NODEDC_MISSION_CORE/docs/adr/0028-e35-deterministic-degradation-and-recovery.md

ADR 0028 — E35 deterministic degradation and recovery

Date: 2026-07-27

Status: accepted and executed

Context

E32 fixes camera-owned semantic identity and exclusive map-frame point ownership over all 4,489 immutable RAVNOVES00 frames. E33 proves bounded recorded-source-paced delivery. E34 adds a separate hit-only temporal layer with explicit current/occupied, held/unknown and expired/unknown state.

Those nominal results do not yet prove that the composed pipeline fails safely when camera, LiDAR, pose or delivery timing degrades. A fault must not retain a semantic or metric claim that its required evidence no longer supports. It must also not turn missing data into free space or reintroduce a stale result after the fault window.

Predeclared decision

1. E35 derives six immutable variants from the exact accepted E32/E33/E34 chain. It never mutates the source or any accepted upstream result.
2. Each variant replays all 4,489 source frames. One bounded, non-overlapping interval carries exactly one deterministic transformation: camera loss, LiDAR loss, pose staleness, delayed frames, bounded frame drops or camera↔LiDAR timing offset.
3. Camera loss removes camera observations. Current metric point ownership is retained only as unknown-class geometry-only; E35 cannot preserve or invent semantic class.
4. LiDAR loss retains camera identity as camera-only but removes current metric rows. Prior occupied evidence may age through the E34 held/expired contract, but no new occupied or free cells may be created.
5. Pose age of 0.5 s exceeds the accepted 0.1 s binding gate. Map-frame points are therefore withheld and camera claims remain non-metric.
6. A deterministic 1.0 s delivery delay exceeds the 0.75 s occupied TTL. Delayed results are explicitly discarded and may not re-enter after their logical deadline.
7. The bounded-drop variant drops every third frame in its 60-frame interval. Every drop is journalled; intervening frames remain ordered and the layer exposes held/expired uncertainty instead of silent continuity.
8. A 250 ms camera↔LiDAR offset exceeds the admitted binding. Camera observations and point-backed geometry are split into separate camera-only and geometry-only evidence. The mismatched pair cannot publish agree.
9. Every variant records one terminal outcome per source frame, every injected transformation, layer-state transitions, current/held/expired counts, excluded semantic/metric claims, recovery time and artifact digests.
10. Acceptance requires six complete 4,489-frame variants, exact unchanged upstream artifacts, zero hidden success, zero false-free rows, zero semantic claims during camera loss, zero metric rows during LiDAR or pose loss, zero late-result reintroduction and explicit recovery no later than 0.25 s after the fault interval.
11. The E34 profile, TTL, association gates and bounds remain frozen. E35 may vary only the declared source/channel transformation.
12. Persistent reconstruction, planner input, commands, navigation and safety authority remain unavailable.

Consequences

• A passed E35 closes A8 only as a source-scoped diagnostic/shadow degradation contract.
• Safe degradation is represented as explicit loss of confidence and capability, not as guessed class, extrapolated free space or a green aggregate status.
• A failed scenario remains immutable evidence. Threshold relaxation or a new transformation definition requires a new profile and result rather than rewriting E35.
• E36 remains the first transfer/generalization gate and requires an eligible second mounted real source with the frozen E32–E35 profile.

Outcome

Immutable result: e35-degradation-recovery-82bdbd5c5bfde6d932737f077153c3a8472c993c343fcbe8a207c39bfa2a6288.

All six variants replayed all 4,489 frames, producing 26,934 terminal outcomes and 360 injection records. Maximum recovery was 0.102 s against the predeclared 0.25 s gate. Hidden success, false-free rows, camera-less semantic claims, LiDAR/pose-less metric rows, timing-mismatch agree, late-result reintroduction and upstream mutations were all zero. E35 is accepted and A8 is closed; A9/E36 is next.