NODEDC_MISSION_CORE/docs/audits/2026-09-19-selected-route-distance.md

# Selected route owns the live walk distance

Owner correction: remove arbitrary upper distance limits, not replace 40 m with
100 m. The operator may select 100, 200, 300 m or another available reference
interval. No physical acquisition or movement was requested or initiated here.

## Contract and implementation

- `live_limits.py`: new live runs seal the selected draft's actual `length_m`
  as `maximum_distance_m`. No upper route length and no overall run timer.
  The existing 3 m lower bound belongs to the initial heading basis, not a
  maximum walk distance. Nonfinite or invalid lengths still fail admission.
- `live_tests.py`, `stationary_live.py`: use that sealed distance, not a
  constant 40 m. Remove both the 300 s active and 1800 s waiting termination.
  Completing the selected distance ends the calculation only; it never sends
  scanner STOP or stops the independent raw recording. Identity, freshness,
  geometric gates and individual native-worker deadlines remain unchanged.
- `reference_map.py`, `sources.py`: cover the complete selected interval plus
  the existing 20 m context on either side where the recording permits it.
  Prepare as many <=40 m extraction tiles as necessary; 40 m is now a tile
  size, not a route cap. No tile-count or whole-map point-count truncation.
  Merge/deduplicate one tile at a time at the existing 0.25 m voxel scale.
  Cancellation is checked between tiles and after preparation; it releases
  leases without starting acquisition. One extractor invocation still has its
  own bounded CPU/data contract.
- `reference_window.py`: retain the complete route map for evidence, but for
  maps above the existing 100,000-point numerical budget select a local target
  around the initialization/accepted pose. Radius includes all current query
  points and a 10 m search/correction neighbourhood. Smaller maps retain their
  exact target. Local targets are never silently thinned to pass the budget;
  missing/too-dense local support fails explicitly. Each calculation seals
  its window bounds, counts and target-array SHA-256 with its input artifact.
- `live_buffer.py`: after 2000 retained trajectory vertices, decimate historical
  display geometry while retaining the first and latest pose. Previously the
  frozen tail could overcount subsequent distance or cause false jump errors.
  Raw evidence remains untouched. Display decimation is not a pose reset.
- `PlanningProjectSettings.tsx`, `planner.ts`: reuse existing start/end metre
  controls and `Вся траектория`. Live admission has no upper distance cap.
  End selection chooses the preceding recorded pose rather than overshooting
  the typed endpoint. The actual selected length remains visible.

The separate one-shot **two saved recordings** comparison is not the live
tracking pipeline. Its existing explicit 3–40 m admission remains unchanged;
extending that batch estimator is not claimed by this live-walk change.
Developer archive probes retain their own explicit wall bounds; these are not
operator run limits.

## Evidence and tests

Immutable physical query: `20260919T185447Z_viewer_live`, original live run
`27a20878-9697-4735-a86e-763de28e4b67`, distance 35.300 m. Reference:
`20260911T085226Z_viewer_live`, full recorded path 487.611 m. Existing reports,
raw captures, metadata and code are hashed by `check_planning_live_bootstrap.py`.
Its new `--route-length-m` changes only the isolated probe's reference selection,
not any operator draft or original result. It reuses real receipt queues,
registration workers and in-process production scene GETs, without a listening
server, physical commands or a new capture.

`20260919-selected-route-006-100m-001`: all 11 checks passed. Reference 141,543
points / four extraction tiles; numerical targets 37,482–73,356 points.
All 1013 pose and 1013 lidar receipts consumed, zero overflow. All 15 fresh
fits accepted. Last overlap 0.98911, inlier RMSE 0.14794 m. This seal preceded
only incremental map merge/cancellation handling; the full 300 m repeat uses
the later sources.

`20260919-selected-route-006-300m-001`, run
`02f063a1-48d8-4f9c-9ddc-ae3ae4819686`: all 11 checks passed. Actual selected
distance 299.929 m, map 302,013 points / nine tiles, local numerical targets
37,480–73,355. All 15 fresh fits accepted over the existing 35.300 m query;
final overlap 0.98945 and inlier RMSE 0.14794 m. Pose overflow zero, lidar
overflow **2 of 1013**; do not call this a zero-drop run. No tracking loss before
input ended. This is larger-map regression, not a 300 m independent traversal.

`20260919-selected-route-006-wrong-001`, run
`97c40331-e1f5-48dc-ab8d-dce9c85f55e8`: all 11 checks passed using the wrong
reference interval starting at 130 m and extending another 100 m. Complete
108-seed search rejected the location; no tracking or accepted transform was
invented. One lidar receipt overflow, no pose overflow. Original inputs and
executed source hashes remained unchanged in both final-source qualifications.

Focused backend validation: 128 passed. Includes live stop at selected 20,
50, 100, 200 and 300 m; no hidden waiting/active timer; admission at 10 km;
coverage across multiple tiles; cancellation and lease cleanup; local-target
budget failures; path continuation past 2000 vertices; historical display,
stale/identity/ambiguity and failure regressions. Synthetic distances prove
software termination semantics, not physical localization accuracy.

Frontend architecture 4/4, TypeScript typecheck, complete frontend suite
861/861 and production build passed sequentially. Ruff passed for nine checked
changed/new Python modules/tests; whitespace check passed. Existing Vite
large-chunk and TestClient/httpx deprecation warnings remain. No Docker VM or
second backend; free-memory observation 50–54%, swap stable at 5784.62 MB across
checks. Temporary probe/native/test/build workers exited before the next stage.

## Runtime and interface acceptance

Canonical service reloaded through `manage_mission_core_launch_agent.py apply`
after fresh proof: source/control/camera idle, acquisition null, physical command
resolved/inactive, active planning run completed. Current/desired plist hashes
both `5d7a58122c016f8021fede27d1b21891ee20238fc38c281e5b33574ff8204e3f`.
Health accepted; new PID 11459. No data-root migration or device commands.
Production bundle `app-DWoNbjNw.js`.

In-app browser on the rebuilt app: existing reference JA-SADOVAYA-001; typed
100 m selected 99.912 m, typed 300 m selected 299.929 m, and whole trajectory
selected 487.611 m. Start stayed enabled in all three cases. These are actual
recorded-pose endpoints, not fabricated exact-metre positions. Normal/expanded
settings and Escape passed. The temporary client-only draft was neither saved
nor started. Returned to the original physical ja-sun-006 historical 3D result;
scene expansion and Escape restored correctly. No real-time rate or new
physical-distance accuracy was measured by this UI check.

Ops MISSIONCOR-81 updated through the direct Tasker MCP: 12 titled report/checker
blocks appended, previous 108 preserved (120 total). Physical long-walk and
navigation acceptance remain unchecked.

## Boundaries

Removing a route cap is not proof of unlimited hardware capacity. The complete
reference geometry, preparation time and stored evidence still scale with the
selected interval. This is not a disk-paged city-scale map implementation.
Individual extraction/registration budgets, corruption checks and freshness
gates remain real. No distance-based quality claim or automatic threshold
relaxation is introduced. Surface overlap/RMSE is not independent positional
accuracy. A physical 100/200/300 m repeat remains to be measured.

The product-UI skill kept the existing inspector, canonical RangeControl/Button
and viewer composition; no new setting, visual primitive or product root.
Only the canonical durable service on 8000 may be reloaded after idle proof;
no duplicate server, Docker workload or rover/K1 command is admitted.