NODEDC_MISSION_CORE/docs/audits/2026-09-19-planning-fast-display.md

# Planning: native receipts, bounded scene deltas, unchanged five-second fits

Owner request: keep the expensive map check at its existing cadence; separate
fresh cloud/pose presentation from registration. Assess whether the retained
35 m physical result supports eventual supervised rover trials. No new device
command, capture, network mutation, extrinsic profile or motion authority.

## Sources and decision

The physical source is run `27a20878-9697-4735-a86e-763de28e4b67`, also named
`ja-sun-006`, query `20260919T185447Z_viewer_live`. Do not confuse it with the
earlier failed run bearing the same label. See the separate
`2026-09-19-physical-repeat-006-results.md` audit for its 83 verified artifacts,
camera evidence, accepted fits and STOP chronology.

The old display reused `LiveCloudBuffer`: 169 of 1,013 native cloud packets were
selected at the numerical half-second cadence. Each browser request then sent
the entire accumulated query, followed by another 500 ms wait. This was a
presentation bottleneck, not evidence of a two-second native pose rate.

## Implementation

- `live_display_buffer.py`: presentation-only tap after input identity and pose
  continuity validation. No 500 ms packet gate. Finite/range/causal-pose filters,
  0.25 m visual voxel, half-second chunks updated on every accepted packet,
  2,000 points per chunk, 40 fixed slots and 40,000 total displayed points.
  Old slot contents are immutable; eviction carries revisioned tombstones.
  This is a bounded rolling visual cloud, not a replacement for full raw capture.
- `stationary_live.py`, `live_tests.py`: attach that tap without changing the
  numerical buffer, bootstrap, GICP settings, five-second fresh-check cadence,
  or three-independent-window gate. Fast points/pose advance only under the last
  accepted transform, in the same segment and while cloud/fit remain fresh.
  Loss freezes historical geometry. Saving/restoring still binds the retained
  projection to verified artifacts. Raw pose remains scanner telemetry, not a
  chassis pose or navigation contract.
- `live_scene_delta.py`, `live_scene.py`: native Rerun static entities. Send
  changed chunk slots, pose/path, transform or validated window only. Keep cloud
  coordinates in their source frame under one accepted parent transform; do not
  apply the pose twice. Green indices stay attached to their own fitted input.
  Reference/blueprint is resent on initial load or display-setting changes.
- `planning_live_api.py`: read-only same-origin delta GET with bounded cursor,
  run/view identity, no-store, 204 for unchanged data, and server-relative ages.
  No socket, auxiliary backend, extra sensor consumer, or per-client queue.
- `planningSceneStream.ts`, `PlanningLiveScene.tsx`: one outstanding request,
  100 ms target start-to-start cadence, bounded request deadline, cursor reset
  after error, mode/end-state response fencing, disposal abort, and no transfer
  for unchanged completed views. Reject cloud/fit ages that expire during the
  full request duration. Transport failure hides stale evidence. A delayed
  `recording_open` event cannot restore a failed scene.

Rerun's static entity replacement is intentional: its viewer can physically
discard superseded static values; fixed slot names avoid unlimited entity growth.
This is not a claim of measured browser heap stability over long durations.
[Upstream static-data semantics](https://rerun.io/docs/concepts/logging-and-ingestion/static).

## Validation evidence

`check_planning_live_bootstrap.py --fast-scene --queue-ingress` replays original
receipt intervals through the real decoder, bounded queues, planning service,
registration subprocess and production ASGI delta route. TestClient is in-process;
it opens no second server and cannot send commands to K1. All input/code digests
and executed sources are retained under the existing private causal-replay root.

First positive qualification: `20260919-fast-display-006-positive-001`, isolated
run `7037b8d7-260c-4312-b4fa-21f552f0a15f`.

- All 11 acceptance checks passed; complete 108-hypothesis search, three fresh
  windows before tracking, subsequent accepted checks, distance 35.300 m.
- Final overlap 99.1581%, inlier RMSE 0.14398 m. These are surface-registration
  statistics, not independent position error.
- All 1,013 lidar and 1,013 pose receipts consumed, zero queue overflow;
  1,007 packets admitted to the bounded visual accumulator. Not every receipt
  must produce a visual frame: causal freshness and filtering remain active.
- 931 scene requests. During accepted live display: 668 requests over 73.183 s,
  497 distinct latest cloud revisions (about 6.8 updates/s at this polling phase,
  with intermediate packets accumulated/coalesced rather than queued).
- Delta export through ASGI: median 1.94 ms, p95 25.07 ms, max 60.29 ms.
  Latest receipt age at snapshot: median 75.17 ms, p95 518.40 ms, max 1.122 s.
  Typical reply 43.5 KB, p95 50.3 KB; full initial projection up to 1.63 MB.
- These are receipt-to-server-snapshot/export measurements. They do not measure
  network-to-browser delay, native Rerun ingestion completion or GPU presentation.

Wrong-region qualification: `20260919-fast-display-006-negative-001`, same
independent query but reference route 130–160 m with its own surrounding context.
All 11 acceptance checks passed. Search ended without accepted tracking; the
fast path did not invent an alignment or green confirmation.

The final delivery-age guard and preservation of stored display diagnostics were
added after these first two replay seals. They do not change the numerical inputs
or registration algorithm. Final-source validation is recorded below at handoff.

Final-source replay: `20260919-fast-display-006-positive-002`, isolated run
`0a4d0d53-1877-473c-be94-926291dc415e`. All 11 checks passed, all 2,026 input
receipts delivered, 1,007 visual packets, no queue overflow. 917 scene requests;
accepted display 659 requests / 73.264 s and 494 distinct latest cloud revisions
(6.74/s). Snapshot age median 73.47 ms, p95 521.19 ms, maximum 1.040 s. Export
median 1.98 ms, p95 25.72 ms, maximum 62.20 ms. This final seal includes the age
headers/guard and executed scene sources; it is still not a browser frame-rate test.

Final focused Python run: 103 passed. Architecture and stream tests, TypeScript
typecheck and full frontend suite: 860 passed after the fullscreen correction.
Production build passed. Ruff passed on eight changed Python files; git diff
whitespace check passed. Known warnings: existing Vite large chunks and installed
Starlette/httpx TestClient deprecation (no package installation attempted).

The browser check found that the existing fullscreen button depended on a live
gRPC URL even for an independently rendered planning profile. The condition now
admits that profile after capture ends; the existing expand/restore actions use
canonical IconButton and retain the existing Escape handler. No new layout or
fullscreen mechanism was added.

Controlled reload used the versioned LaunchAgent plan/apply path, unchanged plist
SHA-256 `5d7a58122c016f8021fede27d1b21891ee20238fc38c281e5b33574ff8204e3f`,
after fresh checks of idle control/source/camera, completed acquisition, resolved
physical command and protocol-confirmed STOP. New canonical PID 7662 accepted
health/readiness; 8765 had no listener. It restored the original physical run as
completed/historical, not as live localization. The final frontend-only rebuild
does not require another backend restart.

In-app browser QA on the final `app-BRD3dS1N.js`: actual retained physical run
rendered through the new delta endpoint in normal 3D and top view. Expand,
Escape restore, query-layer off (only gray reference remains) and on all passed.
Historical status remained explicit; no live camera/green localization was
invented. The real 3D case was left open for owner review, with one viewer only.
No final-source browser live cadence or simultaneous camera+scene run is claimed;
that is the next physical acceptance on the same known route.

Ops MISSIONCOR-81 updated through the direct Tasker MCP: 12 titled report/checker
blocks appended, all previous 96 blocks preserved (108 total). Physical fast-view
acceptance and independent navigation/failure-stop acceptance remain unchecked.

## Product and authority boundaries

The product-UI skill retained the existing Rerun host, scene modes, canonical
controls, expand/restore and error surfaces. No new shared component, navigation
root or LAB layout was introduced. Engineering diagnostics stay in evidence/Ops.

This change qualifies faster presentation, not obstacle perception or a control
loop. A five-second map fit can coexist with fresh native pose, but the laboratory
8 s fit-age allowance is not a safe vehicle reaction/stop budget. That requires a
separate speed-dependent contract and measured failure response.

## Assessment for supervised motion

The physical 35.3 m walk is genuinely encouraging: all 15 fresh fits accepted,
moving overlap about 96–98%, accepted transform yaw span about 0.197°, and no
loss while walking. Terminal stale occurred after confirmed device STOP.
This supports progressing toward a slow, bounded, supervised test on the known
route; it does not establish a universal positional accuracy or safe clearance.

Missing evidence: surveyed/cross-measured route position and heading errors,
repeat starts with varied offsets/orientations/heights, ambiguous/wrong locations,
occlusion and receipt loss, and verified stopping before an unsafe distance is
covered. High overlap and low fit RMSE cannot substitute for those tests. The
previous 25 cm clearance idea is not validated by a 14 cm surface-fit RMSE.

Retain `vehicle_control=false` and `localization_confirmed=false`. No rover was
moved and no K1 start/stop/calibration command was issued by this implementation.