Every factory-offset joint is clamped exactly ON its encoder seam — #35 may affect all six

[OriNachum]

The finding

Probing all six joints by feel (gentle_move driven to each end of its permitted range),
three of them reached the software bound with no contact — still free — and stopped this
close to the encoder seam:

joint	reported	→ raw	seam @ raw	gap	outcome
shoulder_lift	4094	83	85	2 ticks	no wall
gripper	4093	82	85	3 ticks	no wall
shoulder_pan	4085	74	85	11 ticks	no wall

No contact means they could have kept going. Their remaining travel lies across the seam.

Why this is structural, not coincidence

Every joint except elbow_flex still carries the factory offset Ofs = 85. The
commandable bound is reported tick 4095. With Ofs = 85 that is raw 84 — exactly
one tick below the seam, which lives at raw == Ofs == 85.

For every joint at the factory offset, the software bound lands precisely on the seam.

So the arm has been reporting the seam as its boundary. We could not see past it, so we
could not know any of these joints' real ranges. elbow_flex is the only honest row in that
table — real walls at both ends (raw 983 and 3267), with 829 ticks of clearance from its seam —
and only because #35's re-zero moved its seam out of its travel.

Direct physical confirmation

shoulder_lift was left at reported 4094 by a probe. Torque released, and it sagged
under gravity through the seam — it now reads 2 (raw 87). Nothing commanded it there.
Its travel demonstrably includes the seam.

What this means

• Issue elbow_flex and wrist_roll encoders wrap — a [min, max] range cannot describe them, and gentle_move cannot converge across the seam #35 is potentially a six-joint problem, not a two-joint one. The "linear tick axis"
  the whole codebase assumes may be false for most joints, and we could not tell because the
  clamp hid it.
• It partly explains why the reachability map was garbage (arm explore's grid is derived from the wrong things — EEPROM bounds and a global bucket size (r2) #34). Not only was the grid wrong
  — the measurements feeding it were bounded by an artifact.
• Every per-joint range recorded before today for these joints is suspect at its high end.

The chicken-and-egg, and the way out

To re-zero a joint you need its unreachable arc; you cannot measure the arc until you can see
past the seam. The escape (already proven on elbow_flex): temporarily shift the offset so
the seam moves out of reach, probe freely to find the true travel, then compute the permanent
offset from that — and restore it if you decide not to commit.

Three probe lessons worth encoding in whatever verb does this

1. Creep outward; do not command the bound. Shifting the offset also flips which reported
   direction maps to which physical direction, so "drive to reported 4095" can mean "drive
   back into the wall you just found". Stepping outward from the current position is immune.
2. "Not contacted" is not "no wall". A move can also time out — it could not get there and
   we learned nothing. Conflating that with "reached the bound" silently turns ignorance into a
   measurement. Three outcomes must stay distinct: WALL / EDGE / TIMEOUT.
3. Mechanical vs environmental. A limit found in one pose is environmental — it is what the
   joint can do given where every other joint happens to be. The mechanical limit is the
   widest envelope ever seen across poses, since an obstacle can only ever make a range smaller.
   Mechanical limits belong in arm_spec (intrinsic, portable); environmental limits belong in
   the map (pose-dependent — and never in the servo's EEPROM).

elbow_flex's walls were confirmed mechanical by this test: probed in three poses
(shoulder_lift 3354 vs 3779, wrist_flex 3963 vs 1366), the wall moved by ≤4 ticks while other
joints moved by hundreds.

Related

Found during the hardware session that proved #35's re-zero — see
docs/hardware-rezero-run-2026-07-12.md. Blocks meaningful progress on #34, since the grid
cannot map a joint-space whose per-joint extents are artifacts.

[OriNachum]

STATUS 2026-07-13 — the build shipped, the hardware run happened, and it overturned a "PROVEN" fact

Read this before picking the work up cold. It is the fastest path back in.

Branch feat/arm-limits, PR #48, now v0.24.1, 1697 tests green.

What SHIPPED and is trustworthy

arm limits — the rolling frame, the crash-safe calibration journal, the raw-tick boundary, the
classifier, the creep, the four-verdict record, the commit path. Proven on hardware:

• elbow_flex re-derived from nothing: unreachable arc within 8 ticks of the shipped
  table, re-zero offset 1158 vs 1157 — one tick — having driven itself through the encoder
  seam. No joint names anywhere in the classifier.
• require_clean restored the arm from a temporary calibration a dead process left behind.

THE FINDING — wrist_roll is NOT continuous. It never was.

arm_spec recorded, in as many words, "This refusal is PROVEN and it stays": that
wrist_roll "turns freely all the way round (measured free range [21, 4073])", has no
unreachable arc by definition, and so can never be re-zeroed.

It was not proven. It was an artifact of an instrument that could not fire.

wrist_roll's contact threshold was 400. Its walls press at 272 / 288 (and its weak end
at only 172-196). _StallDetector.is_contact needs load > threshold, so contact could
never fire, however hard the joint pushed. The [21, 4073] "free range" was not a measurement
of a free joint — it was a joint driving into real stops with the software deaf to it.

A human hand finds two ends (raw 1769 / 1429, torque off, at-rest reads). The joint is
bounded. The claim is withdrawn.

The threshold band was wrong on BOTH sides, and both errors pushed it UP — the blinding direction

bound	what we thought	what it actually is
ceiling	500 — where present_load saturates	the load at the joint's WEAKEST WALL. 500 is where the sensor stops, not the joint.
floor	the joint's free-motion peak	the load in the servo's pre-onset dead window. An advancing joint never stalls, so a high free-motion load cannot false-contact — the stall gate covers it.

Only wrist_roll fails to saturate. Five of six joints shove the full 500 into a stop, so
almost any threshold under 500 fires on them — which is exactly why "the ceiling is 500" survived
unchallenged. A rule validated on the easy cases is not validated.

Every wall load, now MEASURED (follower, 2026-07-13)

joint	verdict	wall load	threshold	note
shoulder_pan	BOUNDED	500 / 500	250	arc 3330 — wraps the seam
shoulder_lift	UNDETERMINED	swept 53 ticks	200	pose-limited -> #52
elbow_flex	BOUNDED	500	280	arc ~1600
wrist_flex	UNDETERMINED	500 / 500	250	overload race -> #52
wrist_roll	unstable	172 / 196 / 272 / 288 / 476 / 500	400 -> 120	compliant -> #51
gripper	BOUNDED	500 / 284	250 -> 200	arc 2587 — wraps the seam

The gripper is the near-miss and the generalisable lesson. Its two ends are NOT alike: low
wall saturates at 500, high wall pushes only 284. Against the old 250 threshold that is a
34-tick margin. It fired — but a weaker wall, a warmer joint, a lighter grip, and it goes the
way of wrist_roll, silently. The ceiling is the WEAKEST wall, not the average one, and one
joint can have one of each.

shoulder_pan and gripper both WRAP the seam with arcs wide enough to re-zero into.
elbow_flex is no longer the only re-zeroable joint. Not acted on — that is a decision.

The guard that now makes this class of bug announce itself

LimitVerdict.UNFIRABLE_THRESHOLD (a fifth verdict). A probe that times out having never
reached peak_load > threshold provably could not have called a contact — not "did not":
could not, whatever the joint was doing, including pressing its hardest into a solid wall.
That is a fact about the instrument, provable from one comparison. It names the number that
blinded it and what to lower it to.

Confirmed firing on hardware: at threshold 250, wrist_roll's high end peaks at 196 — the
threshold is unreachable, and the verb says so instead of inventing a verdict.

The too-LOW direction was already caught (a phantom contact has free_run ~ 0, and the WALL rule
needs free_run >= needed). The instrument now self-diagnoses in both directions — which is
what makes it safe to bootstrap a threshold on hardware: run at the default and let the verdict
tell you.

Other changes

• MIN_EVICTABLE_ARC_TICKS: 2*margin + 2 -> 3*margin (300). The old cutoff left the seam
  two ticks to stand on and called that "the same risk profile elbow_flex runs". A margin
  absorbs error in ONE wall; the INTERIOR absorbs error in both at once. The tightening
  deletes the unrepresentable-seam corner case rather than handling it.
• arm_spec._REZERO_IMPOSSIBLE -> _REZERO_REFUSED. wrist_roll is still refused and still
  soft-limited — but on a measured number, not an impossibility in principle. An
  impossibility forecloses the question; a number can be re-measured. The refusal is now
  RENDERED into explain/learn/--help from arm_spec, because hard-coding it there is
  exactly how the withdrawn claim survived in the operator-facing prose after the table itself
  had already been corrected once.
• bus.clear_overload now VERIFIES the latch dropped. It is not instant — a read issued
  straight after a successful torque-disable still came back error=32; the same read ~250 ms
  later was clean. gentle_move cleared the latch, immediately re-read, got a still-faulted
  servo, suppressed it, and lost the position — and the NEXT probe ran on a motor that had
  never recovered. That is why wrist_flex's high end reported 5 ticks of travel and a verdict
  describing the leftover fault instead of the joint. Same rule write_offset already follows:
  the register is the arbiter, not the status byte.
• arm limits --help crashed with a raw TypeError since the flag shipped — a rendered
  "80% of" in --sweep-duration parsed as the %o format code. argparse raises inside its own
  formatter, upstream of the CLI's no-traceback contract, so nothing could catch it. Every
  verb's help is now formatted by a test.

MISTAKES I MADE — recorded so they are not repeated

1. I set _PRESSING_EXCESS_LOAD = 25 by REASONING, not measuring — reasoning down from a
   real wall's ~212 excess, on the argument that anything well under it was safe. On the first
   probe that exercised it, wrist_roll stalled against nothing at an excess of 32, and
   the verb confidently reported an unfirable threshold for a wall that did not exist. The
   constant was under the noise floor. Now 100, with the noise floor (32) and the weakest
   real wall (~208) both pinned by a test so it cannot be reasoned back down.
2. I probed wrist_roll starting from a joint sitting ON a mechanical end. A probe with no
   free approach is degenerate and its result is not comparable to a mid-travel run. Always start
   mid-travel.
3. My hand-sweep path-integrator aliased. Sampling at 20 Hz, a fast hand-spin covers >2048
   ticks between samples and signed_delta then picks the wrong direction. Trust at-rest
   reads, not path integration, unless you sample fast enough.
4. git stash is unsafe in this repo — uv run regenerates uv.lock, which blocks
   stash pop. It silently reverted 23 files. Commit instead.

DEPENDENT WORK — do these in this order

• arm limits reports a COMPLIANT stop (a cable) as a WALL — the verdict does not replicate, and a WALL is what authorises a re-zero #51 — arm limits reports a COMPLIANT stop (a cable) as a WALL. wrist_roll's end verdicts
  do not replicate (BOUNDED / UNDETERMINED / UNDETERMINED across three runs; travel does
  replicate: 3887 / 3903 / 3905). Its ends are compliant: the arm squashes ~65-70 ticks into each,
  and a hand-placed end sits ~70 ticks short of where the arm gets. A WALL is the only verdict
  that authorises a re-zero — so a compliant end passing as a WALL can park the seam in an arc
  that is not actually unreachable. DO THIS FIRST.
• arm limits probes ONE pose — shoulder_lift and wrist_flex cannot be measured in it, so two of six joints have no honest limits #52 — arm limits probes ONE pose. shoulder_lift (53 ticks) and wrist_flex (hardware
  overload) cannot be measured in the rest pose; what got measured was the pose, not the joint.
  Sequence AFTER arm limits reports a COMPLIANT stop (a cable) as a WALL — the verdict does not replicate, and a WALL is what authorises a re-zero #51 — merging unreliable end verdicts across poses just launders the noise
  into an authoritative-looking answer.

CAVEAT ON WHAT IS COMMITTED

wrist_roll is recorded in v0.24.0 as BOUNDED with arc 209. That rests on a SINGLE run
that has not replicated. The joint is bounded (the hand proves it), but the arm cannot
reliably prove it, and the arc is not a fixed quantity — it shrinks the harder something
pushes. The soft-limit decision is correct; the "209 < 300" reasoning in _REZERO_REFUSED is
right by luck. See #51.