NODEDC_MISSION_CORE/docs/audits/2026-09-19-selected-route-distance.md

Selected route owns the live walk distance

Owner correction: remove arbitrary upper distance limits, not replace 40 m with 100 m. The operator may select 100, 200, 300 m or another available reference interval. No physical acquisition or movement was requested or initiated here.

Contract and implementation

• live_limits.py: new live runs seal the selected draft's actual length_m as maximum_distance_m. No upper route length and no overall run timer. The existing 3 m lower bound belongs to the initial heading basis, not a maximum walk distance. Nonfinite or invalid lengths still fail admission.
• live_tests.py, stationary_live.py: use that sealed distance, not a constant 40 m. Remove both the 300 s active and 1800 s waiting termination. Completing the selected distance ends the calculation only; it never sends scanner STOP or stops the independent raw recording. Identity, freshness, geometric gates and individual native-worker deadlines remain unchanged.
• reference_map.py, sources.py: cover the complete selected interval plus the existing 20 m context on either side where the recording permits it. Prepare as many <=40 m extraction tiles as necessary; 40 m is now a tile size, not a route cap. No tile-count or whole-map point-count truncation. Merge/deduplicate one tile at a time at the existing 0.25 m voxel scale. Cancellation is checked between tiles and after preparation; it releases leases without starting acquisition. One extractor invocation still has its own bounded CPU/data contract.
• reference_window.py: retain the complete route map for evidence, but for maps above the existing 100,000-point numerical budget select a local target around the initialization/accepted pose. Radius includes all current query points and a 10 m search/correction neighbourhood. Smaller maps retain their exact target. Local targets are never silently thinned to pass the budget; missing/too-dense local support fails explicitly. Each calculation seals its window bounds, counts and target-array SHA-256 with its input artifact.
• live_buffer.py: after 2000 retained trajectory vertices, decimate historical display geometry while retaining the first and latest pose. Previously the frozen tail could overcount subsequent distance or cause false jump errors. Raw evidence remains untouched. Display decimation is not a pose reset.
• PlanningProjectSettings.tsx, planner.ts: reuse existing start/end metre controls and Вся траектория. Live admission has no upper distance cap. End selection chooses the preceding recorded pose rather than overshooting the typed endpoint. The actual selected length remains visible.

The separate one-shot two saved recordings comparison is not the live tracking pipeline. Its existing explicit 3–40 m admission remains unchanged; extending that batch estimator is not claimed by this live-walk change. Developer archive probes retain their own explicit wall bounds; these are not operator run limits.

Evidence and tests

Immutable physical query: 20260919T185447Z_viewer_live, original live run 27a20878-9697-4735-a86e-763de28e4b67, distance 35.300 m. Reference: 20260911T085226Z_viewer_live, full recorded path 487.611 m. Existing reports, raw captures, metadata and code are hashed by check_planning_live_bootstrap.py. Its new --route-length-m changes only the isolated probe's reference selection, not any operator draft or original result. It reuses real receipt queues, registration workers and in-process production scene GETs, without a listening server, physical commands or a new capture.

20260919-selected-route-006-100m-001: all 11 checks passed. Reference 141,543 points / four extraction tiles; numerical targets 37,482–73,356 points. All 1013 pose and 1013 lidar receipts consumed, zero overflow. All 15 fresh fits accepted. Last overlap 0.98911, inlier RMSE 0.14794 m. This seal preceded only incremental map merge/cancellation handling; the full 300 m repeat uses the later sources.

20260919-selected-route-006-300m-001, run 02f063a1-48d8-4f9c-9ddc-ae3ae4819686: all 11 checks passed. Actual selected distance 299.929 m, map 302,013 points / nine tiles, local numerical targets 37,480–73,355. All 15 fresh fits accepted over the existing 35.300 m query; final overlap 0.98945 and inlier RMSE 0.14794 m. Pose overflow zero, lidar overflow 2 of 1013; do not call this a zero-drop run. No tracking loss before input ended. This is larger-map regression, not a 300 m independent traversal.

20260919-selected-route-006-wrong-001, run 97c40331-e1f5-48dc-ab8d-dce9c85f55e8: all 11 checks passed using the wrong reference interval starting at 130 m and extending another 100 m. Complete 108-seed search rejected the location; no tracking or accepted transform was invented. One lidar receipt overflow, no pose overflow. Original inputs and executed source hashes remained unchanged in both final-source qualifications.

Focused backend validation: 128 passed. Includes live stop at selected 20, 50, 100, 200 and 300 m; no hidden waiting/active timer; admission at 10 km; coverage across multiple tiles; cancellation and lease cleanup; local-target budget failures; path continuation past 2000 vertices; historical display, stale/identity/ambiguity and failure regressions. Synthetic distances prove software termination semantics, not physical localization accuracy.

Frontend architecture 4/4, TypeScript typecheck, complete frontend suite 861/861 and production build passed sequentially. Ruff passed for nine checked changed/new Python modules/tests; whitespace check passed. Existing Vite large-chunk and TestClient/httpx deprecation warnings remain. No Docker VM or second backend; free-memory observation 50–54%, swap stable at 5784.62 MB across checks. Temporary probe/native/test/build workers exited before the next stage.

Runtime and interface acceptance

Canonical service reloaded through manage_mission_core_launch_agent.py apply after fresh proof: source/control/camera idle, acquisition null, physical command resolved/inactive, active planning run completed. Current/desired plist hashes both 5d7a58122c016f8021fede27d1b21891ee20238fc38c281e5b33574ff8204e3f. Health accepted; new PID 11459. No data-root migration or device commands. Production bundle app-DWoNbjNw.js.

In-app browser on the rebuilt app: existing reference JA-SADOVAYA-001; typed 100 m selected 99.912 m, typed 300 m selected 299.929 m, and whole trajectory selected 487.611 m. Start stayed enabled in all three cases. These are actual recorded-pose endpoints, not fabricated exact-metre positions. Normal/expanded settings and Escape passed. The temporary client-only draft was neither saved nor started. Returned to the original physical ja-sun-006 historical 3D result; scene expansion and Escape restored correctly. No real-time rate or new physical-distance accuracy was measured by this UI check.

Ops MISSIONCOR-81 updated through the direct Tasker MCP: 12 titled report/checker blocks appended, previous 108 preserved (120 total). Physical long-walk and navigation acceptance remain unchecked.

Boundaries

Removing a route cap is not proof of unlimited hardware capacity. The complete reference geometry, preparation time and stored evidence still scale with the selected interval. This is not a disk-paged city-scale map implementation. Individual extraction/registration budgets, corruption checks and freshness gates remain real. No distance-based quality claim or automatic threshold relaxation is introduced. Surface overlap/RMSE is not independent positional accuracy. A physical 100/200/300 m repeat remains to be measured.

The product-UI skill kept the existing inspector, canonical RangeControl/Button and viewer composition; no new setting, visual primitive or product root. Only the canonical durable service on 8000 may be reloaded after idle proof; no duplicate server, Docker workload or rover/K1 command is admitted.