# ADR 0028 — E35 deterministic degradation and recovery

Date: 2026-07-27

Status: accepted and executed

## Context

E32 fixes camera-owned semantic identity and exclusive map-frame point
ownership over all 4,489 immutable RAVNOVES00 frames. E33 proves bounded
recorded-source-paced delivery. E34 adds a separate hit-only temporal layer
with explicit `current/occupied`, `held/unknown` and `expired/unknown` state.

Those nominal results do not yet prove that the composed pipeline fails safely
when camera, LiDAR, pose or delivery timing degrades. A fault must not retain a
semantic or metric claim that its required evidence no longer supports. It
must also not turn missing data into free space or reintroduce a stale result
after the fault window.

## Predeclared decision

1. E35 derives six immutable variants from the exact accepted E32/E33/E34
   chain. It never mutates the source or any accepted upstream result.
2. Each variant replays all 4,489 source frames. One bounded, non-overlapping
   interval carries exactly one deterministic transformation:
   camera loss, LiDAR loss, pose staleness, delayed frames, bounded frame drops
   or camera↔LiDAR timing offset.
3. Camera loss removes camera observations. Current metric point ownership is
   retained only as unknown-class `geometry-only`; E35 cannot preserve or
   invent semantic class.
4. LiDAR loss retains camera identity as `camera-only` but removes current
   metric rows. Prior occupied evidence may age through the E34 held/expired
   contract, but no new occupied or free cells may be created.
5. Pose age of `0.5 s` exceeds the accepted `0.1 s` binding gate. Map-frame
   points are therefore withheld and camera claims remain non-metric.
6. A deterministic `1.0 s` delivery delay exceeds the `0.75 s` occupied TTL.
   Delayed results are explicitly discarded and may not re-enter after their
   logical deadline.
7. The bounded-drop variant drops every third frame in its 60-frame interval.
   Every drop is journalled; intervening frames remain ordered and the layer
   exposes held/expired uncertainty instead of silent continuity.
8. A `250 ms` camera↔LiDAR offset exceeds the admitted binding. Camera
   observations and point-backed geometry are split into separate
   `camera-only` and `geometry-only` evidence. The mismatched pair cannot
   publish `agree`.
9. Every variant records one terminal outcome per source frame, every injected
   transformation, layer-state transitions, current/held/expired counts,
   excluded semantic/metric claims, recovery time and artifact digests.
10. Acceptance requires six complete 4,489-frame variants, exact unchanged
    upstream artifacts, zero hidden success, zero false-free rows, zero
    semantic claims during camera loss, zero metric rows during LiDAR or pose
    loss, zero late-result reintroduction and explicit recovery no later than
    `0.25 s` after the fault interval.
11. The E34 profile, TTL, association gates and bounds remain frozen. E35 may
    vary only the declared source/channel transformation.
12. Persistent reconstruction, planner input, commands, navigation and safety
    authority remain unavailable.

## Consequences

- A passed E35 closes A8 only as a source-scoped diagnostic/shadow
  degradation contract.
- Safe degradation is represented as explicit loss of confidence and
  capability, not as guessed class, extrapolated free space or a green
  aggregate status.
- A failed scenario remains immutable evidence. Threshold relaxation or a new
  transformation definition requires a new profile and result rather than
  rewriting E35.
- E36 remains the first transfer/generalization gate and requires an eligible
  second mounted real source with the frozen E32–E35 profile.

## Outcome

Immutable result:
`e35-degradation-recovery-82bdbd5c5bfde6d932737f077153c3a8472c993c343fcbe8a207c39bfa2a6288`.

All six variants replayed all 4,489 frames, producing 26,934 terminal outcomes
and 360 injection records. Maximum recovery was 0.102 s against the
predeclared 0.25 s gate. Hidden success, false-free rows, camera-less semantic
claims, LiDAR/pose-less metric rows, timing-mismatch `agree`, late-result
reintroduction and upstream mutations were all zero. E35 is accepted and A8
is closed; A9/E36 is next.