ADR 0045: Upstream Rerun as the canonical recorded-LAB pipeline

Date: 2026-08-30 Status: accepted; RAVNOVES004TREE is the first migrated full-route LAB

Navigation amendment, 2026-09-21: ADR 0052 records the owner-authorized, bounded native-camera patch. The historical decision below remains intact; single renderer/clock/data ownership still applies.

Implementation audit, 2026-09-05: see the complete customization inventory and upstream provenance evidence. The historical decision below remains recorded as written. The current code uses private Python blueprint/reader hooks, a camera-input journal and an outer controlled splitter; the old pointer-relay/native-divider description is no longer its implementation. The audit also distinguishes the canonical LAB's ready gate from Saved Sessions' progressive policy and lists unimplemented display settings. These are upgrade dependencies and known gaps, not claims that upstream packages have been modified.

Context

The accepted LAB product composition was repeatedly rebuilt over independent camera, semantic, point-cloud and TGS transports. The resulting implementation had several clocks, LAB-specific caches, a browser MediaSource decoder and a separate Three.js spatial renderer. A camera could continue while segmentation or the cloud stopped; rewind could expose evidence from different source sequences; switching TGS could block both panes. Low host utilization did not make that architecture correct: the bottleneck was duplicated admission, decoding, scheduling and state ownership.

The product owner requires the existing LAB UI and interaction grammar to stay unchanged. VIDEO/CAMERA, SOURCE POINTS/LOCAL SLAM/TGS COSTMAP/SEMANTICS and 3D/PLAN remain the canonical controls. Models and evidence providers may change, but a LAB may not create another player, clock, splitter, spatial renderer, window or status grammar.

The repository state before this migration is retained by the annotated Git tag baseline/custom-legacy-before-canonical-rerun-2026-08-30. Its Russian stage name is «Этап перехода от самописного legacy-контура к каноническому шаблонному Rerun-пайплайну».

Decision

Recorded LAB replay uses the unmodified upstream Rerun SDK and web viewer. The first accepted dependency is exactly rerun-sdk==0.36.3 and @rerun-io/web-viewer@0.36.3. Mission Core does not patch the package, vendor a viewer fork or depend on private viewer source. Product controls are an outer adapter which requests an ordinary Rerun blueprint.

One native Rerun viewer owns:

one session_time playback clock;
the recorded camera and semantic image-space evidence;
/world/points, /world/sensor_pose and /world/trajectory;
native 3D orbit and top-down plan presentation;
seek, play/pause and frame synchronization.

The canonical K1 RRD remains the source of pose, source points, bounded Local SLAM accumulation and trajectory. A LAB may publish one immutable normalized RRD sidecar containing only derived evidence absent from that recording, such as camera video, semantic masks and diagnostic 2D boxes. The base recording and sidecar must have the same application id, recording id and timeline. A sidecar does not copy, rotate or re-own world geometry.

RAVNOVES004TREE uses a digest-bound sidecar cache. Its sealed fMP4 fragments are verified, concatenated and transcoded once to an upstream-compatible H.264 AssetVideo. Source PTS are preserved. A fragment without a decodable sample holds the latest preceding frame; decoded samples are never renumbered to a synthetic fixed-rate clock. Each semantic mask and VideoFrameReference is logged at the exact immutable LAB session_time.

Profiles control loading rather than creating different viewers:

source points use zero accumulation;
Local SLAM uses a native five-second visible time range;
TGS COSTMAP and 3D SEMANTICS are enabled only when full-route immutable artifacts exist and share the recording clock;
semantic model buttons select an entity path in the same sidecar;
3D/PLAN changes native eye controls, never point coordinates;
layers missing from an immutable result stay visibly disabled and fail closed; they are not reconstructed from sparse review anchors.

The previous fMP4/Three.js LAB transport remains source-retained only for explicit legacy comparison. No canonical route selects it, preloads it or lets it start background work. Removal is allowed after migrated results pass the same acceptance checks and the rollback tag is no longer operationally needed.

Acceptance

A migrated recorded LAB is accepted only when:

the base RRD identity and sidecar identity match exactly;
camera, semantics, point cloud, pose and trajectory follow one Rerun clock;
play, pause, forward seek and backward seek do not remount the viewer;
SOURCE POINTS and Local SLAM are native views of the same sealed geometry;
unavailable TGS or semantic 3D evidence is disabled rather than simulated;
first materialization is cached by source/result/renderer digests and a cache hit performs no decode or inference;
the existing LAB page, selectors, report mode, controls and expand behavior remain unchanged;
Data replay and live Rerun profiles continue to use their own load policies;
the integrated application remains on 127.0.0.1:8000 and no second Mission Core service is introduced.

The isolated renderer materialized the first real RAVNOVES004TREE sidecar in 79.5 seconds. Under the live operator service, cold materialization completed in approximately seven minutes and produced a 393,203,594-byte RRD; this is too slow to treat as an interactive open and should be moved to publication-time preparation. With a full SHA-256 recheck on every cache hit, the warm product endpoint returned headers in 0.89 seconds and streamed the complete local artifact in 2.48 seconds. These measurements establish the local cache behavior, not a realtime inference or navigation claim.

Consequences

Mission Core keeps its product UI without owning media or spatial playback.
Rerun can be upgraded through ordinary dependency updates and regression tests instead of reapplying a local patch.
New models publish entities and annotations into the same recording contract; they do not add LAB-specific viewers.
SLAM clouds and trajectories stay visible through standard Rerun components.
Useful native boxes/cuboids may be added as ordinary entity layers when their immutable full-route evidence exists.
The migration does not improve DDRNet quality, prove terrain traversability or grant navigation/actuation authority. Those remain separate model and safety acceptance questions.

Resource ownership addendum — 2026-09-03

An active calculation/view may allocate what its admitted workload needs. On termination its ephemeral resources must become releasable; lowering evidence quality or deleting durable results is not a substitute for lifecycle cleanup.

Recorded viewers run the same unmodified upstream SDK in a disposable, same-origin iframe inside the existing viewer surface. A small synchronous facade exposes only the public methods already used by the product adapter. The revision-2 boundary returns primitive JSON strings, including events and errors; the parent parses them in its own realm. Native handles, DOM nodes, channels, unsubscribe closures and SDK startup Promises stay inside the iframe. Parent-owned RRD bytes enter a synchronous channel call, without transfer or changing the payload/quality. Parent startup Promises are settled by primitive notifications and rejected on disposal. Every channel is closed independently; a late SDK startup completion is stopped again. Teardown severs references and removes the iframe. There is still exactly one native renderer and clock, no new playback UI, SDK patch or second backend. The live source path stays direct upstream. Page-cache restoration starts a fresh viewer lifecycle.

The iframe relays only Escape and primitive pointer fields to parent-owned events for the existing outer controls. Coordinates are translated by the iframe bounds, including the native-chrome crop. Native Rerun still owns its canvas gestures and divider; nothing is cancelled or sent back to the canvas. The parent tracks the same divider for control alignment, not a second layout or renderer. Teardown removes every relay listener and foreign frame reference.

The backend's ephemeral blueprint store has an exact viewport owner, explicit release, idle expiry (300 seconds; reaped every 30 seconds), and shutdown cleanup. An open owner renews every 30 seconds. Release is serialized with rendering; late updates for that released identity are rejected. Expiry never stops an active render, a recording, a Worker profile or a vehicle. Durable files are not removed. The pre-existing 32-entry cache bound is unchanged; no new active data or image-quality cap is introduced.

DOM disappearance is not memory acceptance. Compare process footprints before, during and after ordinary sequential open/close cycles without forced GC or page reload. See the dated memory-lifecycle report for measurements and limits. Revision 2 and the input relay passed full typecheck, 740 frontend tests, 64 focused backend tests and a production build, served on canonical 8000. Real browser acceptance of this revision remains pending: auto-review rejected opening the heavy saved viewer under elevated pressure; explicit owner approval was requested. This does not gate unrelated input/catalog contract work, nor does a successful build prove that the recorded memory retention is fixed.

9.6 KiB Raw Blame History