From 13ed096f80be1c8ca12a7178ad5b9da21d9c0e3f Mon Sep 17 00:00:00 2001 From: DCCONSTRUCTIONS Date: Wed, 5 Aug 2026 21:12:59 +0300 Subject: [PATCH] docs(m4): seal rolling map correction evidence --- ...E_4_OBJECT_CENTRIC_RECORDED_REALTIME_CV.md | 57 +++++++++++ ...40-dual-evidence-replay-threat-boundary.md | 10 +- ...d-map-increment-rolling-local-occupancy.md | 98 +++++++++++++++++++ 3 files changed, 164 insertions(+), 1 deletion(-) create mode 100644 docs/adr/0041-registered-map-increment-rolling-local-occupancy.md diff --git a/docs/22_MILESTONE_4_OBJECT_CENTRIC_RECORDED_REALTIME_CV.md b/docs/22_MILESTONE_4_OBJECT_CENTRIC_RECORDED_REALTIME_CV.md index 0e37454..b90baec 100644 --- a/docs/22_MILESTONE_4_OBJECT_CENTRIC_RECORDED_REALTIME_CV.md +++ b/docs/22_MILESTONE_4_OBJECT_CENTRIC_RECORDED_REALTIME_CV.md @@ -989,6 +989,63 @@ the replay-derived virtual frame must be replaced by one measured rigid `T_body_from_sensor`; this does not change the downstream obstacle or threat contracts. M4.7 is now the next implementation phase. +### 2026-08-05 — M4.5R representation correction and M4.6 reseal + +Operator inspection of frame `1880` exposed a second independent defect in the +accepted M4.6 evidence: the recorded K1 `lio_pcl` message had been rendered and +processed as a complete current scan. It is actually a registered SLAM-map +increment. The camera visibly retained two concrete hemispheres while that +single increment did not republish their points. Result +`m4-threat-replay-78a06d96c4db5263dc63fc4e6e067c07fc81370d3f5085ff43361af89cec1e9e` +is therefore withdrawn. Its gravity-stable body-frame correction remains valid, +but its obstacle-presence interpretation does not. + +ADR 0041 adds a product-owned rolling local occupancy provider without changing +the detector, geometry or body-frame seams. The exact current increment, +temporal motion state and bounded retained occupancy are separate contracts. +Missing republication never clears a cell. Retained occupancy is bounded to +`3.0 s`, `12.0 m`, `65,536` cells and zero allowed capacity drops; it can block +an intersecting corridor but cannot claim current motion or safe clearance. + +The accepted resealed M4.5R result is +`m4-temporal-replay-b8611526dfcd2b9be9049560d751bbd23a9ad54b7dda8e9dc48a17374d46266e`: + +- frame ledger SHA-256 + `08a03669d3487ecf7bd62b047ae5b8d1ff586a27e7435e5f235907a4d709dd25`; +- manifest/report SHA-256 + `5df4c31b1d3a9f834895af999c55829b40afeca89d50ffe04f7e23bd85e2bd8c` / + `2e708fb30f35b34ed99cbe107055772bfb61553a3321c0ff2fee725d3a07bdc9`; +- `4,489 / 4,489` frames, zero failed; +- `848,868` current increment cells; +- `69,855` retained component and `1,776,145` retained cell publications; +- peak `907` active cells and `35` retained components; +- `29,620` time evictions, `6,512` radius evictions, zero capacity drops and + maximum retained age exactly `3.0 s`. + +The accepted resealed M4.6 result is +`m4-threat-replay-ef521b23eee704dee99856b6e93d5047a9b358e21ffda3ea9cacc2ef768164d9`: + +- manifest/report SHA-256 + `199ed52211f3d50ecce0e3f0bc1efc094b665e9a0c5e0426e01640a6b9a5f0bb` / + `e32402fd6d52b1c22e3a5ee5b794bbe8facaf132e02cdaa902175395fa6b9db8`; +- frame/visual SHA-256 + `57219acd7dfe1cf04b12d4a415d1819e0a4947bc3173333bb56eea8fd2bd47b9` / + `bda54e144a1b4c878ba645a8dafedcdc0332e16a1489b62b7100670e8eae6f25`; +- evidence: `27,299` current metric, `69,855` rolling-map, `37,995` + stale/held and `10,158` camera-only publications; +- decisions: `6,626 threat`, `10,700 not-threat`, `127,981 unknown`; +- deterministic fixtures `10 / 10`, five critical, zero critical false-safe; +- body-frame qualification unchanged at `3,861 / 3,928`, confirming the + representation fix did not regress the earlier route/gravity correction; +- frame `1880` now binds two distinct engineering anchors to retained occupied + components; the near anchor asserts threat. The anchors are not independent + truth. + +The common viewer keeps VIDEO/CAMERA/3D/PLAN synchronized and independently +toggles `CURRENT INCREMENT` and `ROLLING MAP`. Regression frames are now `138`, +`274` and `1880`. M4.7 may proceed only from the resealed identities above; +physical-live, collision, navigation and actuation authority remain false. + ## Implementation order The implementation sequence is intentionally strict: diff --git a/docs/adr/0040-dual-evidence-replay-threat-boundary.md b/docs/adr/0040-dual-evidence-replay-threat-boundary.md index de94499..a571967 100644 --- a/docs/adr/0040-dual-evidence-replay-threat-boundary.md +++ b/docs/adr/0040-dual-evidence-replay-threat-boundary.md @@ -1,7 +1,7 @@ # ADR 0040: Dual-evidence replay threat boundary Date: 2026-08-05 -Status: accepted and implemented for M4.6 +Status: accepted; representation handling amended by ADR 0041 ## Context @@ -24,6 +24,12 @@ made the replay corridor approximately 90 degrees off the route and rotated the SLAM world with the operator's hand. Result `m4-threat-replay-7e1613...` is superseded and is not admissible M4.6 evidence. +The subsequent result `m4-threat-replay-78a06d...` corrected the body frame but +still treated each recorded `lio_pcl` message as a complete current scan. ADR +0041 withdraws that result and adds the missing rolling-map representation +boundary. The dual-evidence and gravity-stable body-frame decisions below remain +valid. + ## Decision Mission Core threat assessment consumes two independent evidence paths: @@ -86,6 +92,8 @@ ledgers. Visual evidence uses the common LAB viewer and reusable renderers: plan view; - mandatory regression frames `138` and `274`, which exposed the original sensor/body-axis failure; +- mandatory frame `1880`, which exposes loss of occupied structures when a + registered map increment is mistaken for a complete scan; - visible threat/not-threat/unknown and `replay-simulated` authority. Visuals are an inspection surface, not ground truth. Independent object-centric diff --git a/docs/adr/0041-registered-map-increment-rolling-local-occupancy.md b/docs/adr/0041-registered-map-increment-rolling-local-occupancy.md new file mode 100644 index 0000000..57ab42b --- /dev/null +++ b/docs/adr/0041-registered-map-increment-rolling-local-occupancy.md @@ -0,0 +1,98 @@ +# ADR 0041: Registered map increment and rolling local occupancy + +Date: 2026-08-05 +Status: accepted and implemented for M4.5R/M4.6 + +## Context + +The recorded K1 topic `lixel/application/report/lio_pcl` is post-LIO data in the +vendor SLAM map frame. In RAVNOVES00 it behaves as a registered map increment: +one message contains points contributed at that moment, not a complete scan of +everything currently visible. Therefore a structure can remain physically +present while its points are absent from a later message. + +M4.5 originally applied a `0.75 s` temporal object hold directly to those +increments. M4.6 then rendered the current increment as if it were the complete +LiDAR scene. At frame `1880` the exact camera frame visibly contains two +concrete hemispheres, while the current `lio_pcl` increment has no corresponding +points in the corridor. The old result `m4-threat-replay-78a06d...` consequently +lost them from 3D. This was a representation error, not evidence that LiDAR had +measured free space. + +## Decision + +Mission Core keeps three distinct products: + +```text +current registered increment ──> exact source context +current occupied components ───> temporal identity and motion evidence +bounded rolling occupancy ─────> conservative local obstacle presence +``` + +`RollingLocalObstacleMapProvider` accumulates only qualified current occupied +cells in the SLAM map frame. It never interprets missing republication as free +space. Retained cells are evicted only by explicit bounds: + +- voxel size `0.45 m`; +- retention `3.0 s`; +- local radius `12.0 m` around the recorded pose; +- maximum `65,536` active cells, with fail-closed capacity handling; +- bounded component size/count and deterministic 26-neighbour connectivity. + +The provider publishes only cells not present in the current increment as +`TemporalState.RETAINED`. Current and retained identities cannot overlap. +Retained components have ephemeral identity, carry their last-hit age and never +claim current motion. They may assert `threat` when their occupied cells +intersect the current virtual corridor; outside the corridor they remain +`unknown`, never `not-threat`. + +The `0.75 s` temporal object state remains separate. It continues to answer +whether a current component has enough bounded history for motion reasoning. It +is not a map-clearing policy. + +## Evidence and acceptance + +The accepted M4.5R result is +`m4-temporal-replay-b8611526dfcd2b9be9049560d751bbd23a9ad54b7dda8e9dc48a17374d46266e`. +Its frame ledger SHA-256 is +`08a03669d3487ecf7bd62b047ae5b8d1ff586a27e7435e5f235907a4d709dd25`. +Across all `4,489` source frames it records: + +- `848,868` current increment occupied cells; +- `69,855` retained component publications and `1,776,145` retained cell + publications; +- peak `907` active cells and `35` retained components; +- `29,620` time evictions, `6,512` radius evictions and zero capacity drops; +- maximum retained age exactly `3.0 s` and `587` active cells at replay end. + +The accepted M4.6 result is +`m4-threat-replay-ef521b23eee704dee99856b6e93d5047a9b358e21ffda3ea9cacc2ef768164d9`. +All `4,489` frames completed with `27,299` current metric, `69,855` rolling-map, +`37,995` stale/held and `10,158` camera-only evidence publications assessed +exactly once. Decisions are `6,626 threat`, `10,700 not-threat` and `127,981 +unknown`. All `10/10` deterministic fixtures pass with zero critical false-safe +outcomes. + +Frame `1880` is a mandatory engineering visual regression. It binds two +separate body-frame regions to two retained components. The near region must +assert threat; both regions are present in the accepted result. These anchors +encode a reproducible owner-reviewed visual case, not independent object truth. + +The common LAB viewer exposes `CURRENT INCREMENT` and `ROLLING MAP` as separate +layers over the same selected frame. The current point count is not relabelled +as a complete scan, and retained occupied cells remain independently hideable. + +## Consequences and limitations + +- Missing points cannot create free-space or navigation authority. +- Short-lived obstacle disappearance caused solely by incremental publication + is removed from the replay decision path. +- A moving object may leave a conservative ghost for up to `3.0 s`; retained + occupancy can block but cannot claim motion or clearance. +- No ray-level free-space clearing is available in this recording. A future raw + scan/ray provider must add explicit observation and clearing semantics rather + than weakening this contract. +- The two frame-1880 anchors are regression evidence, not independent truth, + detector accuracy or physical collision acceptance. +- Live K1, measured `T_body_from_sensor`, physical body geometry, navigation, + commands and actuation remain outside M4.5R/M4.6 authority.