# ADR 0040: Dual-evidence replay threat boundary

Date: 2026-08-05
Status: accepted and implemented for M4.6

## Context

Historical camera-first experiments correctly kept camera semantics separate
from LiDAR metric support, but the phrase "camera-first" is not an acceptable
product threat architecture. The RAVNOVES00 camera detector visibly misses some
unclassified occupied structures, while camera proposals without qualified
LiDAR support cannot establish metric clearance. Making either sensor a gate for
the other would discard useful evidence.

The portable RAVNOVES00 recording also has no admitted measured vehicle body or
qualified LiDAR-to-body mount. A recorded threat experiment therefore needs an
explicit virtual geometry without weakening the physical rig contract in ADR
0035.

## Decision

Mission Core threat assessment consumes two independent evidence paths:

```text
camera proposals ---------------------> camera-only uncertainty
       |                                           |
       +---- optional association ----+            |
                                      v            v
LiDAR occupied geometry ----------> LocalObstacleMap ---> ThreatAssessment
```

Neither path is called first:

- camera publishes image-space object proposals and optional semantics;
- LiDAR publishes metric occupied components, including geometry with no class;
- association enriches evidence but is not an admission gate;
- current metric geometry may produce `threat` or `not-threat` from corridor
  geometry and bounded relative motion;
- camera-only, held, expired or otherwise incomplete evidence produces
  `unknown`, never a safe decision;
- semantic class, detector ID and persistent identity are excluded from the
  threat calculation.

M4.6 fixes a versioned replay hypothesis: body length `1.0 m`, width `0.6 m`,
nominal sensor height `1.25 m`, forward corridor `8 m`, rear margin `0.5 m`,
lateral clearance `0.2 m` and prediction horizon `5 s`. These values may be used
only with `replay-simulated` authority. They do not populate or qualify
`missioncore.rig-geometry/v1`, and they cannot support physical collision,
navigation, safety or actuation claims.

## Evidence and presentation

The accepted replay must publish immutable frame, fixture, report and visual
ledgers. Visual evidence uses the common LAB viewer and reusable renderers:

- full recorded camera video with synchronized proposal boxes;
- exact camera samples with metric range or explicit missing range;
- synchronized point cloud, occupied cells, virtual body and corridor in 3D and
  plan view;
- visible threat/not-threat/unknown and `replay-simulated` authority.

Visuals are an inspection surface, not ground truth. Independent object-centric
labels remain a separate gate.

## Consequences

- Unclassified concrete, vegetation or road furniture can remain visible to the
  metric path without inventing a semantic label.
- A camera detection cannot become safe merely because LiDAR support is absent.
- New detectors and LiDAR geometry providers may replace either side behind the
  existing contracts without changing the threat provider.
- Physical body/mount qualification and live acceptance remain intentional debt.
- ADR 0035 remains valid for ownership of semantics, metric support and physical
  rig qualification; this ADR supersedes camera-first wording for the canonical
  product decision graph.