NODEDC_MISSION_CORE/docs/audits/2026-09-19-entry-acquisition.md

# Entry acquisition — protocol fixed before execution

This increment implements a bounded initial search separately from local tracking.
It preserves the failed causal baseline and GICP policy v1. The owner accepts
roughly 30 s of preparation, but a stale calculation cannot confer current
localization. There are no hardware commands or autonomous-control authority.

## Frozen experiment v1

- Existing reference A forward 30.012 m, original B receipt-paced 1× input. The
  old fitted B transform, correspondence mask and future B poses are forbidden.
- Initial heading still comes from the already observed first >=3 m displacement.
  Standing-start heading recognition is not added in this increment.
- 27 initial hypotheses: along/across-entry offsets {-3,0,3} m in the reference
  route heading basis, times yaw offsets {-15,0,15} degrees. Yaw is applied around
  the query entry, not the arbitrary map origin. No vertical search.
- Each seed runs unchanged local GICP v1 (including its <=3 m patch-center
  correction gate). A final acquisition must also put the query entry inside a
  5 m horizontal radius, within 1 m vertically, and within 30 degrees of the
  route-entry/travel-heading hypothesis. This bounds initial search separately
  from each local optimization; it does not establish a measured capture radius.
- Group accepted solutions with pairwise entry-position distance <=0.5 m and
  rotation <=5 degrees. Rank by overlap, then residual. Require >=3 agreeing
  hypotheses from >=2 distinct translation grid positions. Multiple seeds are
  robustness checks, not independent observations or a probability of correctness.
- If any other solution group has overlap within 5 percentage points and RMSE
  within 0.03 m of the best solution, reject as ambiguous, even if it has fewer
  seeds. Never accept a partial/timed-out search as unambiguous.
- One numeric child / CPU thread, 27 seeds per initial search, total internal
  search deadline 25 s and external child deadline 30 s. Maximum two acquisition
  attempts per continuous receipt segment, separated by >=10 s on rejection.
  Replay remains bounded by 120 s / 40 m and existing point limits.
- A fresh accepted search is only candidate #1. Tracking still needs three fresh
  compatible causal windows at >=5 s cadence, with the unchanged 8 s freshness,
  0.5 m / 5 degree continuity checks. Following fits use the previous fresh
  candidate. Gap, stale result, ambiguity, end of input or an incompatible fit
  removes current tracking. Failed results never seed subsequent tracking.

## Acceptance and controls

First prove anchor-preserving seeds, known synthetic transform recovery,
ambiguous repeated geometry rejection, outside-search-bound rejection, budget
exhaustion and no partial-search acceptance in focused tests. Then run one real
positive causal trace and negative searches on the already frozen wrong-region
snapshot A 130–155 m / B causal step 3 and on a query displaced 1000 m with an
unchanged entry hypothesis. Preserve all attempts and checksum inputs/outputs.
The far-seed control represents this displacement by adding 1000 m to each
translation component of the initial transform, with the actual query unchanged.
All compute probes run sequentially and are bounded functional checks, not load
tests or qualification of the future onboard computer. No new field capture.

Record first search, first accepted candidate, first 3-window tracking, time spent
tracking, losses, worker latency/input age, search clusters, replay lateness and
integrity. Wrong-region acceptance, unexplained position jumps or ambiguity block
advancement. Success on this pair does not establish pose accuracy or robustness
across locations. No parameter adjustment after a failing probe without a new,
explicitly versioned protocol and retained old result.

## Executed evidence

Reference A: JA-SADOVAYA-001, session `20260911T085226Z_viewer_live`, forward
30.012 m from the immutable run `820571ba-6076-482b-be34-29ceb5328c80`.
Query B: JA-SADOVAYA-002, session `20260911T134352Z_viewer_live`, raw MQTT and
original monotonic receipt metadata. Only the reference cloud/path were read
from the offline artifact; its fitted B transform and query cloud were not used.

Positive run `20260919-acquisition-001`: 2026-09-19T10:54:19.671Z through
10:55:22.797Z, start monotonic ns 832936970922333. Darwin arm64, Python 3.12.13,
small_gicp 1.0.1, one numerical child and one CPU thread; 974 causal pose/cloud
deliveries in 63.126 s, stopped at 40.038 m. Fixed reference preparation took
0.033 s from the existing artifact and is not raw-map preparation performance.

- First available heading/window: 30.812 s. The original receipt stream has a
  9.973 s gap and a 10.407 m pose displacement; it was preserved and fenced.
  Less than 3 m displacement had been available before this gap.
- Initial search evaluated all 27 hypotheses in 1.984 s inside the worker
  (2.208 s full worker wall time). Six accepted seeds formed one solution
  cluster; no alternative eligible cluster. First fresh candidate at 33.033 s,
  input age 2.221 s. The search used no previously known fitted transform.
- Three-window consistency first passed at 42.362 s, at the window whose query
  path length was 22.046 m. Tracking stayed qualified until input ended at
  63.126 s, when it was explicitly cleared. There was no post-lock real gap in
  this trace, so recovery after loss was not physically demonstrated.

| Window | Query distance, m | Input time, s | Overlap | Inlier RMSE, m | Input age at completion, s | Temporal state |
| --- | ---: | ---: | ---: | ---: | ---: | --- |
| 1, initial search | 13.268 | 30.812 | 98.72% | 0.146 | 2.221 | acquiring |
| 2 | 17.470 | 35.950 | 98.86% | 0.154 | 0.837 | acquiring |
| 3 | 22.046 | 42.015 | 98.68% | 0.153 | 0.346 | tracking |
| 4 | 26.826 | 47.786 | 98.33% | 0.156 | 0.323 | tracking |
| 5, beyond reference path end | 31.455 | 52.940 | 97.59% | 0.161 | 0.486 | tracking |
| 6, beyond reference path end | 36.019 | 58.873 | 92.97% | 0.177 | 0.522 | tracking |

Tracking fits took 0.068–0.117 s numerically, 0.263–0.457 s including the worker.
Maximum replay delivery lateness was 0.184 s; maximum buffer ingestion 0.00332 s.
Successive accepted transforms differed at the current scanner position by at
most 0.01494 m and 0.161 degrees. These are consistency measurements, not ground
truth pose errors. Overlap counts points within 0.5 m; it is not a correctness
probability. The last two windows test cloud coverage beyond the reference path
end and must not extend route acceptance. Only windows 3 and 4 demonstrate the
qualified tracking state while still within the selected 30 m path.

## Negative controls

`20260919-acquisition-controls-001`, 2026-09-19T10:55:45.043Z through
10:56:19.476Z, used the previously frozen causal step-003 query.

- Wrong region A 130–155 m: all 27 hypotheses evaluated in 7.294 s, no eligible
  solution cluster, `no-admissible-entry`. No false acceptance on this control.
- Far initial translation (+1000 m on all axes): 13 hypotheses in 26.801 s;
  internal soft budget expired between seeds. `incomplete-search`, no candidate.
  This proves rejection on budget exhaustion, not full search of all 27 seeds.

The original input digests, all 31 positive and 6 control artifacts, and the
executed source digests were checked again after completion. Private evidence
is under `data_dir/missions/causal-replays/`; no geometry entered Git. Exact
sources and the later live-integration source are copied to
`20260919-acquisition-executed-source-001` with a manifest. Report SHA-256:

- positive: `bf1a8c44e2a9960d06748d7061c19a3ae47e945242896359c57462bc402d3235`
- controls: `77cb3ca147105439439560649ad4564266f0a53fac4b280a660525e4fac511b2`

## Implementation and validation

`entry_acquisition.py` separates bounded entry search, complete-link solution
clustering, ambiguity checks and support gates from unchanged local GICP.
`entry_acquisition_worker.py` isolates the search with a 30 s hard child deadline.
The acquisition mode in `causal_replay.py` uses it until a fresh candidate exists,
then seeds local refinement from that candidate. No rejected fit seeds tracking.

The existing `PlanningLiveTests` profile now uses the same entry search and
`CausalTracking` evaluator. It retains session/generation ownership, bounds the
attempt count per receipt segment, and records seed and policy provenance.
Green correspondences require three fresh consistent windows. Gaps, stale input,
rejection and input end remove green qualification; a final historical worker
cannot restore current tracking. It still has no scanner or vehicle commands.

49 focused tests passed: entry/causal/live/projects/registration/viewer replay.
These include synthetic known-transform recovery, ambiguity with unequal support,
complete-link clustering, anchor-preserving yaw, region/height/angle limits,
partial-search rejection, prefix-only input, stale/gap fencing and live controller
integration (one initializer, then two local fits; green only on the third;
silence expires the result and releases the consumer lease). Ruff passed on new
and replay files; `git diff --check` passed. One existing Starlette/httpx
deprecation warning remains. No frontend code or layout changed this increment.

The canonical service was restarted only after verifying idle source, no physical
scan and no camera recording. On 2026-09-19T11:04:37.611Z the new backend started
on 127.0.0.1:8000 (PID 60284); `/` and `/api/health` return 200. Nothing listens on
8765; no numerical children or replay jobs remain. Docker VM was not started.
The engineering summary, fixed protocol, controls, limitations and acceptance
checker were saved in MISSIONCOR-81 (34 preserved/appended structured blocks).

## Decision and next stage

The bounded initial search resolves the observed entry-acquisition failure on
this A/B pair while preserving the previous local-refinement policy. It supports
continuing the teach-and-repeat research without another capture for this step.
It does not establish arbitrary-start localization, stationary calibration,
independent metric accuracy, a reliable 5 m capture radius, or onboard capacity.
The 8 s freshness and 5 s cadence are diagnostic settings, not navigation limits.

Next isolate recovery and initialization from travel: test deliberate receipt
loss after tracking and wrong-start/repeated-geometry cases; then develop a
stationary accumulation/heading hypothesis protocol. Preserve this successful
trace as a fixed regression. A fresh physical short pass, concurrent camera/UI
acceptance and qualification on the actual onboard computer follow separately.
No need for the operator to repeat the route now. Autonomous steering, collision
avoidance and vehicle-control authority remain outside this increment.