WP12 - Fidelity ladder: L0/L1/L2 propagation + L4/L5 elements; zero keep-out violations re-verified per level

[HeliCorgi]

WP12 (adsc-specification-v5.md section 6) - fidelity ladder through L2 with L4/L5 elements

Runtime-selectable propagation levels on ONE code path (no fork; 'build-selectable' realized as run-time-selectable within one build - strictly stronger): L0 the original linear CW baseline, kept - every committed campaign number byte-identical; L1 full inertial two-body+J2 of both craft differenced into the target LVLH frame (the one documented conversion, R8); L2 +per-craft drag (Vallado density, R1 reuse) with ballistic-coefficient uncertainty from an INDEPENDENT dispersion stream (ds-v2 = ds-v1 + BC stream; the committed ds-v1 draws untouched).

Mandatory cross-validation (tested, ctest ladder)

L1 with J2 disabled reproduces the L0 CW closed form within a stated 2.0 m epsilon - the CW LINEARIZATION error itself (the J2-off path is the full nonlinear two-body problem), measured worst case 0.52 m (SL-16/340) across the WP1 424.3 m scenario re-derived from its own corridor sweep, all 14 forensic-14 post-abort coasts, and the standoff case. L2 with drag disabled reproduces L1 bit-for-bit (same code path). Attitude pins (19.15/16.87/17.07) untouched by construction - no translation content.

Results (generated/wp12_ladder.{csv,md}, R14-tagged per level)

• Zero keep-out violations at every level, both catalogs (292+291 committed abort events re-verified with the UNCHANGED WP11 clearing law; Wilson UBs 0.0130/0.0130): clearance floor 20.0 m (L0) -> 18.8 m (L2, SL-8, the tighter catalog). The anticipated CW-safe-but-higher-level-unsafe case does NOT materialize for this dispersion set - the WP11 margin absorbs the measured ~1.0-1.2 m J2+drag erosion. A negative-negative result, reported with the same discipline as a positive one (spec v5 sections 6/10).
• Forensic-14 clears at every level (per-level table committed; the x0>0 cases actually improve at L1, consistent with the independently measured linearization signs).
• Margin decay measured (the F2 caveat, promised qualitatively since WP1): worst 1.40 m min-range erosion over 5 orbits on the 400 m standoff ellipse [L1].
• L4 estimate-driven guidance: the guided approach flies on the translation EKF's estimate (truth = error recording only) under measurement dropout + an UNESTIMATED range-bias walk; truth-evaluated contact speed 0.0998 m/s (gate 0.15). Honest consistency finding, stated in the pack AND README: NIS 3.99 (ideal ~4, consistent) but NEES ~310 vs ideal ~6 - the filter is OPTIMISTIC about its own accuracy under the unestimated bias walk; bias states are the identified fix. This closes WP11's truth-fed-only known limit.
• L5 actuator model retires the continuous-torque caveat by measurement: sync at 16.28 s vs 16.87 s continuous under a delta-sigma minimum-impulse-bit actuator (MIB 2e-4 N m s PLACEHOLDER) + 1-step command delay + single-axis 50% fault; translation MIB (1e-3 m/s) still meets the contact gate. The README known-limit carried since WP3 is retired with numbers, honest remainder stated.

Two findings the CI-as-laboratory loop produced (documented, not patched over)

1. My initial 0.5 m cross-validation epsilon was falsified by measurement: the CW linearization error alone reaches 0.52 m at the largest forensic excursions. The stated epsilon is now 2.0 m with the measured justification in the test and header.
2. Per-step round-to-nearest MIB quantization was falsified as a model: it deletes every sub-bit command per step - including the continuous feedforward that tracks a precessing target - so the hold never converges. Replaced by the delta-sigma (duty-cycled) quantizer real pulsed DACS hardware implements: firings stay integer bits, mean torque tracks the command. The falsified variant is documented in the code comments.

Discipline

• No pinned number moved (R15 not triggered): wp5_campaign_runs.csv byte-identical to master (verified independently at artifact level AND by the adversarial-verifier); reference_metrics legacy rows byte-identical (+9 wp12 rows); summary CSV/md differ ONLY in the two keep-out note strings (the [L0, ds-v1] tag - closes PR WP11 - Safety hardening + closed-loop guidance: clearing-abort law, reachability screen, keep-out 0 of 500 [L0, ds-v1] #19's deferred WARN, the ride-along authorized for this WP); wp10/wp11 artifacts untouched.
• CI green end-to-end: run 28723189583 (16/16 ctest + regenerate + byte-identity gate) on the full tree; artifacts adopted from CI's own Linux regeneration (run 28722765714).
• adversarial-verifier: SHIP - from-scratch reimplementation reproduced the worst linearization diff to six digits (0.520309 m, same case), all 14 L1 J2-on ladder values to <=5e-5 m, per-level Wilson bounds exactly, L0 floors == the WP11 audit, and full byte-discipline vs master.
• safety-claims-reviewer: found ONE genuine pre-existing BLOCKER - a 'minimum-cost allocation' phrase in the evidence pack (banned as an absolute claim by spec v5 section 1) that had never been in the claims-audit regex list. Fixed to cost-effectiveness framing AND the audit now enforces a minimum-cost regex permanently. Its WARNs (spec-phrase drift 'clearing-'->'clearance-verified'; an under-tagged zero-claim; the ambiguous 'compliant clamp') are all fixed in-branch; the verifier's cosmetic finds (stale eps comment; the canonical safety phrase absent from the pack's summary) fixed in-branch.

Ride-alongs (owner-directed)

• Spec v5 section 1: the exact authorized replacement is in, using the file's unicode conventions: 'passively-safe approach design with clearance-verified aborts (keep-out violations 0/500 per catalog [L0, ds-v1, Wilson <= 0.0076])', plus the appended note that the WP11 criterion is met and WP12 re-verifies at L1/L2.
• README wall-clock CI timings de-pinned to approximate form citing the Actions log (PR WP11 - Safety hardening + closed-loop guidance: clearing-abort law, reachability screen, keep-out 0 of 500 [L0, ds-v1] #19 verifier observation).

Spec-vs-repo observations (reported, not improvised around)

1. Spec v5 section 1's rationale clause 'because the current campaign shows a nonzero keep-out violation rate' is now factually stale (the committed campaign shows 0/500) and sits next to the new criterion-met note. Tightening it is the owner's call (e.g. 'because a zero point estimate still carries a nonzero Wilson upper bound'); not edited beyond the authorized replacement.
2. The 'measured worst 0.52 m' linearization figure lives in prose/comments; CI enforces only the 2.0 m ceiling. If the forensic states or emitter change, that prose figure could go stale silently - candidate for a printed/generated value in a future WP (adversarial-verifier observation).
3. L3 (SRP) is not implemented - the WP12 completion criterion is 'through at least L2 with L4/L5 elements', which this PR meets; L3 remains for a later WP and the ladder md's coverage statement says exactly what is and is not verified.

Completion criteria (v5 section 6, WP12): ladder implemented through L2 with L4/L5 elements - met; per-level comparison table in the evidence pack - met (section 3, from wp12_ladder.csv mechanically); 'which model verifies what' section - met (the pack subsection and the ladder md coverage statement; phrased without the banned word the spec's own shorthand uses); mandatory cross-validation tested - met (ctest ladder); adversarial-verifier independently re-derived the J2-off cross-validation and per-level rates before this PR opened - met.

🤖 Generated with Claude Code