feat(perception): qualify E35 degradation recovery

docs/13_LIDAR_WORKER_PRODUCT_AND_ROADMAP.md

@@ -6,7 +6,8 @@ complete; full GOOSE and RELLIS qualification complete; L2.6d K1 replay
 local-surface temporal qualification, operator triage and prior-plane residual
 explainability implemented; L2.6e recorded-source-paced bounded shadow
 qualified; E28 complete worker replay accepted; E29 camera-first semantic and
-parallel geometry-only replay implemented; operator review and shadow gate next
+parallel geometry-only replay implemented; E30–E35 source-scoped qualification
+accepted; E36 transfer gate next
 Scope: passively received real-time K1 point/pose evidence, immutable replay and
 future live shadow processing
 Explicitly out of scope: K1 firmware modification, a new onboard exporter, new
@@ -693,11 +694,18 @@ source gap plus an incoherent nearest-neighbor jump detector; the fixed
 implementation uses an independent TTL deadline and coherent translation
 support without changing the frozen profile.
 
-Execution was strictly sequential through E34: E30 determined what E31 was
+E35 accepted immutable degradation result
+`e35-degradation-recovery-82bdbd5c5bfde6d932737f077153c3a8472c993c343fcbe8a207c39bfa2a6288`.
+Six deterministic variants each replay all `4,489` source frames and record
+`26,934` terminal outcomes plus `360` injection records. Maximum recovery is
+`0.102 s` against the frozen `0.25 s` gate. Hidden success, false-free rows,
+camera-less semantic claims, LiDAR/pose-less metric rows, timing-mismatch
+`agree`, late-result return and upstream mutation are all zero.
+
+Execution was strictly sequential through E35: E30 determined what E31 was
 allowed to change; E31 determined the E32 profile; E32 determined the E33
-runtime input; E32/E33 then bound the E34 layer. Exact accounting and the
-bounded nominal temporal layer are now closed, so E35 is the active critical
-path.
+runtime input; E32/E33 then bound the E34 layer; E32–E34 then bound E35.
+Exact nominal and degradation accounting are closed, so A8 is complete.
 E36 is the first generalization gate. A separate product decision follows:
 either keep the result as operator/shadow evidence, or start L5 occupied-space
 integration. No LAB in this cycle can enable navigation, commands or safety

docs/16_ARCHITECTURE_AUDIT_EXECUTION_ROADMAP.md

@@ -202,7 +202,14 @@ cells per component, and emits no free cells. Geometry-only re-association is
 independent `0.75 s` deadline and records the `0.283 s` worst source-gap
 materialization delay separately. The first immutable run remains a rejected
 artifact documenting the frame-clock and incoherent-jump implementation
-failures. E35 is now the critical path.
+failures. A8/E35 is complete in immutable result
+`e35-degradation-recovery-82bdbd5c5bfde6d932737f077153c3a8472c993c343fcbe8a207c39bfa2a6288`.
+Six deterministic variants each replay all 4,489 frames; the result records
+26,934 terminal outcomes and 360 injections. Maximum recovery is `0.102 s`
+against the `0.25 s` gate. Hidden success, false free-space, unsupported
+semantic/metric claims, timing-mismatch `agree`, late-result return and
+upstream changes are all zero. A0–A8 are closed. A9/E36 is now the critical
+path and requires an eligible second mounted real source.
 
 - [x] Reproduce all 4,489 immutable E29 frames with the exact frozen profile
   before applying E31/E30 changes.
@@ -224,7 +231,7 @@ failures. E35 is now the critical path.
   pinned container image; independently verify all result artifacts.
 - [x] Build E34 as a separate short-TTL occupied/unknown temporal layer over
   accepted E32/E33 evidence.
-- [ ] Run E35 deterministic degradation/recovery variants without changing
+- [x] Run E35 deterministic degradation/recovery variants without changing
   the immutable source or accepted E32/E33 results.
 
 ### A3 residual and human-exception policy

docs/adr/0028-e35-deterministic-degradation-and-recovery.md

@@ -0,0 +1,82 @@
+# ADR 0028 — E35 deterministic degradation and recovery
+
+Date: 2026-07-27
+
+Status: accepted and executed
+
+## Context
+
+E32 fixes camera-owned semantic identity and exclusive map-frame point
+ownership over all 4,489 immutable RAVNOVES00 frames. E33 proves bounded
+recorded-source-paced delivery. E34 adds a separate hit-only temporal layer
+with explicit `current/occupied`, `held/unknown` and `expired/unknown` state.
+
+Those nominal results do not yet prove that the composed pipeline fails safely
+when camera, LiDAR, pose or delivery timing degrades. A fault must not retain a
+semantic or metric claim that its required evidence no longer supports. It
+must also not turn missing data into free space or reintroduce a stale result
+after the fault window.
+
+## Predeclared decision
+
+1. E35 derives six immutable variants from the exact accepted E32/E33/E34
+   chain. It never mutates the source or any accepted upstream result.
+2. Each variant replays all 4,489 source frames. One bounded, non-overlapping
+   interval carries exactly one deterministic transformation:
+   camera loss, LiDAR loss, pose staleness, delayed frames, bounded frame drops
+   or camera↔LiDAR timing offset.
+3. Camera loss removes camera observations. Current metric point ownership is
+   retained only as unknown-class `geometry-only`; E35 cannot preserve or
+   invent semantic class.
+4. LiDAR loss retains camera identity as `camera-only` but removes current
+   metric rows. Prior occupied evidence may age through the E34 held/expired
+   contract, but no new occupied or free cells may be created.
+5. Pose age of `0.5 s` exceeds the accepted `0.1 s` binding gate. Map-frame
+   points are therefore withheld and camera claims remain non-metric.
+6. A deterministic `1.0 s` delivery delay exceeds the `0.75 s` occupied TTL.
+   Delayed results are explicitly discarded and may not re-enter after their
+   logical deadline.
+7. The bounded-drop variant drops every third frame in its 60-frame interval.
+   Every drop is journalled; intervening frames remain ordered and the layer
+   exposes held/expired uncertainty instead of silent continuity.
+8. A `250 ms` camera↔LiDAR offset exceeds the admitted binding. Camera
+   observations and point-backed geometry are split into separate
+   `camera-only` and `geometry-only` evidence. The mismatched pair cannot
+   publish `agree`.
+9. Every variant records one terminal outcome per source frame, every injected
+   transformation, layer-state transitions, current/held/expired counts,
+   excluded semantic/metric claims, recovery time and artifact digests.
+10. Acceptance requires six complete 4,489-frame variants, exact unchanged
+    upstream artifacts, zero hidden success, zero false-free rows, zero
+    semantic claims during camera loss, zero metric rows during LiDAR or pose
+    loss, zero late-result reintroduction and explicit recovery no later than
+    `0.25 s` after the fault interval.
+11. The E34 profile, TTL, association gates and bounds remain frozen. E35 may
+    vary only the declared source/channel transformation.
+12. Persistent reconstruction, planner input, commands, navigation and safety
+    authority remain unavailable.
+
+## Consequences
+
+- A passed E35 closes A8 only as a source-scoped diagnostic/shadow
+  degradation contract.
+- Safe degradation is represented as explicit loss of confidence and
+  capability, not as guessed class, extrapolated free space or a green
+  aggregate status.
+- A failed scenario remains immutable evidence. Threshold relaxation or a new
+  transformation definition requires a new profile and result rather than
+  rewriting E35.
+- E36 remains the first transfer/generalization gate and requires an eligible
+  second mounted real source with the frozen E32–E35 profile.
+
+## Outcome
+
+Immutable result:
+`e35-degradation-recovery-82bdbd5c5bfde6d932737f077153c3a8472c993c343fcbe8a207c39bfa2a6288`.
+
+All six variants replayed all 4,489 frames, producing 26,934 terminal outcomes
+and 360 injection records. Maximum recovery was 0.102 s against the
+predeclared 0.25 s gate. Hidden success, false-free rows, camera-less semantic
+claims, LiDAR/pose-less metric rows, timing-mismatch `agree`, late-result
+reintroduction and upstream mutations were all zero. E35 is accepted and A8
+is closed; A9/E36 is next.