WP11 - Safety hardening + closed-loop guidance: clearing-abort law, reachability screen, keep-out 0 of 500 [L0, ds-v1]

[HeliCorgi]

WP11 (adsc-specification-v5.md section 6) - targets the FORENSICALLY CONFIRMED mechanism

WP10c refuted D13's capped-abort hypothesis: all 14 violations were CLEAN aborts whose drift-null (bounded) safety ellipse geometrically intersected the keep-out sphere. WP11 eliminates exactly that mechanism.

Design (named elements per the WP11 completion criteria)

1. Clearing-abort law (compute_clearing_abort / clearing_abort_for): 3-stage escalation - (1) drift-null baseline accepted only if the ANALYTIC post-burn ellipse (bounded_coast_min_range, closed form from the CW STM) clears keep-out + a 20 m design margin; (2) bounded-clearing radial reshape, closed-form u* = x0^2/g - g/4 from the sufficient condition |y_c| - 2*rho >= R_clear; (3) two-impulse radial retreat hop with an analytic terminal-ellipse acceptance (used for inside-sphere retreat); legacy Capped honesty preserved past the dv budget. Addresses the WP10c mechanism: clearance is now analytic and accepted, never assumed from boundedness.
2. Negative result, documented (v5 section 10): the originally-envisioned pure along-track opening-drift escalation was evaluated and REJECTED - its oscillation amplitude ~4*dv/n (km-scale) swamps the 100 m geometry and re-crosses near-zero range (measured minima of meters). The bounded-vs-escalation trade is documented in generated/wp11_guidance_modes.md (design note) and generated/wp11_abort_audit.md section 5 (abort_dv trade table: the cap is not the binding constraint anywhere in 0.5-4.0 m/s).
3. Reachability screen / safe-set: guidance evaluates the clearing law on every candidate post-impulse state BEFORE committing it (outside the sphere: analytic bounded clearance required; inside, post-sync authorized: retreat feasibility with a no-closer-than-0.8x floor). Held at every step of the flown demo.
4. Closed-loop translation guidance (new guidance module, extends the WP3 phases per R1): far approach -> hold -> sync-hold -> final approach -> contact -> retreat; two-impulse CW hold transfers (exact STM boundary-value solves); glideslope-with-floor profile so the contact speed is PRODUCED by guidance (0.1000 m/s) with the 0.15 m/s gate retained as an independent check - closing the long-standing 'gate, not guidance' known limit at L0; LOS cone; mode machine + per-mode entry/exit/abort conditions emitted from the code itself to generated/wp11_guidance_modes.md; abort feasibility demonstrated from every mode in the flown profile.

Results (all quoted numbers regenerate; CI byte-identity gate green)

• Keep-out violations: 0 of 500 per catalog [L0: linear CW, dispersion set ds-v1, Wilson 95% upper bound 0.0076] - the WP11 completion criterion, quoted with the Wilson bound per R14/R15 (a zero still carries an interval).
• forensic-14 pinned regression (tests/test_forensic14.cpp + the Python replay gates): the legacy law reproduces all 14 WP10c violations analytically from the pinned states; the clearing law clears every one (analytic min > 200 m, |dv| <= 2 m/s); the full campaign path replays all 14 (catalog, run_index) pairs clean.
• Abort-stage usage across all 583 gate-abort events: 562 Clean, 21 BoundedClearing, 0 RetreatHop, 0 Capped; clearance floor 20.0002 m (= the design margin, by construction - vs a 10.8 m near-miss floor under the legacy law).
• Guided-approach demo: completed; dv total 2.53 m/s; screen held every step; LOS ok. New R14-tagged rows in reference_metrics.csv.

R15 protocol - BEFORE/AFTER (per catalog; BEFORE = v0.10-phase0-baseline tag)

metric	BEFORE (SL-16 / SL-8)	AFTER (SL-16 / SL-8)
keep_out_violation_rate	0.014 [0.007, 0.029] / same	0.000 [0.000, 0.008] / same [L0, ds-v1]
keep_out count	7 / 7	0 / 0
dv_exhausted count	215 / 222	222 / 229 (the 14 runs continue, then exhaust dv)
gate_abort events	288 / 288	292 / 291 (continuation reaches extra aborts)
dv_used mean [m/s]	127.622 / 127.722	128.798 / 129.000
kits_used = removals mean	3.830 / 3.840	3.860 / 3.876
success / nonproductive / gate-abort-run rates	unchanged	unchanged (both old and new outcomes are nonproductive)
legacy GNC pins 19.15 / 424.3 / 16.87 / 17.07	unchanged	unchanged (byte-identical rows; F1 tests intact)

Reason (algorithmic, deliberate): the campaign keep-out screen now runs the clearing-abort law instead of the legacy drift-null law. Dispersions unchanged - dispersion_set_id = ds-v1 now stamped in every runs-CSV row (schema 1.0 -> 1.1, additive, with schema.md + all consumers updated in this PR); seed-for-seed comparison verified: the full 1000-run draw stream (run_seed, solar, closing speeds) is byte-identical to the baseline tag, and EXACTLY the 14 forensic runs changed outcome. Evidence-pack changelog (section 11) archives the superseded value.

Verification

• CI green end-to-end (build + 15 ctests + regenerate + byte-identity gate): run 28712876792. The re-baselined campaign artifacts were adopted from CI's own Linux regeneration (run 28711955570) and independently verified by a bit-exact stdlib-Python replay of all 1000 runs (0 mismatches on every replay-reachable column incl. the new worst_abort_clearance at 1e-4 precision) plus an independent recomputation of every summary rate/CI/percentile.
• adversarial-verifier: SHIP (7/7) - re-derived the ellipse closed form from the STM algebraically and numerically (sub-mm), re-derived u* (boundary holds to the last digit), recomputed all rates from the raw CSV, confirmed R15 discipline (superseded value archived; 0.014 nowhere as a current claim; wp10 forensics CSV byte-identical to the WP10 merge), README parity, audit-artifact consistency, and full-population stream preservation vs the baseline tag.
• safety-claims-reviewer: 0 blockers; 2 of its 3 WARNs fixed in-branch (Wilson UB added to the roadmap bullet; TRL sections now explicitly say WP10/WP11 do not raise TRL per spec section 9). Deferred WARN, documented: the R14 [L0, ds-v1] tag is not in the C++-generated wp5_campaign_summary.md notes column (R14's scope is README/docs/evidence pack, which all carry it); scheduled for the next WP that touches campaign.cpp.
• Safety wording upgraded per spec section 1's rule, modestly and R15-documented: 'passively-safe approach design with clearing-verified aborts' + tagged numbers. 'Strict approach safety' and similar remain unused.

Also in this PR (owner-directed)

• Spec v5 section 2: interval rounding aligned to generated values ([0.0068, 0.0286] -> [0.007, 0.029]) - fixes spec conflict redesign: v2.0 closed-loop GNC, TMR UB fixes, honest README #2 from the WP10 report.
• Spec v5 section 6 WP15: added the baseline-release line (releases at phase boundaries; DOI-carrying archive stays a WP15 deliverable).
• WP10c forensics artifacts: the report is now the legacy-law ARCHIVE (CSV byte-identical to WP10c; md carries a supersession note) regenerated law-locked from the pinned seed recipe; new wp11_abort_audit.{csv,md} audits the committed campaign (hard-gated replay).
• CI-hardening mini-WP dependency: PR CI-hardening mini-WP: upload regenerated artifacts on gate failure (if: always()) #18 (artifact upload on gate failure) enabled the no-local-toolchain re-baselining workflow.

Spec-vs-repo observations (reported, not improvised around)

1. The safety-claims reviewer notes spec v5 section 1's conditional ('Until the WP11 completion criterion is met...') is now satisfied but the spec text itself is not annotated; the traceability lives in the evidence changelog and this PR. Owner may wish to annotate section 1 in a future spec revision (owner-authored document; not touched beyond the two directed edits).
2. Pre-existing README lines quote CI wall-clock runtimes (~10.7 s / ~70 s) - outside the generated/evidence gate and predating WP11; flagged by the adversarial-verifier for awareness.

🤖 Generated with Claude Code