Fix observation admission, Orrery state, and provider recovery

[Protonmatter]

Outcome

Prevent missing activity observations from changing the analysis or reducing uncertainty, reject unusable critical provider payloads, and keep Solar System time and selected facts consistent across navigation and date changes. Repair malformed provider-cache entries instead of repeatedly returning them.

For example, a bundle containing only wind/magnetic context previously changed a 0.2 activity prior to 0.76 and reduced variance from 0.04 to approximately 0.008. It now retains the prior, variance and Synthetic mode. A paused System scene no longer advances with wall time after leaving and returning; Halley's distance updates with its displayed epoch without reselection.

The patch also derives daily cycle-stage labels from established thresholds, makes series text output explicitly LF, removes unreferenced empty GPU prototypes and redundant helpers, repairs registry documentation links, and prevents idle browser preconnections from blocking the smoke-test server.

CI's assimilation round-trip now builds the native CLI and tests explicit fresh, missing and stale synthetic reports from the real Python producer. It requires the expected analysis or withheld mode, prior/variance behavior, strict JSON, full snapshot validation and research-only readiness after 48 transport steps; it cannot skip when the native CLI is required.

Specification and traceability

• Requirements: SOL-CONTRACT-001, SOL-SCI-001, SOL-DATA-001, SOL-DET-001, SOL-UX-002, SOL-UX-003, SOL-TEST-001 and SOL-DOC-001.
• RFC: existing docs/rfcs/0002-correctness-delivery-and-experience.md; these corrections enforce the accepted evidence, recovery and experience boundaries.
• ADR: not required; no new runtime architecture or public provider boundary.
• Governing specification: docs/SPEC.md, docs/TRANSACTIONAL_FEED.md, docs/EPHEMERIS_V3.md; compatibility details in docs/review_activity_fix.md.
• Non-goals: daily Orrery PR automation, credentials/settings changes, auto-merge, deployment, new scientific calibration or canonical moon qualification.

Correctness and risk

• Inputs, outputs, and failure behavior: new Python reports distinguish illustrative activity defaults from an explicit available/unavailable observation descriptor. CLI analysis requires fresh attributable contributors and matching evidence. HTTP-success error envelopes and critical products without eligible numeric observations cannot become healthy candidates. Failed strict ingestion retains the previous derived selection; empty optional event catalogues remain legitimate.
• Compatibility or migration: historical snapshots remain readable. Older Python blends with ambiguous activity-contributor freshness are withheld from new analysis. Existing simple/native observation reports retain their historical contract. The descriptor uses the existing extensible observed-context object; public snapshot versions are unchanged. Provider cache namespace v7 uses an internal exact-request envelope; old entries rebuild lazily, with no bulk deletion. The provider requires the repository's existing validators and schema.
• Scientific/accuracy/provenance impact: count and monthly fallback evidence follows the active contributing row; original source bytes remain immutable. Stage thresholds have a shared literal Python/Rust/JS corpus. Phase-based cycle-series labels are unchanged. No empirical calibration, new astronomical accuracy or operational forecasting is claimed.
• Privacy/security/dependency impact: no new dependencies, telemetry, credentials or remote endpoints. Cache reads are bounded and use strict JSON/full-contract validation; numeric overflow and excessive nesting are rejected. Public helper exports remain intact and are reused.
• Release risk, monitoring, and rollback: principal risks are contributor-admission compatibility and cache migration, covered with positive/negative and producer-consumer tests. Review exact CI results before merging. Revert this change to restore previous behavior; cache namespaces are independent. The existing master CI/Pages pipeline is unchanged.

UI and UX

• Primary task and disclosure-level impact: retain paused/accepted System epoch on reentry/retry; update selected comet/dwarf distance and light time on slider and animation changes.
• Keyboard, focus, touch/pointer, responsive, and reduced-motion evidence: detail updates retain DOM nodes, keyboard focus and open disclosure state. Automated staged browser and rendering checks include 390px layout and existing disclosure/motion behavior. This is not physical-device qualification.
• Loading, empty, success, degraded, unavailable, and error states: explicit Now/date controls remain functional. Paused context recovery retains epoch; CPU detail facts update during graphics loss. Invalid cache entries rebuild once; invalid rebuilt data returns a typed error.
• Manual usability/accessibility checks: screen readers, Safari/Firefox, physical touch and native-GPU/HDR were not re-qualified in this patch.

Validation evidence

• Unit tests cover positive, boundary, and negative cases where applicable.
• Contract/integration tests cover producer-consumer boundaries where applicable.
• Browser end-to-end and visual assertions cover user-visible rendering where applicable.
• Deterministic series generation and the supported local numerical diagnostic pass; canonical-generation limitation is recorded below.
• Rust, Python, Node, and whole-web coverage gates remain at least 90%: all hosted coverage gates passed on the final PR head.
• Locally unavailable checks are named and left to required CI.

Commands and results on the unchanged local patch:

npm test: 1,395 passed
PYTHONPATH=tools python -m unittest discover -s tests/python -p 'test_*.py' -v: 425 passed
python -m unittest discover -s services/ephemeris-server -p 'test*.py' -v: 36 passed
cargo test --workspace --locked: 194 passed
cargo fmt --all --check: passed
cargo clippy --workspace --all-targets --locked -- -D warnings: passed
node --check across application/tool JS and MJS: 186 files passed
python tools/typecheck_web.py: passed
python tools/validate_sdlc.py: passed
python tools/validate_docs.py: passed
python tools/validate_ux_contract.py: passed
python tools/validate_web_static.py: passed
python tools/build_wasm.py --locked --out-root build/fixes-wasm: passed
python tools/browser_smoke.py --web-root build/fixes-site: passed
node tools/browser_validation.mjs --web-root=build/fixes-site: passed
node tools/check_node_coverage.mjs: lines 98.28%, branches 91.21%, functions 96.12%
node tools/merge_web_coverage.mjs --web-root=build/fixes-site --minimum-lines=90: 97.48%
Python configured branch-inclusive aggregate coverage gate: 91%, passed
Eight additional rendering suites, including context loss: 8/8 passed
Original two Orrery failure probes: both now pass
Series regeneration: 11 frames plus manifest byte-identical to committed data
Linux ARM64 read-only/no-network moon validation: 11,985 held-out checks passed
git diff --check: passed

Local environment: Windows ARM64, Python 3.14.3, Node 24.18.0, Cargo 1.96.0, Chrome 153.0.8010.48; local Coverage.py 7.13.5. These differ from the CI pins. The core Node/Python/Rust suites were rerun before publication, and file hashes were checked against the staged-browser/coverage-tested tree. Independent review found and verified additional contributor-evidence and cache-overflow edge cases; its final scoped review found no remaining actionable issues.

Hosted validation on bba14d4f84b796aea164afc7b6977f753a62e1cf: all 20 checks passed, including the release gate. CI, Coverage, and Docs all completed successfully. Hosted Rust line coverage was 95.67%; hosted Python aggregate coverage was 91.47%. GitHub's tested PR merge tree was verified equal to the pushed head's tree.

The existing Windows ARM64 moon-regeneration byte difference remains documented. The successful Linux ARM64 diagnostic does not qualify the separately pinned Linux x86_64 image. Authoritative moon data, expected hashes, tolerances and pending qualification status are unchanged. Local cargo-llvm-cov is unavailable, but the hosted Rust coverage gate passed. No deployment evidence is claimed for this PR.

Documentation

• README and contributor-facing publication claims remain accurate; broken navigation links now use verified versioned documentation/source pages.
• Governing specification and compatibility documentation reflect the correction; existing requirement/RFC scope is retained, with no new architecture or implementation-plan scope.
• Operations, transactional-feed, provider-cache and local handoff documentation are updated where affected.
• User-visible claims and help match implemented behavior; historical publication and source attribution are preserved.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T03:06:24.056776Z	bba14d4	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.