# Powered hover, sampled recovery and shielded admission

Implementation revision: 2026-10-07. Scope: this hidden proof laboratory only.

This note explains the mathematical changes, their implementation boundary and the evidence required for this release. It supersedes the controller and ground-start descriptions in the earlier Play handoffs for new runs. Earlier validation files remain historical evidence for their explicitly identified commits.

## Sources read and source identity

The continuing-task handoff `PROOF_LAB_NEXT_AGENT_HANDOFF_20261006.md`, the repository `PLAY_HANDOFF.md`, and the fleet checkpoint and validation notes were read before implementation. The preceding light-show and implementation notes were also consulted. The two uploaded LaTeX addendums are retained verbatim in this directory.

| Source | SHA-256 |
| --- | --- |
| Uploaded sampled-latch addendum v01 | `f23cb924b2e499e8163a30757ae48b50feabc6c7f213ab1cce18e9244b0fe61d` |
| Uploaded shielded-admission addendum v01 | `83be4bab7c73e67d12a130a17201c0b616ab89ecfbc7ae1a7c2eb622b7dd8341` |
| Installed `mathematical-source.tex`, parent v05 | `7b1c7b3858b547eeb90331278cff33fb8049b7a5463009acc20026ee72bb0951` |
| Parent v05 cited by the supplied addendums | `165c9b5dda01ae9573a2af28f0b9bd78ec380bce653e594cc4a3ba4662260773` |

The last two identities differ. The cited parent file was not found in the available handoff, Library lookup or repository search. The installed file has not been replaced or represented as byte-identical to the cited file. The addendums' explicit equations and assumptions are the implementation contract; the installed parent controller remains available for comparison. This is a material provenance distinction, not a claim that the two full parent documents have been proved equivalent.

## Three nominal laws, measured rigid realization

The delayed priority state remains separate from nominal translational references and physical drones. There are three motion regimes:

1. Before disturbance activation, the original exact held-goal reference law.
2. The sampled common-translation latch from the first addendum, selected by default for wind.
3. Coherent recovery with the admission shield from the second addendum, selected automatically on admission. Standard shield release returns to ordinary coherent recovery.

The interface exposes the selected recovery law. Switching laws is an explicit finite intervention. It is not presented as a composition theorem. In particular, a live capture cannot silently switch into the sampled latch, and release does not use the old orb heuristic.

The nominal references and the physical drones have separate states and diagnostics. Thrust, tilt, speed and acceleration limits, attitude control, avoidance, contacts, gravity, aerodynamic drag and the finite fluid simulation belong to the physical realization. The supplied addendums do not prove that this realization satisfies their ideal-plant hypotheses.

### Coordinates and initialization

New runs create **300 active logical participants** and **2,500 powered physical chassis**, all at the 8 m hover plane. The chassis occupy a centre-out golden-angle spiral: the 300 active bodies take the innermost positions and 2,200 powered reserve bodies extend outward. The target formation is **hourglass** when Play is pressed. Firefly optics are enabled by default. Initial physical allocation is a new-run operation; live survivors are never repositioned, stopped or deleted to repair a formation.

The nominal coordinate frame is 8 metres below the displayed hovering frame. Thus `x_nominal = p_physical - [0,0,8]`. Velocities are identical in both frames. At first recovery activation, the separate nominal recovery state is initialized from the current physical state using this fixed coordinate conversion. Both sampled latches reset to zero, inactive, with zero timer and the supplied 0.75-second grace. Physical positions, velocities and actuator states do not change at that activation boundary.

### Priority endpoint μ versus physical centroid

`μ` remains the delayed-priority invariant endpoint. It is recomputed at every membership epoch from the **active logical support**, its retained priority histories, graph and delays, then projected through the active anchor table to obtain `muPoint`. Powered reserve chassis are not members of that support and do not enter the invariant. The instantaneous physical positions of the drones also do not define `μ`; replacing the invariant with a body centroid would change the mathematics.

For visual inspection, the additive light-show layer exposes a separate **active physical centroid** marker. That marker is presentation/diagnostic state only and does not enter priority, reference, latch, shield, transport or rigid-body equations.

The powered-hover adapter applies the same fixed lift to ordinary references, coherent references and sampled physical targets. Formation markers additionally receive the actual common translation of the selected recovery state. Reference points already contain that translation and receive the fixed lift only. This distinction prevents both origin-bound sparkles and a double-applied translation. Mathematical anchors, offsets, priorities and invariant endpoints are never edited for a rendering correction.

## Sampled-latch contract

`recovery-addenda.js` implements `SampledLatch`. In the live nominal specialization,

\[
\dot x_i=v_i,\qquad
\dot v_i=ab(r_i+q_i+\hat s-x_i)-(a+b)v_i+d_i.
\]

The original factorized analytic held-input propagator is used with the held disturbance incorporated into the target by `d/(ab)`. This is the exact real-arithmetic solution of that held nominal interval, evaluated in binary64. A separate general positive-K, positive-C helper is checked against an independent matrix-exponential series, including critical and overdamped cases.

The guard clock is always 120 Hz. It is independent of rendering, the user-selected outer physics rate, the priority frequency and video encoding. The scheduler splits at guard and priority boundaries. At a coincidence, the order is:

1. Complete plant flow and endpoint physical impulses.
2. Evaluate both sampled guards using the existing `q^-`.
3. Perform the priority update and expose `q^+`.

Constants match the supplied instance: position tolerance 0.55 m, speed tolerance 0.22 m/s, outward threshold 0.12 m/s, inward threshold 0.05 m/s, radial cutoff 1e-9 m and enabled returning hold of 0.24 s.

Settled tests are closed inequalities. Unsettled radial tests are strict. Settled bodies are skipped; their outward reduction is false and their returning reduction is vacuously true. Large position error at rest does not by itself trigger an outward guard.

| Availability / state | Action |
| --- | --- |
| Unavailable | Retain translation, active flag and timer |
| Inactive, no outward unsettled body | Retain all three |
| Inactive, an outward unsettled body | Activate, clear timer, recompute complete-cohort mean of `x-r-q^-` |
| Active, not every unsettled body returning | Recompute the same mean, clear timer, remain active |
| Active, every unsettled body returning | Hold translation, add exactly 1/120 s to the timer; exit when the timer reaches 0.24 s |

Empty or incomplete metadata, nonfinite observations, initial grace and an active controlled round-trip trial make the guard unavailable. There is no hidden reset inside an unavailable callback. Cohort or slot changes are finite interventions; the eventual fixed-cohort theorem starts after the final such change with the finite latch state then present.

From a zero timer, 29 consecutive **enabled returning calls** suffice to exit. This is not an unconditional elapsed-time bound when availability is intermittent. An active flag may already be holding the translation. Guard freezing and flag exit are distinct conclusions.

The physical guard reads the complete physical cohort in the fixed nominal coordinate frame. The nominal guard reads the complete nominal reference cohort. Their separate latches must not be conflated: only the latter is paired with the ideal analytic plant in the theorem implementation.

## Shielded admission

### Fixed incumbent slots and same-time information

An admission keeps every incumbent formation offset unchanged. The previous automatic admission reflow would change the very `r_i` used by the shield's premise and has been removed from that path. Explicit formation edits and subsequent departures remain separate recorded interventions. They restart the valid capture window when they affect a capture cohort.

Logical membership continues to use the existing full-history admission map. A returned chassis receives a fresh logical identity and keeps its actual physical state. The newcomer's nominal initial state is taken from that chassis in the fixed coordinate frame. The ordinary anchor policy remains bounded independently of the newcomer's physical distance. Explicit user changes to those assumptions are not silently promoted to distance-independent theorem instances.

For an immutable complete origin table at source time `s`, let

\[
h_i(s)=x_i(s)-r_i-q_i(s),\qquad \bar h_I(s)=|I|^{-1}\sum_{i\in I}h_i(s).
\]

The shield applies `h_i - mean_I h` to every member. For one newcomer this is algebraically identical to subtracting the incumbent mean from the full-cohort incumbent residual and multiplying the newcomer's full residual by `(n+1)/n`. The implementation uses the cancellation form directly, so a huge newcomer's residual is not introduced and then numerically subtracted from every incumbent correction.

The complete origin table still travels through the existing selected communication graph. Each receiver must actually have the full same-prefix, same-epoch table at commitment. The optimization checks table identity at every receiver and reuses the identical centering result. It saves repeated arithmetic; it does not invent frames, waive delivery, reduce frame counts or remove a resource assumption. Origin values remain immutable. The retained parent source is unchanged.

Before the first valid enlarged-cohort commit, the incumbent correction is centered to retain a zero-sum incumbent input. The newcomer has the declared zero waiting correction. This is a finite waiting policy; a partial mixed-time table is not treated as the shield.

### Complete-window release

Capture observations read the **complete nominal state**, including velocities. This observation is an explicit centralized simulation resource; residual frames alone do not imply that resource.

Define `e = x_new-r_new-mean_I(x_i-r_i)` and the analogous relative velocity. The chosen release thresholds are 0.30 m and 0.18 m/s. They are checked over complete intervals, not only at a favorable current sample.

The coherent scheduler splits at every sample, forward, delivery and commit time. On one exact held-input interval with common damping C, relative velocity is affine in `exp(-Ct)`. Its norm is bounded by the larger endpoint norm. Therefore

\[
\sup_{t\in[t_0,t_1]}\|e(t)\|
\le \|e(t_0)\|+(t_1-t_0)\max(\|\dot e(t_0)\|,\|\dot e(t_1)\|).
\]

This conservative bound and both velocity endpoints certify the entire interval. A failed interval clears the accumulated safe window. Release requires a continuously certified interval covering `[T-H,T]`, a coherent valid current support, no contract fault, and every committed or still-eligible pending source time inside that window. The pending epoch and in-flight frames are included. A stale source cannot be ignored simply because the newcomer is close now.

Standard release replaces the shield correction with the already committed ordinary full-cohort correction. It changes neither nominal position nor velocity, applies no velocity atom, and records source-window evidence. The optional impulse release in the addendum is not implemented or claimed.

The full shield correction need not sum to zero across incumbents plus newcomers. Diagnostics distinguish its applied sum, the incumbent sum and the ordinary full-cohort sum. The incumbent common mode is the protected mode during capture.

### Theorem-boundary enforcement

The supplied shield manuscript proves exactly one newcomer with a fixed incumbent cohort and fixed offsets during capture. The recovery core therefore still rejects an overlapping or multi-newcomer `beginAdmission` call. The application orchestration no longer rejects later membership requests: it places them in a FIFO queue and executes them only after the current capture has passed its complete history-window test and released to ordinary recovery.

A queued sequence therefore has the semantics **admit A → capture A → flush every still-actionable source frame → release A → execute the next queued departure/admission → start the required new nominal epoch → begin the next one-newcomer capture**. A requested Drones count above the current population is expanded into repeated single admissions; the queue stops after each admission until that capture releases. Consecutive departures may drain immediately because each departure is itself an atomic priority-membership intervention and explicitly starts a new nominal theorem epoch before the next queue item is processed.

Formation/objective offset edits and nominal gain edits remain blocked during shield capture because they would change the fixed quantities inside the active theorem interval. Outside capture, a cohort departure, fixed-offset/objective edit or nominal gain edit is treated as a new nominal theorem epoch with physical position and velocity retained. In sampled-latch mode both latches reset to the source-defined zero latch, inactive flag, zero timer and grace interval. In ordinary coherent-recovery mode the coherent transport is reinitialized on the current support. The offline Theorem-1 round-trip experiment bypasses live admission shielding entirely and stays under its own atomic-history contract.

The priority core still contains general finite batch membership algebra and binary64 performance tests. Those are not exposed as a multi-newcomer shield theorem. No theorem for indefinitely continuing churn, automatic topology repair or arbitrary switching is claimed. The earlier large-removal communication-loss problem remains deferred; the explicit graph-rebuild control is retained, and no new reconnection rule has been invented.

## Performance and numerical precision

The optimized code preserves binary64 priority values, the selected graph, every retained history age, all physical bodies, the 120 Hz guard and all required physics/transport events.

* Identical immutable initialized history tables share storage. A new computed table replaces an age in the ordinary way. All 17 default ages remain represented. Original-kernel comparisons check every serialized value after network evolution and supported interventions.
* Identical history tables and constant newborn rows are shared during a finite membership batch. No age is discarded.
* A batch of more than 64 admissions evaluates the real composed factor `(1-beta)^count` directly, instead of performing that same multiplication thousands of times for every old coordinate in every retained layer. This changes the sequence of floating-point roundings, not the real membership map or storage precision. Exact dyadic-rational checks test a 3,975-admission factor and show smaller aggregate rounding error than repeated multiplication in that fixture. Small batches retain the prior operation order. Nonpositive or unrepresentable mass is rejected before physical mutation.
* Reference and physical clearance diagnostics use a conservative spatial sweep. It excludes a pair only when a coordinate-distance lower bound exceeds both current distance and radius-adjusted clearance minima. Heterogeneous radii, coincident centers and large translations are tested against exhaustive comparisons. All scalar diagnostic results in the comparison fixtures are exactly identical.
* Camera motion avoids per-frame settings writes. Existing immutable graph summaries, instanced drawing, reusable visual buffers and the frame work budget remain in use. Automatic quality reduction is not the new default; detail quality is selected.

The current UI/resource ceiling is **2,500 participants**. A fully evolved native browser acceptance at that ceiling passed with all 17 retained histories and finite checked states; see `HOVER_ADDENDA_VALIDATION.md` for the exact run and timings. Earlier revisions were also stress-tested at 5,000 participants with 17 retained ages, positive rows and normalized mass. Those 5,000 measurements are retained as historical stress evidence, not as the present selectable limit or a GPU/browser FPS, hurricane or long-run stability guarantee.

At 2,500 participants the current selectable workload can still advance slower than wall time under the full delayed-history and rigid-body computation. Historical 5,000-participant stress tests contained 425 million numeric values across 17 dense history layers before sharing, about 3.4 GB of raw binary64 payload alone. Those historical measurements explain why the current ceiling was reduced. The renderer and lossless recorder wait for actual computed states; they do not substitute fewer participants or lower-fidelity equations.

## Play-tab spectacle controls

The Play tab is a compact working layer over the unchanged detailed parameter panels. It is ordered by the way the laboratory is normally manipulated rather than by the internal schema.

1. **Drones & formation** is open first. **Drones** is the first control, followed by motion objective, 2D/3D formation dimension, formation, formation spacing, and return/recover actions.
2. **Big effects** is open second: Speed / violence, storm, Collision chaos / jolt, Firefly phase locking and slow motion.
3. **Camera & recording** follows these groups but starts collapsed.
4. **Priority & delays** is collapsed and mirrors the important Experiment controls in one compact place: communication graph, mixing gain, priority update rate, delay generator, maximum directional lag, uniform lag, history depth, anchor/objective radius and initial cell radius.
5. Flight tuning, Collision tuning, Light show and Environment details remain collapsed.

Play-only slider footers are hidden to reduce vertical space; the detailed Experiment/Drone/View/Data panels keep their full controls and remain the authoritative fine-grained editors.

**Speed / violence** is a compound physical preset, not a priority/recovery-mathematics change. At maximum it requests a 250 m/s velocity cap, 200 m/s² acceleration-command cap, 1000 N collective-thrust authority, an 89° requested tilt limit, faster motor/attitude response and much lower drag. The zero end reproduces the deliberately calm-but-quicker 16 m/s / 18 m/s² default flight envelope, with 130 N thrust and 82° tilt authority so the rigid-body layer can actually approach that pace. **Collision chaos** uses an aggressive 160 m/s / 180 m/s² physical preset, disables predictive avoidance, keeps swept rigid-sphere contacts enabled and raises the contact-event budget. Saturation, contact-budget and finite-step diagnostics remain authoritative; these presets deliberately allow violent or infeasible runs and make no hardware-safety claim.

## Explicit settings persistence

Runtime control changes are session-only by default. A fresh browser state therefore starts at the declared defaults, including 300 active drones, Firefly optics on, and the **hourglass** formation target. Legacy records created by the former automatic-save behavior are ignored unless they carry the new explicit manual-save marker.

The **Save settings** button beside **Reset to defaults** is the only path that persists the current main laboratory parameters, Play/Firefly settings, and camera-mode/wave settings to local storage. Subsequent edits remain unsaved until Save settings is pressed again. Reset to defaults clears all three laboratory settings stores and reloads the defaults; unrelated browser storage is not cleared. Experiment export remains a separate full-state operation and is unaffected by this preference-save policy.

## Camera, fullscreen and lossless recording

Static fit follows only the active logical drones; powered reserve and returning/retired drones do not enlarge the automatic frame. Cinematic fit uses the same active set and adds independently parameterized sinusoidal azimuth and elevation. Amplitude, period, phase and framing margin are available in Play. Any manual orbit, pan, touch drag or mouse-wheel zoom releases automatic fit/cinematic/follow behavior and leaves the resulting camera under manual control until a view is explicitly selected again. Native fullscreen includes discreet playback, formations, recording and a button to show or hide the complete left panel. Space toggles playback outside form controls.

The formation list is generated from the canonical complete registry, grouped into 2D and 3D. It does not inherit a filtered list from the currently selected dimension.

HD recording uses a separate 1920 × 1080 renderer. Only its scene canvas is encoded. Menus and DOM controls never enter the capture. PNG frames are stored unmodified in a QuickTime MOV container. PNG compression is automatic and lossless; this is not a bitrate-based quality claim. Playback speed controls the simulation time represented by each 30 fps output sample. Slow motion can repeat an actual discrete physical state; no interpolation or skipped physics steps is used. Pause holds recording. Encoding backpressure slows capture instead of dropping a requested frame.

Origin-private temporary storage is used when available. Finalization consumes its byte stream into an independent browser Blob before removing the temporary backing file, so removal cannot invalidate an in-progress download. This avoids a whole-video JavaScript ArrayBuffer; browser-managed finalization can still require additional temporary storage. The memory fallback automatically saves at 512 MiB without discarding prior frames. Lossless files can be large and player codec support differs; no MP4-size or universal-player guarantee is made. The writer also supports explicit sample durations and 64-bit data offsets. Independent FFmpeg decoding verifies HD RGBA byte equality.

Experiment JSON is gzip-compressed when saving, and both compressed and older plain files are accepted. The existing prohibition on exact state save/restore during wind/recovery remains explicit, because a complete fluid/transport checkpoint is not implemented. Video recording works during wind and admission and does not depend on that checkpoint function. Very large full-state JSON exports remain constrained by browser memory.

## In-lab source citations

The **Mathematics** button in the top-right masthead opens the laboratory's IEEE-style references and scope notes. The list includes HORTRAME contracts, the rigid-flight and Firefly references, Blondin–Hale's ACC 2020 multi-objective optimization paper, and Naderi–Blondin–Roy's arXiv:2603.16523v1 delay-consensus paper. The conference paper retains its published authors and links its earlier preprint separately. The Naderi entry shows Guillaume Bolduc as fourth author with an explicit authorship-update-pending note; the note preserves the linked arXiv v1’s current three-author list. No source PDF or public arXiv metadata is changed. Citation does not imply that every theorem or protocol in a source is implemented. The popup distinguishes mathematical contracts from physical, rendering and performance layers.

## Verification and review status

Finite regression tests cover source identities, strict thresholds, bypass state, exact held flow, guard/priority ordering with mismatched clocks, translation symmetry, shield algebra, distance-independent incumbent trajectories, real transport, whole-window release, physical retirement and reuse, scene framing, HD pixel round trips, immutable history equivalence and exact-rational batch accuracy.

The native browser acceptance script additionally exercises actual WebGL, fullscreen, the complete formation list, wheel override, live admission, compressed state saving and real canvas recording. Its report and screenshots are retained in the corresponding GitHub Actions artifact; the release validation note records the actual run rather than treating unit stubs as browser evidence.

This implementation and its test analysis were prepared with AI assistance. No independent mathematical audit, formal verification, rigid-body convergence theorem, hardware safety theorem or universal performance bound is claimed. The goal is a source-explicit, testable implementation with the limitations visible alongside the equations.


### Binary64 storage follow-up

After the separate preview checkpoint `c909593d57d36f09e69e658f1f5f7426ec96b5b5`, priority rows were moved to `Float64Array` payloads. Generated and evolved dense tables allocate one contiguous buffer per table. Their row views retain ordinary JSON array serialization; imported JSON and structured-cloned views are validated before packing. Membership maps retain the original coordinate arithmetic and compute each immutable input table once. The generated random sequence, receiver/source/coordinate summation order, all history ages, positivity checks, physical steps and transport service remain unchanged. The reviewed priority-core SHA-256 is `75ae1ef2527eac6380b6069bccb5f255748ed95412b70f2bee792303da0d5916`; the earlier preview kernel was `4ea6eeaa7f51ead95d3019a6d2ead08170f2e1705865ec84d0b81ef9dafa2b19`.

All 112 scoped tests pass locally. Three additional finite oracle tests compare every stored probability with `Object.is` against the preserved original kernel through 24 updates over three graphs and both constant/independent histories; heterogeneous admission, survivor conditioning and finite batches; fork isolation; ordinary JSON/editor values; and restart continuation from structured-cloned views. Invalid source rows remain rejected before conversion. The large-batch rounding qualification above still applies separately.

A 20-update run with 5,000 participants and Node's default heap settings completed with all 17 distinct evolved tables, positive probabilities and normalized rows. Initialization was 4.46 s; network updates were 478–766 ms; diagnostics were 178–399 ms. Observed memory at the final sample was 4.24 GB RSS, 434 MB JavaScript heap and 3.60 GB ArrayBuffer payload including a not-yet-collected table. The previous boxed-array 20-update profile used about 4.96 GB RSS and 4.69 GB JavaScript heap with a 6 GiB heap allowance. These are separate finite runs, without a peak/live-memory or real-time guarantee. The separate default-heap browser follow-up passed all 13 acceptance groups in run 37565997695, at commit `c571b3a35c352182e0a4f68f5b266a0cdc204e1c`, including 192 physical steps and 17 distinct evolved history tables at 5,000 participants. See [HOVER_ADDENDA_VALIDATION.md](./HOVER_ADDENDA_VALIDATION.md) for exact scopes and timings.