docs(m4): seal rolling map correction evidence

2026-08-05 21:12:59 +03:00
parent 31313c3c96
commit 13ed096f80
3 changed files with 164 additions and 1 deletions
@@ -989,6 +989,63 @@ the replay-derived virtual frame must be replaced by one measured rigid
 `T_body_from_sensor`; this does not change the downstream obstacle or threat
 contracts. M4.7 is now the next implementation phase.

+### 2026-08-05 — M4.5R representation correction and M4.6 reseal
+
+Operator inspection of frame `1880` exposed a second independent defect in the
+accepted M4.6 evidence: the recorded K1 `lio_pcl` message had been rendered and
+processed as a complete current scan. It is actually a registered SLAM-map
+increment. The camera visibly retained two concrete hemispheres while that
+single increment did not republish their points. Result
+`m4-threat-replay-78a06d96c4db5263dc63fc4e6e067c07fc81370d3f5085ff43361af89cec1e9e`
+is therefore withdrawn. Its gravity-stable body-frame correction remains valid,
+but its obstacle-presence interpretation does not.
+
+ADR 0041 adds a product-owned rolling local occupancy provider without changing
+the detector, geometry or body-frame seams. The exact current increment,
+temporal motion state and bounded retained occupancy are separate contracts.
+Missing republication never clears a cell. Retained occupancy is bounded to
+`3.0 s`, `12.0 m`, `65,536` cells and zero allowed capacity drops; it can block
+an intersecting corridor but cannot claim current motion or safe clearance.
+
+The accepted resealed M4.5R result is
+`m4-temporal-replay-b8611526dfcd2b9be9049560d751bbd23a9ad54b7dda8e9dc48a17374d46266e`:
+
+- frame ledger SHA-256
+  `08a03669d3487ecf7bd62b047ae5b8d1ff586a27e7435e5f235907a4d709dd25`;
+- manifest/report SHA-256
+  `5df4c31b1d3a9f834895af999c55829b40afeca89d50ffe04f7e23bd85e2bd8c` /
+  `2e708fb30f35b34ed99cbe107055772bfb61553a3321c0ff2fee725d3a07bdc9`;
+- `4,489 / 4,489` frames, zero failed;
+- `848,868` current increment cells;
+- `69,855` retained component and `1,776,145` retained cell publications;
+- peak `907` active cells and `35` retained components;
+- `29,620` time evictions, `6,512` radius evictions, zero capacity drops and
+  maximum retained age exactly `3.0 s`.
+
+The accepted resealed M4.6 result is
+`m4-threat-replay-ef521b23eee704dee99856b6e93d5047a9b358e21ffda3ea9cacc2ef768164d9`:
+
+- manifest/report SHA-256
+  `199ed52211f3d50ecce0e3f0bc1efc094b665e9a0c5e0426e01640a6b9a5f0bb` /
+  `e32402fd6d52b1c22e3a5ee5b794bbe8facaf132e02cdaa902175395fa6b9db8`;
+- frame/visual SHA-256
+  `57219acd7dfe1cf04b12d4a415d1819e0a4947bc3173333bb56eea8fd2bd47b9` /
+  `bda54e144a1b4c878ba645a8dafedcdc0332e16a1489b62b7100670e8eae6f25`;
+- evidence: `27,299` current metric, `69,855` rolling-map, `37,995`
+  stale/held and `10,158` camera-only publications;
+- decisions: `6,626 threat`, `10,700 not-threat`, `127,981 unknown`;
+- deterministic fixtures `10 / 10`, five critical, zero critical false-safe;
+- body-frame qualification unchanged at `3,861 / 3,928`, confirming the
+  representation fix did not regress the earlier route/gravity correction;
+- frame `1880` now binds two distinct engineering anchors to retained occupied
+  components; the near anchor asserts threat. The anchors are not independent
+  truth.
+
+The common viewer keeps VIDEO/CAMERA/3D/PLAN synchronized and independently
+toggles `CURRENT INCREMENT` and `ROLLING MAP`. Regression frames are now `138`,
+`274` and `1880`. M4.7 may proceed only from the resealed identities above;
+physical-live, collision, navigation and actuation authority remain false.
+
 ## Implementation order

 The implementation sequence is intentionally strict:
@@ -1,7 +1,7 @@
 # ADR 0040: Dual-evidence replay threat boundary

 Date: 2026-08-05
-Status: accepted and implemented for M4.6
+Status: accepted; representation handling amended by ADR 0041

 ## Context

@@ -24,6 +24,12 @@ made the replay corridor approximately 90 degrees off the route and rotated the
 SLAM world with the operator's hand. Result `m4-threat-replay-7e1613...` is
 superseded and is not admissible M4.6 evidence.

+The subsequent result `m4-threat-replay-78a06d...` corrected the body frame but
+still treated each recorded `lio_pcl` message as a complete current scan. ADR
+0041 withdraws that result and adds the missing rolling-map representation
+boundary. The dual-evidence and gravity-stable body-frame decisions below remain
+valid.
+
 ## Decision

 Mission Core threat assessment consumes two independent evidence paths:
@@ -86,6 +92,8 @@ ledgers. Visual evidence uses the common LAB viewer and reusable renderers:
  plan view;
 - mandatory regression frames `138` and `274`, which exposed the original
  sensor/body-axis failure;
+- mandatory frame `1880`, which exposes loss of occupied structures when a
+  registered map increment is mistaken for a complete scan;
 - visible threat/not-threat/unknown and `replay-simulated` authority.

 Visuals are an inspection surface, not ground truth. Independent object-centric
@@ -0,0 +1,98 @@
+# ADR 0041: Registered map increment and rolling local occupancy
+
+Date: 2026-08-05
+Status: accepted and implemented for M4.5R/M4.6
+
+## Context
+
+The recorded K1 topic `lixel/application/report/lio_pcl` is post-LIO data in the
+vendor SLAM map frame. In RAVNOVES00 it behaves as a registered map increment:
+one message contains points contributed at that moment, not a complete scan of
+everything currently visible. Therefore a structure can remain physically
+present while its points are absent from a later message.
+
+M4.5 originally applied a `0.75 s` temporal object hold directly to those
+increments. M4.6 then rendered the current increment as if it were the complete
+LiDAR scene. At frame `1880` the exact camera frame visibly contains two
+concrete hemispheres, while the current `lio_pcl` increment has no corresponding
+points in the corridor. The old result `m4-threat-replay-78a06d...` consequently
+lost them from 3D. This was a representation error, not evidence that LiDAR had
+measured free space.
+
+## Decision
+
+Mission Core keeps three distinct products:
+
+```text
+current registered increment ──> exact source context
+current occupied components ───> temporal identity and motion evidence
+bounded rolling occupancy ─────> conservative local obstacle presence
+```
+
+`RollingLocalObstacleMapProvider` accumulates only qualified current occupied
+cells in the SLAM map frame. It never interprets missing republication as free
+space. Retained cells are evicted only by explicit bounds:
+
+- voxel size `0.45 m`;
+- retention `3.0 s`;
+- local radius `12.0 m` around the recorded pose;
+- maximum `65,536` active cells, with fail-closed capacity handling;
+- bounded component size/count and deterministic 26-neighbour connectivity.
+
+The provider publishes only cells not present in the current increment as
+`TemporalState.RETAINED`. Current and retained identities cannot overlap.
+Retained components have ephemeral identity, carry their last-hit age and never
+claim current motion. They may assert `threat` when their occupied cells
+intersect the current virtual corridor; outside the corridor they remain
+`unknown`, never `not-threat`.
+
+The `0.75 s` temporal object state remains separate. It continues to answer
+whether a current component has enough bounded history for motion reasoning. It
+is not a map-clearing policy.
+
+## Evidence and acceptance
+
+The accepted M4.5R result is
+`m4-temporal-replay-b8611526dfcd2b9be9049560d751bbd23a9ad54b7dda8e9dc48a17374d46266e`.
+Its frame ledger SHA-256 is
+`08a03669d3487ecf7bd62b047ae5b8d1ff586a27e7435e5f235907a4d709dd25`.
+Across all `4,489` source frames it records:
+
+- `848,868` current increment occupied cells;
+- `69,855` retained component publications and `1,776,145` retained cell
+  publications;
+- peak `907` active cells and `35` retained components;
+- `29,620` time evictions, `6,512` radius evictions and zero capacity drops;
+- maximum retained age exactly `3.0 s` and `587` active cells at replay end.
+
+The accepted M4.6 result is
+`m4-threat-replay-ef521b23eee704dee99856b6e93d5047a9b358e21ffda3ea9cacc2ef768164d9`.
+All `4,489` frames completed with `27,299` current metric, `69,855` rolling-map,
+`37,995` stale/held and `10,158` camera-only evidence publications assessed
+exactly once. Decisions are `6,626 threat`, `10,700 not-threat` and `127,981
+unknown`. All `10/10` deterministic fixtures pass with zero critical false-safe
+outcomes.
+
+Frame `1880` is a mandatory engineering visual regression. It binds two
+separate body-frame regions to two retained components. The near region must
+assert threat; both regions are present in the accepted result. These anchors
+encode a reproducible owner-reviewed visual case, not independent object truth.
+
+The common LAB viewer exposes `CURRENT INCREMENT` and `ROLLING MAP` as separate
+layers over the same selected frame. The current point count is not relabelled
+as a complete scan, and retained occupied cells remain independently hideable.
+
+## Consequences and limitations
+
+- Missing points cannot create free-space or navigation authority.
+- Short-lived obstacle disappearance caused solely by incremental publication
+  is removed from the replay decision path.
+- A moving object may leave a conservative ghost for up to `3.0 s`; retained
+  occupancy can block but cannot claim motion or clearance.
+- No ray-level free-space clearing is available in this recording. A future raw
+  scan/ray provider must add explicit observation and clearing semantics rather
+  than weakening this contract.
+- The two frame-1880 anchors are regression evidence, not independent truth,
+  detector accuracy or physical collision acceptance.
+- Live K1, measured `T_body_from_sensor`, physical body geometry, navigation,
+  commands and actuation remain outside M4.5R/M4.6 authority.