WP10c - Keep-out violation forensics: read-only replay; D13 hypothesis REFUTED (clean-abort ellipse mechanism)

[HeliCorgi]

WP10c (Phase 0) - keep-out violation forensics per adsc-specification-v5.md section 6

Read-only analysis tool + committed artifacts, through the normal regeneration pipeline. No control-law or campaign code changes (WP10 is behavior-change-free by definition).

What it does

• tools/forensics/make_forensics.py (Python 3 stdlib, R9) replays the committed campaign exactly: per-run seeds (SplitMix64(master_seed XOR FNV1a64(catalog), run_index)), the std::mt19937_64 + Box-Muller draw stream in run_one_mission's exact draw order, the deterministic Delta-v/kit bookkeeping, and the compute_safe_abort CW coast under the campaign's coarsened screen (1 period at dt = 8 s).
• Self-gating: before classifying anything, the tool replays all 1000 committed runs and hard-fails unless every replay-reachable column (run_seed, solar_factor, first_closing_speed, tumble_rate, dv_used, dv_remaining, removals, targets_attempted, gate_abort_events, kits_used, outcome) matches the committed CSV at its own printed precision, and the replayed violation set equals the committed one. Result: 1000/1000, zero mismatches, 576 aborts replayed, exactly the committed 14 violations reproduced.
• Writes generated/wp10_violation_forensics.csv (one forensic row per violating run: dispersed initial state, commanded impulse, capped flag, post-burn drift, coast minimum + time, analytic ellipse cross-check, classification) and .md (replay recipe, cross-validation, findings, near-miss context, honest limits). Registered as ctest forensics and as regenerate_all step [6/9], so the artifacts sit behind the same SHA reproducibility gate as everything else.

Finding: the D13 working hypothesis is REFUTED

D13 hypothesized the primary violation mechanism as capped-abort residual drift. The data says otherwise:

• All 14 violations are clean aborts: max commanded impulse 0.306 m/s against the 2.0 m/s cap; post-burn secular drift term is exactly zero in every case.
• Actual mechanism: clean-abort safety-ellipse keep-out intersection. The drift-null impulse yields a bounded ellipse x = x0 cos nt, y = y0 - 2 x0 sin nt, z = z0 cos nt through the dispersed abort-start state; every violator has |x0| = 62.6-142.4 m (1.6-3.6 sigma of the 40 m dispersion), swinging the coast to within 53-200 m of the target at a quarter or three-quarter orbit (sign of x0 predicts which - confirmed for all 14).
• Near-miss context for WP11: margins of the 562 non-violating aborts are continuous down to 10.8 m; the 0.014 rate is a distribution tail, not isolated outliers. Consequence for WP11 design: constraining the abort ENTRY STATE (reachability/ellipse-clearance check) is the fix; raising abort_dv authority alone addresses zero of the observed violations.

Per v5 D13, this hypothesis-vs-data outcome is exactly what WP10 forensics was for; WP11's completion criterion ("every WP10-classified violation mechanism addressed by a named design element") now targets the REAL mechanism. Negative results are first-class deliverables (v5 section 10).

Verification

• ctest additions pass locally (forensics, plus evidence/viz/compliance unchanged-green); CI runs the full build + ctest + regenerate + SHA gate.
• Adversarial-verifier verdict: SHIP (9/9), including independent from-scratch recomputation of all 1000 run seeds (0 mismatches), independent closed-form CW minima for spot-checked rows (agreement to <0.001 m analytic / ~8 s-screen resolution swept), bookkeeping identity dv_used = 8a + 4g + 3(a-g) + 5r + 15(a-1) exact on all 14 rows, and constant-mirror audit against campaign.hpp/mission.hpp/decay.cpp.
• Traceability note (from the verifier, agreed): the md's near-miss aggregates (10.8 m floor, 38 aborts < 50 m) derive from the replay of non-violating aborts, which have no committed row-level artifact - they are deterministically regenerated and gate-protected, but not inspectable without running the tool. If row-level near-miss data becomes WP11 input, a follow-up can widen the CSV.

Spec-vs-repo observations (reported, not improvised around)

• Spec v5 R15 mentions dispersion_set_id stamping into campaign CSVs as a future protocol element; it does not exist in the committed schema and adding it is a code/schema change outside WP10's no-behavior-change scope. The forensics md therefore scope-tags its statements as "[L0: ... WP5 committed dispersion set as configured in CampaignConfig]" rather than by a set id.

Completion criteria (v5 section 6, WP10): forensic classification of ALL violating runs (14/14) - met; replay recipe (seed + config) documented (md section 1) - met; citation-fill merged (PR #16) - met.

🤖 Generated with Claude Code