docs(lab): freeze M4.8 viewer and regression canon

docs/15_LABORATORY_RUN_CANON.md

@@ -185,6 +185,29 @@ The evidence slot has two admitted renderers:
 - `diagnostic-model` — a specialized visual result such as the LAB E28 L2.6
   surface/timeline/review viewer.
 
+Recorded camera clips used for review are a frozen sub-contract of the admitted
+viewer, `missioncore.laboratory-recorded-clip-viewer/v1`, implemented by
+`LaboratoryRecordedClipPlayer`. It owns the generation-bound fMP4 manifest,
+bounded MediaSource buffering, source-time playback clock, clip looping and the
+canonical timeline. A LAB may provide typed overlays and an alternative spatial
+scene, but it may not implement its own frame timer, per-frame JPEG playback,
+media cache, port, Rerun blueprint or loading grammar. Exact JPEG remains a
+paused-frame/fallback evidence endpoint, never the continuous playback transport.
+Forward frame progression may roll an already-buffered segment target; a
+backward seek or clip loop must perform an explicit decoder seek and remain
+decoder-ready without exposing a per-frame loader.
+
+When recorded camera and frame-indexed spatial evidence are both required for
+one review question, the shared player presents them simultaneously on the same
+media clock. The camera remains the clock owner; a bounded experiment-neutral
+spatial cache prefetches exact source sequences, including across the loop
+boundary. Mode switching changes presentation only. It must not pause the clock,
+hide the companion camera, create another transport, or flash a full-stage
+loader between spatial frames. Connected M4.8 workflows project CAMERA, 3D and
+PLAN through the same left-side vertical glass rail of canonical circular
+actions; the report, assisted correction and formal review flows do not invent
+separate mode-control geometry.
+
 An admitted diagnostic viewer may own the result interaction internally when
 the evidence itself is the review/result instrument, as in E28 and E30. This is
 not permission to omit the result from a new ordinary LAB report. New bounded

docs/17_PRODUCT_UI_AND_LAB_PRESENTATION_CANON.md

@@ -173,6 +173,37 @@ The viewer frame must:
 - remain keyboard-addressable and restore the previous surface on Escape;
 - avoid hard-coded product colors and application-local focus/hover states.
 
+Connected recorded review uses stacked viewer chrome: source/case navigation
+occupies a dedicated header above the visual viewport; playback controls and
+the timeline occupy a dedicated transport panel below it. CAMERA/3D/PLAN use
+one reusable vertical `GlassSurface` rail on the left of the viewport. Its
+three actions are canonical 46 px circular `IconButton` controls: an outline
+camera glyph, the `3D` text glyph and an outline plan glyph. The rail may float
+over the viewport but must not resize it; every other control region remains
+outside the camera/spatial interaction area. These regions form one seamless
+viewer surface without per-region outlines or gaps. When spatial
+and camera evidence are shown together, the shared vertical divider is
+pointer- and keyboard-resizable, preserves one mounted camera transport, and
+may only reveal its visual affordance while hovered, focused, or dragged.
+CAMERA visibility remains independent. 3D/PLAN remain mutually exclusive
+spatial modes whose selected mode can be disabled while CAMERA stays visible.
+The UI must preserve at least one visible evidence channel and must not encode
+CAMERA, 3D and PLAN as one exclusive group.
+
+For recorded clip review, continuous camera playback must use the shared
+`missioncore.laboratory-recorded-clip-viewer/v1` transport: one immutable
+manifest admission followed by bounded generation-bound fMP4 fragments on the
+source media clock. A visible loader on every source frame, a LAB-owned timer,
+or a LAB-owned video/Rerun configuration is a contract regression. Spatial modes
+whose evidence cannot be delivered at source pace remain explicit frame-step
+modes; they must not stall or relabel the camera clock as realtime. When spatial
+evidence is admitted at source pace, it follows the same source sequence through
+a bounded look-ahead cache. CAMERA + 3D/PLAN remain simultaneously visible, and
+no intermediate spatial miss may replace or stop the camera surface.
+The shared player may retain a rolling target only for the same or a later
+segment. Rewind and clip-loop transitions must seek backward explicitly while
+keeping the admitted generation and decoder owner mounted.
+
 ### 3D and 2D policy
 
 Choose the default representation from the operator question:
@@ -187,6 +218,10 @@ When both questions matter, expose 2D and 3D as modes of the same viewer. They
 must use the same selected case and immutable source indices. Do not create a
 second LAB page or duplicate the evidence state.
 
+For M4.8, **3D/PLAN always includes the synchronized RIGHT-camera companion**.
+The point cloud must advance with the recorded media clock; a paused 3D snapshot
+with disabled playback is not admissible evidence for connected-object review.
+
 For E30, **camera + projected LiDAR is the default** because the first review
 question is whether a camera claim, its bbox and the projected points refer to
 the same visible object. A black pixel-plane scatter without the exact camera

docs/18_APPLICATION_COMPONENT_ARCHITECTURE.md

@@ -175,6 +175,36 @@ receives a concise typed projection.
 DOM or CSS classes. The product UI test discovers every `ENNResult.tsx`
 automatically and rejects such a fork.
 
+`components/laboratory/LaboratoryRecordedClipPlayer.tsx` exclusively owns the
+versioned `missioncore.laboratory-recorded-clip-viewer/v1` camera transport and
+clock. Feature renderers may add typed overlays or a synchronized spatial scene
+through its slots. Source-paced spatial evidence follows exact media sequences
+through a bounded reusable look-ahead cache; frame-step remains an explicit
+capability only when the source cannot keep pace. Experiment-named players must not fetch a JPEG
+per playback frame, instantiate MediaSource, schedule frame timers, or declare a
+new Rerun receiver/blueprint. Forward buffered progression and backward
+loop/seek are separate shared-player transitions; a backward target cannot be
+treated as an ordinary rolling-buffer advance.
+
+The shared player owns the admitted `primary` camera and `companion` camera +
+spatial presentations. A feature mode may not disable playback, unmount the
+camera, or create a second viewer configuration merely to show 3D/PLAN.
+`LaboratoryEvidenceViewer` owns the reusable `stacked` chrome layout: one header,
+one visual stage and one transport/timeline rail joined into a seamless surface.
+`LaboratoryRecordedClipPlayer` reuses the canonical `SplitPane` for resizable
+spatial + companion-camera evidence while keeping the recorded camera owner
+mounted across CAMERA/3D/PLAN transitions. Feature code supplies typed actions
+and modes; it does not declare a feature-local splitter. M4.8 reuses one
+`M48EvidenceModeRail` projection in the report, candidate-assisted correction,
+independent review and adjudication surfaces. The rail is the admitted
+viewport overlay: a canonical `GlassSurface` containing three default-size
+`IconButton` controls and no local control geometry. CAMERA/3D/PLAN therefore
+do not return to the stacked header or fork per workflow:
+CAMERA visibility is independent from the nullable 3D/PLAN spatial mode, and
+their state transition cannot hide both channels. Candidate seed data belongs
+to the correction contract only; it cannot enter the blind source decoder or
+upgrade assisted evidence to independent truth.
+
 Legacy/integrated diagnostic viewers may keep a result interaction inside the
 evidence slot only where that viewer is already the admitted result instrument.
 This exception does not apply automatically to a new LAB.

docs/22_MILESTONE_4_OBJECT_CENTRIC_RECORDED_REALTIME_CV.md

@@ -2,9 +2,10 @@
 
 Date: 2026-08-05
 
-Status: in progress; M4.0–M4.6 accepted, the M4.7 canonical graph and Worker
+Status: in progress; M4.0–M4.6 and the M4.7 canonical lossless Worker 006
-006 shadow artifact are implemented locally, and Worker preflight/full shadow
+shadow are accepted, M4.8 prediction-frozen review-pack preparation is complete,
-acceptance plus durable cutover remain open
+and the independent reviews/adjudication, M4.8 scoring, M4.9 release candidate
+and durable Worker cutover remain open
 
 Audit base: `1b3e0b3` on `feat/simulation-polygon-s1`
 
@@ -500,10 +501,11 @@ Physical mounted threat acceptance remains outside Milestone 4.
 
 ### M4.7 — cut Worker 006 over to the canonical graph
 
-Status: implementation complete locally on 2026-08-23; Worker 006 preflight,
+Status: the isolated Worker 006 preflight and full lossless shadow were accepted
-full lossless shadow evidence and durable process replacement are not yet
+on 2026-08-23 with all `4,489` frames delivered, zero parity mismatches and queue
-accepted. The current E15 worker and Triton identities remain the rollback
+high-water mark `2`. Durable process replacement is not implemented or accepted.
-predecessor. No K1, Zarya or connection-stack change is part of this phase.
+The current E15 worker and Triton identities remain the rollback predecessor. No
+K1, Zarya or connection-stack change is part of this phase.
 
 Deliverables:
 
@@ -533,8 +535,9 @@ adds a separate object-centric review contract; it does not require class labels
 Dataset construction:
 
 - freeze 20–30 connected clips of 5–10 seconds across route/time blocks;
-- include occupied object, background false-positive, partial occlusion, fisheye
+- derive the private balancing hypotheses only from already frozen prediction
-  edge, small obstacle, moving crossing, static obstacle and no-object strata;
+  rows (associated/unassociated, moving/static/threat, small, fisheye-edge and
+  sparse-scene signals); never use unrevealed truth to select the release set;
 - label obstacle presence/extent, current geometry association, freshness,
   moving/static/unknown and virtual-corridor threat/unknown;
 - freeze graph predictions before review labels are joined;
@@ -1194,12 +1197,199 @@ accepting the run. This makes Worker 006 usable without touching the stabilized
 K1/Zarya connection path.
 
 Local contract, graph, result-sealing, artifact and historical-rollback tests
-pass. This is implementation evidence only. It does not claim that Worker 006
+pass. Worker result
-has the pinned local-surface input, that preflight has passed, that the 4,489
+`m47-reference-graph-5f6a851cd655c7cf07c3025dacadbc188018b0afa97eda3a08802266e12da87d`
-frame graph shadow matches the accepted M4.5R/M4.6 ledgers, or that the durable
+sealed the full shadow with `4,489/4,489` admitted and delivered frames, zero
-E15 command has been replaced. Those are the next M4.7 acceptance actions, in
+failed/stale/superseded/rejected/unavailable outcomes and zero mismatches in all
-that order. K1, Zarya, the stable connection path and physical-live authority
+seven parity dimensions. LAB result
-remain untouched.
+`m47-reference-graph-lab-49678f0a7c628c7e991af0964fa57d005baa027d2d1eea19f38bbfe27ed39ce5`
+therefore opens the independent object-centric quality gate. This does not claim
+that the durable E15 command has been replaced: the accepted runner is explicitly
+one-shot shadow-only, and the required persistent service, telemetry-continuity
+and automatic rollback contract do not yet exist. K1, Zarya, the stable
+connection path and physical-live authority remain untouched.
+
+### 2026-08-24 — M4.8 independent review pack frozen
+
+The first provenance-complete M4.8 pack is
+`m48-object-quality-pack-680c091cd81cce802931dbb8987db6f26dc568c5d7395166cda2e9e5a4c78e27`.
+It binds the accepted M4.7 LAB manifest, exact M4.6 threat ledger and exact
+single-sample camera-fragment hashes for all `4,489` source frames, plus the
+adapter, selection, camera index, graph, threat and geometry manifests/ledgers by
+SHA-256. The selected review surface contains `24` non-overlapping connected
+clips of approximately six seconds each (`12` development and `12` validation;
+`1,464` selected frames) across six split-local route blocks and eight
+split-local time blocks. All eight private balancing hypotheses are derived
+mechanically from the frozen prediction rows and are present in validation; the
+reviewer projection contains neither those hypotheses nor frozen boxes, IDs,
+scores, model identity or semantic-class tasks.
+
+The pack state is intentionally
+`prepared-predictions-frozen-labels-unavailable`. It is not an accepted quality
+result. Two distinct capability-bound reviewers must complete the class-free
+tracklet review, both submissions must freeze, and a separate adjudication must
+seal before the frozen predictions can be joined. Only then may the deterministic
+per-frame ledger, critical-first failure atlas and M4.8 thresholds produce an
+ACCEPT or REJECT. Release gates use validation only; development and combined
+metrics remain diagnostic. No aggregate metric may waive a false-free claim, critical
+miss, hidden terminal outcome or critical `threat`→`not-threat` error.
+
+### 2026-08-24 — M4.8 laboratory architecture hardening
+
+M4.8 is represented by one catalog work,
+`m48-object-centric-quality`, whose evidence lifecycle advances from the
+prepared review pack to the terminal quality result instead of publishing two
+competing LAB cards. Review and adjudication use one shared focus-owning
+laboratory workspace frame, while opening either full-screen capability unmounts
+the background work output. Consequently only one camera decoder, spatial
+renderer and playback clock can own the selected evidence at a time.
+
+The M4.8 surface reuses the shared recorded camera and metric spatial viewers;
+it defines no Rerun blueprint, receiver, window identifier or per-LAB viewer
+configuration. Spatial legends are derived from admitted data and enabled
+layers, so source-only review does not advertise unavailable threat, rolling or
+local-surface semantics. Recorded-camera decode lanes and source manifests are
+bounded by independent LRU caches. These changes do not alter the stabilized K1
+connection, control or physical-live path.
+
+The earlier M4.8 camera surface nevertheless still advanced playback through an
+experiment-local timer and decoded one HTTP JPEG per frame. On the 10 FPS source,
+each request also reopened and validated the full neutral pack, producing
+approximately 0.17–0.42 s frame latency and a visible loader between frames.
+That path is removed from continuous playback. M4.8 now consumes the frozen
+`missioncore.laboratory-recorded-clip-viewer/v1`: the backend validates the
+content-addressed pack and all selected camera fragment hashes once, binds the
+canonical recorded-media generation, and the browser admits one compact
+manifest before fetching bounded fMP4 fragments ahead of the source clock.
+Switching clips, review/adjudication surfaces, or CAMERA/3D/PLAN modes does not
+create another media configuration or another port. The exact JPEG endpoint is
+retained only for a paused-frame/failure fallback and no longer participates in
+normal playback.
+
+The camera-fragment identity remains byte-exact. The replay graph stores integer
+nanoseconds while the fMP4 boundary is represented through its media timescale;
+the binding therefore admits at most `1,000 ns` of representation drift and
+rejects any larger timeline change. Live acceptance on the canonical backend
+confirmed a warm source projection in `12–16 ms`, the manifest in `13 ms`, and
+21 init/fragment reads at `6.13 ms` mean, `10.94 ms` p95 and `23.02 ms` maximum.
+The first post-process durable-package restoration is one explicit initial
+admission and is not repeated per frame.
+
+Acceptance also exposed and closed a shared loop defect: a backward clip target
+had been misclassified as forward rolling-buffer progress. The shared player now
+keeps rolling only for the same or a later segment and performs a decoder seek
+for rewind/loop. A live six-second clip crossed `5.832 → 6.062 → 0.177 s` with
+`readyState=4`, continuous playing state and no frame loader.
+
+This viewer version is held as an architecture invariant. New LABs reuse
+`LaboratoryRecordedClipPlayer`; they may supply domain overlays and a typed
+alternative scene, but cannot own frame timers, MediaSource, per-frame playback
+fetches, Rerun receivers or loading grammar. CAMERA is continuous and driven by
+the recorded media clock. M4.8 `3D` and `PLAN` use the shared companion
+presentation: the spatial scene and RIGHT camera remain visible together, play
+from one media clock, and switching representation does not pause or remount the
+decoder. Exact spatial frames are prefetched by a bounded 14-frame look-ahead
+window, retained in a 24-frame client cache, and served through a 256-frame
+backend LRU; the cache also looks through the clip-loop boundary.
+
+Live acceptance on `m48-clip-02` confirmed camera progression
+`11.991 → 14.841 s` and spatial progression `121 → 149` over the same interval.
+Across 12 consecutive observations the 3D sequence changed 12 times with zero
+loader observations. A separate loop check crossed `17.904 → 12.010 s`, advanced
+16 distinct spatial sequences and again exposed no intermediate loader. This is
+recorded source-paced evidence, not physical-live or navigation authority.
+
+The selected evidence is not uniformly body-frame qualified: `1,202/1,464`
+review frames expose the bounded current LiDAR increment, while `262` are
+camera-only because no qualified body frame exists. The first selected clip is
+camera-only for all `61` frames; the remaining clips have partial spatial
+coverage. The review UI presents those frames as explicit unavailable evidence,
+uses one admitted channel, creates no empty spatial canvas and never interprets
+the absence as free space.
+
+The frozen evaluation now runs through the canonical laboratory runner and
+emits a content-addressed run receipt alongside the quality result. This is
+execution provenance, not gate acceptance: the current pack remains at `0/2`
+frozen independent reviews, with no adjudication, truth seal or evaluated M4.8
+result.
+
+### 2026-08-24 — M4.8 Worker 006 assisted correction LAB
+
+The operator-facing final check no longer starts from an empty annotation
+surface. A separate capability-bound correction session projects the immutable
+Worker 006 prediction rows into editable class-free boxes before the first clip
+opens. The current pack contributes `5,236` boxes across all `1,464` frames and
+all `24` clips. The operator selects, moves, resizes or deletes an existing box,
+draws a missing box, and then explicitly marks each clip reviewed.
+
+This workflow reuses the same `LaboratoryRecordedClipPlayer`, camera/3D/PLAN
+controls, split pane, timeline and spatial cache as the blind workflow. It adds
+no viewer, Rerun blueprint, port, media transport or experiment-local playback
+clock. Because the accepted M4.7 output has no provider tracklet identity, each
+frozen detection is projected honestly as a one-frame editable object; the LAB
+does not fabricate temporal identity between adjacent detections.
+
+The correction artifact stores the frozen prediction-row SHA-256, original
+Worker identity, complete corrected clip set and a deterministic human delta:
+confirmed candidates, unchanged candidates, modified candidates, deleted false
+positives and added misses. Its assistance mode is
+`frozen-candidate-seeded`; candidate predictions are explicitly visible, model
+scores and semantic classes remain absent, and `independent_truth_eligible` is
+always false. Freezing this artifact therefore supplies regression evidence for
+Worker 006 without pretending that candidate-assisted review satisfies the
+two-reviewer independent release gate above.
+
+The correction UI persists the clip-level `reviewed` transition immediately;
+there is no second global Save action after the operator changes that checker.
+Object geometry/state edits retain their bounded explicit Save action. Success
+and error statuses use the canonical independently timed toast lifecycle and
+roll a failed clip-status transition back to the last server revision while
+preserving any pre-existing dirty object edits.
+
+Small static objects are not split into semantic one-off rules for bins,
+bollards, pipes or road hemispheres. M4.8 already records two orthogonal state
+dimensions: `threat` is the immediate threat decision, while
+`critical_corridor_obstacle` means that the object constrains passage and must
+receive avoidance/clearance treatment even when `threat=not-threat`. The LAB UI
+therefore exposes the latter as the separate **Проезд → Объезд или запас**
+option. A camera rectangle is review evidence only: it cannot become
+an oversized 3D collider. Future planner clearance must derive from admitted
+LiDAR/local-occupancy geometry, its uncertainty envelope and the configured
+vehicle footprint. This distinction is part of the durable M4.8 contract and
+must not appear or disappear with detector-class tuning.
+
+### 2026-08-24 — M4.8R1 small-static passage regression baseline
+
+The first correction-derived regression is a new experiment inside the existing
+M4.8 human LAB, not a replacement for the assisted-correction run. It keeps the
+`m48-class-free-object-quality/v1` pipeline fixed, uses experiment
+`m48-small-static-passage-regression/v1`, and publishes append-only run label
+`M4.8R1`. The source correction session and frozen Worker 006 pack are read-only
+inputs; no correction revision, pack artifact or earlier LAB result is mutated.
+
+Canonical run
+`m48-small-static-passage-regression-3e3a2001f87fd3adcb736de52a65e42515044d83faa3515f892705b40915c084`
+snapshots revision 29 of the assisted correction. It contains `14`
+operator-added exact-frame anchors across `8` reviewed clips, including `12`
+anchors marked **Объезд или запас**. Against the frozen `5,236` Worker 006 boxes,
+the exact-frame class-free comparator found `0/14` matches at IoU `>= 0.50`.
+This deliberately fails the diagnostic `0.90` assisted-anchor recall target and
+establishes a concrete miss baseline for the next perception experiment.
+
+The result is not independent truth: the operator saw the Worker 006 candidates,
+and the selection is intentionally biased toward objects that required manual
+addition. It therefore cannot produce unbiased precision/recall or satisfy the
+two-reviewer M4.8 release gate. A camera rectangle is also not a metric collider;
+clearance and passability remain functions of admitted LiDAR/local occupancy,
+uncertainty and the configured vehicle footprint. Physical live, navigation,
+commands, actuation and collision-safety authority remain false.
+
+The regression reuses the held M4.8 recorded viewer and its CAMERA/3D/PLAN,
+single media clock, timeline and bounded spatial cache. Each assisted anchor and
+the frozen Worker objects are shown only on their exact source frame; the UI does
+not drift a manually drawn rectangle across subsequent frames or fabricate a
+track. A later Worker candidate must publish another immutable M4.8R run against
+the frozen seed, leaving this baseline available for before/after comparison.
 
 ## Implementation order