NODEDC_MISSION_CORE/docs/audits/2026-09-21-ring-entry-and-seam-review.md

# Ring entry failure and independent seam traversal

## Decision

The latest `JA-STROITEL-RING-001` live study supports local tracking across the
corrected reference seam, but exposes a route-wide cold-start scheduling defect.
Its first location was not geometrically unsuitable: a complete offline search
of the original first prefix finds an unambiguous 98.82% overlap candidate with
unchanged production quality gates. The live search never reached that seed.

No production code, default, threshold, scanner state, saved run or corrected
reference was changed during this audit. Diagnostic outputs are private, ignored
runtime evidence; the original study retains its actual unsuccessful first
attempt. This is not a retroactively successful live initialization.

## Inputs and scope

- Latest study `473870e0-5210-452c-b9e4-9d7937e93646`, query capture
  `20260921T103511Z_viewer_live`.
- Reference: `JA-STROITEL-SUN-RING · коррекция v2`, the full 579.9827 m,
  all 5,182 poses, 694,420 registration-map points. This was not another
  truncated-reference regression.
- First stationary prefix: 8,870 retained query points, approximately 10 seconds,
  maximum measured prefix motion 0.01066 m. No recorded receipt gap.
- Two initialization attempts, one operator reinitialization, final study state
  `completed`, termination `spatial-stop-requested`.
- The operator deliberately returned to the initially rejected physical place.
  Initial/final poses differ by 0.164 m in this capture's SLAM coordinates. This
  supports the comparison but is not independent survey ground truth.

## Execution chronology (Moscow time)

| Time | Recorded event |
| --- | --- |
| 13:35:37.912 | First stationary prefix begins |
| 13:35:47.921 | First search starts |
| 13:36:24.105 | Search rejected as `initialization-incomplete` |
| 13:36:46.859 | Operator requests reinitialization at the familiar start area |
| 13:36:56.780 | Second search starts |
| 13:37:14.769 | Dense-start candidate found: 98.72% overlap |
| 13:37:27.973 | Third disjoint fresh check establishes tracking |
| 13:38:35–40 | Trajectory crosses the original start/end seam in reverse |
| 13:39:36.468 | Last accepted tracking result near the initial failed location |
| 13:39:41.876 | Intentional STOP completes the study |

The final in-flight calculation also produced a geometric candidate, but was
correctly not published after STOP. Its unaccepted decision is not a loss event.

## Root cause of the first failure

The code first runs 108 dense-start seeds. That stage consumed 15.737 seconds
and found no admissible candidate, as the actual location was about 15 m before
the seam, not within the familiar start patch. The route-wide stage then received
only the remainder of a shared 35-second search budget: approximately 19 seconds.

The full route contains 117 searchable anchors and three yaw hypotheses per
anchor (351 fits). Retrieval covered the full map, but precise verification
completed only 40 anchors and one fit of the next anchor: 121/351 route fits.
Together with the start stage this is 229/459 planned fits. The saved result
explicitly says `complete=false`, `incomplete-route-search`; it does **not** prove
`no-route-location`.

The nearest anchor was ranked 62nd. The anchor whose existing production seed
eventually finds the correct fit was ranked 100th. Neither was reached live.
The coarse descriptor ranks radial/height distributions around cloud medians,
not a measured probability of place identity. Here it prioritizes other route
areas over the true place. Different visible geometry in a stationary prefix
and a multi-visit local reference makes that representation a plausible source
of poor ordering; this audit establishes the bad ordering, not vegetation as
its independently classified cause.

There are two further implementation consequences:

1. `choose_route_location` discards the candidate queue when a search is
   incomplete; `StationaryBootstrap.offer_prior` enters `lost`. Initial loss
   then waits for operator retry rather than continuing the unexamined queue.
2. The incomplete/expired operator message asks to stop recording and begin
   again. That recommendation is inappropriate for this observed compute
   exhaustion. No scanner reset or bad physical location was established.

## Bounded offline experiments

All original run-file hashes were verified before and after each experiment.
Single CPU job at a time, one numerical thread; no hardware, ingress or UI
publication. Each output is exclusive-created, never written over live evidence.

### 1. Retrospective geometric check

Register the original first prefix using a seed from the later successful
alignment. This uses future information deliberately and is **not** a cold-start
test. It isolates whether the first cloud is compatible with the corrected map.

- First accepted transform as seed: 98.887% overlap, 0.1396 m inlier RMSE.
- Last accepted transform as seed: 98.893% overlap, 0.1399 m inlier RMSE.
- Both pass unchanged local registration gates.

### 2. Complete cold-prefix route search

Replay the same original first query and complete reference through existing
`relocalize_route`. No endpoint, final transform or physical-location hint enters
the search. The only experimental override is a 120-second **offline** deadline
so the finite queue can finish; all geometric quality gates remain unchanged.

- All 117 anchors / 351 fits completed in 59.408 seconds.
- Correct, non-ambiguous leading candidate: 98.820% overlap, 0.1439 m inlier RMSE.
- Candidate anchor at route progress 560 m, ranked 100th; the fitted pose is
  consistent with approximately 15 m before the seam.
- Next distinct fitted candidate: 61.086% overlap at an unrelated route area.
  It was already present in the incomplete live search. Thus accepting the
  first threshold-passing fit or loosening acceptance would be an unsafe fix.

This proves recoverability from the original prefix, not live readiness. A
59-second result would violate the existing live 35-second search / 40-second
source-age contract and must not simply be relabeled fresh or green.

### 3. Seed-construction sensitivity

On a bounded, retrospectively chosen four-anchor subset, compare the existing
cloud-median translation seed with a seed mapping query scanner origin to the
route anchor, using the same yaw options, targets and quality gates.

At the nearest anchor (565 m), yaw 90°:

- Existing median seed: 53.799% overlap, rejected.
- Origin-to-anchor seed: 98.847% overlap, accepted geometrically.
- Retrospectively measured initial-position error decreases from 4.62 to 1.51 m.

This is evidence for improving seed construction, not an approved replacement:
the subset was chosen after examining the result, and one neighboring anchor
still produces a weak approximately 61% candidate. Global ranking, competing
places and fresh-data confirmation remain necessary.

## Tracking and seam quality

- 28 fresh checks accepted, including initial confirmation; 26 accepted results
  in tracking state. No transition to lost/recovering after tracking begins.
- Observed distance after reinitialization: 101.633 m; last accepted result at
  100.896 m. The remaining final result was fenced by intentional STOP.
- Overlap within 0.5 m: minimum 98.516%, median 99.348%, maximum 99.746%.
- Inlier surface RMSE: 0.1226–0.1533 m, median 0.1422 m.
- Maximum accepted consecutive-transform change: 0.0316 m / 0.5906°.
- Calculation worker wall time: median 0.383 s, maximum 0.464 s. The roughly
  five-second interval is the configured check cadence, not a five-second fit.
- At the seam crossing, overlap remains 99.57–99.69%, with centimetre-scale
  transform corrections and no recovery event. Route progress wraps from the
  beginning to the end as expected while physical coordinates remain continuous.

These metrics measure consistency with the admitted map, not absolute rover
position accuracy. Only the traversed seam neighborhood is independently
checked here, not the entire 580-m ring, arbitrary seasons, or kilometre routes.

## Recommended architectural correction (not implemented here)

1. Preserve the successful local tracking and corrected reference.
2. Make full-route acquisition a resumable search with a cached reference index
   and auditable unexamined candidates. A compute slice expiring means still
   searching/incomplete, not a declaration that the operator picked a bad place.
3. Separate place-hypothesis generation from live position validity. Refresh
   observations and confirm candidates against disjoint current frames; never
   extend an old matrix's control authority to cover a long global search.
4. Qualify sensor-origin-based descriptor/seed variants against this recording,
   previous successful start/mid-route runs and wrong-place negative cases.
5. Retain ambiguity, identity and quality gates. Do not patch this by lowering
   overlap or merely increasing the shared timer.

The saved first prefix, complete map, successful return and disjoint subsequent
frames are sufficient for the next offline iteration. No new field recording
is required to diagnose or begin correcting this failure.

## Validation and private reproduction

62 focused tests passed: route relocalization, stationary bootstrap, stationary
recovery, and planning-live lifecycle. Existing tests correctly assert refusal
of an incomplete search; they do not establish acceptable completion latency
on this real ring. The new captured case should become an evidence-backed
acceptance fixture for the acquisition redesign.

Private evidence: `.runtime/audits/2026-09-21-ring-001-entry/` contains
`inspect.json`, `exhaustive.json`, `seeds.json`, the diagnostic `audit.py`, and a
provenance seal. Inputs remain in the canonical run directory. No temporary
worker remains; canonical Mission Core stays on port 8000.