feat(perception): qualify E35 degradation recovery

2026-07-27 17:53:59 +03:00
parent 621084fcd6
commit b894945344
21 changed files with 3985 additions and 17 deletions
@@ -0,0 +1,82 @@
+# ADR 0028 — E35 deterministic degradation and recovery
+
+Date: 2026-07-27
+
+Status: accepted and executed
+
+## Context
+
+E32 fixes camera-owned semantic identity and exclusive map-frame point
+ownership over all 4,489 immutable RAVNOVES00 frames. E33 proves bounded
+recorded-source-paced delivery. E34 adds a separate hit-only temporal layer
+with explicit `current/occupied`, `held/unknown` and `expired/unknown` state.
+
+Those nominal results do not yet prove that the composed pipeline fails safely
+when camera, LiDAR, pose or delivery timing degrades. A fault must not retain a
+semantic or metric claim that its required evidence no longer supports. It
+must also not turn missing data into free space or reintroduce a stale result
+after the fault window.
+
+## Predeclared decision
+
+1. E35 derives six immutable variants from the exact accepted E32/E33/E34
+   chain. It never mutates the source or any accepted upstream result.
+2. Each variant replays all 4,489 source frames. One bounded, non-overlapping
+   interval carries exactly one deterministic transformation:
+   camera loss, LiDAR loss, pose staleness, delayed frames, bounded frame drops
+   or camera↔LiDAR timing offset.
+3. Camera loss removes camera observations. Current metric point ownership is
+   retained only as unknown-class `geometry-only`; E35 cannot preserve or
+   invent semantic class.
+4. LiDAR loss retains camera identity as `camera-only` but removes current
+   metric rows. Prior occupied evidence may age through the E34 held/expired
+   contract, but no new occupied or free cells may be created.
+5. Pose age of `0.5 s` exceeds the accepted `0.1 s` binding gate. Map-frame
+   points are therefore withheld and camera claims remain non-metric.
+6. A deterministic `1.0 s` delivery delay exceeds the `0.75 s` occupied TTL.
+   Delayed results are explicitly discarded and may not re-enter after their
+   logical deadline.
+7. The bounded-drop variant drops every third frame in its 60-frame interval.
+   Every drop is journalled; intervening frames remain ordered and the layer
+   exposes held/expired uncertainty instead of silent continuity.
+8. A `250 ms` camera↔LiDAR offset exceeds the admitted binding. Camera
+   observations and point-backed geometry are split into separate
+   `camera-only` and `geometry-only` evidence. The mismatched pair cannot
+   publish `agree`.
+9. Every variant records one terminal outcome per source frame, every injected
+   transformation, layer-state transitions, current/held/expired counts,
+   excluded semantic/metric claims, recovery time and artifact digests.
+10. Acceptance requires six complete 4,489-frame variants, exact unchanged
+    upstream artifacts, zero hidden success, zero false-free rows, zero
+    semantic claims during camera loss, zero metric rows during LiDAR or pose
+    loss, zero late-result reintroduction and explicit recovery no later than
+    `0.25 s` after the fault interval.
+11. The E34 profile, TTL, association gates and bounds remain frozen. E35 may
+    vary only the declared source/channel transformation.
+12. Persistent reconstruction, planner input, commands, navigation and safety
+    authority remain unavailable.
+
+## Consequences
+
+- A passed E35 closes A8 only as a source-scoped diagnostic/shadow
+  degradation contract.
+- Safe degradation is represented as explicit loss of confidence and
+  capability, not as guessed class, extrapolated free space or a green
+  aggregate status.
+- A failed scenario remains immutable evidence. Threshold relaxation or a new
+  transformation definition requires a new profile and result rather than
+  rewriting E35.
+- E36 remains the first transfer/generalization gate and requires an eligible
+  second mounted real source with the frozen E32–E35 profile.
+
+## Outcome
+
+Immutable result:
+`e35-degradation-recovery-82bdbd5c5bfde6d932737f077153c3a8472c993c343fcbe8a207c39bfa2a6288`.
+
+All six variants replayed all 4,489 frames, producing 26,934 terminal outcomes
+and 360 injection records. Maximum recovery was 0.102 s against the
+predeclared 0.25 s gate. Hidden success, false-free rows, camera-less semantic
+claims, LiDAR/pose-less metric rows, timing-mismatch `agree`, late-result
+reintroduction and upstream mutations were all zero. E35 is accepted and A8
+is closed; A9/E36 is next.