NODEDC_MISSION_CORE/docs/adr/0040-dual-evidence-replay-threat-boundary.md

ADR 0040: Dual-evidence replay threat boundary

Date: 2026-08-05 Status: accepted and implemented for M4.6

Context

Historical camera-first experiments correctly kept camera semantics separate from LiDAR metric support, but the phrase "camera-first" is not an acceptable product threat architecture. The RAVNOVES00 camera detector visibly misses some unclassified occupied structures, while camera proposals without qualified LiDAR support cannot establish metric clearance. Making either sensor a gate for the other would discard useful evidence.

The portable RAVNOVES00 recording also has no admitted measured vehicle body or qualified LiDAR-to-body mount. A recorded threat experiment therefore needs an explicit virtual geometry without weakening the physical rig contract in ADR 0035.

Decision

Mission Core threat assessment consumes two independent evidence paths:

camera proposals ---------------------> camera-only uncertainty
       |                                           |
       +---- optional association ----+            |
                                      v            v
LiDAR occupied geometry ----------> LocalObstacleMap ---> ThreatAssessment

Neither path is called first:

• camera publishes image-space object proposals and optional semantics;
• LiDAR publishes metric occupied components, including geometry with no class;
• association enriches evidence but is not an admission gate;
• current metric geometry may produce threat or not-threat from corridor geometry and bounded relative motion;
• camera-only, held, expired or otherwise incomplete evidence produces unknown, never a safe decision;
• semantic class, detector ID and persistent identity are excluded from the threat calculation.

M4.6 fixes a versioned replay hypothesis: body length 1.0 m, width 0.6 m, nominal sensor height 1.25 m, forward corridor 8 m, rear margin 0.5 m, lateral clearance 0.2 m and prediction horizon 5 s. These values may be used only with replay-simulated authority. They do not populate or qualify missioncore.rig-geometry/v1, and they cannot support physical collision, navigation, safety or actuation claims.

Evidence and presentation

The accepted replay must publish immutable frame, fixture, report and visual ledgers. Visual evidence uses the common LAB viewer and reusable renderers:

• full recorded camera video with synchronized proposal boxes;
• exact camera samples with metric range or explicit missing range;
• synchronized point cloud, occupied cells, virtual body and corridor in 3D and plan view;
• visible threat/not-threat/unknown and replay-simulated authority.

Visuals are an inspection surface, not ground truth. Independent object-centric labels remain a separate gate.

Consequences

• Unclassified concrete, vegetation or road furniture can remain visible to the metric path without inventing a semantic label.
• A camera detection cannot become safe merely because LiDAR support is absent.
• New detectors and LiDAR geometry providers may replace either side behind the existing contracts without changing the threat provider.
• Physical body/mount qualification and live acceptance remain intentional debt.
• ADR 0035 remains valid for ownership of semantics, metric support and physical rig qualification; this ADR supersedes camera-first wording for the canonical product decision graph.