate with a capacity-two derived queue and zero loss;
- source timestamp bursts are absorbed without unnecessary drops;
- real overload fails boundedly and explicitly rather than growing latency;
- result freshness and sensor/fusion degradation are separate states;
- accepted obstacles have map and K1-LiDAR positions, range, geometry and
  guarded velocity fields;
- a first diagnostic LiDAR clearance signal is available;
- Rerun remains a subscriber/diagnostic surface, not the perception authority.

## What remains open

- actual live camera/LiDAR ingestion through this scheduler;
- network and inference latency on the RTX worker;
- 10 Hz detector/tracker execution rather than precomputed E5 observations;
- asynchronous lower-rate semantic inference rather than precomputed E4 masks;
- current-frame E6 fusion rather than precomputed geometry;
- calibrated K1-to-vehicle-body transform;
- ground-truthed velocity, clearance, object and free-space accuracy;
- bounded worker disconnect/recovery and authenticated non-SSH transport;
- navigation or safety acceptance.

## Next gate — LAB E8

Move the same contract onto the real executor path without changing K1 command
ownership:

1. replay encoded camera frames to the RTX worker at 10 Hz;
2. run YOLOX detection/tracking without synchronous video-artifact writes;
3. run semantic segmentation asynchronously at a lower measured rate and
   expire old masks explicitly;
4. feed current detections, latest valid semantics and current LiDAR/pose into
   the E6 fusion adapter;
5. publish the same E7 world-state schema through the capacity-two queue;
6. measure transport, decode, inference, fusion and publication latency
   separately;
7. repeat the 250 ms overload and worker-disconnect negative controls;
8. connect the live K1 only after source-paced worker replay passes.

The initial E8 gate remains 5–10 Hz derived perception with p95 world-state age
below 300 ms and uninterrupted raw recording. A visually better model is
accepted only if it improves obstacle evidence inside that operational budget.
