NODEDC_MISSION_CORE/docs/audits/2026-09-11-planning-live-profile.md

# LAB planning profile — 2026-09-11

Owner decision: move the research planner to LAB, remove the decorative vehicle
step, and make Testing lead through the existing K1 connection/naming/start
workflow into a planning-specific spatial scene. The ordinary recorded-pair
comparison remains a separate action. This is an operator diagnostic instrument,
not a mission executor or a new root/navigation system.

## Operator workflow

1. LAB → Planner; open a saved reference draft. A remains immutable. Select the
   reference interval in trajectory metres and its travel direction; save.
2. Testing prepares the reference once and opens the canonical Window containing
   the existing DeviceWorkspace/K1 connection flow. The server owns the frozen
   draft/revision; its planning profile survives navigation and browser reload.
3. Create a **new K1 project** and a separate capture B at the physical entry of
   the chosen reference interval. Press the existing acquisition/connect action.
   Its existing host callback opens Spatial Scene with the planning profile.
4. Walk 20–30 m once, approximately the same scanner height and direction. Initial
   position is the operator's entry hypothesis; first ≥3 m displacement supplies
   yaw. It is not global place recognition or a guarantee of arbitrary-start
   recovery. A remains separate from B; no LAS or Gaussian processing is needed.
5. Gray shows reference geometry. New query geometry uses a blue-to-magenta
   height palette. Only accepted per-point nearest-reference distances ≤0.5 m
   become green. GICP candidate rejection gates remain fixed v1. Live green is
   removed after 8 s sample age, stopped input, changed identity, or termination.
6. Device and recording controls retain the existing K1 stop/finalization path.
   Finishing the *research* only releases its derived-data lease; it cannot stop
   capture or a vehicle. The last completed calculation is retained for review.

## Architecture and resource bounds

- `sessions/live_planning.py` is the normalized read-only input contract. K1's
  `planning_live.py` adapts its **existing committed-evidence ingress**; no second
  MQTT receiver, device command, network scan, or raw-capture owner is introduced.
  Both verified current and legacy protocol decoders are reused. Published K1
  map-space points are not transformed by pose a second time.
- Planning occupies the existing exclusive derived-data consumer lease. An AI
  worker already owning it yields an explicit busy response; neither profile
  silently steals the other's lease. No inference service is started or stopped.
- `missions/live_tests.py` captures baseline generation while idle, requires a
  new session ID/generation, rejects reuse of A/prior capture, and fences every
  sample/result. A changed producer session terminates the research. Independent
  project/SLAM reset remains an operator requirement (`slam_reset_verified=false`).
- Reference preparation uses existing immutable source validation and submap
  extraction (≤40 m, ≤100,000 points, ≤90 s). Native GICP uses the same isolated
  short-lived worker and one shared compute lock as offline comparison.
- Live preview samples at most 2 cloud frames/s, requires a preceding pose no
  older than 0.5 s, crops within 20 m and relative height −3…+6 m, voxelizes at
  0.25 m, retains 40 frames × ≤4,000 points, then bounds the fit to 40,000 points.
  Original recording is unaffected by preview thinning or queue overflow.
- Fit requests are at least 5 s apart, one active numerical child, 30 s deadline.
  Capture ingestion continues while fitting; no future query frames enter a job.
  Research is capped at 40 m or 300 s after session admission, waiting at 30 min.
  Local synthetic checks are bounded functionality tests, **not load tests** or
  board resource acceptance.
- Rerun uses one isolated viewer/channel. Static reference is sent once;
  subsequent entity updates replace the query without resetting the camera.
  Expand/restore and unmount dispose the isolated WASM realm.
- Private `data_dir/missions/live-tests/<UUID>` contains frozen draft, reference,
  per-step NPZ numerical inputs, result JSON, source sequences/host receipt clocks,
  query path and artifact SHA-256. Ingress before/after counters are retained.
  `active.json` supports refresh; interrupted runs are marked on server restart,
  never silently rebound. Raw B remains in the ordinary observation catalog.
- Pre-existing immutable offline RRDs are not rewritten. Their legend explicitly
  identifies the old all-query green format; new reports carry versioned
  per-correspondence coloring.

## Validation and limits

23 focused Python tests (live profile, registration, planner) pass: causal pose
window, bounded thinning, per-point green, no green on rejection, existing ingress
adapter, exclusive profile lease, fresh identity, frozen draft revision, stale
producer rejection, cancellation/release, persisted report, native Rerun stream,
known rigid transform recovery and negative registration cases. Frontend planner
and architecture tests pass; typecheck/build pass. Browser on canonical 8000:
LAB placement, absence of Vehicle step, saved 30 m draft, Testing modal, preparation
of real A without capture, gray reference in native Rerun, profile retained across
navigation. Final production build `app-C4fpKRYf.js` is served on canonical
`127.0.0.1:8000`; 15 frontend checks pass. The browser trial was cancelled with
`query_session_id=null`, then the managed local server was restarted and checked.
No K1 connection, capture or stream command was issued during this acceptance.
Mission Core Ops cards 81 and 79 contain the updated workflow and open hardware
acceptance items; both updates were independently read back.

Independent B and live hardware acceptance are **not yet performed**. No claim of
navigation accuracy, a 20 m start radius, robust global relocalization, obstacle
avoidance, or adequate Mac mini compute follows from these checks. The next useful
result is B from a new project, followed by analysis of accepted/rejected windows,
receipt gaps and wrong-location controls. The entry hypothesis can mislead in
repeated geometry; green is geometric consistency, never autonomous authority.