# Independent imperfect-state safety study

Protocol `fa1fe42361c602cc7761a31a310f837eec65abd07667c59fef4fdeebfbf1fab1`; frozen core `e60c90a1121209969da7b80cf1ea0f39a57a61f0`.

**288/288 episodes complete**; 0 failed, 0 interrupted, 0 unattempted. No replacement seeds.
Completed evidence: **36,864 steps, 221,184 agent-steps, 552,960 pair-steps**.

**No flight guarantee, no promotion, and no Gaussian strict certification.** This is an independent toy simulator, not a new validation of the frozen production planner.

## Safety and mission outcomes

Each complete stratum: 16 episodes, 2,048 steps, 12,288 agent-steps, 30,720 pair-steps, 96 agent missions. Progress = mean fractional reduction in distance to fixed opposite-side goals; it is not clipped. Arrival is ever within 1 m, not landing.

| Condition | Controller | Complete | Collision episodes | Collision pair-steps | Wall agent-steps | Min distance m | Progress % | Arrivals / agent missions | Coverage % | Path m/episode | Fallback / agent-steps |
|---|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|
| nominal | oracle | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.488 | 100.0 | 96/96 | 21.9 | 133.5 | 0/12288 |
| nominal | naive | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.488 | 100.0 | 96/96 | 21.9 | 133.5 | 0/12288 |
| nominal | aware | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.488 | 100.0 | 96/96 | 21.9 | 133.5 | 0/12288 |
| state_noise | oracle | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.488 | 100.0 | 96/96 | 21.9 | 133.5 | 0/12288 |
| state_noise | naive | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.431 | 99.7 | 96/96 | 22.0 | 143.5 | 4/12288 |
| state_noise | aware | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.854 | 99.7 | 96/96 | 22.9 | 145.5 | 33/12288 |
| latency | oracle | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.488 | 100.0 | 96/96 | 21.9 | 133.5 | 0/12288 |
| latency | naive | 16/16 | 16/16 | 768/30720 | 0/12288 | 0.009 | 96.6 | 91/96 | 23.3 | 210.0 | 1707/12288 |
| latency | aware | 16/16 | 9/16 | 89/30720 | 0/12288 | 0.837 | 39.4 | 0/96 | 17.5 | 158.0 | 9138/12288 |
| packet_drop | oracle | 16/16 | 3/16 | 286/30720 | 0/12288 | 0.909 | 93.5 | 84/96 | 21.5 | 126.1 | 1160/12288 |
| packet_drop | naive | 16/16 | 4/16 | 377/30720 | 0/12288 | 1.063 | 92.1 | 81/96 | 21.2 | 123.9 | 1409/12288 |
| packet_drop | aware | 16/16 | 7/16 | 790/30720 | 0/12288 | 0.595 | 78.7 | 58/96 | 20.4 | 108.8 | 3180/12288 |
| wind | oracle | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.488 | 100.0 | 96/96 | 21.8 | 132.7 | 0/12288 |
| wind | naive | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.521 | 99.9 | 96/96 | 21.8 | 136.5 | 0/12288 |
| wind | aware | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.521 | 99.9 | 96/96 | 21.8 | 136.5 | 0/12288 |
| combined | oracle | 16/16 | 0/16 | 0/30720 | 0/12288 | 1.209 | 98.6 | 94/96 | 21.6 | 134.9 | 214/12288 |
| combined | naive | 16/16 | 16/16 | 1360/30720 | 0/12288 | 0.010 | 93.5 | 85/96 | 24.0 | 207.8 | 2778/12288 |
| combined | aware | 16/16 | 1/16 | 86/30720 | 0/12288 | 0.323 | 34.2 | 0/96 | 18.6 | 140.7 | 9759/12288 |

![Mission progress](figures/mission_progress.svg)
![Collisions](figures/collisions.svg)
![Coverage](figures/coverage.svg)
![Fallback](figures/fallback.svg)

## Transport and information audit (separate from geometry)

| Condition | Controller | Drops / attempts | Held on loss | Expired / agent-steps | Drop changed execution | Position / bounded estimates | Velocity / bounded estimates | False bound / claims |
|---|---|---:|---:|---:|---:|---:|---:|---:|
| nominal | oracle | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/12288 |
| nominal | naive | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/0 |
| nominal | aware | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/12288 |
| state_noise | oracle | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/12288 |
| state_noise | naive | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/0 |
| state_noise | aware | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/12255 |
| latency | oracle | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/12288 |
| latency | naive | 0/12288 | 0 | 0/12288 | 0 | 0/72576 | 0/72576 | 0/0 |
| latency | aware | 0/12288 | 0 | 0/12288 | 0 | 0/72576 | 0/72576 | 0/3150 |
| packet_drop | oracle | 3675/12288 | 2576 | 1099/12288 | 2581 | 0/73728 | 0/73728 | 0/11128 |
| packet_drop | naive | 3675/12288 | 2576 | 1099/12288 | 2504 | 0/73548 | 0/73548 | 0/0 |
| packet_drop | aware | 3675/12288 | 2576 | 1099/12288 | 2028 | 0/73548 | 0/73548 | 0/9108 |
| wind | oracle | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/12288 |
| wind | naive | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/0 |
| wind | aware | 0/12288 | 0 | 0/12288 | 0 | 0/73728 | 0/73728 | 0/12288 |
| combined | oracle | 3675/12288 | 2576 | 1099/12288 | 3626 | 0/73728 | 0/73728 | 0/12074 |
| combined | naive | 3675/12288 | 2576 | 1099/12288 | 3594 | 0/72051 | 0/72051 | 0/0 |
| combined | aware | 3675/12288 | 2576 | 1099/12288 | 3608 | 0/72051 | 0/72051 | 0/2529 |

## Progress cost and empirical age envelopes

Stationary means actual speed <0.05 m/s. Max error and max bound below are separate extrema, not a ratio or a quantile calibration claim. Per-sample support exceedances are in the table above.

| Condition | Controller | Stationary / agent-steps | Final at goal / missions | Mean effort integral | Shared coverage % | Max telemetry age s | Max position error m | Max position bound m |
|---|---|---:|---:|---:|---:|---:|---:|---:|
| nominal | oracle | 4734/12288 | 96/96 | 92.74 | 21.9 | 0.00 | 0.000 | 0.000 |
| nominal | naive | 4734/12288 | 96/96 | 92.74 | 21.9 | 0.00 | 0.000 | 0.000 |
| nominal | aware | 4734/12288 | 96/96 | 92.74 | 21.9 | 0.00 | 0.000 | 0.000 |
| state_noise | oracle | 4734/12288 | 96/96 | 92.74 | 21.9 | 0.00 | 0.000 | 0.000 |
| state_noise | naive | 527/12288 | 96/96 | 185.55 | 22.0 | 0.00 | 0.253 | 0.255 |
| state_noise | aware | 488/12288 | 96/96 | 198.72 | 22.9 | 0.00 | 0.253 | 0.255 |
| latency | oracle | 4734/12288 | 96/96 | 92.74 | 21.9 | 0.00 | 0.000 | 0.000 |
| latency | naive | 202/12288 | 91/96 | 575.45 | 23.3 | 1.00 | 1.125 | 1.125 |
| latency | aware | 200/12288 | 0/96 | 572.09 | 17.4 | 1.00 | 1.125 | 1.125 |
| packet_drop | oracle | 5338/12288 | 84/96 | 91.77 | 21.5 | 0.00 | 0.000 | 0.000 |
| packet_drop | naive | 5466/12288 | 81/96 | 89.75 | 21.2 | 1.75 | 2.175 | 3.150 |
| packet_drop | aware | 6074/12288 | 58/96 | 106.72 | 20.4 | 1.75 | 1.725 | 3.150 |
| wind | oracle | 4870/12288 | 96/96 | 92.64 | 21.8 | 0.00 | 0.000 | 0.000 |
| wind | naive | 2461/12288 | 96/96 | 95.52 | 21.8 | 0.00 | 0.000 | 0.000 |
| wind | aware | 2461/12288 | 96/96 | 95.52 | 21.8 | 0.00 | 0.000 | 0.000 |
| combined | oracle | 3639/12288 | 94/96 | 102.87 | 21.6 | 0.00 | 0.000 | 0.000 |
| combined | naive | 127/12288 | 76/96 | 503.78 | 23.7 | 6.25 | 9.661 | 44.810 |
| combined | aware | 182/12288 | 0/96 | 477.33 | 18.5 | 6.25 | 8.393 | 44.810 |

Actual actuator violations: **0 / 221184 agent-steps**. Cruise speed is a reference, not a physically enforced speed limit; exceedances are retained in JSON. State is never clipped to walls.

## Calibration

Uniform radial support: sqrt(2) times per-axis halfwidth. **0/100000** probe violations; empirical radial maximum 1.412716 vs declared 1.414214.
Gaussian illustrative 3-sigma radial ball: **1195/100000** outside (theoretical probability exp(-4.5)). This is NOT bounded support. Aware response: `unbounded_information_brake`, claim=False.
Independent randomized Euler propagation checks: **0/4096** violations. Calibration probes are not added to the 288 episode denominator.

## Paired aware minus oracle differences

Descriptive 95% Student-t intervals across the same 16 seeds (df=15), not independent-step inference; no multiplicity correction. Full aware-naive and naive-oracle contrasts are in summary.json.

| Condition | Paired n | Progress difference pp [95% interval] | Collision pair-steps difference [95% interval] |
|---|---:|---:|---:|
| nominal | 16 | 0.00 [0.00, 0.00] | 0.00 [0.00, 0.00] |
| state_noise | 16 | -0.27 [-0.30, -0.24] | 0.00 [0.00, 0.00] |
| latency | 16 | -60.57 [-61.07, -60.06] | 5.56 [1.77, 9.35] |
| packet_drop | 16 | -14.79 [-25.26, -4.31] | 31.50 [-17.92, 80.92] |
| wind | 16 | -0.10 [-0.12, -0.09] | 0.00 [0.00, 0.00] |
| combined | 16 | -64.39 [-67.25, -61.53] | 5.38 [-6.08, 16.83] |

## Frozen research gates (not deployment gates)

- PASS: `all_288_complete`
- PASS: `exogenous_pairing_verified`
- FAIL: `aware_zero_collision_and_wall_events`
- PASS: `aware_zero_false_conditional_bounds`
- PASS: `all_actuators_bounded`
- FAIL: `aware_mean_progress_at_least_half_each_condition`
- FAIL: `aware_progress_noninferiority_to_oracle_5pp_each_condition`

No zero-motion success claim: progress, arrivals, true footprint coverage, path length, stationary fraction, and effort are jointly reported. Failing a progress gate rejects favorable safety-only interpretation.

## Assumptions and limitations

- Planar piecewise-linear Euler plant, no obstacles, battery, altitude, real aerodynamics, or field planner.
- Exact clock, identity, world geometry, goals, and declared uniform/wind support are assumptions.
- Oracle alone sees true current state and current wind; candidates do not.
- One-step bound checks are conditional reachability enclosures, not recursive feasibility or safe-stop certificates.
- Fallback braking uses estimated/nominal velocity; packet expiry is zero effort, not guaranteed braking.
- Gaussian measurements have no finite strict support and force aware fallback; not a Gaussian episode study.
- Coverage is evaluator-ground-truth footprint coverage, not a localization-robust mapping algorithm.
- 16 paired seeds per stratum; descriptive t intervals have no multiplicity correction or population safety interpretation.
- Command-drop collision co-occurrence is not causal attribution; all command outcomes are separately counted.
- Runtime file snapshots do not include macOS shared-cache library bytes; OS/build and NumPy metadata identify those dependencies.

## Provenance and durability

Explicit source/runtime byte snapshots and hashes are in `protocol.json` and `snapshots/`. Per-episode `start.json`, fsynced hash-chained `journal.jsonl.gz`, and `result.json` preserve measurements, controller inputs, requested/executed commands, truth, audit, and failures. Resume verifies every attempted job and never retries failed/interrupted identities. Hashes detect corruption, not an adversary rewriting all evidence.

See `docs/IMPERFECT_STATE_STUDY.md` for frozen dynamics, channels, uncertainty equations, scope, and reproduction commands. `verification.json` records the independent persisted-trajectory re-audit. Runtime is descriptive only.