NODEDC_MISSION_CORE/docs/audits/2026-09-19-stationary-bootstrap.md

# Stationary prior → fresh validation → temporal tracking

## Objective and frozen protocol

Connect the previously qualified stationary snapshot initializer to current-data
validation. The owner accepts a startup wait. This increment checks the complete
causal chain on the existing independent A/B recordings, without another physical
scan, vehicle commands, product UI changes or activation in the live profile.

The immutable pre-execution manifest is in private
`data_dir/missions/causal-replays/20260919-stationary-bootstrap-002`.
Preparation `-001` was not executed: a formatting-only script correction preceded
preparation `-002`. No numerical attempt is omitted.

Inputs reuse the preceding recovery experiment's A forward 39.926109 m / 52,965
points, B's raw transport and actual receipt clock, and the frozen negative A
130–155 m geometry. A is `20260911T085226Z_viewer_live`; B is the independent
`20260911T134352Z_viewer_live`. Input hashes are verified before and after each
run. No previous fitted B matrix, overlap mask or later travel heading seeds the
search. Metadata's one pending event supplies only its due time until delivery.

Policy `stationary-fresh-bootstrap/v1`:

1. Collect the first 10 s incrementally. Recorded motion must be ≤0.10 m; require
   continuity and ≥300 retained points. Each event is checked, including poses
   that the spatial buffer would otherwise thin. Prefix provenance is bounded.
2. Freeze only when every due prefix event has arrived. Run the existing
   `stationary-entry/v1` search: 108 hypotheses, complete-search/support/ambiguity
   gates, 25 s soft / 30 s process deadline, no change to local GICP thresholds.
3. A successful old fit is **only a provisional seed**. It contributes zero
   temporal confirmations, no live matrix and no green/tracking authority. Its
   source timestamp remains unchanged. Maximum search wall time is 30 s; maximum
   prior source age 40 s; there is one initialization attempt and one seed trial.
4. Start a new empty buffer after the search actually completes. Exclude every
   receipt at or before completion, including backlog delivered late. Require at
   least 2 s of new cloud observations. Trial must complete within the prior's
   10 s lifetime. Input continues at original 1× pace during calculation.
5. Fit current cloud using the provisional seed, then apply unchanged
   `causal-consistency/v1`: source age ≤8 s, three consistent candidates, ≤0.5 m
   position change and ≤5° rotation change. Subsequent fits are at least 5 s apart.
   Observation sequence IDs in successive fit windows are disjoint; the buffer
   resets at each submitted sample, while new receipts continue accumulating.
6. Reject bad/partial/expired initialization, failed fresh fit, session/generation
   change, source-order regression, fresh-phase receipt gap, silence and input
   end. Never retry a failed provisional seed or fall back to future travel
   heading. A late worker result cannot reactivate an ended run.

The original B receipt gap occurs while initialization is running. One gap before
readiness may retain an old same-session transform **as a hypothesis only**,
subject to the separate fresh checks above. It cannot bypass `CausalTracking`'s
old-segment rejection. Any gap after readiness discards the one-shot prior and
tracking. Session/generation identity is enforced; subtle unreported SLAM frame
resets are not verified (`slam_reset_verified=false`). This distinction is an
experimental assumption, not a deployment claim.

## Implementation

- `missions/stationary_entry.py`: shared incremental bounded prefix collector;
  old snapshot entry point wraps the same collector.
- `missions/stationary_bootstrap.py`: provisional state, source/freshness fences,
  one-shot trial, disjoint fresh windows and existing temporal gate.
- `missions/stationary_replay.py`: bounded 1× orchestration, one isolated numerical
  worker, concurrent input delivery, stage provenance, historical-only late jobs.
- `scripts/check_stationary_bootstrap.py`: frozen sources/code/expected outcomes,
  sequential positive and wrong-region controls, immutable exact source copies.
- `tests/test_stationary_bootstrap.py`: authority, identity, timeout, gap,
  partial-search and observation-fence cases.

No change to the running travel-entry product profile, frontend, capture
ownership, device protocols or old saved experiments.

## Results

Both complete 1× probes passed their frozen expectations. Darwin arm64,
Python 3.12.13, small_gicp 1.0.1; single isolated CPU worker, sequential runs.

Positive: 2026-09-19 12:26:30.527–12:27:33.648 UTC;
monotonic start 838468170195291. Delivered 974 events in 63.122767 s,
40.037509 m; maximum delivery lag 0.154619 s. The original 9.972693 s receipt
gap and 10.406525 m recorded displacement remain present. No event is replayed
early. The selected fit windows lie inside the reference's 39.926109 m extent;
the final pose crosses 40 m and ends the probe without another fit.

The initial prefix remains 168 events / 8,227 retained points, maximum recorded
motion 0.0051505 m. It is frozen at 10.008045 s without a B travel heading.
All 108 hypotheses complete in 20.980390 s (worker wall 21.158549 s), producing
the same geometric candidate as the preceding snapshot: overlap 89.8145%,
RMSE 0.170424 m. This run's timing is a single measurement, not a guaranteed
startup deadline. At completion the newest included cloud is 21.482298 s old:
its original time is retained and it is not admitted to the live gate.

| Stage | Seconds from first receipt | Current-data age | Temporal streak |
|---|---:|---:|---:|
| Provisional seed ready | 31.166594 | old prefix; no live admission | 0 |
| First fresh fit | 33.807565 | 0.371100 s | 1 |
| Second fresh fit | 38.757844 | 0.372068 s | 2 |
| Tracking established | 43.823601 | 0.658728 s | 3 |
| Further fresh fits | 48.835069 / 53.928964 / 59.181734 | 0.453103 / 0.475792 / 0.308357 s | 4 / 5 / 6 |
| Input ends, state cleared | 63.122606 | — | 0 |

Six fresh windows use disjoint observation IDs, all strictly after initial search
completion; each cloud time is ≤request time≤completion time. Their B distances
are 14.624 / 19.049 / 23.296 / 27.295 / 31.905 / 36.019 m. Fit worker wall times
are 0.224275–0.328083 s including process overhead; overlaps 98.198–99.260%,
inlier surface RMSE 0.148757–0.154952 m. These are geometric consistency metrics,
not independent position errors. Disjoint receipt IDs are not independent SLAM
maps; overlapping real surfaces are expected.

Negative A 130–155 m: 12:27:58.108–12:29:01.231 UTC;
monotonic start 838555753631833. Same 974 B events / 40.037509 m,
maximum delivery lag 0.145273 s. All 108 hypotheses finish in 14.933964 s;
`no-admissible-entry`, rejected at 25.165285 s. No prior, fresh candidate or
tracking appears; no automatic travel-heading fallback. One wrong area is not
an estimate of false-positive frequency across a location catalogue.

## Validation and retained evidence

65 focused tests passed in 3.34 s: stationary bootstrap, preceding stationary
prefix and receipt-loss tests, entry acquisition, causal replay, live planning,
projects, registration and archived viewer replay. Ruff and `git diff --check`
passed. Existing Starlette/httpx deprecation warning remains.

Verified input hashes before/after runs, frozen executed-source hashes, all 36
positive and 6 negative artifacts, source-time ordering, disjoint fresh windows,
zero authority from the old fit and cleared state at end. The private directory
contains the protocol manifest, exact code, per-step inputs/results/provenance,
receipt delivery logs, test output, summary and seal. Geometry stays outside Git.

SHA-256:
- Positive report: `d9cbd3059531a1c26d7101a11d0d9a73c7234dfe360eae55d19ae27956a72452`
- Negative report: `723d7654d49a326a783fcc81332bb67cfe0dce5323195ca2a286de634e6ba9c9`
- Seal: `ffd380e20f46b2c70d195702e86c769b592f2259be01e2aca6806e45cdf293ef`

Memory checks before runs showed free-memory percentage 54% then 51%; swap
4522.31 → 4370.31 MB. Docker VM was not started. Temporary worker processes exited
between runs. The canonical server was left running; no duplicate backend or
product restart was needed.

## Decision and next boundary

On this independent recording pair the complete sequence now works causally:
stationary prefix → bounded search → non-authoritative prior → current cloud
confirmation → temporally consistent tracking. Full readiness is about **44 s**
from first receipt in this probe, not the 21 s search duration or 31 s prior time.
The existing B moved while calculation ran; this is not a new physical test of
a rover holding still throughout readiness.

This research protocol remains uninstalled in the product's live planning
profile; its default is still travel-entry. Next, connect this same bootstrap
state machine to the existing live profile and recording lifecycle, preserve
camera/scene controls, expose preparation/confirmation/readiness through existing
product states, and test teardown/reconnection without another scan. A separate
choice is required for route entry assumptions and trustworthy frame-reset
signalling. Then qualify different initial positions/headings and the actual
board, and perform a physical validation pass. No unrestricted start, navigation
accuracy, obstacle avoidance, permissible speed or autonomous driving is accepted.
The 5 s diagnostic cadence and 8 s freshness bound are not a motion-control loop.