83 lines
4.2 KiB
Markdown
83 lines
4.2 KiB
Markdown
# ADR 0028 — E35 deterministic degradation and recovery
|
||
|
||
Date: 2026-07-27
|
||
|
||
Status: accepted and executed
|
||
|
||
## Context
|
||
|
||
E32 fixes camera-owned semantic identity and exclusive map-frame point
|
||
ownership over all 4,489 immutable RAVNOVES00 frames. E33 proves bounded
|
||
recorded-source-paced delivery. E34 adds a separate hit-only temporal layer
|
||
with explicit `current/occupied`, `held/unknown` and `expired/unknown` state.
|
||
|
||
Those nominal results do not yet prove that the composed pipeline fails safely
|
||
when camera, LiDAR, pose or delivery timing degrades. A fault must not retain a
|
||
semantic or metric claim that its required evidence no longer supports. It
|
||
must also not turn missing data into free space or reintroduce a stale result
|
||
after the fault window.
|
||
|
||
## Predeclared decision
|
||
|
||
1. E35 derives six immutable variants from the exact accepted E32/E33/E34
|
||
chain. It never mutates the source or any accepted upstream result.
|
||
2. Each variant replays all 4,489 source frames. One bounded, non-overlapping
|
||
interval carries exactly one deterministic transformation:
|
||
camera loss, LiDAR loss, pose staleness, delayed frames, bounded frame drops
|
||
or camera↔LiDAR timing offset.
|
||
3. Camera loss removes camera observations. Current metric point ownership is
|
||
retained only as unknown-class `geometry-only`; E35 cannot preserve or
|
||
invent semantic class.
|
||
4. LiDAR loss retains camera identity as `camera-only` but removes current
|
||
metric rows. Prior occupied evidence may age through the E34 held/expired
|
||
contract, but no new occupied or free cells may be created.
|
||
5. Pose age of `0.5 s` exceeds the accepted `0.1 s` binding gate. Map-frame
|
||
points are therefore withheld and camera claims remain non-metric.
|
||
6. A deterministic `1.0 s` delivery delay exceeds the `0.75 s` occupied TTL.
|
||
Delayed results are explicitly discarded and may not re-enter after their
|
||
logical deadline.
|
||
7. The bounded-drop variant drops every third frame in its 60-frame interval.
|
||
Every drop is journalled; intervening frames remain ordered and the layer
|
||
exposes held/expired uncertainty instead of silent continuity.
|
||
8. A `250 ms` camera↔LiDAR offset exceeds the admitted binding. Camera
|
||
observations and point-backed geometry are split into separate
|
||
`camera-only` and `geometry-only` evidence. The mismatched pair cannot
|
||
publish `agree`.
|
||
9. Every variant records one terminal outcome per source frame, every injected
|
||
transformation, layer-state transitions, current/held/expired counts,
|
||
excluded semantic/metric claims, recovery time and artifact digests.
|
||
10. Acceptance requires six complete 4,489-frame variants, exact unchanged
|
||
upstream artifacts, zero hidden success, zero false-free rows, zero
|
||
semantic claims during camera loss, zero metric rows during LiDAR or pose
|
||
loss, zero late-result reintroduction and explicit recovery no later than
|
||
`0.25 s` after the fault interval.
|
||
11. The E34 profile, TTL, association gates and bounds remain frozen. E35 may
|
||
vary only the declared source/channel transformation.
|
||
12. Persistent reconstruction, planner input, commands, navigation and safety
|
||
authority remain unavailable.
|
||
|
||
## Consequences
|
||
|
||
- A passed E35 closes A8 only as a source-scoped diagnostic/shadow
|
||
degradation contract.
|
||
- Safe degradation is represented as explicit loss of confidence and
|
||
capability, not as guessed class, extrapolated free space or a green
|
||
aggregate status.
|
||
- A failed scenario remains immutable evidence. Threshold relaxation or a new
|
||
transformation definition requires a new profile and result rather than
|
||
rewriting E35.
|
||
- E36 remains the first transfer/generalization gate and requires an eligible
|
||
second mounted real source with the frozen E32–E35 profile.
|
||
|
||
## Outcome
|
||
|
||
Immutable result:
|
||
`e35-degradation-recovery-82bdbd5c5bfde6d932737f077153c3a8472c993c343fcbe8a207c39bfa2a6288`.
|
||
|
||
All six variants replayed all 4,489 frames, producing 26,934 terminal outcomes
|
||
and 360 injection records. Maximum recovery was 0.102 s against the
|
||
predeclared 0.25 s gate. Hidden success, false-free rows, camera-less semantic
|
||
claims, LiDAR/pose-less metric rows, timing-mismatch `agree`, late-result
|
||
reintroduction and upstream mutations were all zero. E35 is accepted and A8
|
||
is closed; A9/E36 is next.
|