Why a map has to be able to forget
Furniture carried out of a room stays on an ICIDO map until something removes it, and stale furniture is not cosmetic. Routing subtracts each saved object's footprint from the walkable floor, plus a clearance margin of about 24 cm, so a table that left last month still bends every route around where it stood.
The first attempt at removing it was reverted. Its rule was that the update had meshed floor in a column and nothing above it, so whatever used to stand there was gone. Measured against a glass stair guard, that rule deleted 754 of 754 of its faces (62774b1). An infrared pulse passes through a transparent panel instead of returning from it, so an intact glass barrier produces exactly the signature the rule read as vanished.
The signal that cannot be faked
What shipped instead uses where the device physically went. You cannot walk through a solid object, so a column the device travelled through held nothing solid below the device itself (62774b1).
That inverts the failure mode. Glass, mirrors and dark surfaces are things people walk around, so they never appear in a walked cell and are protected by construction rather than by a threshold. Things you walk under sit above the phone and are protected by a height cap set 30 cm below the device. Removal stays furniture-only: appearing to walk through a wall means the pose drifted, not that the wall left.
The path itself is recorded conservatively. The pose is sampled at 4 Hz, capped at 6000 samples, only while tracking is normal — and during an update, only after the session has found its position in the existing map, since coordinates recorded before that belong to a different frame.
Four builds, four measurements
The rule was right and still removed nothing. Each build found a different reason, each one measured rather than guessed.
The path was too sparse. At walking pace, 4 Hz gives a sample every 25 cm or so, and a chair footprint is barely three 12 cm cells across — so you could walk straight through where a chair stood, land either side of it, and mark none of its cells. The line between consecutive samples is now filled at 6 cm steps, with a 1.2 m gap guard so a tracking correction never draws a path through whatever lies between two unrelated positions. The path is deliberately not widened: lateral dilation would start reaching things you walked alongside, which is the glass-balustrade failure this design exists to avoid (a87e685).
Then the rule never fired for moved furniture at all, because moving a chair means re-scanning by sweeping — you never step where it used to be. A per-object test was added: cluster the old mesh's furniture, and judge a cluster gone when it is furniture-shaped, the update captured floor inside its footprint, and nothing of the update stands in its volume. The second condition carries the argument. An object that is still present occludes the ground beneath itself, so seeing that ground is positive evidence of absence in a way a missing return never was (6dca1d4).
Shape needed two tests rather than one. Aspect ratio reads the bounding box, and the bounding box of an L is square. An L-shaped glass guard measured 1.60 × 1.60 with an aspect of 1.000 and 55% of its floor seen, and lost 1624 of 1624 faces through that gate. So a fill test was added: the cluster must occupy at least 60% of its bounding footprint. A chair fills nearly all of its box; an L-shaped or returned barrier fills about 15% (6dca1d4).
Two more causes sat upstream of all four gates. The vanished pass had reused the navigation overlay's detector, which keeps only the 14 largest clusters so the camera view is not drawn full of boxes — and a chair's box is around 0.10 m³. A harness sweep with an identical chair, only the house growing around it, showed a clean step at 14: at 13 pieces the chair was removed, at 14 it was never evaluated. The same detector also fuses fragments 15 cm apart, gluing a chair tucked under a desk into one cluster with the desk — and the desk is still there. An uncapped variant with a 2 cm merge margin now serves the save-time pass, while the overlay keeps its top 14 (f0adfcf).
The near-miss that settled it
With per-cluster reasons in the log, the real chair finally reached the gates and missed fill by 0.06, scoring 0.54. Lowering the threshold was the obvious move, and was measured first: a guard with a 0.5 m return scored 0.57 under the same sampling — three hundredths from passing. Admitting the chair would have admitted the guard (41fd92f).
So the unfakeable signal decides at object level instead. If the device walked through a cluster's interior during an update — a full cell in from the box edge, so drift while passing something present can never count — the whole cluster is removed below the height cap. Crossing the middle of a rigid object empties it, and that path needs no shape, fill or floor test at all.
A separate defect surfaced in the same logs: three saves of one room read 10.4, 18.3 and 22.4 m², because every update welded a second floor onto the old one. Old floor is now replaced where the update captured floor in the same cell within 25 cm of the same height (2e4a72f).
The limit is stated in the release notes: if you do not walk through the space, nothing is removed. Undo Last Update remains the backstop.
Where this is
None of this changes what leaves the device, which is nothing. ICIDO has no accounts, no sign-in, no analytics and no network connections; scans, tagged spots and settings stay on the iPhone.
The work described here is in TestFlight builds. ICIDO is coming to the App Store, and scanning requires the LiDAR sensor — iPhone 12 Pro and later Pro models.