NODEDC_MISSION_CORE/docs/audits/2026-09-20-local-tracking-recovery-and-scene-80m.md

# Local tracking, recovery and independent 80-m presentation

Implementation following the operator's architecture review, 20 September 2026.
No scanner commands, new physical capture, vehicle control or deletion of raw evidence.

## Operational contract

The selected reference is the known working territory. Initial localisation is a hypothesis
search; ordinary tracking is local verification, not repeated global recognition.

1. First acquisition: stationary fresh prefix, dense start-area search, provisional hypothesis.
2. Only a completed geometric rejection permits the existing selected-route fallback.
   A time budget expiring is incomplete computation, not proof that the place is wrong.
3. Three disjoint fresh checks are needed for tracking. Original quality thresholds remain.
4. Tracking uses the established local 20-m input profile. Spatially selected reference windows
   preserve 0.25-m map sampling. More than 100,000 target points is not itself a localisation failure.
5. After previously established tracking is lost, accepted live authority clears immediately.
   The same session remains running and capture ownership stays with the recorder.
6. Recovery collects a new stationary prefix, searches the last confirmed reference position
   first, then uses the existing route fallback when applicable. Historical position is a search
   hint only, not a valid current transform. Failed recovery attempts repeat using new data.
7. Movement during recovery restarts stationary collection. Coordinate jumps do not count as
   travelled distance. New session/generation cannot silently inherit an old registration.
8. Operator cancellation and actual input-session end still end the research. Selected-route
   distance completion remains the existing diagnostic-run completion rule.

Initial acquisition failure remains an actionable manual reinitialisation state. A moved manual
retry does not secretly start another attempt without a click. Initialisation and post-tracking
recovery are intentionally different states.

## Display and clipping

The presentation profile has an independent 80-m radial envelope and no hidden relative-height
filter. A separate scene atlas is produced from reference raw frames; numerical registration
never consumes this presentation derivative. Display LOD budgets remain, with raw data retained.

The right-side vertical slider has upper value 80 m. Its top position means no user ceiling
(`ceiling_m` omitted); lowering it clips in reference-frame Z. Range is not inferred from the
current cloud's maximum Z and is not a claim that every recording contains points at 80 m.
An 80-m radial range and 80-m Z ceiling are different coordinate concepts.

New runs retain a hash-bound `scene-reference.npy` separately from `reference.npy`.
Old numerical artefacts are not rewritten; historical reference presentation can be rebuilt
from verified source data, while old query previews retain their originally saved content.

In the common Design Guideline StatusBadge, opt-in pulse animates only the lamp and respects
reduced motion. Mission Core uses it for lost/recovering/error, not for the panel background.
Search and fresh-confirmation banners omit the redundant grey descriptions.

## Verification

162 focused Python tests passed before archive qualification, including recovery after stale
data, insufficient local reference, rejected fit, worker failure and pose discontinuity.
Each recovery fixture reacquires with fresh observations; no capture stop is issued.

Actual live service at 1× recorded receipt cadence, production derived ingress, isolated
in-process scene-delta endpoint, no listening test server:

- 014: complete available recording, 38.262 m; 15 accepted fresh fits. A final in-flight fit is
  rejected for input-ended, not density/registration failure. All 11 qualification checks pass.
  Evidence: local private `.runtime/qualification-20260920-v5-014`.
- 007: 102.594 m, 25/25 fresh fits accepted, no recovery/loss before selected-distance completion.
  All 11 checks pass. Evidence: local private `.runtime/qualification-20260920-v5-007`.
- Separate display atlas: 190,384 points, Z −2.904…62.702 m; numerical reference remains
  155,806 points, Z −0.741…7.439 m. Thus the old visual ceiling was a preparation filter,
  not merely a slider label.

Original input checksums and executed-code checksums are retained with each qualification.
All leases released and current alignment invalidated after source end.

Two further plugin-contribution tests pass (164 focused Python tests total).
Frontend: 24 focused tests; Design Guideline: 7 tests plus registry validation.
Ruff passes for the changed orchestration/registration modules; production TypeScript/Vite
build passes (existing large-bundle advisory remains).

Applied to the existing canonical service on 8000 using the versioned LaunchAgent manager:
idle and terminal-research preconditions checked, backup retained, health accepted.
Browser QA on the actual historical 014 scene: native slider min −2.904, max/value 80;
lowering to 20 visually clips the upper cloud; End restores 80. Actual status lamp computed
animation is nodedc-status-pulse, red RGB 255/116/116, badge background remains transparent.
The temporary browser tab was closed; no scanner recording was started.

Ops structured-layout writes to MISSIONCOR-79/81 were denied by automatic safety review.
No external card update was applied. Separate approval was requested for a short, non-sensitive
comment instead; local acceptance does not depend on an Ops write.

## Still unqualified

This is LAB evidence, not a navigation-safety or independent-accuracy certificate.
The next physical test is a known-start 100-m passage followed by deliberate loss/recovery
while stationary. Arbitrary middle-of-route starts, 10-m displaced starts, kilometre routes,
independent pose error and deployment on the rover computer remain separate acceptance work.
No lowered overlap/RMSE acceptance thresholds and no vehicle-command authority were introduced.