NODEDC_MISSION_CORE/docs/audits/2026-09-20-mid-route-016-retrieval-diagnosis.md

# Two mid-route starts: retrieval failure, not absence of matching geometry

Date: 2026-09-20. Scope: inspect physical attempt 016 and fix the explicitly
requested vertical-scale outline. No production localisation logic, admission
threshold, device command, raw recording or historical result was changed.

## Evidence and integrity

The operator reports first starting approximately 30 m along the reference,
then moving closer, approximately 20 m, and pressing reinitialisation. The
saved run contains two stationary initialisations and one fresh validation.
All 18 artifact hashes listed by its report match the files on disk, including
both frozen initialisation inputs and the fresh registration input. The report
records no receipt gaps. Prefix maximum motion was 5.0 mm and 5.4 mm: motion
during the stationary prefix does not explain the failure.

This is one recording with two positions, not two independent captures. The
operator's distances are approximate, not surveyed ground truth.

## What actually ran

Both initialisations completed the 108-fit dense start stage and then the
18-fit route fallback. There was no worker timeout. Fallback wall time was
approximately 3.1 s after approximately 15 s for the start stage.

The fallback descriptor evaluated all 18 anchors on the selected 81.06 m
reference. `rank_route_candidates` then retained only the first six; exact
registration evaluated three yaw seeds for each. It did not proceed to the
remaining descriptor candidates after rejecting that shortlist.

| Attempt | Anchors admitted to exact registration, in descriptor order | Live outcome |
| --- | --- | --- |
| First | 0, 5, 10, 81.06, 80, 75 m | No admitted route location |
| Reinitialised | 0, 5, 81.06, 80, 75, 10 m | Provisional hypothesis near the route end; rejected by fresh validation |

The second provisional transform placed the scanner nearest route progress
79.76 m, with 74.16% point overlap and 0.2475 m inlier RMSE. Its fresh check
reported 77.14% overlap and 0.2407 m RMSE, but failed numerical convergence
(`converged=false`). The hypothesis was never confirmed as tracking. It is
inconsistent with the operator's reported location; high overlap alone cannot
justify admitting it. Lowering the gate or ignoring convergence would therefore
not be an appropriate remedy.

## Bounded offline counterfactual

Read each frozen `route-relocalization-input.npz` and call `relocalize_route`
with the production policy, changing only `candidate_count` from 6 to 18 so
every existing anchor reaches the same three-yaw exact fit. Retain the same
clouds, 30 s deadline, 40 iterations and all geometric thresholds. No live
publication or historical result rewrite occurs.

| Input | Selected anchor | Estimated scanner progress along reference | Point overlap | Inlier RMSE | Converged |
| --- | --- | --- | --- | --- | --- |
| First prefix | 30 m | 30.10 m | 96.95% | 0.1472 m | Yes |
| Reinitialised prefix | 20 m | 24.47 m | 98.41% | 0.1547 m | Yes |

Both searches completed and returned a candidate without relaxing acceptance.
The first 30 m anchor ranked fifteenth; the second 20 m anchor ranked
fourteenth. The second 25 m anchor ranked thirteenth and independently fitted
the same location with 98.41% overlap. Distances from fitted scanner position to
the nearest reference path sample are approximately 1.03 m and 2.03 m.

Overlap is the measured fraction of evaluated points within 0.5 m, not a
probability of correct location, centimetric accuracy or a vehicle-safety
qualification. Inlier RMSE is cloud residual, not independently measured pose
error. The counterfactual does not replay fresh confirmation or prove a live
recovery. It isolates a concrete retrieval false negative.

## Code-level cause and next decision

`route_relocalization.py` ranks radial-height histograms around cloud medians:
a 20 m live footprint is compared to 28 m reference contexts. These differently
observed and populated clouds can rank the true location poorly. The rankings
above prove that defect on this capture; they do not isolate which descriptor
feature is responsible.

The implementation is only a truncated cascade: it discards candidates after
the sixth, labels completion relative to those attempted fits, and offers only
one provisional transform. `StationaryBootstrap.accept_fresh` ends initial
confirmation on rejection; it does not resume the ranked candidate queue.
Automatic recovery after established tracking does not repair cold-start
shortlist exhaustion.

Recommended implementation, not applied in this turn:

1. Preserve the established dense start path and local tracking.
2. Use ranking as work order, not as a permanent exclusion of other areas.
   Process spatially diverse candidate batches and continue the queue after
   rejection, under an explicit compute/freshness budget.
3. When the budget is exhausted with unvisited candidates, report incomplete
   search, not evidence that the route cannot be matched.
4. Improve descriptor observation comparability and verify distinct competing
   locations before promotion. Continue to another viable candidate when fresh
   confirmation rejects a provisional one; preserve source-age and identity
   fences and never reuse stale confirmation data.
5. Qualify against both frozen prefixes, wrong-location/ambiguity controls and
   the known successful start/tracking recordings before requesting another
   field test. Increasing a constant to 18 is a diagnostic, not the scalable
   product design for a kilometre route.

## Outline correction

The shared Design Guideline explicitly drew a 2 px outline on the vertical
range wrapper when its native input matched `:focus-visible`. This state can
survive pointer interaction. The vertical variant now has no border, outline
or shadow in any state. Focus-visible underlines both existing contrast-aware
central text layers. Native arrow/Home/End behaviour, left-side endpoints and
the 80 m domain range remain unchanged. The shared registry, documentation,
catalog specimen and contract test changed together; no app-local CSS override
or localisation change was introduced.

## Validation and handoff

- Shared range contract: 5/5; Design Guideline registry validation and core /
  catalog typechecks passed.
- Mission Core architecture contract: 4/4; full frontend typecheck passed;
  full frontend unit suite: 872/872; production build passed. Existing bundle
  size warning remains; no new server or scanner session was started.
- Browser QA on the saved 016 scene in normal and expanded layout: slider
  min -3.023, max 80. Pointer click changed value to 38.48 with real input focus;
  native and wrapper outlines were 0 px, border 0 px, shadow none. Keyboard
  focus underlined both contrast layers; Up changed the value, End restored 80.
- Canonical service on port 8000 served the new production CSS/JS and remained
  healthy. No temporary numerical workers or build watchers remain. One
  background saved-evidence view is retained for owner review, at the full
  80 m clipping range. Device state is idle.