The Geometry of Operational State

A scene can be locally coherent and globally wrong

Rigid transformations preserve local geometry. If every object in a sensor frame is rotated and translated by the same transformation, pairwise distances remain unchanged:

because a rigid rotation satisfies:

A local consistency check can therefore report a coherent scene while the complete scene is displaced or rotated relative to the world frame. The problem is not that the observations contradict one another. The problem is that they agree in the wrong coordinate system.

Spatial plate A Rigid-frame error Constructed scene

Interactive replacement for this plate. Plan view of a published constructed scene, with positions, zones, and footprints read from the study payload. Any of the six held-out scenes can be selected; the extruded view is an optional illustration.

Spatial plate A. Rigid-frame error. A held-out constructed scene is shown in the authoritative world frame, after reported-coordinate fusion under a shared source-frame error, and after fiducial normalization. The example is illustrative of the benchmark mechanism. It is not a customer scene.

This distinction is central to operational state. A scene can satisfy all of the following and still be wrong:

• object-to-object distances look plausible;
• every source record is well formed;
• sensor confidence is high;
• no object overlaps another;
• the scene fits inside the mapped boundary;
• the assembled state is internally consistent.

Spatial truth requires more. The state must be expressed in the correct frame, attached to the correct identities, current to the controlling revision, supported at the claimed precision, physically feasible, and topologically consistent with the operational environment.

1Operational state as a constrained geometric object

An operational scene is not merely a set of coordinates. At reconstruction boundary $\tau$, define:

where:

• $i$ is object identity;
• $g_i$ is the typed axis-aligned floor footprint;
• $p_i\in\mathbb R^2$ is floor position in the authoritative world frame;
• $z_i$ is operational zone or topological state;
• $\nu_i$ is the controlling revision;

The benchmark is deliberately planar. State estimation occurs in the floor plane. The static plates extrude the evaluated footprints using four fixed illustrative heights solely to make object identity and overlap legible; vertical height is not a generated, fitted, or evaluated benchmark variable. Object orientation is fixed by type and is not an evaluated degree of freedom. The construction is sufficient to study frame registration, identity, floor occupancy, zone topology, stale twins, and planar uncertainty without claiming arbitrary three-dimensional surface or pose reconstruction.

A source $s$ observes object $i$ through a source-specific measurement operator:

where $x_i$ denotes the relevant state variables and $\varepsilon_{is}$ represents observation error. If the source reports coordinates in its own frame $\mathcal F_s$, the world-frame relation is:

with:

A reconstruction engine does not know $R_{Ws}$ and $t_{Ws}$ merely because a source supplies a coordinate. It must inherit, estimate, or verify the transform. Related localization and mapping systems make the same separation explicit: observations acquire spatial meaning through an estimated relation between sensor pose and map state [8,9]. In the benchmark, fixed fiducials provide independent frame anchors. The normalization stage estimates:

where $a_k^s$ and $a_k^W$ are corresponding fiducials. This is the classical absolute-orientation problem [1,2]. Iterative closest-point methods generalize registration when correspondences are not fixed in advance [3], while robust estimators such as random sample consensus address contaminated correspondence sets [4].

The benchmark intentionally keeps four fiducial correspondences known. Their reported coordinates are transformed by the same live-source frame error and independent anchor noise. A two-dimensional orthogonal Procrustes fit estimates the inverse rigid map from the fiducials alone, then normalizes the camera-like and ranging observations before they are fused again with the already world-referenced digital twin. Authoritative object positions are never used for registration.

1.1A scene is more than a point cloud

For each object, define its axis-aligned floor footprint under reconstructed pose:

Hard physical feasibility requires boundary inclusion:

obstacle exclusion:

and object clearance. Let $B_i^{+0.01}(\widehat p_i)$ denote the footprint expanded by $0.01$ m on every side. The benchmark requires the interiors of the expanded footprints to be disjoint:

Equation (11) is an axis-aligned two-centimetre object-to-object clearance rule. Interior disjointness permits the two expanded boundaries to touch, which corresponds to exactly 0.02 m of separation between the original footprints and matches the benchmark implementation. These conditions are necessary, not sufficient. An object can be collision-free and still occupy the wrong ward, aisle, bay, compartment, or control zone. Let:

map spatial position to operational zone. Topological consistency requires:

where $z_i^{*}$ is the authorized zone claim at boundary $\tau$.

Identity consistency is separate again. Let $\pi_s$ map source detections to canonical object identities. A correct association requires:

If two objects exchange identities, the set of positions can remain plausible while the operational meaning is wrong. This is the classical data-association problem in another form. Multiple-hypothesis tracking and joint probabilistic data association were developed precisely because assignment uncertainty cannot be reduced to coordinate noise [5,6].

Revision consistency requires:

where $\nu_i^{*}$ is the controlling digital-twin or source revision at $\tau$. A stale twin can be geometrically smooth, complete, and self-consistent while representing an earlier physical world.

1.2Contributions and scope

We make seven contributions.

First, we define operational spatial validity as a conjunction of world-frame positional support, including frame registration and bounded-uncertainty conditions, together with identity continuity, revision currency, physical feasibility, and zone topology.

Second, we construct a controlled benchmark in which each failure mechanism alters concrete sensor, transform, identity, revision, occupancy, topology, or support state rather than merely flipping an abstract error label.

Third, we separate four reconstruction stages: reported-coordinate fusion, fiducial frame normalization, hard constraint projection, and uncertainty-aware representation.

Fourth, we show experimentally that physical constraint satisfaction can increase sharply without a comparable increase in operational truth. In the held-out set, hard projection raises physical feasibility from 85.08% to 100%, while exact point-state validity increases from 55.38% to 55.46%.

Fifth, we compare confidence-only release with a geometry-trace policy under disjoint fitting, calibration, threshold-selection, and test populations.

Sixth, we provide interactive fault, calibration, risk-coverage, diagnostic-ladder, exact-recheck, and scene-trace views together with six static geometric plates.

Seventh, we state the boundary of the result. The benchmark does not establish real sensor performance, general three-dimensional reconstruction, field fault prevalence, digital-twin correctness, or measured Cortonex deployment performance.

2Benchmark construction

2.1Scene families

The benchmark contains:

constructed scenes, divided equally among:

Each scene contains:

• a bounded $24\text{ m}\times16\text{ m}$ floor region;
• six labeled operational zones;
• two fixed obstacle bands;
• four typed axis-aligned floor footprints, rendered as extruded cuboids in the static plates;
• camera-like, ranging, and digital-twin observation channels;
• source-frame and fiducial state;
• current and prior digital-twin revisions;
• an authoritative reference geometry at boundary $\tau$.

The domain labels alter object types and dimensions. They do not reproduce clinical workflows, warehouse physics, industrial safety rules, real sensor characteristics, or domain-specific operating distributions. Each source contributes at most one boundary-time observation per object. The study does not evaluate stream latency, asynchronous delivery, temporal filtering, motion dynamics, or sequence-level tracking.

The six zone rectangles, expressed as $[x_0,x_1]\times[y_0,y_1]$ in metres, are:

The fixed obstacle bands are $[6.45,7.65]\times[5.4,15.8]$ and $[15.15,16.35]\times[5.4,15.8]$. Objects 1 through 4 are assigned, respectively, to aisle east, staging, aisle west, and quality hold. Their authoritative centers are sampled uniformly inside the assigned zone after accounting for half-footprint extent and an additional 0.15 m inward margin.

Source and registration model

Before intervention, camera-like, ranging, and digital-twin positions are generated from the authoritative object centers with independent isotropic Gaussian coordinate noise:

The baseline weights are fixed across all conditions and renormalized only over the channels available for each object. No injected condition name or materiality flag changes the reconstruction weights. The four fixed fiducials receive independent Gaussian coordinate noise with standard deviation 0.028 m per axis before rigid registration. The controlling twin revision is sampled uniformly from the integers 3 through 9, and the prior revision is one less.

For nonmaterial controls, a shared perturbation with coordinate standard deviation 0.18 m is applied at 0.25 scale to the camera-like channel and at negative 0.15 scale to the ranging channel. Nonmaterial occlusion and support-gap controls also remove one camera-like observation while preserving final validity. These values are benchmark design parameters, not estimates of deployed sensor accuracy.

2.2Condition allocation

Each scene receives one condition. Per scene family, the fixed allocation is:

For a nonclean condition, materiality is sampled as:

The frozen benchmark realized 7,015 material nonclean scenes. The 0.86 value and the condition allocation are stress-design choices. They are not estimates of field failure prevalence.

Within this benchmark, material is an intervention-strength flag, not a synonym for final invalidity. It selects the higher-amplitude branch of the named mechanism before normalization, projection, uncertainty representation, and release evaluation. A material frame mismatch can be corrected by fiducial registration, and a material occlusion intervention can become release-valid through a bounded uncertainty region. Materiality therefore describes the injected challenge, while validity describes the final reconstructed state.

Nonmaterial controls preserve the final valid state while introducing ambiguous telemetry, such as partial source absence or mild inter-source disagreement. They are assigned within the same condition strata, but they are not mechanism-matched counterfactuals for every material intervention. Their purpose is to prevent the fitted trace policy from treating every anomaly as a fault.

2.3Failure mechanisms

Rigid frame mismatch

The camera-like and ranging channels receive the same rotation and translation in their reported coordinate frame:

The pairwise geometry can remain plausible even when the world placement is wrong.

Identity collision

Two object assignments are exchanged through an incorrect association map:

The geometry may still contain the correct number of boxes, but the state belongs to the wrong objects.

Occlusion overcommitment

Live support is removed for one object, and the remaining estimate is biased while initially represented with unjustified precision. The fault is not merely positional error. It is the mismatch between evidential support and reported uncertainty.

Stale digital twin

A prior revision contributes state as if it were current:

Live observations for the affected object are partially absent, allowing the stale twin to dominate fusion.

Impossible occupancy

All sources agree on a placement intersecting a fixed obstacle or another object. This creates a physically impossible but observationally coherent state.

Topology breach

An object is assigned to a region outside its authorized operational zone:

The injected topology mechanism does not enforce hard feasibility before fusion. Some topology-labelled scenes therefore also activate boundary, obstacle, or object-clearance checks. The condition name identifies the intervention family, not an exclusive validity component.

Support gap

Current live observations are absent, and the system falls back to an older twin state. Some cases are overt because a required field is missing; others remain silent.

Compound geometry fault

A shared frame error is combined with either identity collision or stale-twin wrong-zone state.

The nine condition labels are intervention families rather than mutually exclusive failure predicates. An identity exchange can also create a footprint conflict because object dimensions differ. An impossible-occupancy placement can also violate zone topology. A topology intervention can be infeasible before projection. Fault-level tables must therefore be read as behavior under the named intervention, not as a decomposition into orthogonal causes.

The material intervention parameters are fixed as follows:

These choices define the stress suite. They are not empirical distributions of field faults.

2.4Data separation

The 12,000 scenes are partitioned before final evaluation:

The split is stratified by typed scene family and condition. Held-out aggregate validity labels do not estimate policy coefficients, calibration parameters, or release thresholds. Diagnostic channels in every split are generated by the same frozen response formulas, several of which use constructed latent predicates disclosed in Section 5.3. Let $\mathcal T$ denote the held-out test population and define:

3Reconstruction stages

3.1Reported-coordinate fusion

For object $i$, let $\mathcal A_i$ be the available sources and $w_{is}$ their normalized weights. The baseline point estimate is:

This stage trusts each source's reported world coordinates and canonical identity.

3.2Fiducial frame normalization

The second stage estimates an inverse rigid transform from four fixed anchors using Equation (7), maps the camera-like and ranging observations into the world frame, and then repeats fusion while leaving the already world-referenced digital twin unchanged:

The benchmark does not use authoritative object positions to estimate this correction. Only fixed fiducials are available.

3.3Hard physical constraint projection

Let $\bar S$ denote the normalized point reconstruction, with normalized fused object positions $\bar p_i$, and let $\mathcal C_{\mathrm{hard}}$ be the set satisfying Equations (9) through (11). The ideal Euclidean projection is:

Projection methods are standard tools in convex feasibility [11]. The benchmark hard set is nonconvex because of pairwise clearance, and the study does not claim to solve Equation (24) globally. Its implementation is an order-dependent deterministic approximation. Objects are processed sequentially. Candidate displacements use radii from 0.25 m to 5.00 m in 0.25 m increments, with 24 equally spaced directions at each radius, plus the zero-displacement candidate. The nearest feasible candidate is selected. This is not a general optimizer for a nonconvex three-dimensional scene.

Even an exact selection from the minimizers in Equation (24) would choose a closest feasible state to the input, not necessarily the authoritative state. If the input is wrong because of identity, topology, or stale revision, a geometrically minimal repair can remain operationally wrong.

Spatial plate B Feasible but wrong Constructed scene

Interactive replacement for this plate. Plan view of a published constructed scene, with positions, zones, and footprints read from the study payload. Any of the six held-out scenes can be selected; the extruded view is an optional illustration.

Spatial plate B. Feasible but wrong. The hard projection removes the constructed occupancy violation. It cannot infer the authoritative position merely from the fact that a nearby feasible position exists.

3.4Uncertainty-aware representation

A point estimate is not always the correct output. For object $i$, the benchmark uses an isotropic Gaussian-form support model:

Let $c_i\in\{1,2,3\}$ be the number of available source channels in the frozen benchmark. The digital-twin channel is always retained, so the zero-source state is not evaluated. Let $\bar p_i$ be the normalized weighted fusion from Section 3.2. The spread used by the benchmark is the unweighted root mean squared distance of the available normalized source points from that weighted fusion, $s_i=\sqrt{|\mathcal A_i|^{-1}\sum_{s\in\mathcal A_i}\lVert\widehat p_{is}^{W}-\bar p_i\rVert_2^2}$. In Equation (25), $\mu_i$ is the projected point center from Section 3.3. The nominal scale is the explicit design rule:

No intervention label, condition name, materiality flag, authoritative reference error, or final validity label enters Equation (25a). The same width rule is applied to every object in every scene. The support model remains constructed and nominal, but it is label-independent at inference time.

The corresponding nominal $1-\alpha$ support contour is:

For the planar benchmark:

For the isotropic planar model, contour area is:

The benchmark accepts uncertain positional support only when the authoritative reference is inside the nominal 95% contour and the contour area does not exceed a fixed ceiling. The word nominal is important: the construction does not claim frequentist 95% coverage in a field population.

The ceiling prevents an arbitrarily broad region from making every point trivially supported.

Spatial plate C Partial observation Constructed scene

Interactive replacement for this plate. Plan view of a published constructed scene, with positions, zones, and footprints read from the study payload. Any of the six held-out scenes can be selected; the extruded view is an optional illustration.

Spatial plate C. Partial observation. The uncertainty region exposes what the observations do not determine. It does not convert an unsupported point into a verified location.

4Validity and release

4.1Positional support

For point-valued stages, object error is:

Point position is accepted when:

Scene positional root mean squared error is:

The stage table reports the arithmetic mean of scene-level RMSE, so each scene receives equal weight:

This is not the pooled object-level RMSE. For reference, pooled object-level RMSE is 4.0097 m for reported-coordinate fusion, 3.8879 m after frame normalization, and 3.9061 m after projection. The article uses mean scene-level RMSE because the scene is the evaluation unit.

For the uncertainty-aware stage, an object is position-supported when either Equation (31) holds or Equations (28) and (29) hold. Hard physical feasibility is evaluated at the projected point centers. The benchmark does not require every point inside an uncertainty contour to satisfy the hard constraints.

4.2Release validity

From this section onward, index $i$ denotes a scene rather than an object. Define binary scene conditions:

• $P_i$: every object is supported in the authoritative world frame, either by the point tolerance or by the bounded uncertainty rule;
• $I_i$: object identities remain correct;
• $R_i$: the controlling revision is current;
• $O_i$: hard occupancy constraints hold;
• $T_i$: operational zone topology is correct.

Frame error is evaluated through world-frame positional and zone support, while uncertainty honesty is part of $P_i$. The benchmark release-validity label is therefore:

The multiplication denotes Boolean conjunction. It does not assume statistical independence.

A physically feasible scene satisfies only:

Therefore:

but:

Equation (36) is the central distinction in the study.

4.3Base hold and silent invalidity

Let $B_i=1$ when the base assembler visibly holds a scene because observation confidence is below 0.49 or a required object field is missing.

A base-silent invalid scene is:

An overt invalid scene is:

The held-out identities are:

and:

Thus, 993 invalid held-out scenes pass the ordinary base rule without a visible hold.

The base comparator is deliberately minimal. All 183 base holds, including all 44 held-out base holds, occur in material support-gap scenes with at least one required object field missing. Seventeen of those complete-benchmark scenes, including two held-out scenes, also fall below the scalar confidence threshold, but the missing required field already holds them. The base-silent count therefore means silent relative to this limited comparator, not silent relative to a mature production release policy.

5Release policies

5.1Scalar observation-confidence gate

The scalar policy receives only the one-world observation-confidence value. It does not see the condition label, materiality, authoritative scene, or benchmark validity bit.

5.2Geometry trace gate

The geometry trace policy receives eight noisy one-world diagnostics:

1. observation confidence;
2. constructed identity-consistency response;
3. digital-twin revision freshness;
4. observation support completeness;
5. zone-claim consistency;
6. spatial lineage completeness;
7. constructed association-consistency response;
8. frame, revision, and projection integrity.

5.3Constructed diagnostic-response model

The trace channels are generated by an explicit response model. They are not measurements from deployed sensors or a production reference monitor. For a latent channel value $\ell\in[0,1]$ and declared reliability $r$, the observed diagnostic is:

The exact latent definitions and response reliabilities are:

Here $\bar c$ is mean source availability, $\bar s$ is mean normalized inter-source spread, and $r_f^{\mathrm{pre}}$ is the root mean squared discrepancy between the reported and known world-frame fiducial coordinates before rigid correction. In the lineage channel, $u_\nu^{\mathrm{line}}=1$ for a current revision and $0.15$ when stale. The frame term is $u_f=1$ when post-registration fiducial residual is below $0.18$ m and $0.35$ otherwise. The association offset is $u_I=0.10$ for a correct identity and $0.08$ otherwise; when identity is incorrect, the complete association latent is capped at $0.22$. In the integrity channel, $u_\nu^{\mathrm{int}}=1$ for a current revision and $0.42$ otherwise, $u_\Phi=1$ when the normalized point scene is physically feasible and $0.32$ otherwise, and $d_{\mathrm{proj}}$ is the sum of object-center displacement introduced by hard projection. No injected condition name or materiality flag enters this channel.

Observation confidence is generated separately. Let $\bar c$ again denote mean source availability and let $a_i=e^{-\bar s_i/(0.9\text{ m})}$ denote position agreement for scene $i$. Its pre-noise center is:

where $\delta_i^{\mathrm{miss}}=1$ when a required object field is missing and is zero otherwise. The reported value is $\operatorname{clip}_{[0,1]}(\mathcal N(\mu_{C,i},0.065^2))$. Coherent faults can therefore remain confident through source agreement itself; the confidence generator does not receive the intervention class.

Several latent channels are noisy responses to benchmark validity components rather than outputs of independently evaluated raw-sensor algorithms. The trace result is therefore a conditional observability result under this diagnostic model. It is not an independent estimate of how accurately a deployed system would infer identity, revision, topology, or integrity from field data. On the held-out set, the individual channel AUROCs for validity range from 0.607 to 0.795; the combined policy gains its separation by composing several partially informative channels.

5.4Fitting and calibration

For policy $k$ with standardized feature vector $\mathbf x_i^{(k)}$, the fitted validity score is:

where:

The feature standardizer and an $L_2$-regularized logistic model are fitted only on the training population. The implementation uses balanced class weights, regularization parameter $C=1$, and the LBFGS solver. A separate sigmoid calibration map is then fitted on the calibration population using a near-unregularized one-dimensional logistic fit with $C=10^6$:

Probability calibration and ranking answer different questions [12]. The study therefore reports Brier score, expected calibration error, ranking metrics, detection, false holds, coverage, and selective risk together.

5.5Threshold selection

A scene is held when the base rule already holds it or fitted validity falls below threshold:

The numerical tolerance prevents machine-level equality changes from altering a threshold tie.

Thresholds are chosen on the threshold-selection population to maximize invalid-scene detection subject to a 2% valid false-hold budget. When two feasible observed thresholds hold the same number of invalid scenes, the larger threshold is selected:

subject to:

The selected thresholds are:

The threshold-selection population contains 680 valid scenes, so the integer budget is:

Both selected policies hold exactly 13 valid threshold-selection scenes. Their separate held-out false-hold rates are allowed to differ.

6Reconstruction results

6.1Stage comparison

Frame normalization raises exact scene validity by:

percentage points, while reducing mean positional RMSE by:

Hard projection raises physical feasibility by:

percentage points relative to frame normalization. Yet exact scene validity increases by only:

percentage points.

This is not a paradox. Projection solves a feasibility problem. It does not recover lost identity, establish the current twin revision, restore missing observations, or infer the correct operational zone.

Uncertainty-aware representation adds 32 release-valid scenes beyond the exact projected point state:

percentage points. All 32 additional release-valid scenes are occlusion-overcommitment cases that satisfy the common source-count and inter-source-spread rule in Equation (25a). No condition-specific width is applied. The gain remains benchmark-specific because the width formula and area ceiling are design choices, not field-calibrated uncertainty estimates.

6.2Interactive figure 1: Spatial observability matrix

The first interactive figure maps each fault class against nine diagnostic channels. It should be read as an observability matrix, not a causal attribution chart.

The matrix compares observation confidence, identity consistency, revision freshness, observation support, zone consistency, lineage completeness, association consistency, frame and projection integrity, and exact benchmark validity.

6.3Hard feasibility can hide wrong identity

Spatial plate D Identity collision Constructed scene

Interactive replacement for this plate. Plan view of a published constructed scene, with positions, zones, and footprints read from the study payload. Any of the six held-out scenes can be selected; the extruded view is an optional illustration.

Spatial plate D. Identity collision. The spatial set can remain plausible while the correspondence map is wrong. A collision checker cannot recover identity.

6.4Projection can erase the visible symptom

Spatial plate E Projection displacement Constructed scene

Interactive replacement for this plate. Plan view of a published constructed scene, with positions, zones, and footprints read from the study payload. Any of the six held-out scenes can be selected; the extruded view is an optional illustration.

Spatial plate E. Projection displacement. The scene becomes collision-free after projection. The repair may remove the most obvious symptom while leaving the reconstructed location unsupported by the authoritative scene.

6.5Topology is not reducible to occupancy

Spatial plate F Topology breach Constructed scene

Interactive replacement for this plate. Plan view of a published constructed scene, with positions, zones, and footprints read from the study payload. Any of the six held-out scenes can be selected; the extruded view is an optional illustration.

Spatial plate F. Topology breach. This selected held-out example is physically feasible after reconstruction but violates its authorized operational zone. Across the intervention family, pre-projection hard feasibility is not guaranteed.

7Release-policy results

7.1Operating-point measurements

For policy $k$, invalid detection is:

Base-silent detection is:

Valid false-hold rate is:

Release coverage is:

Invalidity among released scenes, the selective risk, is defined when at least one test scene is released:

The scalar gate holds:

of invalid scenes and:

of base-silent invalid scenes.

The geometry trace gate holds:

of invalid scenes and:

of base-silent invalid scenes.

It false-holds:

of valid scenes.

The scalar policy releases 2,252 scenes, of which 923 are invalid:

The trace policy releases 1,429 scenes, of which 91 are invalid:

The reduction in released invalidity is therefore:

percentage points.

The corresponding reduction in release coverage is:

percentage points.

The stronger gate is not free. It routes substantially more scenes to review.

7.2Ranking and calibration

The Brier score is:

Ten-bin expected calibration error is:

Here $\operatorname{acc}(B_m)$ is the empirical valid-scene fraction in bin $B_m$, and $\operatorname{conf}(B_m)$ is its mean fitted validity probability. The bins are the ten equal-width intervals $[0,0.1),[0.1,0.2),\ldots,[0.8,0.9),[0.9,1]$; empty bins contribute zero and are omitted from the displayed reliability points.

The scalar score provides weak discrimination for ranking validity. This is intentional. Several faults are constructed to remain locally coherent and highly confident. Confidence is not a substitute for frame, identity, revision, occupancy, topology, and support diagnostics.

7.3Nominal Wilson intervals

For an observed rate $\widehat p=x/n$, the two-sided nominal 95% Wilson interval is:

For trace invalid detection, the interval is approximately:

For trace base-silent detection:

For trace valid false holds:

These are finite-count Bernoulli summaries. They are not deployment confidence intervals, design-based intervals over all possible constructed benchmarks, or field-performance guarantees.

7.4Interactive figure 2: Fault-level geometry atlas

The two fitted residual classes are occlusion overcommitment and impossible occupancy. The trace policy holds 48 of 121 invalid held-out occlusion scenes, or 39.67%, leaving 73 invalid releases. It holds 167 of 185 invalid impossible-occupancy scenes, or 90.27%, leaving 18 invalid releases. It detects every invalid held-out case in identity collision, stale twin, topology breach, support gap, and compound-fault classes. Such complete separation is a property of the instrumented construction. It is not evidence that field systems expose equally clean diagnostics.

7.5Interactive figure 3: Progressive geometry-control ladder

The progressive figure independently fits five policies:

7.6Interactive figure 4: Spatial risk versus release coverage

Selective classification trades coverage for lower released risk [13]. The fixed threshold grid preserves the irreversible base hold.

7.7Interactive figure 5: Validity-probability reliability

8Fault interpretation

8.1Rigid frame mismatch

Frame mismatch is conceptually important because local geometry can remain intact. In the held-out class, reported-coordinate fusion is valid in 51 of 288 scenes, or 17.71%, while correspondence-based fiducial normalization makes all 288 scenes release-valid under the simplified anchor model. This is a recovery result under known, well-spread correspondences, not a claim about unconstrained field registration. The trace policy still false-holds 2 corrected scenes because it treats evidence of a large pre-normalization frame discrepancy conservatively.

A translation-only correction is insufficient when the source frame is rotated. If:

then subtracting only $t$ leaves:

This equals the world-frame point for every possible $p$ only when:

8.2Identity collision

Identity is not recoverable from non-overlap alone. A feasible assignment of boxes can correspond to an incorrect permutation. Because the benchmark objects have different footprints and authorized zones, an identity exchange can also create occupancy or topology failure. The intervention label names the assignment fault, not an isolated geometric predicate. The state space is therefore partly discrete:

where $\mathfrak S_n$ is the permutation group over object identities.

8.3Occlusion overcommitment

Occupancy-grid and probabilistic-robotics methods treat unknown space as a distinct state rather than automatically declaring it free or occupied [7,10]. The same principle applies at object level. Under partial observation, uncertainty should expand. A narrow point estimate is a stronger claim than the evidence supports.

The benchmark's uncertainty-aware stage rescues many occlusion cases because it asks whether the authoritative state lies inside a bounded region, not whether an unsupported point happens to be exact.

8.4Stale digital twin

A digital twin is not current merely because its geometry is internally consistent. The ISO 23247 series provides a structured digital-twin framework for observable manufacturing elements [14]. Operational use still requires an explicit rule identifying which revision controls at the decision boundary.

8.5Impossible occupancy

Hard projection is highly effective at removing constructed overlap and boundary violations under the explicit two-centimetre object-clearance rule. It is deliberately weak at identifying truth. An impossible-occupancy intervention can also move an object into the wrong operational zone. In the held-out benchmark, all projected scenes are physically feasible, yet 1,069 remain invalid as exact point states and 1,037 remain invalid after the bounded uncertainty rule is applied.

8.6Topology breach

Operational topology adds semantics to geometry. A room, aisle, hold zone, sterile area, restricted bay, or safety envelope is not equivalent to free Euclidean space. The injected topology intervention selects a wrong zone but does not guarantee pre-projection physical feasibility, so some cases also activate hard constraints. After projection, a state can be collision-free while remaining operationally forbidden.

8.7Support gap

A missing live observation should not be replaced silently by an older twin without a current-revision check. The base rule catches some support gaps as overt. The remainder require trace-level revision and support diagnostics.

9Exact recheck and conditional transfer

9.1Exact geometry oracle

The exact oracle is defined as:

Its hold rule is:

Perfect separation follows by construction. The oracle has no AUROC, average precision, Brier score, expected calibration error, or reliability curve. It is not a fitted detector and not measured Cortonex performance.

9.2Risk-prioritized exact recheck

The idealized recheck overlay applies exact benchmark validity to increasing fractions of trace-released scenes, ordered from lowest to highest fitted trace probability. It can add holds but cannot reverse an existing trace hold.

Full-overlay release remains below the standalone oracle's 56.79% because the overlay preserves the trace policy's 25 valid false holds.

9.3Conditional prevalence scenarios

Let:

• $\varrho$ be an assumed operating invalid-scene prevalence;
• $d_k$ be held-out invalid detection;
• $f_k$ be held-out valid false-hold rate.

Projected hold rate is:

Projected invalidity among released scenes is:

At an assumed invalid prevalence of 5%, the conditional calculations are:

These are sensitivity calculations, not deployment forecasts. They assume the benchmark's conditional detection and false-hold rates remain unchanged when prevalence changes.

10Interactive scene traces

The scene explorer contains six explicitly constructed held-out examples:

1. rigid frame mismatch;
2. identity collision;
3. occlusion overcommitment;
4. stale digital twin;
5. impossible occupancy;
6. topology breach.

For each scene, the explorer exposes:

• typed scene family;
• authoritative object-zone facts;
• emitted object-zone facts;
• current revision;
• attached twin revision;
• source-bundle description;
• fault mechanism;
• scalar confidence;
• fitted trace probability and hold state;
• exact oracle status.

11Study specification and verification

This study uses a programmatically constructed benchmark developed for controlled evaluation. The frozen seed is $70{,}629{,}431$. Exploratory development informed the benchmark and diagnostic-response design before the final protocol was frozen; the study was not preregistered. The final protocol nevertheless keeps fitting, calibration, threshold selection, and held-out testing disjoint. The public article reports:

• scene-family composition;
• facility geometry and object abstraction;
• condition allocation;
• materiality process;
• source and reconstruction stages;
• frame-normalization objective and fixed-fiducial construction;
• physical and topological constraints;
• uncertainty-support rule;
• release-validity definition;
• four-way data separation;
• fitted-policy, diagnostic-response, and calibration method;
• threshold-selection and numerical tie rule;
• aggregate held-out results;
• confidence intervals;
• calibration and selective-risk measurements;
• principal limitations.

The Cortonex Lab retains the versioned benchmark, scene-level outputs, fitted-policy state, generator, and separate verification materials used to produce the reported results. These internal research materials are not part of the public release.

All published operating-point values were regenerated from the frozen scene-level test output and checked through a separate verification path before packaging. This is internal technical verification, not outside certification or peer review.

Data and code availability. The experimental design, scene composition, fault mechanisms, metrics, aggregate results, geometric plates, and limitations are documented in this publication. Scene-level benchmark data, fitted-policy state, construction code, and private verification materials are retained by The Cortonex Lab and are not publicly distributed.

12Limitations

12.1Constructed scenes

The benchmark uses generated geometry, not field data. Its scene distributions, dimensions, fault allocation, materiality probability, noise scales, source weights, thresholds, and review budget are design choices.

12.2Planar state with illustrative extrusion

The evaluated state contains axis-aligned floor footprints and center positions only. The static geometric plates extrude those footprints using fixed illustrative heights that do not enter any benchmark label or metric. The study does not evaluate object height, arbitrary meshes, deformable objects, articulated systems, full six-degree-of-freedom pose, surface reconstruction, photometric consistency, or dynamic contact mechanics.

12.3Boundary-time observations rather than streams

Although the publication title refers to sensor streams, the benchmark reduces each channel to a constructed observation at one reconstruction boundary. It does not evaluate streaming latency, asynchronous arrival, dynamic filtering, temporal association, motion continuity, or sequence-level state estimation.

12.4Simplified registration

Four fiducial correspondences are known, well spread across the constructed floor, and corrupted only by modest independent coordinate noise. Real registration can fail through poor anchor geometry, outliers, moving anchors, repeated structure, partial overlap, nonrigid distortion, and degenerate viewpoints. ICP and related methods can converge to local solutions [3].

12.5Simplified data association

Identity faults are constructed as assignment collisions. The benchmark does not model long-horizon track birth and death, dense crowding, appearance drift, adversarial identity mimicry, or full multiple-hypothesis tracking.

12.6Hard projection is deliberately narrow

The projection stage enforces boundary, obstacle, and the explicit two-centimetre object-clearance rule through deterministic local search. It is not a general solver for nonconvex three-dimensional feasibility. It does not infer hidden semantics or recover authoritative state from physical constraints alone.

12.7Uncertainty regions are isotropic and constructed

The benchmark uses isotropic planar Gaussian-form support regions derived only from available-source count and post-registration inter-source spread. The same width rule is applied across all conditions, without intervention labels or materiality flags. Even so, the formula and the 22 square metre area ceiling are benchmark design choices rather than field-calibrated uncertainty estimates. The 95% contour is nominal and is not calibrated as a population coverage guarantee. Projection displacement does not widen the support region, so the construction can understate uncertainty after a large geometric repair. Hard feasibility is checked at the projected point centers; the full uncertainty contours are not truncated by obstacles, boundaries, other objects, or zone topology. Real sensor uncertainty can be anisotropic, multimodal, non-Gaussian, correlated across objects, and conditional on visibility, calibration, motion, or the repair operation itself.

12.8Operational topology is typed but simple

Zones are fixed rectangles, and zone validity is evaluated from each object center rather than full-footprint containment. Real operational topology can include access direction, reachability, containment hierarchies, temporal occupancy rules, safety envelopes, route constraints, and policy-dependent zone semantics.

12.9Digital-twin revision is explicit

The benchmark supplies current and prior revision identifiers. Field systems can have missing revisions, branching histories, inconsistent clocks, partial updates, and unclear authority.

12.10The base comparator is deliberately minimal

Every base hold occurs in a material support-gap scene with a missing required field, and the confidence threshold adds no unique hold beyond that missing-field condition. The 993 base-silent held-out scenes are therefore silent relative to this deliberately limited comparator. They are not an estimate of what would pass a mature Cortonex release policy or a well-instrumented production geometry system.

12.11The diagnostic response model is assumed

The geometry trace receives parameterized noisy responses to identity, revision, support, zone, lineage, association, and integrity state. The identity and association channels are constructed responses to latent benchmark state, not outputs of an independently evaluated signature or multi-object association algorithm. The integrity channel uses only fiducial residual, revision metadata, pre-projection feasibility, and projection displacement, but its response formula and reliability remain designed rather than field measured. These channels are cleaner and more directly instrumented than many deployed systems can provide. The 91.22% result is conditional on the disclosed response formulas and reliability settings. Field performance would depend on whether the same properties can be inferred from raw sources without access to benchmark truth.

12.12Fault families are not orthogonal

Condition names identify the injected mechanism. They do not partition final invalidity into exclusive causes. Identity exchange, impossible occupancy, topology, stale revision, and compound interventions can activate multiple positional, occupancy, topology, identity, or revision predicates at once.

12.13One primary frozen seed and no preregistration

The reported benchmark uses one primary frozen seed, $70{,}629{,}431$. Exploratory work informed the final design before freezing, and no preregistration was filed. Deterministic regeneration verifies the retained experiment. A limited post hoc internal sensitivity check over additional seeds is retained with the private verification record, but it was not preregistered, does not alter the primary tables, and does not establish robustness to structural benchmark choices.

12.14No operational cost model

The study reports release coverage and false holds but does not measure human review time, correction cost, latency, compute cost, sensor cost, or consequences of delay.

12.15No field prevalence

The held-out invalid prevalence is:

This high prevalence is created by the stress design. It is not an estimate of real operational invalidity.

12.16No production claim

The reported 91.22% invalid-scene detection is a held-out measurement on the disclosed constructed benchmark. It is not Cortonex production performance, a customer outcome, or a guarantee.

13Conclusion

Operational state is not established by collecting more coordinates. A defensible reconstruction must answer several independent questions:

• Are observations expressed in the correct frame?
• Do observations belong to the correct objects?
• Is the digital-twin revision current?
• Does the state satisfy hard physical constraints?
• Does it satisfy operational topology?
• Is the claimed precision supported by the available observations?
• Can the release system distinguish a feasible repair from an authoritative state?

The benchmark exposes the consequences of collapsing these questions into one confidence value. Reported-coordinate fusion is often locally plausible. Frame normalization repairs a specific global failure class. Hard projection eliminates constructed physical impossibility. Uncertainty-aware representation prevents partial observation from becoming false precision. None of these alone establishes operational truth.

The strongest result is not the aggregate detection rate. It is the separation between physical feasibility and release validity. On the held-out stress suite, hard projection makes every scene physically feasible, yet only 55.46% are exactly valid as point states. A physically possible world can still be the wrong world.

The Cortonex Lab therefore treats geometry as evidence-bearing state. Coordinate frames, identities, revisions, constraints, topology, uncertainty, and release status must remain attached to the reconstruction. A world model should not be released because it looks coherent. It should be released only when the system can state what makes that coherence defensible.

@techreport{cortonexlab-geometry-of-operational-state,
  author      = {{The Cortonex Lab}},
  title       = {The Geometry of Operational State: Reconstructing Physically
                 Coherent Reality from Sensor Streams, Digital Twins, and
                 Incomplete Observations},
  institution = {The Cortonex Lab, Cortonex Technologies Inc.},
  version     = {1.7},
  url         = {https://cortonex.com/lab/geometry-of-operational-state/},
  note        = {Controlled constructed planar spatial benchmark;
                 no production-performance claim.}
}

References

1. Horn, B. K. P. Closed-form solution of absolute orientation using unit quaternions. Journal of the Optical Society of America A, 4(4), 629-642, 1987.
2. Arun, K. S., Huang, T. S., and Blostein, S. D. Least-squares fitting of two 3-D point sets. IEEE Transactions on Pattern Analysis and Machine Intelligence, 9(5), 698-700, 1987.
3. Besl, P. J., and McKay, N. D. A method for registration of 3-D shapes. IEEE Transactions on Pattern Analysis and Machine Intelligence, 14(2), 239-256, 1992.
4. Fischler, M. A., and Bolles, R. C. Random sample consensus: a paradigm for model fitting with applications to image analysis and automated cartography. Communications of the ACM, 24(6), 381-395, 1981.
5. Reid, D. B. An algorithm for tracking multiple targets. IEEE Transactions on Automatic Control, 24(6), 843-854, 1979.
6. Fortmann, T., Bar-Shalom, Y., and Scheffe, M. Sonar tracking of multiple targets using joint probabilistic data association. IEEE Journal of Oceanic Engineering, 8(3), 173-184, 1983.
7. Elfes, A. Using occupancy grids for mobile robot perception and navigation. Computer, 22(6), 46-57, 1989.
8. Durrant-Whyte, H., and Bailey, T. Simultaneous localization and mapping: part I. IEEE Robotics and Automation Magazine, 13(2), 99-110, 2006.
9. Bailey, T., and Durrant-Whyte, H. Simultaneous localization and mapping: part II. IEEE Robotics and Automation Magazine, 13(3), 108-117, 2006.
10. Thrun, S., Burgard, W., and Fox, D. Probabilistic Robotics. MIT Press, 2005.
11. Bauschke, H. H., and Borwein, J. M. On projection algorithms for solving convex feasibility problems. SIAM Review, 38(3), 367-426, 1996.
12. Guo, C., Pleiss, G., Sun, Y., and Weinberger, K. Q. On calibration of modern neural networks. Proceedings of the 34th International Conference on Machine Learning, 70, 1321-1330, 2017.
13. Geifman, Y., and El-Yaniv, R. Selective classification for deep neural networks. Advances in Neural Information Processing Systems, 30, 2017.
14. International Organization for Standardization. ISO 23247-1:2021, Automation systems and integration, digital twin framework for manufacturing, part 1: overview and general principles. 2021.