# LAB E10-N1 — Semantic-worker loss negative control

Date: 2026-07-22
State: completed; negative control accepted
Ground truth: no
Navigation/safety acceptance: no
Publication scope: laboratory negative control only

## Purpose and answer

E10-N1 tests a failure property required by the unmanned-system runtime:

> If the lower-rate semantic worker stops, does the 10 Hz detector/world-state
> path continue, does semantic freshness become stale explicitly, and does 3D
> fusion refuse to use an expired mask?

The answer is **yes for the accepted 60-second recorded source-paced control**:

- semantics was intentionally stopped after exactly 20 completed results;
- detector/tracker processed 601/601 frames at 10.010952 FPS with zero drops;
- world-state age p95 remained 90.268570 ms;
- semantic binding transitioned to 498 `stale` detector states;
- 3D fusion stopped after 96 fresh-mask frames and never resumed;
- freshness violations: zero;
- every negative-control acceptance check passed.

This proves fail-closed behavior for a controlled semantic-worker stop. It does
not yet prove recovery/restart, direct K1 transport or a process/container crash.

## Input and configuration identity

The camera, calibration, LiDAR pack, models and 60-second source interval are
identical to accepted LAB E10:

- session: `RAVNOVES00` / `20260720T065719Z_viewer_live`;
- source: `sensor.camera.right`, 800x600;
- source frames: 1,000–1,600 inclusive;
- session time: 135.365857292–195.334857292 seconds;
- source span: 59.969 seconds;
- calibration slot: `camera_1`;
- calibration SHA-256:
  `05f3ad9b38b3a4fc95388a8ec83da83c745e217709e51787b3d5aad0969f6fa9`;
- LiDAR pack:
  `e10-lidar-pack-5da0396d32a27f9d1ca537cc2e8a371d386078d6f0dc71737b78620992af9625`;
- detector: YOLOX-S/Triton every frame;
- semantics: EoMT/FP16 scheduled every fifth frame;
- semantic TTL: 750 ms;
- detector queue capacity: 2;
- semantic queue capacity: 1.

The only intentional change is:

```text
mode = semantic-loss-negative-control
stop_after_completed_results = 20
```

Profile SHA-256:
`eb2b114048336c273e77f3046d1eeac5187d27ec01e830de89ff201fb326c8c8`.

## Failure injection and expected behavior

The semantic worker exits cleanly immediately after publishing its twentieth
real mask. The source producer and detector consumer remain unchanged. The last
semantic result may be reused only until its 750 ms TTL expires.

After TTL expiration:

- semantic status must become `stale`;
- world-state delivery health becomes degraded where LiDAR exists;
- LiDAR association and cuboid generation must not execute with that mask;
- raw source scheduling and detector/tracker must continue to the final frame;
- the bounded semantic queue may discard scheduled work because its consumer is
  intentionally absent, but this must not block the detector queue.

The result uses publication scope
`recorded-integrated-semantic-loss-negative-control-only`. Mission Core's E10
overlay store explicitly excludes that scope, so the negative control cannot
replace the accepted visual E10 result in `RAVNOVES00`.

## Result

Result ID:

`e10-integrated-perception-cf3b763731515120dc2714b6c3d7030496ed75057ce41ca88a1df62c21c4149c`

### Detector and world-state continuity

| Measurement | Result |
|---|---:|
| Detector scheduled / processed | 601 / 601 |
| Detector drops | 0 |
| Detector effective rate | 10.010952 FPS |
| Detector queue maximum / capacity | 1 / 2 |
| Replay wall / source span | 60.034251 / 59.969 s |
| World-state age mean | 63.686918 ms |
| World-state age p95 | 90.268570 ms |
| World-state age max | 140.979884 ms |

The main path remained source-paced after semantic loss. Its p95 stayed well
inside the frozen 175 ms laboratory budget.

### Semantic loss and freshness

| Measurement | Result |
|---|---:|
| Scheduled semantic frames | 121 |
| Completed before injected stop | 20 |
| Queue-overwritten after stop | 100 |
| Final bounded queue depth | 1 |
| Unavailable detector states | 5 |
| Fresh detector states | 98 |
| Stale detector states | 498 |
| Fresh coverage | 16.3062% |

Queue accounting is exact: 20 consumed + 100 overwritten + 1 final bounded
entry = 121 scheduled frames. These 100 semantic discards are the expected
effect of intentionally removing the consumer; detector drops remained zero.

### Fail-closed fusion

| Fusion state | Frames |
|---|---:|
| `fused` | 96 |
| `semantic-stale` | 428 |
| `semantic-unavailable` | 2 |
| `depth-unavailable-sync-gate` | 75 |

- accepted cuboid observations before loss became stale: 279;
- fused frames after the mask became stale: zero;
- fusion freshness violations: zero.

The 428 `semantic-stale` fusion states are fewer than the 498 stale detector
states because the depth synchronization gate takes precedence on 70 of those
frames. Neither path performs fusion with an expired semantic mask.

## Acceptance contract

| Check | Threshold | Result |
|---|---:|---:|
| Detector accounting | exact | pass |
| Detector rate | >= 9.5 FPS | 10.010952 |
| Detector drop fraction | <= 0.5% | 0% |
| World-state age p95 | <= 175 ms | 90.268570 ms |
| Semantic stop | exactly 20 results | 20 |
| Stale detector states | >= 450 | 498 |
| Semantic queue accounting | exact | pass |
| Fusion with non-fresh mask | zero | zero |
| Worker/producer errors | zero | zero |

All checks passed. `navigation_or_safety_accepted` remains false.

## GPU, memory and disk

Across 61 telemetry samples:

- GPU utilization: 58.72% mean, 90% p95, 93% max;
- board memory used: 13,151.64 MiB mean, 13,161 MiB max;
- power: 160.05 W mean, 211.02 W p95, 219.41 W max;
- temperature: 41.28 C mean, 42 C max;
- CUDA peak allocated: 2,107.925 MiB;
- CUDA peak reserved: 2,840.0 MiB;
- process peak RSS: 2,023.730 MiB.

The worker orchestrator used only `D:\NDC_MISSIONCORE`, enforced a 360 GiB
floor, and completed with approximately 376.88 GiB free after cleanup. Windows
C was not used. YOLOX was returned to its previous load state.

## Producer and artifact identity

- runner SHA-256:
  `894e679c91d398b0084fa7894346c827e6a54b01e1841cf505a21be76a6c7188`;
- fusion runtime SHA-256:
  `042136fffbc6e06ef62c6d223d5272ce48e0136651f430ab1d59729b32c4bd90`;
- orchestrator SHA-256:
  `ac0ee42495839773a2de60090ebcb49eee979dc7ee3b8587662a3c59e19a4d03`;
- profile SHA-256:
  `eb2b114048336c273e77f3046d1eeac5187d27ec01e830de89ff201fb326c8c8`;
- independent validator/renderer SHA-256:
  `deb9e9f581b0868c9cf3ecae73b17b3253152c969d46089f11ad364efa6f6804`.

| Artifact | SHA-256 |
|---|---|
| `semantic-frames.jsonl` | `ad187a84335cefed40b2d2db7261c16ff053057d49554dc9097e1258a63fa81e` |
| `fusion-frames.jsonl` | `dbd8f203c41ed3f9ba0325b9a53227c7d25c66a34733caf0f2d687a18c26b5a6` |
| `world-state.jsonl` | `2a4e1e0e1bade8f07b12e880602c24fb4b4f8814b683ab01b407174592bd4230` |
| `transient-perception.npz` | `b653d8be9bc2474804268e9aa0a8c7dfdb1b2cacc779b515ef6b112aa9231e89` |
| `gpu-telemetry.jsonl` | `07708357da7a5c464db2015f897137deb730762c68e247ed5eeb40cee19ac108` |
| `run-report.json` | `06a8170ccdf561c51616050887a0ddd489894e36d22d35f0dd02ebbc700cf9e1` |
| `result.json` | `e23821353a3afdd3789b9fee57d58915ca56c002828453662ec30824a878d3f5` |

Independent validation accepted the result and confirmed its negative-control
publication scope. A store-selection regression proved that the UI continues to
select the accepted qualification result
`e10-integrated-perception-c6e0263...`, not E10-N1. The targeted regression
suite now passes 48 tests.

## Accepted scope

- controlled semantic-worker stop after real inference results;
- detector/tracker continuity at source pace;
- explicit unavailable/fresh/stale state transition;
- fail-closed LiDAR fusion after TTL expiration;
- bounded semantic queue behavior without detector backpressure;
- negative-control isolation from the user-facing Rerun result;
- D-only storage and disk-floor enforcement.

## Not accepted

- automatic semantic-worker restart or state recovery;
- hard process/container/GPU failure;
- direct K1 live transport;
- long-duration operation;
- target onboard hardware;
- navigation or safety use.

## Next gate

The next gate is the full `RAVNOVES00` stability run with the normal accepted E10
configuration. It must cover the complete approximately nine-minute camera
track, build a matching full-session LiDAR replay pack, preserve bounded queues
and memory, and keep the D free-space floor. After that, the recorded source
adapter can be replaced with direct K1 transport under the same contracts.
