feat(perception): qualify E33 worker shadow

2026-07-27 13:43:18 +03:00
parent 32257fc2b4
commit 9bbd5845b7
13 changed files with 2448 additions and 9 deletions
@@ -666,9 +666,25 @@ and exclusive PointSlab ownership is enforced. Conflict count remains `38`;
 the result is accepted only as the source-scoped diagnostic/shadow input for
 E33 and is not promoted as a detector-accuracy or staleness improvement.

-Execution is strictly sequential through E33: E30 determines what E31 is
-allowed to change; E31 determines the E32 profile; E32 determines the E33
-runtime input. E34 and E35 may proceed only after E33 closes exact accounting.
+E33 accepted immutable worker result
+`e33-worker-shadow-05cc0bb264410fd49536df90e94067ac39731aff0322a8873700d40008a8bb3a`
+from package
+`e33-worker-package-c8609151e71a35b3be3857aef168c0fe98380ff9055ce37560233bb332508823`.
+The final E32 TrackGeometry stage delivered all `4,489` frames at recorded
+`1.0×` pace on physical worker `DESKTOP-OPJ8J04`: effective rate was
+`10.0062 FPS`, wall/source ratio `1.000142`, result-age p95 `2.668 ms` and
+process RSS maximum `92.34 MiB`. Work and result queues remained bounded at
+depth two with zero replacement, drop or deadline miss. The pinned container,
+worker node, complete per-frame outcomes and resource samples are retained in
+the immutable result. GPU board counters include co-tenant persistent
+workloads and are evidence of node visibility, not E33 process consumption.
+E33 qualifies downstream publication against the immutable E10→E32 chain; it
+does not rerun or independently requalify upstream inference.
+
+Execution was strictly sequential through E33: E30 determined what E31 was
+allowed to change; E31 determined the E32 profile; E32 determined the E33
+runtime input. Exact accounting is now closed, so E34 and E35 are the active
+critical path.
 E36 is the first generalization gate. A separate product decision follows:
 either keep the result as operator/shadow evidence, or start L5 occupied-space
 integration. No LAB in this cycle can enable navigation, commands or safety
@@ -184,7 +184,15 @@ unqualified ranges and resolves 4,461 overlapping point claims. Of 709
 arbitrated semantic observations, 563 retain `agree` and 146 conservatively
 become `unknown`. The 38 E29 conflicts remain 38; A6 is accepted as a
 diagnostic/shadow contract, not as detector-accuracy improvement. A7/E33
-recorded-source-paced worker execution is now the critical path.
+is complete in immutable result
+`e33-worker-shadow-05cc0bb264410fd49536df90e94067ac39731aff0322a8873700d40008a8bb3a`.
+All 4,489 frames were delivered at `10.0062 FPS` over a `448.623 s` source
+span with zero queue replacement, result drop or deadline miss. Result age
+p95 was `2.668 ms`, process RSS peaked at `92.34 MiB`, both queues remained
+bounded at depth two and the exact physical worker/container identity is
+retained. This qualifies the final TrackGeometry publication stage against the
+immutable upstream E10→E32 chain; it is not a new model-inference benchmark.
+A8/E34+E35 is now the critical path.

 - [x] Reproduce all 4,489 immutable E29 frames with the exact frozen profile
  before applying E31/E30 changes.
@@ -196,6 +204,18 @@ recorded-source-paced worker execution is now the critical path.
  cause while preserving source availability and unknown/free-space policy.
 - [x] Add a digest-bound compact binary PointSlab encoding and strict
  TrackGeometryFrame reconstruction/validation.
+- [x] Package the exact E32 result, frozen runtime and profile as immutable
+  E33 worker input with complete artifact digests.
+- [x] Replay all 4,489 frames at recorded `1.0×` pace through independent
+  bounded latest-wins work/result queues.
+- [x] Close every frame as delivered, input-superseded or result-superseded
+  and publish per-frame health/timing plus resource telemetry.
+- [x] Bind the accepted result to physical worker `DESKTOP-OPJ8J04` and the
+  pinned container image; independently verify all result artifacts.
+- [ ] Build E34 as a separate short-TTL occupied/unknown temporal layer over
+  accepted E32/E33 evidence.
+- [ ] Run E35 deterministic degradation/recovery variants without changing
+  the immutable source or accepted E32/E33 results.

 ### A3 residual and human-exception policy

@@ -0,0 +1,97 @@
+# ADR 0026 — E33 recorded-source-paced TrackGeometry worker shadow
+
+Date: 2026-07-27
+
+Status: accepted for source-scoped diagnostic/shadow use
+
+## Context
+
+E32 closed source, observation and exclusive point-ownership accounting for all
+4,489 immutable RAVNOVES00 frames. That result proved the data contract, but it
+did not prove that the final TrackGeometry publication stage could sustain the
+recorded source timeline on the designated worker with bounded channels and
+explicit terminal outcomes.
+
+The upstream E10 result already contains the full source-paced detector and
+semantic worker execution. E33 therefore qualifies the final E32
+TrackGeometry transport/publication stage. It does not rerun, replace or tune
+the detector, segmentation, tracking, calibration or geometry algorithms.
+
+## Decision
+
+1. E33 receives one content-addressed package containing the complete immutable
+   E32 result, the frozen E33 profile and the minimum runtime required to
+   validate and replay it.
+2. The package and result bind the exact E10, E29, E30, E31 and E32 identities.
+   Every package artifact and every published result artifact has a byte length
+   and SHA-256 digest.
+3. The producer releases all frames at `1.0×` recorded host pace. Work and
+   result channels are independent latest-wins queues with capacity two.
+4. Queue replacement is never silent. Every source frame has exactly one
+   terminal outcome: delivered, input-superseded or result-superseded.
+5. Delivered frames include release lag, work wait, processing time, result
+   wait, result age, health and a digest over the referenced E32 point slab.
+   A late result becomes explicit health state.
+6. The runtime samples process CPU and RSS plus GPU board visibility,
+   utilization and memory. GPU board values are node-level observations and
+   may include co-tenant workloads; they are not process-level attribution to
+   the E33 publication stage.
+7. The immutable identity binds both the expected physical worker node and the
+   container hostname. A correct container on an unexpected node fails closed.
+8. The Windows wrapper admits only a real `D:` package/output directory,
+   enforces a 300 GiB free-space floor, verifies the pinned container image,
+   disables networking, uses a read-only filesystem, drops capabilities and
+   publishes only one atomically completed result directory.
+9. E33 is diagnostic/shadow only. Commands, navigation and safety acceptance
+   remain false. No persistent reconstruction or source artifact is modified.
+
+## Accepted result
+
+Package:
+`e33-worker-package-c8609151e71a35b3be3857aef168c0fe98380ff9055ce37560233bb332508823`.
+
+Result:
+`e33-worker-shadow-05cc0bb264410fd49536df90e94067ac39731aff0322a8873700d40008a8bb3a`.
+
+Runtime:
+
+- physical worker: `DESKTOP-OPJ8J04`;
+- container hostname: `ebca59deeafd`;
+- image:
+  `nvcr.io/nvidia/tritonserver:26.06-py3@sha256:58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794`;
+- source span: `448.623 s`;
+- replay wall time: `448.687 s`;
+- wall/source ratio: `1.000142`;
+- effective delivery rate: `10.0062 FPS`.
+
+Accounting and timing:
+
+- 4,489 / 4,489 frames delivered;
+- zero input replacements, result replacements and deadline misses;
+- work/result queue maximum depth `2/2`;
+- release lag p50/p95/max:
+  `0.075 / 0.462 / 8.594 ms`;
+- processing p50/p95/max:
+  `0.174 / 0.750 / 7.698 ms`;
+- result age p50/p95/max:
+  `0.468 / 2.668 / 13.638 ms`;
+- process RSS p50/p95/max:
+  `79.28 / 90.33 / 92.34 MiB`.
+
+All 13 predeclared acceptance requirements pass. The independently copied
+result archive has SHA-256
+`9336f8df72ed43c2b46c68c544400db2fda52cf22f7ed8520d23fa0a9fc21081`.
+
+## Consequences
+
+- A7 is complete for the final TrackGeometry worker publication stage.
+- E33 proves source-paced bounded execution and closed accounting for this
+  exact source, profile, package, worker and container identity. It does not
+  independently requalify the already accepted upstream model-inference
+  stages.
+- An earlier accepted runtime result without a physical worker-node binding is
+  retained as historical evidence and is not the accepted A7 result.
+- E34 may consume the accepted E32 evidence under the E33 timing/accounting
+  envelope to build a separate short-TTL occupied/unknown layer.
+- E35 must still prove deterministic degradation and recovery. E33 does not
+  establish second-source transfer, free space, traversability or control.