Verify Valhalla on arm64; correct driving-side and retention decisions

arm64 is no longer a risk: verified end to end on mikkeli-orin-nano-2
(L4T R36.4.7). The official image publishes linux/arm64, runs natively, and
the full pipeline works including a served route.

Corrects the Japan guidance. Advising a regional extract was wrong for the
admin build: driving side is a country-level property, and a Shikoku extract
produces no country row and drive_on_right=1, silently giving right-hand
traffic routing. Admins must come from the full extract; routing tiles may
still come from a region.

Decision 14 closed: recordings bounded with rotation, enforced by the writer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013kj58Jugkic783b8ZrtTVZ

docs/ARCHITECTURE.md

@@ -243,16 +243,23 @@ checksum at both ends.
 
 | Concern | Consequence |
 |---|---|
-| **Left-hand traffic** | `valhalla_build_admins` builds the admin database that determines driving side. It is a separate step *before* the tile build, and the database is used only at build time, not by the running server. Skip it and Valhalla routes and narrates as though Japan drove on the right. |
+| **Left-hand traffic** | `valhalla_build_admins` builds the admin database that determines driving side. **Build it from the whole-Japan extract, never a sub-region** — verified on the Orin, a Shikoku extract yields only `admin_level=4` prefecture rows with no country record, and every row reports `drive_on_right=1`. Driving side is a country-level property, so a clipped extract silently gives right-hand-traffic routing even when the step ran correctly. |
-| **Data volume** | The whole-Japan PBF is **2.3 GB** — Japan is among the more densely mapped countries in OSM. Routing tiles and basemap scale with it. Geofabrik publishes per-region extracts (Kantō, Chūbu, Hokkaidō, …); start with the region actually driven, not the whole country. |
+| **Data volume** | The whole-Japan PBF is **2.3 GB** — Japan is among the more densely mapped countries in OSM. Regional extracts keep *routing tiles* small (Shikoku: 49 MB PBF → 149 MB of tiles, measured), but the **admin database must still come from the full extract** — see above. The two builds are separate invocations and may take different inputs. |
 | **CJK labels** | MapLibre cannot ship Japanese glyph sets as SDF ranges — far too large. Set `localIdeographFontFamily` so the browser renders CJK from on-device fonts. Protomaps tiles also carry `name:en`, so romanised labels are an option. |
 | **Addressing** | Japanese addresses are block-based, not street-based. Valhalla does not geocode at all, so destination search is a separate problem — do not assume a western geocoder transfers. |
 
-### Known risk
+### arm64 — resolved
 
-Valhalla's arm64 container story is unsettled upstream. Confirming that Valhalla
+No longer a risk. Verified on `mikkeli-orin-nano-2` (L4T R36.4.7, JetPack 6) on
-builds and runs on the Jetson is the **first** task in this workstream, before
+2026-09-04: `ghcr.io/valhalla/valhalla` publishes a `linux/arm64` manifest, the
-any data pipeline work is done against it.
+image runs natively, and the full pipeline works end to end — config, timezones,
+admins, tiles, and a served route.
+
+Measured: Shikoku, 49 MB PBF → 149 MB of routing tiles; Takamatsu → Matsuyama
+routed in 157 km / 112 min with Japanese street names intact in the narrative.
+
+The server logs a benign `tiles.tar No such file or directory` warning and falls
+back to the tile directory, which is the form decision 10 selected anyway.
 
 ## Decisions
 
@@ -274,7 +281,7 @@ rewriting the document.
 | 11 | Boot ordering is capture-first: acquisition reaches ready before serving or voice | Accepted | 2026-09-03 |
 | 12 | The Orin owns the car's aux input; the display unit carries no permanent cable | Accepted | 2026-09-03 |
 | 13 | Reasoning stays in the cloud — a local LLM does not fit beside the voice stack | Accepted | 2026-09-03 |
-| 14 | Recording retention policy — unbounded growth silently stops capture | **Open** | — |
+| 14 | Recordings are bounded with rotation | Accepted | 2026-09-04 |
 | 15 | Boundary is two simplex channels — lossy stream down, acknowledged request/response up | Accepted | 2026-09-03 |
 | 16 | Cloud links are outbound-initiated only; nothing calls in | Accepted | 2026-09-03 |
 | 17 | `svc-gw` combines local hub and app gateway; no client may block the hub | Accepted | 2026-09-03 |

docs/ORIN-RUNTIME.md

@@ -108,9 +108,17 @@ guidelines. Data does not.
 | Voice models | GB | Static |
 | Recorded sessions | GB per drive | **Unbounded** |
 
-Recordings are the problem. Without a retention policy the disk fills mid-drive
+Recordings are the problem. Without a bound the disk fills mid-drive and capture
-and capture stops — silently, because a full disk is not a crash. A retention
+stops — silently, because a full disk is not a crash.
-policy is a tier-1 concern, not housekeeping.
+
+**Recordings are bounded with rotation.** The recorder enforces its own ceiling and
+discards oldest-first; it does not rely on an external cleanup job that might not
+have run. Two properties matter more than the specific size:
+
+- The bound is enforced by the writer, so the failure mode is *losing the oldest
+  session*, which is recoverable, rather than *silently stopping capture*, which
+  is not.
+- A session in progress is never the one rotated away.
 
 ## Audio
 

docs/ROADMAP.md

@@ -66,10 +66,10 @@ Not a phase — it runs alongside, and its early output feeds Phase 2. Design is
 in [ARCHITECTURE.md](ARCHITECTURE.md#navigation); code in `svc-nav` (runtime)
 and `tool-mapmint` (artifact builds).
 
-- [ ] Confirm Valhalla builds and runs on the Jetson (arm64) — do this first,
+- [x] Confirm Valhalla builds and runs on the Jetson (arm64) — done 2026-09-04,
-      it is the one real integration risk
+      full pipeline verified on the Orin including a served route
-- [ ] Build the admin database with `valhalla_build_admins` — this is what sets
+- [ ] Build the admin database with `valhalla_build_admins` **from the full Japan
-      left-hand traffic, and it must run before the tile build
+      extract** — a sub-region silently yields right-hand-traffic routing
 - [ ] Build Valhalla routing tiles from a Geofabrik Japan extract, starting with
       the region actually driven rather than all 2.3 GB of it
 - [ ] Pull a Japan basemap extract from the Protomaps daily build with