Geometry-Certified Write-Protected State: Label-Blind Audit Design

Decision and scope

This is a new research branch after the sealed V6a.1 mechanism failure. It is not V6a.2 and does not modify V5, V6a, V6a.1, the typed state, or the fixed renderer. The first executable stage is a zero-training audit. Training is blocked until this audit establishes that context RGB and calibrated context cameras can produce useful, independently checkable 3D observations.

The preserved project backbone is:

multiple calibrated context RGB observations
-> target-independent typed metric 3D state
-> fixed zero-parameter measurement program
-> RGB / depth / normal / point / visibility / risk

The candidate extension is:

context-only correspondence proposals
-> reciprocal + epipolar + cycle + cheirality + reprojection certification
-> conditional ray certificates
-> certified free prefix / surface interval / behind-surface unknown / conflict / provenance
-> unknown-only completion
-> unchanged fixed measurement program

This stage implements and tests only the certificate builder and its post-hoc evaluator. It does not yet write certificates into the production state or train a completion network.

Claim boundary

Matching, triangulation, epipolar filtering, occupancy, free/occupied/unknown semantics, TSDFs, and preserving measurements are not claimed as individual contributions. G2SR already occupies a direct learned-proposal plus geometric-triangulation route, while MatchNeRF, EpiS, MVSplat, MVSGaussian, eFreeSplat, VGGT, MapAnything, NeuralRecon, TransformerFusion, TSDF/OctoMap, and scene completion occupy important neighboring components.

The only provisional contribution is the combined, counterfactually testable contract:

• learning or image similarity may propose an observation but cannot certify it;
• fixed geometry decides what may enter the measured state;
• completion may write only unknown regions and cannot overwrite a certificate;
• one fixed renderer reads every measurement;
• every output remains attributable to measured or completed evidence.

The NeuralRecon/TransformerFusion/TSDF/scene-completion equivalence check remains incomplete. The arXiv interface returned HTTP 429 during the pre-implementation check. No CVPR novelty claim is authorized by this design or by a passing audit.

Frozen audit protocol

The audit uses only prepared Hypersim development-train scenes. Final-holdout and diagnostic-test partitions are excluded. Windows are selected deterministically from scene IDs and the fixed seed 17. Four consecutive context frames are used; no target frame is required for certificate construction.

The proposer is a frozen Kornia LoFTR model with ScanNet indoor_new weights. It is context-only, receives grayscale image pairs, is never fine-tuned, and is not a claimed contribution. Its native dual-softmax confidence threshold is fixed at 0.2. Geometry, rather than LoFTR confidence, determines whether a proposal may be certified. The exact weights file and SHA-256 are recorded by the runner.

Certification is cumulative:

1. raw: LoFTR proposes a finite pair with native confidence at least 0.2;
2. reciprocal: the reverse pair set returns within 1.5 px in both images;
3. cycle: source -> matched -> deterministic third view -> source closes within 2.0 px;
4. geometric: the proposal lies within 1.5 px of the calibrated epipolar line, DLT triangulation has positive depth in both source views, triangulation angle is at least 1.0 degree, and source-pair reprojection error is at most 1.5 px;
5. certified: the triangulated point reprojects into the third context view and agrees with the cycle proposal within 2.0 px.

All thresholds are frozen before reading any depth labels. No threshold sweep is allowed after post-hoc scoring.

Label isolation

build_certificates(context_rgb, context_cameras, config) is the only certificate-construction entry point. Its signature cannot receive target RGB, depth, normal, point, visibility, or target cameras. evaluate_certificates(certificates, context_depth, context_cameras, ...) is a separate post-hoc function. Evaluation labels cannot alter a certificate, threshold, selected window, or decision rule.

Prepared context-frame depth is loaded only after the immutable certificate JSON has been written. Depth provides post-hoc 3D correctness for audit purposes and is never presented as an inference input or a model result.

Endpoints and controls

Primary endpoint:

• certified source-pixel coverage: certified source samples divided by fixed grid samples, macro averaged over windows.

Supportive endpoints:

• counts and retention at raw, reciprocal, cycle, geometric, and certified stages;
• median and p90 source-pair and third-view reprojection error;
• median triangulation angle;
• post-hoc 3D error against source context depth;
• matched-coverage comparison between geometric certificates and ordinary LoFTR confidence;
• occupied native-grid coverage at 48 x 32 x 48 within the existing local metric bounds;
• certificate invariance under context-view permutation;
• shuffled-camera and shuffled-correspondence negative controls.

Frozen decision rule

The branch receives GO_TO_STATE_INTEGRATION only if all conditions hold on at least 32 frozen development-train windows:

• macro certified source coverage is at least 15%;
• at least 80% of windows have nonzero certified observations;
• median post-hoc 3D error is at most one native voxel (0.25 m);
• p90 post-hoc 3D error is at most two native voxels (0.50 m);
• certification beats ordinary descriptor confidence at matched coverage on median 3D error;
• the predeclared certificate risk has strictly positive Spearman correlation with post-hoc 3D error;
• view-permutation geometry differs by at most numerical tolerance;
• shuffled controls materially degrade geometry correctness.

Any failed primary condition yields STOP_CERTIFICATE_FRONTEND. An incomplete run yields INCONCLUSIVE. A stopped frontend is not rescued by training, threshold tuning, a stronger completion network, or reading validation/test labels. Changing the proposer or its weights is a new, predeclared audit, not a reinterpretation of this frozen result.

Super Research status

The earlier medium-intensity preparation used three non-formal consultants because the formal Research Institute route and requested Luna route were unavailable. The current code stage does not manufacture missing Institute records. Research Institute roles not invoked are reported as not invoked. Council not convened. The Generation 10 terminal-report document is a design, while the active ecosystem remains Generation 9.