chore: WIP pre-implement

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_tasks/todo/AZ-841_unxfail_az777_tier2_tests.md

@@ -1,57 +0,0 @@
-# Un-xfail AZ-777 AC-4 + AC-5 Tier-2 tests (AZ-835 C5)
-
-**Task**: AZ-841_unxfail_az777_tier2_tests
-**Name**: Un-xfail AZ-777 AC-4 + AC-5 Tier-2 tests once C3 fixture + C4 orchestrator land (AZ-835 C5)
-**Description**: Fifth building block of Epic AZ-835. Once C3 (AZ-839, `operator_pre_flight_setup` real fixture) and C4 (AZ-840, e2e orchestrator test) land, remove the `@pytest.mark.xfail` markers from the AZ-777 Tier-2 tests. The verdict — PASS or FAIL — becomes the honest signal. Both tests remain gated by `RUN_REPLAY_E2E=1` + `@pytest.mark.tier2`.
-**Complexity**: 1 SP
-**Dependencies**: AZ-839 (C3, `operator_pre_flight_setup` real fixture — HARD); AZ-840 (C4, e2e orchestrator test — HARD); AZ-777 (being closed/superseded by this Epic; tests live in same file tree); AZ-835 (parent Epic)
-**Component**: `tests/e2e/replay/test_derkachi_1min.py` (xfail removal) + `tests/e2e/replay/test_derkachi_real_tlog.py` (xfail removal)
-**Tracker**: AZ-841 (https://denyspopov.atlassian.net/browse/AZ-841)
-**Parent Epic**: AZ-835
-
-Jira AZ-841 is the authoritative spec; this file is the in-workspace mirror.
-
-## Targets
-
-1. `tests/e2e/replay/test_derkachi_1min.py::test_ac3_within_100m_80pct_of_ticks` (AZ-777 AC-4) — remove `@pytest.mark.xfail`; verify `@pytest.mark.tier2` + `RUN_REPLAY_E2E` gating stays in place.
-2. `tests/e2e/replay/test_derkachi_real_tlog.py::test_az699_real_flight_validation_emits_verdict_and_report` (AZ-777 AC-5) — remove `@pytest.mark.xfail`; verify gating stays in place.
-
-## Verification
-
-**On Tier-2 Jetson** (`RUN_REPLAY_E2E=1`):
-- `test_ac3_within_100m_80pct_of_ticks` PASSES (≥ 80 % of ticks within 100 m of ground truth, log lines `replay.satellite_anchor_inserted` visible).
-- `test_az699_real_flight_validation_emits_verdict_and_report` runs to completion within 15 min and emits `_docs/06_metrics/real_flight_validation_<YYYY-MM-DD>.md` with the honest distribution. PASS preferred but NOT required for AC-4 — emitting the honest report IS the success criterion.
-
-**Locally** (no env):
-- Both tests skip explicitly with a reason naming `RUN_REPLAY_E2E` — they MUST NOT pass as a side effect of being skipped.
-
-## Acceptance criteria
-
-| # | Criterion |
-|---|-----------|
-| AC-1 | `@pytest.mark.xfail` removed from both AZ-777 tests. |
-| AC-2 | Both tests still gated by `@pytest.mark.tier2` + skip-unless-env(`RUN_REPLAY_E2E=1`). Skip reason names the missing env. |
-| AC-3 | On Jetson with `RUN_REPLAY_E2E=1`, `test_ac3_within_100m_80pct_of_ticks` PASSES (≥ 80 % within 100 m). |
-| AC-4 | On Jetson with `RUN_REPLAY_E2E=1`, `test_az699_real_flight_validation_emits_verdict_and_report` completes within 15 min and emits the verdict report. PASS preferred but not required for AC-4. |
-| AC-5 | If either test FAILS on the metric (e.g. only 60 % within 100 m), the test reports FAIL honestly — no fallback to xfail or skip. Failure mode is a feature, not a bug. |
-| AC-6 | Locally on a machine without `RUN_REPLAY_E2E`, both tests skip with an explicit reason. |
-
-## Out of scope
-
-- Modifying the airborne pipeline to improve metric performance (separate optimization tickets if AC-3 fails).
-- Adding new test cases (this ticket only removes xfail; new cases belong to other tickets).
-- Documentation updates (AZ-842 / C6).
-- Modifying the verdict thresholds (AZ-696).
-
-## Risks
-
-**Risk 1 — Un-xfailed tests may FAIL on the metric.** If horizontal-error distribution comes in worse than the 80 % @ 100 m gate, this test reports FAIL. That outcome is in-scope for AC-5 (report honestly) and out-of-scope for this ticket's fix (file a separate optimization ticket).
-
-## References
-
-- Parent Epic: AZ-835 — https://denyspopov.atlassian.net/browse/AZ-835
-- Hard deps: AZ-839 (C3), AZ-840 (C4)
-- Tests: `tests/e2e/replay/test_derkachi_1min.py`, `tests/e2e/replay/test_derkachi_real_tlog.py`
-- AZ-777 spec: `_docs/02_tasks/done/AZ-777_derkachi_c6_reference_fixture.md` (post-closure)
-- Threshold spec: AZ-696 (≥ 80 % within 100 m)
-- Verdict writer: `src/gps_denied_onboard/helpers/accuracy_report.py`

_docs/02_tasks/todo/AZ-842_replay_protocol_and_orchestrator_docs.md

@@ -3,17 +3,30 @@
 **Task**: AZ-842_replay_protocol_and_orchestrator_docs
 **Name**: Docs: replay_protocol.md Invariant 12 + AZ-777 Phase 3+ superseded note + orchestrator-test README (AZ-835 C6)
 **Description**: Sixth and final building block of Epic AZ-835. Capture the route-driven flow in the authoritative documents so future implementers, operators, and reviewers understand what changed and why.
-**Complexity**: 2 SP
-**Dependencies**: AZ-841 (C5, un-xfail — SOFT; README describes test outcomes assuming C5 has landed); AZ-777 (being closed/superseded by this Epic — AZ-777 spec is updated during the AZ-777 closure step, verified by AC-6); AZ-835 (parent Epic)
+**Complexity**: 3 SP (cycle-4 rescope: was 2 SP)
+**Dependencies**: AZ-894 (CSV adapter — HARD; replay_protocol.md sub-section describes the new single-canonical-clock flow); AZ-895 (auto-sync deprecation — HARD; replay_protocol.md sub-section describes the tlog adapter's new audit-only role); AZ-896 (CSV format docs — SOFT; replay_protocol.md cross-links to the format spec); AZ-777 (closed/superseded by this Epic); AZ-835 (parent Epic)
 **Component**: `_docs/02_document/contracts/replay/replay_protocol.md` + `_docs/02_document/architecture.md` + `tests/e2e/replay/README*.md`
 **Tracker**: AZ-842 (https://denyspopov.atlassian.net/browse/AZ-842)
 **Parent Epic**: AZ-835
 
 Jira AZ-842 is the authoritative spec; this file is the in-workspace mirror.
 
+> **Cycle-4 rescope (2026-05-26)**: dropped the AZ-841 (un-xfail) soft
+> dependency — AZ-841 was deferred to backlog in cycle-4 Step 9 scope
+> review (see `_docs/02_tasks/backlog/AZ-841_unxfail_az777_tier2_tests.md`).
+> Expanded scope from "AZ-835 epic docs only" to also cover the cycle-4
+> replay-input redesign narrative: AZ-894 (CSV-driven single-canonical-clock
+> adapter), AZ-895 (tlog adapter → audit-only after auto-sync deprecation),
+> AZ-896 (CSV format spec). The replay_protocol.md edits now describe BOTH
+> the route-driven AZ-835 flow AND the cycle-4 CSV-driven replay path,
+> which together supersede the legacy tlog+auto-sync surface.
+> Complexity bumped 2 → 3 SP to cover the added cycle-4 narrative.
+
 ## Modified files
 
-### 1. `_docs/02_document/contracts/replay/replay_protocol.md` — Invariant 12 extension
+### 1. `_docs/02_document/contracts/replay/replay_protocol.md` — Invariant 12 extension + Invariant 13 (NEW, cycle-4)
+
+**1a. Invariant 12 — route-driven flow (AZ-835)**
 
 Extend **Invariant 12** with an AZ-835 sub-section describing:
 
@@ -21,6 +34,16 @@ Extend **Invariant 12** with an AZ-835 sub-section describing:
 - Why route-driven supersedes the AZ-777 bbox approach (efficiency: ~100× fewer tiles; honesty: pre-commits to where the operator did fly).
 - The C3 fixture's failure-handling contract (validation/terminal → re-raise; transient → retry up to 3 attempts using C11's existing backoff schedule).
 
+**1b. Invariant 13 — single canonical clock (cycle-4, AZ-894 / AZ-895 / AZ-896)**
+
+Add a new **Invariant 13** sub-section describing:
+
+- The single-clock model production uses (single edge device, single clock at receipt) and why two-clock surfaces (e.g. `VioOutput.emitted_at_ns` from Jetson monotonic vs. `ImuWindow.ts_end_ns` from FC-boot) produce ESKF out-of-order regressions like AZ-848.
+- The CSV-driven replay path (AZ-894) — `(video, CSV)` operator input, IMU + GPS-ground-truth on a single canonical clock derived from the CSV's `Time` column, no auto-sync.
+- The CSV schema (delegate to `_docs/02_document/contracts/replay/csv_replay_format.md` produced by AZ-896 for the field-level spec).
+- The tlog-replay adapter's new audit-only role (AZ-895): retained for FDR analysis and one-shot tlog→CSV export, removed from the test/demo critical path.
+- Auto-sync deprecation (AZ-895): `--time-offset-ms` / `--skip-auto-sync-validation` CLI flags removed or marked deprecated with one-cycle warning.
+
 ### 2. `_docs/02_document/architecture.md` — satellite-provider entry extension
 
 Append a sub-section to the existing satellite-provider entry noting that Epic AZ-835 + its C1-C5 children landed the full e2e real-flight validation path on top of AZ-777 Phase 1's wire + C11 contract adaptation. Mark AZ-777 Phase 3+ as superseded by Epic AZ-835 (pointer-only — the AZ-777 spec itself is updated in C5's wake during the AZ-777 closure step).
@@ -39,11 +62,13 @@ Either extend `tests/e2e/replay/README.md` or create a dedicated `tests/e2e/repl
 | # | Criterion |
 |---|-----------|
 | AC-1 | `replay_protocol.md` Invariant 12 has a new AZ-835 sub-section covering the route-driven flow, the bbox-supersedure rationale, and the failure-handling contract. |
+| AC-1b | `replay_protocol.md` has a new Invariant 13 (cycle-4) sub-section covering the single-canonical-clock model, the CSV-driven replay path (AZ-894), the tlog adapter's audit-only role (AZ-895), and auto-sync deprecation. Links to `csv_replay_format.md` (AZ-896). |
 | AC-2 | `architecture.md` satellite-provider entry has a sub-section noting Epic AZ-835's contribution and pointing at AZ-777 Phase 3+ as superseded. |
+| AC-2b | `architecture.md` replay-input section explains the cycle-4 redesign: CSV adapter primary path, tlog adapter audit-only role, removal of auto-sync. References AZ-894 / AZ-895 / AZ-896 / AZ-897. |
 | AC-3 | `tests/e2e/replay/README*.md` exists and a new contributor can run the orchestrator test on Jetson using only the README's instructions (no out-of-band knowledge required). |
-| AC-4 | All three docs link to the Epic (AZ-835) and to the relevant child tickets (AZ-836 / AZ-838 / AZ-839 / AZ-840 / AZ-841). |
+| AC-4 | All three docs link to the Epic (AZ-835), its children (AZ-836 / AZ-838 / AZ-839 / AZ-840), and the cycle-4 redesign tickets (AZ-894 / AZ-895 / AZ-896 / AZ-897). AZ-841 reference omitted (deferred to backlog). |
 | AC-5 | License attribution string ("Imagery © Google") and the dev-only caveat are present in the test README. |
-| AC-6 | Cross-references in `_docs/02_tasks/_dependencies_table.md` and `_docs/02_tasks/done/AZ-777*.md` (once moved) point at this Epic / its children. |
+| AC-6 | Cross-references in `_docs/02_tasks/_dependencies_table.md` and `_docs/02_tasks/done/AZ-777*.md` (once moved) point at this Epic / its children and at the cycle-4 redesign tickets. |
 
 ## Out of scope
 

_docs/02_tasks/todo/AZ-894_csv_driven_replay_adapter.md

@@ -0,0 +1,53 @@
+# Replay: CSV-driven IMU+GPS adapter using single canonical clock
+
+**Task**: AZ-894_csv_driven_replay_adapter
+**Name**: Add a CSV-replay adapter that consumes the Derkachi-schema `data_imu.csv` (or any flight that ships with a paired CSV) and exposes IMU + GPS-ground-truth on a single canonical clock derived from the CSV's `Time` column
+**Description**: Cycle 3 surfaced AZ-848 (eskf_out_of_order on frame 3) because the current replay pipeline imports two incompatible clocks: `VioOutput.emitted_at_ns` uses Jetson process-monotonic time, while `ImuWindow.ts_end_ns` uses FC-boot-relative time (parsed from MAVLink tlog messages). The single-clock model that production uses (single edge device, single clock at receipt) is not what replay does today. The Derkachi fixture's `data_imu.csv` already contains both IMU (`SCALED_IMU2.*`) and GPS ground truth (`GLOBAL_POSITION_INT.*`) on a single canonical clock (the `Time` column, 0..489.9 s at 10 Hz, aligned 3:1 with the 30 fps video). Using the CSV directly eliminates the clock-mismatch surface entirely for the test/demo path and matches the production single-clock model.
+
+**Complexity**: 3 SP
+**Dependencies**: AZ-896 (format docs land in the same cycle but can land in either order)
+**Blocks**: AZ-895 (auto-sync deprecation), AZ-897 (replay UI)
+**Component**: replay_input (new adapter), c8_fc_adapter (alternate ground-truth source), cli/replay
+**Tracker**: AZ-894 (https://denyspopov.atlassian.net/browse/AZ-894)
+**Parent Epic**: (none — cycle-4 replay-input redesign)
+
+## Schema
+
+The Derkachi CSV header (19 columns):
+
+```
+timestamp(ms), Time,
+SCALED_IMU2.xacc, SCALED_IMU2.yacc, SCALED_IMU2.zacc,
+SCALED_IMU2.xgyro, SCALED_IMU2.ygyro, SCALED_IMU2.zgyro,
+SCALED_IMU2.xmag, SCALED_IMU2.ymag, SCALED_IMU2.zmag,
+GLOBAL_POSITION_INT.lat, GLOBAL_POSITION_INT.lon, GLOBAL_POSITION_INT.alt,
+GLOBAL_POSITION_INT.relative_alt,
+GLOBAL_POSITION_INT.vx, GLOBAL_POSITION_INT.vy, GLOBAL_POSITION_INT.vz,
+GLOBAL_POSITION_INT.hdg
+```
+
+- `timestamp(ms)`: FC-boot-relative milliseconds (kept for traceability; not used by C5)
+- `Time`: flight-relative seconds (canonical clock — what C5 actually uses)
+- `SCALED_IMU2.*`: 10 Hz IMU stream (accel mg, gyro mrad/s, mag mGauss per ArduPilot convention)
+- `GLOBAL_POSITION_INT.*`: 10 Hz GPS ground truth (lat/lon in 1e-7 deg, alt in mm, vx/vy/vz in cm/s, hdg in cdeg)
+
+## Acceptance Criteria
+
+- **AC-1**: Adapter parses the Derkachi `data_imu.csv` end-to-end and emits 4,899 IMU samples + 4,899 GPS-ground-truth samples on a single monotonic clock anchored at row 0.
+- **AC-2**: Wired into `cli/replay.py`; `gps-denied-replay --video flight_derkachi.mp4 --imu data_imu.csv` runs without invoking `tlog_replay_adapter.py`.
+- **AC-3**: `test_derkachi_1min.py::test_ac1_exits_0_jsonl_count_match` passes on the Jetson e2e harness using the new path. AZ-848 cascade no longer triggers (no two-clock surface in the new path).
+- **AC-4**: `VioOutput.emitted_at_ns` is populated from the CSV's `Time` column (or the frame-derived `t = N/fps`), not `time.monotonic_ns()`, when the new adapter is in use.
+- **AC-5**: Schema mismatch (missing required column, NaN in `Time`, non-monotonic `Time`) raises a clear `ReplayInputAdapterError` at startup, not deep in the loop.
+
+## Out of scope
+
+- The structural AZ-848 / AZ-883 fix in the tlog adapter — those stay open as backlog.
+- UI for picking the CSV — AZ-897.
+- Other CSV schemas (PX4, generic MAVLink dumps) — future enhancement if needed.
+
+## References
+
+- Cycle-3 retro: `_docs/06_metrics/retro_2026-05-26.md`
+- Bench-run evidence: `_docs/04_release/release_cycle3_jetson-bench_2026-05-26-1442.md`
+- Companion tickets: AZ-895 (deprecate auto-sync), AZ-896 (format docs + example CSV), AZ-897 (replay UI)
+- Supersedes (re bench-blocking): AZ-848 (VioOutput contract), AZ-883 (SCALED_IMU2 ts_ns=0)

_docs/02_tasks/todo/AZ-895_deprecate_auto_sync_surface.md

@@ -0,0 +1,39 @@
+# Replay: deprecate auto_sync surface; tlog adapter → audit-only
+
+**Task**: AZ-895_deprecate_auto_sync_surface
+**Name**: Remove the tlog+video auto-sync infrastructure and reframe `tlog_replay_adapter.py` as audit-only, now that AZ-894 ships the CSV-driven primary path
+**Description**: User decision (2026-05-26): the test/demo replay path will accept a paired (video, CSV) input from the operator instead of auto-syncing a tlog and video. Auto-sync is unnecessary in production (single edge device, single clock by design) and over-engineered for test (the CSV already encodes the alignment).
+
+**Complexity**: 2 SP
+**Dependencies**: AZ-894 (must ship first — the CSV adapter is the replacement)
+**Component**: replay_input (auto_sync.py, tlog_video_adapter.py), cli/replay, runtime_root/_replay_branch
+**Tracker**: AZ-895 (https://denyspopov.atlassian.net/browse/AZ-895)
+**Parent Epic**: (none — cycle-4 replay-input redesign)
+
+## Touch list
+
+- `src/gps_denied_onboard/replay_input/auto_sync.py` — delete or convert to a clear no-op that raises `ReplayInputAdapterError("auto-sync removed; supply --imu CSV instead")`
+- `src/gps_denied_onboard/replay_input/tlog_video_adapter.py` — strip auto-sync invocations
+- `src/gps_denied_onboard/cli/replay.py` — remove `--time-offset-ms` / `--skip-auto-sync-validation` flags (or mark deprecated with one-cycle warning)
+- `src/gps_denied_onboard/runtime_root/_replay_branch.py` — strip auto-sync wiring
+- `tests/unit/replay_input/test_az405_auto_sync.py` — pass against the new behaviour or delete with rationale recorded in the batch report
+- `tests/e2e/replay/test_derkachi_real_tlog.py` — continues to `@xfail` with the AZ-848-scoped reason; nothing in this ticket fixes the underlying tlog-clock bug
+- `tlog_replay_adapter.py` / `tlog_ground_truth.py` — module docstrings updated to call out the new audit-only / one-shot-export roles
+
+## Acceptance Criteria
+
+- **AC-1**: `auto_sync.py` is either deleted or made into a clear no-op that raises `ReplayInputAdapterError("auto-sync removed; supply --imu CSV instead")`.
+- **AC-2**: All references to `--time-offset-ms` / `--skip-auto-sync-validation` flags in the CLI are removed or marked deprecated with a one-cycle deprecation warning.
+- **AC-3**: `test_az405_auto_sync` tests either pass against the new behaviour or are deleted with rationale recorded in the batch report.
+- **AC-4**: `test_derkachi_real_tlog.py` continues to `@xfail` with the AZ-848-scoped reason; nothing in this ticket fixes the underlying tlog-clock bug.
+- **AC-5**: Module docstrings of `tlog_replay_adapter.py` and `tlog_ground_truth.py` are updated to call out their new audit-only / one-shot-export roles.
+
+## Out of scope
+
+- AZ-848 / AZ-883 structural fix — they stay open as backlog (tlog path is still broken, just no longer the primary path).
+- New CSV export tooling for arbitrary tlogs — future ticket.
+
+## References
+
+- Cycle-3 retro: `_docs/06_metrics/retro_2026-05-26.md`
+- Companion: AZ-894 (CSV adapter — must land first), AZ-896 (docs), AZ-897 (UI)

_docs/02_tasks/todo/AZ-896_replay_format_docs_and_example_csv.md

@@ -0,0 +1,38 @@
+# Docs: replay-input format spec + downloadable example CSV
+
+**Task**: AZ-896_replay_format_docs_and_example_csv
+**Name**: Author the operator-facing format spec for the (video, CSV) replay input pair, plus a minimal downloadable example CSV
+**Description**: Operators using the replay/demo path need to know the exact CSV schema the system accepts, the hard contract (video t=0 ≡ CSV row 0; video must be nadir; UAV must already be airborne at t=0), and have a downloadable example to copy from. Operators today have no entry point that documents this.
+
+**Complexity**: 1 SP
+**Dependencies**: AZ-894 (the adapter that consumes the format — the doc describes what AZ-894 accepts)
+**Blocks**: AZ-897 (UI links to the docs page and serves the example CSV)
+**Component**: docs (_docs/04_release/)
+**Tracker**: AZ-896 (https://denyspopov.atlassian.net/browse/AZ-896)
+**Parent Epic**: (none — cycle-4 replay-input redesign)
+
+## What
+
+- Author a docs page at `_docs/04_release/replay_input_format.md` (or wherever the operator-facing docs land in cycle 4)
+- Schema table: column names, units, types, expected rates, required vs optional
+- Constraint statements up top, before the column table:
+  - Video: nadir camera; UAV already airborne at frame 0
+  - CSV: row 0 timestamp == video frame 0 timestamp; `Time` column starts at 0.0; rows monotonic and uniformly-spaced
+- Ship `_docs/04_release/example_data_imu.csv` — a minimal valid example (e.g., 20 rows = 2 seconds at 10 Hz)
+- Cross-link from the AZ-897 replay UI "Download example" button
+
+## Acceptance Criteria
+
+- **AC-1**: Schema page documents all 19 columns of the Derkachi CSV with units and types.
+- **AC-2**: The three hard constraints (nadir / airborne / aligned-start) are stated up top, before the column table.
+- **AC-3**: The example CSV (≥10 rows) passes through the AZ-894 CSV adapter without errors.
+- **AC-4**: The page is reachable from the AZ-897 UI's "Download example" link.
+
+## Out of scope
+
+- Multi-schema support (PX4, generic MAVLink dumps).
+
+## References
+
+- Companion: AZ-894 (CSV adapter), AZ-897 (UI), AZ-895 (auto-sync deprecation)
+- Source fixture: `_docs/00_problem/input_data/flight_derkachi/data_imu.csv`, README at `_docs/00_problem/input_data/flight_derkachi/README.md`

_docs/02_tasks/todo/AZ-897_replay_ui_web_form.md

@@ -0,0 +1,45 @@
+# Replay UI: web form for paired video + CSV input + example download
+
+**Task**: AZ-897_replay_ui_web_form
+**Name**: Build the first operator-facing UI for the GPS-denied onboard system — a single-page form that uploads a paired (video, CSV) for replay
+**Description**: User decision (2026-05-26): the system offers an operator-facing UI for the test/demo replay path. The UI surfaces the hard constraints visually (nadir, airborne, aligned-start) so operators don't fail silently from a misaligned video. This is also the foundation for the deferred operator-tooling work (see `_docs/00_research/00_question_decomposition.md` lines 119, 224).
+
+Tech stack per `.cursor/rules/techstackrule.mdc`: React + Tailwind CSS.
+
+**Complexity**: 5 SP
+**Dependencies**: AZ-894 (backend CSV adapter), AZ-896 (format docs + example CSV that the UI serves)
+**Component**: frontend (new — first piece of operator-facing UI), backend (new HTTP endpoint that fronts `gps-denied-replay`)
+**Tracker**: AZ-897 (https://denyspopov.atlassian.net/browse/AZ-897)
+**Parent Epic**: (none — cycle-4 replay-input redesign; will likely become the first piece of a future operator-tooling epic)
+
+## Shape
+
+A single-page web form, served from a target to be decided during implementation (Jetson? operator workstation? containerised dev mode?). Hosts:
+
+- **Video file picker**. Accept `.mp4`, `.mov`. Display constraint hint: "Nadir camera; UAV already airborne at frame 0."
+- **CSV file picker**. Accept `.csv`. Display constraint hint: "Row 0 timestamp must equal video frame 0; see format docs."
+- **"Download example CSV"** link → AZ-896's `example_data_imu.csv`.
+- **"View format docs"** link → AZ-896's `replay_input_format.md`.
+- **"Start replay"** button → POSTs (video_path, csv_path) to a backend endpoint that invokes `gps-denied-replay --video X --imu Y`.
+- **Result panel**: tail the replay subprocess output, display final verdict (PASS/FAIL + accuracy metrics).
+
+## Acceptance Criteria
+
+- **AC-1**: Form renders with both pickers, both constraint hints, download/docs links, and the start button.
+- **AC-2**: The start button correctly invokes the replay pipeline against the selected files; success path returns a verdict; failure path returns the error reason from the backend.
+- **AC-3**: Form rejects mismatched filename pairs only with explicit operator-actionable error messages — no silent failures.
+- **AC-4**: Example-CSV download serves the file from AZ-896 with the correct content-type.
+- **AC-5**: Tests cover empty submissions, mismatched file types, backend failures, and the happy path. React Testing Library + jest for component tests; an e2e smoke test covers the full flow.
+
+## Out of scope
+
+- Multi-flight management / history / library.
+- Authentication / user accounts.
+- Sector classification, pre-flight cache provisioning, mission planning (those are separate deferred items from C10 / `00_question_decomposition.md`).
+- The deploy-target decision (Jetson vs operator workstation) — to be resolved during implementation; default proposal: containerised dev mode for now.
+
+## References
+
+- Companion: AZ-894 (CSV adapter), AZ-896 (docs + example CSV)
+- Deferred precedent: `_docs/00_research/00_question_decomposition.md` lines 119 ("Mission-planning UX is out of scope"), 224 ("Operator-side CLI/desktop tool design deferred to Plan-phase")
+- Tech stack: React + Tailwind CSS per `.cursor/rules/techstackrule.mdc`

_docs/02_tasks/todo/AZ-899_architecture_compliance_baseline.md

@@ -0,0 +1,78 @@
+# Land `architecture_compliance_baseline.md` (cycle-3 retro #3, third try)
+
+**Task**: AZ-899_architecture_compliance_baseline
+**Name**: Create `_docs/02_document/architecture_compliance_baseline.md` so cumulative reviews can emit `## Baseline Delta` rows
+**Description**: Cycle-1 retro Top-3 Improvement Action #3, repeated in cycle-3 retro Top-3 #3. The file has been unmade across cycles 2 and 3, leaving cumulative reviews unable to quantify carried-over / resolved / newly-introduced architecture violations per cycle. Seed the baseline from `_docs/06_metrics/structure_2026-05-20.md` with `0` violations, freeze the snapshot semantics, and wire the existing-code flow's Step 2 to reference it.
+**Complexity**: 1 SP
+**Dependencies**: None (operates on existing artifact `_docs/06_metrics/structure_2026-05-20.md`)
+**Component**: documentation only — no source code change
+**Tracker**: AZ-899 (https://denyspopov.atlassian.net/browse/AZ-899)
+**Epic**: (none — cycle-4 process housekeeping)
+
+## Problem
+
+Cycle-3 retro § Structural Metrics:
+
+> `_docs/02_document/architecture_compliance_baseline.md` **still does not exist** — cycle-1 retro Top-3 Improvement Action #3 was NOT delivered in cycles 2 or 3.
+
+Without a baseline, cumulative reviews log "`_docs/02_document/architecture_compliance_baseline.md` does NOT exist → no Baseline Delta section emitted". Structural regressions (new cycles in the import graph, newly-introduced violations) therefore cannot be quantified across cycles — only verified pairwise per batch.
+
+## Outcome
+
+- Cumulative-review reports starting from cycle-4 batch 1 emit a `## Baseline Delta` section that quantifies new vs. resolved vs. carried-over architecture violations.
+- Cycle-end retros can compare structural deltas across cycles using a single canonical baseline document instead of re-deriving from the previous cycle's snapshot.
+
+## Scope
+
+### Included
+
+- Create `_docs/02_document/architecture_compliance_baseline.md` seeded with **0** violations.
+- Reference `_docs/06_metrics/structure_2026-05-20.md` as the source-of-truth snapshot from which the baseline was derived.
+- Document the file's update protocol: a new violation found in a cumulative review is appended (with batch ID, severity, finding ID); a resolution is recorded by marking the row `RESOLVED in batch <ID>`.
+- Document the snapshot-refresh trigger: any cycle that materially changes structure (component count, cross-component edges, new contracts) re-snapshots via `python -m gps_denied_onboard.tools.structure_snapshot` (or equivalent existing script — verify before reference).
+
+### Excluded
+
+- Refactoring source code to fix violations — none currently exist.
+- Adding new component scaffolding — out of scope.
+- Modifying `code-review` or `retrospective` skills — they already reference the file; the only change needed is making the referenced file exist.
+
+## Acceptance Criteria
+
+**AC-1: Baseline file exists with 0 violations**
+Given a fresh repo checkout
+When `ls _docs/02_document/architecture_compliance_baseline.md` runs
+Then the file exists and its `## Violations` section is explicitly empty (or marked "None at baseline")
+
+**AC-2: Baseline references the structural snapshot**
+Given the baseline file
+When read
+Then it includes a `## Source` section pointing at `_docs/06_metrics/structure_2026-05-20.md` and lists the structural facts (15 components, 0 import cycles, 5 contract files) that establish the "0 violations" claim
+
+**AC-3: Update protocol documented**
+Given the baseline file
+When read
+Then it includes an `## Update Protocol` section describing append-on-violation, mark-resolved-on-fix, and the snapshot-refresh trigger
+
+**AC-4: Cumulative-review hook verified**
+Given the baseline file in place
+When the cycle-4 first cumulative-review report is generated
+Then the report emits a `## Baseline Delta` section (even if empty: "0 new, 0 resolved, 0 carried-over")
+
+## Constraints
+
+- File format: markdown, matches the structure of `_docs/06_metrics/structure_2026-05-20.md` style.
+- No source code change permitted under this ticket — strictly documentation.
+
+## Risks & Mitigation
+
+**Risk 1: Future violations slip past the baseline**
+- *Risk*: A cumulative review finds a violation but the reviewer forgets to append it to the baseline.
+- *Mitigation*: The `code-review` skill (referenced in cycle-3 retro Suggested Updates) should be updated separately to auto-append; this ticket only delivers the baseline file. The follow-up belongs in cycle 5 if needed.
+
+## References
+
+- Cycle-3 retro: `_docs/06_metrics/retro_2026-05-26.md` § Top 3 Improvement Actions #3
+- Cycle-1 retro: `_docs/06_metrics/retro_2026-05-20.md` § Top 3 Improvement Actions #3 (original)
+- Source snapshot: `_docs/06_metrics/structure_2026-05-20.md`
+- Existing-code flow Step 2: `.cursor/skills/autodev/flows/existing-code.md` § "Step 2 — Architecture Baseline Scan"

_docs/02_tasks/todo/AZ-900_autodev_retro_existence_gate.md

@@ -0,0 +1,82 @@
+# Autodev: gate Step-9 entry on previous-cycle retro existence
+
+**Task**: AZ-900_autodev_retro_existence_gate
+**Name**: Codify the LESSONS rule — autodev must block cycle-N+1 Step 9 entry if `retro_<YYYY-MM-DD>.md` for cycle N is absent
+**Description**: Cycle-3 retro Top-3 Improvement Action #2 and 2026-05-26 LESSONS entry both call for codifying a Re-Entry After Completion gate that verifies the previous cycle's retro file exists before incrementing the cycle counter. Cycle-2 retro was never filed; the orchestrator silently advanced to cycle 3 and all cycle-1 retro Top-3 actions sat invisible. This ticket codifies the gate in `.cursor/skills/autodev/flows/existing-code.md` § Re-Entry After Completion.
+**Complexity**: 1 SP
+**Dependencies**: None
+**Component**: `.cursor/skills/autodev/flows/existing-code.md` (workflow doc only)
+**Tracker**: AZ-900 (https://denyspopov.atlassian.net/browse/AZ-900)
+**Epic**: (none — cycle-4 process housekeeping)
+
+## Problem
+
+LESSONS 2026-05-26 [process] entry:
+
+> Cycle-2 retro was never filed. The autodev orchestrator silently auto-chained from cycle-2 Step 17 (if it ran at all) straight into cycle-3 Step 9 without producing `retro_<cycle2-date>.md`. As a result, cycle-1 retro's Top-3 Improvement Actions sat invisible across cycle 2 and were re-discovered, all three still undelivered, only at cycle-3 close.
+
+Cycle-3 retro Top-3 #2 echoes the same recommendation.
+
+The fix is a one-line check in the flow file that BLOCKS Step 9 entry for cycle N+1 unless `_docs/06_metrics/retro_<YYYY-MM-DD>.md` for cycle N exists.
+
+## Outcome
+
+- Future cycle-N → cycle-(N+1) transitions are gated: the autodev orchestrator refuses to enter Step 9 of cycle N+1 if no retro file exists for cycle N.
+- Missing retros are surfaced at the session boundary, not 6 weeks later at the next cycle's close.
+
+## Scope
+
+### Included
+
+- Edit `.cursor/skills/autodev/flows/existing-code.md` § "Re-Entry After Completion" to add a gate: before incrementing `cycle`, glob `_docs/06_metrics/retro_*.md` and verify a file dated after the cycle-N start exists.
+- Define the BLOCK behavior: if absent, present a Choose A/B/C block:
+  - **A)** Author the missing retro now (invoke `.cursor/skills/retrospective/SKILL.md` in cycle-end mode)
+  - **B)** Stub a backfilled retro and proceed (with a leftover entry filed for proper backfill)
+  - **C)** Abort and ask the user
+- Add a corresponding bullet to `.cursor/skills/autodev/state.md` § "Session Boundaries" pointing at the new gate.
+
+### Excluded
+
+- Retroactively writing cycle-2 retro (separate ticket if user wants it; cycle-3 retro already covers cycle-2 trend deltas where data is on disk).
+- Adding similar gates to greenfield or meta-repo flows (only `existing-code` has the cycle counter).
+- Per-step retro check inside cycles (this gate fires only at the cycle boundary).
+
+## Acceptance Criteria
+
+**AC-1: Flow file gate exists**
+Given `.cursor/skills/autodev/flows/existing-code.md`
+When the "Re-Entry After Completion" section is read
+Then it contains a step `Verify previous cycle's retro exists` BEFORE the cycle increment
+
+**AC-2: Choose A/B/C block specified**
+Given the gate triggers (no retro file found)
+When the documented behavior is consulted
+Then it specifies the three options (A: author now, B: stub + leftover, C: abort) with the standard Choose format
+
+**AC-3: state.md cross-reference**
+Given `.cursor/skills/autodev/state.md`
+When the "Session Boundaries" section is read
+Then it mentions the new retro-existence gate or links to the flow file's gate
+
+**AC-4: Discovery rule**
+Given the gate
+When the file pattern is documented
+Then the glob is unambiguous: `_docs/06_metrics/retro_*.md` with a date matching cycle-N's date range; the date-range derivation is explicit (cycle N start = last `implementation_report_*_cycle{N-1}.md` date; cycle N end = today)
+
+## Constraints
+
+- Pure workflow doc change — no source code, no tests.
+- Must not break the existing greenfield-Done → existing-code Phase-B transition (greenfield → existing-code is a one-shot flow change with no retro requirement on first entry, since there is no previous cycle).
+
+## Risks & Mitigation
+
+**Risk 1: False positive on greenfield→existing-code transition**
+- *Risk*: First cycle of an existing-code flow shouldn't require a previous-cycle retro.
+- *Mitigation*: Gate condition includes `state.cycle > 1` — cycle 1 has no previous cycle.
+
+## References
+
+- LESSONS 2026-05-26 [process] entry: `_docs/LESSONS.md` § 2026-05-26 [process]
+- Cycle-3 retro Top-3 #2: `_docs/06_metrics/retro_2026-05-26.md`
+- Flow file: `.cursor/skills/autodev/flows/existing-code.md` § "Re-Entry After Completion"
+- State management: `.cursor/skills/autodev/state.md` § "Session Boundaries"

_docs/02_tasks/todo/AZ-901_evidence_out_default_path_fix.md

@@ -0,0 +1,85 @@
+# Fix `EVIDENCE_OUT` default path — workspace-relative, not container-only
+
+**Task**: AZ-901_evidence_out_default_path_fix
+**Name**: Change `e2e/runner/conftest.py:56` `EVIDENCE_OUT` default from `/e2e-results/evidence` to a workspace-relative path so Tier-1 host runs don't crash
+**Description**: Closes leftover `_docs/_process_leftovers/2026-05-26_evidence_out_default_path.md`. Cycle-3 Step 15 (Performance Test) surfaced this: the default path `/e2e-results/evidence` is the container mount inside the Tier-1 Docker harness; a developer Mac/Linux workstation invoking `python -m pytest e2e/tests/performance/` directly hits `OSError: [Errno 30] Read-only file system: '/e2e-results'` (macOS) or `PermissionError` (Linux). Workaround today: `EVIDENCE_OUT="$(pwd)/e2e-results/..." pytest ...`. Fix: resolve a workspace-relative default when neither `--evidence-out` nor `EVIDENCE_OUT` is set.
+**Complexity**: 1 SP
+**Dependencies**: None
+**Component**: `e2e/runner/conftest.py`
+**Tracker**: AZ-901 (https://denyspopov.atlassian.net/browse/AZ-901)
+**Epic**: (none — cycle-4 process housekeeping)
+
+## Problem
+
+`e2e/runner/conftest.py:56`:
+
+```python
+default=os.environ.get("EVIDENCE_OUT", "/e2e-results/evidence")
+```
+
+The default `/e2e-results/evidence` is a container-mount path. Tier-1 Docker harness and the Tier-2 Jetson runner pass `--evidence-out` explicitly, so they're fine. Host-direct `python -m pytest e2e/tests/performance/` invocations (developer machine, no Docker) hit `nfr_recorder.pytest_sessionfinish` which tries `mkdir(evidence_dir)` and crashes.
+
+## Outcome
+
+- Developer can run `python -m pytest e2e/tests/performance/` on a Mac/Linux workstation without setting `EVIDENCE_OUT` and without crashing.
+- Docker / Jetson runners continue to work unchanged (they pass `--evidence-out` explicitly).
+
+## Scope
+
+### Included
+
+- Modify `e2e/runner/conftest.py:56` to resolve a workspace-relative default when `EVIDENCE_OUT` is unset.
+  - Proposed: `default=os.environ.get("EVIDENCE_OUT", str(Path(__file__).resolve().parents[2] / "e2e-results" / "evidence"))`
+- Verify Docker compose files and Jetson scripts that pass `--evidence-out` still work (they should — they override the default).
+- Verify `.gitignore` ignores `e2e-results/` at repo root (probably already does — confirm before commit).
+- Delete the leftover file `_docs/_process_leftovers/2026-05-26_evidence_out_default_path.md` once the fix lands and the verification AC passes.
+
+### Excluded
+
+- The "lazy fallback inside the recorder" alternative shape — staying with the workspace-relative-default shape for simplicity (Option 1 from the leftover file).
+- Refactoring `nfr_recorder.pytest_sessionfinish` — the writer code is fine; only the default path is wrong.
+- Adding new evidence-out related env vars or CLI flags.
+
+## Acceptance Criteria
+
+**AC-1: Host-direct pytest works without EVIDENCE_OUT**
+Given a clean workspace on macOS or Linux
+When `python -m pytest e2e/tests/performance/ -v --tb=short` runs (no `EVIDENCE_OUT` env var, no `--evidence-out` flag)
+Then pytest exits 0, evidence is written under `<workspace_root>/e2e-results/evidence/`, and no `OSError` / `PermissionError` is raised
+
+**AC-2: Docker harness unchanged**
+Given the Tier-1 Docker compose (`docker-compose.test.jetson.yml`)
+When the e2e suite runs inside the container
+Then `--evidence-out` is still passed and evidence lands at the container mount path `/e2e-results/evidence/` (no behavioral change)
+
+**AC-3: Jetson harness unchanged**
+Given `scripts/run-tests-jetson.sh`
+When invoked
+Then it still passes `--evidence-out` to pytest and evidence is collected per the existing protocol
+
+**AC-4: gitignore covers workspace-relative path**
+Given the fix in place
+When a host-direct run produces `<workspace_root>/e2e-results/`
+Then `git status` does NOT show `e2e-results/` as untracked (already covered by `.gitignore`, or `.gitignore` is updated as part of this ticket)
+
+**AC-5: Leftover deleted**
+Given the fix lands and ACs 1–4 pass
+When `ls _docs/_process_leftovers/2026-05-26_evidence_out_default_path.md`
+Then the file does not exist
+
+## Unit Tests
+
+| AC Ref | What to Test | Required Outcome |
+|--------|-------------|-----------------|
+| AC-1 | Run `pytest e2e/tests/performance/` without env vars on host | Exit 0, evidence at `<workspace_root>/e2e-results/evidence/` |
+
+## Constraints
+
+- Backward-compatible — existing callers passing `--evidence-out` or setting `EVIDENCE_OUT` see no change.
+- No new dependencies; uses `pathlib.Path` which `conftest.py` already imports (verify before commit).
+
+## References
+
+- Leftover file: `_docs/_process_leftovers/2026-05-26_evidence_out_default_path.md`
+- Cycle-3 Step 15 perf report: `_docs/06_metrics/perf_2026-05-26_cycle3-tier1-probe.md` § "Findings worth tracking" item 3
+- Conftest: `e2e/runner/conftest.py:56`