1 oracle.pipelines

oracle.pipelines

Operational pipelines that generate Oracle-supervised datasets.

This package provides offline/online VIN labeling, rollout-store construction, sharded campaigns, and verified online QH bundle adaptation. These pipelines compose lower-level candidate generation, rendering, RRI, replay, and storage owners without moving those contracts into dashboards or storage codecs.

1.1 Package guide

aria_nbv.oracle.pipelines composes data access, candidate generation, privileged scoring, replay, and immutable persistence. It does not redefine the lower-level storage, target, RRI, or scorer contracts.

1.2 Finish or pause a collection

After publishing an increment or stopping an interrupted collection, refresh its metadata inventory with nbv-stores-info --root-store ROOT_FRAGMENT --rollout-store COMPLETED_SHARD --output RUN_DIRECTORY/store_inventory.json. Repeat exact-store flags for all published fragments/shards, confirm the new paths are visible, and retain unavailable entries and prior completed stores. Exact-path refresh avoids a recursive all-data scan. Keep this derived snapshot with run receipts; store and training validation remain separate. The dataset store overview owns the shared CLI/Streamlit workflow. Writers continue to publish immutable stores and receipts.

1.3 Command-Line Workflows

1.3.1 Measured Mac work selection

The Mac supervisor accepts an optional [selector] section alongside its absolute runtime/resource configuration:

[selector]
root_plan_path = "/absolute/root-campaign/root-plan.json"
owner_host = "mac-host-name"
rollout_queue_paths = ["/absolute/admitted-queue/queue.json"]
admitted_queue_inventory_path = "/absolute/fleet/admitted-queues.json"
refill_below_hours = 2
stop_refill_at_hours = 8
minimum_cycle_samples = 2

The required supervisor queue_path is the primary queue and must also appear in rollout_queue_paths. It owns the fleet-wide operator pause. All queues and the root plan retain the same frozen host order and exact owner; an offline endpoint never transfers its assignments. The supervisor holds one exclusive lock and launches one heavy worker. Root work is bounded to one fragment; rollouts retain bounded tranches. Every restart reconciles the canonical runner/queue locks before launch and preserves refill hysteresis.

Supply counts only admitted, previously unscheduled source roots. Each terminal target attempt and the roster’s prior selection consume that first-pass supply, including exclusions. Hours equal that backlog times the observed mean complete rollout-cycle duration, including setup/admission/validation. Missing full-cycle support produces a one-unit rollout bootstrap and null hours. The observed duration range is descriptive, with no calibrated prediction interval. These watermarks control work queues; counts never qualify scientific pooling.

New root fragments need canonical source-manifest and target-roster admission, then their own immutable frozen queue. To make them visible to an already running supervisor, atomically publish the optional inventory:

{
  "owner_host": "mac-host-name",
  "root_plan_hash": "exact-frozen-root-plan-hash",
  "queue_paths": ["/absolute/admitted-queue/queue.json", "/absolute/new-admitted-queue/queue.json"]
}

The inventory retains configured queues and adds only source-disjoint admitted queues with the same generation profile. Missing inventory/queue endpoints and live locks report a blocked, incomplete inventory with null hours. Without an inventory pointer, the explicit list changes on supervisor restart. Generated fragments alone never increase qualified supply.

Run python -m aria_nbv.oracle.pipelines.mac_generation_supervisor status /absolute/supervisor.toml for the selected work, reason, backlog, measured support, observed range and freshness timestamp. pause and resume persist explicit controls without launching work; use run or reload the supervised launcher after an operator/resource pause. Active workers stop at their existing publication boundary, and resume reconciles completed evidence. AC return may resume a power pause; operator/resource pauses survive it. Existing disk, staging and commissioned memory guards apply to either worker type. This configuration is not evidence of live commissioning or numerical qualification.

Pause persists the primary/root requests before checking extra endpoints and reports unavailable paths. Resume skips queues already running or not started. A failed lifecycle or terminal execution failure stops fleet selection; a queue’s output quota excludes that queue while other admitted work remains selectable.

Focused proof: tests/oracle/pipelines/test_fleet_selector.py, test_mac_generation_supervisor.py, test_root_fragments.py and test_recipe_queue.py.

Run from aria_nbv/:

Command	Purpose
`nbv-build-offline`	Build immutable scene-labelled VIN rows or actor-only rollout roots.
`nbv-build-rollouts`	Generate one rollout store or one planned shard.
`nbv-plan-rollout-shards`	Bind ordered source rows into a shard manifest.
`nbv-plan-rollout-source`	Build a source-population manifest.
`nbv-status-rollout-shards`	Validate and summarize shard completion.
`nbv-rollout-campaign`	Run a bounded resumable rollout campaign.

Campaign smoke is a canonical single-work-unit guard for the deterministic first planned unit. It is not evidence that a multi-scene or replicated smoke population completed; population-level admission remains a separate WP18 responsibility.

Always validate configuration before generation:

uv run nbv-build-offline \
  --config-path ../.configs/build_vin_offline_81286.toml \
  --dry-run
uv run nbv-build-rollouts \
  --config-path ../.configs/smoke/build_rollouts_v1_smoke.toml \
  --dry-run

For rollout roots, set VinOfflineWriterConfig.preparation_mode="actor_only". This explicit V11 capability retains actor inputs, configured EVL evidence, target boxes and trajectories while skipping scene candidate rendering and RRI labels. The default scene_labelled mode remains V10. Actor-only stores support rollout generation and named QH actor joins; one-step VIN training and scene-RRI inspection require scene-labelled roots. See the VIN storage guide. The bounded example is .configs/build_vin_actor_roots.toml; validate it with nbv-build-offline --config-path ../.configs/build_vin_actor_roots.toml --dry-run from aria_nbv/ before selecting new source keys and output paths.

Grow a root collection by creating new immutable store fragments. Do not append to a finalized root store: existing rollout source references bind its manifest hash. Interrupted root preparation may finalize its completed rows, but is not an append/resume protocol. Plan the remaining raw snippets into a new fragment.

The same campaign preflight command can materialize the no-render, no-reward-label Phase-A candidate-family proposal-support audit with privileged GT target instruction and mesh validity. It does not construct an oracle scorer, renderer, replay policy, or reward label, but it is not oracle-free because target instruction and physical validity remain privileged:

uv run nbv-rollout-campaign preflight \
  --config-path ../.configs/build_rollouts_v2_cuda_campaign.toml \
  --source-store /path/to/vin_offline_rollout_campaign100_v10_rebuilt \
  --family-phase-a-output ../docs/contents/evidence/candidate_family_phase_a_wp02.json

The explicit source path is local acquisition only. Before evaluating any row, the command plans the source store through the canonical dataset owner and requires its native manifest, cache version, split identity, and ordered rows to match the reviewed manifest exactly. The emitted compact JSON binds those actual source identities, the manifest bytes, complete writer configuration, clean generation revision, CUDA/PyTorch/PyTorch3D/GPU runtime, every full candidate shell, and the canonical family gate. The dedicated reader verifies all bindings, the content hash, the complete reducer policy, and a fresh reduction before exposing the DTO. A failed gate is still written and exits with status 2. Broad rollout generation stays blocked until the separately versioned WP18 admission artifact exists.

The current 100-scene control completed with a machine-readable no-go. Its canonical artifact and figures live in the rollout evidence directory: all source rows were evaluated, but applicable-family collapse and low support remain. A no-go command writes the complete artifact and exits with status 2; it completes issue #54’s fail-closed mechanism/evidence checklist while remaining evidence for later sampler retuning, not campaign admission.

1.4 Composition Boundaries

Module	Responsibility
`offline_vin`	Stream raw snippets, prepare expensive evidence, and write VIN rows.
`rollout_dataset`	Compose target tasks, candidates, oracle scoring, replay, and store writes.
`scene_labels`	Generate scene-level labels over finite candidate tables.
`evaluated_rollout`	Bind replay transitions to retained oracle evaluation.
`shards`	Plan and atomically promote independent generation shards.
`campaign`	Resume bounded local/CUDA campaign work with explicit receipts.
`online_vin`	Live one-step oracle dataset for the historical control.
`online_qh`	Verify an immutable QH bundle and adapt hard-valid values to replay `CandidateScores`.

online_qh fails closed on actor, learning, target, candidate-generator, action-mask, representation, geometry, or trained-horizon mismatches. It does not rank by P(valid) * Q; the authoritative hard mask defines deployable support.

1.5 Verification

cd aria_nbv
uv run ruff check aria_nbv/oracle/pipelines
uv run pytest tests/rollouts/test_cli_typer.py
uv run pytest tests/oracle/test_online_qh.py
uv run nbv-build-rollouts \
  --config-path ../.configs/smoke/build_rollouts_v1_smoke.toml \
  --dry-run

Use the data-handling guide for source/store preparation and the rollout guide for persisted validation and inspection.

1.6 Independent endpoint audits

Enable RolloutDatasetWriterConfig.endpoint_audit_enabled for the captured audit subset. The writer independently prepares and measures the root and final selected-observation history through TargetRriScorer.measure_endpoint_pair, then writes endpoint sidecars after store creation. This is opt-in because full prepared clouds add retention and measurement cost. Audit failures block that store; missing measurements are never substituted with zero gain. Numerical repeatability alone does not establish metric sensitivity, physical-camera correctness, or suitability as a training objective.

1.7 Local recipe diagnostics

recipe_experiment schedules a predeclared parameter-only comparison through shards.run_rollout_shard. It deliberately does not modify the reviewed CudaRolloutCampaignConfig profile/temperature contract or grant corpus admission. Each named arm points to a canonical RolloutDatasetWriterConfig TOML; scientific profile and proposal replica are separate identities.

From aria_nbv/, use the shared environment with this checkout on the import path:

python -m aria_nbv.oracle.pipelines.recipe_experiment freeze /absolute/experiment.toml
python -m aria_nbv.oracle.pipelines.recipe_experiment run /absolute/output/plan.json
# After acquisition, without changing the frozen generation source:
python -m aria_nbv.oracle.pipelines.recipe_experiment_report /absolute/output/plan.json /absolute/report.json

The experiment config supplies timezone-aware deadline, measured conservative block time/bytes, disk reserve, output cap, worker timeout and maximum matched source blocks. Planning rejects mismatched source populations, measurement or Oracle task-selection contracts, multiple factual branches, and acquisition caps above sixteen. It binds the clean source revision and writer bytes; resume rejects changed identities and validates successful shard sidecars. Expected support rejection remains an observed outcome. Execution failure finishes the current attempted block but prevents starting later blocks. An interrupted worker’s staging is quarantined before a retry, and final stores are reused only through canonical validation.

recipe_experiment_report owns plan/shard acquisition and provenance checks; rollouts.inspection.recipe_experiment owns finite prefix projection and scene-first paired reduction. Missing endpoints stay unavailable. Cumulative prefix returns are collection diagnostics, not independent endpoint measurement, proof of useful prediction horizon, or recipe promotion. Independent prepared root/final measurement and the broader admission gates remain required.

For a resumable, disk-bounded single-profile stream, recipe_queue freezes a G60 writer and an admitted target-roster receipt, then visits only eligible development scenes. Its first pass visits the 61 eligible roots not yet used in the current matrix before the 16 previously sampled roots. It increments sampler and proposal seeds after each full scene pass, while preserving the 20 reserved confirmation scenes and 3 excluded roots. Each rollout is still frozen and executed by recipe_experiment; the queue adds no wall-clock campaign deadline. Its output quota and free-space reserve are the normal stop conditions, while a per-rollout watchdog and typed genuine execution failures remain safety stops.

python -m aria_nbv.oracle.pipelines.recipe_queue freeze /absolute/queue.toml
python -m aria_nbv.oracle.pipelines.recipe_queue run /absolute/output/queue.json
# These append control events; pausing takes effect at a rollout boundary.
python -m aria_nbv.oracle.pipelines.recipe_queue pause /absolute/output/queue.json
python -m aria_nbv.oracle.pipelines.recipe_queue resume /absolute/output/queue.json

queue.json and its source receipt bind the population and generation code; ledger.jsonl records each terminal rollout. Pause and resume append to controls.jsonl. Completed stores, receipts, and logs are retained. A quota stop is terminal for that queue identity; further storage requires a new explicitly frozen queue rather than rewriting the old quota or its evidence. The free-space reserve stop is resumable after disk space is available again. pause records a boundary request and prints whether the request is merely persisted or the scheduler has already acknowledged a quiescent paused state. Repeating pause is a readback of that acknowledgement; it does not interrupt or wait for the current rollout. SIGINT/SIGTERM/SIGHUP stop at the current worker boundary and leave that unit resumable. A genuine execution failure remains terminal for the queue and requires diagnosis before any new queue is frozen.

1.7.1 Target-roster geometry parity

The no-render target-roster preflight binds each paired source row to the same physical root, target row identity, target center and full extents, world object pose and reference object pose. V2 receipt validation checks arm agreement and selected-row audit consistency independently of the JSON seal. Raw root poses must reproduce their hashes, and standoff must equal the target-to-camera distance. Balanced comparison admission accepts only v2 receipts; separately versioned singleton engineering receipts support same-arm commissioning. require_admitted=False permits diagnostic inspection of blocked receipts; proposals never admit. Historical v1 JSON stays sealed evidence and requires a new preflight for current admission.

1.7.2 Matched candidate-renderer validation

RecipeExperimentConfig.rendering_contrast=true opts into a strict render-only contrast. Within each paired replica, the source, target sampler, candidate mixture, selection policy and seed, candidate cap, score margin, resolution, stride and fusion settings must agree. Only target_scorer.candidate_render_crop may differ scientifically. renderer_validation_output and store.store_dir are the two declared operational destination differences. The frozen plan retains complete original writer/scorer/task contracts and seals their exact delta; ordinary and historical experiment validation remains unchanged. Historical R0/cropR1 additionally changed the target-sampler and policy seeds from 20261001 to 20261004 and proposal replica from 0 to 1. That collection-policy contrast cannot isolate candidate cropping. A same-pose measurement compares rendering for fixed realized inputs; a collection-policy contrast also changes which inputs are selected. Use the existing rendering_contrast contract for a new matched crop contrast; historical evidence retains its original scope.

Set RolloutDatasetWriterConfig.renderer_validation_output to a fresh capture root to enable actual single-chain traces. A reviewed source manifest and clean current acquisition revision are required. Capture hooks record the actual scoring raster until selection, then retain only the selected low-resolution depth, mask, calibration and full-scene world points. The adapter resolves these observations before future state preparation and at final materialization. The capture records complete shell/label/probability tables, actual prepared states, original mesh/content identity and conservative retained-face provenance. Selected high-resolution storage follows its existing independent route.

renderer_validation.read_renderer_validation accepts a relocated hydrated manifest and independently supplied frozen identity. It checks payload hashes, action/shell/camera joins, actual causal point history and terminal coverage; missing sidecars are explicit and cannot qualify. compare_renderer_traces checks actual actions, ranks/ties, history and labels/probabilities (absolute ≤1e-6). Prefixes remain repeated observations within a scene, with scene-first aggregation owned by the existing recipe reducer. A matching projected config never substitutes for measured numerical equality.

Scorer phases, actual selected acquisition, selected high-resolution rendering, endpoint measurement and store/endpoint-receipt writing are recorded separately from capture serialization. The existing outcome receipt remains authoritative for full worker elapsed time: summed instrumented phases omit uninstrumented setup/selection/validation and are not a replacement total. Missing or disabled phases remain unavailable. Capture observers are disabled by default and do not constitute data admission or a speed/equivalence claim. Acquire both arms on one updated canonical revision; preserve earlier experiments as historical evidence.

A writer fragment enables capture in both arms. The crop table belongs only in the cropped arm; keep the rest of both writer files identical except their recorded store/capture destinations:

renderer_validation_output = "/absolute/experiment/captures/cropped"

[target_scorer]
include_scene_rri = false

[target_scorer.candidate_render_crop]
extra_halo_m = 0.0
face_chunk_size = 200000

In the existing experiment TOML, declare rendering_contrast = true and a [[contrasts]] entry with baseline = "full", challenger = "cropped". Freeze one single-chain writer per arm/replica with the same selector seed in both members of each pair. The capture constructor writes frozen-identity.json from source/target/config/mesh checks before scoring; preserve and seal that file independently of the terminal validation manifest.

nbv-build-rollouts --config-path full.toml --dry-run
nbv-build-rollouts --config-path cropped.toml --dry-run
python -m aria_nbv.oracle.pipelines.recipe_experiment freeze renderer-screen.toml
python -m aria_nbv.oracle.pipelines.recipe_experiment run /absolute/experiment/plan.json
python -m aria_nbv.oracle.pipelines.renderer_validation compare \
  hydrated/full/renderer-validation.json hydrated/cropped/renderer-validation.json \
  --baseline-identity frozen/full-identity.json \
  --cropped-identity frozen/cropped-identity.json

The comparison command is read-only and returns success only for the declared full-versus-cropped contrast with completed intended horizons and qualifying actual evidence. Matching early-stop prefixes are reported descriptively and cannot qualify a missing H16 endpoint. Legitimate scored-but-unselected terminal tables remain explicitly auditable. The supported interface and CPU checks do not establish the planned real H16 equivalence or speed claim; GPU acquisition and analysis remain required.

The bounded renderer validation capture excludes directed_orbit_only and directed_orbit_plus_bypass: those selectors use geometric selection values instead of the measured Oracle scores validated by this contract. Config and freeze reject these combinations before acquisition. Optional production crop rendering remains supported for directed policies when capture is disabled.

1.7.3 Exact-box scoring

TargetRriScorerConfig.target_crop_policy="gt_obb_oriented_triangle_clip_v2" requires target_crop_margin_m=0. The reference mesh is intersected with all six GT-OBB half spaces: boundary-crossing triangles contribute their in-box surfaces even when every original vertex is outside. No bounding-box caps are created. Reconstructed metric points use the same exact oriented membership and existing recorded fusion order. Candidate labels and independent endpoint audits share this versioned preparation.

The historical any-vertex v1 crop remains the default and retains its semantics. Exact-box data has a distinct measurement identity; do not pool it with v1 labels or rewrite old receipts. Rendering still uses the full scene unless an independently validated rendering option is declared. Rendering visibility halos do not expand this metric target region.

Optional require_current_root_target_support=true retains the uniform GT sampler and restricts its draw to targets meeting min_current_target_points after canonical observed-root preparation. Source-bound pool/count/probability receipts persist for successes and typed exclusions; unavailable inspection is explicit. This changes the admitted sampling population and its lineage.

Optional min_target_aware_root_candidates=3 counts hard-valid proposals from target-bearing, lateral-bypass and orbit center modes together before scoring. It imposes no per-family minimum. Set min_valid_root_candidates=0 to disable the separate total-root threshold. Both new controls remain disabled and omitted from default serialized writer configurations.

1.8 Computational source contrasts

source_contrast_report.read_source_contrast_report admits the narrowly versioned generation-throughput-source-contrast-v1 assignment: three scenes, one seed, H16, crop enabled in both sources, six capture attempts and twelve ordinary attempts in AB/BA blocks. Every independent recipe plan and complete writer is sealed. The existing portable recipe reader admits copied writer bytes; the assignment retains original identities and explicitly binds the approved source diff. It cannot relax E32’s existing twenty-cell full/crop contract.

Enable RecipeExperimentConfig.worker_lifecycle_timing in both sources for outcome-bound parent launch-to-exit timing and synchronized child GPU peak allocation/reservation companions. Capture instrumentation is declared separately. The source reader compares captured causal48px tensors, the common persisted projection (including actual float16 retained240px rasters), independently recomputed endpoints, and same-source capture/production projections. Matching 240px depth does not establish absent48px history. Missing outcomes, captures, endpoints or resource companions remain nonqualifying; statistical steps are not independent samples. Scene-equal paired log ratios and observed baseline-repeat variation support a descriptive engineering decision, not a population claim.

The receipt reader is evidence verification, not historical training reproduction or corpus admission. Its local qualification is only one gate for the separate schema-v2 performance evaluator and mandatory W&B publication/readback.

1.8.1 Fixed-input surface metric correction

surface_correction_replay binds the historical eight-state panel to corrected surface metric measurements on the same prepared inputs. It reuses surface_reference_panel for measurement, triangle parity and decision reductions. Candidate treatments remain paired within each state; maxima and event counts describe this fixed diagnostic panel. The historical sample-count gate is reported independently from execution completion. Neither result grants evaluator or corpus admission.

Freeze a future aware deadline on a clean committed source revision, then use run to execute cases through the existing process-group watchdog. Each child is bounded by its frozen case timeout and the remaining absolute deadline, with 15 seconds reserved for termination cleanup. Source and prepared tensor hashes are checked before replay; changed revisions are rejected. --case-limit selects a pilot prefix and retains all unreached states.

python -m aria_nbv.oracle.pipelines.surface_correction_replay freeze \
  --output /absolute/correction-assignment.json \
  --old-assignment /absolute/historical-assignment.json \
  --old-run /absolute/historical-run --deadline 2026-11-01T12:00:00+01:00
python -m aria_nbv.oracle.pipelines.surface_correction_replay run \
  --assignment /absolute/correction-assignment.json \
  --output-dir /absolute/new-correction-run

seal preserves original JSON bytes in an exclusive portable bundle and prints its manifest SHA-256. Retain that hash independently. Explicit historical paths allow archived evidence to be relocated without consulting stored absolute paths. Cold readback verifies exact retained file support and hashes, recomputes all reached case contrasts, and rejects any inconsistent full aggregate even when its comparison hash has been rebound. It needs no original stores, prepared tensors, historical Git checkout or GPU. Prepared tensor hashes remain captured provenance; readback does not remeasure their contents.

python -m aria_nbv.oracle.pipelines.surface_correction_replay seal \
  --assignment /absolute/correction-assignment.json \
  --output-dir /absolute/correction-run \
  --old-assignment /absolute/historical-assignment.json \
  --old-run /absolute/historical-run --destination /absolute/new-bundle
python -m aria_nbv.oracle.pipelines.surface_correction_replay readback \
  --manifest /relocated/bundle/manifest.json \
  --expected-manifest-sha256 <independently-retained-hash>

1.8.2 Fixed-root renderer primitive diagnostics

aria_nbv/scripts/probe_renderer_equivalence.py captures explicitly requested fixed-root mechanism controls through the existing evaluated source owner. It retains candidate membership, finite-score support, prepared point hashes and paired raster/score observations. It does not alter a collector recipe or admit a corpus. Requested root indices must be unique and nonnegative, and every attempt uses an exclusive new directory. Depth and nested renderer CUDA devices must agree; timings, memory guards and provenance use that resolved ordinal. renderer_validation.compare_renderer_scores and renderer_equivalence_gate own the shared comparison and frozen numerical gates: full-image claims require depth masks and mapped face identity for every recorded repeat; viewing-AABB results remain target-local, and target-only cropping is a negative control. No gate certifies successor acquisition integration.

For an existing immutable renderer-mechanism-evidence-bundle-v1 bundle, retain its manifest SHA independently, then use:

python aria_nbv/scripts/verify_renderer_equivalence_readback.py \
  --bundle /absolute/retained-bundle --manifest-sha256 <retained-sha256> \
  --output /absolute/new-readback.json
python -m aria_nbv.reporting.renderer_probe_figures \
  --bundle /absolute/retained-bundle --manifest-sha256 <retained-sha256> \
  --output /absolute/new-figure-directory

read_captures verifies the complete manifest and all payloads, rejecting noncanonical paths, symlinks and special files. open_verified_capture verifies and consumes a selected primitive through one regular file descriptor; tensor readback uses restricted weights_only=True deserialization. Captures must be immutable during use; this is not a snapshot of concurrently writable data. Cold readback checks retained candidate identity, tensor hashes, finite supported gain algebra and masked selection distributions. Unsupported scores remain missing, not zero. It replays reported repeat criteria; it does not independently remeasure every repeat’s depth/face comparison. Original meshes are required for GT distance kernels, and no complete rollout-equivalence claim follows.

observation_tables preserves attempt/root/arm/timing-repeat identity and records the joined depth_diagnostic_repeat. The full-naive cold reference has no repeat comparison; its warm diagnostics use an explicit index offset. max_abs_score is present only for the saved-last render observation, because scores were not measured for every repeat. Unavailable or unreached roots remain separate. Export filenames retain a deterministic attempt-identity digest so distinct paths cannot silently overwrite one another. render_bundle and its CLI use those same normalized tables and figure producer. Cold/warm repeats are observations within a mechanism root, not independent scenes; exports provide descriptive raw observations, not confidence intervals or campaign-wide efficiency. There is no new Streamlit consumer in this slice. No queue-wide denominator is inferred from root assignments or these capture receipts.

1.8.3 Separate R1 supervision productivity pilot

The executable declarations are .configs/profiles/r1_48_incumbent.toml, r1_48_quota.toml and r1_48_bearing085.toml. Preparation seals their exact bytes and materializes three ordinary writers. Quota changes only allocation 18/18/12/12 to 18/14/12/16; bearing changes only its maximum radius 1.1 m to 0.85 m. The controls retain R1 crop, V10 actual 48³ roots, H16/T1/floor 0 and motion bounds.

Write a local preparation TOML with explicit paths and selected TRAIN keys:

baseline_writer_path = "/absolute/local-reviewed-r1-writer.toml"
output_root = "/absolute/fresh-r1-ablation"
host = "mac_cpu" # use ubuntu_cuda on Ubuntu; mac_mojo requires pinned provider
sample_keys = ["ASE_84320_Atek_000048"]
max_blocks = 1
seeds = [20261012]
free_disk_floor_gib = 250
max_output_gib = 16
unit_timeout_seconds = 1800

Run from a clean, fixed source checkout. The reviewed local baseline supplies root manifest/store, meshes and prepared-source paths; paths are not inferred or silently translated between hosts. Use an equivalent local baseline on the other host and retain its own runtime identity. Preparation reads actual stored occupancy/free grids and rejects declarations without 48³ evidence.

python -m aria_nbv.oracle.pipelines.r1_ablation /absolute/prepare.toml
python -m aria_nbv.oracle.pipelines.recipe_experiment freeze /absolute/fresh-r1-ablation/inputs/experiment.toml
python -m aria_nbv.oracle.pipelines.recipe_experiment run /absolute/fresh-r1-ablation/plan.json

An interrupt affects only this experiment’s owned child. Resume with the same run command; completed stores are reused and earlier attempt costs retained. Changing a knob or source requires a fresh output directory. Existing production queues and profiles are not modified. This pilot does not admit a pooled corpus.

After the opt-in R1 parameter preparation and ordinary recipe experiment, produce a source-bound report with python -m aria_nbv.oracle.pipelines.r1_ablation_report RUN/plan.json --output RUN/r1-report.json. The canonical JSON and adjacent manifest preserve every intended root/profile/ replica cell, all lifecycle attempts including retries, and admitted native posthoc tables. read_saved_r1_ablation_report verifies cold bytes, source and supervision quantities without reopening stores; provide plan_path to bind independent frozen plan bytes. A new live scan verifies current store evidence.

Initial measured target pool, selection, replay root and frozen sampler seed must match before successful within-host comparisons. Candidate draws and later trajectories may differ. Contrasts average replicas within roots, roots within physical scenes, and scenes equally, with support and excluded dispositions. Committed Q-train labels are an operational supervision proxy, not measured learning benefit. Negative valid labels retain their support. All-attempt observed monotonic seconds are separate from complete total cost; missing clocks make amortized labels/second unavailable. This descriptive pilot declares no winner, significance, cross-host speedup or automatic promotion.

The independent endpoint diagnostic reads already saved endpoint_audits/**/endpoint_measurement.json only after canonical shard sidecar-seal validation. Receipt bytes retain source/root/target/chain/scorer and promoted-parent binding. Missing or unsealed measurements stay unavailable; this readback neither remeasures clouds nor substitutes cumulative gains. Quarantine bytes sum measured per-attempt directory growth, with absent or shrinking-directory measurements retained as missing.

# oracle.pipelines { #aria_nbv.oracle.pipelines } `oracle.pipelines` Operational pipelines that generate Oracle-supervised datasets. This package provides offline/online VIN labeling, rollout-store construction, sharded campaigns, and verified online QH bundle adaptation. These pipelines compose lower-level candidate generation, rendering, RRI, replay, and storage owners without moving those contracts into dashboards or storage codecs.  ## Package guide `aria_nbv.oracle.pipelines` composes data access, candidate generation, privileged scoring, replay, and immutable persistence. It does not redefine the lower-level storage, target, RRI, or scorer contracts. ## Finish or pause a collection After publishing an increment or stopping an interrupted collection, refresh its metadata inventory with `nbv-stores-info --root-store ROOT_FRAGMENT --rollout-store COMPLETED_SHARD --output RUN_DIRECTORY/store_inventory.json`. Repeat exact-store flags for all published fragments/shards, confirm the new paths are visible, and retain unavailable entries and prior completed stores. Exact-path refresh avoids a recursive all-data scan. Keep this derived snapshot with run receipts; store and training validation remain separate. The [dataset store overview](https://github.com/JanDuchscherer104/ARIA-NBV/blob/main/aria_nbv/aria_nbv/datasets/STORE_OVERVIEW.md#refresh-the-inventory) owns the shared CLI/Streamlit workflow. Writers continue to publish immutable stores and receipts. ## Command-Line Workflows ### Measured Mac work selection The Mac supervisor accepts an optional `[selector]` section alongside its absolute runtime/resource configuration: ```toml [selector] root_plan_path = "/absolute/root-campaign/root-plan.json" owner_host = "mac-host-name" rollout_queue_paths = ["/absolute/admitted-queue/queue.json"] admitted_queue_inventory_path = "/absolute/fleet/admitted-queues.json" refill_below_hours = 2 stop_refill_at_hours = 8 minimum_cycle_samples = 2 ``` The required supervisor `queue_path` is the primary queue and must also appear in `rollout_queue_paths`. It owns the fleet-wide operator pause. All queues and the root plan retain the same frozen host order and exact owner; an offline endpoint never transfers its assignments. The supervisor holds one exclusive lock and launches one heavy worker. Root work is bounded to one fragment; rollouts retain bounded tranches. Every restart reconciles the canonical runner/queue locks before launch and preserves refill hysteresis. Supply counts only admitted, previously unscheduled source roots. Each terminal target attempt and the roster's prior selection consume that first-pass supply, including exclusions. Hours equal that backlog times the observed mean complete rollout-cycle duration, including setup/admission/validation. Missing full-cycle support produces a one-unit rollout bootstrap and null hours. The observed duration range is descriptive, with no calibrated prediction interval. These watermarks control work queues; counts never qualify scientific pooling. New root fragments need canonical source-manifest and target-roster admission, then their own immutable frozen queue. To make them visible to an already running supervisor, atomically publish the optional inventory: ```json { "owner_host": "mac-host-name", "root_plan_hash": "exact-frozen-root-plan-hash", "queue_paths": ["/absolute/admitted-queue/queue.json", "/absolute/new-admitted-queue/queue.json"] } ``` The inventory retains configured queues and adds only source-disjoint admitted queues with the same generation profile. Missing inventory/queue endpoints and live locks report a blocked, incomplete inventory with null hours. Without an inventory pointer, the explicit list changes on supervisor restart. Generated fragments alone never increase qualified supply. Run `python -m aria_nbv.oracle.pipelines.mac_generation_supervisor status /absolute/supervisor.toml` for the selected work, reason, backlog, measured support, observed range and freshness timestamp. `pause` and `resume` persist explicit controls without launching work; use `run` or reload the supervised launcher after an operator/resource pause. Active workers stop at their existing publication boundary, and resume reconciles completed evidence. AC return may resume a power pause; operator/resource pauses survive it. Existing disk, staging and commissioned memory guards apply to either worker type. This configuration is not evidence of live commissioning or numerical qualification. Pause persists the primary/root requests before checking extra endpoints and reports unavailable paths. Resume skips queues already running or not started. A failed lifecycle or terminal execution failure stops fleet selection; a queue's output quota excludes that queue while other admitted work remains selectable. Focused proof: `tests/oracle/pipelines/test_fleet_selector.py`, `test_mac_generation_supervisor.py`, `test_root_fragments.py` and `test_recipe_queue.py`. Run from `aria_nbv/`: | Command | Purpose | | --- | --- | | `nbv-build-offline` | Build immutable scene-labelled VIN rows or actor-only rollout roots. | | `nbv-build-rollouts` | Generate one rollout store or one planned shard. | | `nbv-plan-rollout-shards` | Bind ordered source rows into a shard manifest. | | `nbv-plan-rollout-source` | Build a source-population manifest. | | `nbv-status-rollout-shards` | Validate and summarize shard completion. | | `nbv-rollout-campaign` | Run a bounded resumable rollout campaign. | Campaign `smoke` is a canonical single-work-unit guard for the deterministic first planned unit. It is not evidence that a multi-scene or replicated smoke population completed; population-level admission remains a separate WP18 responsibility. Always validate configuration before generation: ```sh uv run nbv-build-offline \ --config-path ../.configs/build_vin_offline_81286.toml \ --dry-run uv run nbv-build-rollouts \ --config-path ../.configs/smoke/build_rollouts_v1_smoke.toml \ --dry-run ``` For rollout roots, set `VinOfflineWriterConfig.preparation_mode="actor_only"`. This explicit V11 capability retains actor inputs, configured EVL evidence, target boxes and trajectories while skipping scene candidate rendering and RRI labels. The default `scene_labelled` mode remains V10. Actor-only stores support rollout generation and named QH actor joins; one-step VIN training and scene-RRI inspection require scene-labelled roots. See the [VIN storage guide](data_handling.vin_store.qmd). The bounded example is `.configs/build_vin_actor_roots.toml`; validate it with `nbv-build-offline --config-path ../.configs/build_vin_actor_roots.toml --dry-run` from `aria_nbv/` before selecting new source keys and output paths. Grow a root collection by creating new immutable store fragments. Do not append to a finalized root store: existing rollout source references bind its manifest hash. Interrupted root preparation may finalize its completed rows, but is not an append/resume protocol. Plan the remaining raw snippets into a new fragment. The same campaign preflight command can materialize the no-render, no-reward-label Phase-A candidate-family proposal-support audit with privileged GT target instruction and mesh validity. It does not construct an oracle scorer, renderer, replay policy, or reward label, but it is not oracle-free because target instruction and physical validity remain privileged: ```sh uv run nbv-rollout-campaign preflight \ --config-path ../.configs/build_rollouts_v2_cuda_campaign.toml \ --source-store /path/to/vin_offline_rollout_campaign100_v10_rebuilt \ --family-phase-a-output ../docs/contents/evidence/candidate_family_phase_a_wp02.json ``` The explicit source path is local acquisition only. Before evaluating any row, the command plans the source store through the canonical dataset owner and requires its native manifest, cache version, split identity, and ordered rows to match the reviewed manifest exactly. The emitted compact JSON binds those actual source identities, the manifest bytes, complete writer configuration, clean generation revision, CUDA/PyTorch/PyTorch3D/GPU runtime, every full candidate shell, and the canonical family gate. The dedicated reader verifies all bindings, the content hash, the complete reducer policy, and a fresh reduction before exposing the DTO. A failed gate is still written and exits with status 2. Broad rollout generation stays blocked until the separately versioned WP18 admission artifact exists. The current 100-scene control completed with a machine-readable no-go. Its canonical artifact and figures live in the [rollout evidence directory](../contents/evidence/candidate_family_phase_a_wp02.json): all source rows were evaluated, but applicable-family collapse and low support remain. A no-go command writes the complete artifact and exits with status 2; it completes issue #54's fail-closed mechanism/evidence checklist while remaining evidence for later sampler retuning, not campaign admission. ## Composition Boundaries | Module | Responsibility | | --- | --- | | `offline_vin` | Stream raw snippets, prepare expensive evidence, and write VIN rows. | | `rollout_dataset` | Compose target tasks, candidates, oracle scoring, replay, and store writes. | | `scene_labels` | Generate scene-level labels over finite candidate tables. | | `evaluated_rollout` | Bind replay transitions to retained oracle evaluation. | | `shards` | Plan and atomically promote independent generation shards. | | `campaign` | Resume bounded local/CUDA campaign work with explicit receipts. | | `online_vin` | Live one-step oracle dataset for the historical control. | | `online_qh` | Verify an immutable QH bundle and adapt hard-valid values to replay `CandidateScores`. | `online_qh` fails closed on actor, learning, target, candidate-generator, action-mask, representation, geometry, or trained-horizon mismatches. It does not rank by `P(valid) * Q`; the authoritative hard mask defines deployable support. ## Verification ```sh cd aria_nbv uv run ruff check aria_nbv/oracle/pipelines uv run pytest tests/rollouts/test_cli_typer.py uv run pytest tests/oracle/test_online_qh.py uv run nbv-build-rollouts \ --config-path ../.configs/smoke/build_rollouts_v1_smoke.toml \ --dry-run ``` Use the [data-handling guide](data_handling.qmd) for source/store preparation and the [rollout guide](rollouts.qmd) for persisted validation and inspection. ## Independent endpoint audits Enable `RolloutDatasetWriterConfig.endpoint_audit_enabled` for the captured audit subset. The writer independently prepares and measures the root and final selected-observation history through `TargetRriScorer.measure_endpoint_pair`, then writes endpoint sidecars after store creation. This is opt-in because full prepared clouds add retention and measurement cost. Audit failures block that store; missing measurements are never substituted with zero gain. Numerical repeatability alone does not establish metric sensitivity, physical-camera correctness, or suitability as a training objective. ## Local recipe diagnostics `recipe_experiment` schedules a predeclared parameter-only comparison through `shards.run_rollout_shard`. It deliberately does not modify the reviewed `CudaRolloutCampaignConfig` profile/temperature contract or grant corpus admission. Each named arm points to a canonical `RolloutDatasetWriterConfig` TOML; scientific profile and proposal replica are separate identities. From `aria_nbv/`, use the shared environment with this checkout on the import path: ```sh python -m aria_nbv.oracle.pipelines.recipe_experiment freeze /absolute/experiment.toml python -m aria_nbv.oracle.pipelines.recipe_experiment run /absolute/output/plan.json # After acquisition, without changing the frozen generation source: python -m aria_nbv.oracle.pipelines.recipe_experiment_report /absolute/output/plan.json /absolute/report.json ``` The experiment config supplies timezone-aware deadline, measured conservative block time/bytes, disk reserve, output cap, worker timeout and maximum matched source blocks. Planning rejects mismatched source populations, measurement or Oracle task-selection contracts, multiple factual branches, and acquisition caps above sixteen. It binds the clean source revision and writer bytes; resume rejects changed identities and validates successful shard sidecars. Expected support rejection remains an observed outcome. Execution failure finishes the current attempted block but prevents starting later blocks. An interrupted worker's staging is quarantined before a retry, and final stores are reused only through canonical validation. `recipe_experiment_report` owns plan/shard acquisition and provenance checks; `rollouts.inspection.recipe_experiment` owns finite prefix projection and scene-first paired reduction. Missing endpoints stay unavailable. Cumulative prefix returns are collection diagnostics, not independent endpoint measurement, proof of useful prediction horizon, or recipe promotion. Independent prepared root/final measurement and the broader admission gates remain required. For a resumable, disk-bounded single-profile stream, `recipe_queue` freezes a G60 writer and an admitted target-roster receipt, then visits only eligible development scenes. Its first pass visits the 61 eligible roots not yet used in the current matrix before the 16 previously sampled roots. It increments sampler and proposal seeds after each full scene pass, while preserving the 20 reserved confirmation scenes and 3 excluded roots. Each rollout is still frozen and executed by `recipe_experiment`; the queue adds no wall-clock campaign deadline. Its output quota and free-space reserve are the normal stop conditions, while a per-rollout watchdog and typed genuine execution failures remain safety stops. ```sh python -m aria_nbv.oracle.pipelines.recipe_queue freeze /absolute/queue.toml python -m aria_nbv.oracle.pipelines.recipe_queue run /absolute/output/queue.json # These append control events; pausing takes effect at a rollout boundary. python -m aria_nbv.oracle.pipelines.recipe_queue pause /absolute/output/queue.json python -m aria_nbv.oracle.pipelines.recipe_queue resume /absolute/output/queue.json ``` `queue.json` and its source receipt bind the population and generation code; `ledger.jsonl` records each terminal rollout. Pause and resume append to `controls.jsonl`. Completed stores, receipts, and logs are retained. A quota stop is terminal for that queue identity; further storage requires a new explicitly frozen queue rather than rewriting the old quota or its evidence. The free-space reserve stop is resumable after disk space is available again. `pause` records a boundary request and prints whether the request is merely persisted or the scheduler has already acknowledged a quiescent `paused` state. Repeating `pause` is a readback of that acknowledgement; it does not interrupt or wait for the current rollout. SIGINT/SIGTERM/SIGHUP stop at the current worker boundary and leave that unit resumable. A genuine execution failure remains terminal for the queue and requires diagnosis before any new queue is frozen. ### Target-roster geometry parity The no-render target-roster preflight binds each paired source row to the same physical root, target row identity, target center and full extents, world object pose and reference object pose. V2 receipt validation checks arm agreement and selected-row audit consistency independently of the JSON seal. Raw root poses must reproduce their hashes, and standoff must equal the target-to-camera distance. Balanced comparison admission accepts only v2 receipts; separately versioned singleton engineering receipts support same-arm commissioning. `require_admitted=False` permits diagnostic inspection of blocked receipts; proposals never admit. Historical v1 JSON stays sealed evidence and requires a new preflight for current admission. ### Matched candidate-renderer validation `RecipeExperimentConfig.rendering_contrast=true` opts into a strict render-only contrast. Within each paired replica, the source, target sampler, candidate mixture, selection policy and seed, candidate cap, score margin, resolution, stride and fusion settings must agree. Only `target_scorer.candidate_render_crop` may differ scientifically. `renderer_validation_output` and `store.store_dir` are the two declared operational destination differences. The frozen plan retains complete original writer/scorer/task contracts and seals their exact delta; ordinary and historical experiment validation remains unchanged. Historical R0/cropR1 additionally changed the target-sampler and policy seeds from 20261001 to 20261004 and proposal replica from 0 to 1. That collection-policy contrast cannot isolate candidate cropping. A same-pose measurement compares rendering for fixed realized inputs; a collection-policy contrast also changes which inputs are selected. Use the existing `rendering_contrast` contract for a new matched crop contrast; historical evidence retains its original scope. Set `RolloutDatasetWriterConfig.renderer_validation_output` to a fresh capture root to enable actual single-chain traces. A reviewed source manifest and clean current acquisition revision are required. Capture hooks record the actual scoring raster until selection, then retain only the selected low-resolution depth, mask, calibration and full-scene world points. The adapter resolves these observations before future state preparation and at final materialization. The capture records complete shell/label/probability tables, actual prepared states, original mesh/content identity and conservative retained-face provenance. Selected high-resolution storage follows its existing independent route. `renderer_validation.read_renderer_validation` accepts a relocated hydrated manifest and independently supplied frozen identity. It checks payload hashes, action/shell/camera joins, actual causal point history and terminal coverage; missing sidecars are explicit and cannot qualify. `compare_renderer_traces` checks actual actions, ranks/ties, history and labels/probabilities (absolute ≤1e-6). Prefixes remain repeated observations within a scene, with scene-first aggregation owned by the existing recipe reducer. A matching projected config never substitutes for measured numerical equality. Scorer phases, actual selected acquisition, selected high-resolution rendering, endpoint measurement and store/endpoint-receipt writing are recorded separately from capture serialization. The existing outcome receipt remains authoritative for full worker elapsed time: summed instrumented phases omit uninstrumented setup/selection/validation and are not a replacement total. Missing or disabled phases remain unavailable. Capture observers are disabled by default and do not constitute data admission or a speed/equivalence claim. Acquire both arms on one updated canonical revision; preserve earlier experiments as historical evidence. A writer fragment enables capture in both arms. The crop table belongs only in the cropped arm; keep the rest of both writer files identical except their recorded store/capture destinations: ```toml renderer_validation_output = "/absolute/experiment/captures/cropped" [target_scorer] include_scene_rri = false [target_scorer.candidate_render_crop] extra_halo_m = 0.0 face_chunk_size = 200000 ``` In the existing experiment TOML, declare `rendering_contrast = true` and a `[[contrasts]]` entry with `baseline = "full"`, `challenger = "cropped"`. Freeze one single-chain writer per arm/replica with the same selector seed in both members of each pair. The capture constructor writes `frozen-identity.json` from source/target/config/mesh checks before scoring; preserve and seal that file independently of the terminal validation manifest. ```bash nbv-build-rollouts --config-path full.toml --dry-run nbv-build-rollouts --config-path cropped.toml --dry-run python -m aria_nbv.oracle.pipelines.recipe_experiment freeze renderer-screen.toml python -m aria_nbv.oracle.pipelines.recipe_experiment run /absolute/experiment/plan.json python -m aria_nbv.oracle.pipelines.renderer_validation compare \ hydrated/full/renderer-validation.json hydrated/cropped/renderer-validation.json \ --baseline-identity frozen/full-identity.json \ --cropped-identity frozen/cropped-identity.json ``` The comparison command is read-only and returns success only for the declared full-versus-cropped contrast with completed intended horizons and qualifying actual evidence. Matching early-stop prefixes are reported descriptively and cannot qualify a missing H16 endpoint. Legitimate scored-but-unselected terminal tables remain explicitly auditable. The supported interface and CPU checks do not establish the planned real H16 equivalence or speed claim; GPU acquisition and analysis remain required. The bounded renderer validation capture excludes `directed_orbit_only` and `directed_orbit_plus_bypass`: those selectors use geometric selection values instead of the measured Oracle scores validated by this contract. Config and freeze reject these combinations before acquisition. Optional production crop rendering remains supported for directed policies when capture is disabled. ### Exact-box scoring `TargetRriScorerConfig.target_crop_policy="gt_obb_oriented_triangle_clip_v2"` requires `target_crop_margin_m=0`. The reference mesh is intersected with all six GT-OBB half spaces: boundary-crossing triangles contribute their in-box surfaces even when every original vertex is outside. No bounding-box caps are created. Reconstructed metric points use the same exact oriented membership and existing recorded fusion order. Candidate labels and independent endpoint audits share this versioned preparation. The historical any-vertex v1 crop remains the default and retains its semantics. Exact-box data has a distinct measurement identity; do not pool it with v1 labels or rewrite old receipts. Rendering still uses the full scene unless an independently validated rendering option is declared. Rendering visibility halos do not expand this metric target region. Optional `require_current_root_target_support=true` retains the uniform GT sampler and restricts its draw to targets meeting `min_current_target_points` after canonical observed-root preparation. Source-bound pool/count/probability receipts persist for successes and typed exclusions; unavailable inspection is explicit. This changes the admitted sampling population and its lineage. Optional `min_target_aware_root_candidates=3` counts hard-valid proposals from target-bearing, lateral-bypass and orbit center modes together before scoring. It imposes no per-family minimum. Set `min_valid_root_candidates=0` to disable the separate total-root threshold. Both new controls remain disabled and omitted from default serialized writer configurations. ## Computational source contrasts `source_contrast_report.read_source_contrast_report` admits the narrowly versioned `generation-throughput-source-contrast-v1` assignment: three scenes, one seed, H16, crop enabled in both sources, six capture attempts and twelve ordinary attempts in AB/BA blocks. Every independent recipe plan and complete writer is sealed. The existing portable recipe reader admits copied writer bytes; the assignment retains original identities and explicitly binds the approved source diff. It cannot relax E32's existing twenty-cell full/crop contract. Enable `RecipeExperimentConfig.worker_lifecycle_timing` in both sources for outcome-bound parent launch-to-exit timing and synchronized child GPU peak allocation/reservation companions. Capture instrumentation is declared separately. The source reader compares captured causal48px tensors, the common persisted projection (including actual float16 retained240px rasters), independently recomputed endpoints, and same-source capture/production projections. Matching 240px depth does not establish absent48px history. Missing outcomes, captures, endpoints or resource companions remain nonqualifying; statistical steps are not independent samples. Scene-equal paired log ratios and observed baseline-repeat variation support a descriptive engineering decision, not a population claim. The receipt reader is evidence verification, not historical training reproduction or corpus admission. Its local qualification is only one gate for the separate schema-v2 performance evaluator and mandatory W&B publication/readback. ### Fixed-input surface metric correction `surface_correction_replay` binds the historical eight-state panel to corrected surface metric measurements on the same prepared inputs. It reuses `surface_reference_panel` for measurement, triangle parity and decision reductions. Candidate treatments remain paired within each state; maxima and event counts describe this fixed diagnostic panel. The historical sample-count gate is reported independently from execution completion. Neither result grants evaluator or corpus admission. Freeze a future aware deadline on a clean committed source revision, then use `run` to execute cases through the existing process-group watchdog. Each child is bounded by its frozen case timeout and the remaining absolute deadline, with 15 seconds reserved for termination cleanup. Source and prepared tensor hashes are checked before replay; changed revisions are rejected. `--case-limit` selects a pilot prefix and retains all unreached states. ```sh python -m aria_nbv.oracle.pipelines.surface_correction_replay freeze \ --output /absolute/correction-assignment.json \ --old-assignment /absolute/historical-assignment.json \ --old-run /absolute/historical-run --deadline 2026-11-01T12:00:00+01:00 python -m aria_nbv.oracle.pipelines.surface_correction_replay run \ --assignment /absolute/correction-assignment.json \ --output-dir /absolute/new-correction-run ``` `seal` preserves original JSON bytes in an exclusive portable bundle and prints its manifest SHA-256. Retain that hash independently. Explicit historical paths allow archived evidence to be relocated without consulting stored absolute paths. Cold `readback` verifies exact retained file support and hashes, recomputes all reached case contrasts, and rejects any inconsistent full aggregate even when its comparison hash has been rebound. It needs no original stores, prepared tensors, historical Git checkout or GPU. Prepared tensor hashes remain captured provenance; readback does not remeasure their contents. ```sh python -m aria_nbv.oracle.pipelines.surface_correction_replay seal \ --assignment /absolute/correction-assignment.json \ --output-dir /absolute/correction-run \ --old-assignment /absolute/historical-assignment.json \ --old-run /absolute/historical-run --destination /absolute/new-bundle python -m aria_nbv.oracle.pipelines.surface_correction_replay readback \ --manifest /relocated/bundle/manifest.json \ --expected-manifest-sha256 <independently-retained-hash> ``` ### Fixed-root renderer primitive diagnostics `aria_nbv/scripts/probe_renderer_equivalence.py` captures explicitly requested fixed-root mechanism controls through the existing evaluated source owner. It retains candidate membership, finite-score support, prepared point hashes and paired raster/score observations. It does not alter a collector recipe or admit a corpus. Requested root indices must be unique and nonnegative, and every attempt uses an exclusive new directory. Depth and nested renderer CUDA devices must agree; timings, memory guards and provenance use that resolved ordinal. `renderer_validation.compare_renderer_scores` and `renderer_equivalence_gate` own the shared comparison and frozen numerical gates: full-image claims require depth masks and mapped face identity for every recorded repeat; viewing-AABB results remain target-local, and target-only cropping is a negative control. No gate certifies successor acquisition integration. For an existing immutable `renderer-mechanism-evidence-bundle-v1` bundle, retain its manifest SHA independently, then use: ```sh python aria_nbv/scripts/verify_renderer_equivalence_readback.py \ --bundle /absolute/retained-bundle --manifest-sha256 <retained-sha256> \ --output /absolute/new-readback.json python -m aria_nbv.reporting.renderer_probe_figures \ --bundle /absolute/retained-bundle --manifest-sha256 <retained-sha256> \ --output /absolute/new-figure-directory ``` `read_captures` verifies the complete manifest and all payloads, rejecting noncanonical paths, symlinks and special files. `open_verified_capture` verifies and consumes a selected primitive through one regular file descriptor; tensor readback uses restricted `weights_only=True` deserialization. Captures must be immutable during use; this is not a snapshot of concurrently writable data. Cold readback checks retained candidate identity, tensor hashes, finite supported gain algebra and masked selection distributions. Unsupported scores remain missing, not zero. It replays reported repeat criteria; it does not independently remeasure every repeat's depth/face comparison. Original meshes are required for GT distance kernels, and no complete rollout-equivalence claim follows. `observation_tables` preserves attempt/root/arm/timing-repeat identity and records the joined `depth_diagnostic_repeat`. The full-naive cold reference has no repeat comparison; its warm diagnostics use an explicit index offset. `max_abs_score` is present only for the saved-last render observation, because scores were not measured for every repeat. Unavailable or unreached roots remain separate. Export filenames retain a deterministic attempt-identity digest so distinct paths cannot silently overwrite one another. `render_bundle` and its CLI use those same normalized tables and figure producer. Cold/warm repeats are observations within a mechanism root, not independent scenes; exports provide descriptive raw observations, not confidence intervals or campaign-wide efficiency. There is no new Streamlit consumer in this slice. No queue-wide denominator is inferred from root assignments or these capture receipts. ### Separate R1 supervision productivity pilot The executable declarations are `.configs/profiles/r1_48_incumbent.toml`, `r1_48_quota.toml` and `r1_48_bearing085.toml`. Preparation seals their exact bytes and materializes three ordinary writers. Quota changes only allocation 18/18/12/12 to 18/14/12/16; bearing changes only its maximum radius 1.1 m to 0.85 m. The controls retain R1 crop, V10 actual 48³ roots, H16/T1/floor 0 and motion bounds. Write a local preparation TOML with explicit paths and selected TRAIN keys: ```toml baseline_writer_path = "/absolute/local-reviewed-r1-writer.toml" output_root = "/absolute/fresh-r1-ablation" host = "mac_cpu" # use ubuntu_cuda on Ubuntu; mac_mojo requires pinned provider sample_keys = ["ASE_84320_Atek_000048"] max_blocks = 1 seeds = [20261012] free_disk_floor_gib = 250 max_output_gib = 16 unit_timeout_seconds = 1800 ``` Run from a clean, fixed source checkout. The reviewed local baseline supplies root manifest/store, meshes and prepared-source paths; paths are not inferred or silently translated between hosts. Use an equivalent local baseline on the other host and retain its own runtime identity. Preparation reads actual stored occupancy/free grids and rejects declarations without 48³ evidence. ```sh python -m aria_nbv.oracle.pipelines.r1_ablation /absolute/prepare.toml python -m aria_nbv.oracle.pipelines.recipe_experiment freeze /absolute/fresh-r1-ablation/inputs/experiment.toml python -m aria_nbv.oracle.pipelines.recipe_experiment run /absolute/fresh-r1-ablation/plan.json ``` An interrupt affects only this experiment's owned child. Resume with the same `run` command; completed stores are reused and earlier attempt costs retained. Changing a knob or source requires a fresh output directory. Existing production queues and profiles are not modified. This pilot does not admit a pooled corpus. After the opt-in R1 parameter preparation and ordinary recipe experiment, produce a source-bound report with `python -m aria_nbv.oracle.pipelines.r1_ablation_report RUN/plan.json --output RUN/r1-report.json`. The canonical JSON and adjacent manifest preserve every intended root/profile/ replica cell, all lifecycle attempts including retries, and admitted native posthoc tables. `read_saved_r1_ablation_report` verifies cold bytes, source and supervision quantities without reopening stores; provide `plan_path` to bind independent frozen plan bytes. A new live scan verifies current store evidence. Initial measured target pool, selection, replay root and frozen sampler seed must match before successful within-host comparisons. Candidate draws and later trajectories may differ. Contrasts average replicas within roots, roots within physical scenes, and scenes equally, with support and excluded dispositions. Committed Q-train labels are an operational supervision proxy, not measured learning benefit. Negative valid labels retain their support. All-attempt observed monotonic seconds are separate from complete total cost; missing clocks make amortized labels/second unavailable. This descriptive pilot declares no winner, significance, cross-host speedup or automatic promotion. The independent endpoint diagnostic reads already saved `endpoint_audits/**/endpoint_measurement.json` only after canonical shard sidecar-seal validation. Receipt bytes retain source/root/target/chain/scorer and promoted-parent binding. Missing or unsealed measurements stay unavailable; this readback neither remeasures clouds nor substitutes cumulative gains. Quarantine bytes sum measured per-attempt directory growth, with absent or shrinking-directory measurements retained as missing.