NODEDC_MISSION_CORE/docs/audits/2026-09-19-registration-stabilization-006.md

# Registration stabilization after physical run 006

Date: 2026-09-19. Scope: LAB registration, live presentation, and reproducible
qualification. Rover geometry, mounting profiles, obstacle clearance, controller
integration, and autonomous motion are explicitly outside this change. Both
`vehicle_control` and `localization_confirmed` remain false.

## Evidence and decision

The preceding diagnosis is in
`2026-09-19-physical-start-006-diagnosis.md`. Physical run `ja-sun-006`
(`ebee2e65-5d74-49f2-9489-1b2fecf30a76`) initially registered successfully.
Its late rejection coincided with inadequate reference-map coverage past the
selected 30.01 m route. The old renderer then selected the travel-heading hint
instead of retaining the accepted transform. Neither the user's uncertain
viewing angle nor this reconstruction establishes exactly when the user noticed
the apparent rotation. The original report and raw recordings are not rewritten.

The change addresses these demonstrated boundaries, without weakening GICP,
initial-search completeness, freshness, or temporal consistency acceptance.

## Implemented contracts

- `missions/reference_map.py`, `sources.py`: a live reference map includes up to
  20 m of recorded trajectory context on each side of the selected route.
  `route-context-map/v1` limits extraction to three tiles of at most 40 m,
  0.25 m voxel deduplication, and 100,000 points. Source identity and hashes are
  checked by the existing bound/submap path. Invalid distance ordering, excessive
  interval length, insufficient continuity, and oversized maps fail closed.
  Route geometry and its selected interval are unchanged. Recorded A/B comparison
  remains on its existing interval-based submap implementation.
- `missions/live_presentation.py`, `live_tests.py`: latest display data, accepted
  alignment, and numerical evidence are separate. A newer same-segment cloud may
  advance under the last accepted transform only while its age is at most 2 s
  and the accepted fit age is at most 8 s. A rejected result cannot replace that
  transform. There is no travel-heading fallback before or after registration.
- `missions/live_scene.py`: newer points use ordinary height colouring. Green
  correspondences belong only to the exact accepted fitted window and its own
  indices/transform. Loss, expiry, source change, and completion remove live
  highlighting. A terminal display is explicitly historical, not current pose.
- New runs save a hashed `aligned-preview.npz`. Restored legacy runs use their
  last temporally accepted, hash-verified fit window. For old 006 this is a
  historical window, not a newly reconstructed full terminal cloud. Failed or
  absent integrity evidence does not authorize a substitute alignment.
- `missions/projects.py`: archive rendering follows the same accepted-alignment
  rule; a versioned derived-scene cache prevents reuse of the old renderer output.
  Original result metrics remain visible with a note that the scene uses the last
  accepted alignment while the metrics describe the last calculation.
- `sessions/live_planning.py`, K1 `planning_live.py`: preserve native pose
  orientation in the neutral event ABI. `live_tests.py` receives pose telemetry
  independently of the five-second fit cycle. This is K1 session-frame telemetry,
  not a chassis pose or a new navigation/control authority.
- `stationary_live.py`: scene snapshots every 0.5 s; separate distance-limit,
  time-limit, cancellation, and input-end reasons. The 40 m LAB cap is unchanged.
- Frontend `PlanningLiveScene.tsx`, `PlanningSpatialWorkspace.tsx`,
  `PlanningTestContext.tsx`, `planningPresentation.ts`, `planningProjects.ts`, and
  `PlanningProjectResult.tsx`: 0.5 s polling with unchanged-terminal revision
  suppression; explicit live/historical state and stricter cloud-age display
  gating. No new design primitive, control, CSS surface, or alternative viewer.

## Recorded-input qualification

The extended `scripts/check_planning_live_bootstrap.py` and
`planning_archive_source.py` replay original receipt intervals at 1x through the
actual ingress queue and K1 decoder. The production reference-map builder is used
before sealing the reference. No physical K1 access, second server, accelerated
load, camera replay, or browser timing simulation was used. A 120 s input budget
allows the service's existing 40 m cap to terminate the run.

Private evidence lives under the canonical data directory at
`missions/causal-replays/20260919-stabilization-006-positive-001` and
`missions/causal-replays/20260919-stabilization-006-negative-001`.
Each contains input/source hashes, copies of the 34 executed implementation files,
reference provenance, receipt deliveries, decisions, scene measurements, RRDs,
summary and artifact seal. The 82 original 006 artifacts were verified.

| Check | Correct entry | Wrong reference region |
| --- | --- | --- |
| Complete initial search | 108 hypotheses; ready at 25.405 s | Complete search, not timeout |
| Tracking | Established at 38.356 s | Never established |
| End | Distance limit at 100.691 s | Initial registration rejected |
| Final accepted geometry | 98.232% overlap; inlier RMSE 0.1533 m | No accepted localization |
| Delivered pose/cloud events | 2,014 | 2,016 |
| Maximum replay delivery lag | 0.1679 s | 0.0555 s |
| Qualification checks | 11/11 | 11/11 |

Positive run: `396d1cd4-e80e-4b87-9a9b-6d1022637404`,
2026-09-19T18:29:55.348Z–18:31:36.318Z. Tracking persisted through the final
accepted fit at 99.758 s, including the former failure region. The reference
contains 70,870 points in two tiles, route indices 0–577, map indices 0–785
(approximately 0–50 m). The published final distance is 39.486 m; the subsequent
input reaches the 40 m termination gate. Terminal display sequence 1995 retains
alignment sequence 1983, with no live green authority.

Negative run: `75cad066-9b20-496a-87f0-eda98a783997`; reference route 130–160 m
and context approximately 110–180 m. Rejection at 24.443 s, without tracking.
This is one wrong-region control, not a false-positive-rate estimate.

The positive replay produced 191 scene exports: server-side export latency
p50 3.04 ms, p95 38.49 ms, maximum 171.82 ms. Maximum observed native pose age
was 0.884 s. Pose queue overflow was zero; lidar overflow was 1 of 1,007
published frames. Unconsumed terminal queue depths (pose 3, lidar 4) are separate
from overflow. These are private replay/server measurements, not physical
sensor-to-browser or sensor-to-controller latency guarantees. Surface overlap
and inlier RMSE are not independent localization accuracy.

## Verification and runtime acceptance

- 99 focused Python cases passed: stabilization, live/project/failure boundaries,
  planner, stationary bootstrap, recovery, causal replay, entry, registration,
  and recording ingress.
- Architecture 4/4, full frontend 854/854, TypeScript typecheck, then production
  build passed sequentially. Existing bundle-size warnings remain. Production
  asset: `app-D2qqIbEW.js`.
- Ruff check passed for the nine selected changed/new Python modules and harness
  files; this is not a whole-repository lint claim. `git diff --check` passed.
- Browser QA on real 8000: old 006 opens with the historical accepted transform;
  the original rejected result remains 49.4% / 0.266 m. Its explanatory note is
  readable after inspector scrolling. Planner and spatial normal/expanded modes,
  3D/top views, reset view, inspector maximize, and Escape were exercised. No
  browser console errors were reported. Narrow spatial mode retains existing
  limited toolbar/overlay space; expanded mode was restored. No live device was
  connected and no live end-to-end browser latency is claimed.
- Before restart: source/control idle, completed acquisition, receiver stopped,
  physical command inactive. Versioned LaunchAgent plan/apply succeeded with
  backup and health acceptance; current and desired plist SHA-256 both
  `5d7a58122c016f8021fede27d1b21891ee20238fc38c281e5b33574ff8204e3f`.
  No repository/environment migration. PID 91643 → 99603.
- Runtime started 2026-09-19T18:39:44.252799Z,
  `snapshot-runtime-564d78ca9bd1eb86e13bdce9b4b5be27`. Health operational,
  plugin runtimes 1/1, only canonical 8000 listening and no 8765 listener.
  Restored 006 is completed/ended/historical, both authority flags false.
- No Docker workloads were started. Sequential replay/test/build/browser work
  respected the 18 GB host; reported free memory was 34–42% around these checks.
  Replay publishers and numerical workers terminated and released leases.

## Next physical acceptance

Ready for another short manually carried K1 test near the known start, with a
new recording name. Wait stationary for actual tracking, then walk 20–30 m with
the same reference. Do not interpret a fixed wait time, scanner calibration
success alone, or one green cloud as permission to start. If tracking is lost,
stop the walk, retain the evidence, and finish recording through normal controls.
Evaluate startup, motion, height/orientation change, scene freshness, terminal
view, recording closure and replay together. The entire raw/archive/camera path
must still be accepted physically; this qualification did not exercise RTSP/MSE.

The currently qualified initial search radius remains 5 m. A 10 m start envelope,
arbitrary-route global relocalization, generalized failure recovery, onboard
timing, independent pose accuracy, and autonomous driving are not accepted by
these results. No rover profile or footprint decision is needed to validate this
registration change.