# SIM S1B real-provider acceptance — 2026-07-24

## Result

`PASS` for the product-owned stock-rover start/health/stop boundary on the
accepted `MissionCore-Sim` worker.

This is not S1 acceptance. It does not prove live world control, rover command
mapping, canonical telemetry/frames, watchdog/failsafe behavior, repeatability,
navigation behavior or real actuator safety.

## Accepted source generation

- Branch: `feat/simulation-polygon-s1`.
- Mission Core commit:
  `6cb14954d4696270e12d4adb800bc337251dc631`.
- Archive: `NODEDC_MISSION_CORE-s1-6cb1495.tgz`.
- Archive SHA-256:
  `37da47744e855bb1031734893a6f2dd82bb4eb92b7e15edd70794c29b2dfb451`.
- Source:
  `/mnt/d/NDC_MISSIONCORE/simulation/source/NODEDC_MISSION_CORE-6cb1495`.
- Target test evidence:
  `/mnt/d/NDC_MISSIONCORE/simulation/artifacts/s1/bootstrap/20260724T153453Z-6cb1495`.
- Target test result: `25 passed`.

The source was produced with `git archive` from the exact commit and an
explicit path set. Existing S0 and earlier S1 source/evidence generations were
not modified.

## Accepted run

- Run: `s1b-6cb1495-20260724t1535z`.
- Evidence:
  `/mnt/d/NDC_MISSIONCORE/simulation/artifacts/s1/lifecycle/s1b-6cb1495-20260724t1535z`.
- Host profile:
  `ai-worker-px4-gazebo-v1`.
- Host profile SHA-256:
  `aeecf5005301db230e1340b85215cbbd862b72974a22b8c43767c28be8453e2f`.
- Lifecycle profile SHA-256:
  `06fadcd1b55b70c9a53556dadc65d15a35d8d73f7664ebf766b9986cbe19a883`.
- Scenario SHA-256:
  `49e8f4009bc96c40964a5657fef5c2e035f22fa567a2247b0e40571cb5e4ee5e`.
- Network interfaces inside the run: `lo` only.
- Provider owners:
  `micro-xrce-dds-agent`, `px4-gazebo-stock-rover`.
- Terminal state: `completed`.
- Terminal reason: `operator-stop-clean`.
- Persisted events: `8`.
- Control commands: `0`.
- Registry residue: none.
- Independent exact-process check after the run: no `px4`,
  `MicroXRCEAgent` or `gz`.
- D free bytes after the run: `392023871488`, above the accepted 200 GiB stop
  floor.

Provider readiness was not inferred from PIDs. The admitted log evidence
contains:

```text
world: rover, model: rover_ackermann_0
Startup script returned successfully
successfully created rt/fmu/out/vehicle_status_v1 data writer
session established
```

PX4 stdin remained open to prevent an EOF prompt loop, but Mission Core wrote no
PX4 shell command. The worker received no arm or actuator/setpoint request.

## Failed generations retained as negative evidence

`01ec122` stopped before starting providers because the first namespace check
read WSL sysfs rather than the current namespace through netlink. The transient
namespace itself contained only loopback. Source was corrected in a new
generation; the failed generation was not retried.

`b4e3b3b` reached the real stock rover and XRCE session but ended
`orchestrator-start-failed`. Its declared profile incorrectly required
`Running, connected`, a line emitted by the S0 diagnostic CLI command rather
than spontaneous provider health, while PX4 stdin was closed. The full failed
run, provider logs, terminal process registry and digest index remain under:

```text
/mnt/d/NDC_MISSIONCORE/simulation/artifacts/s1/lifecycle/s1b-b4e3b3b-20260724t1531z
```

That generation was not retried. `6cb1495` replaced repeated full-file polling
with incremental log readers, kept PX4 stdin open without writing commands and
used the factual DDS-writer marker.

## Accepted and open boundaries

Accepted:

- exact S0 generation and D-only admission;
- product-owned loopback namespace;
- shell-free real provider specifications;
- readiness-gated Mission Core start;
- persisted run lifecycle and provider registry;
- deterministic real-provider stop with no residue;
- zero command/actuator authority.

Open:

- restart-safe PID/start-token reconciliation after orchestrator process loss;
- live pause/resume/single-step/reset;
- PX4/ROS canonical VehicleState and ENU/NED/FLU/FRD golden conversion;
- Ackermann and Differential command mapping;
- TTL/heartbeat/watchdog and provider-loss cases;
- repeatability verdict and complete S1 QualificationReport;
- S1C/S1D and S2.

## UI-0 follow-on

The direct internal read-only UI-0 surface is implemented after this acceptance
without changing the accepted S1B evidence. It reads the same
`artifacts/s1/runs` journal through GET-only backend routes and a
non-navigable Control Station workspace. Visual QA loaded the copied accepted
run and showed terminal `completed`, `operator-stop-clean`, four provider pins,
eight events, zero commands and the virtual-only authority boundary. The
browser received neither the configured D root nor artifact bytes or command
payloads.

This follow-on is interface/read-model acceptance only. It does not promote the
S1B run to S1 acceptance and does not close any remaining control, telemetry,
frame, failsafe, repeatability, navigation or physical-safety gate.
