NODEDC_MISSION_CORE/docs/audits/2026-09-21-shared-ring-closure.md

# Shared known-revisit correction for small and large rings

## Scope and topology correction

The operator clarified that the small ring is inside the large ring and shares
roughly half its path. Their unshared corridors must not be scored as a failed
repeat of the same map. Reference surveys in Data and independent captures
owned by planner studies are distinct evidence classes.

The earlier 30/101 replay used the planner-owned `JA-STROITEL-RING-002` full
small-ring pass, not the Data reference itself. Its whole path does not become
covered merely because its origin is the planner. The earlier 29/29 short pass
also came from the planner. Preserve the negative numbers, but classify their
geometric scope correctly. Other short planner passes are separate queries.

## Implementation and boundaries

`reconstruction/closure.py` owns a device-independent, injected-registrar policy
for acquisition of a known start-area revisit. It has no hardware, UI, catalog
or planner import. The K1-specific `reconstruct_recorded_ring.py` adapter now
uses this same policy on both source recordings, with no source-name branch.

The separate offline first-fit registration policy admits a larger initial
correction (25 m / 180 degrees) without modifying live tracking's 3 m / 30-degree
policy or the existing overlap, RMSE, shape, information and correspondence
criteria. These are declared acquisition bounds, not a promise of arbitrary
drift recovery. Identity is the initial hypothesis; endpoint positions are
never forced together or used to manufacture a seam transform.

All 12 training-only support pairs are evaluated: first [10,20,40] seconds ×
last [5,10,20,30] seconds. Held-out frames cannot enter either side; shared
source frames are rejected. Each qualified forward fit must pass seeded reverse
refinement and the existing 0.1 m / 0.2-degree round-trip check. Qualified support
windows must also agree at both observed patch centers within the separately
declared 0.5 m / 1-degree consistency envelope. This is an engineering ambiguity
guard, not a calibrated accuracy claim.

The established 20/5-second measurement is retained if qualified. Otherwise the
largest qualifying support is selected. All windows are still examined for
contradiction before selection is accepted. The smooth field solver, rigid
per-frame transform, original-frame clock binding and full-resolution export
are unchanged. Failure keeps the audit and produces no silently accepted
identity correction.

The adapter's v2 contract binds closure search and its declared policy.
Sealed v1 decoded caches remain reusable only when all actual decode/holdout
settings match. `review_recorded_ring.py` adds explicit frozen-data acceptance:
all local windows qualify, enough seam holdout exists, fixed quality gates pass,
and cross-visit agreement is not degraded. Packaging requires positive v2
acquisition and review, with the complete search included in the evidence seal.
Previously published v1 map bundles and pinned studies remain supported.

This is an offline correction/admission workflow, not a newly installed
background auto-corrector for every capture. It does not discover arbitrary
interior loops or recover a measured drift history from native LiDAR sweeps.

## Regression caught and retained

The first generalization always selected the largest qualifying support. It
passed same-source checks (small 52/52, large 136/136), but warm replay of the
independent full small-ring planner pass accepted only 100/101 snapshots. The
96.115 m window failed numerical convergence despite 99.866% overlap and
0.13993 m RMSE; the following window recovered. The same replay against its
frozen previous reference accepted 101/101. This was a real numerical regression,
not an uncovered-region excuse or permission to ignore convergence.

The final cascade preserves the qualifying established window and uses expanded
support only when necessary. It reproduces the previous small-ring corrected
points and trajectory bit-for-bit, and the previous successful large-ring
diagnostic geometry bit-for-bit. The unsuccessful intermediate candidate and
its full replay are retained privately; no quality threshold was weakened.

## Verification and runtime

- 201 focused software tests passed, including 23 new closure/admission cases
  and the previous registration, correction, route search, causal recovery,
  reference version and session-default suites. One existing Starlette/httpx
  deprecation warning remains. Ruff and diff whitespace checks passed.
- Final real-source qualification uses the same immutable small 579.797 m and
  large 1595.409 m recordings and their sealed decode caches. No new scanner
  recording, hardware command, frontend change or service restart is required.
- The shared policy retains the small 20/5-second closure and selects 40/30
  seconds for the large ring. Source frame holdout remains correlated by the
  upstream K1 map and is not independent survey truth.
- Final same-source local checks pass 52/52 on the small ring and 136/136 on
  the large ring. Frozen seam holdout overlap is 89.434% and 95.093%, respectively.
- Repeating the independent full small-ring planner capture against the final
  rebuilt small atlas restores 101/101 numerical and causal acceptances, matching
  the 101/101 frozen-reference baseline. This is a warm map-version regression,
  initialized by its existing old-map cold fit, not another cold-start claim.
- Complete large-map atlas and trajectory arrays equal the previously tested
  diagnostic atlas. Its independent short-pass 29/29 and cold numerical search
  evidence remain applicable by exact identity, not by assuming similar maps
  have identical behavior. No full independent pass through the new territory
  is inferred from that reuse.
- A full numerical search for the planner's `ja-sun-009-100m` was stopped after
  host swap increased. Its exact temporary worker was terminated and reaped;
  canonical service 8000 was retained. This incomplete run is neither a
  localization success nor a geometric rejection. No repeated heavyweight
  search is required to establish equivalence of identical map arrays.

Private evidence is under `.runtime/audits/2026-09-21-closure-v2/`, with the
initial candidate retained at the root and final cascade results separately
under `cascade/`. Earlier observations and source recordings remain immutable.

## Reviewed version admission

The existing packager rechecked all 13,608 full-resolution large-map frames and
all 13,624 poses against the frozen field, plus source transport/clocks and the
complete review seal. It published a separate content-addressed full map. The
ordinary large-session selection now resolves to its corrected generation and
1599.807 m in the canonical planner API. The small-session default pointer is
unchanged; existing planner studies retain their pinned generations. Raw captures
remain available, and no vehicle-control authority is granted.

Canonical API acceptance confirms that the spatial overview defaults to
`corrected` and uses the same admitted map generation as ordinary planner
selection. The original-generation-pinned view remains `original`. Both
Original and Corrected preview RRDs were rendered successfully at the 80 m
height ceiling. Browser visual QA and a new full playback export were not run.
The final private evidence seal rechecked 212 input files with no changes,
no producer changes, and exact small/large geometry equivalence confirmed.

The operator workflow remains explicit: reconstruct → frozen review → package →
publish paired overview → activate the session default. No new UI or background
automatic capture correction has been introduced. Publication and admission
reuse the existing ordinary-name selection and Original/Corrected inspector.

## Decision and remaining scope

The shared cascade is qualified for these two known start-area revisits, with
explicit fail-closed acquisition/review boundaries. Universal means one policy
and regression corpus, not a claim that every possible ring will close.

Independent new-territory repeat accuracy, absolute geometry, the actual spatial
distribution of drift, arbitrary crossing-loop graphs, seasonal transfer and
onboard/live timing remain unproven. One accepted seam plus a smoothness prior
cannot establish those facts. Incomplete optional planner searches remain open;
do not relabel them as passed or use mixed-coverage loops as an aggregate score.