@meri-imperiumi/signalk-dead-reckoning 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -7,6 +7,206 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-09-17
+
+### Fixed
+- **The derived-current EWMA can now sample on a healthy GPS feed — and
+  only ever pairs fixes from one receiver.** The sampler refreshed its
+  differential baseline on every tick, so with GPS fixes arriving faster
+  than the 5 s minimum interval the ≥5 s differential could only form
+  across `navigation.position` null gaps — and those gap-spanning samples
+  routinely paired fixes from *different* receivers. On the
+  2026-09-11…14 Niue→Vava'u trial that produced a phantom "current" of
+  1.1 kn @ ~131° for 55 h (a quasi-fixed ~140 m offset between two
+  position providers ÷ the multi-minute sampling gap — heading-
+  independent, which is why it didn't look like leeway), dragging DR to
+  34.7 nm of error at arrival while the real current was 0.6 kn @ 006°.
+  Replaying the same passage with the sampler working ends at 8.7 nm.
+  The baseline now holds across cadence-rejected ticks (samples form at
+  the 5 s minimum instead of only across null gaps), differentials use
+  the fix's own timestamp (a paused feed can no longer fabricate
+  zero-ground "currents" from a running tick clock), fixes carry their
+  `$source` so a differential never spans two receivers, and the tick
+  path feeds the sampler (and training's ground truth) the server's
+  priority-filtered tree position instead of the last-writer-wins raw
+  delta — on multi-GPS installs the raw subscription stream flits
+  between every provider of the path (this one: ZG100, Orca, WIDELINK
+  AIS, YDNR, Cerbo, the RUTX11's indoor GNSS, and the own-boat
+  meshtastic node's LoRa-recycled position), several of which sit
+  100 m+ from the truth. Verified by capturing the live subscription
+  stream: ranked-below sources still deliver; priorities only gate the
+  merged tree.
+- **A bearing to a known object is now a ray constraint in the fix
+  resolver, not an infinite line.** On the same trial a running fix
+  against a bearing to AIS vessel MATILDA (115.5° true, 4.1 nm)
+  projected the advanced fix onto the far side of the line: a "fix"
+  2.7 nm past the vessel from which the vessel bore the reciprocal of
+  the sighted bearing. The resolver now rejects points past the
+  object's anchor — in single-observation running fixes, bearing×
+  bearing intersections, bearing×range circle picks and the
+  parallel-bearings midline — with an error explaining that the run and
+  the bearing disagree (celestial intercept LOPs stay full lines; a
+  100 m along-ray slack keeps close-range sights with ordinary compass
+  slop from hard-rejecting). The
+  `lop_type` threads from the persisted row through running-fix
+  advancement into the resolver, and REST resolve/confirm surface the
+  rejection as the 400 message.
+
+### Changed
+- **Training Mode no longer runs on model currents (tier 3/4), only on
+  observed ones (manual tier 1, derived tier 2).** A wrong current —
+  model *or* phantom — gets compensated by the trainer as physically
+  impossible leeway: the Niue→Vava'u trial's phantom tier-2 current was
+  absorbed as 15–18° of leeway on broad reaches (thousands of live
+  hits), which then mis-rotate the water track whenever the current
+  resolves correctly. Same failure shape as the previous trial's tier-5
+  zero-current poisoning, now gated for the model tiers too. A write-time
+  plausibility bound rejects observations implying |leeway| > 15° (input
+  disagreement, not hydrodynamics), and schema v3 ships a one-time data
+  migration removing bins with |leeway| > 10° accumulated during the two
+  poisoned trials — no manual SQL on the boat.
+
+### Changed
+- **The DR output is no longer published to the bus on every
+  integration tick.** Each published delta costs the Signal K server
+  fanout — delta-cache routing plus serialization to every websocket
+  client and logging plugin subscribed to the context — and most of
+  the DR output (log, trip log, current vector, uncertainty radius,
+  elapsed-since-fix) is slow-moving data nobody needs at 1 Hz. The
+  tick still integrates every `tickIntervalMs`; the published set is
+  batched to every `publish.everyTicks`-th tick (new setting, default
+  2 → one delta every 2 s at the default 1 s tick; 1 restores
+  per-tick publishing). Notable transitions publish immediately,
+  within the tick that observed them: method/state/active flips, paths
+  appearing or disappearing (e.g. the STW echo dropping when the
+  polar fallback takes over), and values crossing to/from null (e.g.
+  the divergence readout clearing at anchor). The shadow vessel's
+  synthetic target follows the same cadence.
+
+### Fixed
+- **The logbook access-request flow now targets the logbook URL's own
+  host and port.** It previously used a separate `logbook.baseUrl`
+  setting that wasn't even exposed in the plugin settings UI and
+  defaulted to `http://localhost:3000` — on installs where that port
+  isn't the Signal K server (Grafana there), its 404 read as "open
+  server", the tokenless probe then hit the real server's auth gate,
+  and logbook writes parked with "Logbook writes need authentication
+  this plugin cannot obtain" even though the server's access-request
+  flow was fully available. The `logbook.baseUrl` config option is
+  gone: the origin is derived from the configured `logbook.url`. An
+  unparseable URL parks the flow with a message naming the fix instead
+  of crashing the write path.
+- **The uncertainty cone no longer grows while anchored or moored.**
+  The current-knowledge term scaled with wall-clock time since the
+  last fix, so a week on the hook painted a 100+ NM circle around a
+  boat the ground was holding perfectly still. The engine now tracks
+  a separate under-way clock (`underwaySinceOriginS`, gated by
+  `navigation.state` anchored/moored, persisted across restarts) and
+  the cone grows only on that axis; wall-clock `since last fix` still
+  counts anchor time (published unchanged). The same axis now also
+  drives the fix sanity cap (the boat can't have traveled while
+  anchored — a far fix is more suspect, not less) and the learned
+  `dr_corrections` deviation rate (anchor time between fixes no
+  longer deflates it).
+
+## [0.9.0] - 2026-09-10
+
+### Added
+- **Derived-current tier (SPEC §6.2 tier 2)**: an exponentially-weighted
+  mean of the boat's own GPS-vs-water-track residual, sampled every
+  tick while GPS is trusted and the water track is usable (STW floor,
+  interval, glitch/outlier bounds), carried forward with exponential
+  decay when GPS degrades and TTL-bounded (24 h) so the resolver falls
+  through to the model tiers after. Zero-configuration: it outranks
+  the Weather API and pilot charts as soon as ~10 samples exist (the
+  first minutes of a passage), `environment.current` and `/status`
+  surface it as source `derived`, and the uncertainty cone uses a
+  tighter per-tier residual (0.2 kn). Sea-trial replay
+  (Aitutaki→Niue 2026-08-30→09-05): final DR error 10.9 nm over 622 nm
+  vs 47.3 nm for the live tier-3 configuration and 85.2 nm for the
+  zero vector — landfall-visible DR on a trade-wind passage.
+
+### Fixed
+- **The weather-current client calls the Weather API in-process**
+  (`app.weatherApi.getForecasts()`, the same instance the REST routes
+  wrap — mirrors signalk-energy-predictor) instead of an HTTP loopback
+  that defaulted to `localhost:3000` — a port Grafana answers on this
+  install, so every poll 404ed and tier 3 never resolved
+  ("Weather current fetch failed: weather API returned 404 — using
+  zero current"). No base URL, ports or auth tokens involved; the
+  `weatherCurrent.baseUrl` config option is gone.
+- **The celestial sight plausibility gate measures the distance from
+  the DR origin, not from the sight's assumed position** (sea trial
+  2026-08-31 root-cause follow-up): a small intercept at a wrong
+  assumed position drew the LOP an ocean away and the gate never saw
+  it. Non-noon sights now gate on the perpendicular distance from the
+  DR origin to the LOP (floored by the intercept magnitude), mirroring
+  the `/fix/lop` bearing gate; noon sights gate on the origin-vs-
+  reduction latitude difference.
+- **The fix-confirm sanity cap now grows with DR time-since-origin**
+  instead of being a flat 100 NM: legitimate fixes after days GPS-less
+  (DR drifts ~0.5–1 NM/h; the trials measured 47 NM in 4.5 days with a
+  current tier, 85 NM cold) were being rejected, training crews to
+  habitually force-confirm — defeating the guard for the teleport
+  case it exists for. The cap is now `max(100 NM, 1.5 kn × hours since
+  origin)`, mirrored in `/fix/resolve`'s `gross` preview flag.
+- **Training Mode is suspended while the resolved current is tier 5
+  (zero vector — current unknown)** (SPEC §6.1/§6.2): training with an
+  unknown current bakes it into the leeway/speed bins as fake
+  corrections and over-applies them later (Huahine→Aitutaki backtest:
+  72 vs 65 nm cold; both trials' regressions). With the new tier-2
+  derived current self-bootstrapping in the first minutes of a
+  passage, a current-resolved matrix train no longer requires a
+  weather provider. The replay tool's learning variants accordingly
+  run with the derived current ("training with zero current" is no
+  longer a reachable live configuration), and a new `derived` variant
+  (cold + tier 2, no training) isolates the tier's contribution in
+  backtests.
+- **Logbook write-through no longer floods the server when
+  authentication cannot be obtained** (reported 2026-09-11 on
+  lille-oe-pi: a continuous ~10 req/s stream of
+  `POST /plugins/signalk-logbook/logs` 401s at anchor; the 91-byte
+  bodies identified the server's plugin-route admin gate answering a
+  tokenless "open server" probe). The access-request client read
+  *any* non-OK response (403 disallowed device requests, 429 rate
+  limit, 400 duplicate, 503, …) as "no access-request flow", built a
+  tokenless client, ate the admin gate's 401, and re-ran the whole
+  cycle forever. The client now distinguishes: 403 → "forbidden"
+  (park; the plugin status names the two ways out — allow device
+  access requests on the server, or paste a token); 404/501 → a
+  single tokenless probe, terminal on rejection; everything else →
+  "unreachable", retried on an exponential backoff (30 s doubling to
+  a 16 min cap, configurable via `logbook.retryBackoffMs`) — never an
+  open-server assumption, never a loop. A rejected config token or
+  tokenless probe parks instead of resurrecting the same credentials
+  in a loop. A pending access request is persisted and resumed across
+  restarts instead of re-filed (the server rejects duplicates), and an
+  approval granted while the plugin was down is picked up on the
+  first poll. Queued entries are never dropped by any of this.
+- **The "paddlewheel appears fouled" alert no longer fires on breeze
+  over a moored boat** while `navigation.state` hasn't landed in the
+  delta cache yet (or on installs without an autostate source): a live
+  SOG reading below the moving threshold is now an outright "not
+  making way" verdict, and wind only corroborates fouling when GPS is
+  silent.
+
+### Added
+- **Polar speed fallback now also works without
+  signalk-polar-performance-plugin**: when its `performance.polarSpeed`
+  feed is absent, DR computes the speed in-process from the active
+  `polars` resource (the signalk-polar-management contract — the
+  `polars.activePolar` pointer and `polars.performanceFactor` derating
+  multiplier) interpolated from water-referenced true wind
+  (`environment.wind.speedTrue` / `angleTrueWater`). The resource path
+  shares the existing running-average window and staleness cutoff, is
+  zero-configuration (engages when an active polar is selected, stays
+  dormant otherwise), and a live `performance.polarSpeed` feed still
+  outranks it. The DR state's `speedSource` distinguishes `polar`
+  (delta feed) from `polar-resource`, the sensor-health alert names the
+  active resource id, and GET /status mirrors the loaded polar. A dead
+  wind instrument ages the average out to the honest idle branch
+  instead of integrating a frozen wind at a frozen speed.
+
 ## [0.8.0] - 2026-09-09
 
 ### Fixed

package/SPEC.md

@@ -91,6 +91,7 @@ CREATE TABLE IF NOT EXISTS dr_matrix_bins (
 - `stw_bin`/`awa_bin`/`heel_bin` must be populated via an explicit quantization function (round to nearest bin width) before insert/lookup — storing raw continuous values as the primary key would prevent `hit_count` from ever accumulating meaningfully.
 - `live_hit_count` and `historical_hit_count` are tracked separately so a season of live sailing can outweigh years of backfilled data in the effective confidence/learning-rate calculation — each live sample should count as several times a historical sample by default (tunable), and each historical sample's weight further depends on `historical_confidence_tier` (a bin trained against reanalysis current data is more trustworthy than one that only had climatological pilot-chart current available).
 - `sail_state = motoring` (or any interval where `propulsion.main.state = started`) is **excluded** from writes to this table entirely — the underlying physics (prop walk, wake, rudder-induced yaw) differs from sail-driven leeway and would corrupt the model if blended. A separate under-power calibration table is out of scope for v1 (see §12).
+- **Plausibility bound:** observations implying |leeway| > 15° are rejected at write time — real leeway for this hull is ≈0° on a run and ≈10–13° close-hauled in a gale; anything beyond is input disagreement (wrong current tier, flappy sensor sources), not hydrodynamics. Both 2026 sea trials poisoned bins this way (10–32° on broad reaches); schema v3 ships a one-time data migration removing bins with |leeway| > 10° accumulated before the bound existed.
 - Historical bins written during backfill should apply a mild recency-decay weight, and/or respect configured "epoch boundaries" (known re-rig / instrument-replacement dates) so pre- and post-change data isn't blended across a known discontinuity.
 
 ### 4.2 Persistent DR State & Checkpoints
@@ -174,6 +175,8 @@ CREATE TABLE IF NOT EXISTS circular_position_lines (
 - Circle × Circle → **two** candidate intersections; default to the one nearest current DR position, but surface both to the watchkeeper rather than silently discarding one.
 - A single, unresolved LOP or CPL may still be **advanced** along the DR track to combine with a later observation (classic running fix), reusing the DR engine's integrated track over the elapsed interval.
 
+**Bearing ray constraint:** a bearing to a *known object* (charted feature, AIS target) is a ray, not a full line — the bearing itself says which side of the object the observer is on (the reciprocal side). A resolved point past the object's anchor would place the vessel where the object bears the *opposite* of the sighted bearing — geometrically on the line, navigationally wrong (2026-09-13, AIS vessel MATILDA: the running-fix projection landed 2.7 nm beyond the target and "reversed" the bearing). The resolver enforces the observer's ray for `lop_type = 'bearing'` in the point-projection (running fix), Line × Line, Line × Circle and parallel-midline branches — a candidate past the object beyond a 100 m along-ray slack (close-range compass/run slop) is rejected with an explanatory error. Celestial intercept LOPs remain full lines: any point on the line is equally valid.
+
 **Non-intersecting / contradictory inputs (residual fallback):** measurement error means an exact geometric intersection is the exception rather than the rule — three or more LOPs/CPLs will almost never cross at a single point (the classical "cocked hat" case), and even a two-input combination can fail to intersect cleanly if one observation was mistimed or misread. The resolver must not fail silently or force a nearest-point snap when inputs disagree beyond expected measurement tolerance. Instead:
 - With ≥3 inputs, resolve via least-squares residual minimization (best-fit point minimizing summed distance to each line/circle constraint) rather than requiring exact intersection.
 - With exactly 2 inputs that don't intersect within tolerance, present the closest-approach point and the residual gap explicitly, rather than silently picking a point on one of the two constraints.
@@ -269,8 +272,9 @@ Worker Thread (DR Physics)
 
 ### 6.1 Training Mode vs. Inference Mode
 
-**Training Mode** — active when `isGpsReliable = true` AND `propulsion.main.state = stopped` AND paddlewheel not fouled (§6.3):
+**Training Mode** — active when `isGpsReliable = true` AND `propulsion.main.state = stopped` AND paddlewheel not fouled (§6.3) AND the resolved current is an *observed* vector (§6.2 tier ≤ 2 — manual or derived; training with an unknown *or modelled* current bakes its error into the leeway/speed bins as fake corrections: the zero vector did this on the 2026-08-30→09-05 trial, a wrong tier-2 phantom on 2026-09-11…14):
 - Computes error vectors: GPS SOG/COG vs. sensor STW/heading, minus the resolved current vector (§6.2), updated into matching `dr_matrix_bins` via EMA, learning rate modulated by effective `hit_count`.
+- Observations implying |leeway| > 15° are rejected outright as input disagreement, not hydrodynamics (§4.1 plausibility bound).
 
 **Inference Mode** — active when `isGpsReliable = false` OR OVERRIDE is manually engaged:
 - Freezes matrix learning. Reads raw sensors, looks up matching bins, applies corrections, integrates the resolved current vector, publishes `navigation.deadReckoning.position` as authoritative (`navigation.deadReckoning.active = true`).
@@ -286,8 +290,8 @@ The paddlewheel-failure fallback is a distinct branch from the "GPS unreliable"
 ### 6.2 Current Hierarchy of Truth
 
 1. Manual Override — watchstander input with valid TTL (`environment.current`).
-2. Live High-Res — Starlink-cached coastal NetCDF vectors.
-3. Sparse Forecast — bilinear/temporal-interpolated radio GRIB vectors.
+2. Derived Residual — exponentially-weighted mean of the boat's own GPS-vs-water-track residual (`derived-current.js`), sampled while GPS is trusted and the water track is usable; carried forward with exponential decay when GPS degrades, TTL-bounded. The boat's own observation outranks model products (sea trial 2026-08-30→09-05, Aitutaki→Niue: ~11 nm DR error over 622 nm vs 47 nm for tier 3, 85 nm for tier 5). Sampling discipline (2026-09-11…14 trial): differentials pair only fixes from the same `$source` (multi-receiver buses flit between antennas at 1 Hz each — a cross-receiver differential is antenna separation measured as current), span the fixes' own timestamps at a ≥5 s minimum cadence, and the tick path reads the server's priority-filtered tree position rather than the raw last-writer-wins subscription stream.
+3. Sparse Forecast — bilinear/temporal-interpolated radio GRIB vectors (Signal K Weather API).
 4. Offline Pilot Charts — static SQLite monthly historical averages (`offline_pilot_currents`).
 5. Zero Vector — pure inertial water track (U: 0, V: 0).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meri-imperiumi/signalk-dead-reckoning",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Offline-first dead reckoning and sensor fusion engine for Signal K",
   "main": "plugin/index.js",
   "scripts": {
@@ -34,7 +34,8 @@
     "recommends": [
       "@meri-imperiumi/signalk-autostate",
       "@meri-imperiumi/signalk-logbook",
-      "signalk-polar-performance-plugin"
+      "signalk-polar-performance-plugin",
+      "signalk-polar-management"
     ],
     "screenshots": [
       "./doc/dr-map.png",

package/plugin/current.js

@@ -7,7 +7,11 @@
  *  1. **Manual override** — watchstander input with a valid TTL
  *     (`environment.current`). Not yet wired to an input path; the
  *     resolver accepts it so the precedence is explicit and testable.
- *  2. Live high-res NetCDF (Starlink-cached coastal) — future.
+ *  2. **Derived residual** — EWMA of the boat's own GPS-vs-water-track
+ *     residual (`derived-current.js`), learned while GPS is trusted and
+ *     carried forward with decay when GPS degrades. The boat's own
+ *     observation outranks model products (sea trial 2026-08-30→09-05:
+ *     ~11 nm DR error over 622 nm vs 47 nm for tier 3).
  *  3. **Signal K Weather API** (`/signalk/v2/api/weather/forecasts/point`)
  *     — a provider (e.g. a GRIB another process already downloaded)
  *     serves point forecasts carrying `current: {set (rad), drift (m/s)}`.
@@ -102,13 +106,17 @@ function parseWeatherCurrent(points, nowMs) {
  * @param {object} [input]
  * @param {{setTrue: number, drift: number, validUntilMs: number}|null} [input.manual]
  *   tier 1: watchstander override, honored while its TTL lasts
+ * @param {{setTrue: number, drift: number, validUntilMs: number}|null} [input.derived]
+ *   tier 2: EWMA of the boat's own GPS-vs-water-track residual
+ *   (`derived-current.js`), TTL-bounded and decayed while GPS is
+ *   degraded — the boat's own observation outranks model products
  * @param {{setTrue: number, drift: number, validUntilMs: number}|null} [input.weather]
  *   tier 3: Weather API cache entry from `WeatherCurrentClient.currentAt`
  * @param {((ctx: object) => ({setTrue: number, drift: number}|null))|null} [input.pilotLookup]
  *   tier 4: (month,lat,lon)→vector lookup into `offline_pilot_currents`
  * @param {object} [input.pilotCtx] - context for the pilot lookup
  * @param {number} [input.nowMs] - epoch ms; defaults to Date.now()
- * @returns {{setTrue: number, drift: number, tier: 1|3|4|5, source: string}}
+ * @returns {{setTrue: number, drift: number, tier: 1|2|3|4|5, source: string}}
  *   drift in knots, setTrue in deg true (direction the current flows toward)
  */
 function resolveCurrent(input = {}) {
@@ -125,6 +133,15 @@ function resolveCurrent(input = {}) {
       source: "manual",
     };
   }
+  // Tier 2: derived residual — the boat's own GPS-vs-water-track EWMA.
+  if (valid(input.derived)) {
+    return {
+      setTrue: normalizeDeg360(input.derived.setTrue ?? 0),
+      drift: input.derived.drift,
+      tier: 2,
+      source: "derived",
+    };
+  }
   // Tier 3: Weather API (sparse forecast GRIB via a weather provider).
   if (valid(input.weather)) {
     return {
@@ -157,34 +174,40 @@ function resolveCurrent(input = {}) {
  * 30 min) with a hard timeout, failures keep the previous cache until
  * its TTL lapses, and `currentAt` is a synchronous cache read.
  *
+ * The call is **in-process** (mirrors signalk-energy-predictor): the
+ * plugin always talks to the Signal K server it runs inside —
+ * `app.weatherApi.getForecasts()` is the same WeatherApi instance the
+ * `/signalk/v2/api/weather` REST routes wrap — so weather providers
+ * (e.g. a GRIB provider) registered by other plugins answer without
+ * HTTP, auth tokens or port guessing. The old HTTP loopback defaulted
+ * to `localhost:3000`, which on this install is Grafana and 404s every
+ * `/signalk/...` path. On servers without the Weather API the client
+ * stays idle and the §6.2 resolver never sees tier 3.
+ *
  * The response is a WeatherDataModel array; `current.set` is radians
  * and `current.drift` m/s (converted here to deg/kn).
  */
 class WeatherCurrentClient {
   /**
    * @param {object} [opts]
-   * @param {string} [opts.baseUrl] - server base URL (no trailing slash)
+   * @param {object} [opts.weatherApi] - the server's `app.weatherApi`
+   *   (needs a `getForecasts` function)
    * @param {number} [opts.intervalMs=1800000] - poll interval
    * @param {number} [opts.count=6] - forecast entries to request
-   * @param {number} [opts.timeoutMs=10000] - per-fetch abort timeout
+   * @param {number} [opts.timeoutMs=10000] - per-fetch timeout
    * @param {number} [opts.validityFactor=4] - cache TTL = interval × this
    * @param {() => ({latitude: number, longitude: number}|null)} [opts.getPosition]
    * @param {(message: string) => void} [opts.onStatus]
-   * @param {typeof fetch} [opts.fetchFn=globalThis.fetch]
    * @param {() => number} [opts.now=Date.now]
    */
   constructor(opts = {}) {
-    this.baseUrl = (opts.baseUrl ?? "http://localhost:3000").replace(
-      /\/+$/,
-      "",
-    );
+    this.weatherApi = opts.weatherApi ?? null;
     this.intervalMs = opts.intervalMs ?? 30 * 60 * 1000;
     this.count = opts.count ?? 6;
     this.timeoutMs = opts.timeoutMs ?? 10000;
     this.validityFactor = opts.validityFactor ?? 4;
     this.getPosition = opts.getPosition ?? (() => null);
     this.onStatus = opts.onStatus ?? null;
-    this.fetchFn = opts.fetchFn ?? globalThis.fetch?.bind(globalThis);
     this.now = opts.now ?? (() => Date.now());
     /** @type {{setTrue: number, drift: number, fetchedAt: number, validUntilMs: number}|null} */
     this.cache = null;
@@ -226,48 +249,51 @@ class WeatherCurrentClient {
    * @returns {Promise<void>}
    */
   async poll() {
-    if (this.fetching || !this.fetchFn) return;
+    if (this.fetching) return;
+    if (
+      !this.weatherApi ||
+      typeof this.weatherApi.getForecasts !== "function"
+    ) {
+      return; // server has no Weather API — tier 3 simply never resolves
+    }
     const pos = this.getPosition();
     if (!pos) return; // no position yet — retry on the next interval
     this.fetching = true;
     try {
-      const url = new URL(
-        `${this.baseUrl}/signalk/v2/api/weather/forecasts/point`,
-      );
-      url.searchParams.set("lat", String(pos.latitude));
-      url.searchParams.set("lon", String(pos.longitude));
-      url.searchParams.set("count", String(this.count));
-
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
-      try {
-        const res = await this.fetchFn(url.toString(), {
-          signal: controller.signal,
-        });
-        if (!res.ok) {
-          throw new Error(`weather API returned ${res.status}`);
-        }
-        const data = await res.json();
-        if (!Array.isArray(data)) {
-          throw new Error("weather API response is not an array");
-        }
-        const parsed = parseWeatherCurrent(data, this.now());
-        if (!parsed) {
-          throw new Error("forecast carries no current data");
-        }
-        const now = this.now();
-        this.cache = {
-          setTrue: parsed.setTrue,
-          drift: parsed.drift,
-          fetchedAt: now,
-          validUntilMs: now + this.intervalMs * this.validityFactor,
-        };
-        this.onStatus?.(
-          `Weather current: set ${parsed.setTrue.toFixed(0)}° true, drift ${parsed.drift.toFixed(2)} kn`,
-        );
-      } finally {
-        clearTimeout(timeoutId);
+      // In-process (same object the REST routes wrap): providers
+      // registered by other plugins answer directly. The timeout guards
+      // a provider doing its own network fetch under the hood.
+      let timeoutId;
+      const data = await Promise.race([
+        this.weatherApi.getForecasts(
+          { latitude: pos.latitude, longitude: pos.longitude },
+          "point",
+          { maxCount: this.count },
+        ),
+        new Promise((_resolve, reject) => {
+          timeoutId = setTimeout(
+            () => reject(new Error("weather API timed out")),
+            this.timeoutMs,
+          );
+        }),
+      ]).finally(() => clearTimeout(timeoutId));
+      if (!Array.isArray(data)) {
+        throw new Error("weather API response is not an array");
+      }
+      const parsed = parseWeatherCurrent(data, this.now());
+      if (!parsed) {
+        throw new Error("forecast carries no current data");
       }
+      const now = this.now();
+      this.cache = {
+        setTrue: parsed.setTrue,
+        drift: parsed.drift,
+        fetchedAt: now,
+        validUntilMs: now + this.intervalMs * this.validityFactor,
+      };
+      this.onStatus?.(
+        `Weather current: set ${parsed.setTrue.toFixed(0)}° true, drift ${parsed.drift.toFixed(2)} kn`,
+      );
     } catch (err) {
       // Keep any previous cache; the TTL decides when it stops being
       // trusted. Surface the failure once per poll cycle.

package/plugin/db.js

@@ -20,7 +20,7 @@ const { mkdirSync } = require("node:fs");
 /** Schema version, bumped when a migration is needed. Persisted in dr_state_store.
  * v2: `fixes.derived_from_fix_id` — provenance for single-observation
  * running fixes advanced from a previous confirmed fix. */
-const SCHEMA_VERSION = 2;
+const SCHEMA_VERSION = 3;
 
 /**
  * DDL for every table in SPEC §4. Statements run in order; all are
@@ -202,6 +202,7 @@ function openDatabase(dbPath) {
     db.exec(stmt);
   }
   migrate(db);
+  migrateData(db);
   // Record schema version so future migrations can branch on it.
   setState(db, "schema_version", String(SCHEMA_VERSION));
   return db;
@@ -283,6 +284,47 @@ function migrate(db) {
   }
 }
 
+/**
+ * One-time, version-gated *data* migrations. Unlike the column steps
+ * above (idempotent by construction, safe on every open), these are
+ * gated on the stored `schema_version` so each runs exactly once per
+ * database. Bumping SCHEMA_VERSION and adding an entry here upgrades
+ * an existing install on its first open.
+ *
+ * v3 — poisoned-leeway cleanup (sea trials 2026-08-30…09-05 and
+ * 2026-09-11…14): both trials trained while the resolved current was
+ * wrong (zero vector, then the phantom cross-receiver tier-2 vector),
+ * and the trainer absorbed the current error as leeway — bins carrying
+ * 10–32° of leeway on broad reaches, physically impossible for this
+ * hull (real leeway on a run is ≈0°, close-hauled in a gale ≈10–13°).
+ * Those bins mis-rotate the water track on every later passage until
+ * retrained, so they are removed outright: the EMA would blend them
+ * out only over many more hours than a clean restart. The current-tier
+ * training gate (§6.1) and the computeObservation plausibility bound
+ * prevent new poison of this shape.
+ */
+const DATA_MIGRATIONS = [
+  {
+    version: 3,
+    run: (db) => {
+      db.exec("DELETE FROM dr_matrix_bins WHERE ABS(leeway_angle) > 10");
+    },
+  },
+];
+
+/**
+ * Applies pending data migrations, gated on the stored schema version.
+ *
+ * @param {import("node:sqlite").DatabaseSync} db
+ * @returns {void}
+ */
+function migrateData(db) {
+  const stored = Number(getState(db, "schema_version") ?? 0);
+  for (const step of DATA_MIGRATIONS) {
+    if (stored < step.version) step.run(db);
+  }
+}
+
 /**
  * Reads a scalar value from `dr_state_store`.
  *