feat: finalize corrected-route planning and Rerun recording review

docs/15_LABORATORY_RUN_CANON.md

@@ -6,9 +6,11 @@ Status: accepted, 2026-07-26
 
 Mission Core has two different catalogs over related evidence:
 
-- **Data → Sessions and records** contains only original physical captures.
+- **Data → Sessions and records** contains independent original physical captures.
   Examples: `RAVNOVES00`, `TEST007`, `TEST009`. A source record is immutable
-  evidence received from a device or recording adapter.
+  evidence received from a device or recording adapter. Per the 2026-09-21
+  owner decision, physical passes acquired by the planner are shown with their
+  studies in **LAB → Planner**, not in Data or the reference selector.
 - **Test contour → Laboratory contours** contains derived experimental runs.
   Examples: LAB E24, E25, E26, E28 and E29. A LAB run references an original
   record and never becomes another original capture.
@@ -16,7 +18,10 @@ Mission Core has two different catalogs over related evidence:
 The backend may keep both entities in one durable SQLite catalog, but every
 consumer must request an explicit catalog scope:
 
-- `scope=source` for original records;
+- `scope=standalone` for Data and planner reference choices: original records
+  excluding explicit planner-acquisition bindings;
+- `scope=source` for all original records, including planner passes needed for
+  recorded comparisons and scientific inspection;
 - `scope=laboratory` for LAB projections;
 - `scope=all` only for internal joins that must resolve both a derivative and
   its source.
@@ -24,6 +29,12 @@ consumer must request an explicit catalog scope:
 Deleting, renaming or moving source payloads to make the UI look clean is
 forbidden. Product separation is expressed by typed projections.
 
+A planner pass remains a physical source, not a synthetic LAB projection.
+Classification uses exact run/session acquisition bindings, never names or
+registration success. Hiding it from Data does not remove its raw evidence or
+its historical planning report. See
+[the full-reference/catalog audit](audits/2026-09-21-whole-reference-and-capture-catalogs.md).
+
 ## Current reference-source policy
 
 RAVNOVES00 is the sole active physical reference source for the current

docs/adr/0045-upstream-rerun-canonical-recorded-lab-pipeline.md

@@ -3,6 +3,10 @@
 Date: 2026-08-30
 Status: accepted; RAVNOVES004TREE is the first migrated full-route LAB
 
+Navigation amendment, 2026-09-21: [ADR 0052](0052-native-rerun-grid-navigation.md)
+records the owner-authorized, bounded native-camera patch. The historical
+decision below remains intact; single renderer/clock/data ownership still applies.
+
 Implementation audit, 2026-09-05: see the
 [complete customization inventory](../audits/2026-09-05-rerun-customization-inventory.md)
 and [upstream provenance evidence](../audits/2026-09-05-rerun-upstream-evidence.json).

docs/adr/0052-native-rerun-grid-navigation.md

@@ -0,0 +1,75 @@
+# ADR 0052: Native Rerun grid navigation
+
+Date: 2026-09-21
+Status: implemented and installed; checks and manual acceptance bounds are in the navigation audit
+
+## Decision and authority
+
+The owner accepted the restored recorded cloud quality, then explicitly asked
+to finish navigation: pan the pivot on the grid, orbit around that fixed pivot,
+and zoom independently of the route extent. OPS is updated only after completion.
+
+This is a bounded amendment to ADR 0045's **unmodified web viewer** requirement.
+Rerun SDK, recording format, data, timeline, native renderer and single-viewer
+ownership remain unchanged. The web viewer stays on upstream **0.36.3**, with
+one reproducible, hash-checked source patch. The archived 0.34.1 fork is not
+reactivated. No second camera/renderer, pointer injection or HTTP request per
+gesture is introduced.
+
+## Camera contract
+
+- The native orbital pivot lies on the native `LineGrid3D` plane (XY in the
+  product's world frame). Pan translates the whole camera rig along that plane;
+  orbital rotation leaves the pivot fixed. Scene changes cannot choose a new
+  pivot after operator navigation. The guide grid is not a measured terrain model.
+- Initial fallback height is projected before rendering, not at the start of
+  the first rotation. Active interpolation stops on manual navigation.
+- Zoom changes distance to the pivot. The scene-diagonal zoom-out cap is removed.
+  Upstream's 0.02 m collision-with-pivot guard and a finite 1e17 arithmetic guard
+  remain; these are not route-distance limits. Passing through the pivot would
+  reverse orbital direction, so it is deliberately not implemented.
+- Explicit tracking remains distinct from fixed-pivot inspection. While following,
+  Rerun may move the target with the tracked entity. First-person movement keeps
+  upstream behavior. Reset and plan/3D switches remain explicit preset actions.
+- A read-only native snapshot supplies the last rendered eye to the existing
+  iframe facade. The approximate DOM-input camera journal is removed. Snapshots
+  cross the disposable iframe as copied primitive JSON only; no native handle or
+  listener escapes its lifetime. With no rendered 3D frame, the snapshot is null.
+- Display-only blueprint activation carries that actual native eye. Omitting
+  eye fields resurrects the incoming store's startup camera, as reproduced in
+  browser QA; stable view identity alone is insufficient. This is one snapshot
+  per settings update, not a second input controller or HTTP per gesture.
+- Mission Core admits one active spatial pane per iframe. The snapshot selects
+  the last rendered spatial state of the active recording, ignoring retained
+  states from earlier views. Multiple simultaneous 3D panes would require an
+  explicit view-id argument before that product composition is admitted.
+
+## Build, upgrade and rollback
+
+`vendor/rerun-web-viewer-0.36.3/NODEDC_NAVIGATION.patch` is applied to the pinned
+upstream commit. `scripts/build-rerun-navigation.sh` runs in a bounded temporary
+Worker006 container, not on the 18 GB operator Mac. It tests native camera math,
+uses Rerun's own release/WebAssembly builder and matching JS transformation,
+and emits the paired runtime and declarations. No scanner data enters the build.
+
+`navigation-build.json` binds upstream, source patch, compiler image and artifact
+hashes. The installer validates every input before modifying any package file,
+and rejects an unfamiliar SDK version or wrapper. Fresh installs and production
+builds use that same installer once the candidate is accepted.
+
+An upgrade requires rebasing this patch, native tests, JS/WASM ABI checks,
+frontend contracts and real-browser navigation/regression QA. Do not copy the
+old WASM into a newer SDK. To roll back, disable the installer hooks and restore
+the exact official 0.36.3 package; the facade treats a missing native snapshot as
+unavailable, never fabricates an operator eye. Raw/corrected recordings do not
+need to be regenerated.
+
+## Acceptance
+
+Required: plane/pan/orbit/zoom invariants, different grid plane, top-down and
+first-person regression; exact native snapshot and realm cleanup; normal and
+expanded product views, Escape, explicit reset, layers/point-size updates and
+follow transitions. A successful compile alone is not product acceptance.
+
+The accepted full-fidelity cloud and 30-minute accumulation are outside this
+navigation patch and must not be reduced to make testing cheaper.

docs/audits/2026-09-21-corrected-session-default.md

@@ -0,0 +1,106 @@
+# Corrected session as the operator and laboratory default
+
+## Decision and product surface
+
+Owner direction supersedes the earlier *view-only* admission in
+`2026-09-21-map-comparison-view.md`: an explicitly reviewed correction becomes
+the ordinary representation of the same physical session in Data, and the
+default reference when that recording is selected for a new planner study.
+Original evidence stays immutable and available in Information → comparison.
+
+This is domain content in an admitted composition (class A), not a new catalog
+row, root, workspace, solver or viewer. Rejected alternatives: duplicating the
+capture under another name, and connecting only the bounded preview while the
+planner still consumes original geometry. Canonical SegmentedControl,
+RangeControl and LoadingRegion remain the only UI primitives used here.
+
+States: no activated correction → original; activated correction → corrected;
+missing/corrupt selected correction → explicit error, never silent original
+fallback. Comparison is an optional inspector control, not a different default
+policy. Initial overview geometry remains hidden until the selected
+representation is applied. Version and clipping changes retain the viewer and
+camera; only explicit camera controls reset the view.
+
+## Architecture and source ownership
+
+`SessionMapVersions` stores immutable complete bundles in application data and
+atomically selects one generation for each physical session. Activation is an
+explicit offline operation after review, not automatic acceptance of any
+solver output. `activate_session_map.py` verifies the original transport,
+index, frozen clock and origin before admission. The pointer grants only
+recorded playback and laboratory reference use. It cannot authorize movement.
+
+Data uses `MapReplaySessionStore`, a read-only playback facade over the real
+catalog. `ReplayCommand.map_version` pins the geometry generation before work
+is queued. Native capture confinement remains unchanged; three separately
+verified projection inputs (manifest, complete points, trajectory) extend the
+preparation/cache identity. A raw ready-job cannot satisfy a corrected launch.
+The existing single background worker and seekable RRD path are reused.
+
+The K1 exporter reads the exact corrected cloud frame and corrected pose,
+including orientation, at the corresponding original receipt time. The raw
+capture clock, duration, media and event sequence are unchanged. Map timestamps
+are relative to the first raw message, not the first pose or capture start.
+All cloud/pose ownership is checked before publication. The normal operator
+RRD's existing temporal display sampling is retained; no 180k-point preview is
+substituted for playback or registration data. Point-color overlays use the
+same corrected positions and preserve observation count/order. Uncorrected
+perception overlays are rejected instead of mixing two spatial frames.
+
+New planner selections resolve through `DefaultPlanningSources.get`, retaining
+the physical session's name. Existing studies resolve their pinned generation
+through `bound`/`verify`: old studies retain original geometry, and corrected
+studies use their immutable map even if the default later changes. The full
+map and trajectory feed the existing reference extraction/preparation. No
+registration acceptance thresholds or search rules were weakened.
+
+Planner preview requests also carry the reference generation. An existing
+original study must not display a newly corrected default as its old reference.
+Information retains both representations and original acquisition metrics.
+
+## Scope and verification
+
+Original capture bytes and the previously reviewed correction/solver seal are
+unchanged. The correction remains a regularized estimate validated against
+this capture, not independent proof of positioning accuracy. Admission is
+for the next supervised scanner experiment, not rover movement.
+
+### Acceptance completed
+
+- Frontend architecture checks, typecheck, all 885 frontend tests, and the
+  production build passed sequentially. Focused Python suites passed: the
+  162-test integration selection, the 70-test overview/API/live-planning
+  selection, and the final 31-test recording/exporter-capability selection
+  (these selections overlap; their counts are not additive).
+- Synthetic coverage verifies durable activation, historical generation pins,
+  fail-closed missing/corrupt defaults, native path confinement, source digest
+  ownership, corrected frame/pose projection, and unchanged replay timing.
+- The reviewed full correction was explicitly activated in application data;
+  no physical session was duplicated, and no original capture was modified.
+  Canonical source lookup now returns the same selected map generation as
+  recorded playback and the Information comparison.
+- Actual operator RRD inspection matched all 1,036 displayed cloud frames to
+  their complete-map counterparts and all 5,182 poses/orientations to the
+  corrected trajectory. Original timing (597.439503125 seconds) and media
+  timing remain unchanged. The ordinary operator display sampling is retained.
+- Isolated full-route planner preparation used the selected corrected source,
+  produced 15 reference tiles and 694,420 voxel points, and verified all 5,182
+  trajectory poses across approximately 579.98 metres. It did not persist a
+  real study, issue device commands, or grant vehicle-control authority.
+- Browser acceptance on canonical port 8000: ordinary recording-name selection
+  opens playback; Information initially selects Corrected; Original/Corrected
+  switching works; window restore/expand works and Escape closes Information.
+  A new planner selection of the same ordinary name displays Corrected and
+  579.98 metres. Selecting Whole trajectory includes all 5,182 positions.
+  No browser console errors were reported during this acceptance.
+- One canonical backend remains listening on 8000; no backend listens on 8765.
+
+### Next supervised experiment
+
+Use a **new** planner study, the ordinary physical recording name, and **Whole
+trajectory** so the reference includes both sides of the closure. Existing
+studies deliberately retain their pinned generation. Try several stationary
+initializations near the seam, including offset positions, then short walks
+through it after tracking is confirmed. Inspect those runs before extending to
+kilometre-scale routes. This admission is not an independent measurement of
+localization accuracy or autonomous-driving readiness.

docs/audits/2026-09-21-full-route-search-fix.md

@@ -0,0 +1,118 @@
+# Complete route search before provisional localization
+
+## Decision and scope
+
+Owner-approved follow-up to the [entry/seam audit](2026-09-21-ring-entry-and-seam-review.md).
+Fix cold-start search scheduling, retain the precise start-area solver and all
+geometric/fresh-data gates. No device commands, threshold relaxation, map
+correction changes, endpoint snapping or retroactive edit of the failed study.
+
+`route-relocalization/v7` compares the complete selected route before choosing a
+provisional place. A finite hypothesis queue replaces the shared 35-second
+deadline. `stationary-fresh-bootstrap/v4` separates search geometry from current
+localization evidence; an old prefix can never establish tracking directly.
+
+## Algorithm and boundaries
+
+1. Collect the existing 10-second stationary prefix.
+2. Run all 108 established dense-start seeds at the start/last confirmed hint.
+   Keep a qualified dense candidate, but do not accept it before route comparison.
+   A missing local start target does not prohibit searching the remaining map.
+3. Index the complete reference and rank all geometrically usable route anchors,
+   spaced by the existing 5-m policy. Ranking changes order, never eligibility.
+4. At each anchor, test the existing three yaw proposals with two translations:
+   sensor entry to route anchor, and the former cloud-median placement. One
+   prepared local target tree is shared by all six fits. No atlas density cap
+   or new thinning is introduced.
+5. Compare the resulting SE(3) clusters together with the dense-start candidate.
+   A distinct similarly good place remains ambiguous; first passing fit is not
+   accepted. A failed fresh trial can advance to the next unambiguous candidate,
+   with a new receipt fence and no reused validation data.
+6. During search, continue checking source identity/order, receipt segment,
+   pose/cloud freshness and stationary translation (existing 0.10-m envelope).
+   Movement or broken input invalidates the hypothesis. The existing 40-second
+   prefix-age fence remains for the legacy local protocol, not for v7's explicitly
+   monitored stationary whole-route search.
+7. After the result arrives, discard all pre-result receipts for confirmation.
+   Three consistent fresh geometric checks remain mandatory before tracking.
+   Ordinary tracking, local reference extraction, quality thresholds and the
+   8-second fresh-result gate are unchanged.
+
+The numerical child emits progress after individual work units. The supervisor
+allows arbitrary total search duration while work advances; 60 seconds with no
+progress is a **worker stall**, not evidence that the location is unknown.
+STOP, source end, moved-search cancellation and teardown terminate/reap that
+exact child. A queued operator retry waits for its release and starts with a new
+prefix. Recording remains owned by the device plugin.
+
+The candidate queue stays in one worker across scheduling batches; this is not
+a durable checkpoint/resume facility after a process crash. A failed worker
+returns incomplete search and offers reinitialization without stopping recording.
+Operator copy uses the existing status surface under the product UI canon.
+
+## Real saved-input regressions
+
+Same immutable run `473870e0-5210-452c-b9e4-9d7937e93646`, query
+`20260921T103511Z_viewer_live`, corrected full reference
+`JA-STROITEL-SUN-RING · correction v2`, 579.98 m / 694,420 points.
+Only original initialization arrays enter the production worker. No end pose,
+later successful transform, manually selected anchor or offline deadline override.
+One CPU worker at a time; numerical thread counts fixed to one.
+
+| Original attempt | New result | Surface overlap | Inlier RMSE | Worker wall |
+| --- | --- | --- | --- | --- |
+| First, failed cold start near route end | Candidate at anchor 113 / 565 m | 98.8467% | 0.14330 m | 138.58 s |
+| Second, familiar start | Candidate at start | 98.7191% | 0.13466 m | 156.52 s |
+
+Both searches completed 810/810 fits: 108 dense + 117 anchors × 3 yaws × 2 seeds.
+No remaining route anchors; no competing qualified location close enough to
+trigger ambiguity. The second case retained the dense-start solution rather
+than degrading its target geometry.
+
+All 159 files of the original saved study were hashed before/after each replay
+and remained unchanged. Raw evidence and generated arrays/results remain in the
+ignored private `2026-09-21-full-route-fix` audit directory. The earlier study
+still truthfully records its failed first initialization.
+
+## Validation and review
+
+- 121 focused backend tests passed: route coverage, last-ranked candidate,
+  dense/global competition, median-seed regression, anchor-origin placement,
+  multi-minute search, stationary continuity, distinct fresh windows, stale and
+  ambiguous rejection, live recovery, cancellation, same-recording retry,
+  child stall/forced cleanup and corrected-map source admission.
+- Focused Ruff and `git diff --check` passed.
+- Replacing median placement outright failed the existing lateral-offset GICP
+  regression; therefore both initializations are retained. No quality threshold
+  was weakened to make that test pass.
+- Registration/correction producer files and reference generations are unchanged.
+- Application architecture checks, TypeScript, all 887 frontend tests and the
+  production build passed sequentially. Only the existing large-chunk build
+  warning remains. Normal/expanded planner, latest ring evidence and Escape menu
+  dismissal were checked in the existing in-app browser; no live state was faked.
+- With acquisition idle and the old study completed, the canonical LaunchAgent
+  was restarted. Health/liveness passed on the sole port-8000 backend (PID 64086);
+  no backend on 8765 and no temporary search/test workers remain. New captures
+  use v7; the old report continues to expose its original v6 evidence.
+
+## Limitations and next field acceptance
+
+Completeness is relative to the declared finite anchor/yaw/seed policy, not a
+mathematical proof that every pose in continuous space was searched. Descriptor
+ranking remains imperfect; queue completeness prevents a low rank from excluding
+the real place, but is not a fast kilometer-scale place-recognition index.
+
+Full comparison increases even familiar-start latency to roughly 2–3 minutes on
+this 580-m map. This is an explicit regression in speed, accepted here for complete
+comparison, not a claim of final optimization. Target preprocessing is reused;
+safe coarse-to-fine acceleration still needs independent evidence.
+
+Offline replay proves the corrected numerical cold-start outcome, **not** live
+stationary continuity or independent absolute pose accuracy. Synthetic tests
+prove the temporal contract; the operator must confirm it on a new capture.
+Surface overlap/RMSE are not position accuracy or autonomous-driving acceptance.
+
+Field check: start at the formerly rejected place (last point of the old pass),
+leave the scanner stationary through search and fresh confirmation, then walk
+20–30 m across the seam and back. Record the time to tracking and any interruption.
+No longer route is needed to answer this regression question.

docs/audits/2026-09-21-large-ring-offline-qualification.md

@@ -0,0 +1,244 @@
+# Large-ring offline qualification — 21 September 2026
+
+## Scope and retained authority
+
+The owner supplied `JA-STROITEL-SUN-RING-002`, session
+`20260921T134309Z_viewer_live`, and requested source, drift, correction and
+offline-localization testing without another physical capture. The finish was
+approximately 3–5 m beyond the physical start. Endpoint equality is therefore
+specifically prohibited as a fitting constraint.
+
+All geometry, detailed results, scripts and SHA-256 inventories are private under
+`.runtime/audits/2026-09-21-large-ring-002/`. No hardware command, source overwrite,
+map activation, planner mutation, production-code edit, service restart or motor
+authority is part of this audit. Earlier unrelated uncommitted work is retained.
+
+## Source acceptance
+
+- Saved capture: 1,446.684 s; catalog and RRD preparation are ready.
+- Spatial trajectory: 1,595.409 m over 1,362.429 s of pose receipts.
+- 13,608 cloud frames, 13,624 poses, 49,217,854 decoded points.
+- All 31,450 metadata records cover the complete 573,728,851-byte transport.
+- Every payload SHA-256, topic, length and frame offset was checked against
+  metadata: 31,450/31,450 agree, zero mismatches.
+- Transport SHA-256 agrees with its capture manifest. Cloud/pose sequences have
+  no missing numbers or resets; decoded geometry and receipt order are valid.
+- No capture reconnect, rejected transport message or recovery gap. Maximum
+  cloud receipt gap is 1.344 s; maximum pose receipt gap is 1.189 s.
+- No pose discontinuity under the existing live criterion; largest successive
+  position step is 0.1515 m. Single-receipt speed is not physical velocity:
+  transport bursts compress receipt intervals. Five-second travel averages
+  reach 1.501 m/s. Hardware synchronization is not established by these checks.
+- Nearest pose-to-cloud receipt gap: p95 42.7 ms, maximum 180.8 ms. These are
+  host-clock observations, not per-point LiDAR firing-time reconstruction.
+
+The raw endpoint displacement is 4.000 m horizontally and +1.5875 m vertically,
+4.3034 m in 3D. This includes real operator displacement and is NOT a surveyed
+drift measurement. The corrected result must retain the real overshoot.
+
+The control-plane acquisition ended with
+`acquisition.stop.accepted_physical_outcome_unknown`, cleanup pending false.
+This is a separate physical-stop confirmation issue. The receiver reports
+`external_stop`, no transport error, and the saved recording is ready; do not
+misreport that control state as corruption of the completed cloud.
+
+## Existing recipe failure and diagnostic variant
+
+The unchanged `recorded-ring-experiment/v1` recipe stopped before producing a
+correction. Its first-20-s/last-5-s fit converged: overlap 95.317%, inlier RMSE
+0.1641 m, correction at the patch center 4.2176 m / 2.6199 degrees. Rejection was
+solely the ordinary local-tracking correction guard of 3 m.
+
+Merely changing that guard is insufficient. Four disjoint five-second tail
+probes using the existing coarse acquisition policy failed the unchanged
+bidirectional-consistency gate. The first fit's cycle was 0.0280 m / 0.6007
+degrees, against the existing 0.1 m / 0.2-degree limits.
+
+A declared training-only grid of first windows [10, 20, 40] s and last windows
+[10, 20, 30] s was evaluated without using withheld frames. Two of nine passed
+the existing quality and cycle gates: 20/30 and 40/30. The larger 40/30 support
+was selected before held-out evaluation. It yields 72.777% overlap, 0.1875 m
+inlier RMSE and a 0.0194 m / 0.0973-degree bidirectional cycle. Its lower overlap
+reflects a different, larger point population; it is not comparable to the
+short-window 95% as an identical-denominator score.
+
+This private adapter uses the already defined route-acquisition registration
+policy for the first coarse seam fit only. Ordinary local registration,
+shape/information gates, overlap/RMSE thresholds, reverse consistency, solver and
+validation policy remain unchanged. Production modules were not patched.
+
+All 80 attempted neighboring-window links failed overlap and RMSE gates; ten
+also failed convergence. None was admitted. The reconstruction is therefore
+one measured closure plus a smoothness prior, NOT recovery of a densely
+measured drift history. The input is K1 mapped increments, not native LiDAR
+sweeps from which a new independent SLAM solution was reconstructed.
+
+## Frozen candidate and held-out evaluation
+
+The existing `smooth-map-correction-experiment/v2` spline solver and full-frame
+materializer produced a separate experimental candidate. Every ten seconds,
+the two-second phase 4–6 interval was withheld: 2,855 frames, with 10,753 retained
+for fitting. Shared upstream K1 mapping means this split is not independent
+survey truth, despite disjoint frame membership.
+
+| Measurement | Original | Diagnostic corrected candidate |
+| --- | ---: | ---: |
+| Local held-out windows accepted | 134/136 | 136/136 |
+| Median local overlap, 0.5 m radius | 98.077% | 98.081% |
+| Median local inlier RMSE | 0.16495 m | 0.16563 m |
+| Cross-visit held-out overlap | 22.723% | 95.093% |
+| Cross-visit median all-point distance | 1.2018 m | 0.1186 m |
+| Cross-visit p95 all-point distance | 2.5941 m | 0.4914 m |
+| Endpoint XY separation | 4.000 m | 2.801 m |
+| Endpoint Z difference | +1.5875 m | −0.0112 m |
+| Trajectory length | 1,595.409 m | 1,599.807 m |
+
+Cross-visit evaluation fixes the same 7,499 source points in 18 held-out tail
+frames, compares them only to retained first-20-s geometry, and performs no
+additional fit. Those query frames did not enter closure selection or fitting.
+The source and corrected failed-window checks use the same frozen priors;
+fresh one-second halves in original failure groups 74 and 120 all qualify.
+
+The remaining 2.8 m endpoint separation is compatible with, but does not survey,
+the operator's 3–5 m overshoot. Near-zero endpoint Z is not centimetre absolute
+accuracy. A fit between coincident-looking endpoints was never imposed.
+
+Maximum trajectory displacement is 8.164 m, maximum displacement gradient
+0.04123 m per travelled metre (p95 0.03768). Changing regularizer strength by
+0.5×/2× changes trajectory positions by at most 0.009 mm; this is numerical
+prior stability, NOT proof of the actual spatial distribution of drift.
+Using the other qualifying 20/30-second closure measurement instead changes
+the corrected trajectory by up to 0.2483 m (p95 0.2262 m). This measurement-window
+sensitivity is materially larger than regularizer sensitivity and is retained
+as model uncertainty, not hidden by the visually closed seam.
+
+All 49,217,854 materialized points and all 13,624 corrected poses were reproduced
+from the frozen field. Within-frame motion is rigid. Maximum coordinate
+serialization error is 0.0306 mm; sampled intra-frame pair-distance error is
+0.0601 mm. No count, intensity, frame order or raw source was discarded.
+
+## Independent archived passes and complete-route search
+
+The production versioned-map extractor and tiled reference builder were reused
+through a private adapter, not through an admitted catalog generation. The
+whole route yields 1,924,498 original and 1,940,166 corrected registration
+points. Preparation took 25.48 / 26.67 s. No 30 m crop or whole-map point-count
+cap was introduced. Presentation's 80 m envelope is not the local numerical
+matching profile.
+
+The first independent query is the original cold prefix from study
+`473870e0-5210-452c-b9e4-9d7937e93646`, captured in a different session. Only its
+original query points and sensor origin are loaded, not its old reference or
+accepted transform. Full production v7 search tests all 2,034 fits: 108 dense
+start hypotheses and 1,926 route hypotheses.
+
+| Same independent cold input | Original atlas | Corrected atlas |
+| --- | ---: | ---: |
+| Complete search | 2,034/2,034 | 2,034/2,034 |
+| Result | Candidate | Candidate |
+| Time | 320.41 s | 317.07 s |
+| Overlap | 98.899% | 98.978% |
+| Inlier RMSE | 0.1493 m | 0.1449 m |
+
+This does not demonstrate a material speedup or inability to localize against
+the original. Correction's demonstrated benefit is cross-visit map agreement.
+
+The corrected atlas then accepts all 29 stored fresh snapshots over the
+101.633 m independent walk using a causal previous-accepted-transform chain.
+Overlap is 98.546–99.823%, inlier RMSE 0.1181–0.1501 m; measured local calculation
+time is 0.073–0.105 s. Real recorded request/receipt clocks are retained; measured
+rerun calculation duration is substituted. This is an archived-snapshot replay,
+NOT a live ingress, camera, scheduler, motion-stationarity or recovery test.
+
+The original atlas also accepts all 29 snapshots of that short pass. Thus this
+test proves compatibility of the corrected version, not a general superiority
+claim for every metric.
+
+A second independent cold prefix from study
+`0324337e-b590-4561-b19a-8fbc7835b888` also qualifies after all 2,034 fits:
+352.94 s, 99.108% overlap, 0.1438 m inlier RMSE. Replaying its entire old smaller
+ring against the new larger one is **not all-positive**: 30/101 snapshots qualify,
+with first rejection at 132.265 m. Reference-path proximity under the last
+accepted transform grows from 12.2 m at the last positive window to 18.2 m at
+first rejection, then approximately 72 m. This supports a different-route /
+out-of-localization-coverage explanation, not a claim that the two rings cover
+the same corridor. It is not ground truth during the lost interval.
+
+Near the old pass's return to the shared area, overlap again reaches 99.25–99.64%
+and inlier RMSE about 0.139 m, but correcting the obsolete local prior requires
+3.15–3.20 m and is correctly rejected by ordinary tracking policy. This replay
+deliberately has no complete recovery/bootstrap state machine. It neither proves
+nor disproves physical reinitialization after returning; a fresh stationary
+relocalization is a separate operation, not continued green tracking on the old
+hint. The original and failed cases are retained in full.
+
+The middle-route probe selects held-out time group 68 without looking for a
+favorable fit: source progress 794.812 m, 11,625 query points. All 2,855 held-out
+frames are excluded from the atlas; query coordinates are translated to a new
+origin and rotated 90 degrees. The generating correction is used only to
+measure post-fit model consistency, never as the search seed.
+
+Complete search qualifies after 2,034/2,034 fits in 452.16 s: overlap 98.545%,
+inlier RMSE 0.1625 m, selected retrieval anchor at 800 m. Fitted sensor position
+is 0.0461 m from the generating model, NOT surveyed truth. This is a same-source
+numeric place-retrieval test with shared upstream K1 mapping. The source query
+spans 3.804 m of motion; it is explicitly not a valid stationary bootstrap
+prefix and must not be presented as live cold-start acceptance at the midpoint.
+
+In total, four complete cold numerical searches performed 8,136 fits. Runtime
+on this Mac ranges from 5.28 to 7.54 minutes. These are measured functional
+experiments, not a stress test or a guarantee for larger routes or the onboard
+computer. The full finite queue and ambiguity checks remain intact.
+
+## Negative controls and software regressions
+
+On real query geometry, local initial-X perturbations 0/1 m converge; 3 m is
+rejected by the unchanged correction guard; 5/10/20 m fail numeric-quality
+criteria and 1,000 m has no target coverage. These are software initial-guess
+perturbations, NOT physical scanner-displacement acceptance. Full-route search
+is a different operation and is not restricted by those local outcomes.
+
+The fixed halfway wrong-region comparison is rejected on surface RMSE.
+Applying real positive geometry with future, nine-second-old or prior-segment
+receipt metadata is rejected in all three cases. Zero false confirmations in
+this small set is not a false-acceptance-rate estimate.
+
+All 178 focused software regressions pass: correction, registration, full-route
+coverage/ambiguity/worker ownership, bootstrap freshness, recovery, replay,
+live lifetime/multiple traversals, reference preparation and map-version/default
+boundaries. A pre-existing Starlette/httpx deprecation warning remains. These
+fixtures do not constitute physical multi-lap or onboard-computer acceptance.
+
+## Decision boundary
+
+The data support an experimental correction of this larger loop without
+forcing the real endpoints together. The existing automatic recipe is NOT
+qualified unchanged: seam acquisition and window-support selection require a
+separate production change. Do not lower tracking-quality gates to conceal
+that distinction.
+
+Not proven: independent repeat accuracy throughout the newly added territory,
+absolute map/pose error, correct internal drift distribution, arbitrary-loop
+discovery, seasonal transfer, simultaneous live latency, target-board budget,
+physical multiple laps, navigation safety or motor authority. No further live
+scanner trial is needed to reproduce the present offline evidence.
+
+The next production increment should separate offline closure acquisition from
+local tracking correction, qualify window-support selection and preserve the
+measured quality/cycle/holdout gates. Do not ship the experiment by silently
+changing the global live 3 m guard or forcing final coordinates onto the start.
+Only after that separate change and versioned admission should the candidate
+be offered as the recording's corrected default. The current default is not
+changed by this audit.
+
+## Runtime and final evidence seal
+
+Heavy checks ran sequentially with a single numerical worker on the operator
+Mac; no stress workload or second application server was introduced. The final
+seal verifies 311 input files unchanged and inventories 62 private artifacts.
+The only non-ignored repository addition from this audit is this report.
+Production modules, original experiment scripts and raw capture remain intact.
+
+The canonical service remains the same PID 73593 on port 8000. Final health is
+operational with zero consecutive reconciler failures; no temporary audit/search
+worker or port-8765 listener remains. No restart or hardware action was taken.

docs/audits/2026-09-21-map-comparison-view.md

@@ -0,0 +1,92 @@
+# Corrected map comparison — view-only admission
+
+## Product surface brief
+
+Operator job: inspect the recorded ring before and after reviewed correction,
+with identical observations, colors, clipping and camera. Primary entity remains
+the physical recording; correction is a separate derived representation.
+
+Placement: Data → Sessions and recordings → selected source → Information.
+Extend the admitted overview with a canonical `SegmentedControl` labelled
+“Версия облака”: “Исходное / Исправленное”. This is domain content inside an
+existing composition (class A), not a new workspace, LAB or product root.
+Rejected: adding another catalog session (would impersonate a physical capture),
+or a separate experiment viewer (duplicates camera/lifecycle controls).
+The planner's source preview does not enable comparison and remains original.
+
+States: no admitted pair → ordinary original overview; available pair → explicit
+version choice; pending update → retain previous view with an updating label;
+failure → retain previous view with visible error, never silently label original
+geometry as corrected. Source changes invalidate access. The information panel
+explicitly refers to original capture metrics in both modes.
+
+## Identity, geometry and authority
+
+`overview_comparison.py` publishes a content-addressed, bounded paired geometry
+bundle outside the raw session catalog. Its manifest binds original session ID,
+overview generation, raw artifact digests and reviewed map generation. An atomic
+pointer selects an explicitly published pair; requests pin that pair, rather than
+following subsequent publications. No HTTP filesystem path input or mutation API.
+
+The offline producer verifies the admitted map, its packaging receipt, frozen
+decoded-cache seal, original transport/clocks, frame/pose ownership and current
+overview. It then samples identical point and pose indices in both geometries.
+The preview policy is at most 180,000 points and 20,000 poses, uniformly across
+the complete capture including endpoints. These are viewer resource budgets,
+not route-distance, acquisition, correction or localization limits. Full
+resolution corrected and original files remain unchanged. The preview is not a
+ground-truth accuracy measurement or a new live reference.
+
+## Rerun lifetime
+
+One original RRD supplies stable application/recording identity. Updates replace
+only `/world/cloud`, `/world/route` and `/world/endpoints` through the existing
+channel. No new recording, viewer mount, blueprint or camera journal update on
+version or clip change. Explicit Top/3D commands may change the camera; both
+representations use common bounds. Height controls start unclipped, with maximum
+at least 80 m. Paired observation colors are computed once conceptually from
+original heights, so a color shift cannot masquerade as geometry correction.
+
+No Rerun fork customization, solver modification, source-session mutation,
+reference promotion, vehicle authority, or frontend root change is introduced.
+
+## Acceptance
+
+- Python: 78 focused tests passed across overview/comparison, candidate admission,
+  packaging, reference preparation, planner, correction and registration. The
+  17 overview/comparison tests were rerun after formatting and passed. Coverage
+  includes exact source/generation binding, hash corruption, symlinks, path
+  traversal, missing version (409 rather than raw fallback), shared RRD identity,
+  route/endpoints replacement, unchanged colors, reversible clipping, and no
+  camera blueprint on representation changes.
+- Frontend: architecture gate, full typecheck, all 884 unit tests and production
+  build passed. After the final footer-only adjustment, architecture + both
+  overview test files (9 tests), typecheck and production build passed again.
+- Ruff and `git diff --check` passed. Existing Vite large-chunk and Starlette
+  httpx deprecation warnings remain; no dependency change was made for them.
+- The real recorded ring was admitted as a view-only pair: 180,000 identical
+  point indices, all 5,182 poses, original 579.797271 m and corrected 579.982703 m.
+  Full-resolution original and corrected clouds remain intact. Private manifest
+  and generation identities live under runtime evidence, not the session catalog.
+- Canonical API accepted the pair after restart. IAB visually displayed original
+  and corrected versions, Top/3D, and height clipping at 5 m then full 80 m.
+  A manually rotated view remained stable on toggling. Normal/expanded workspace
+  modes preserved version and clipping; Escape closed the information view.
+- Final-build viewport geometry was identical before/after comparison switching:
+  308.828125 × 311.78125 CSS pixels at the same coordinates on the narrow IAB.
+  The footer uses common copy to avoid changing viewer height with the version.
+  Desktop 1440 × 1000 QA override was reset. The corrected real case remains
+  open in the canonical IAB; no alternative server or extra viewer was started.
+- Resource gate: memory free percentage 40–49%; builds, tests, materialization
+  and browser work ran sequentially. Docker Desktop was not started.
+- Ops reporting remains pending: direct `tasker_get_agent_instructions` and
+  `tasker_list_projects` both timed out after 60 seconds. No card ID was guessed,
+  no duplicate card or substitute API write was used. This report preserves the
+  implementation/acceptance record for the existing card when Ops is reachable.
+
+## Decision and remaining boundary
+
+The candidate can now be inspected in the product. That does not admit it for
+live localization or autonomous movement. No new scan is necessary just to
+compare the two representations. A corrected-reference replay and independent
+repeat capture remain separate acceptance stages, not proved by this viewer.

docs/audits/2026-09-21-map-reference-version-admission.md

@@ -0,0 +1,117 @@
+# Explicit map-reference version admission
+
+## Outcome and boundary
+
+The reviewed smooth ring correction now has a separately sealed, content-addressed
+map bundle and an **offline** adapter to the existing planning-source interface.
+The whole corrected route was assembled by the unchanged `build_reference_map`
+consumer. This is data-path admission, not independent localization acceptance.
+
+The adapter is deliberately not installed in the web composition. No source
+session, active reference, stored draft, live run, matcher policy or viewer was
+changed. The ordinary `get(session_id)` still returns the original source; a
+candidate requires its exact derivative generation. Nothing chooses “latest”.
+
+The next integration must add an explicit version choice and matching corrected
+preview in the existing planner. Selecting a corrected trajectory while showing
+the raw session's overview would be a contract error. Live field instructions
+are deferred until that coherent selection/preview path is verified.
+
+## Implementation and provenance
+
+- `reconstruction/map_version.py` owns `missioncore.map-reference-version/v1`,
+  full artifact hashing, exclusive staging, idempotent publication and projections.
+  It has no SciPy, device-plugin, session-store, viewer or hardware dependency.
+- `missions/versioned_sources.py` composes the original provider with one explicitly
+  pinned candidate. A source generation/digest mismatch or artifact corruption
+  fails closed; it never falls back to different geometry under the same identity.
+- `experiments/package_recorded_map_version.py` is the bounded K1 experiment
+  adapter. It reads the canonical source API and checks native transport, receipt
+  index, frozen capture clock and origin. It never imports or writes the web app.
+- A reviewed evidence-seal SHA binds the original experiment code, correction,
+  geometry and measured reports. Packaging adds its own producer/contract hashes
+  and frame-reproduction receipt without rewriting those reports.
+
+The bundle preserves full-resolution corrected XYZ, unchanged cached intensities,
+pose orientations, original frame offsets/counts/sequences and receipt chronology.
+Its manifest binds the original physical session, source generation and every
+source-artifact digest. Separate map frame identity prevents confusing corrected
+coordinates with the raw scanner frame.
+
+The trajectory contract explicitly distinguishes `source_distance_m` (the smooth
+field's original traversal parameter) from recomputed corrected `distance_m`.
+Drafts and route tiling consume the latter. No first/last pose equality is added.
+
+Multi-tile preparation uses one verified private bundle snapshot and checks the
+original and derivative again before the complete map may be returned. Failure,
+cancellation and exceptions clean only that temporary snapshot. Existing source
+evidence and earlier versions remain untouched.
+
+## Measured execution
+
+On the existing ring, all **5,178 full-resolution cloud frames / 17,669,672 points**
+were reproduced from the frozen correction field and compared bit-for-bit after
+float32 serialization. All **5,182 corrected positions and orientations** were
+checked, as were source pose indices, distances and receipt times.
+
+The canonical source generation remained unchanged. The original trajectory is
+579.797271 m; the corrected trajectory is 579.982703 m. The existing reference-map
+builder assembled 15 route tiles and 694,420 voxel-retained registration points.
+The packaging plus full-route assembly check took 10.36 seconds on the local CPU.
+This is one measured execution, not a throughput benchmark or a scalability claim.
+
+The source/model fidelity and held-out registration findings remain those in
+`2026-09-21-smooth-map-correction.md`; packaging did not refit or remeasure them.
+The full candidate map includes all source frames. Its assembly therefore must
+not be reported as an additional held-out localization score.
+
+Extraction has a declared, separate numerical profile (120 uniformly selected
+frames per interval, 0.25 m voxel, 20 m radius and relative height −3…6 m), matching
+the current recorded reference extraction settings. Presentation uses an 80 m
+radius and no vertical crop. These are derived preparation profiles, not raw
+capture limits, and the full stored bundle is not thinned. Convergence,
+loss/recovery, quality thresholds and acquisition remain unchanged.
+
+## Validation and limitations
+
+Tests cover idempotency, separate source/version generations and draft geometry,
+corrected distance calculation, raw default selection, source/frame ownership,
+no second cloud transform, presentation/numerical separation, every artifact's
+hash, wrong parent, unsafe paths/symlinks, nonfinite data, bad frame indices,
+invalid quaternions, cancellation, exception cleanup and changes during assembly.
+
+The focused suite passed **61 tests**, including the existing source preparation,
+draft and registration regressions and the correction solver tests. Ruff and
+diff whitespace checks passed. Frontend code/build and web composition were not
+changed or restarted for this offline increment.
+
+The packaging adapter initially rejected the real source because its provisional
+mapping swapped capture-clock and receipt-index artifact names. Inspection of
+the plugin's actual source contract corrected that mapping; a dedicated regression
+now checks the frozen capture clock separately from the mutable current timeline.
+No recorded bytes or source metadata were changed to make admission pass.
+
+The original correction still has only one accepted closure and a smoothness
+prior. Same-source held-out tests do not establish independent positioning truth,
+and numerical GICP sensitivity remains an open issue. No new field acceptance,
+automatic arbitrary-loop discovery, online SLAM replacement or navigation/safety
+authority is claimed.
+
+## Ops and local runtime
+
+Ops access instructions, granted projects and Mission Core project context respond.
+Card discovery did not recover: a full list and searches for `planning` and `кольц`
+each timed out after 60 seconds. The earlier `совмещение` search returned no rows.
+No issue was guessed, duplicated or overwritten, and no raw-API fallback was used.
+The structured engineering update remains pending card access.
+
+Local memory was 39% free before the sequential checks; no Docker workload or
+parallel heavy validation ran. The canonical operator service on 8000 was retained.
+The package and detailed private receipt remain under ignored `.runtime/analysis`.
+# Subsequent view-only admission
+
+The same reviewed candidate is now available for explicit Original/Corrected
+comparison in the existing session overview. See
+`2026-09-21-map-comparison-view.md` for the separate paired-preview contract,
+source identity checks, UI placement and acceptance. This does not change the
+reference-promotion or independent-validation boundaries documented below.

docs/audits/2026-09-21-native-rerun-navigation.md

@@ -0,0 +1,96 @@
+# Native Rerun navigation · 2026-09-21
+
+## Scope
+
+The owner accepted the recorded cloud quality and asked to finish navigation.
+No scanner command, recording rewrite, cloud decimation, color change or matching
+algorithm change belongs to this increment. OPS receives the final result only
+after completion, per the owner's explicit instruction.
+
+## Cause and implementation
+
+Upstream orbital pan translates in the camera's screen plane. Consequently the
+target can move above the ground grid; scrolling then approaches that floating
+target rather than the intended ground location. Upstream also limits orbital
+zoom-out to five scene diagonals. The application previously inferred a camera
+from DOM deltas; that approximation was not the rendered native camera.
+
+ADR 0052 admits a bounded patch to the pinned upstream 0.36.3 WebViewer:
+
+- Project orbital pan onto the native grid plane and translate the complete rig.
+- Anchor untracked orbital views before rendering; stop interpolation when the
+  operator navigates. Ordinary orbit keeps the target fixed.
+- Zoom to that target independently of scene extent, retaining only 0.02 m
+  near-plane protection and a finite arithmetic guard.
+- Read the native rendered eye through the existing disposable iframe boundary.
+  Remove the approximate DOM camera journal and its viewport/radius plumbing.
+- Preserve first-person navigation and explicit follow/reset/plan actions.
+  Display-only updates carry the actual native eye and do not seek/reload data.
+  Browser QA caught that omitting eye fields on blueprint activation restored
+  the incoming store's startup camera despite the stable view identity. The
+  settings boundary now preserves the operator eye explicitly.
+
+The existing canonical hint describes LMB orbit, RMB ground-pivot pan and wheel
+zoom. No new product controls, renderer, debug UI or alternative event loop were
+introduced. The product UI skill kept this change inside the shared viewer.
+
+## Build and evidence
+
+Pinned upstream commit: `6ded109d33c549e98185f7c95fa8009d44e4adef`.
+Portable patch and generated artifacts are under
+`apps/control-station/vendor/rerun-web-viewer-0.36.3`.
+
+Worker006 used a temporary 4-CPU / 16-GB build-only container, no GPU, ports or
+scanner data. Native Rust camera tests passed **6/6**, including fixed-pivot
+rotation, ground pan, another grid orientation, top-down pan, zoom from over
+20 km to below 3 cm and invalid-input / first-person regression.
+
+The first browser build failed because macOS AppleDouble archive metadata was
+interpreted as a WGSL shader. The versioned packaging/build step now excludes
+and strips that metadata inside the disposable build workspace. No shader or
+upstream dependency was changed to bypass the error.
+
+The three source files on Worker006 were SHA-256 identical to the locally
+audited patch result. `navigation-build.json` records source, toolchain and
+paired JS/WASM identities. The installer validates the entire set before writing
+and rejects package drift rather than silently applying a patch to a new SDK.
+
+## Acceptance record
+
+- Native tests: **6/6** passed. The source patch applies cleanly to the pinned
+  pristine upstream archive.
+- Final application architecture: **4/4**; TypeScript: passed; complete frontend
+  suite: **895/895**, no skipped tests; production build: passed (14.36 s).
+- Installer ran twice successfully. Generated JS/WASM ABI and all artifact
+  hashes passed. Served build uses WASM SHA-256
+  `2b661de545ac90bb950eda1a28fc5a7c3ce4ca7f5bb24894789acf7589495185`.
+- Real in-app browser, canonical port 8000, `JA-STROITEL-SUN-RING-002`, paused
+  at 60 s: orbit, close/far wheel zoom, point size change to 0.5 px, cloud layer
+  off/on, follow on/off, expanded scene and return all exercised. After the
+  settings-boundary correction, the manually rotated view survived display and
+  layer changes. No browser console errors were reported.
+- Host-focused Escape returned from the expanded scene. The automation did not
+  establish Escape delivery with focus inside the native canvas; that gesture
+  is not claimed as verified. No keyboard code was changed in this increment.
+- Physical two-finger/right-button dragging is not exposed by the available
+  browser automation. Ground-plane pan and fixed-pivot invariants are covered
+  by the native tests; the owner's actual trackpad feel remains manual acceptance.
+- The final recorded scene is left paused for owner review. The temporary
+  Worker006 build container was removed after artifacts/logs were copied.
+  No alternate backend or temporary renderer was left running.
+
+The owner subsequently accepted navigation ("устраивает") and authorized OPS
+documentation. Card #74 now records the accepted native patch, build manifest,
+upgrade/rollback procedure and verification boundaries. This does not qualify
+rover operation or alter the navigation test limitations above.
+
+## Boundaries
+
+The guide grid is a geometric plane, not measured terrain. Explicit following
+may move a target because that is its requested purpose. Mission Core admits one
+active 3D pane per iframe; multiple simultaneous panes would require a view-id
+argument for snapshots. Floating-point/near-plane safeguards are retained;
+"no route-size zoom cap" does not mean infinite numeric coordinates.
+
+The accepted full-fidelity RRD and 30-minute accumulation are unchanged. Raw and
+corrected map versions do not need regeneration for this navigation update.

docs/audits/2026-09-21-recorded-cloud-fidelity-and-navigation.md

@@ -0,0 +1,130 @@
+# Recorded cloud fidelity and navigation — 2026-09-21
+
+## Scope and evidence
+
+Operator report: JA-STROITEL-SUN-RING-002 is slow to reopen, its cloud is much
+sparser than the live scan, point-size changes do not appear effective, the
+accumulation control stops at 120 s, and the orbital pivot moves off the grid.
+No scanner commands, raw-cloud changes, alignment-threshold changes, or map
+correction changes are part of this work.
+
+The large ring has 13,608 captured point frames and 49,217,854 points over
+1,446.684 s. The selected corrected map remains generation
+`99f7b84541875a23aa3a8c58eb246116b66f8af03f1d2656eba4b527af36b1db`.
+These are captured samples, not a count of unique surface points.
+
+## Confirmed causes
+
+1. The v12 RRD exporter retained only frames 1, 6, 11, … . Normal point batches
+   were complete, but four out of five captured scans never reached playback.
+   Another stride of four applied above 100,000 points per individual frame.
+   Neither rule altered the immutable raw capture.
+2. Ordinary recorded-view settings appended blueprint rows without activating
+   the updated blueprint. Upstream Rerun uses an active clone; updates need
+   activation. The LAB costmap path already requested this, ordinary recordings
+   did not. A visible slider value was therefore not evidence of native state.
+3. Both accumulation controls clamped to 120 seconds, independently of the
+   duration of the source.
+4. Preparing the already-published v12 recording took 6.290 s on the first API
+   request (including integrity checks), then 0.006 s on the next request with
+   the same 182,745,691-byte RRD digest. No repeated map correction or RRD export
+   was observed in those requests. This is **not** a browser-open timing: the
+   disposable native viewer still reads and indexes the RRD when opened.
+5. Ordinary display requests sent a playback cursor, causing a full RRD bounds
+   scan even though the eye did not change. Only tracking-relative camera
+   transitions now send that cursor.
+6. Global HTTP gzip recompressed native RRD chunks; the stock 64 KiB file
+   response also incurred thousands of thread/event-loop handoffs competing
+   with telemetry/color work. RRD routes bypass gzip, and pinned file responses
+   use bounded 1 MiB reads. JSON/text compression, Range, ETag and cache pins
+   remain intact.
+
+## Implementation
+
+- v13 RRD projection retains every point of every captured frame. Color-only
+  overlays follow the same timestamps and complete point ordering. Only the
+  derived cache version changes; old projections are not accepted as v13.
+- Both existing accumulation controls use one shared 1,800-second maximum,
+  with minute/second labels. The control changes the visible history; it does
+  not delete or decimate archived points. Existing chosen values are retained.
+- Every recorded display update requests blueprint activation. Stable view
+  IDs remain; ordinary display changes do not inject a guessed camera pose.
+- Export/cache failures remain explicit. There is no silent low-quality
+  fallback. More complete data necessarily increases file and memory size.
+
+## Navigation boundary / pending decision
+
+Rerun SDK and web viewer remain unmodified 0.36.3. Upstream `eye.rs` pans in
+the screen plane, not the XY ground plane. Its orbital zoom approaches the
+current look target; it does not fly through that target toward a remote
+object. The public WebViewer API cannot read/write the active eye. The local
+camera journal is a shadow estimate, not the native camera controller; changing
+that estimate alone would not fix ground-constrained pan and would risk more
+desynchronization.
+
+The requested ground-constrained pivot and unchanged pivot during orbit need
+a deliberately supported native navigation extension (with pinned source,
+patch, build provenance and upgrade tests), not per-pointer HTTP blueprint
+replacement or another overlay renderer. Owner approval for that change to
+the unmodified-upstream architecture was requested. Native navigation is not
+claimed fixed by this increment.
+
+## Validation
+
+- Architecture tests, full TypeScript check and 889 frontend unit tests passed.
+- Production build passed (existing large-bundle warning remains).
+- Focused Python export/color/cache/corrected-map tests passed. New checks prove
+  all 12 synthetic cloud frames are actually logged, all six color frames are
+  emitted, corrected positions are retained for every frame, 0.5 screen-space
+  radius is serialized, and a 30-minute history does not write eye controls.
+- Real v13 export completed. A streaming audit counted exactly 13,608 frames
+  and 49,217,854 positions, matching capture metadata. Size 743,853,833 bytes;
+  SHA-256 `40dbebba5dddccf94ba5c48118a94909bdb01ee8de883746d0db54a5d4ea86f2`.
+  A repeat prepare request reused this digest in 16 ms, without another export.
+- Incremental gates: 81 frontend tests, full TypeScript check and production
+  build passed; 12 focused HTTP/session tests passed, including unchanged RRD
+  bytes, 206 ranges, length, ETag, pin release, overlay POST and retained JSON
+  gzip. No extra integrated backend was started.
+- Bounded real HTTP sample: an 8 MiB range took 7.274 s with 64 KiB reads while
+  the archive/color load was active. After the 1 MiB change, cold metadata
+  restoration took 5.264 s and the body another 6 ms; the warm repeated request
+  took 13.9 ms total. These differ in background load and are not a controlled
+  throughput benchmark or a complete browser-open measurement.
+- Browser acceptance on the canonical IAB viewer: after the transport fix,
+  the complete 24:06.684 timeline and dense playing cloud were visible at the
+  first inspection roughly 45 s after open (upper bound, not a precise load
+  stopwatch). Before the chunk-size fix, a 5+ minute observation still had no
+  usable timeline. Native color defaults remained visible while the first
+  requested height/Viridis overlay was preparing.
+- Paused playback at 60 s: 0.5 → 5 → 0.5 changed the actual native point
+  footprint; a manually orbited camera retained its viewpoint through these
+  settings changes. Expanded cloud/Escape restore worked. The existing
+  display modal was used; its product anatomy was not changed in this task.
+- The 1,800-second slider showed “30 мин”; seeking to the exact archive end
+  kept earlier geometry visible. However, this full-cloud draw took roughly
+  23 s for the UI capture and swap rose from about 9 GB to 14.8 GB. The viewer
+  was closed immediately to release resources. This is functional acceptance
+  of the range, **not** smooth full-ring interaction acceptance on the 18 GB
+  Mac. No hidden decimation or lowered accumulation limit was substituted.
+
+## Remaining work and limits
+
+- Ground-constrained pivot, fixed-target orbit, and map-independent zoom are
+  not implemented; they require the native-controller decision above.
+- First non-default coloring still decodes the complete source into a bounded
+  overlay cache and can take minutes on this capture. The existing index cache
+  is smaller than the complete 49M-point index. Opening no longer waits for
+  this to show the base cloud, but color-preparation latency is not solved.
+- Full-fidelity storage is not a sufficient large-scene rendering strategy.
+  A follow-up should separate a whole-route overview from full-detail spatial
+  inspection, with explicit level-of-detail/provenance and access to every raw
+  point. Do not reintroduce silent frame skipping as a performance “fix”.
+
+## Resource and authority policy
+
+Single canonical service on port 8000; no Docker startup, extra viewer, load
+test, device command, changed raw evidence or regenerated corrected map.
+Tests, build, large export and browser QA run sequentially on the 18 GB Mac.
+The full-cloud view is not a guarantee of interactive performance at every
+history length. Any future LOD policy must be explicit and must preserve a
+full-fidelity inspection path.

docs/audits/2026-09-21-ring-continuity-and-live-lifetime.md

@@ -0,0 +1,103 @@
+# Full-ring continuity and live-pass lifetime
+
+## Scope and evidence
+
+Owner requested review of the latest full ring, removal of distance-triggered
+termination, and removal of the recorded/live pass chooser from operator setup.
+Full-route acquisition and its quality gates are deliberately unchanged.
+
+The completed study is `0324337e-b590-4561-b19a-8fbc7835b888`, captured on
+2026-09-21. This is an audit of immutable production decisions, not a numerical
+rerun, new capture, or absolute-position survey. The operator reports a start
+approximately 20 m before the original seam and a full circular walk.
+
+Private evidence is retained under
+`.runtime/audits/2026-09-21-ring-002-unbounded/`: audit script, per-check results,
+UTC/monotonic audit bounds, input SHA-256 inventory and test logs. Every study
+artifact, the raw MQTT capture, metadata, clocks and capture manifest were hashed
+before and after inspection; they were unchanged. Raw data remains outside Git.
+
+## Production result
+
+- Reference length: **579.9827 m**; cumulative live travel at termination:
+  **580.0751 m**. Recorded reason: **`distance-limit`**.
+- Route search: **810/810** fits, complete; selected anchor at **555 m** along
+  the reference. Worker wall time **127.93 s**, followed by three fresh
+  confirmation checks. First tracking receipt: **12:35:02.035 UTC**.
+- Fresh checks: **101 accepted / 101**, comprising two acquiring decisions and
+  **99 tracking decisions** (the third confirmation establishes tracking).
+  No reinitialization or recovery attempt; no recorded pose receipt gap.
+- Overlap within the 0.5 m evaluation radius: **98.274–99.928%**, median
+  **99.644%**. Inlier surface RMSE: **0.1330–0.1580 m**, median **0.1416 m**.
+- Successive accepted transform changes: maximum **0.0716 m / 0.2732°**.
+  These are consistency measurements, not surveyed pose errors.
+- Local checks: median **0.450 s** worker time, maximum **0.900 s**;
+  median check interval **5.111 s**, maximum **6.564 s**. Maximum accepted
+  result age **3.112 s**, below the unchanged freshness gate.
+- No LiDAR/pose queue overflow or oversize rejection. Camera preview dropped
+  1,271 superseded queue frames; this is a separate latest-frame video path,
+  not evidence of missing registration clouds.
+- Last check at **12:43:25.926 UTC**, at sampled travel **578.815 m**, was
+  accepted and tracking. The distance branch terminated the study **238 ms**
+  later, at **12:43:26.164 UTC**. Capture finalization completed separately at
+  **12:44:51.043 UTC**. No scanner-stop command belongs to that distance branch.
+
+The stop is therefore an execution-policy defect, not a failed geometric fit.
+The reported black screen was not independently reproduced; saved aligned
+geometry and the historical scene remain available. Browser telemetry is a
+presentation-admission proxy, not a GPU-paint receipt.
+
+## Correction and architecture boundary
+
+`selected-live-route/v2` separates reference coverage from pass lifetime:
+
+- The selected reference still defines where matching searches and validates.
+- Distance remains telemetry. It does not consume a budget or end a pass,
+  including on detours, reversals, snakes or additional laps.
+- New runs expose `maximum_distance_m: null` and `maximum_seconds: null`.
+  The live loop no longer reads a distance cap, including a retained legacy
+  finite field. Historical reports are not migrated or rewritten.
+- Explicit study cancellation, source end/stop intent, changed source identity,
+  technical failure and service shutdown retain their existing semantics.
+  Quality/freshness loss still revokes tracking and invokes the existing
+  recovery path; removing the cap does not hold a false green status.
+- Engineering recorded-replay bounds are unchanged. They limit an offline
+  experiment, not operator live travel.
+
+Operator setup now contains project, full reference and direction, followed by
+one **«Начать новый проход»** action. The entire **«Повторный проход»** section,
+its mode switch, recorded-source fields and explanatory paragraphs are removed.
+The workspace invokes only the live start and no longer mounts the recorded
+comparison hook or requests its catalog. Existing saved comparisons and backend
+engineering comparison APIs remain available. The admitted Design Guideline
+Inspector and Button are reused; no new controls, styling or navigation added.
+
+## Validation and limits
+
+Functional fixtures exercise three traversals of the same route geometry with
+travel equal to three reference lengths, including a finite legacy cap field.
+They verify that source end, explicit study cancellation and source stop intent
+still terminate and release leases without commanding capture. A second fixture
+uses the real stationary bootstrap and causal gate, synthetic numeric fits, and
+fresh accepted windows beyond three reference lengths. UI tests render the
+actual settings, verify empty/busy/short-reference gates and the direct start.
+
+Acceptance: **140 focused backend tests**, **888 frontend tests**, architecture
+checks, TypeScript and the production build passed. The existing large-chunk
+build warning remains. In-app browser QA on the canonical `8000` service verified
+the empty form, full corrected reference, normal/expanded layouts, scrolling to
+the start action and Escape. No start action was sent during browser QA. The
+latest real ring result was left open, with its saved geometry visibly loaded.
+The service was restarted while acquisition was idle and left healthy on `8000`,
+with no Mission Core listener on `8765`.
+
+SHA-256 comparison against the preceding handoff confirms unchanged entry
+acquisition, full-route search/worker, stationary bootstrap, registration and
+causal-tracking modules. Only lifetime policy/loop and the requested setup UI
+were changed for this increment, alongside regression tests and this audit.
+
+The observed physical ring supports continuous localization on this reference.
+It does not establish absolute pose accuracy, unattended navigation/safety,
+seasonal transfer, multi-kilometre capacity, or physical multi-lap acceptance.
+No new device operation or change to route search, correction-map producers,
+registration thresholds or scanner acquisition was made for this correction.

docs/audits/2026-09-21-ring-entry-and-seam-review.md

@@ -0,0 +1,181 @@
+# Ring entry failure and independent seam traversal
+
+## Decision
+
+The latest `JA-STROITEL-RING-001` live study supports local tracking across the
+corrected reference seam, but exposes a route-wide cold-start scheduling defect.
+Its first location was not geometrically unsuitable: a complete offline search
+of the original first prefix finds an unambiguous 98.82% overlap candidate with
+unchanged production quality gates. The live search never reached that seed.
+
+No production code, default, threshold, scanner state, saved run or corrected
+reference was changed during this audit. Diagnostic outputs are private, ignored
+runtime evidence; the original study retains its actual unsuccessful first
+attempt. This is not a retroactively successful live initialization.
+
+## Inputs and scope
+
+- Latest study `473870e0-5210-452c-b9e4-9d7937e93646`, query capture
+  `20260921T103511Z_viewer_live`.
+- Reference: `JA-STROITEL-SUN-RING · коррекция v2`, the full 579.9827 m,
+  all 5,182 poses, 694,420 registration-map points. This was not another
+  truncated-reference regression.
+- First stationary prefix: 8,870 retained query points, approximately 10 seconds,
+  maximum measured prefix motion 0.01066 m. No recorded receipt gap.
+- Two initialization attempts, one operator reinitialization, final study state
+  `completed`, termination `spatial-stop-requested`.
+- The operator deliberately returned to the initially rejected physical place.
+  Initial/final poses differ by 0.164 m in this capture's SLAM coordinates. This
+  supports the comparison but is not independent survey ground truth.
+
+## Execution chronology (Moscow time)
+
+| Time | Recorded event |
+| --- | --- |
+| 13:35:37.912 | First stationary prefix begins |
+| 13:35:47.921 | First search starts |
+| 13:36:24.105 | Search rejected as `initialization-incomplete` |
+| 13:36:46.859 | Operator requests reinitialization at the familiar start area |
+| 13:36:56.780 | Second search starts |
+| 13:37:14.769 | Dense-start candidate found: 98.72% overlap |
+| 13:37:27.973 | Third disjoint fresh check establishes tracking |
+| 13:38:35–40 | Trajectory crosses the original start/end seam in reverse |
+| 13:39:36.468 | Last accepted tracking result near the initial failed location |
+| 13:39:41.876 | Intentional STOP completes the study |
+
+The final in-flight calculation also produced a geometric candidate, but was
+correctly not published after STOP. Its unaccepted decision is not a loss event.
+
+## Root cause of the first failure
+
+The code first runs 108 dense-start seeds. That stage consumed 15.737 seconds
+and found no admissible candidate, as the actual location was about 15 m before
+the seam, not within the familiar start patch. The route-wide stage then received
+only the remainder of a shared 35-second search budget: approximately 19 seconds.
+
+The full route contains 117 searchable anchors and three yaw hypotheses per
+anchor (351 fits). Retrieval covered the full map, but precise verification
+completed only 40 anchors and one fit of the next anchor: 121/351 route fits.
+Together with the start stage this is 229/459 planned fits. The saved result
+explicitly says `complete=false`, `incomplete-route-search`; it does **not** prove
+`no-route-location`.
+
+The nearest anchor was ranked 62nd. The anchor whose existing production seed
+eventually finds the correct fit was ranked 100th. Neither was reached live.
+The coarse descriptor ranks radial/height distributions around cloud medians,
+not a measured probability of place identity. Here it prioritizes other route
+areas over the true place. Different visible geometry in a stationary prefix
+and a multi-visit local reference makes that representation a plausible source
+of poor ordering; this audit establishes the bad ordering, not vegetation as
+its independently classified cause.
+
+There are two further implementation consequences:
+
+1. `choose_route_location` discards the candidate queue when a search is
+   incomplete; `StationaryBootstrap.offer_prior` enters `lost`. Initial loss
+   then waits for operator retry rather than continuing the unexamined queue.
+2. The incomplete/expired operator message asks to stop recording and begin
+   again. That recommendation is inappropriate for this observed compute
+   exhaustion. No scanner reset or bad physical location was established.
+
+## Bounded offline experiments
+
+All original run-file hashes were verified before and after each experiment.
+Single CPU job at a time, one numerical thread; no hardware, ingress or UI
+publication. Each output is exclusive-created, never written over live evidence.
+
+### 1. Retrospective geometric check
+
+Register the original first prefix using a seed from the later successful
+alignment. This uses future information deliberately and is **not** a cold-start
+test. It isolates whether the first cloud is compatible with the corrected map.
+
+- First accepted transform as seed: 98.887% overlap, 0.1396 m inlier RMSE.
+- Last accepted transform as seed: 98.893% overlap, 0.1399 m inlier RMSE.
+- Both pass unchanged local registration gates.
+
+### 2. Complete cold-prefix route search
+
+Replay the same original first query and complete reference through existing
+`relocalize_route`. No endpoint, final transform or physical-location hint enters
+the search. The only experimental override is a 120-second **offline** deadline
+so the finite queue can finish; all geometric quality gates remain unchanged.
+
+- All 117 anchors / 351 fits completed in 59.408 seconds.
+- Correct, non-ambiguous leading candidate: 98.820% overlap, 0.1439 m inlier RMSE.
+- Candidate anchor at route progress 560 m, ranked 100th; the fitted pose is
+  consistent with approximately 15 m before the seam.
+- Next distinct fitted candidate: 61.086% overlap at an unrelated route area.
+  It was already present in the incomplete live search. Thus accepting the
+  first threshold-passing fit or loosening acceptance would be an unsafe fix.
+
+This proves recoverability from the original prefix, not live readiness. A
+59-second result would violate the existing live 35-second search / 40-second
+source-age contract and must not simply be relabeled fresh or green.
+
+### 3. Seed-construction sensitivity
+
+On a bounded, retrospectively chosen four-anchor subset, compare the existing
+cloud-median translation seed with a seed mapping query scanner origin to the
+route anchor, using the same yaw options, targets and quality gates.
+
+At the nearest anchor (565 m), yaw 90°:
+
+- Existing median seed: 53.799% overlap, rejected.
+- Origin-to-anchor seed: 98.847% overlap, accepted geometrically.
+- Retrospectively measured initial-position error decreases from 4.62 to 1.51 m.
+
+This is evidence for improving seed construction, not an approved replacement:
+the subset was chosen after examining the result, and one neighboring anchor
+still produces a weak approximately 61% candidate. Global ranking, competing
+places and fresh-data confirmation remain necessary.
+
+## Tracking and seam quality
+
+- 28 fresh checks accepted, including initial confirmation; 26 accepted results
+  in tracking state. No transition to lost/recovering after tracking begins.
+- Observed distance after reinitialization: 101.633 m; last accepted result at
+  100.896 m. The remaining final result was fenced by intentional STOP.
+- Overlap within 0.5 m: minimum 98.516%, median 99.348%, maximum 99.746%.
+- Inlier surface RMSE: 0.1226–0.1533 m, median 0.1422 m.
+- Maximum accepted consecutive-transform change: 0.0316 m / 0.5906°.
+- Calculation worker wall time: median 0.383 s, maximum 0.464 s. The roughly
+  five-second interval is the configured check cadence, not a five-second fit.
+- At the seam crossing, overlap remains 99.57–99.69%, with centimetre-scale
+  transform corrections and no recovery event. Route progress wraps from the
+  beginning to the end as expected while physical coordinates remain continuous.
+
+These metrics measure consistency with the admitted map, not absolute rover
+position accuracy. Only the traversed seam neighborhood is independently
+checked here, not the entire 580-m ring, arbitrary seasons, or kilometre routes.
+
+## Recommended architectural correction (not implemented here)
+
+1. Preserve the successful local tracking and corrected reference.
+2. Make full-route acquisition a resumable search with a cached reference index
+   and auditable unexamined candidates. A compute slice expiring means still
+   searching/incomplete, not a declaration that the operator picked a bad place.
+3. Separate place-hypothesis generation from live position validity. Refresh
+   observations and confirm candidates against disjoint current frames; never
+   extend an old matrix's control authority to cover a long global search.
+4. Qualify sensor-origin-based descriptor/seed variants against this recording,
+   previous successful start/mid-route runs and wrong-place negative cases.
+5. Retain ambiguity, identity and quality gates. Do not patch this by lowering
+   overlap or merely increasing the shared timer.
+
+The saved first prefix, complete map, successful return and disjoint subsequent
+frames are sufficient for the next offline iteration. No new field recording
+is required to diagnose or begin correcting this failure.
+
+## Validation and private reproduction
+
+62 focused tests passed: route relocalization, stationary bootstrap, stationary
+recovery, and planning-live lifecycle. Existing tests correctly assert refusal
+of an incomplete search; they do not establish acceptable completion latency
+on this real ring. The new captured case should become an evidence-backed
+acceptance fixture for the acquisition redesign.
+
+Private evidence: `.runtime/audits/2026-09-21-ring-001-entry/` contains
+`inspect.json`, `exhaustive.json`, `seeds.json`, the diagnostic `audit.py`, and a
+provenance seal. Inputs remain in the canonical run directory. No temporary
+worker remains; canonical Mission Core stays on port 8000.

docs/audits/2026-09-21-shared-ring-closure.md

@@ -0,0 +1,139 @@
+# Shared known-revisit correction for small and large rings
+
+## Scope and topology correction
+
+The operator clarified that the small ring is inside the large ring and shares
+roughly half its path. Their unshared corridors must not be scored as a failed
+repeat of the same map. Reference surveys in Data and independent captures
+owned by planner studies are distinct evidence classes.
+
+The earlier 30/101 replay used the planner-owned `JA-STROITEL-RING-002` full
+small-ring pass, not the Data reference itself. Its whole path does not become
+covered merely because its origin is the planner. The earlier 29/29 short pass
+also came from the planner. Preserve the negative numbers, but classify their
+geometric scope correctly. Other short planner passes are separate queries.
+
+## Implementation and boundaries
+
+`reconstruction/closure.py` owns a device-independent, injected-registrar policy
+for acquisition of a known start-area revisit. It has no hardware, UI, catalog
+or planner import. The K1-specific `reconstruct_recorded_ring.py` adapter now
+uses this same policy on both source recordings, with no source-name branch.
+
+The separate offline first-fit registration policy admits a larger initial
+correction (25 m / 180 degrees) without modifying live tracking's 3 m / 30-degree
+policy or the existing overlap, RMSE, shape, information and correspondence
+criteria. These are declared acquisition bounds, not a promise of arbitrary
+drift recovery. Identity is the initial hypothesis; endpoint positions are
+never forced together or used to manufacture a seam transform.
+
+All 12 training-only support pairs are evaluated: first [10,20,40] seconds ×
+last [5,10,20,30] seconds. Held-out frames cannot enter either side; shared
+source frames are rejected. Each qualified forward fit must pass seeded reverse
+refinement and the existing 0.1 m / 0.2-degree round-trip check. Qualified support
+windows must also agree at both observed patch centers within the separately
+declared 0.5 m / 1-degree consistency envelope. This is an engineering ambiguity
+guard, not a calibrated accuracy claim.
+
+The established 20/5-second measurement is retained if qualified. Otherwise the
+largest qualifying support is selected. All windows are still examined for
+contradiction before selection is accepted. The smooth field solver, rigid
+per-frame transform, original-frame clock binding and full-resolution export
+are unchanged. Failure keeps the audit and produces no silently accepted
+identity correction.
+
+The adapter's v2 contract binds closure search and its declared policy.
+Sealed v1 decoded caches remain reusable only when all actual decode/holdout
+settings match. `review_recorded_ring.py` adds explicit frozen-data acceptance:
+all local windows qualify, enough seam holdout exists, fixed quality gates pass,
+and cross-visit agreement is not degraded. Packaging requires positive v2
+acquisition and review, with the complete search included in the evidence seal.
+Previously published v1 map bundles and pinned studies remain supported.
+
+This is an offline correction/admission workflow, not a newly installed
+background auto-corrector for every capture. It does not discover arbitrary
+interior loops or recover a measured drift history from native LiDAR sweeps.
+
+## Regression caught and retained
+
+The first generalization always selected the largest qualifying support. It
+passed same-source checks (small 52/52, large 136/136), but warm replay of the
+independent full small-ring planner pass accepted only 100/101 snapshots. The
+96.115 m window failed numerical convergence despite 99.866% overlap and
+0.13993 m RMSE; the following window recovered. The same replay against its
+frozen previous reference accepted 101/101. This was a real numerical regression,
+not an uncovered-region excuse or permission to ignore convergence.
+
+The final cascade preserves the qualifying established window and uses expanded
+support only when necessary. It reproduces the previous small-ring corrected
+points and trajectory bit-for-bit, and the previous successful large-ring
+diagnostic geometry bit-for-bit. The unsuccessful intermediate candidate and
+its full replay are retained privately; no quality threshold was weakened.
+
+## Verification and runtime
+
+- 201 focused software tests passed, including 23 new closure/admission cases
+  and the previous registration, correction, route search, causal recovery,
+  reference version and session-default suites. One existing Starlette/httpx
+  deprecation warning remains. Ruff and diff whitespace checks passed.
+- Final real-source qualification uses the same immutable small 579.797 m and
+  large 1595.409 m recordings and their sealed decode caches. No new scanner
+  recording, hardware command, frontend change or service restart is required.
+- The shared policy retains the small 20/5-second closure and selects 40/30
+  seconds for the large ring. Source frame holdout remains correlated by the
+  upstream K1 map and is not independent survey truth.
+- Final same-source local checks pass 52/52 on the small ring and 136/136 on
+  the large ring. Frozen seam holdout overlap is 89.434% and 95.093%, respectively.
+- Repeating the independent full small-ring planner capture against the final
+  rebuilt small atlas restores 101/101 numerical and causal acceptances, matching
+  the 101/101 frozen-reference baseline. This is a warm map-version regression,
+  initialized by its existing old-map cold fit, not another cold-start claim.
+- Complete large-map atlas and trajectory arrays equal the previously tested
+  diagnostic atlas. Its independent short-pass 29/29 and cold numerical search
+  evidence remain applicable by exact identity, not by assuming similar maps
+  have identical behavior. No full independent pass through the new territory
+  is inferred from that reuse.
+- A full numerical search for the planner's `ja-sun-009-100m` was stopped after
+  host swap increased. Its exact temporary worker was terminated and reaped;
+  canonical service 8000 was retained. This incomplete run is neither a
+  localization success nor a geometric rejection. No repeated heavyweight
+  search is required to establish equivalence of identical map arrays.
+
+Private evidence is under `.runtime/audits/2026-09-21-closure-v2/`, with the
+initial candidate retained at the root and final cascade results separately
+under `cascade/`. Earlier observations and source recordings remain immutable.
+
+## Reviewed version admission
+
+The existing packager rechecked all 13,608 full-resolution large-map frames and
+all 13,624 poses against the frozen field, plus source transport/clocks and the
+complete review seal. It published a separate content-addressed full map. The
+ordinary large-session selection now resolves to its corrected generation and
+1599.807 m in the canonical planner API. The small-session default pointer is
+unchanged; existing planner studies retain their pinned generations. Raw captures
+remain available, and no vehicle-control authority is granted.
+
+Canonical API acceptance confirms that the spatial overview defaults to
+`corrected` and uses the same admitted map generation as ordinary planner
+selection. The original-generation-pinned view remains `original`. Both
+Original and Corrected preview RRDs were rendered successfully at the 80 m
+height ceiling. Browser visual QA and a new full playback export were not run.
+The final private evidence seal rechecked 212 input files with no changes,
+no producer changes, and exact small/large geometry equivalence confirmed.
+
+The operator workflow remains explicit: reconstruct → frozen review → package →
+publish paired overview → activate the session default. No new UI or background
+automatic capture correction has been introduced. Publication and admission
+reuse the existing ordinary-name selection and Original/Corrected inspector.
+
+## Decision and remaining scope
+
+The shared cascade is qualified for these two known start-area revisits, with
+explicit fail-closed acquisition/review boundaries. Universal means one policy
+and regression corpus, not a claim that every possible ring will close.
+
+Independent new-territory repeat accuracy, absolute geometry, the actual spatial
+distribution of drift, arbitrary crossing-loop graphs, seasonal transfer and
+onboard/live timing remain unproven. One accepted seam plus a smoothness prior
+cannot establish those facts. Incomplete optional planner searches remain open;
+do not relabel them as passed or use mixed-coverage loops as an aggregate score.

docs/audits/2026-09-21-smooth-map-correction.md

@@ -0,0 +1,157 @@
+# Offline smooth correction of a recorded ring
+
+## Decision and boundary
+
+Implemented and exercised an **experimental map derivative**, not a live SLAM
+replacement, planner change or automatic reference promotion. The real input and
+all detailed geometry remain under ignored private runtime storage. No scanner
+command, capture mutation, viewer publication or vehicle command was made.
+
+The result supports proceeding with review of a corrected reference. It does not
+establish absolute positioning accuracy or independent repeat-pass acceptance.
+
+## Implementation
+
+- `src/k1link/reconstruction/smooth_correction.py`: vendor-neutral smooth field
+  C(s), where s is cumulative distance in the original recorded trajectory.
+- `experiments/reconstruct_recorded_ring.py`: K1-specific immutable-source adapter,
+  source hashing, frame split, surface measurements, candidate solver, local
+  registration checks and full-resolution derivative materialization.
+- `experiments/review_recorded_ring.py`: fixed-population cross-visit holdout and
+  fresh-frame checks of sensitive matching windows; no re-fit of the correction.
+- `tests/test_smooth_map_correction.py`: synthetic invariants and negative cases.
+- `pyproject.toml`, `uv.lock`: optional `map-correction` extra with SciPy 1.16.2
+  and the existing small-gicp 1.0.1. No new mandatory runtime import.
+
+Capture remains plugin-owned. Reconstruction has no plugin, UI, planner or
+hardware imports. Planning may later consume a separately admitted derivative;
+there is deliberately no runtime path that changes the current reference.
+
+## Model, not recovered ground truth
+
+The field has natural cubic splines for translation and rotation-vector
+parameters, 20 m knot spacing, and an explicitly recorded first/second derivative
+penalty. Rotations act about a geometry-bound pivot so changing world coordinates
+does not change the physical answer. Three-point Gauss quadrature integrates the
+squared spline derivatives; the first knot fixes the gauge.
+
+A surface link measures C(query) = C(reference) × T(reference, query), evaluated
+at the observed patch center and in orientation. No endpoint-position equality,
+flat-ground constraint or endpoint-derived initial guess is introduced. The
+weights are engineering regularization scales, **not sensor covariance**.
+
+Each whole source cloud frame receives one rigid transform, and corresponding
+pose positions/orientations receive the same field. Thus within-frame distances
+are preserved, apart from float32 serialization. Different frames may move
+relative to one another; that is precisely the deformation being tested.
+
+This field is parameterized by traversal, not a single XYZ warp that would move
+two different visits identically. Small-rotation chart admission is explicit;
+large corrections, arbitrary loop discovery and scale to multi-kilometre graphs
+remain unqualified. Current CPU least-squares uses a dense numerical Jacobian.
+
+## Input and separation
+
+The private ring source has 5,178 cloud frames, 5,182 poses and 17,669,672 points,
+with a 579.797 m recorded trajectory. Full decode and source SHA-256 checks
+precede and follow the operation. Source sequences are continuous. The export
+preserves every point; the solver/validation sample every eighth source point
+and use 0.25 m voxels. Spatial windows are declared computation profiles, not
+capture-distance or vertical-clipping limits.
+
+Every ten seconds, the two-second interval at phase 4–6 seconds is withheld:
+1,061 frames withheld, 4,117 retained. No withheld frame enters the reference map
+or the surface-link fits. Upstream K1 mapping still makes these observations
+correlated; this is neither an independent recording nor ground truth.
+
+Cloud/pose binding uses the existing host-monotonic chronology. Nearest pose
+receipt distance is 25 ms p95, 143 ms maximum. This is not proven hardware
+synchronization and does not recreate per-point firing times or native sweeps.
+
+## Actual constraints admitted
+
+The start-area revisit qualifies on retained frames with the unchanged production
+GICP policy: 98.70% overlap within 0.5 m and 0.120 m inlier RMSE. Forward/reverse
+fits differ by approximately 5 mm at the patch center and 0.191 degrees.
+
+All **29 attempted additional neighboring-window registrations were rejected**
+under the unchanged overlap/RMSE gates. They were excluded, not assigned low
+quality but positive identity. Therefore this result uses **one measured closure
+and a smoothness prior**, not a densely measured multi-edge reconstruction of
+the drift history. Rejected measurements are retained in the private audit.
+
+## Results
+
+| Check | Original | Corrected v2 |
+| --- | ---: | ---: |
+| Trajectory length | 579.797 m | 579.983 m |
+| Final minus initial Z | −1.4646 m | +0.00265 m |
+| Local held-out registration candidates | 51 / 52 | 52 / 52 |
+| Median local overlap within 0.5 m | 98.259% | 98.285% |
+| Median local inlier RMSE | 0.16246 m | 0.16192 m |
+| Cross-visit held-out overlap within 0.5 m | 25.54% | 89.43% |
+| Cross-visit all-point distance median | 0.891 m | 0.119 m |
+| Cross-visit all-point distance p95 | 1.825 m | 0.906 m |
+
+The cross-visit comparison uses the **same 16,109 source points from 41 withheld
+frames**, compared to only the first retained window, with the correction frozen
+and no re-fit. The remaining outlier tail is real and is not explained away as
+vegetation without classification. Millimetre endpoint-Z agreement is **not**
+millimetre map or localization accuracy. Physical endpoint locations were not
+measured and may differ; no exact physical endpoint offset was imposed.
+
+Maximum displacement of the sampled trajectory is 1.548 m. The maximum change
+of displacement along it is 8.61 mm per travelled metre (p95 7.99 mm/m). This is a
+correction-field gradient, not a measured strain bound for every 3D surface.
+The maximum rotation-parameter gradient is 0.000786 degrees/m. Halving/doubling
+the smoothness weight changes trajectory positions by less than 0.008 mm in this
+one-closure case; that only shows this prior's numerical stability, not truth.
+
+## Registration sensitivity retained
+
+The first candidate had 51/52 accepted windows, with a non-convergence at 437 m;
+the original had a non-convergence at 327 m. No quality threshold was lowered.
+Fresh disjoint one-second halves in **both** regions passed for both maps.
+
+After changing the field's coordinate pivot and exact quadrature (v2), its geometry
+is nearly unchanged but all 52 two-second windows pass. This is evidence of
+numerical/window-composition sensitivity of GICP convergence, **not proof that
+its failure mode has been fixed**. Both revisions and their less-favorable
+results are preserved. Production matching/loss/recovery code is unchanged.
+
+The local test starts at identity, then uses the last accepted transform; it
+does not seed each query with the correction field. The test is local matching,
+not global place recognition or the entire live state machine. Agreement with
+the generating field must not be called independent pose accuracy.
+
+## Reproduction and storage
+
+Install the optional extra through `uv` in a project environment. Run the
+experiment with `--raw`, `--sha256`, `--session-id` and a fresh `--output` directory.
+An optional `--cache` reuses a hash-sealed decoded source. Subsequent review takes
+the result directory and can include additional explicitly named window groups.
+Outputs are exclusive-created, not overwritten.
+
+`corrected-points.f32` is little-endian Nx3 float32 map coordinates. Frame offsets,
+counts and receipt times are retained in `corrected-trajectory.npz`; `distance_m`
+and `frame_distance_m` there are **original source traversal parameters**, not
+recomputed corrected path lengths. Intensities are unchanged and remain in the
+hash-sealed source cache. `correction.json` records the field including its pivot.
+The review seal binds code files and measured artifacts by SHA-256.
+
+## Acceptance and next step
+
+- 17 focused tests pass, including existing registration regression tests.
+- Ruff and diff whitespace checks pass.
+- One sequential CPU job at a time; no duplicate server, Docker workload or
+  temporary worker remains. The canonical service stays on port 8000.
+- Candidate only; neither stored session nor operational reference replaced.
+- Next: versioned reference admission and independent repeat-pass verification,
+  retaining recoverable localization state for numerical matching failures.
+- Ops documentation write is pending: instruction/project MCP reads timed out;
+  no card was changed and no raw API fallback was used.
+
+Subsequent same-day progress: the separate bundle and offline planning adapter are
+verified in `2026-09-21-map-reference-version-admission.md`. Source/default live
+selection remains unchanged. Ops metadata reads recovered, but card searches
+still time out, so the engineering card update remains pending.

docs/audits/2026-09-21-whole-reference-and-capture-catalogs.md

@@ -0,0 +1,93 @@
+# Whole reference and independent capture catalog
+
+## Owner decision and product composition
+
+New planning executions use the complete selected reference recording. The
+reference crop section, its range controls and its 30-m shortcut are removed.
+Data → Sessions and records lists independent physical recordings; live passes
+created by the planner stay with their planning studies and are not offered as
+reference choices. No new type selector, tab, catalog copy or workspace is
+introduced. This is an owner-approved projection change in existing surfaces,
+using the existing Select, Inspector, Button and WorkspaceWindow components.
+
+The rejected alternative was another type dropdown in Data. It would preserve
+the mixed acquisition catalog the owner explicitly asked to separate. Physical
+evidence and corrected-map generations remain immutable. A planner pass is
+still a physical capture, not a synthetic LAB result.
+
+## Reproduced defects
+
+- A newly selected reference was initialized to the first 30 metres.
+- Choosing the same recording again reset its independently stored interval
+  to indices 0…1. React did not reload the unchanged source identity, so the
+  interval remained there. A stationary prefix then showed approximately zero
+  metres and two poses, disabling launch. The scanner lifecycle was not a
+  dependency of that button condition.
+- The latest failed ring study is terminal (`cancelled`). Its frozen reference
+  was about 97.57 metres, not the complete approximately 579.98-metre ring.
+  Initialization exhausted its recorded candidates without finding a location.
+  This establishes the incomplete reference, not that full-reference matching
+  has already succeeded at the operator's latest location.
+
+## Implementation boundaries
+
+The planner derives its reference poses from the complete loaded source; it no
+longer owns editable start/end state. Re-selecting the same source explicitly
+reloads its generation without collapsing its route. Product saves request
+`whole_recording: true`; the server resolves the endpoints from the immutable
+source. Existing bounded API clients remain a compatibility path for historical
+recorded experiments. Existing reports retain their frozen geometry. Opening
+an older editable draft prepares a full-route revision rather than rewriting
+the prior run.
+
+The physical session store adds append-only planning-acquisition links keyed by
+exact session and run identities. New live binding records the link before
+publishing its run state. Startup reconciliation backfills only explicit live
+report bindings; names, distances and fit success are never classifiers.
+The link may precede capture finalization/catalog ingestion, survives archive
+reconciliation and project catalog tombstones, and is excluded from the physical
+source evidence digest.
+
+The `standalone` catalog scope filters these links and LAB projections in SQL
+before pagination. Data and new reference selectors request it. Existing
+`source`/`all` scientific scopes and direct source/replay endpoints remain
+unchanged. Recorded-repeat selection inside the planner still requests physical
+`source` captures, so planning evidence does not become inaccessible after it
+is hidden from Data. A previously independent survey is not reclassified just
+because somebody later compares it offline.
+
+Live admission, registration thresholds, scanner commands and vehicle authority
+are unchanged. The older offline recorded-comparison solver still admits short
+references only; its existing constraint is now explained next to its disabled
+action instead of silently disabling the full-ring form. This task does not
+claim to upgrade that solver to route-wide offline relocalization.
+
+## Acceptance
+
+- Focused Python regression suite: 135 passed (capture catalog, drafts, live
+  planning, session store/API and corrected session defaults).
+- Frontend: architecture/targeted checks passed, typecheck passed, complete
+  test suite 887 passed, production build passed. Ruff and `git diff --check`
+  passed.
+- Canonical LaunchAgent restarted after the build. One backend remains on
+  `127.0.0.1:8000`; no temporary backend was started on 8765.
+- Startup backfilled 19 exact historical acquisition bindings. The current
+  standalone catalog contains five independent recordings, including
+  `JA-STROITEL-SUN-RING`, and excludes the planning captures. The planner
+  still lists 22 projects, including the latest unsuccessful ring study.
+- Browser acceptance used the existing application tab after reload. Data and
+  the reference selector both showed the five independent recordings; no
+  second type dropdown was introduced. The planning history retained the
+  latest pass and previous studies.
+- A new unsaved form selected the corrected ring and showed `Вся запись ·
+  579.98 м · 5 182 положений`. With a name supplied, launch was enabled.
+  Re-selecting that same recording retained the full route and enabled action.
+  Normal and expanded settings, scrolling to the action, and Escape close
+  were checked. Browser error logs were empty.
+- The temporary form name was cleared without saving or starting a pass. The
+  corrected ring preview remains open. No scanner command, new acquisition,
+  registration run or historical-report rewrite was performed during QA.
+
+These checks validate form/catalog repair and full-reference admission. They
+do not claim a successful new field localization at the previously failed
+location; that remains a short operator-controlled seam test.

docs/audits/2026-09-22-recorded-display-profile.md

@@ -0,0 +1,272 @@
+# Saved recording display profile · 22 September 2026
+
+## Operator contract
+
+The existing Display window now offers cloud decimation, an accumulation-slider
+range in minutes and the current accumulation duration. New session profiles
+default to a three-minute slider range, zero decimation and the existing 12 s
+current window. Exact value inputs accept fractional percentages and custom
+durations; the 30-minute drag range is not a duration-validation ceiling.
+
+0% retains the original point count, 50% retains half per frame (rounded), and
+100% hides points without hiding the trajectory or grid. These are presentation
+controls, not scanner, registration, reconstruction or evidence controls.
+
+Recorded Display edits preview while the modeless window remains open. Changes
+coalesce for 750 ms or flush on a control's commit; 0%/100% decimation bypass
+that delay. Closing atomically saves the complete display settings in
+`display-profile.json` inside that session's catalog-validated directory. Schema
+is `missioncore.session-display-profile/v1`. Sealed `method.json`, raw transport,
+corrected geometry and original RRD are not rewritten. Missing profiles use
+defaults. Reads/writes are fenced by session identity and edit revision; writes
+are serialized. Save failure leaves the window closable and reports an error.
+
+## Implementation / Rerun upgrade inventory
+
+- `packages/spatial-ui/src/{sceneSettings,ObservationTimeline,SceneDisplayControls}`:
+  shared RangeControl, three-minute default, per-profile timeline maximum.
+- `apps/control-station/src/core/observation/{sessionDisplayProfile,useSessionDisplayProfile}`
+  and App: JSON mapping, validation, live preview and close-to-save session-bound persistence.
+- `src/k1link/sessions/display_profile.py`, SessionStore and session_api:
+  confined GET/PUT display-profile endpoint, atomic fsync/replace sidecar.
+- Plugin contribution `point_display_renderer`, K1 `recorded_point_display.py`:
+  read-only full timeline traversal, deterministic ranked sampling, full-frame
+  palette before selecting rows, corrected map-frame ownership retained.
+- Follow-up fix `prepared_point_display.py`: intensity/Turbo decimation reads
+  exact positions and packed colors from the already prepared operator RRD via
+  `RrdReaderInternal`/Arrow instead of re-normalizing raw transport. The client
+  supplies the source SHA-256; the server validates and pins that exact ready
+  preparation and releases it on completion, startup failure or cancellation.
+  A stale generation fails with 412. The hook also fences applied banks by
+  source generation. Neither a browser-supplied filesystem path nor a second
+  recording is admitted. Other color modes retain the raw decoding fallback.
+- `recordedPointDisplay.ts`, `useRecordedPointDisplay.ts`, RerunViewport and
+  viewer/recorded.py: framed RRD batches into the existing receiver, unique generation
+  entity below `/world/display_points`, then blueprint activation. Inactive
+  generations are excluded before streaming, including old cached RRDs. Unique
+  paths avoid accumulating old samples at the same temporal entity. Previous
+  representation remains visible during preparation or failure. 0% uses the
+  base entity; 100% uses visibility, without rebuilding an empty recording.
+- The same recording, iframe, clock and native camera remain active. Blueprint
+  activation carries actual native eye. Changing only accumulation or size does
+  not regenerate points. Native SDK/WebViewer remain 0.36.3 with the previously
+  accepted navigation patch; this increment adds no Rust/WASM patch.
+
+The HTTP envelope is NPD1 + repeated little-endian u32 length / standalone RRF2
+payload + a terminal zero length. Native `send_rrd` expects a complete RRD per
+call, not arbitrary HTTP chunks. Browser QA caught this distinction: an earlier
+prototype appeared thinned but logged decoder errors and was rejected. The
+replacement frames transport explicitly, validates every batch and refuses
+activation without the success terminator. A multi-batch RrdReader regression
+decodes each payload independently and counts every input frame.
+
+Upgrade checks: complete RRF2 batch admission, same recording ID, temporal query and
+generation include/exclude precedence, point-size overrides on alternate entity,
+current eye preservation, retained pause/seek and teardown/abort. Repeat profile
+roundtrip and failure tests independently of browser local storage.
+
+## Verification and limits
+
+Frontend complete suite: 900 passed; production TypeScript/Vite build passed.
+Final backend display/profile/colors/session/blueprint/plugin-boundary suites:
+65 distinct tests passed, including atomic-write failure, source-generation
+pin/release, independently decodable batches and exact prepared-RRD attributes.
+Sampling tests cover 0/5/49/49.5/50/99.9/100%, exact count and nested subsets;
+stream cancellation releases the preparation slot. Frontend tests cover
+fragmented RRF2 headers, cancellation, cross-origin rejection, profile identity,
+range override and recorded-only control exposure.
+
+Canonical port 8000 browser QA on corrected JA-STROITEL-SUN-RING-002: staged
+95% decimation, 600 s range and 60 s current window persisted on close. The
+prototype visibly thinned the cloud, but its decoder errors invalidate that as
+evidence of complete delivery. Pause remained at 01:45.173 and grid/camera
+framing stayed unchanged. 100% removed only points; 0% restored full cloud
+without decoding it again. This tests display, not geometric accuracy or
+localization.
+
+The earlier framed-protocol browser trials admitted multiple batches without codec
+errors, but service restarts interrupted the requests before their success
+terminator. The previous representation remained visible and the UI reported
+the failure; it did not activate the incomplete generation. Full real-recording
+completion was NOT browser-qualified at that point.
+The watchdog journal has no restart-requested event for these restarts; their
+initiator has not been established. No watchdog setting was weakened. The small
+ring's separate replay preparation was also interrupted by a service restart.
+That earlier test must not be cited as a passed large-recording test.
+
+After a page reload, the recording restored its exact 0.5 px point size, 0%
+decimation, 600 s custom range and 60 s accumulation from the JSON profile.
+The QA session was subsequently returned to 0% decimation, a 180 s range and
+47 s window. The final retry-dependency fix passed production build and the nine
+focused frontend profile/camera tests: unrelated size/time edits do not cancel
+preparation of the same sampling key, while closing Display retries a failure.
+
+Follow-up browser acceptance on canonical 8000, 22 September: persisted 86.2%
+was reproduced in JA-STROITEL-SUN-RING-002. The old renderer was still decoding
+raw transport; retaining the old representation until completion made it look
+inert. After installing the prepared-RRD path, the complete generated bank was
+activated. At the same paused cursor 01:38.386 and accumulation 49 s, switching
+86.2% -> 0% visibly restored the dense cloud; 100% removed points while keeping
+grid/trajectory, and returning to 86.2% restored the sparse cloud. Camera framing
+and the paused cursor remained unchanged. Expanded mode and host Escape return
+passed. Browser error log was empty (only known native web viewport-command
+warnings). The source had no decoder errors. This closes the earlier real-file
+activation acceptance item. The test leaves the user's 86.2%, 0.5 px, 180 s
+range and 49 s current window intact. It does not claim exact GPU counts or
+physical gesture coverage. The synthetic RRD test proves 138/1000 points per
+frame at 86.2%, exact XYZ/RGBA and original timestamps without raw decoding.
+
+OPS registry #74 is updated only after this follow-up browser qualification;
+the long-lived upgrade registry itself is not moved to Done.
+
+Performance limitation: the old raw path took several minutes on the
+24-minute/49-million-point recording. The intensity/Turbo path now traverses the
+prepared RRD; other palettes/modes still use the slower raw path. A new percentage
+still needs asynchronous preparation, not instantaneous GPU sampling. The server
+streams bounded batches (one preparation at a time), and the browser avoids a
+whole-cloud JS blob. Decimation reduces visible geometry/draw work; it does NOT
+evict the base recording or guarantee lower total native store RAM. Inactive
+generations remain subject to native store retention until viewer disposal.
+Repeated-percentage memory stress and a persistent preview cache are not claimed
+as qualified. Raw/corrected source integrity and navigation are not traded for
+speed. No extra backend, Docker runtime or alternate renderer was introduced.
+
+Host acceptance limitation: the disk had about 300 MiB free during final QA,
+below the service's 2 GiB reserve. `/api/health` reported recording-cache
+capacity-pressure while the single canonical service continued serving 8000;
+8765 had no listener. No recordings were deleted and the reserve was not
+weakened. New materialization/load stress is not safe until disk headroom is
+recovered; the prepared-RRD fix does not add a new persistent cloud cache.
+
+The product UI skill kept the controls in the admitted Display window and reused
+canonical RangeControl/ToastStack rather than creating another workspace.
+
+## Follow-up: open-inspector preview regression
+
+The operator's 07:57 screenshots exposed a second, independent defect after the
+prepared-RRD fix. `stageDisplayPatch` returned early whenever recorded playback
+and Display were both open. Both the inspector and the bottom accumulation
+slider used this callback: their labels showed the draft, while Rerun continued
+to receive the previous scene settings. The preceding browser acceptance only
+tested changes after closing Display and did not cover this interaction.
+
+The inspector-open suppression is removed. Preview is independent of JSON
+persistence; close still saves the latest shared draft, including edits made
+from the bottom slider. Cheap 0%/100% changes apply immediately. Intermediate
+percentage edits remain coalesced and asynchronous, with the previous complete
+bank retained until the replacement succeeds. Returning to a cached bank or
+0% now clears an obsolete preparation status. No raw/corrected data, camera
+navigation or native viewer build is changed by this follow-up.
+
+Preparation status is placed upper-right on the source-button vertical axis.
+Camera windows default to bottom-left, still clear of the timeline. Explicit
+saved/user-moved window rectangles retain priority over the default placement.
+The product UI skill preserves the existing window and range primitives.
+
+Follow-up validation: architecture 4/4, full frontend 902/902, TypeScript and
+production Vite build passed; `git diff --check` passed. The regression test
+executes the actual App callbacks with controlled timers: open inspector,
+100% -> 0%, 180 s -> 10 s, fractional 49.5% preview, then close-to-save. Existing
+lower-right/left-status layout assertions were updated to the requested layout.
+
+Visual acceptance of this follow-up remains PENDING. The prepared large ring
+loaded after the rebuild, but browser control was interrupted before the
+open-inspector comparison. After the host restart the canonical LaunchAgent
+failed before application startup: launchd reported `posix_spawn(uv): Operation
+not permitted`, exit 78, with no listener on 8000. Kickstart and re-registration
+of the identical existing plist did not recover it. No permissions, plist,
+data, raw recording, or other service were changed. No alternate backend was
+started. This startup failure is not proof of a Rerun failure; its exact OS-level
+cause is not established. OPS is not updated for this unfinished acceptance.
+
+### Resumed acceptance and fractional cursor regression
+
+The owner requested coordination with Mission Core - SIM. That task owns the
+canonical service restart; this task does not launch another backend. SIM
+recovered the existing LaunchAgent by moving only its startup log out of
+Downloads to the user's Library/Logs directory. Canonical health subsequently
+reported operational=true, one listener on 8000, none on 8765. Browser QA ran
+with one prepared recording, no build/test overlap, and 53–75% reported free
+memory. Original per-session settings (86.2%, 49 s, 180 s maximum) were restored
+and verified through the profile API before closing the temporary viewer for
+SIM's next explicitly coordinated restart.
+
+Open-inspector 100% removed points and 0% restored the dense cloud; the camera
+window appeared bottom-left. However, after seek and Follow on/off, 180 s and
+10 s produced an unchanged view and later display requests stopped reaching the
+blueprint endpoint. This is NOT accepted as working accumulation.
+
+An additional concrete boundary defect was reproduced in a focused test:
+`fetchRecordedBlueprintRrd` rejected a native fractional-nanosecond cursor such
+as 536460021972.65625 before making the request. Pinned Rerun 0.36.3
+`crates/viewer/re_viewer/src/web.rs::get_time_for_timeline` returns TimeReal as
+f64, not an integer. A failed following-eye transition remains pending, so
+later display-only updates retry that same invalid pose-query timestamp.
+The request boundary now rounds to the nearest integer nanosecond (at most
+0.5 ns); the native playback cursor is untouched. Negative, non-finite and
+unsafe timestamps still fail. Aborted requests stay quiet; other blueprint
+failures now produce a console warning instead of disappearing silently.
+The new regression failed before the change and passed after it. Full gates
+and resumed end-to-end accumulation verification are still pending; OPS remains
+unchanged until they pass.
+
+### Final acceptance after the fractional cursor fix
+
+The sequential gates now pass: architecture 4/4, TypeScript, full frontend
+903/903 (zero skipped), production Vite build and `git diff --check`. The build
+retains only the existing large-chunk warning. Served asset
+`app-Bm1TJUff.js` was confirmed before the final browser pass. No native/WASM
+rebuild or further service restart was needed.
+
+On JA-STROITEL-SUN-RING-002, with Display open and the same paused cursor/camera,
+180 s showed the longer cloud history and 10 s visibly removed older geometry.
+This also passed after seeking to 01:00.780 and toggling Follow on/off. 100%
+removed only points; 0% restored them. 99.9% yielded a near-empty cloud while
+keeping grid/trajectory, and returning to 86.2% restored the prepared subset.
+During that replacement the preparation pill was visibly upper-right, aligned
+with the source/expand controls. Camera default was bottom-left. Expanded view
+and Escape returned to the same paused frame and accumulation. Console error
+entries and the new recorded-scene failure warnings were both empty.
+
+Original session profile values were restored and read back after closing
+Display: 86.2% decimation, 49 s accumulation, 180 s scale maximum, 0.5 point size,
+intensity/Turbo. Source recordings and sealed method.json were not rewritten.
+No exact GPU point-count claim or physical trackpad-device qualification is
+made by this browser pass.
+
+The temporary viewer was then closed rather than left resident: the explicitly
+coordinated Mission Core - SIM task needed the next single-viewer acceptance
+window, and the host had recently exhausted RAM. SIM was notified that the
+frontend gates had already passed and must not be duplicated unnecessarily.
+Final local checks: operational=true, one canonical listener on 8000, none on
+8765, 62% reported free memory and about 16.5 GB available disk. No background
+build, second backend or large-recording stress test was started.
+
+### Operator cleanup and repository packaging
+
+At the owner's request the persistent LMB/RMB/wheel hint was removed from the
+shared SpatialScene and both recorded/live callers, with its unused CSS and
+readiness prop. Native camera input and renderer code were not changed.
+Architecture/layout checks 9/9, frontend 904/904, typecheck and production build
+passed. Lightweight browser inspection confirmed the hint was absent; the large
+recording was not reloaded solely for this copy removal after host swap growth.
+The canonical service remained healthy and the temporary browser was closed.
+
+The accepted 0.36.3 native WASM is packaged through Git LFS, matching the existing
+binary-artifact convention for the archived viewer. The source patch, paired
+JS/types, licenses and hash-bound build manifest remain normal versioned files.
+Raw captures, runtime state and simulation work-in-progress are outside this
+publication scope. The long-lived Ops customization registry is not marked done.
+
+Before publication, the selected Git index was exported into an isolated
+temporary source snapshot, excluding every pending SIM change (including the
+SIM hunks in App, dependency manifests and web/app). Against that snapshot,
+154 focused frontend tests, TypeScript typecheck and 230 focused backend tests
+passed. Dependencies were reused from the existing local installation; this is
+not a clean dependency-install qualification. The only backend warning was the
+existing Starlette/httpx deprecation. First-party staged diff checks passed;
+generated vendor JS and source-patch context retain their hash-bound whitespace.
+The staged WASM is a Git LFS pointer to the manifest-verified 50,469,154-byte
+artifact. Working files were unchanged by staging. No service restart, new
+physical scan, repeat full build or large-recording replay was needed for this
+publication gate; canonical 8000 returned operational=true.