NODEDC_MISSION_CORE/docs/audits/2026-09-20-mid-route-016-retrieval-diagnosis.md

Two mid-route starts: retrieval failure, not absence of matching geometry

Date: 2026-09-20. Scope: inspect physical attempt 016 and fix the explicitly requested vertical-scale outline. No production localisation logic, admission threshold, device command, raw recording or historical result was changed.

Evidence and integrity

The operator reports first starting approximately 30 m along the reference, then moving closer, approximately 20 m, and pressing reinitialisation. The saved run contains two stationary initialisations and one fresh validation. All 18 artifact hashes listed by its report match the files on disk, including both frozen initialisation inputs and the fresh registration input. The report records no receipt gaps. Prefix maximum motion was 5.0 mm and 5.4 mm: motion during the stationary prefix does not explain the failure.

This is one recording with two positions, not two independent captures. The operator's distances are approximate, not surveyed ground truth.

What actually ran

Both initialisations completed the 108-fit dense start stage and then the 18-fit route fallback. There was no worker timeout. Fallback wall time was approximately 3.1 s after approximately 15 s for the start stage.

The fallback descriptor evaluated all 18 anchors on the selected 81.06 m reference. rank_route_candidates then retained only the first six; exact registration evaluated three yaw seeds for each. It did not proceed to the remaining descriptor candidates after rejecting that shortlist.

Attempt	Anchors admitted to exact registration, in descriptor order	Live outcome
First	0, 5, 10, 81.06, 80, 75 m	No admitted route location
Reinitialised	0, 5, 81.06, 80, 75, 10 m	Provisional hypothesis near the route end; rejected by fresh validation

The second provisional transform placed the scanner nearest route progress 79.76 m, with 74.16% point overlap and 0.2475 m inlier RMSE. Its fresh check reported 77.14% overlap and 0.2407 m RMSE, but failed numerical convergence (converged=false). The hypothesis was never confirmed as tracking. It is inconsistent with the operator's reported location; high overlap alone cannot justify admitting it. Lowering the gate or ignoring convergence would therefore not be an appropriate remedy.

Bounded offline counterfactual

Read each frozen route-relocalization-input.npz and call relocalize_route with the production policy, changing only candidate_count from 6 to 18 so every existing anchor reaches the same three-yaw exact fit. Retain the same clouds, 30 s deadline, 40 iterations and all geometric thresholds. No live publication or historical result rewrite occurs.

Input	Selected anchor	Estimated scanner progress along reference	Point overlap	Inlier RMSE	Converged
First prefix	30 m	30.10 m	96.95%	0.1472 m	Yes
Reinitialised prefix	20 m	24.47 m	98.41%	0.1547 m	Yes

Both searches completed and returned a candidate without relaxing acceptance. The first 30 m anchor ranked fifteenth; the second 20 m anchor ranked fourteenth. The second 25 m anchor ranked thirteenth and independently fitted the same location with 98.41% overlap. Distances from fitted scanner position to the nearest reference path sample are approximately 1.03 m and 2.03 m.

Overlap is the measured fraction of evaluated points within 0.5 m, not a probability of correct location, centimetric accuracy or a vehicle-safety qualification. Inlier RMSE is cloud residual, not independently measured pose error. The counterfactual does not replay fresh confirmation or prove a live recovery. It isolates a concrete retrieval false negative.

Code-level cause and next decision

route_relocalization.py ranks radial-height histograms around cloud medians: a 20 m live footprint is compared to 28 m reference contexts. These differently observed and populated clouds can rank the true location poorly. The rankings above prove that defect on this capture; they do not isolate which descriptor feature is responsible.

The implementation is only a truncated cascade: it discards candidates after the sixth, labels completion relative to those attempted fits, and offers only one provisional transform. StationaryBootstrap.accept_fresh ends initial confirmation on rejection; it does not resume the ranked candidate queue. Automatic recovery after established tracking does not repair cold-start shortlist exhaustion.

Recommended implementation, not applied in this turn:

1. Preserve the established dense start path and local tracking.
2. Use ranking as work order, not as a permanent exclusion of other areas. Process spatially diverse candidate batches and continue the queue after rejection, under an explicit compute/freshness budget.
3. When the budget is exhausted with unvisited candidates, report incomplete search, not evidence that the route cannot be matched.
4. Improve descriptor observation comparability and verify distinct competing locations before promotion. Continue to another viable candidate when fresh confirmation rejects a provisional one; preserve source-age and identity fences and never reuse stale confirmation data.
5. Qualify against both frozen prefixes, wrong-location/ambiguity controls and the known successful start/tracking recordings before requesting another field test. Increasing a constant to 18 is a diagnostic, not the scalable product design for a kilometre route.

Outline correction

The shared Design Guideline explicitly drew a 2 px outline on the vertical range wrapper when its native input matched :focus-visible. This state can survive pointer interaction. The vertical variant now has no border, outline or shadow in any state. Focus-visible underlines both existing contrast-aware central text layers. Native arrow/Home/End behaviour, left-side endpoints and the 80 m domain range remain unchanged. The shared registry, documentation, catalog specimen and contract test changed together; no app-local CSS override or localisation change was introduced.

Validation and handoff

• Shared range contract: 5/5; Design Guideline registry validation and core / catalog typechecks passed.
• Mission Core architecture contract: 4/4; full frontend typecheck passed; full frontend unit suite: 872/872; production build passed. Existing bundle size warning remains; no new server or scanner session was started.
• Browser QA on the saved 016 scene in normal and expanded layout: slider min -3.023, max 80. Pointer click changed value to 38.48 with real input focus; native and wrapper outlines were 0 px, border 0 px, shadow none. Keyboard focus underlined both contrast layers; Up changed the value, End restored 80.
• Canonical service on port 8000 served the new production CSS/JS and remained healthy. No temporary numerical workers or build watchers remain. One background saved-evidence view is retained for owner review, at the full 80 m clipping range. Device state is idle.