NODEDC_MISSION_CORE/docs/audits/2026-09-19-recovery-stationary.md

Recovery and stationary entry — frozen protocol v1

This follow-up uses immutable A/B recordings only. No hardware commands, new capture, vehicle authority or UI changes. All numerical jobs are sequential, one child / CPU thread. Prior failed and successful traces remain unchanged.

Receipt recovery

Prepare one fixed forward A submap from its first pose through the last pose whose recorded path length is <=40 m. Same extraction v1 and 120-frame budget; no B data used to select or build this map. Replay B at 1x, <=120 s / 40 m. First run unchanged acquisition v1 on this reference. Then suppress all B pose/cloud events with original relative receipt time in [44,47) seconds. Do not shift timestamps, add poses, replay stale frames or change surviving payloads. Save identities/times of every suppressed event. This is an injected transport loss on real recorded geometry, not a new physical experiment.

Acceptance: qualified tracking must exist before 44 s; the resumed receipt gap must clear old windows and qualification. Reacquisition must use a fresh bounded search, never retain the pre-gap matrix as current, followed by three fresh consistent windows from the new segment. Record the exact loss/recovery times, seed, latency and in-route distances. Failure or insufficient time is retained, not repaired by loosening thresholds or copying an old fitted transform. The existing 8 s result freshness policy remains unchanged for this baseline; a <8 s silence may retain the last fresh solution until the receipt gap is observed. This diagnostic delay is not a navigation safety policy.

Stationary prefix experiment

B's first 10 s contain approximately 0.005 m maximum recorded displacement. Freeze only that prefix, rejecting it if displacement exceeds 0.10 m. Use the existing bounded accumulator and fixed A40 reference. No B heading from later motion, offline B registration, or future points. Positions establish only the prefix's map-frame entry; no independent physical stillness/accuracy is claimed.

New stationary-entry/v1: nine offsets {-3,0,3} m along/across the reference heading, and twelve yaw seeds 0..330 degrees at 30-degree intervals = 108 seeds. Yaw rotates about query entry. Full yaw is searched because the K1 map-frame heading is not assumed to match the taught route. Initial translation places the prefix entry at the selected reference entry. Final translation bounds remain 5 m XY / 1 m Z. No vertical or arbitrary-site search. Every seed uses unchanged local GICP v1, including its 3 m /30-degree local correction limits.

Reuse complete-link solution clustering, support and ambiguity gates; at least 3 supporting seeds and 2 translation positions. Require all 108 hypotheses; 25 s soft/30 s hard deadline. Incomplete search is rejected. Run the same prefix against the already fixed wrong A130–155 m region as a negative control. If the correct prefix is ambiguous or rejected, record that limitation. Stationary snapshot acceptance alone is not temporal tracking or operational readiness.

Validation and decision gate

Focused fixtures cover fault boundaries and unchanged event identity/time, post-gap three-window qualification, no old segment authority, prefix-only selection, motion rejection, yaw-anchor preservation and full-search rejection. Record UTC/monotonic times, input/code/output hashes, all seeds and clusters. Do not install the stationary initializer into the product merely because one snapshot looks good. Decide the next increment from positive and negative evidence. No new operator scan is needed for these bounded experiments.

Results: controlled loss and recovery

Private experiment root: data_dir/missions/causal-replays/20260919-recovery-stationary-001. The fixed A interval is 39.926109 m and 52,965 retained points. A is session 20260911T085226Z_viewer_live; B is 20260911T134352Z_viewer_live. All prior A/B artifacts and failed/successful traces remain unchanged. The reference derives solely from A; B geometry does not select reference frames.

Baseline: 2026-09-19T12:01:13.261Z–12:02:16.501Z; start monotonic ns 836950850212541. 974 delivered events, 63.125 s, 40.038 m. Initial candidate 33.100 s, first tracking 42.343 s. Six accepted windows. Maximum delivery lag 0.1672 s. This reproduces the previous outcome on the explicitly longer A map.

Loss probe: 2026-09-19T12:02:37.218Z–12:03:40.468Z; start monotonic ns 837034809904750. 60 events suppressed, 914 delivered, 63.123 s / 40.027 m; maximum delivery lag 0.1525 s. No survivor payload or timestamp was changed. Original 9.973 s gap remains; the injected interval produces a second observed pose gap of 3.331 s / 2.569 m displacement.

Event	Time from input start, s	State / evidence
Three-window qualification	42.358	tracking, segment 1
Deliberately absent input	44–47	last result still within existing 8 s freshness limit
Resumed receipt reveals gap	47.097	lost; old matrix/windows cleared, segment 2
New bounded search completes	49.637	acquiring, new-segment candidate 1
Next fresh local refinement	53.178	acquiring, candidate 2
Third new-segment window	58.602	tracking restored
Input ends at distance bound	63.122	lost; no current result retained

The first post-gap candidate used a new 27-seed search, not the old fitted transform. It completed 2.540 s after observed resumption, at input age 2.572 s. Post-gap windows were at 26.138, 31.198 and 35.911 m, all within the selected A path, with overlap 99.09%, 98.55%, 98.02% and RMSE 0.1453, 0.1536, 0.1571 m. Requalification took 11.505 s from observed resumption. Thus recovery from this injected receipt loss is demonstrated, with the diagnostic 5 s fit cadence. This does not qualify a moving vehicle's reaction time. The short silence was recognized on the next pose; immediate silence detection is not claimed.

Results: heading-free stationary prefix

The prefix contained 168 pose/cloud events through 9.933688 s and 8,227 retained points. Maximum recorded displacement was 0.0051505 m. This is K1's own pose estimate, not an independent physical stillness measurement. No later B points, direction, fitted transform or correspondence mask was used. The wrong-region entry and basis came directly from A's saved trajectory, not a previous B seed.

The two sequential snapshot probes ran 2026-09-19T12:04:04.176Z–12:04:46.942Z; launcher monotonic interval 837121521919208–837164567013166 ns. The experiment uses a frozen already-collected prefix; it is not a second wall-paced replay.

Control	Hypotheses	Compute wall time, s	Result
Correct A entry	108/108	24.548	candidate; one eligible cluster, 7 seeds
Wrong A130–155 m entry	108/108	16.560	rejected; no eligible cluster

Correct-entry overlap 89.815% within 0.5 m; inlier RMSE 0.17042 m. These are surface-fit statistics, not localization accuracy. Seven agreeing initial seeds are not seven independent observations. After both runs, a read-only comparison with the earlier causal A40 candidate showed 0.10251 m difference at the entry and 0.78413 degrees rotation. That comparison was not an input or gate, and is not ground truth.

An operational implementation would need about 10 s accumulation plus 25 s search on this host/input, before fresh validation. The successful search was close to the unchanged 25 s soft budget; a slower/ambiguous search must reject. Its old prefix already exceeds the current 8 s freshness limit on completion. Therefore the snapshot candidate is not activated as live tracking. It needs a separate provisional initialization result and fresh-window validation, followed by the temporal gate. The three-metre-heading requirement remains in the currently active product profile; stationary entry is an engineering probe.

Implementation and verification

• replay_faults.py: explicit lazy time-window filtering, preserving survivor identity/timestamps and an audit of dropped sequence numbers.
• stationary_entry.py: bounded prefix, motion/gap/completeness checks and stationary-entry/v1 full-yaw policy. No heading extraction from B motion.
• entry_acquisition.py: the existing clustering and search accept an explicit policy; the default travel-entry constants remain unchanged. Complete-search cardinality comes from the policy's translation/yaw grid.
• entry_acquisition_worker.py: optional stationary mode in the same isolated worker, retaining one thread and a 30 s hard limit. Existing callers use the default travel mode. No hardware path or product selector added.
• check_planning_recovery.py: fixed-reference preparation, separate baseline, loss and stationary stages, provenance and before/after digest verification.
• test_recovery_stationary.py: fault boundaries, identity/time preservation, prefix-only geometry, motion rejection, 108 anchor-preserving hypotheses, partial-search rejection, gap reset and three new-segment candidates.

54 focused tests passed in 3.12 s, covering entry, causal replay, live profile, project results, registration and viewer replay; one existing Starlette/httpx deprecation warning. Ruff and git diff --check passed. Numerical jobs ran sequentially on Darwin arm64 / Python 3.12.13 / small_gicp 1.0.1, one CPU thread. No load test, Docker VM, new capture or vehicle commands. Frontend unchanged. All probe processes completed. The existing canonical server was left running; its /api/health returned operational ok after the experiments. No second server was started or product connection restarted. The engineering results and acceptance checker were saved in MISSIONCOR-81, preserving 40 structured blocks.

All input digests, reference artifact, executed-source hashes and 31/31/7 baseline/loss/stationary artifact hashes were rechecked. Exact executed sources and focused tests are stored privately in executed-source/, with seal.json. Report SHA-256:

• baseline: 0c4b3d4f096f0deb065bfd21e0917f0414772861c8c6c72f44380d3f6e794f5d
• loss: 2ac13eae870a4c4eac5d0d95d35bdb72ab46c84e4a10bf29285fae593d6bcafb
• stationary: 1390f4b5ceb3188ff89c9a70ff34fb20cb02140335483f13ba88571a80ff2815
• seal: 619aec16a6f5921cdfbec2f2e7fda520bd6756c8c4caaf60f26a0f97b7083339

Decision

Controlled receipt-loss recovery passed on this recording. Stationary geometry supports a bounded heading-free initialization candidate on this pair, with the tested wrong region rejected. Neither result establishes arbitrary-site localization, independent pose accuracy, repeatability across locations or onboard resource qualification.

Next increment: make the stationary search result a provisional prior only; validate against a current cloud before temporal qualification, while the input continues. Separate startup waiting from maximum age while moving. Reduce repeated fixed-reference preparation if measured helpful, retaining frozen regression and ambiguity controls. Then qualify starts/orientations on held-out data and the physical camera/UI path. No new operator scan is needed yet.