NODEDC_MISSION_CORE/docs/audits/2026-09-22-ai-polygon-route-recovery.md

# AI-полигон · привод, маршрут и проверка корпуса

Обновление23сентября: R29 и R30 прошли весь заданный маршрут Riverside Path
с `goal-reached` и остановкой. После оптимизации R30 завершён за32.67с вместо
63.97с; задержка inference по медиане234мс вместо414мс. Это парк с готовой
парой Gaussian/mesh, не грунтовка. Ниже сохранена история ошибок и последующих
исправлений, включая отрицательные результаты.

Полное автономное прохождение Forest/Bamboo пока не принято. Исправления ниже
подтверждают отдельные свойства симулятора; ни смещение перевёрнутого аппарата,
ни штатный Stop не считаются успешным маршрутом.

## Исправление прежнего результата

Forest `airun-3664b7dec1024dbe984aaf82a11147cc` закончился переворотом
(конечный roll около178°, наклон от вертикали около168°). Прежнее утверждение
«2.461м, затем остановка перед препятствием» отозвано в исходном audit и Ops.
Raw evidence сохранён. Теперь используется наклон оси корпуса относительно
вертикали из quaternion, поэтому инверсия не маскируется нормализацией углов.

## Исполнение и композиция

Isaac/PhysX, Gaussian, камера/лидар, модели, решения и журналы исполняются на
Worker006. Mac принимает видеопоток и компактное состояние. Физический привод
устройств не подключён. SegFormer B2 ADE150 и RF-DETR остались готовыми
провайдерами общей композиции; DDRNet и прежние образы/веса сохранены.
Добавлен модуль `simulation-waypoint-mission`: необязательные32точки XY,
проверка продвижения, до3попыток сменить наблюдаемую локальную цель, явные
`goal-reached`, `stuck`, `unstable`. Это локальное поведение, не глобальный
планировщик обхода и не подтверждённая автономность.

Состояние миссии теперь принадлежит эпизоду; пересоздание сетевого клиента модели
не сбрасывает индекс маршрута и terminal fault. Пауза замораживает время.
Близкая уже наблюдённая точка явного маршрута сохраняется в слепой полосе камеры,
если текущие наблюдения всё ещё содержат поверхность; CMU и монитор корпуса
сохраняют право остановки. Без свежего кадра800мс или команды500мс привод получает ноль.

## Измеренная физика

Квадратный footprint1×1м,4колеса радиусом0.25м,24кг, без подвески — временный
лабораторный профиль, не модель физических устройств пользователя.
11проверок на Worker: плоскость, ступени5/10/15/18/20/25см и уклоны10/15/20/25°.
Прошли плоскость,5/10см и все4уклона.15см и выше не прошли; поэтому предел
навигации снижен с прежнего неподтверждённого18см до10см.

Нулевая скорость сама по себе не удерживала колёса на склоне. Добавлен физический
position-hold колёсных шарниров: без фиксации корпуса, телепортаций и подмены позы.
На финальных уклонах10–25° дрейф после торможения за2с составил0.29–1.06мм.
Solver32/8 и contact offset5мм повторно прошли ту же capability-проверку.
Повтор одинаковых сохранённых команд на исходной Bamboo-геометрии уменьшил
максимальный наклон с50.86° до15.94°; это физический replay, не AI-route acceptance.

## Наблюдения и CMU

15колец виртуального лидара, первый физический контакт, частотаоколо5Гц.
Дополнительные лучи−80/−75/−70° сокращают слепую полосу перед колёсами.
Восстановлена upstream-память CMU: decay2с, noDecayDis4м. Исчезновение точки
за корпусом больше не объявляет пространство свободным. Очистка следов
движущихся участников не квалифицирована; память статического рельефа консервативна.

Готовые CMU terrainAnalysis/pathFollower и библиотека примитивов сохранены.
В localPlanner внесён ограниченный адаптер выбора: перед принятием кандидата
проверяется поворот к look-ahead0.7м и первый участок пути до1.2м с прямоугольником
1.1×1.1м (корпус плюс5см запаса с каждой стороны). Прежняя угловая проверка могла
разрешить задевание задним углом и одновременно запретить прямой выход.
Её заменяет этот фильтр. Отдельный монитор дуги фактически выдаваемой команды
остаётся включён. Изменения объявлены явно; C++ больше не считается неизменённым
upstream. Ограничение скорости0.15м/с и поворота20°/с сохранено.

Исходный CMU commit `158e67b31b644ed1e8b06eb1d7f70e183cc62591`;
базовый image `sha256:7693c28fac83df9e9e6ac6d89ffec81470f660cb8b30fc78fa88be228329dc0b`.
Отдельный image с фильтром:
`sha256:41784f6269f46907a4bb41323fe24ce8dcf439c797be94b1257d24f280c99453`.
Сборка из versioned `navigation/Dockerfile.footprint`, `missioncore_footprint.hpp`,
`patch_footprint.py`; повторная подготовка — `Prepare-RectangleNavigation.ps1`.
Старые model images не перезаписывались.

Семь независимых Worker-only проверок прошли: плоскость; объезд стены;
остановка в ограждении; коридор1.3м; отказ от0.9м; прямой выход от препятствия у
заднего угла; сохранение ближнего препятствия при исчезновении наблюдения.
Вариант только с более плотным terrainVoxelSize0.02 проблему не решил и не принят;
оставлено0.08. Первый вариант фильтра вместе со старой угловой проверкой не прошёл
новую регрессию; установлен только исправленный вариант.

## Плавные уклоны и сохранение препятствий

Установленный адаптер `navigation/terrain_costs.py` устраняет ещё одно измеренное
расхождение: физическое шасси проходит плавные уклоны до25°, но прежняя оценка
CMU блокировала15° и выше. Высота точки над нижним квантилем ячейки не равна
высоте ступени. Адаптер разрешает только наблюдённую локальную плоскость с
остатком не более2.5см, достаточной площадью опоры и уклоном2–25°; геометрия
не меняется. Резкие ступени, обрывы, недостаточные и неровные наблюдения
сохраняют прежнюю стоимость. Это не полная квалификация отрицательных препятствий.

На Worker прошли12сценариев: прежние7 и пять непрерывных уклонов5/10/15/20/25°.
Отдельная проверка через ROS-адаптер сохранила остановку перед ступенью15см
и перепадом вниз40см в коридоре1.3м. В R10 нормализатор не снял ни одного
из ближних препятствий: наблюдаемые перепады не удовлетворяют условию плоскости.

## Реальные заезды и ограничения

| Заезд | Наблюдение | Оценка |
|---|---|---|
| `airun-02e135f864d944888b3e40e5c5877182` | Bamboo, смещение0.994м, max tilt35.02° | Не принят: опасный наклон |
| `airun-7bd0bb24a42d400e83d291369ea32887` | Bamboo, память препятствий, остановка у старта | Не принят: путь не найден |
| `airun-cbb037ed6de44df0b87ec9874c120232` | Bamboo, смещение0.0085м, max tilt7.51° | Не принят: застревание |
| `airun-06e86d64d53245f6a3d9e14f706c6be5` | Forest, практически нулевое смещение, max tilt17.07° | Не принят: нет наблюдаемого прохода |
| `airun-0862bb2a6a9a4651a6bdf8a1d36e85d9` | Bamboo, прямоугольный фильтр, старт[0.95,0.3] | Не принят: путь не найден после3попыток |
| `airun-2ecadc20d2fe40e2ac1a31efc3559154` | Bamboo, старт[3.65,2.5], цель[5,2.5] | Не принят: путь не найден |
| `airun-457b2564987a41428108f8449b342dbc` | Bamboo, исправление уклонов; смещение0.44мм, max tilt13.62°,34.5с | Не принят:35решений obstacle,117no-road,12stuck |
| `airun-09859bf380b74119ba4afdf30798e0e3` | Forest, старт[-1.5,1], смещение9.86мм, max tilt8.68°,34.5с | Не принят:74obstacle,56no-road,12stuck |

Ровная площадка сама по себе не доказывает возможность выехать метровым корпусом:
на последнем старте range видит близкое превышение0.17–0.22м у переднего правого
угла и боковую геометрию. Проверки коллизий не ослаблялись. Scale остаётся1,
внешняя метрическая опора скана пока отсутствует. Collision proxy не разделяет
твёрдый рельеф и мягкую растительность. Новая точка старта выбиралась только
при подготовке сценария; inference не получает mesh или авторскую карту.

Текущий профиль не имеет глобального поиска пути, готового возврата задним ходом,
приёмки обрывов/неизвестной опоры и динамических людей/животных. Десять успешных
повторных маршрутов не получены. Нужна подготовка физически проходимого участка
и полноценное поведение восстановления; добавление моделей само по себе эти
два ограничения не решает.

## Версия и доказательства

Установлен release `b3f1e73eb597fba1`,584файла;
identity `b3f1e73eb597fba135f803591561be1f217a112b160699640c5a1b7133d71cab`;
tgz SHA-256 `8f89288cfc8d169f4468cb6c27faabfacb78a511d1f9e7cf8d7e55424ba61382`.
Установка подтверждена штатным Windows installer в06:20:14UTC. Core8000
согласованно перезапущен для загрузки изменённого реестра композиции; health и
регистрация Worker подтверждены перед R10. Предыдущая версия `2fff34f35bba9346`
сохранена для отката.

41backend AI-polygon tests и16launchd/tunnel tests прошли; Ruff для изменённых
файлов прошёл. Согласованная соседняя задача проверила ту же общую frontend-сборку:
architecture4/4,typecheck,unit903/903,production build,diff check — passed.
Здесь тяжёлая сборка повторно не запускалась. Операторская проверка AI-полигона:
шапка/прокрутка, настройка общей композиции, три камеры, fullscreen/Escape и
показ явной причины неуспешного прогона проверены. Настоящий Worker video в
паузе28–29FPS, это не частота inference и не результат движения. После выхода
из fullscreen выбранная камера сохраняется. Перед UI-проверкой: memory pressure1,swap0.

Raw RGB,labels,range,motion,composition,robot-profile и terrain остаются на Worker.
Каждый закрытый эксперимент получает SHA-манифест рядом с raw; время sealing
отделено от исходных UTC/monotonic эксперимента. Частные компактные сводки:
`outputs/ai-polygon-2026-09-22/route-recovery/`.
Отдельный инцидент запуска Core и его восстановление описаны в
[Core launch recovery](2026-09-22-core-launch-recovery.md).

## Отдельная проверка подготовки коллизий

Повтор старого эксперимента SplatTransform с carve снова упал при Building BVH.
Прямой bounded-запуск того же3.4.0 с `--filter-nan` и процессным Node heap12ГБ
построил кандидат за11.125с:4.65млн splats,736тыс треугольников,12.6МБ GLB.
Эти два изменения проверены вместе; отдельная причина сбоя не установлена.
[Штатный carve](https://developer.playcanvas.com/user-manual/splat-transform/collision/)
очищает недоступные внутренние поверхности; он не распознаёт мягкую растительность.

Кандидат НЕ установлен: отдельный физический прогон на старте R10 прошёл только
0.304м до аварийного наклона30.06°. Это не AI-заезд и не улучшение проходимости.
Исходный рабочий collider сохранён. Его замена без проверки контактной геометрии
маскировала бы ограничение скана вместо исправления навигации.

Сравнение Docker06:26:09UTC: сохранены21исходный container ID и конфигурации
(name/image/restart/mounts/memory/GPU/ports),104уникальных image ID из108записей
исходного каталога,9volumes. Отличий и пропавших объектов нет. Проверка не
утверждает неизменность полного Config JSON; перечисленные поля сравнены явно.

## Операторская проверка после восстановления

Прогон `airun-8255c7e50998477b9afaee41746372cb`: Pause через UI подтверждён
Worker; в течение22.344с неизменны simulation time26.566666667с,
physics steps1594,inference count96 и pose. Continue подтверждён; в отсутствие
первого нового решения привод оставался остановлен. Последующий UI Stop дал
`stopped / Движение и inference остановлены.`; active run/marker отсутствуют.
Повторное сравнение Docker06:43:36UTC снова не обнаружило изменений прежних
контейнеров/images/volumes. Core8000 health ok,Worker available;8765 не слушает.

Отчёт Ops с исправлением прежней ложной оценки и Core recovery был записан.
Последующие updates R10/R11 получили transport errors; результат пока не
подтверждён. Точное тело для идемпотентной повторной записи сохранено в private
`outputs/ai-polygon-2026-09-22/route-recovery/pending-ops-report.json`.

После закрытия видео финальная проверка Mac: pressure1,swap4370.88МБ.
Временных локальных test/build/simulation jobs этой задачи не осталось; по
RSS один Core8000 около539МБ, браузерный renderer около276МБ. Причина роста
swap не установлена; рядом появилась пользовательская Chrome-сессия, но это
не доказательство причинности. Смежная задача предупреждена перед своей
следующей сборкой. Системные лимиты и приложения пользователя не менялись.
Финальный Ops read также получил timeout60с; повторная запись не подтверждена.

## R12: observed reverse recovery and coordinate fault (07:12 UTC onward)

Release `63d59fd270b2a252` added signed virtual motion, CMU two-way driving with
reverse body-orientation clearance, and a bounded retreat/replan policy inside
the existing composition constructor. Retreat requires fresh range support over
the full swept width. A separate rear mount adds 660 first-hit rays; the chassis
continues to occlude rays. Route progress now uses improvement toward the target,
so backing away cannot replenish the retry budget. Core enforces the speed limit
by magnitude in both directions. Local targeted suite: 48 passed.

The new navigation image is
`sha256:1dd68dfb3fa6bf4148fec4f1caabb204e8ec39382c6dee60ac806378f553c9c7`,
separate tag `ndc-ai-polygon-cmu:rectangle-v2`. All 14 Worker navigation cases
passed, including reverse on clear ground and rejection of a rear wall. The
shipped physical chassis and mounted sensors completed a 0.504 m reverse on a
synthetic floor; braking drift was 0.00030 m. These are component qualifications,
not acceptance of a Gaussian-world route.

Bamboo R12 `airun-6c49b967377b4521b64637d462b81edb` remained blocked: 69 obstacle,
77 no-road and 11 terminal stuck decisions. The newly observed rear footprint
contained local height spreads up to 0.262 m, so recovery correctly stayed
inadmissible. This did not establish whether that physical surface matched the
image.

### Confirmed visual/collision registration defect

Inspection of the installed SplatTransform 3.4.0 source map established that PLY
input carries an implicit **Rz(180)** transform (`Transform.PLY`). The old
preparer neither cancelled that transform nor used the correct Z-up to Y-up
basis rotation. Its additional Rx(+90), followed by the runtime GLB conversion,
produced a physical mesh rotated 180 degrees horizontally relative to the USD
Gaussian visual.

A Worker-only single-Gaussian landmark confirmed the defect independently of
perception, navigation, chassis and scene complexity. The raw landmark (1,2,3)
with the configured USD rotation belongs at (-1,-3,-2). The old pipeline produced
(0.9875,3.0125,-2.0125), 6.332 m from its visual position. Cancelling Rz(180) before
the configured scene rotation and using Rx(-90) for glTF produced
(-1.0125,-2.9875,-2.0125), error 0.02165 m with a 0.025 m voxel.

**All earlier real-world route outcomes in this audit used mismatched visual and
collision geometry. They cannot qualify road recognition, visual navigation or
traversability of the visible Forest/Bamboo scene.** Synthetic chassis and CMU
component checks remain separate valid evidence. The prior terrain capability
conclusions are restricted to the physical proxy actually tested, not the
visible road. No additional terrain classifier was installed to conceal this
registration problem.

The versioned `Prepare-Terrain.ps1` now cancels the PLY convention explicitly,
uses the inverse of the runtime glTF basis, and crops in that same basis. Its
changed generator digest invalidates the previous terrain cache. Existing
meshes remain available as historical evidence. A versioned landmark regression
executes the actual preparer rather than merely duplicating its transform math.

### Coordinate correction acceptance and R13/R14

Release `0ad2b4bf9b3dcfa6` (587 files) was installed at 07:31:25 UTC. The actual
preparer's independent landmark test passed: horizontal expected (-1,-3),
measured (-0.990,-2.970), with the production 6 cm voxel. The admitted old caches
were corrected by an exact rigid transform, preserving every vertex and face.
`migrate_terrain_coordinates.py` accepts only the known old generator digest and
the exact rotation [-90,0,180]; its own SHA is pinned inside the preparer.
A synthetic binary GLB regression verifies positions and unchanged topology.

A fresh full-scene BVH build in SplatTransform failed natively with Windows code
3221226505, including a diagnostic retry with optimization disabled. That retry
was not installed. The existing-cache correction avoids this upstream rebuild
for Forest and Bamboo. Fresh imports without an admitted old cache still use
the corrected official converter and may encounter that unresolved upstream
failure. No scene was simplified to avoid the failure.

Bamboo R13 `airun-2645a317563e451e82f29477843a16e3` rejected its rotated initial
footprint before execution. R14 `airun-92bb42f79beb491584ea293a9f65fec2` used an
admitted pose (-1.35,-0.6), heading220°, and the corrected collider SHA
`434c68755d9bb6443eb2081014fb5a2f226947721d4c3ff7c28f046c00c74f9e`.
It started upright (support residual0.03664m) but still failed to make route
progress:135 obstacle,2 replanning,11 stuck decisions; net movement0.0093m,
maximum tilt8.04°. Its initial RGB frame visibly follows the bamboo trail, and
semantic road fraction was0.989. This is not an accepted autonomous route.

The same scene/profile/pose in a separate bounded physical contact test moved
1.189m in20 simulated seconds, maximum tilt14.34°, without a tilt stop. It drifted
in heading and was not a route-following test. This proves some physical motion
is possible from that pose; it does not prove completion of the requested route.
The remaining analysis concerns observed terrain costs and planning, rather
than missing ground classification. All original evidence remains on Worker.


### Short prefixes, observed reserve and command freshness

Release `fd4ffaa8c24983da` admitted a safe 0.5 m CMU path prefix, retaining the
whole rectangular body and command/braking monitor. Seventeen Worker navigation
cases passed, as did separate 12/15 cm step and 40 cm drop rejections. Bamboo R15
`airun-18877f2bce60420886b29a2677b292c3` still failed: eight road decisions followed
by 134 obstacle and 11 stuck decisions, with approximately 8 mm net movement.
The first small motion revealed terrain returns about 0.53 m behind the body,
inside its 5 cm reserve but outside the actual 1 m body. Requiring the complete
reserve clear at time zero incorrectly rejected even departure from these points.

The new filter retains actual body-overlap rejection. For a point already inside
the reserve, every sampled turn/translation must preserve or increase its initial
clearance; all other points retain the full 5 cm reserve. It therefore cannot
permit approach, reverse into that point or sweep a corner through it. Regression
cases cover departure, front obstruction, body overlap and the braking horizon.

R15 also recorded camera-result ages of roughly 0.4 s plus a roughly 0.2 s capture
period. The old 0.5 s source watchdog repeatedly stopped valid motion between
results (57 stale-camera versus 64 applied-command snapshots). The Worker source
budget is now 0.8 s, and the command collision envelope uses the same constant,
plus the existing braking distance and 0.5 s reserve. The independent 0.5 s
completed-command watchdog remains. This is a bounded local latency budget,
not permission to apply an indefinitely stale prediction. Fifty-two focused
local tests passed after these changes. Live route acceptance remains pending.


### R16/R17: remove the processing backlog, retain obstacle authority

Release `878206a9ae0d9467` passed20 CMU scenarios (including reserve departure,
front reserve and body-overlap rejection), three separate hazardous terrain
cases and R15 observation replay. Live R16
`airun-4beae79a310f43889388efb0d08c4c7b` moved0.181m, then stopped while terrain
processing fell behind. Measured cost normalization rose from31ms to540ms as the
local map accumulated roughly7,000 points. This was Worker-local processing,
not operator-network latency.

`terrain_costs.py` now indexes exact radius neighborhoods, rejects mathematically
impossible plane fits early, and bounds a cache of byte-identical neighborhood
fits to16,384 entries. Changed observations invalidate the relevant fit. It does
not store or erase occupancy; CMU remains its owner. Seven retained map snapshots
produced exactly equal normalized costs to the earlier algorithm. The measured
ROS callback fell to87–93ms in the late recorded scene. The new-obstacle cache
invalidation regression and 12/15cm ledge/40cm drop rejection passed.

Release `3bfe8f53075912f6` was installed at08:25:38UTC. Live R17
`airun-43c573ee22174735b1e42edd4c3717f4` removed the sustained stale-frame stops
(3 initial stale versus116 applied-command snapshots in the sampled trace),
but stopped after0.168m:16 road,95 obstacle,10 stuck decisions. CMU selected a
path while the final command's full-speed turning/braking arc was inadmissible.
This exposed the need for bounded speed regulation rather than repeatedly
requesting the same rejected full-speed command. No completed route is claimed.

### R18: regulation removes command rejection, terrain estimate still blocks

Release `b8fd58094d09f501` scales the CMU linear and angular command together,
preserving curvature. A bounded search admits only a speed whose complete body
and braking envelope passes the same monitor. It cannot create a new path or
ignore an obstacle. Twenty native navigation cases and the 12/15 cm ledge and
40 cm drop rejections passed. Progress recognition now admits 0.10 m in eight
seconds, retaining the same bounded recovery budget and jitter rejection.

Bamboo R18 `airun-14f6f5c770bb4a1aad9ef52c76f5dc16` still stopped after 0.212 m.
It ran 37.4 simulation seconds in 37.5 wall seconds; rendered about 13–16 FPS
and inferred about 3–4 Hz. The final source age was 344 ms. These measurements
separate local simulation performance from route completion: real-time execution
was possible, but the autonomous route did not pass.

### September 23: restart, isolated Forest contact and median-ground candidate

Worker was powered down by its owner and resumed on September 23. The scheduled
task was Ready with LastResult 1. Pinned model preflight passed, the existing
scheduled task was started, and Core reported Worker available. The historical
log is insufficient to identify the boot failure; it does not establish Docker
startup as the cause. Release `6974a7ef7a8d5d14`, installed at 05:02:31 UTC, adds
top-level coordinator exception logging and persisted native startup phases.
It changes no navigation model, wheel or terrain parameter.

Corrected Forest R19 `airun-7e504cc926d346a4adcfee17756e1ddb` never finished
startup. R20 `airun-7f4448035d0f4a60918d73d41def5acf` isolated the stall to
`initial-render-and-contact`. Native physics views, the stream and 2,142,439
Gaussians had initialized. A physics-only replay of the exact 1,347,252-triangle
collider also exceeded 100 seconds without completing. Both were bounded and
their owned process trees were terminated. No Forest AI route was run.

An isolated test enabled NVIDIA's official
[convex cylinder approximation](https://docs.omniverse.nvidia.com/kit/docs/omni_physics/110.0/dev_guide/rigid_bodies_articulations/collision.html).
The same Forest physics-only replay then completed: 12 simulation seconds in
4.92 measured stepping seconds, 80.03 seconds including process startup/shutdown.
It moved 0.734 m and stopped at the existing 30-degree tilt guard. This diagnoses
the contact representation and demonstrates bounded physical motion, not a
successful AI route. Wheel dimensions, terrain and tilt limits were unchanged.

R18 observations also exposed the ground-reference issue: CMU's 0.15 height
quantile in its 0.6 m neighbourhood can classify the upper side of shallow scan
depressions as a >10 cm obstacle. A candidate uses CMU's existing `quantileZ=0.5`
parameter, retaining absolute drop costs. On the same first 60 retained R18
observations, old processing produced 33 no-path results and 24 positive speeds;
the candidate produced 60 positive speeds and no no-path results. Replay does
not predict the subsequent changed live trajectory. Hazard, physical capability
and live-route acceptance must pass before this is an accepted deployment.

The median candidate `0795e3aa7f9d3a14` was rejected: 22 of 23 navigation cases
passed, but wall returns contaminated the reference ground in the 1.3 m corridor
and prevented motion. All three hazardous height boundaries still stopped the
rover. The candidate was not installed. The next candidate restores upstream
CMU `quantileZ=0.25`; its own full qualification and replay are separate.

The shared convex-wheel profile passed independent native physical checks:
1.471 m forward in five seconds, 1.63 mm drift over the following two-second
brake; observed reverse reached -0.495 m with 0.272 mm braking drift. Flat ground,
5/10 cm steps and continuous 10/15/20/25-degree grades passed the unchanged
physical capability gates. As before, 15/18 cm steps failed to traverse and
20/25 cm steps exceeded the stability bound. No capability limit was raised.
These are measurements of the declared virtual chassis, not the owner's vehicle.

Candidate `8f3fbe019a3803f8` uses the upstream quantile 0.25 and the same qualified
convex-wheel implementation (SHA
`021c77c002f1eac4451606329df097b19a94bf6b065b4425cf59d3544f1df6de`).
All 23 native navigation scenarios passed, including the corridor that rejected
the median candidate. The same 60-frame R18 replay produced 54 positive speeds,
no no-path results and six valid turning-only commands. Fifty-five focused local
tests and Ruff passed. These component results admit a bounded live test; they
do not establish route completion.

### R21/R22 and short-horizon controller mismatch

Release `8f3fbe019a3803f8` was installed at 05:26:04 UTC. Bamboo R21
`airun-677927b7cd3c4c8eadf7dd0f1b6bfb6c` failed after initial movement of about
0.2 m: 10 road, 106 obstacle and 12 stuck decisions. New observations differ
from the retained R18 replay; replay success did not generalize to live driving.
Forest R22 `airun-1584055d3c2a4a7bb2f315baba8ca1cd` now started and ran in real
time, ending after 33.1 simulation seconds with no useful motion. Its 124 no-road,
16 obstacle and 10 stuck decisions show an additional visual-width admission
problem. The RGB view is a narrow trail between vegetation and trees. Neither
run qualifies a completed route.

Private experiments at quantiles 0.35 and 0.40 failed the 1.3 m corridor and still
produced 25 no-path results in 35 retained R21 observations. They were not
installed. Intermediate native capability lanes at 12 and 14 cm also failed to
traverse. The 10 cm physical limit remains in force; no hazard threshold was
raised to make the scene pass.

Pinned upstream source inspection found `pathRangeStep=0.5`. Lowering only
`minPathRange` to 0.25 or 0.1 therefore skipped the shorter candidate ranges;
both experiments retained the same 25 no-path results. With a 0.1 m decrement
and 0.2 m minimum, all 35 retained observations produced an admissible path or
turn instead. Most late commands were turn-only, not forward-route success.
The follower also used a 0.25 m stop distance against the cropped local path,
which exceeds the new minimum. Candidate `84445a377102a3af` uses 0.08 m for
this local endpoint, retaining the mission's independent arrival tolerance and
the complete source-deadline/braking-envelope monitor. It requires native
regression and a new live run before acceptance.

The fine-prefix candidate passed all 23 scenarios and was installed at
05:40:09 UTC. R23 `airun-5b4752670cba4bc28c0ab1b1476f3df7` was opened paused
and started using the actual Control Station button. The browser displayed the
Worker stream at 28 FPS before AI start. Simulation time remained zero while
paused. The run moved about 0.36 m, then failed after 51.55 simulation seconds:
35 road, 89 obstacle, three replanning, one waiting and 12 stuck decisions.
The initial inference connection errors recovered, but are retained in the run's
`camera/errors.jsonl`. This is not a successful route.

R23's final map contains a blocking return inside the current body at local
(-0.375,-0.282) m, CMU cost0.10237m but only0.06592m above the measured chassis
support plane. All paths are rejected by the initial body-overlap check. An
isolated straight physical run on the same source moved1.069m before reaching
the30-degree tilt stop; blindly driving straight is therefore not accepted.

Candidate `d1e7783920f0928a` reconciles only observed low returns already inside
the current footprint, inset5cm. Its support band is±8cm relative to the declared
contact height and measured orientation, with a25-degree tilt bound. It changes
neither future terrain nor CMU's raw memory; tall returns and drops retain their
costs. The pose must match the terrain message's exact transaction timestamp.
Regression covers leading-edge/future points, wall,12cm step,40cm drop, excessive
tilt, yaw/translation invariance and preservation of the input map. This is an
explicit candidate awaiting native hazard and live-route validation, not a claim
that unseen ground is traversable.

The first underbody candidate passed the 23 hazard scenarios but applied zero
corrections in all 90 replayed observations. Inspection found that CMU converts
the message timestamp through double-precision seconds. Exact integer lookup
therefore missed the matching pose. Candidate `d3b2218217c56943` uses the same
1,000 ns round-trip tolerance already used by the transaction freshness check;
it never falls back to the latest unrelated pose. Its replay must explicitly
prove nonzero correction before native qualification can admit installation.

The corrected-timestamp replay applied51 underbody corrections. Of90 samples,
89 returned an admissible path/turn and one held at the controller; the51 no-path
results from the previous replay disappeared. All23 native navigation scenarios
passed again, including current-body obstruction and the12/15cm step/40cm drop
cases. The focused local suite now contains56 passing tests. These results admit
another live run without increasing the rover's qualified physical limits.

### R24/R25: scene admission, not another planner threshold increase

R24 `airun-92057c35ee3a4d43b27391d007fc51f1` on release
`d3b2218217c56943` removed the repeated no-path obstruction: 32 road, 60
replanning and 12 stuck decisions, but only about 0.158 m net displacement.
Turn commands continued while the measured heading stopped changing on the
scanned surface. This is still a failed route. The added native flat-ground
pivot test measured +0.458 and -0.486 rad in three seconds for commands of
±0.35 rad/s. Both directions work, but both fail the declared >0.5 rad test.
No gain, torque, friction or capability threshold was changed to hide that result.

A private Bamboo candidate moved the start by 2.5 m without changing scale.
Its physical straight test moved 0.679 m in 16 seconds with maximum tilt21.48°.
R25 `airun-bd3ff5c9c78d42948e176e900e357465` then failed without useful AI
motion. The streamed view showed a bamboo trunk beside/through the starting
footprint. Nine ground-height samples had missed the trunk between the rays.
Original operator settings were automatically restored; this candidate was not
accepted as a replacement route.

`spawn_clearance.py` now tests actual triangles against the full metre-square
occupied prism, using separating axes rather than vertices alone. It detects
crossing faces even when every vertex is outside. The check is scene admission
only: it does not change the mesh or feed future ground truth to AI. Synthetic
regressions cover thin trunks, crossing faces, empty AABB corners, admitted
5/10 cm surfaces, 12 cm obstruction, overhead geometry and translated/rotated
sloping ground. On retained real colliders it finds5 intersecting triangles at
the original Bamboo start,21 at Forest and37 at the R25 candidate. The current
preparer fails early for these occupied starts instead of launching a stuck run.

A bounded authoring search around the original starts (±6 m,0.5 m spacing,
24 headings,0.25 m path samples) found no two-metre straight candidate passing
the full-volume check. The longest tested Bamboo prefix was0.5 m; Forest had
isolated starting footprints only. This is not a proof that no curved path
exists anywhere in either world. It establishes that these two automatic
colliders have not supplied an admitted positive driving scenario.

### Prepared paired-source scene and Worker-local storage

The official [Habitat-GS dataset](https://huggingface.co/datasets/RukawaY/gs_scenes)
supplies Gaussian assets together with separate collision meshes and navigation
episodes. Scene62 was downloaded directly to Worker at pinned revision
`ea6453855938dd3d4395c4c449fedefb7e6603b7` under its declared Apache-2.0 license.
No Habitat engine, new model weights, paid service or avatar dependency was
installed. The navmesh was retained as source evidence; it is not supplied to
the inference graph or used to move the rover.

- Gaussian142,307,349bytes: `5429cf3fc6a7ee5088dada65aca4fb6cad73dbaa660f2aec209a43122ea546ae`.
- Original mesh34,840,636bytes: `fdd8ae7d6d45907bbcaded91246f45390ebcb3a5d6c04a72fd16f5ed54ddce54`.
- Derived GLB: `384573b1a7cb805e94124d42f4ed4c4e0d69fca357183803cd57ac4a42753835`.

The conversion retains all original vertices/triangles. Both the supplied Y-up
mesh and the Gaussian visual use the same Rx(+90) conversion to metric Z-up.
Five five-metre authoring candidates passed support and volume checks. The first,
based on supplied episode3, passed an independent native straight drive:
4.67955m over30simulationseconds, maximum tilt6.1906°, no stability stop.
This qualifies physical contact for that start, not AI navigation or the actual
owner's vehicle. Source metric calibration has not been independently surveyed.

The new authenticated `/worker/worlds` endpoint admits metadata from the current
registered Worker instance. `register_paired_scene.py` validates real PLY bytes,
count, both hashes and GLB structure, stages the pair on Worker and publishes
only its descriptor. Repeated registration preserves operator-edited settings;
changed immutable metadata is rejected. Core rejects source-file downloads for
Worker-local worlds, and the Worker refuses a missing/changed local asset rather
than requesting its large payload from the Mac. A paired collision manifest must
match the admitted source, collider and transform. Existing upload worlds and
model compositions remain supported.

Release `cdeff3dc45ac02f2` was installed2026-09-23T06:33:23.8998231Z
(589verifiedfiles; archiveSHA
`34b9b43fbdfaa59c53e35ddd6623ee3fe859e81d8ca90661273055c99ad88ab4`).
Focused source tests passed before installation. Core8000 was updated through
the canonical launch-agent workflow and passed health acceptance. The new world
is `aiworld-bf03be7256514c7a819a6b9dc908ef78`, operator name `Riverside Path`.
R26 is the first camera/AI test of this pair; physical qualification alone does
not make it a completed autonomous route.


### R26/R27: transaction deadline and moving route goal

R26 `airun-a5c7dcd4048b492199e7189d5c4e1fd0` moved on the paired scene,
but failed after83.17simulationseconds. Its26k-point accumulated map took
310–334ms to process; the HTTP observation transaction returned after300ms.
121decisions therefore reported `waiting-for-plan`, perpetually abandoning
each matching map just before it arrived. This was a coordination failure,
not evidence that the road was blocked.

Release `ada7b6ecfc9879bb`, installed2026-09-23T06:50:55.3713014Z, raises
that wait to600ms. The independent800ms camera deadman,500ms command deadman
and full braking envelope are unchanged. A late result cannot be reused.
The first150 R26 decisions yielded149 eligible replay observations:147 without
navigation failure and2 footprint rejections,134 positive-speed commands.
No last30 observation timed out. All23 native navigation scenarios passed.
The public decision now distinguishes waiting for a plan from uncertain vision.

R27 `airun-94c3ba1ad14647708b852c8891bec427` had no `waiting-for-plan`
results. It moved5.645m net,7.752m accumulated, but failed at80.13simulation
seconds: the semantic local goal repeatedly moved ahead after an intermediate
route waypoint had been missed. The route cursor remained at waypoint1.
Movement alone is not route acceptance. The operator stream showed about17FPS;
Worker rendering was roughly15–19FPS, with variable AI cadence.

The next candidate preserves the requested waypoint XY once at least three
nearby semantic/range observations support it within25cm. It verifies the
requested centre and both half-metre lateral edges in the current semantic
image. CMU and the swept collision monitor still own path/command admission.
An unobserved distant waypoint may use a local goal, but a newly selected goal
must reduce remaining task distance. Clear road ahead cannot authorize driving
away from a waypoint behind the rover. Regression tests cover fixed task
coordinates, the observed close-goal blind strip, lost visual support, a missed
waypoint and distant local progress. Thirty focused navigation/mission tests
passed; the native navigation server and physical profile remain byte-identical
to their qualified versions.


R28 `airun-58202c67c5c947d1870f79fdc077bf16` used release
`7a852d7e3e8b45ab` (installed06:55:49 UTC) and failed at97.98simulation
seconds. It exposed a remaining camera-memory defect: an exact, previously
observed route goal left the image around0.95m away, but the old retention
rule only started at0.8m. The goal was replaced by a forward candidate and
then lost. On recorded frame40 the task was0.786m away while its projected
centre was at image y711 (600-pixel height); frame50 returned no goal at0.456m.
This was not proof of a physical obstacle or successful route completion.

Candidate `020cf047a3872217` uses the measured camera projection for this blind
strip. It retains only an exact, previously observed task goal, within the
existing3.5m horizon and while current forward semantic support remains. Any
visible part classified non-drivable invalidates retention. Every command still
passes live CMU terrain and swept-body checks. The replay of the first50 R28
observations now retains the exact task goal on frame50; removing current
semantic support still returns no goal. Thirty focused mission/navigation tests
passed again. Worker evidence is `qualification-observed-route-goal/result.json`.


### R29: first accepted end-to-end route, with a latency limitation

Release `020cf047a3872217` was installed2026-09-23T07:01:15.5693574Z;
589files verified, archive SHA
`38f806b1f2dfb226ac9b79faf8d63ae984c305c712c1d785481d47b56ac458b4`.
R29 `airun-1aa8d69367224be6b67eb6bfbe482c9d` reached all three Riverside
waypoints in order and completed with `goal-reached`, not the duration limit.
There were156 road decisions and11 latched goal-reached decisions, no recovery
attempts. Accumulated travel4.7047m, net displacement4.6249m; goal latched at61.7s,
last physics report63.9667s. Final centre distance0.3672m is within the unchanged
0.4m arrival radius. All sampled applied commands after goal were zero; final
measured speed0.00198m/s. Maximum chassis tilt6.158°.

This establishes one working closed-loop, five-metre authored route on the
paired scene. The streamed view is a park with paved paths, grass, trees and a
bench; it is not dirt-road/off-road acceptance. Source metric scale has not
been independently surveyed, and Forest/Bamboo remain unqualified. No dynamic
person/animal scenarios have been accepted. No real vehicle or VESC was driven.

Operator video was visually verified at15–17FPS; median Worker rendering16.85FPS,
median telemetry AI cadence2.245decisions/s. The camera deadman held motion in
109 of216 sampled reports. Median reported age of the latest completed frame
was859ms (max1625ms); stale commands were stopped, not admitted. Thus the route
is functional but sustained smooth real-time motion is not yet accepted.
Per moving decision: CMU median304.5ms/p95515ms, RF-DETR63/141ms,
SegFormer47/141ms (the two vision models run in parallel), full inference414/625ms,
pre-inference wait94/203ms. Raw detailed timing and stop samples remain on Worker.

The exact models continue through the shared composition graph. No new weights,
paid services or Mac-side simulation were used. The native hazard qualification
remains23/23 on the byte-identical navigation server and physical profile;
there are30 focused passing tests for the changed mission/goal behavior.


A bounded CPU replay profiled130 accumulated maps (last28,258points).
Terrain normalization consumed27.124s cumulatively under profiling. Pairwise
NumPy norms consumed9.035s cumulatively. A private candidate replaces the
N×N×2 distance temporary with separate X/Y differences and the same
sum-and-square-root arithmetic. It changes no radius, step, slope, memory,
command or deadline threshold. The candidate is not admitted until comparison
of the complete normalized arrays and correction counts on the same live-source
maps agrees and the native hazard scenarios pass.


The paired A/B replay compared130 complete normalized maps and correction counts:
all were exactly equal. On the last40 dense maps, median old340.253ms versus
candidate156.618ms; maximum456.917ms versus191.607ms. Comparison uses the same
container, observations, source ordering and cache policy. Candidate moved to
source only after this equivalence check;20 navigation regressions then passed.
Evidence: `qualification-route-latency/comparison.json` and both replay journals.


### R30: installed optimization and final acceptance

All23 native hazard scenarios passed with the optimized source. Release
`0d4c0a73bbbe2066` was installed2026-09-23T07:34:31.4941743Z after589-file
verification; archiveSHA
`ea485c2b292b84bfd8f6bbf5aa0ead501915ac4d7fa352b803a72f8ad8d9a80f`.
R30 `airun-e15bae285fdf493e9c0507e4692c5628` reached all three waypoints
without recovery.122road decisions and11 latched goal-reached decisions.
Travel4.67475m, net4.67162m, final target distance0.3182m (arrival radius0.4m).
The goal observation was captured at30.5167simulationseconds; completion was
reported at32.6667s after the settling interval. First telemetry with zero applied
speed arrived62ms after the goal decision completed. All sampled commands after
that completion plus100ms were zero; final measured speed0.00145m/s. An earlier
telemetry sample still contains the preceding command while the goal observation
is in inference, so capture time must not be called actuation/latch time.
Maximum tilt6.1195°.

Full inference median234ms/p95359ms/max391ms. CMU140/234/266ms;
RF-DETR62/141/188ms; SegFormer47/141/172ms. Median pre-inference wait94ms.
Median latest-result frame age531ms, max875ms. The unchanged camera deadman held
3 of110 sampled telemetry reports (R29:109/216). Median Worker rendering16.54FPS,
AI3.774decisions/s. The operator receives video and compact state only; no heavy
source or sensor map is transmitted to drive this loop. Real-world end-to-end
network latency is not inferred from these Worker-local timing figures.

Core8000 health and registered Worker availability passed after completion,
with no active run. Docker baseline comparison at2026-09-23T07:37:12Z found
all21 original containers,104 image identities and9 volumes present; no changes
to compared names/images/restart policies/mounts/memory/GPU/port configurations.
No temporary qualification containers or owned realtime episode processes
remained. The temporary QA browser tab was closed; the canonical Core service
remained running. No git stage, commit or push was performed.

Remaining acceptance scope: correct admitted starts/geometry for Forest and
Bamboo, actual dirt/natural terrain routes, dynamic participants, and calibration
against the owner's physical rover. This positive park route and23 synthetic
navigation cases do not establish arbitrary off-road autonomy. The separate
flat-ground pivot threshold test remains failed as recorded above; it was not
silently relaxed by the performance change.

Ops reporting could not be updated in this continuation: agent instructions
were available, but two direct project-list calls timed out after60s. No card was
marked complete; this audit retains the full evidence and limitations locally.


Closed-evidence index:40 sessions,8,243files,1,158,280,493bytes on Worker.
`state/continuation-evidence-index-20260923.json` SHA-256
`2a2a438646656db920cb44e890ceaa2591241d289659c1c2324fd9e173be0464`.
Each session manifest records UTC/monotonic sealing time and raw-file hashes;
sealing time is explicitly distinct from experiment acquisition time. Raw
images, maps, logs and original assets remain private on Worker.