NODEDC_MISSION_CORE/docs/audits/2026-09-19-planning-fast-display.md

Planning: native receipts, bounded scene deltas, unchanged five-second fits

Owner request: keep the expensive map check at its existing cadence; separate fresh cloud/pose presentation from registration. Assess whether the retained 35 m physical result supports eventual supervised rover trials. No new device command, capture, network mutation, extrinsic profile or motion authority.

Sources and decision

The physical source is run 27a20878-9697-4735-a86e-763de28e4b67, also named ja-sun-006, query 20260919T185447Z_viewer_live. Do not confuse it with the earlier failed run bearing the same label. See the separate 2026-09-19-physical-repeat-006-results.md audit for its 83 verified artifacts, camera evidence, accepted fits and STOP chronology.

The old display reused LiveCloudBuffer: 169 of 1,013 native cloud packets were selected at the numerical half-second cadence. Each browser request then sent the entire accumulated query, followed by another 500 ms wait. This was a presentation bottleneck, not evidence of a two-second native pose rate.

Implementation

• live_display_buffer.py: presentation-only tap after input identity and pose continuity validation. No 500 ms packet gate. Finite/range/causal-pose filters, 0.25 m visual voxel, half-second chunks updated on every accepted packet, 2,000 points per chunk, 40 fixed slots and 40,000 total displayed points. Old slot contents are immutable; eviction carries revisioned tombstones. This is a bounded rolling visual cloud, not a replacement for full raw capture.
• stationary_live.py, live_tests.py: attach that tap without changing the numerical buffer, bootstrap, GICP settings, five-second fresh-check cadence, or three-independent-window gate. Fast points/pose advance only under the last accepted transform, in the same segment and while cloud/fit remain fresh. Loss freezes historical geometry. Saving/restoring still binds the retained projection to verified artifacts. Raw pose remains scanner telemetry, not a chassis pose or navigation contract.
• live_scene_delta.py, live_scene.py: native Rerun static entities. Send changed chunk slots, pose/path, transform or validated window only. Keep cloud coordinates in their source frame under one accepted parent transform; do not apply the pose twice. Green indices stay attached to their own fitted input. Reference/blueprint is resent on initial load or display-setting changes.
• planning_live_api.py: read-only same-origin delta GET with bounded cursor, run/view identity, no-store, 204 for unchanged data, and server-relative ages. No socket, auxiliary backend, extra sensor consumer, or per-client queue.
• planningSceneStream.ts, PlanningLiveScene.tsx: one outstanding request, 100 ms target start-to-start cadence, bounded request deadline, cursor reset after error, mode/end-state response fencing, disposal abort, and no transfer for unchanged completed views. Reject cloud/fit ages that expire during the full request duration. Transport failure hides stale evidence. A delayed recording_open event cannot restore a failed scene.

Rerun's static entity replacement is intentional: its viewer can physically discard superseded static values; fixed slot names avoid unlimited entity growth. This is not a claim of measured browser heap stability over long durations. Upstream static-data semantics.

Validation evidence

check_planning_live_bootstrap.py --fast-scene --queue-ingress replays original receipt intervals through the real decoder, bounded queues, planning service, registration subprocess and production ASGI delta route. TestClient is in-process; it opens no second server and cannot send commands to K1. All input/code digests and executed sources are retained under the existing private causal-replay root.

First positive qualification: 20260919-fast-display-006-positive-001, isolated run 7037b8d7-260c-4312-b4fa-21f552f0a15f.

• All 11 acceptance checks passed; complete 108-hypothesis search, three fresh windows before tracking, subsequent accepted checks, distance 35.300 m.
• Final overlap 99.1581%, inlier RMSE 0.14398 m. These are surface-registration statistics, not independent position error.
• All 1,013 lidar and 1,013 pose receipts consumed, zero queue overflow; 1,007 packets admitted to the bounded visual accumulator. Not every receipt must produce a visual frame: causal freshness and filtering remain active.
• 931 scene requests. During accepted live display: 668 requests over 73.183 s, 497 distinct latest cloud revisions (about 6.8 updates/s at this polling phase, with intermediate packets accumulated/coalesced rather than queued).
• Delta export through ASGI: median 1.94 ms, p95 25.07 ms, max 60.29 ms. Latest receipt age at snapshot: median 75.17 ms, p95 518.40 ms, max 1.122 s. Typical reply 43.5 KB, p95 50.3 KB; full initial projection up to 1.63 MB.
• These are receipt-to-server-snapshot/export measurements. They do not measure network-to-browser delay, native Rerun ingestion completion or GPU presentation.

Wrong-region qualification: 20260919-fast-display-006-negative-001, same independent query but reference route 130–160 m with its own surrounding context. All 11 acceptance checks passed. Search ended without accepted tracking; the fast path did not invent an alignment or green confirmation.

The final delivery-age guard and preservation of stored display diagnostics were added after these first two replay seals. They do not change the numerical inputs or registration algorithm. Final-source validation is recorded below at handoff.

Final-source replay: 20260919-fast-display-006-positive-002, isolated run 0a4d0d53-1877-473c-be94-926291dc415e. All 11 checks passed, all 2,026 input receipts delivered, 1,007 visual packets, no queue overflow. 917 scene requests; accepted display 659 requests / 73.264 s and 494 distinct latest cloud revisions (6.74/s). Snapshot age median 73.47 ms, p95 521.19 ms, maximum 1.040 s. Export median 1.98 ms, p95 25.72 ms, maximum 62.20 ms. This final seal includes the age headers/guard and executed scene sources; it is still not a browser frame-rate test.

Final focused Python run: 103 passed. Architecture and stream tests, TypeScript typecheck and full frontend suite: 860 passed after the fullscreen correction. Production build passed. Ruff passed on eight changed Python files; git diff whitespace check passed. Known warnings: existing Vite large chunks and installed Starlette/httpx TestClient deprecation (no package installation attempted).

The browser check found that the existing fullscreen button depended on a live gRPC URL even for an independently rendered planning profile. The condition now admits that profile after capture ends; the existing expand/restore actions use canonical IconButton and retain the existing Escape handler. No new layout or fullscreen mechanism was added.

Controlled reload used the versioned LaunchAgent plan/apply path, unchanged plist SHA-256 5d7a58122c016f8021fede27d1b21891ee20238fc38c281e5b33574ff8204e3f, after fresh checks of idle control/source/camera, completed acquisition, resolved physical command and protocol-confirmed STOP. New canonical PID 7662 accepted health/readiness; 8765 had no listener. It restored the original physical run as completed/historical, not as live localization. The final frontend-only rebuild does not require another backend restart.

In-app browser QA on the final app-BRD3dS1N.js: actual retained physical run rendered through the new delta endpoint in normal 3D and top view. Expand, Escape restore, query-layer off (only gray reference remains) and on all passed. Historical status remained explicit; no live camera/green localization was invented. The real 3D case was left open for owner review, with one viewer only. No final-source browser live cadence or simultaneous camera+scene run is claimed; that is the next physical acceptance on the same known route.

Ops MISSIONCOR-81 updated through the direct Tasker MCP: 12 titled report/checker blocks appended, all previous 96 blocks preserved (108 total). Physical fast-view acceptance and independent navigation/failure-stop acceptance remain unchecked.

Product and authority boundaries

The product-UI skill retained the existing Rerun host, scene modes, canonical controls, expand/restore and error surfaces. No new shared component, navigation root or LAB layout was introduced. Engineering diagnostics stay in evidence/Ops.

This change qualifies faster presentation, not obstacle perception or a control loop. A five-second map fit can coexist with fresh native pose, but the laboratory 8 s fit-age allowance is not a safe vehicle reaction/stop budget. That requires a separate speed-dependent contract and measured failure response.

Assessment for supervised motion

The physical 35.3 m walk is genuinely encouraging: all 15 fresh fits accepted, moving overlap about 96–98%, accepted transform yaw span about 0.197°, and no loss while walking. Terminal stale occurred after confirmed device STOP. This supports progressing toward a slow, bounded, supervised test on the known route; it does not establish a universal positional accuracy or safe clearance.

Missing evidence: surveyed/cross-measured route position and heading errors, repeat starts with varied offsets/orientations/heights, ambiguous/wrong locations, occlusion and receipt loss, and verified stopping before an unsafe distance is covered. High overlap and low fit RMSE cannot substitute for those tests. The previous 25 cm clearance idea is not validated by a 14 cm surface-fit RMSE.

Retain vehicle_control=false and localization_confirmed=false. No rover was moved and no K1 start/stop/calibration command was issued by this implementation.