Record realtime delivery hardening

docs/implementation-plan.md

@@ -448,6 +448,14 @@ should make input supersession and edge preservation structural, replace the
 two-second media default with consumer-derived field budgets, and prove the
 result under controlled loss/jitter/reorder before changing carriers.
 
+The first cut landed in Odin on 2026-07-16: experimental CultLib snapshot
+`8965f3c0`, epoch/sequence/edge-ack HID delivery, 100 ms default LAN media
+deadline, CultNet `realtime` A/V delivery, bounded queues, expiring/late-aware
+repair, and decode-chain-owned keyframe pressure. Next reliability work is real
+encoder keyframe actuation, production parity recovery, audio FEC/concealment,
+bounded long-disconnect edge admission, adaptive sender response, and the
+fault-injected socket timeline harness.
+
 1. Replace the frame-event diagnostic bridge with concrete direct capture
    drivers for Leap stereo IR first, then the
    other cameras.

docs/research/moonlight-muninn-sleipnir-study-2026-07-16.md

@@ -19,8 +19,9 @@ neutralizes stale output.
 
 The weakness is that these parts do not yet form one closed realtime policy:
 
-- generic RUDP reliability remains the dominant substrate instead of a thin
-  carrier beneath media-aware recovery;
+- video already uses unreliable media delivery with parity/manual repair, but
+  audio and HID still lean on generic expiring reliability and none of the
+  lanes yet forms one closed media/input policy;
 - the default Muninn media latency budget is 2000 ms, which is an archive-shaped
   tolerance wearing a realtime badge;
 - receiver feedback is measured and repair/keyframe pressure is recorded, but
@@ -134,7 +135,7 @@ Source: [Moonlight frame-pacing FAQ](https://github.com/moonlight-stream/moonlig
 |---|---|---|---|
 | Video unit | Encoded frame, FEC blocks, dependency recovery | Encoded access unit, chunks/parity, frame/dependency IDs, deadlines | The conceptual unit is already correct. Keep it. |
 | Video loss | FEC first; abandon damaged/obsolete work; request IDR | Parity, missing-chunk feedback, repair cache, keyframe pressure | Close the loop into encoder action and measure whether repair beats deadline. |
-| Audio loss | Small FEC blocks, reorder-aware wait, decoder concealment | Typed audio packets and deadlines; generic reliable delivery remains prominent | Add an audio continuity policy with bounded FEC/reorder/concealment ownership. |
+| Audio loss | Small FEC blocks, reorder-aware wait, decoder concealment | Typed audio packets and deadlines over generic expiring reliable delivery | Add an audio continuity policy with bounded FEC/reorder/concealment ownership. |
 | Congestion | Stream-specific queues and feedback behavior | Sender queue bounds and receiver feedback stats, fixed configured bitrate | Feedback must alter pacing/bitrate/parity or it is only an autopsy report. |
 | Latency budget | Minimal queueing; frame pacing explicitly trades latency for smoothness | Default media budget 2000 ms; Sleipnir reliable expiry 25 ms | Replace one broad media budget with video/audio/input budgets derived from consumption deadlines. |
 | Input state | Coalesces replaceable motion/sensor/analog values | Producer emits latest full controller state; receiver filters regressions | Make coalescing and edge preservation typed protocol semantics, not an accident of polling. |

state/evidence.jsonl

@@ -188,3 +188,4 @@
 {"ts": "2026-07-14T01:00:00+01:00", "type": "verification", "status": "rejected", "note": "2026-07-14 live two-wand sphere-stereo fit remained honestly rejected. Synthetic recovery passed at 0.34/0.63 px held-out median/P95 with focal errors below 0.43 px and 0.22 mm baseline error. Live robust consensus reached 0.51/2.08 px but only 53.8 percent held-out support and an out-of-range Eye 1 focal estimate; PSMoveAPI position age is being projected as confidence and blob radius is not calibrated sphere radius. Artifact live-two-wand-20260714-004210.nominal-radius-fit.mpack is diagnostic only."}
 {"ts": "2026-07-14T01:13:34+01:00", "type": "verification", "status": "ok", "note": "2026-07-14 Odin d0eded6 deployed to Nightwing Muninn (SHA-256 a604fedaf90b26a49db6594b16b8b3499e3aed540152c6fda9dd9dbe87d37d39). Post-deploy 10 s Mimir window: 555 frames, 2246 observations, 443 stereo pairs; radius P01 improved from ~0.707 px to 3.13/3.64 px and candidate confidence is explicitly uncalibrated 0.5 on both Eyes. Eye 1 honestly saw only two plausible stationary IDs. Artifact: artifacts/move-calibration/muninn-post-admission-filter-20260714.mpack."}
 {"ts": "2026-07-16T20:03:50+01:00", "type": "decision", "status": "ok", "note": "Moonlight common-c study at commit 82e2514 found Muninn already has media-aware packetization, deadlines, parity, receiver feedback, repair caching, and keyframe pressure. Preserve those foundations; close feedback into sender policy, replace the two-second realtime default with consumer-derived deadlines, and split Sleipnir input into replaceable latest state versus ordered non-replaceable edges. Research: docs/research/moonlight-muninn-sleipnir-study-2026-07-16.md."}
+{"ts": "2026-07-16T20:29:03+01:00", "type": "verification", "status": "ok", "note": "Moonlight-derived reliability cut implemented in Odin against experimental CultLib snapshot 8965f3c0: HID epoch/latest-state/ordered-edge/application-ack semantics; wall clock demoted from ordering; Muninn A/V uses CultNet realtime lane with 100ms default LAN deadline; bounded producer/pending queues; expiring and receiver-late-aware repair cache; decode-chain-only keyframe pressure. Verification passed 168 Muninn, 25 Sleipnir, and 35 vendored experimental CultNet tests."}

state/map.yaml

@@ -87,6 +87,16 @@ invariants:
     are temporary smoke/bootstrap edges only.
 
 accepted_design:
+  - Odin's 2026-07-16 Moonlight-derived reliability cut now runs Muninn and
+    Sleipnir against the experimental CultLib runtime snapshot at `8965f3c0`.
+    HID latest state and ordered button edges have separate epoch/sequence and
+    application-ack semantics; wall timestamps no longer order input. Muninn
+    media uses CultNet's unreliable `realtime` lane rather than the experimental
+    reliable-without-expiry `media` lane, defaults LAN usefulness to 100 ms,
+    bounds producer/pending queues, expires repair material, refuses repair for
+    receiver-late frames, and reserves keyframe requests for decode-chain
+    invalidation. Odin records the live authority and remaining gaps in
+    `docs/realtime-delivery-authority.md`.
   - The Moonlight comparison at
     `docs/research/moonlight-muninn-sleipnir-study-2026-07-16.md` establishes
     that realtime delivery policy belongs to signal semantics, not generic RUDP