# Component Fit Matrix — Mode B Revisions (2026-05-08)

> Mode B Solution Assessment of `_docs/01_solution/solution_draft01.md`. Revisions to specific candidate-row statuses + new D-Cx-y gates surfaced by Mode B findings F1–F20.
>
> Index: [`00_summary.md`](00_summary.md). Mode B fact cards: [`../02_fact_cards/MODEB_addendum.md`](../02_fact_cards/MODEB_addendum.md). Mode B sources: [`../01_source_registry/MODEB_addendum.md`](../01_source_registry/MODEB_addendum.md). Mode B output: [`../../01_solution/solution_draft02.md`](../../01_solution/solution_draft02.md).
>
> The original Mode A row files [`C1_vio.md`](C1_vio.md) ... [`C10_preflight_provisioning.md`](C10_preflight_provisioning.md) + [`99_cross_component_gates.md`](99_cross_component_gates.md) remain canonical. This file overlays revisions; where this file disagrees with the originals, this file wins (the original Mode A files are not retroactively edited so the audit trail is preserved).

---

## Status changes per candidate row

| Component | Candidate | Mode A status (verbatim from row file) | Mode B revised status | Reason |
|---|---|---|---|---|
| **C1** | VINS-Mono | "Selected (mandatory simple-baseline) — fallback if OKVIS2 fails Jetson MVE" + "Security: BSD permissive clean" | **`Selected via VioStrategy interface for comparative study + research/dev builds`**; production-deployed only if D-C1-1-SUB-A resolves to non-(a) AND IT-12 confirms VINS-Mono outperforms OKVIS2; **license corrected from "BSD permissive clean" to "GPL-3.0 (copyleft viral)"** | Fact #102 + 2026-05-08 user directive — Mode A C1 Fact #28 already correctly classified VINS-Mono as GPL-3.0; the BSD label was a Step-8 deliverable-formatting error in solution_draft01. User directive elevates VINS-Mono into the production design as a comparative-study sibling behind a `VioStrategy` interface. Source #122 confirms canonical GPL-3.0; see new D-C1-1-SUB-A below for viral-linkage containment policy. |
| **C1** | KLT+RANSAC homemade fallback | "Selected (project-internal homemade fallback) — used when OKVIS2/VINS-Mono unavailable" | **`Selected (mandatory simple-baseline) — wrapped as `KltRansacVioStrategy` behind VioStrategy interface`** | Mode A C1 Fact #35 + 2026-05-08 user directive: KLT+RANSAC is the engine-required mandatory simple-baseline AND is wrapped as a third `VioStrategy` so the comparative study (IT-12) covers the engine-required baseline alongside OKVIS2 + VINS-Mono. |
| **C1** | (NEW interface) `VioStrategy` interface | n/a | **`Selected (NEW architectural component per 2026-05-08 user directive on A1)`** | NEW: pluggable Strategy/Adapter pattern hosting `Okvis2VioStrategy`, `VinsMonoVioStrategy`, `KltRansacVioStrategy`. Selection is config-driven at startup; FDR (AC-NEW-3) records active strategy `name()` + `license()` per flight. Interface owns "produce `VioOutput` from frame + IMU window per the strategy's algorithm"; per-strategy concerns live in concrete implementations per coderule SRP rule. |
| **C2** | (NEW) UltraVPR (cbbhuxx/UltraVPR, MIT) | n/a (D-C2-11 deferred to post-research) | **`Documentary lead PRIMARY on BSD/permissive C2 axis`**; mandatory Jetson MVE under D-C1-2 / D-C2-4 expanded scope | Fact #110 — RAL 2025 / ICRA 2026 publication; MIT license; **44 Hz on Jetson Orin NX (Orin-Nano-Super-class)**; rotation-invariant (multi-heading aerial flights); unsupervised aerial pretrain (closes D-C2-1 retrain cost); validated on VPAir + UAV-VisLoc datasets. Sources #124. |
| **C2** | (NEW) MegaLoc (gmberton/megaloc, MIT) | n/a (D-C2-11 deferred to post-research) | **`Documentary lead SECONDARY (broader-applicability)`** on BSD/permissive C2 axis; mandatory Jetson MVE | Fact #110 — CVPR 2025 publication; MIT license; SOTA on multiple VPR benchmarks; aerial-validated via AirZoo benchmark (Source #125). Distributed via torch.hub. |
| **C2** | MixVPR | "Selected (mandatory simple-baseline + recommended primary on BSD/permissive track)" | **`Selected (mandatory simple-baseline)`**; demoted from "recommended primary" to "mandatory baseline" — UltraVPR is the new BSD/permissive PRIMARY recommendation | Fact #110 — MixVPR remains valid candidate but UltraVPR's UAV-pretrain + Jetson-runtime evidence dominates on the project's pinned operating context. MixVPR retained as mandatory baseline per Component Option Breadth rule. |
| **C2** | SelaVPR | "Selected (modern-competitive-lead BSD/permissive two-stage) — eligible if D-C2-7 re-rank strategy chosen" | **`Selected (modern-competitive-lead BSD/permissive secondary)` STRENGTHENED** | Fact #113 — XoFTR / SAR-optical benchmark contrarian evidence reinforces foundation-model (DINOv2) backbone preference for cross-domain registration; SelaVPR's DINOv2-L backbone is well-positioned even without aerial retrain. |
| **C8** | pymavlink → MAVLink GPS_INPUT (AP) | "Selected (recommended-primary) for ArduPilot Plane" | **`Selected (recommended-primary) for ArduPilot Plane` + NEW security mitigation requirement: D-C8-9 MAVLink 2.0 message signing on companion ↔ AP wired channel** | Fact #109 — CVE-2026-1579 CVSS 9.8 CRITICAL. ArduPilot supports MAVLink 2.0 message signing (Source #128). Draft01 had no signing-posture decision; Mode B raises D-C8-9 as new gate. |
| **C8** | D-C8-2 = (b) companion-driven `MAV_CMD_SET_EKF_SOURCE_SET` switch | (Recommendation: implicit `Selected` via D-C8-2 = (b) being the recommended pattern) | **`Selected with runtime gate`** per Step 7.5.3 carve-out — runtime gate = SITL validation by IT-3 before lock | Fact #111 — pattern is firmware-supported but no production-deployed precedent; the project will be establishing the canonical pattern itself. Carve-out is for runtime-quality validation, not API capability. |
| **C4** | OpenCV `cv::solvePnPRansac` + GTSAM `Marginals` (D-C4-2 = (b)) | "Selected (mandatory simple-baseline + recommended-primary covariance recovery via GTSAM)" + "OpenCV 4.x" | **`Selected` + dependency pin updated to `OpenCV ≥4.12.0`** per CVE-2025-53644 mitigation | Fact #112 — OpenCV CVE-2025-53644 CVSS 9.8 CRITICAL on 4.10.0 / 4.11.0; fixed in 4.12.0. Single-line pin change with no API break. |
| **C5** | GTSAM iSAM2 (AC-4.5 internal smoothing) | "Selected (modern-competitive-lead-factor-graph + recommended primary path) — couples NATIVELY with C4 GTSAM Marginals via D-C5-5 = (c)" | **`Selected` + AC-4.5 scope clarification: internal smoothing only, NOT FC retroactive correction** | Fact #107 — GTSAM iSAM2 NATIVE look-back refinement value is internal-only; ArduPilot `AP_GPS_MAV` and iNav `mspGPSReceiveNewData()` consume only the latest frame; FC log is forward-time only. AC-4.5 satisfied as "internal estimator refines past + emits corrected current estimate", not as "FC retroactively corrects past flight log". |
| **All C-rows** | (cross-cutting) | (no AC-4.1 latency partition) | **NEW cross-cutting D-CROSS-LATENCY-1: AC-4.1 latency budget partition strategy** | Fact #103 — draft01's own runtime math (~140-420 ms p95) exceeds AC-4.1 (400 ms) at upper end with no slack reservation. Recommendation: hybrid K=3 default + auto-degrade to K=2 + Jacobian-covariance under thermal throttle. |

---

## Architecture-level additions (new sub-stages absent from solution_draft01)

| Sub-stage | Position in pipeline | Recommended candidate | Source |
|---|---|---|---|
| **Top-N inlier-based re-rank** (was promised by SQ2 Decision 3 but absent from solution_draft01) | Between C2 (VPR top-K) and C3 (matcher) | Thin wrapper around C3 matcher's RANSAC inlier counter; rank top-K candidates by inlier count from a single-pair LightGlue / XFeat invocation per candidate; output top-N ⊆ top-K for full-depth C3 matching | Fact #108; SQ2 Decision 3; Mode A SQ2 Source #38–#42 |
| **AdHoP-conditional refinement** (was promised by SQ2 Decision 2 but absent from solution_draft01) | Between C3 (matcher) and C4 (PnP) | OrthoLoC AdHoP method-agnostic perspective preconditioning per Mode A SQ2 Source #40; invoked only when initial reprojection error exceeds a threshold; worst-case 2× C3 latency when triggered | Fact #108; SQ2 Decision 2; Mode A SQ2 Source #40 |

---

## New cross-component / project-level Plan-phase gates (overlay onto `99_cross_component_gates.md`)

| Gate | Owner | Resolution path |
|---|---|---|
| **D-C1-1 (REVISED with Fact #102 evidence)** license-track posture | User | No change to gate; evidence updated — VINS-Mono is GPL-3.0 (not BSD as draft01 listed); C1 BSD/permissive-track lead remains OKVIS2 (per Mode A C1 Fact #31 unchanged) |
| **D-C1-1-SUB-A (LOCKED 2026-05-08 by User to option (a)) — VINS-Mono GPL-3.0 viral-linkage containment policy** | User (locked); Plan-phase implements | Production binary built with `BUILD_VINS_MONO=OFF` → only `Okvis2VioStrategy` + `KltRansacVioStrategy` linked → BSD-clean. Research/dev binary built with `BUILD_VINS_MONO=ON` → all three strategies linked → enables IT-12 comparative study + docs report. CI publishes both binaries; production CI job verifies via SBOM dump that no `vins_mono` GPL-3.0 symbol is present. CMake spec: `option(BUILD_VINS_MONO "Include VINS-Mono GPL-3.0 VioStrategy implementation; production builds MUST set OFF" OFF)`. Plan-phase scope: CMake flag + CI pipeline split (~1 day engineering). Options (b) process-isolation IPC and (c) accept D-C1-1 = (a) GPL-3.0 entire binary considered and rejected — see solution_draft02 § C1 D-C1-1-SUB-A locked-verdict table for trade-off rationale. |
| **D-C2-11 (REVISED with Fact #110 evidence)** UltraVPR + MegaLoc evaluation as Documentary Lead candidates | User + Plan-phase architect | (a) elevate UltraVPR to Documentary Lead PRIMARY on BSD/permissive C2 axis; (b) elevate MegaLoc to Documentary Lead SECONDARY (broader-applicability); (c) preserve closed pre-screen (5/5: MixVPR + SALAD + SelaVPR + NetVLAD + EigenPlaces) as fallback. Mandatory Jetson MVE under D-C1-2 / D-C2-4 expanded scope. |
| **D-C2-12 (NEW from Mode B Fact #113)** DINOv2-backbone feature-extractor evaluation for cross-domain matching | Plan-phase architect + C3 owner | Plan-phase decision: defer to Jetson MVE phase; potentially closes D-C3-1 retrain cost via DINOv2-feature-based matcher (e.g., DINOv2 + LightGlue or DINOv2 + paired matcher) without requiring D-C2-1 aerial retrain. Carryforward research item. |
| **D-C8-2 (REVISED with Fact #111)** companion-driven `MAV_CMD_SET_EKF_SOURCE_SET` ownership pattern | Plan-phase architect + AC-NEW-2 owner | Recommendation unchanged ((b) companion publishes to source-set 2 + auto-switches FC), but **status downgraded to `Selected with runtime gate`** per Step 7.5.3 carve-out — runtime gate = ArduPilot Plane SITL validation by IT-3 (Spoofing-promotion latency) before lock. NEW sub-decision **D-C8-2-FALLBACK** if SITL validation fails: (a) operator-manual RC aux switch option 90 with relaxed AC-NEW-2 wording; (b) operator-warning STATUSTEXT instead of automated switch; (c) escalate to ArduPilot dev community. |
| **D-C8-9 (NEW from Mode B Fact #109)** MAVLink 2.0 message signing posture per FC | Plan-phase architect + security owner | Plan-phase decision: (a) signing on ALL MAVLink channels (over-engineered for the wired companion link); (b) signing on companion ↔ AP wired channel only; (c) accept unsigned default (rejected per CVE-2026-1579 Critical CVSS); (d) **(RECOMMENDED) hybrid: signing on companion ↔ AP wired channel + per-flight key rotation**. Cross-FC asymmetry: iNav has no signing option (Source #129) — explicit residual risk; propose iNav firmware feature-request as Plan-phase carryforward. NEW NFT-8 — MAVLink message-signing verification: SBOM dump confirms passkey configuration for AP signing channel. |
| **D-CROSS-LATENCY-1 (NEW from Mode B Fact #103)** AC-4.1 latency budget partition strategy | Plan-phase architect + project bring-up team | Plan-phase decision: (a) tighten K=3 to K=2 to recover ~30-60 ms; (b) drop GTSAM `Marginals` from RUNTIME path and use Jacobian-covariance per D-C4-2 = (a) to recover ~20-60 ms; (c) accept budget overrun and validate at Jetson MVE that p95 lands under 400 ms in practice; (d) **(RECOMMENDED) hybrid: K=3 default + auto-degrade to K=2 + Jacobian-covariance under thermal throttle**. **Validation gate**: Jetson MVE measurement of full p95+p99 distribution under hot-soak NFT-3 conditions (25 W @ +50 °C for 8 h) before lock. |
| **D-CROSS-CVE-1 (NEW from Mode B Fact #112)** dependency security pinning posture | Plan-phase architect + security owner | Plan-phase decision: (a) **(RECOMMENDED)** lock to specific patched versions of all CVE-affected dependencies (OpenCV ≥4.12.0; FAISS — no CVEs; GTSAM — no CVEs; TensorRT 10.3 in JetPack 6.2 — no CVE-applicable since not using TRT-LLM 0.x; pymavlink — no CVEs published in repo at access time 2026-05-08); (b) maintain a project SBOM with monthly CVE re-scan; (c) automate pinning via dependabot or equivalent. Recommendation: (a) + (b). |
| **D-PROJ-1 (NEW from Mode B Fact #104)** Camera calibration acquisition strategy | User + project bring-up team | Plan-phase decision: (a) checkerboard calibration on a pre-deployment ADTi 20MP 20L V1 nav-camera unit (~1-2 days engineering + lab access); (b) photogrammetric self-calibration from first ~50 deployment frames over known landmarks (~2-3 days plus runtime support code; degrades first-mission accuracy); (c) request manufacturer's factory-calibration data sheet from ADTi (low cost if available; risk: vendor may not publish per-unit calibration); (d) **(RECOMMENDED) hybrid**: factory data sheet + ground-truth checkerboard refinement on each deployed unit. **CRITICAL Plan-phase gate**: hard prerequisite for AC-1.1/1.2 frame-center-accuracy validation; Test Spec greenfield Step 5 cannot lock end-to-end accuracy fixtures without it. |
| **D-PROJ-2 (NEW from Mode B Fact #105)** Suite Sat Service voting-layer contract verification | User + parent-suite Satellite Service team | Plan-phase decision: (a) verify Suite Service voting layer is documented + scheduled for the deployment timeframe; (b) draft the contract from the onboard side and propose to the Suite Service team; (c) build a project-internal multi-flight aggregator as stop-gap (~2-3 weeks engineering, cross-suite scope creep); (d) accept that AC-NEW-7 Service-side validation is best-effort and document the gap. **(RECOMMENDED) (a) verify + (b) draft in parallel** — contract definition is small (per-tile quality metadata schema + voting threshold spec). **CRITICAL cross-suite gate**: requires coordination with parent-suite Satellite Service team before AC-NEW-7 NFT-5 can pass with end-to-end evidence. |

---

## Testing Strategy additions

| Test ID | Purpose | New for Mode B? |
|---|---|---|
| **IT-11 — Smoothing-loop look-back accuracy** | Validate GTSAM iSAM2's smoothed past-keyframe poses against ground-truth at smoothing convergence (independent of FC-side consumption). FDR (AC-NEW-3) MUST log smoothed past-frame estimates so post-mission analysis can verify AC-4.5. | NEW (Fact #107) |
| **NFT-8 — MAVLink message-signing verification** | SBOM dump confirms passkey configuration for AP signing channel; iNav side documents the unsignable-link as accepted residual risk per D-C8-9. | NEW (Fact #109) |
| **NFT-9 — Hot-soak latency distribution** (extends NFT-3) | Measure end-to-end p95 + p99 latency distribution under hot-soak NFT-3 conditions (25 W @ +50 °C for 8 h); validate D-CROSS-LATENCY-1 hybrid degradation behaves correctly (K=3 → K=2 + Jacobian-covariance under thermal throttle). | NEW (Fact #103) |
| **IT-1 (revised)** | Pipeline smoke now must clarify which datasets exercise which AC subsets per `_docs/00_problem/input_data/expected_results/results_report.md` § Known Gaps: still-image set is for AC-1.1/1.2 frame-center geolocation accuracy ONLY; Derkachi video is for runtime cadence + VIO + replay; neither is sufficient by itself for end-to-end AC-4.1 latency validation under production cadence + altitude + calibration. | Revised (clarify dataset purpose mapping) |
| **IT-12 — VIO comparative study** | Replay same flight footage through all three `VioStrategy` implementations (`Okvis2VioStrategy`, `VinsMonoVioStrategy`, `KltRansacVioStrategy`) in the research/dev build; emit side-by-side AC-1.3 / AC-2.1a / AC-NEW-4 / AC-4.1 / AC-4.2 / SBOM table; published to `_docs/02_document/vio-comparative-study.md`; production-selection gate for D-C1-1-SUB-A. | NEW (2026-05-08 user directive on A1) |

---

## Editing rules (preservation of audit trail)

1. The original Mode A row files (`C1_vio.md` through `C10_preflight_provisioning.md`) and `99_cross_component_gates.md` are NOT retroactively edited — they preserve the Mode A audit trail.
2. Where this Mode B revisions file disagrees with the originals, this file wins. Future Mode B / Plan-phase consumers should read this overlay file alongside the original row files.
3. New Plan-phase decisions raised by Mode B (D-C2-12, D-C8-9, D-CROSS-LATENCY-1, D-CROSS-CVE-1, D-PROJ-1, D-PROJ-2) are catalogued here and in `solution_draft02.md` § Open decisions. Future Mode B / Plan-phase invocations should append to either this file or its sibling `99_cross_component_gates.md` (preferred for Plan-phase consumption) — not modify entries written here.
