plan: v1.115 rotor-out robustness + verification-fidelity follow-ups

artifacts/features/FEAT-FALCON-v1.115.yaml

@@ -0,0 +1,35 @@
+artifacts:
+  - id: FEAT-FALCON-v1.115
+    type: feature
+    title: "v1.115 — rotor-out robustness + verification-fidelity follow-ups"
+    status: proposed
+    release: falcon-v1.115.0
+    description: >
+      PROPOSED (release falcon-v1.115.0). The follow-ups surfaced by the v1.114
+      rotor-out work — where a parasitic-moment allocation flipped the vehicle
+      on the real plant despite being "verified" and dispersed over thousands of
+      Monte-Carlo trials, because the campaign and point-test both ran an
+      IDEALISED attitude-only sim (constant thrust, true-state feedback, no
+      estimator, no rotational drag). The lesson, now driving this release:
+      dispersion is breadth, not fidelity.
+
+      Scope:
+        - SWREQ-FALCON-FAULT-P03 — single-rotor-out FDI robustness under heavy
+          GNSS/gyro sensor noise (detection latency blew up in the dispersed
+          full-loop campaign at the heavier envelope). GitHub #255.
+        - SWREQ-FALCON-FAULT-P04 — supervisor-driven controlled landing after a
+          rotor loss (close the altitude scope the v1.114 campaign reports but
+          does not gate) + a clean gz confirmation run and the recordable
+          recovery video. GitHub #256.
+        - Verification-fidelity audit (GitHub #257): sweep the other
+          safety-behaviour campaigns/point-tests for the idealised-harness blind
+          spot and promote the safety-critical ones to full-production-loop
+          guards (the pattern v1.114 established with
+          run_fullloop_motor_out_campaign).
+
+      Builds on v1.114 (FV-FALCON-FAULT-003): the rank-3 allocation, the
+      full-loop recovery oracle, and the dispersed full-loop campaign.
+    tags: [falcon, fault-tolerance, rotor-loss, verification-fidelity, roadmap, v1.115, proposed]
+    links:
+      - type: implements
+        target: SYSREQ-FALCON-005

artifacts/swreq/SWREQ-FALCON-FAULT-P03.yaml

@@ -0,0 +1,34 @@
+artifacts:
+  - id: SWREQ-FALCON-FAULT-P03
+    type: sw-req
+    title: "FAULT-P03 — single-rotor-out FDI robustness under sensor noise"
+    status: proposed
+    release: falcon-v1.115.0
+    description: >
+      On loss of a single rotor the FDI shall isolate the failed rotor within
+      a bounded latency across the realistic GNSS/gyro sensor-noise envelope —
+      not only in the low-noise regime. The v1.114 dispersed full-loop campaign
+      (FV-FALCON-FAULT-003) showed the CUSUM FDI's detection latency blows up
+      under heavier noise (gps σ up to 0.3 m, gyro-white up to 0.02 rad/s):
+      isolation reached ~1882 steps in early trials and a few mis-isolated or
+      never isolated, because the near-level/low-rate detection gate
+      (tilt_cos > 0.90 && rate2 < 1.0) is pushed shut by noise on the rate.
+      v1.114 scoped its guard to a modest envelope (gps σ ≤ 0.12, gyro ≤ 0.006)
+      where detection is reliable (worst 5 steps); this requirement covers the
+      heavier regime — filter the effectiveness residual, adapt the gate, or add
+      hysteresis so the RECOVERY (already parasitic-free and non-flipping) is not
+      gated behind a delayed/missed isolation. Not a v1.114 regression
+      (pre-existing). GitHub: pulseengine/relay#255.
+    tags: [falcon, fault-tolerance, rotor-loss, fdi, robustness, sensor-noise, v1.115, proposed]
+    fields:
+      req-type: safety
+      priority: should
+      verification-criteria: >
+        Dispersed full-loop rotor-out campaign at the heavier envelope
+        (gps σ up to 0.3 m, gyro-white up to 0.02 rad/s): the FDI isolates the
+        CORRECT rotor within a bounded latency for the whole recoverable
+        envelope, with zero mis-isolation and zero missed isolation. Regression
+        bound on worst detection latency set just above the measured worst case.
+    links:
+      - type: derives-from
+        target: SYSREQ-FALCON-005

artifacts/swreq/SWREQ-FALCON-FAULT-P04.yaml

@@ -0,0 +1,33 @@
+artifacts:
+  - id: SWREQ-FALCON-FAULT-P04
+    type: sw-req
+    title: "FAULT-P04 — supervisor-driven controlled landing after single-rotor loss"
+    status: proposed
+    release: falcon-v1.115.0
+    description: >
+      On single-rotor loss the FlightSupervisor shall command LAND and bring the
+      vehicle down in a CONTROLLED descent to touchdown — bounded sink rate,
+      thrust axis kept upright, settled on the surface — managing the ALTITUDE
+      the reduced-attitude core (FAULT-P02) deliberately does not. Rationale: a
+      3-rotor quad is near neutrally-buoyant on this airframe (two rotors at max
+      thrust ≈ hover weight), so the bare FlightCore holds/drifts altitude rather
+      than descending; the v1.114 full-loop campaign therefore GUARDS attitude
+      (no flip, bounded spin) but only REPORTS altitude ("supervisor's LAND
+      job"). This requirement closes that scope with a supervisor-driven
+      full-loop rotor-out landing oracle/campaign, and pairs it with a clean gz
+      confirmation run + the recordable recovery video (the v1.114 gz run showed
+      the correct rank-3 allocation but a degenerate pose feed).
+      GitHub: pulseengine/relay#256.
+    tags: [falcon, fault-tolerance, rotor-loss, supervisor, landing, gz, v1.115, proposed]
+    fields:
+      req-type: safety
+      priority: should
+      verification-criteria: >
+        Supervisor-driven full-loop rotor-out oracle/campaign: an injected rotor
+        loss ⇒ the supervisor commands LAND, and the vehicle descends (net
+        altitude lost) at a bounded sink rate to an upright touchdown, thrust
+        axis within the FAULT-P02 tilt bound throughout. Plus a clean gz run
+        demonstrating the same on the higher-fidelity plant.
+    links:
+      - type: derives-from
+        target: SYSREQ-FALCON-005