docs(m4): seal rolling map correction evidence

docs/adr/0040-dual-evidence-replay-threat-boundary.md

@@ -1,7 +1,7 @@
 # ADR 0040: Dual-evidence replay threat boundary
 
 Date: 2026-08-05
-Status: accepted and implemented for M4.6
+Status: accepted; representation handling amended by ADR 0041
 
 ## Context
 
@@ -24,6 +24,12 @@ made the replay corridor approximately 90 degrees off the route and rotated the
 SLAM world with the operator's hand. Result `m4-threat-replay-7e1613...` is
 superseded and is not admissible M4.6 evidence.
 
+The subsequent result `m4-threat-replay-78a06d...` corrected the body frame but
+still treated each recorded `lio_pcl` message as a complete current scan. ADR
+0041 withdraws that result and adds the missing rolling-map representation
+boundary. The dual-evidence and gravity-stable body-frame decisions below remain
+valid.
+
 ## Decision
 
 Mission Core threat assessment consumes two independent evidence paths:
@@ -86,6 +92,8 @@ ledgers. Visual evidence uses the common LAB viewer and reusable renderers:
   plan view;
 - mandatory regression frames `138` and `274`, which exposed the original
   sensor/body-axis failure;
+- mandatory frame `1880`, which exposes loss of occupied structures when a
+  registered map increment is mistaken for a complete scan;
 - visible threat/not-threat/unknown and `replay-simulated` authority.
 
 Visuals are an inspection surface, not ground truth. Independent object-centric

docs/adr/0041-registered-map-increment-rolling-local-occupancy.md

@@ -0,0 +1,98 @@
+# ADR 0041: Registered map increment and rolling local occupancy
+
+Date: 2026-08-05
+Status: accepted and implemented for M4.5R/M4.6
+
+## Context
+
+The recorded K1 topic `lixel/application/report/lio_pcl` is post-LIO data in the
+vendor SLAM map frame. In RAVNOVES00 it behaves as a registered map increment:
+one message contains points contributed at that moment, not a complete scan of
+everything currently visible. Therefore a structure can remain physically
+present while its points are absent from a later message.
+
+M4.5 originally applied a `0.75 s` temporal object hold directly to those
+increments. M4.6 then rendered the current increment as if it were the complete
+LiDAR scene. At frame `1880` the exact camera frame visibly contains two
+concrete hemispheres, while the current `lio_pcl` increment has no corresponding
+points in the corridor. The old result `m4-threat-replay-78a06d...` consequently
+lost them from 3D. This was a representation error, not evidence that LiDAR had
+measured free space.
+
+## Decision
+
+Mission Core keeps three distinct products:
+
+```text
+current registered increment ──> exact source context
+current occupied components ───> temporal identity and motion evidence
+bounded rolling occupancy ─────> conservative local obstacle presence
+```
+
+`RollingLocalObstacleMapProvider` accumulates only qualified current occupied
+cells in the SLAM map frame. It never interprets missing republication as free
+space. Retained cells are evicted only by explicit bounds:
+
+- voxel size `0.45 m`;
+- retention `3.0 s`;
+- local radius `12.0 m` around the recorded pose;
+- maximum `65,536` active cells, with fail-closed capacity handling;
+- bounded component size/count and deterministic 26-neighbour connectivity.
+
+The provider publishes only cells not present in the current increment as
+`TemporalState.RETAINED`. Current and retained identities cannot overlap.
+Retained components have ephemeral identity, carry their last-hit age and never
+claim current motion. They may assert `threat` when their occupied cells
+intersect the current virtual corridor; outside the corridor they remain
+`unknown`, never `not-threat`.
+
+The `0.75 s` temporal object state remains separate. It continues to answer
+whether a current component has enough bounded history for motion reasoning. It
+is not a map-clearing policy.
+
+## Evidence and acceptance
+
+The accepted M4.5R result is
+`m4-temporal-replay-b8611526dfcd2b9be9049560d751bbd23a9ad54b7dda8e9dc48a17374d46266e`.
+Its frame ledger SHA-256 is
+`08a03669d3487ecf7bd62b047ae5b8d1ff586a27e7435e5f235907a4d709dd25`.
+Across all `4,489` source frames it records:
+
+- `848,868` current increment occupied cells;
+- `69,855` retained component publications and `1,776,145` retained cell
+  publications;
+- peak `907` active cells and `35` retained components;
+- `29,620` time evictions, `6,512` radius evictions and zero capacity drops;
+- maximum retained age exactly `3.0 s` and `587` active cells at replay end.
+
+The accepted M4.6 result is
+`m4-threat-replay-ef521b23eee704dee99856b6e93d5047a9b358e21ffda3ea9cacc2ef768164d9`.
+All `4,489` frames completed with `27,299` current metric, `69,855` rolling-map,
+`37,995` stale/held and `10,158` camera-only evidence publications assessed
+exactly once. Decisions are `6,626 threat`, `10,700 not-threat` and `127,981
+unknown`. All `10/10` deterministic fixtures pass with zero critical false-safe
+outcomes.
+
+Frame `1880` is a mandatory engineering visual regression. It binds two
+separate body-frame regions to two retained components. The near region must
+assert threat; both regions are present in the accepted result. These anchors
+encode a reproducible owner-reviewed visual case, not independent object truth.
+
+The common LAB viewer exposes `CURRENT INCREMENT` and `ROLLING MAP` as separate
+layers over the same selected frame. The current point count is not relabelled
+as a complete scan, and retained occupied cells remain independently hideable.
+
+## Consequences and limitations
+
+- Missing points cannot create free-space or navigation authority.
+- Short-lived obstacle disappearance caused solely by incremental publication
+  is removed from the replay decision path.
+- A moving object may leave a conservative ghost for up to `3.0 s`; retained
+  occupancy can block but cannot claim motion or clearance.
+- No ray-level free-space clearing is available in this recording. A future raw
+  scan/ray provider must add explicit observation and clearing semantics rather
+  than weakening this contract.
+- The two frame-1880 anchors are regression evidence, not independent truth,
+  detector accuracy or physical collision acceptance.
+- Live K1, measured `T_body_from_sensor`, physical body geometry, navigation,
+  commands and actuation remain outside M4.5R/M4.6 authority.