v1.110 — three-way fail-safe campaigns (validate the safety net)

[avrabe]

Dispersion campaigns for the fail-safes themselves

v1.109 dispersed the nominal recovery behaviors. This extends the discipline to the fail-safes, with the three-way envelope classification the research note called for: inside the recoverable set no fail-safe fires (no false positive), and outside it the correct fail-safe (terminate vs RTL) fires and latches.

Where the point-tests prove ONE condition each, these sweep the regime and validate both halves — "fires when it must" AND "never false-fires". A one-sided pass (a detector wired always-on or always-off) trips the well-sampled assertion.

Each trial drives the full production FlightSupervisor (real IEKF + geometric controller + mixer + FSM) via a tilt-injecting backend — the exact mechanism of the existing point-tests.

crates/falcon-core mod failsafe_campaign — both pass, both regimes sampled

campaign	fires-when-must	never-false-fires
failsafe_runaway_terminate_campaign	tilt ∈ (1.15, 1.50) rad > TILT_RUNAWAY_LIMIT → Terminated + latched	tilt ∈ [0, 0.95] → never terminates (RTL via wind path ≠ false terminate)
failsafe_wind_rtl_campaign	tilt ∈ [0.38, 0.62] (in saturation band) away from home → rtl_latched	tilt ∈ [0, 0.20] (below band) → never latches RTL

Reproducible from (seed, index); both regimes well-sampled (≈60 each) so the pass is genuinely two-sided.

Honest scope

These are deterministic tilt sweeps for now (60/regime densely covers the 1-D range; the injected tilt is exact). Adding gyro/accel noise + bias walk + gust profiles — the full stochastic dispersion vector, at which point trial counts rise to rule-of-three ~1000/behavior — is the next slice.

Discipline notes

• no_std crate: assertions use core panic formatting (no Vec/String/format!/eprintln!) — the index+tilt+mode is the reproducer.
• Runtime trimmed to ~65 s (full-estimator trials are expensive; FlightSupervisor isn't Clone, so no converge-once shortcut).
• Named gate: ci.yml "Closed-loop simulation" job now also runs cargo test -p falcon-core failsafe.

rivet validate PASS. FV-FALCON-SIMMC-002 verifies RUNAWAY-P01 / WINDFS-P01.

🤖 Generated with Claude Code