@@ -2,9 +2,10 @@
Date: 2026-08-05
Status: in progress; M4.0– ccepted, the M4.7 canonical graph and Worker
006 shadow artifact are implemented locally, and Worker preflight/full shadow
acceptance plus durable cutover remain open
Status: in progress; M4.0– nd the M4.7 canonical lossless Worker 006
shadow are accepted, M4.8 prediction-frozen review-pack preparation is complete,
and the independent reviews/adjudication, M4.8 scoring, M4.9 release candidate
and durable Worker cutover remain open
Audit base: `1b3e0b3` on `feat/simulation-polygon-s1`
@@ -500,10 +501,11 @@ Physical mounted threat acceptance remains outside Milestone 4.
### M4.7 — cut Worker 006 over to the canonical graph
Status: implementation complete locally on 2026-08-23; Worker 006 preflight,
full lossless shadow evidence and durable process replacement are not yet
accepted. The current E15 worker and Triton identities remain the rollback
predecessor. No K1, Zarya or connection-stack change is part of this phase.
Status: the isolated Worker 006 preflight and full lossless shadow were accepted
on 2026-08-23 with all `4,489` frames delivered, zero parity mismatches and queue
high-water mark `2` . Durable process replacement is not implemented or accepted.
The current E15 worker and Triton identities remain the rollback predecessor. No
K1, Zarya or connection-stack change is part of this phase.
Deliverables:
@@ -533,8 +535,9 @@ adds a separate object-centric review contract; it does not require class labels
Dataset construction:
- freeze 20– –
- include occupied object, background false-positive, partial occlusion, fisheye
edge, small obstacle, moving crossing, static obstacle and no-object strata;
- derive the private balancing hypotheses only from already frozen prediction
rows (associated/unassociated, moving/static/threat, small, fisheye-edge and
sparse-scene signals); never use unrevealed truth to select the release set;
- label obstacle presence/extent, current geometry association, freshness,
moving/static/unknown and virtual-corridor threat/unknown;
- freeze graph predictions before review labels are joined;
@@ -1194,12 +1197,199 @@ accepting the run. This makes Worker 006 usable without touching the stabilized
K1/Zarya connection path.
Local contract, graph, result-sealing, artifact and historical-rollback tests
pass. This is implementation evidence only. It does not claim that Worker 006
has the pinned local-surface input, that preflight has passed, that the 4,489
frame graph shadow matches the accepted M4.5R/M4.6 ledgers, or that the durable
E15 command has been replaced. Those are the next M4.7 acceptance actions, in
that order. K1, Zarya, the stable connection path and physical-live authority
remain untouched.
pass. Worker result
`m47-reference-graph-5f6a851cd655c7cf07c3025dacadbc188018b0afa97eda3a08802266e12da87d`
sealed the full shadow with `4,489/4,489` admitted and delivered frames, zero
failed/stale/superseded/rejected/unavailable outcomes and zero mismatches in all
seven parity dimensions. LAB result
`m47-reference-graph-lab-49678f0a7c628c7e991af0964fa57d005baa027d2d1eea19f38bbfe27ed39ce5`
therefore opens the independent object-centric quality gate. This does not claim
that the durable E15 command has been replaced: the accepted runner is explicitly
one-shot shadow-only, and the required persistent service, telemetry-continuity
and automatic rollback contract do not yet exist. K1, Zarya, the stable
connection path and physical-live authority remain untouched.
### 2026-08-24 — M4.8 independent review pack frozen
The first provenance-complete M4.8 pack is
`m48-object-quality-pack-680c091cd81cce802931dbb8987db6f26dc568c5d7395166cda2e9e5a4c78e27` .
It binds the accepted M4.7 LAB manifest, exact M4.6 threat ledger and exact
single-sample camera-fragment hashes for all `4,489` source frames, plus the
adapter, selection, camera index, graph, threat and geometry manifests/ledgers by
SHA-256. The selected review surface contains `24` non-overlapping connected
clips of approximately six seconds each (`12` development and `12` validation;
`1,464` selected frames) across six split-local route blocks and eight
split-local time blocks. All eight private balancing hypotheses are derived
mechanically from the frozen prediction rows and are present in validation; the
reviewer projection contains neither those hypotheses nor frozen boxes, IDs,
scores, model identity or semantic-class tasks.
The pack state is intentionally
`prepared-predictions-frozen-labels-unavailable` . It is not an accepted quality
result. Two distinct capability-bound reviewers must complete the class-free
tracklet review, both submissions must freeze, and a separate adjudication must
seal before the frozen predictions can be joined. Only then may the deterministic
per-frame ledger, critical-first failure atlas and M4.8 thresholds produce an
ACCEPT or REJECT. Release gates use validation only; development and combined
metrics remain diagnostic. No aggregate metric may waive a false-free claim, critical
miss, hidden terminal outcome or critical `threat` →`not-threat` error.
### 2026-08-24 — M4.8 laboratory architecture hardening
M4.8 is represented by one catalog work,
`m48-object-centric-quality` , whose evidence lifecycle advances from the
prepared review pack to the terminal quality result instead of publishing two
competing LAB cards. Review and adjudication use one shared focus-owning
laboratory workspace frame, while opening either full-screen capability unmounts
the background work output. Consequently only one camera decoder, spatial
renderer and playback clock can own the selected evidence at a time.
The M4.8 surface reuses the shared recorded camera and metric spatial viewers;
it defines no Rerun blueprint, receiver, window identifier or per-LAB viewer
configuration. Spatial legends are derived from admitted data and enabled
layers, so source-only review does not advertise unavailable threat, rolling or
local-surface semantics. Recorded-camera decode lanes and source manifests are
bounded by independent LRU caches. These changes do not alter the stabilized K1
connection, control or physical-live path.
The earlier M4.8 camera surface nevertheless still advanced playback through an
experiment-local timer and decoded one HTTP JPEG per frame. On the 10 FPS source,
each request also reopened and validated the full neutral pack, producing
approximately 0.17–
That path is removed from continuous playback. M4.8 now consumes the frozen
`missioncore.laboratory-recorded-clip-viewer/v1` : the backend validates the
content-addressed pack and all selected camera fragment hashes once, binds the
canonical recorded-media generation, and the browser admits one compact
manifest before fetching bounded fMP4 fragments ahead of the source clock.
Switching clips, review/adjudication surfaces, or CAMERA/3D/PLAN modes does not
create another media configuration or another port. The exact JPEG endpoint is
retained only for a paused-frame/failure fallback and no longer participates in
normal playback.
The camera-fragment identity remains byte-exact. The replay graph stores integer
nanoseconds while the fMP4 boundary is represented through its media timescale;
the binding therefore admits at most `1,000 ns` of representation drift and
rejects any larger timeline change. Live acceptance on the canonical backend
confirmed a warm source projection in `12– , the manifest in `13 ms` , and
21 init/fragment reads at `6.13 ms` mean, `10.94 ms` p95 and `23.02 ms` maximum.
The first post-process durable-package restoration is one explicit initial
admission and is not repeated per frame.
Acceptance also exposed and closed a shared loop defect: a backward clip target
had been misclassified as forward rolling-buffer progress. The shared player now
keeps rolling only for the same or a later segment and performs a decoder seek
for rewind/loop. A live six-second clip crossed `5.832 → 6.062 → 0.177 s` with
`readyState=4` , continuous playing state and no frame loader.
This viewer version is held as an architecture invariant. New LABs reuse
`LaboratoryRecordedClipPlayer` ; they may supply domain overlays and a typed
alternative scene, but cannot own frame timers, MediaSource, per-frame playback
fetches, Rerun receivers or loading grammar. CAMERA is continuous and driven by
the recorded media clock. M4.8 `3D` and `PLAN` use the shared companion
presentation: the spatial scene and RIGHT camera remain visible together, play
from one media clock, and switching representation does not pause or remount the
decoder. Exact spatial frames are prefetched by a bounded 14-frame look-ahead
window, retained in a 24-frame client cache, and served through a 256-frame
backend LRU; the cache also looks through the clip-loop boundary.
Live acceptance on `m48-clip-02` confirmed camera progression
`11.991 → 14.841 s` and spatial progression `121 → 149` over the same interval.
Across 12 consecutive observations the 3D sequence changed 12 times with zero
loader observations. A separate loop check crossed `17.904 → 12.010 s` , advanced
16 distinct spatial sequences and again exposed no intermediate loader. This is
recorded source-paced evidence, not physical-live or navigation authority.
The selected evidence is not uniformly body-frame qualified: `1,202/1,464`
review frames expose the bounded current LiDAR increment, while `262` are
camera-only because no qualified body frame exists. The first selected clip is
camera-only for all `61` frames; the remaining clips have partial spatial
coverage. The review UI presents those frames as explicit unavailable evidence,
uses one admitted channel, creates no empty spatial canvas and never interprets
the absence as free space.
The frozen evaluation now runs through the canonical laboratory runner and
emits a content-addressed run receipt alongside the quality result. This is
execution provenance, not gate acceptance: the current pack remains at `0/2`
frozen independent reviews, with no adjudication, truth seal or evaluated M4.8
result.
### 2026-08-24 — M4.8 Worker 006 assisted correction LAB
The operator-facing final check no longer starts from an empty annotation
surface. A separate capability-bound correction session projects the immutable
Worker 006 prediction rows into editable class-free boxes before the first clip
opens. The current pack contributes `5,236` boxes across all `1,464` frames and
all `24` clips. The operator selects, moves, resizes or deletes an existing box,
draws a missing box, and then explicitly marks each clip reviewed.
This workflow reuses the same `LaboratoryRecordedClipPlayer` , camera/3D/PLAN
controls, split pane, timeline and spatial cache as the blind workflow. It adds
no viewer, Rerun blueprint, port, media transport or experiment-local playback
clock. Because the accepted M4.7 output has no provider tracklet identity, each
frozen detection is projected honestly as a one-frame editable object; the LAB
does not fabricate temporal identity between adjacent detections.
The correction artifact stores the frozen prediction-row SHA-256, original
Worker identity, complete corrected clip set and a deterministic human delta:
confirmed candidates, unchanged candidates, modified candidates, deleted false
positives and added misses. Its assistance mode is
`frozen-candidate-seeded` ; candidate predictions are explicitly visible, model
scores and semantic classes remain absent, and `independent_truth_eligible` is
always false. Freezing this artifact therefore supplies regression evidence for
Worker 006 without pretending that candidate-assisted review satisfies the
two-reviewer independent release gate above.
The correction UI persists the clip-level `reviewed` transition immediately;
there is no second global Save action after the operator changes that checker.
Object geometry/state edits retain their bounded explicit Save action. Success
and error statuses use the canonical independently timed toast lifecycle and
roll a failed clip-status transition back to the last server revision while
preserving any pre-existing dirty object edits.
Small static objects are not split into semantic one-off rules for bins,
bollards, pipes or road hemispheres. M4.8 already records two orthogonal state
dimensions: `threat` is the immediate threat decision, while
`critical_corridor_obstacle` means that the object constrains passage and must
receive avoidance/clearance treatment even when `threat=not-threat` . The LAB UI
therefore exposes the latter as the separate **Проезд → Объезд или запас**
option. A camera rectangle is review evidence only: it cannot become
an oversized 3D collider. Future planner clearance must derive from admitted
LiDAR/local-occupancy geometry, its uncertainty envelope and the configured
vehicle footprint. This distinction is part of the durable M4.8 contract and
must not appear or disappear with detector-class tuning.
### 2026-08-24 — M4.8R1 small-static passage regression baseline
The first correction-derived regression is a new experiment inside the existing
M4.8 human LAB, not a replacement for the assisted-correction run. It keeps the
`m48-class-free-object-quality/v1` pipeline fixed, uses experiment
`m48-small-static-passage-regression/v1` , and publishes append-only run label
`M4.8R1` . The source correction session and frozen Worker 006 pack are read-only
inputs; no correction revision, pack artifact or earlier LAB result is mutated.
Canonical run
`m48-small-static-passage-regression-3e3a2001f87fd3adcb736de52a65e42515044d83faa3515f892705b40915c084`
snapshots revision 29 of the assisted correction. It contains `14`
operator-added exact-frame anchors across `8` reviewed clips, including `12`
anchors marked **Объезд или запас ** . Against the frozen `5,236` Worker 006 boxes,
the exact-frame class-free comparator found `0/14` matches at IoU `>= 0.50` .
This deliberately fails the diagnostic `0.90` assisted-anchor recall target and
establishes a concrete miss baseline for the next perception experiment.
The result is not independent truth: the operator saw the Worker 006 candidates,
and the selection is intentionally biased toward objects that required manual
addition. It therefore cannot produce unbiased precision/recall or satisfy the
two-reviewer M4.8 release gate. A camera rectangle is also not a metric collider;
clearance and passability remain functions of admitted LiDAR/local occupancy,
uncertainty and the configured vehicle footprint. Physical live, navigation,
commands, actuation and collision-safety authority remain false.
The regression reuses the held M4.8 recorded viewer and its CAMERA/3D/PLAN,
single media clock, timeline and bounded spatial cache. Each assisted anchor and
the frozen Worker objects are shown only on their exact source frame; the UI does
not drift a manually drawn rectangle across subsequent frames or fabricate a
track. A later Worker candidate must publish another immutable M4.8R run against
the frozen seed, leaving this baseline available for before/after comparison.
## Implementation order
DCCONSTRUCTIONS