NODEDC_MISSION_CORE/docs/audits/2026-09-19-registration-stabilization-006.md

Registration stabilization after physical run 006

Date: 2026-09-19. Scope: LAB registration, live presentation, and reproducible qualification. Rover geometry, mounting profiles, obstacle clearance, controller integration, and autonomous motion are explicitly outside this change. Both vehicle_control and localization_confirmed remain false.

Evidence and decision

The preceding diagnosis is in 2026-09-19-physical-start-006-diagnosis.md. Physical run ja-sun-006 (ebee2e65-5d74-49f2-9489-1b2fecf30a76) initially registered successfully. Its late rejection coincided with inadequate reference-map coverage past the selected 30.01 m route. The old renderer then selected the travel-heading hint instead of retaining the accepted transform. Neither the user's uncertain viewing angle nor this reconstruction establishes exactly when the user noticed the apparent rotation. The original report and raw recordings are not rewritten.

The change addresses these demonstrated boundaries, without weakening GICP, initial-search completeness, freshness, or temporal consistency acceptance.

Implemented contracts

• missions/reference_map.py, sources.py: a live reference map includes up to 20 m of recorded trajectory context on each side of the selected route. route-context-map/v1 limits extraction to three tiles of at most 40 m, 0.25 m voxel deduplication, and 100,000 points. Source identity and hashes are checked by the existing bound/submap path. Invalid distance ordering, excessive interval length, insufficient continuity, and oversized maps fail closed. Route geometry and its selected interval are unchanged. Recorded A/B comparison remains on its existing interval-based submap implementation.
• missions/live_presentation.py, live_tests.py: latest display data, accepted alignment, and numerical evidence are separate. A newer same-segment cloud may advance under the last accepted transform only while its age is at most 2 s and the accepted fit age is at most 8 s. A rejected result cannot replace that transform. There is no travel-heading fallback before or after registration.
• missions/live_scene.py: newer points use ordinary height colouring. Green correspondences belong only to the exact accepted fitted window and its own indices/transform. Loss, expiry, source change, and completion remove live highlighting. A terminal display is explicitly historical, not current pose.
• New runs save a hashed aligned-preview.npz. Restored legacy runs use their last temporally accepted, hash-verified fit window. For old 006 this is a historical window, not a newly reconstructed full terminal cloud. Failed or absent integrity evidence does not authorize a substitute alignment.
• missions/projects.py: archive rendering follows the same accepted-alignment rule; a versioned derived-scene cache prevents reuse of the old renderer output. Original result metrics remain visible with a note that the scene uses the last accepted alignment while the metrics describe the last calculation.
• sessions/live_planning.py, K1 planning_live.py: preserve native pose orientation in the neutral event ABI. live_tests.py receives pose telemetry independently of the five-second fit cycle. This is K1 session-frame telemetry, not a chassis pose or a new navigation/control authority.
• stationary_live.py: scene snapshots every 0.5 s; separate distance-limit, time-limit, cancellation, and input-end reasons. The 40 m LAB cap is unchanged.
• Frontend PlanningLiveScene.tsx, PlanningSpatialWorkspace.tsx, PlanningTestContext.tsx, planningPresentation.ts, planningProjects.ts, and PlanningProjectResult.tsx: 0.5 s polling with unchanged-terminal revision suppression; explicit live/historical state and stricter cloud-age display gating. No new design primitive, control, CSS surface, or alternative viewer.

Recorded-input qualification

The extended scripts/check_planning_live_bootstrap.py and planning_archive_source.py replay original receipt intervals at 1x through the actual ingress queue and K1 decoder. The production reference-map builder is used before sealing the reference. No physical K1 access, second server, accelerated load, camera replay, or browser timing simulation was used. A 120 s input budget allows the service's existing 40 m cap to terminate the run.

Private evidence lives under the canonical data directory at missions/causal-replays/20260919-stabilization-006-positive-001 and missions/causal-replays/20260919-stabilization-006-negative-001. Each contains input/source hashes, copies of the 34 executed implementation files, reference provenance, receipt deliveries, decisions, scene measurements, RRDs, summary and artifact seal. The 82 original 006 artifacts were verified.

Check	Correct entry	Wrong reference region
Complete initial search	108 hypotheses; ready at 25.405 s	Complete search, not timeout
Tracking	Established at 38.356 s	Never established
End	Distance limit at 100.691 s	Initial registration rejected
Final accepted geometry	98.232% overlap; inlier RMSE 0.1533 m	No accepted localization
Delivered pose/cloud events	2,014	2,016
Maximum replay delivery lag	0.1679 s	0.0555 s
Qualification checks	11/11	11/11

Positive run: 396d1cd4-e80e-4b87-9a9b-6d1022637404, 2026-09-19T18:29:55.348Z–18:31:36.318Z. Tracking persisted through the final accepted fit at 99.758 s, including the former failure region. The reference contains 70,870 points in two tiles, route indices 0–577, map indices 0–785 (approximately 0–50 m). The published final distance is 39.486 m; the subsequent input reaches the 40 m termination gate. Terminal display sequence 1995 retains alignment sequence 1983, with no live green authority.

Negative run: 75cad066-9b20-496a-87f0-eda98a783997; reference route 130–160 m and context approximately 110–180 m. Rejection at 24.443 s, without tracking. This is one wrong-region control, not a false-positive-rate estimate.

The positive replay produced 191 scene exports: server-side export latency p50 3.04 ms, p95 38.49 ms, maximum 171.82 ms. Maximum observed native pose age was 0.884 s. Pose queue overflow was zero; lidar overflow was 1 of 1,007 published frames. Unconsumed terminal queue depths (pose 3, lidar 4) are separate from overflow. These are private replay/server measurements, not physical sensor-to-browser or sensor-to-controller latency guarantees. Surface overlap and inlier RMSE are not independent localization accuracy.

Verification and runtime acceptance

• 99 focused Python cases passed: stabilization, live/project/failure boundaries, planner, stationary bootstrap, recovery, causal replay, entry, registration, and recording ingress.
• Architecture 4/4, full frontend 854/854, TypeScript typecheck, then production build passed sequentially. Existing bundle-size warnings remain. Production asset: app-D2qqIbEW.js.
• Ruff check passed for the nine selected changed/new Python modules and harness files; this is not a whole-repository lint claim. git diff --check passed.
• Browser QA on real 8000: old 006 opens with the historical accepted transform; the original rejected result remains 49.4% / 0.266 m. Its explanatory note is readable after inspector scrolling. Planner and spatial normal/expanded modes, 3D/top views, reset view, inspector maximize, and Escape were exercised. No browser console errors were reported. Narrow spatial mode retains existing limited toolbar/overlay space; expanded mode was restored. No live device was connected and no live end-to-end browser latency is claimed.
• Before restart: source/control idle, completed acquisition, receiver stopped, physical command inactive. Versioned LaunchAgent plan/apply succeeded with backup and health acceptance; current and desired plist SHA-256 both 5d7a58122c016f8021fede27d1b21891ee20238fc38c281e5b33574ff8204e3f. No repository/environment migration. PID 91643 → 99603.
• Runtime started 2026-09-19T18:39:44.252799Z, snapshot-runtime-564d78ca9bd1eb86e13bdce9b4b5be27. Health operational, plugin runtimes 1/1, only canonical 8000 listening and no 8765 listener. Restored 006 is completed/ended/historical, both authority flags false.
• No Docker workloads were started. Sequential replay/test/build/browser work respected the 18 GB host; reported free memory was 34–42% around these checks. Replay publishers and numerical workers terminated and released leases.

Next physical acceptance

Ready for another short manually carried K1 test near the known start, with a new recording name. Wait stationary for actual tracking, then walk 20–30 m with the same reference. Do not interpret a fixed wait time, scanner calibration success alone, or one green cloud as permission to start. If tracking is lost, stop the walk, retain the evidence, and finish recording through normal controls. Evaluate startup, motion, height/orientation change, scene freshness, terminal view, recording closure and replay together. The entire raw/archive/camera path must still be accepted physically; this qualification did not exercise RTSP/MSE.

The currently qualified initial search radius remains 5 m. A 10 m start envelope, arbitrary-route global relocalization, generalized failure recovery, onboard timing, independent pose accuracy, and autonomous driving are not accepted by these results. No rover profile or footprint decision is needed to validate this registration change.