feat(perception): qualify E33 worker shadow

2026-07-27 13:43:18 +03:00
parent 32257fc2b4
commit 9bbd5845b7
13 changed files with 2448 additions and 9 deletions
@@ -0,0 +1,97 @@
+# ADR 0026 — E33 recorded-source-paced TrackGeometry worker shadow
+
+Date: 2026-07-27
+
+Status: accepted for source-scoped diagnostic/shadow use
+
+## Context
+
+E32 closed source, observation and exclusive point-ownership accounting for all
+4,489 immutable RAVNOVES00 frames. That result proved the data contract, but it
+did not prove that the final TrackGeometry publication stage could sustain the
+recorded source timeline on the designated worker with bounded channels and
+explicit terminal outcomes.
+
+The upstream E10 result already contains the full source-paced detector and
+semantic worker execution. E33 therefore qualifies the final E32
+TrackGeometry transport/publication stage. It does not rerun, replace or tune
+the detector, segmentation, tracking, calibration or geometry algorithms.
+
+## Decision
+
+1. E33 receives one content-addressed package containing the complete immutable
+   E32 result, the frozen E33 profile and the minimum runtime required to
+   validate and replay it.
+2. The package and result bind the exact E10, E29, E30, E31 and E32 identities.
+   Every package artifact and every published result artifact has a byte length
+   and SHA-256 digest.
+3. The producer releases all frames at `1.0×` recorded host pace. Work and
+   result channels are independent latest-wins queues with capacity two.
+4. Queue replacement is never silent. Every source frame has exactly one
+   terminal outcome: delivered, input-superseded or result-superseded.
+5. Delivered frames include release lag, work wait, processing time, result
+   wait, result age, health and a digest over the referenced E32 point slab.
+   A late result becomes explicit health state.
+6. The runtime samples process CPU and RSS plus GPU board visibility,
+   utilization and memory. GPU board values are node-level observations and
+   may include co-tenant workloads; they are not process-level attribution to
+   the E33 publication stage.
+7. The immutable identity binds both the expected physical worker node and the
+   container hostname. A correct container on an unexpected node fails closed.
+8. The Windows wrapper admits only a real `D:` package/output directory,
+   enforces a 300 GiB free-space floor, verifies the pinned container image,
+   disables networking, uses a read-only filesystem, drops capabilities and
+   publishes only one atomically completed result directory.
+9. E33 is diagnostic/shadow only. Commands, navigation and safety acceptance
+   remain false. No persistent reconstruction or source artifact is modified.
+
+## Accepted result
+
+Package:
+`e33-worker-package-c8609151e71a35b3be3857aef168c0fe98380ff9055ce37560233bb332508823`.
+
+Result:
+`e33-worker-shadow-05cc0bb264410fd49536df90e94067ac39731aff0322a8873700d40008a8bb3a`.
+
+Runtime:
+
+- physical worker: `DESKTOP-OPJ8J04`;
+- container hostname: `ebca59deeafd`;
+- image:
+  `nvcr.io/nvidia/tritonserver:26.06-py3@sha256:58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794`;
+- source span: `448.623 s`;
+- replay wall time: `448.687 s`;
+- wall/source ratio: `1.000142`;
+- effective delivery rate: `10.0062 FPS`.
+
+Accounting and timing:
+
+- 4,489 / 4,489 frames delivered;
+- zero input replacements, result replacements and deadline misses;
+- work/result queue maximum depth `2/2`;
+- release lag p50/p95/max:
+  `0.075 / 0.462 / 8.594 ms`;
+- processing p50/p95/max:
+  `0.174 / 0.750 / 7.698 ms`;
+- result age p50/p95/max:
+  `0.468 / 2.668 / 13.638 ms`;
+- process RSS p50/p95/max:
+  `79.28 / 90.33 / 92.34 MiB`.
+
+All 13 predeclared acceptance requirements pass. The independently copied
+result archive has SHA-256
+`9336f8df72ed43c2b46c68c544400db2fda52cf22f7ed8520d23fa0a9fc21081`.
+
+## Consequences
+
+- A7 is complete for the final TrackGeometry worker publication stage.
+- E33 proves source-paced bounded execution and closed accounting for this
+  exact source, profile, package, worker and container identity. It does not
+  independently requalify the already accepted upstream model-inference
+  stages.
+- An earlier accepted runtime result without a physical worker-node binding is
+  retained as historical evidence and is not the accepted A7 result.
+- E34 may consume the accepted E32 evidence under the E33 timing/accounting
+  envelope to build a separate short-TTL occupied/unknown layer.
+- E35 must still prove deterministic degradation and recovery. E33 does not
+  establish second-source transfer, free space, traversability or control.