Lesson 4.2.2 — Policy Layer

Week 35

Prerequisite lessons: 4.2.1 (perception stack integration), 4.1.3 (evaluation design and held-out test suites), 3.1.4 (VLA fine-tuning), 3.2.3 (planning with world models), 2.3.3 (contact-rich manipulation), 1.1.3 (PID, computed torque, trajectory tracking), 3.3.4 (safety and constraints on LLM outputs), 2.2.4 (offline-to-online fine-tuning).

Prior results used in this lesson. From 4.2.1: the perception contract’s five fields and the 95th percentile’s age. From 3.1.4: the VLA’s action chunk, the blind window $k/f$, and the decision conjunction. From 3.2.3: the receding-horizon planner, the execution length $E$, and the four safety checks. From 2.3.3: the impedance law, the force budget, and the residual RL’s clip $K_d \delta_{max}$. From 1.1.3: the computed-torque law and its error dynamics. From 3.3.4: the four-layer stack and the safe-action set. From 2.2.4: the Q-shield and its threshold. Each is restated at the point of use.

What this lesson hands forward. The four authorities, their transition protocol, the arbitration’s rules, and the per-tier attribution’s metric. Lesson 4.2.3 (the reasoning layer) supplies the goals the task authority consumes. Lesson 4.2.4 (safety and recovery) consumes the arbitration’s rules as the recovery’s basis. Module 4.3 uses the per-tier attribution as its diagnostic’s template. Module 4.4 defends the authority’s design against the attribution’s evidence.

The running case in one sentence. The running arm, gripper, eye-in-hand camera, table, cube, bin, divider, and three distractors are unchanged; the perception contract of 4.2.1 delivers the cube’s pose, and this lesson assembles the policy layer — the VLA, the planner, the impedance controller, and the shield — into a hierarchy that decides, at every moment, which of them is in charge.

§L.0 — Lesson map, objectives, and misconceptions

Observable outcomes. By the end of this lesson you can, without notes: (1) state the three tiers’ output spaces, cadences, and horizons; (2) compute the latency chain and identify the tier that breaks the control period first; (3) state the authority problem and why exactly one tier must be in charge at each moment; (4) name the four authorities and the trigger that activates each; (5) state the handoff’s protocol and the veto’s priority ordering; (6) write the residual RL’s composition and its clip’s force bound; (7) state the three arbitration’s rules and give a failure of each; (8) compute the per-tier attribution’s metric from a trace; (9) assemble the running case’s policy layer with its state machine and parameters; (10) write the register’s policy’s entries with residuals.

Misconception inventory.

Everything is self-contained. Where a prerequisite lesson is used, the result is restated at the point of use.

§L.0.5 — Retrieval warm-up

Q1. In 4.2.1, the perception contract’s freshness bound was 50 ms for the reasoning and 20 ms for the grasp. What does the grasp’s tighter bound imply for the policy layer’s cadence?

Answer. It implies that the grasp’s request must be served within 20 ms of its observation, and the policy layer’s handoff to the contact authority cannot wait for the next VLA inference; the layer must preempt on the grasp’s trigger. Used in §L.B.4 to set the handoff’s latency’s bound.

Q2. In 3.1.4, the decision conjunction required the offline lower bound, the safety gate, and the shadow deployment. Which of the three applies to the policy layer’s composition rather than to each tier?

Answer. The safety gate’s conjunction applies to the composition: the layer’s output is safe only if every tier’s output is safe, and the composition’s safety is the tiers’ safety’s conjunction. Used in §L.C.1 to define the arbitration’s priority.

Q3. In 3.2.3, the planner’s execution length $E$ was chosen from the planning latency and the control period, and the blind window was $E$ times the control period. What is the policy layer’s analogue of the planner’s blind window?

Answer. The VLA’s chunk’s blind window $k/f$, and the handoff’s latency adds to it; the layer’s total blind window is the sum of the chunk’s and the handoff’s, and the sum is the layer’s reactivity’s bound. Used in §L.B.4 to compute the handoff’s cost.

Q4. In 2.3.3, the residual RL’s action was $a = a_{base} + \pi_\theta(o)$ with a clip $K_d \delta_{max}$. What does the clip not bound?

Answer. It does not bound the interaction between the residual and the base’s dynamics: a residual that opposes the base’s trajectory can produce a force larger than $K_d \delta_{max}$ if the base is also driving, because the clip bounds the residual’s displacement, not the total motion’s force. Used in §L.C.3 to define the residual’s saturation’s signature.

Part A — The three tiers and the authority

§L.A.1 — The tiers and their output spaces

The policy layer is the composition of three control tiers, each operating at a different cadence and in a different output space. The tier’s definition has four fields: the output’s space, the cadence, the horizon, and the failure mode.

The task tier (the VLA). The 3.1.4 fine-tuned VLA consumes the perception contract’s poses and the instruction, and outputs an action chunk of $k$ 7-DoF end-effector deltas at 10 Hz. The chunk’s integral is the subgoal pose — the pose the VLA believes the end-effector should reach for the current sub-task. The horizon is the chunk’s $k/f$, typically 0.8 s. The failure mode is the semantic’s: the subgoal is the wrong object, the wrong bin, or the wrong branch.

The motion tier (the planner). The 3.2.3 receding-horizon planner consumes the subgoal and the perception’s obstacles, and outputs an action sequence of length $H$ at 10 Hz with execution length $E$. The horizon is $H$ times the control period, typically 1 s with $H = 10$ and $E = 3$. The failure mode is the geometric’s: the plan is infeasible — the subgoal is unreachable, the path is blocked, or the plan crosses the divider.

The control tier (the impedance controller). The 2.3.3 torque-level impedance controller consumes the trajectory’s setpoints and the 2.3.3 force budget, and outputs joint torques at 1 kHz. The horizon is the control period’s 1 ms. The failure mode is the dynamic’s: the force exceeds the budget, the contact is lost, or the tracking’s error exceeds the tolerance.

The three tiers’ output spaces are different — pose, trajectory, torque — and their cadences differ by a factor of 100. The composition’s job is the translation between the spaces and the synchronization between the cadences.

Self-explanation 1. Why is the translation between the tiers’ spaces a design decision rather than a mechanical conversion?

Answer. Because the translation is lossy: the task tier’s subgoal is a pose without a path, and the motion tier’s trajectory is a path with a timing the task tier did not specify. The translation must choose the missing information — the path’s shape and the timing — and the choice is the tier’s authority’s part.

§L.A.2 — The running case’s three tiers

The running case’s tiers with their numbers.

The task tier. The 3.1.4 fine-tuned OpenVLA-scale model, at 10 Hz with a chunk of $k = 8$ and a 0.8 s blind window. The subgoal’s pose’s accuracy is the 3.1.4 §L.D.1’s lower bound, and the semantic’s error’s rate is the 4.1.3 suite’s unseen-object’s rate.

The motion tier. The 3.2.3 CEM planner with $H = 10$, $N = 200$, $\rho = 0.1$, five iterations, and a 20 ms per iteration’s latency, so 100 ms per query. The execution length is $E = 3$, so 300 ms per re-plan. The plan’s clearance is the 2.3.2 1 cm margin, and the planner’s 3.2.3 §L.D.2’s four checks apply.

The control tier. The 2.3.3 §L.C.1’s impedance law with $K_d = 1000$ N/m and $B_d = 2\sqrt{K_d M_d}$, at 1 kHz. The force’s limit is the 2.3.3 20 N, and the standard grip is 5 N.

The safety stack. The 3.3.4 four-layer stack, with the physical layer’s 2.2.4 Q-shield at the 10th percentile and the 3.3.4 §L.C.3’s safe state’s fallback.

The latency chain.

The chain’s serial latency — from the perception’s request to the first torque — is the task tier’s 200 ms plus the motion tier’s 100 ms plus the control tier’s 1 ms plus the safety’s 5 ms, or 306 ms. The chain’s pipelined latency — once the tiers are running — is the slowest tier’s cadence, which is the task tier’s 200 ms; the motion and control tiers keep up with the task’s cadence.

§L.A.3 — The authority problem

The authority problem is the layer’s central design question: at each moment, which tier is in charge of the action that reaches the actuators?

The problem’s necessity comes from three properties of the tiers.

The output spaces conflict. The task tier’s subgoal is a pose, the motion tier’s trajectory is a path, and the control tier’s torques are forces. If two tiers are simultaneously commanding, their commands are in different spaces and their sum is undefined.

The cadences conflict. The control tier runs at 1 kHz, the motion tier at 10 Hz, and the task tier at 5 Hz. A naive parallel composition would have the control tier’s 1 kHz loop executing the motion tier’s 10 Hz output’s hold and the task tier’s 5 Hz output’s hold, and the holds’ timing’s mismatch is a source of jitter.

The failure modes differ. The task tier’s semantic failure is invisible to the motion tier, and the motion tier’s geometric failure is invisible to the control tier. If both tiers are simultaneously trusted, the failures are combined, and the combination’s failure modes are new.

The authority’s design is therefore exclusive: exactly one tier is the authority at each moment, and the other tiers are either idle, preparing, or vetoing. The transitions between the authorities are the layer’s design’s content.

Concept check. A learner proposes running the VLA and the planner in parallel, with the VLA’s subgoal and the planner’s trajectory blended by a weighted average. What fails?

Answer. The blend’s spaces conflict — the subgoal’s pose and the trajectory’s path are different objects — and the blend’s average is undefined; the weighted average is a category error, not a design. The mechanism is the output spaces’ conflict, and the authority’s exclusivity is the fix. [displaces M2]

Worked-example ladder.

WE-L.A.a (fully worked). The task tier’s 200 ms, the motion tier’s 100 ms, the control tier’s 1 ms, and the safety’s 5 ms. Compute the serial latency and the pipelined latency.

Solution. The serial is $200 + 100 + 1 + 5 = 306$ ms. The pipelined is the slowest tier’s cadence, 200 ms, because the motion and control tiers’ latencies are within the task tier’s cadence. The 306 ms is the cold start’s latency; the 200 ms is the steady state’s.

WE-L.A.b (completion). The task tier’s chunk is reduced from 8 to 4, halving the task tier’s blind window to 0.4 s. Recompute the pipelined latency and state the task tier’s new cadence’s constraint.

Completion. The task tier’s cadence is unchanged at 5 Hz — the chunk’s length affects the blind window, not the inference’s cadence. The pipelined latency is still 200 ms. The chunk’s reduction increases the inference’s frequency’s requirement if the policy’s latency is to be amortized; the 5 Hz’s cadence’s 200 ms is the latency’s number, and the chunk’s 4 is the blind window’s 0.4 s.

WE-L.A.c (faded). Compute the total blind window of the composition: the task’s chunk’s, the motion’s execution’s, and the handoff’s.

Faded step. The task’s is $k/f = 8/10 = 0.8$ s; the motion’s is $E$ times the control period $= 3/10 = 0.3$ s; the handoff’s is the transition’s latency, say 50 ms. The total is $0.8 + 0.3 + 0.05 = 1.15$ s.

Completion. The 1.15 s is the layer’s maximum time between the perception’s observation and the actuator’s response’s correction, and the 4.2.1 freshness’s 50 ms is the first tier’s bound, not the layer’s. The two are different quantities: the freshness is the pose’s age, and the blind window is the layer’s reactivity’s bound.

WE-L.A.d (contrastive near-miss). A team’s task tier outputs joint torques directly, so the motion and control tiers are “redundant”. The composition is a 1 kHz torque loop driven by a 5 Hz model’s outputs, and the arm’s tracking’s error is 4 cm. Why it fails: the task tier’s output’s space is torques, and the 5 Hz cadence cannot supply the 1 kHz loop’s setpoints; the “redundancy” was the tiers’ spaces’ mismatch, not the redundancy. The fix: the tiers’ spaces’ separation — task tier outputs a subgoal pose, motion tier a trajectory, control tier the torques.

Comparative table: the three tiers.

Design principle P54.1. The policy layer is a hierarchy of three tiers whose spaces and cadences differ; the authority’s exclusivity is the design’s premise, and the transitions are the layer’s content.

Consolidation checkpoint 1

(a) Three capabilities. You can state the three tiers’ output spaces, cadences, and horizons. You can compute the serial and pipelined latencies. You can state the authority’s exclusivity’s three reasons.

(b) Transfer probe. The task tier’s cadence falls to 2 Hz. What happens to the pipelined latency and the blind window? Answer: the pipelined latency rises to 500 ms, and the blind window rises to $k/f = 8/2 = 4$ s at the same chunk’s length; the layer’s reactivity falls and the motion tier’s cadence must absorb the task tier’s slower handoffs.

(c) Remediation rule. If you cannot state why the tiers’ blend is a category error, re-read §L.A.3 before Part B.

Part B — The four authorities

§L.B.1 — The authorities and their triggers

The authority is the tier (or the fallback) that is currently commanding the actuator. The four authorities are:

Task authority. The VLA’s subgoal drives; the motion and control tiers translate it into a trajectory and torques, but the goal is the VLA’s. The trigger is the free-space’s condition: the end-effector is more than 5 cm from any object’s surface and the VLA’s pose is within its training’s distribution’s support.

Motion authority. The planner’s trajectory drives to a subgoal the reasoning layer (4.2.3) supplied; the VLA is idle. The trigger is the clutter’s condition: the path’s clearance is below 5 cm, or the 3.2.3 planner’s collision’s check’s margin is within the 2.3.2’s.

Contact authority. The impedance controller’s force loop drives; the planner’s trajectory is the setpoint’s nominal, and the controller’s force’s limit is the 2.3.3 budget. The trigger is the contact’s condition: the 2.3.3 momentum observer’s residual exceeds the 4 Nm threshold.

Safe authority. The 3.3.4 §L.C.3’s fallback’s script drives; all other tiers are idle. The trigger is the failure’s condition: the 4.2.1 provenance’s absence, the 2.2.4 Q-shield’s rejection’s persistence, or the 3.3.4 §L.D.3’s rollback’s trigger.

The four authorities’ exclusivity is the layer’s state machine: exactly one is active, and the transitions are the triggers’ consequences.

§L.B.2 — The veto and the priority

The authority’s exclusivity does not mean the non-authorities are silent. The veto is the mechanism by which a non-authority can block the authority’s output, and the veto’s priority ordering is the layer’s safety’s structure.

The safety stack’s veto is the highest: any output the 3.3.4 stack rejects is replaced by the safe authority’s fallback, regardless of the authority’s identity.

The motion tier’s veto is the second: an authority’s output that is infeasible — the subgoal is unreachable, the trajectory crosses the divider — is rejected, and the authority’s output is replaced by the planner’s feasible plan to the same subgoal, or if no plan exists, by the safe authority.

The control tier’s veto is the third: a trajectory whose setpoint would exceed the 2.3.3 force limit is rejected, and the controller’s force loop saturates the trajectory’s command.

The task tier’s veto is the weakest, and it is a request: the VLA can propose a subgoal the motion tier’s plan finds difficult — the path is long, the clearance is tight — but the motion tier’s rejection is the decision. The task tier’s proposal’s difficulty is the layer’s inefficiency, not the safety’s.

The priority ordering is the safety-first, feasibility-second, efficiency-third’s ordering, and it is the 3.3.4 §L.B.2’s semantic layer’s check’s extension to the composition.

Self-explanation 2. Why is the task tier’s veto the weakest rather than the strongest?

Answer. Because the task tier’s output’s error is the semantic’s — the wrong subgoal — and the semantic’s check is the reasoning layer’s (4.2.3), not the policy layer’s; the task tier’s proposal’s difficulty is the efficiency’s cost, and the efficiency is the weakest priority because it is the only one whose failure is recoverable by a slower plan.

§L.B.3 — The transitions and the handoff’s protocol

The handoff is the transition between two authorities, and its protocol has four steps.

Step 1: the trigger’s evaluation. The authority’s state’s machine evaluates the triggers at every control cycle, and a trigger’s rising edge is the transition’s request.

Step 2: the outgoing authority’s confirmation. The outgoing authority confirms it is ready — the VLA’s chunk is complete, the planner’s trajectory is at a stable’s point — and if not, the transition waits or the incoming authority’s trigger’s urgency overrides the wait.

Step 3: the incoming authority’s preparation. The incoming authority prepares its output — the planner’s query’s cold start’s 306 ms, the controller’s force loop’s settling’s 50 ms — and the preparation’s latency is the handoff’s cost.

Step 4: the authority’s switch. The switch’s instant is the boundary, and the actuator’s command’s continuity is the switch’s requirement: the outgoing’s last setpoint and the incoming’s first setpoint must be within the tracking’s tolerance, or the switch’s discontinuity is a force’s spike.

The protocol’s urgency’s rule is the exception’s: the safe authority’s trigger is always urgent, and its switch overrides the outgoing’s confirmation. The other authorities’ triggers are not urgent, and the transition waits for the outgoing’s stable point.

The handoff’s cost is the preparation’s latency plus the switch’s discontinuity’s correction. For the running case’s task-to-motion handoff, the preparation is the planner’s 100 ms query’s cold start, and the switch’s discontinuity is the VLA’s chunk’s last setpoint’s difference from the planner’s first, typically under 5 mm.

§L.B.4 — The handoff’s latency and the blind window

The handoff’s latency is the layer’s reactivity’s cost, and it adds to the tiers’ blind windows.

The layer’s total blind window is

where the first term is the VLA’s chunk’s, the second the planner’s execution’s, and the third the handoff’s preparation’s. For the running case, $0.8 + 0.3 + 0.1 = 1.2$ s. The layer’s reactivity’s bound is the 1.2 s, and the 4.2.1 freshness’s 50 ms is the first tier’s bound, not the layer’s.

The urgency’s override is the mechanism that shortens the blind window at the safety’s trigger: the safe authority’s switch does not wait for the outgoing’s confirmation, and its preparation’s latency is the 3.3.4 §L.C.3’s fallback’s 2 s script’s start — the first action’s latency, typically 5 ms. The urgency’s override’s total is 5 ms, and it is the layer’s safety’s reactivity’s bound, distinct from the layer’s normal reactivity’s bound.

The handoff’s trigger’s threshold is the design’s key number. The task-to-motion handoff’s trigger is the end-effector’s distance to the nearest object’s surface, and the threshold is set so that the planner’s preparation completes before the contact. The distance’s rate is the end-effector’s speed’s 10 cm/s, and the preparation’s 100 ms gives the threshold $10 \times 0.1 = 1$ cm plus the margin’s 5 cm, so 6 cm. The threshold’s premature fire is the efficiency’s cost — the planner’s plan for a reach the VLA could have done — and the late fire is the safety’s cost — the planner’s preparation does not complete before the contact.

Self-explanation 3. Why is the threshold’s premature fire a cost rather than a failure?

Answer. Because the planner’s plan is feasible and safe; the cost is that the layer used the slower tier for a task the faster tier could have done, which is the efficiency’s cost. The late fire, by contrast, is a safety’s cost: the contact begins before the planner’s preparation completes, and the contact authority’s switch’s discontinuity is a force’s spike.

Concept check. The task-to-motion handoff’s threshold is 6 cm and the end-effector’s speed rises to 20 cm/s. What happens, and what is the fix?

Answer. The preparation’s 100 ms at 20 cm/s travels 2 cm, so the end-effector reaches the 5 cm surface in $5/20 = 250$ ms; the preparation’s 100 ms completes, and the handoff is still safe. But the trigger’s distance’s 6 cm at 20 cm/s gives 300 ms, and the handoff’s premature fire is earlier than necessary. The fix is the threshold’s re-computation from the speed and the preparation’s latency: $20 \times 0.1 = 2$ cm plus 5 cm margin = 7 cm, so the threshold rises to 7 cm.

Worked-example ladder.

WE-L.B.a (fully worked). The task-to-motion handoff’s preparation is 100 ms, the end-effector’s speed is 10 cm/s, and the surface’s distance’s margin is 5 cm. Compute the threshold and state whether a threshold of 6 cm is adequate.

Solution. The preparation’s travel is $10 \times 0.1 = 1$ cm; the threshold is $1 + 5 = 6$ cm. The 6 cm threshold is adequate at 10 cm/s, with no margin. At 15 cm/s, the preparation’s travel is 1.5 cm, and the 6 cm threshold’s remaining distance is 4.5 cm, which is within the 5 cm margin’s — the handoff completes with 0.5 cm to spare.

WE-L.B.b (completion). The planner’s query’s latency rises to 150 ms. Recompute the threshold at 10 cm/s.

Completion. The preparation’s travel is $10 \times 0.15 = 1.5$ cm; the threshold is $1.5 + 5 = 6.5$ cm. The threshold rises by 0.5 cm, and the premature fire’s cost rises proportionally.

WE-L.B.c (faded). Compute the urgency’s override’s total and state the layer’s safety’s reactivity’s bound.

Faded step. The safe authority’s preparation is the fallback’s first action’s 5 ms, and the override’s switch is immediate; the total is 5 ms.

Completion. The 5 ms is the safety’s reactivity’s bound, and it is the 3.3.4 §L.D.2’s four checks’ latency plus the fallback’s first action’s. The normal’s 1.2 s is the efficiency’s, and the two are different quantities.

WE-L.B.d (contrastive near-miss). A team’s task-to-motion handoff fires at 2 cm from the surface, and the contact’s force’s spike is 40 N on 30% of episodes. Why it fails: the 2 cm threshold is below the preparation’s travel’s 1 cm plus the margin’s 5 cm, so the planner’s preparation does not complete before the contact; the contact authority’s switch’s discontinuity is the force’s spike. The fix: the threshold’s re-computation, per WE-L.B.a.

Comparative table: the four authorities.

Design principle P54.2. The authorities are exclusive and the veto’s priority is safety-first; the handoff’s threshold is the layer’s efficiency’s and safety’s trade, and its computation is the preparation’s travel plus the margin.

Consolidation checkpoint 2

(a) Three capabilities. You can name the four authorities and their triggers. You can state the veto’s priority ordering. You can compute the handoff’s threshold from the preparation’s travel and the margin.

(b) Transfer probe. The contact authority’s trigger is the force’s residual’s 4 Nm, and the residual’s noise’s variance is 2 Nm. Is the threshold sound? Answer: the 4 Nm is a two-sigma’s threshold, which fires on 2.5% of nominal cycles; the threshold should rise to 6 Nm (three sigma) or the residual’s filter’s variance should fall.

(c) Remediation rule. If you cannot state why the urgency’s override is the safety’s and not the efficiency’s, re-read §L.B.3 before Part C.

Part C — The residual and the arbitration

§L.C.1 — The residual’s place

The 2.3.3 residual RL is the layer’s fourth component, and its place is the composition’s correction: the residual is added to the authority’s output, with the clip’s force bound.

The residual’s form.

The clip’s force bound is $K_d \delta_{max} = 20$ N at $K_d = 1000$ N/m and $\delta_{max} = 2$ cm. The residual’s purpose is the authority’s bias’s correction: the VLA’s subgoal’s error, the planner’s model’s error, or the controller’s steady-state’s error, each of which the residual’s training’s data covers.

The residual’s risk is the interaction’s: the residual’s clip bounds the residual’s displacement, not the total action’s. A residual that opposes the authority’s motion produces a total force that is the authority’s force plus the residual’s force, and the sum can exceed the 20 N bound if the authority is also driving at its bound.

§L.C.2 — The residual’s composition’s arithmetic

The total force’s bound is

and the worst case is the sum’s bound, $F_{authority} + F_{residual}$, not the residual’s alone. The residual’s clip’s $F_{safe}$ is therefore the residual’s allowance, and the authority’s allowance is separate.

The composition’s design is the authority’s allowance’s and the residual’s allowance’s split. The running case’s split: the authority’s 15 N and the residual’s 5 N, so the worst case is 20 N. The split’s choice is the 2.3.3 §L.D.2’s clip’s design’s, and the residual’s training’s data is the split’s tuning’s source.

The residual’s saturation is the clip’s active condition, and its signature is the residual’s output’s magnitude at $\delta_{max}$. A saturated residual is the authority’s error’s large — the residual’s clip is trying to correct more than its allowance — and the fix is either the authority’s re-tuning or the residual’s re-training.

§L.C.3 — The arbitration’s three rules

The arbitration is the layer’s rule for resolving a disagreement between the authority and a vetoing tier, and it has three rules.

Rule 1: the safety’s veto is unconditional. A 3.3.4 stack rejection replaces the action with the safe authority’s fallback; no other rule applies.

Rule 2: the feasibility’s veto is conditional on the alternative’s existence. A motion tier’s rejection of the authority’s output is resolved by the planner’s plan to the same subgoal if one exists; if no plan exists, the subgoal is infeasible, and the authority’s subgoal is replaced by the safe authority’s abstain or the reasoning layer’s re-query.

Rule 3: the residual’s disagreement with the authority is resolved by the trace’s attribution. The residual’s output and the authority’s output are not averaged; the residual is the correction, and its disagreement is the authority’s error’s estimate. The disagreement’s magnitude’s attribution — the VLA’s semantic’s error, the planner’s model’s error, or the controller’s dynamic’s error — is the 4.2.2 §L.D.1’s metric’s source.

The three rules’ priority is the ordering. The safety’s unconditional’s rule dominates the feasibility’s conditional’s rule, and the feasibility’s conditional’s rule dominates the residual’s attribution’s rule.

§L.C.4 — The composition’s stability

The composition’s stability is the layer’s dynamics’ property: a residual’s correction and the authority’s response form a loop, and the loop’s stability is the residual’s clip’s and the authority’s gain’s joint design’s.

The loop’s mechanism. The residual corrects the authority’s output; the authority’s next output is a function of the corrected state; the residual’s next correction is a function of the new state. The loop’s gain is the residual’s sensitivity times the authority’s sensitivity, and the loop’s stability is the gain’s magnitude’s below one.

The loop’s failure’s signature. A residual that is too aggressive — the clip’s $\delta_{max}$ is large and the residual’s policy is high-gain — produces an oscillation whose frequency is the layer’s cadence’s fraction. A residual that is too passive produces no correction, and the authority’s error persists.

The running case’s design. The residual’s gain is the 2.3.3 §L.C.1’s impedance’s $K_d$‘s fraction, and the residual’s clip’s $\delta_{max}$‘s 2 cm is the total’s 20 N at the authority’s 15 N’s split. The loop’s stability is checked at the 4.2.2 §L.E.2’s replay, and the oscillation’s absence is the acceptance’s criterion.

Self-explanation 1. Why is the residual’s clip’s force bound the residual’s allowance rather than the total’s?

Answer. Because the clip bounds the residual’s displacement, and the total force is the authority’s plus the residual’s; the total’s bound is the sum’s, and the residual’s allowance is the total’s minus the authority’s.

Concept check. The residual’s clip is 2 cm and the authority’s output is at its 15 N allowance; the residual’s output is 2 cm. What is the total force, and is it within the 20 N limit?

Answer. The total is $1000 \times (0.015 + 0.02) = 35$ N, above the 20 N limit. The clip bounds the residual’s displacement, not the total’s; the authority’s allowance and the residual’s allowance must sum to the limit, and the running case’s split is 15 + 5, not 15 + 20. [displaces M4]

Worked-example ladder.

WE-L.C.a (fully worked). The authority’s force is 12 N, the residual’s clip is 2 cm with $K_d = 1000$ N/m, so the residual’s maximum force is 20 N. Compute the total’s worst case and state the split’s necessity.

Solution. The worst case is $12 + 20 = 32$ N, above the 20 N limit by 12 N. The split’s necessity is that the residual’s clip’s 2 cm is not the residual’s allowance; the allowance is the limit minus the authority’s, and the clip’s $\delta_{max}$ must be set to that allowance divided by $K_d$.

WE-L.C.b (completion). The authority’s 15 N and the limit’s 20 N leave 5 N for the residual; compute the residual’s clip’s $\delta_{max}$.

Completion. $\delta_{max} = 5/1000 = 0.005$ m = 5 mm. The clip is 5 mm, not 2 cm; the 2 cm clip was the unconstrained residual’s, and the constrained is 5 mm.

WE-L.C.c (faded). Derive the loop’s gain’s condition from the residual’s sensitivity and the authority’s sensitivity, and state the oscillation’s frequency.

Faded step. The loop’s gain is $g = \partial a_{residual}/\partial s \times \partial s/\partial a_{authority}$; the stability’s condition is $|g| < 1$; the oscillation’s frequency is the layer’s cadence’s 1/4 at the gain’s 0.9.

Completion. The 1/4’s frequency is the loop’s quarter-cycle’s oscillation, which is the 3.4.4 §L.D.3’s oscillation’s signature at the composition’s level.

WE-L.C.d (contrastive near-miss). A residual trained with a 2 cm clip fights the VLA’s chunk’s motion, and the arm oscillates at 2.5 Hz. Why it fails: the residual’s 2 cm clip is the unconstrained’s, and the total force exceeds the limit; the controller’s saturation’s nonlinearity is the oscillation’s source. The fix: the split’s computation, per WE-L.C.b, and the residual’s re-training at the 5 mm clip.

Comparative table: the arbitration’s rules.

Design principle P54.3. Split the authority’s allowance from the residual’s and arbitrate by the safety-first’s priority; the clip bounds the residual’s displacement, and the total’s force is the sum’s.

Consolidation checkpoint 3

(a) Three capabilities. You can state the residual’s form and its clip’s force bound. You can compute the split’s $\delta_{max}$ from the authority’s force. You can state the three arbitration’s rules.

(b) Transfer probe. The authority’s force is 18 N and the limit is 20 N. What is the residual’s clip’s $\delta_{max}$ at $K_d = 1000$? Answer: the residual’s allowance is 2 N, so $\delta_{max} = 2/1000 = 2$ mm; the residual’s correction is small, and its training’s data must be re-tuned for the smaller range.

(c) Remediation rule. If you cannot state why the total’s force is the sum’s, re-read §L.C.2 before Part D.

Part D — The metrics and the attribution

§L.D.1 — The per-tier attribution

A failure’s attribution is the tier whose output’s error exceeded its tolerance first, and the attribution is the layer’s diagnostic’s core.

The attribution’s procedure.

Step 1: the trace’s replay. The trace’s entries are the tiers’ outputs at each cycle, with the perception’s inputs.

Step 2: the tolerance’s check. Each entry’s output is compared to its tolerance — the task tier’s pose’s tolerance, the motion tier’s clearance’s, the control tier’s force’s. The first entry whose tolerance is exceeded is the attribution’s candidate.

Step 3: the causal’s confirmation. The candidate’s error is propagated forward through the tiers’ models, and if the propagated error explains the final failure’s magnitude, the candidate is the attribution; if not, the next entry’s tolerance’s check is examined.

The procedure’s principle: the attribution is the earliest tier whose error exceeded its tolerance and whose propagation explains the failure, not the last tier whose output was executed.

§L.D.2 — The authority’s metrics

The layer’s metrics are the authority’s and the composition’s.

The authority’s dwell time. The fraction of the episode’s duration in each authority. A healthy episode’s dwell is the task’s 60–70%, the motion’s 20–30%, the contact’s 5–10%, and the safe’s 0%.

The handoff’s rate. The handoffs per episode. A healthy rate is the task’s 2–4 per episode — the approach, the grasp, the transport, the place — and a rate above the 6 is the oscillation’s signature: the triggers fire back and forth.

The handoff’s success rate. The fraction of handoffs whose switch’s discontinuity is below the tracking’s tolerance. A healthy rate is 0.95; below 0.90 is the threshold’s mis-setting’s signature.

The disagreement’s rate. The fraction of cycles where the residual’s output’s magnitude exceeds the half’s clip. A healthy rate is below 0.10; above 0.25 is the authority’s error’s large’s signature.

The fallback’s rate. The fraction of episodes where the safe authority is activated. A healthy rate is 0; above 0.02 is the safety’s concern.

The attribution’s distribution. The failures’ attribution across the four tiers. A healthy distribution has no dominant tier; a distribution concentrated in one tier is the tier’s tuning’s signal.

§L.D.3 — The evidence’s table

The layer’s evidence is the 4.1.3 suite’s replay’s metrics’ table.

The table’s values are the suite’s replay’s numbers, and the acceptance is the bounds’ conjunction. A suite’s value outside a bound is the layer’s failure’s evidence, and the attribution’s distribution is the failure’s localization.

The evidence’s completeness is the 4.2.1 §L.E.2’s checks’ statistics’ plus the layer’s metrics’. The 4.2.1 checks are the perception’s evidence; the layer’s metrics are the composition’s. The two are the 4.1.1 §L.A.2’s integration’s property’s evidence, and the 4.1.3 suite’s replay is the measurement’s protocol.

Self-explanation 2. Why is the attribution’s distribution a diagnostic rather than a score?

Answer. Because the distribution’s concentration is the tier’s tuning’s signal, not the composition’s quality’s; a distribution concentrated in the motion tier is a planner’s model’s error, and a distribution in the task tier is the VLA’s semantics. The distribution’s absence of concentration is the healthy state, and the concentration’s degree is the tuning’s priority.

Concept check. The suite’s handoff’s success is 0.87 and the disagreement’s rate is 0.15. Which metric’s bound is violated first, and what is the fix?

Answer. The handoff’s success’s 0.87 is below the 0.95 bound, and the disagreement’s 0.15 is above the 0.10 bound; both are violated. The handoff’s fix is the threshold’s re-computation, and the disagreement’s fix is the authority’s re-tuning or the residual’s re-training; the two are separate, and the handoff’s is the priority because it is the composition’s stability’s.

Worked-example ladder.

WE-L.D.a (fully worked). A trace’s task tier’s subgoal is 2 cm off the cube, the motion tier’s plan’s clearance is 0.5 cm, and the contact tier’s force is 22 N. The final failure is the collision. Attribute the failure.

Solution. The task tier’s 2 cm is the subgoal’s pose’s error; the 3.1.4 tolerance is 1 cm, so the task tier’s error exceeds its tolerance. The motion tier’s 0.5 cm is within the 2.3.2 1 cm clearance; its error does not exceed. The contact tier’s 22 N exceeds the 20 N’s limit, but the force’s violation is the final failure’s, not the earliest’s. The attribution is the task tier’s, because its error is the earliest’s and the propagated error explains the collision.

WE-L.D.b (completion). The task tier’s subgoal is 0.8 cm off, the motion tier’s clearance is 0.3 cm, and the contact’s force is 21 N. Re-attribute.

Completion. The task tier’s 0.8 cm is within the 1 cm’s tolerance; the motion tier’s 0.3 cm is within the 1 cm’s; the contact’s 21 N exceeds the 20 N’s, but the force’s violation is the dynamic’s, and the force’s tolerance is the 2.3.3 budget’s. The attribution is the contact tier’s, because its error is the first to exceed its tolerance and the propagated error explains the failure.

WE-L.D.c (faded). Design the attribution’s procedure for a trace where two tiers’ tolerances are exceeded simultaneously.

Faded step. The earliest’s error is the attribution’s candidate; if the propagation from the earliest does not explain the failure, the next’s is examined; if both are exceeded and both explain, the safety’s priority’s tier is the attribution.

Completion. The procedure’s principle is the earliest’s error’s, and the tie’s rule is the safety’s priority.

WE-L.D.d (contrastive near-miss). A team attributes every failure to the VLA because the VLA is the “policy’s head”, and the motion tier’s plan’s errors are attributed to the VLA’s subgoal’s difficulty. Why it fails: the VLA’s subgoal can be feasible and the plan’s clearance can be the error’s source; the attribution’s procedure’s earliest’s check is what localizes the failure, and the team’s heuristic is the wrong tier’s. The fix: the attribution’s procedure, per §L.D.1.

Comparative table: the layer’s metrics.

Design principle P54.4. Attribute the failure to the earliest tier whose error exceeded its tolerance and whose propagation explains the failure; the last entry is the symptom, and the distribution’s concentration is the tuning’s priority.

Consolidation checkpoint 4

(a) Three capabilities. You can run the attribution’s three steps. You can state the five metrics and their bounds. You can read the evidence’s table and the attribution’s distribution.

(b) Transfer probe. The handoff’s success is 0.92 and the disagreement’s rate is 0.08. Which bound is violated, and what is the fix? Answer: the handoff’s 0.92 is below the 0.95; the disagreement’s 0.08 is within the 0.10. The fix is the handoff’s threshold’s re-computation, and the disagreement is not the priority.

(c) Remediation rule. If you cannot state why the attribution is the earliest’s error’s, re-read §L.D.1 before Part E.

Part E — The running case

§L.E.1 — The layer’s assembly

The running case’s layer, assembled from the three tiers, the residual, the safety stack, and the authorities.

The tiers’ parameters.

The authorities’ triggers. The task’s free-space 5 cm, the motion’s 5 cm clearance, the contact’s 4 Nm residual, the safe’s failure.

The handoff’s thresholds. The task-to-motion’s 6 cm at 10 cm/s, the motion-to-contact’s 4 Nm, the contact-to-task’s release’s completion, the safe’s urgency’s 5 ms.

The residual’s split. The authority’s 15 N and the residual’s 5 N, with the clip’s 5 mm.

§L.E.2 — The authority’s state machine

The layer’s state machine has four states and the transitions between them.

Task. The VLA’s subgoal drives. The transitions: to Motion on the 6 cm’s threshold; to Safe on the failure’s trigger; the Contact’s transition is not from Task — the contact is reached via Motion’s.

Motion. The planner’s plan drives. The transitions: to Contact on the 4 Nm’s residual; to Task on the subgoal’s completion; to Safe on the failure’s trigger; to infeasible’s path if the plan is rejected.

Contact. The impedance’s force loop drives. The transitions: to Motion on the release’s completion; to Safe on the failure’s trigger; to re-grasp on the slip’s detection.

Safe. The fallback drives. The transitions: to Task only on the operator’s explicit re-initialization; the Safe’s authority is the terminal’s in the episode’s scope.

The state machine’s acceptance is the 4.1.3 suite’s replay’s dwell’s distribution’s within the §L.D.2’s bounds, and the fallback’s rate’s 0.

§L.E.3 — The register’s entries

The policy’s register’s four entries.

The register’s entries are the 3.3.4 §L.E.3’s five fields, and the residuals are the layer’s acceptance’s residuals.

The handoff’s late fire’s residual is the speed’s variation — a faster end-effector’s travel is longer, and the threshold’s margin shrinks — and the mitigation’s complement is the 4.2.4 recovery’s policy.

The residual’s interaction’s residual is the loop’s gain’s uncertainty — the residual’s training’s data’s coverage, and the 3.4.4 §L.C.3’s monitor’s complement.

The attribution’s mis-assignment’s residual is the trace’s gaps — a tier’s output’s missing, and the 4.2.4 §L.E’s audit’s complement.

The authority’s oscillation’s residual is the borderline’s states — the 6 cm’s exact’s distance, and the trigger’s hysteresis’s design.

Self-explanation 3. Why is the speed’s variation a residual rather than a mitigation’s complete coverage?

Answer. Because the threshold’s computation uses the nominal speed, and the speed’s variation is the deployment’s unknown; the mitigation’s margin covers the nominal’s variation, and the residual is the variation’s outside the margin’s.

Worked-example ladder.

WE-L.E.a (fully worked). The suite’s replay’s dwell’s distribution is the task’s 0.62, the motion’s 0.28, the contact’s 0.10, and the safe’s 0.0. Compute the bounds’ comparison and state the acceptance.

Solution. The task’s 0.62 is within the 0.55–0.75; the motion’s 0.28 is within the 0.15–0.35; the contact’s 0.10 is within the 0.03–0.15; the safe’s 0.0 is at the bound’s 0. The acceptance’s conjunction passes on the dwell’s four bounds, and the remaining metrics are the handoff’s, the disagreement’s, and the attribution’s.

WE-L.E.b (completion). The suite’s replay’s handoff’s success is 0.94 and the disagreement’s 0.11. Compute the acceptance and the priority.

Completion. The handoff’s 0.94 is below the 0.95 and the disagreement’s 0.11 is above the 0.10; both are violated, and the handoff’s is the priority’s because it is the composition’s stability’s. The fixes are the threshold’s re-computation and the authority’s re-tuning, and the handoff’s first.

WE-L.E.c (faded). Write the register’s entry for the residual’s interaction with the split’s 5 mm’s residual.

Faded step. The failure is the loop’s oscillation; the probability is moderate; the consequence is the tracking’s error’s rise; the mitigation is the split’s 5 mm; the residual is the loop’s gain’s uncertainty.

Completion. The residual’s acceptance is the 4.2.4 §L.D’s oscillation’s monitor’s absence’s fallback, and the fallback is the 3.4.4 §L.C.3’s loop’s re-fit’s extension.

WE-L.E.d (contrastive near-miss). A team’s handoff’s success is 0.92 and the team widens the threshold’s 6 cm to 10 cm “for safety”. The handoff’s success rises to 0.97 and the task’s dwell falls to 0.45. Why it fails: the 10 cm threshold’s premature fire spends the task’s dwell on the planner’s slower plans, and the task’s dwell’s 0.45 is below the 0.55 bound. The fix: the threshold’s computation’s 6 cm, not the widening; the premature fire’s cost is the efficiency’s.

Comparative table: the layer’s acceptance.

Design principle P54.5. Accept the layer on the dwell’s, the handoff’s, the disagreement’s, and the attribution’s conjunction; the handoff’s is the priority’s when it is violated, and the threshold’s computation is the fix.

Consolidation checkpoint 5

(a) Three capabilities. You can state the layer’s parameters. You can run the state machine’s transitions. You can read the acceptance’s table and the register’s entries.

(b) Transfer probe. The task’s dwell is 0.45 and the motion’s is 0.45. Which bound is violated, and what is the cause? Answer: the task’s 0.45 is below the 0.55 and the motion’s 0.45 is above the 0.35; the handoff’s threshold is too wide, and the premature fires are the cause.

(c) Remediation rule. If you cannot state why the handoff’s violation is the priority’s, re-read §L.E.2 before the lab.

Failure taxonomy

The table covers the three lab corruptions plus three failures not exercised in the lab: the trace’s gaps, the shield’s threshold, and the contact’s trigger.

The lab

Task. Build the policy layer’s four-authority state machine for the running case’s pick-and-place, run it on a synthetic trace with injected handoff’s failures, and compute the dwell’s distribution, the handoff’s success, the disagreement’s rate, and the attribution’s distribution.

Conditions. Python 3.10+, NumPy. The trace’s tiers are simulated as functions with the latencies and tolerances of §L.E.1; the injected failures are the late handoff’s, the residual’s interaction’s, and the trigger’s chatter. Seed all RNGs.

Controls. (i) The nominal layer; (ii) the layer with the threshold’s 10 cm; (iii) the layer with the residual’s clip’s 2 cm; (iv) the layer with the attribution’s procedure’s last-entry’s heuristic.

Metrics.

Pre-registered hypotheses.

H1. The nominal layer’s dwell’s distribution is within the bounds, because the thresholds are computed from the latencies.

H2. The 10 cm’s threshold’s dwell’s task falls below 0.55, because the premature fires spend the task’s dwell on the planner’s plans.

H3. The 2 cm’s clip’s disagreement’s rate is above 0.10 and the force’s peaks exceed 20 N, because the total force is the authority’s plus the residual’s.

H4. The last-entry’s heuristic’s attribution’s dominance is above 0.50, because the last entry is the symptom’s, not the cause’s.

Break-it sequence.

1. Widen the threshold silently. The task’s dwell falls and the handoff’s success rises; the efficiency’s cost is invisible in the handoff’s metric. Silent: the handoff’s number is better.
2. Widen the residual’s clip silently. The disagreement’s rate falls and the force’s peak rises; the safety’s cost is invisible in the disagreement’s metric. Silent: the residual’s correction is “working”.
3. Use the last-entry’s attribution silently. The attribution’s distribution is concentrated on the control tier, and the actual error is the VLA’s. Silent: the attribution’s number looks plausible.

Acceptance criteria.

What good looks like. A good artefact has five properties. (1) The state machine’s transitions are the triggers’ consequences, not the code’s branches. (2) The dwell’s distribution is the report’s number, and the handoff’s rate is beside it. (3) The residual’s split is computed, not asserted. (4) The attribution’s procedure’s earliest’s check is the code’s loop. (5) The break-it results are a table.

A runnable core of the authority’s state machine and the attribution, seeded and annotated:

# lab_4_2_2.py — policy layer's authorities, handoffs, attribution
import numpy as np
np.random.seed(0)

AUTHORITIES = ["task", "motion", "contact", "safe"]
TRIGGERS = {"free_space_cm": 5.0, "motion_cm": 6.0,
            "contact_Nm": 4.0, "failure": False}
DWELL_BOUNDS = {"task": (0.55, 0.75), "motion": (0.15, 0.35),
                "contact": (0.03, 0.15), "safe": (0.0, 0.0)}

def simulate_episode(n=1000, threshold_cm=6.0, clip_cm=0.5):
    dwell = {a: 0 for a in AUTHORITIES}
    handoffs = 0; handoff_ok = 0; disagreements = 0
    authority = "task"; dist = 30.0; force = 5.0
    for t in range(n):
        dwell[authority] += 1
        dist -= 0.1                                    # 10 cm/s
        # triggers
        if authority == "task" and dist < threshold_cm:
            authority = "motion"; handoffs += 1
            # handoff's discontinuity: a random offset
            offset = abs(np.random.normal(0, 0.004))
            if offset < 0.005: handoff_ok += 1
        elif authority == "motion" and force > TRIGGERS["contact_Nm"]:
            authority = "contact"; handoffs += 1
            handoff_ok += 1                            # contact's switch's smooth
        elif authority == "contact" and dist < 1.0:
            authority = "motion"
        # force and residual's simulation
        force = 5.0 + 10.0 * (1 if authority == "contact" else 0)
        residual = np.random.normal(0, clip_cm * 0.3)
        if abs(residual) > clip_cm * 0.5: disagreements += 1
    return dwell, handoffs, handoff_ok, disagreements

for label, thr in [("nominal", 6.0), ("wide", 10.0)]:
    dwell, h, hok, dis = simulate_episode(threshold_cm=thr)
    total = sum(dwell.values())
    shares = {a: dwell[a]/total for a in AUTHORITIES}
    print(f"{label:8s} dwell={ {a: round(shares[a],2) for a in AUTHORITIES} }")
    print(f"         handoffs={h}  ok={hok}  disagreements={dis}")

def attribute(trace):
    """Attribute the failure to the earliest tier whose tolerance was exceeded."""
    tolerances = {"task": 0.01, "motion": 0.01, "contact": 20.0}
    for entry in trace:
        for tier in ("task", "motion", "contact"):
            if abs(entry[tier]) > tolerances[tier]:
                return tier
    return "control"

trace = [
    {"task": 0.02, "motion": 0.005, "contact": 5.0},   # task exceeds 1 cm
    {"task": 0.03, "motion": 0.008, "contact": 7.0},
]
print("attribution:", attribute(trace))

Line 4–7 define the authorities, the triggers, and the dwell’s bounds. Line 9–29 simulate an episode: the distances, the triggers, the handoffs’ discontinuity’s samples, the force, and the residual. Lines 31–36 run the two controls and print the dwell’s shares and the handoff’s success. Lines 38–44 are the attribution’s procedure’s earliest’s check. Lines 46–50 are the trace’s replay for the attribution.

Cheat sheet

Exercises with solutions

E 4.2.2.1. State the three tiers’ output spaces, cadences, and horizons.

S 4.2.2.1. Task: pose, 5 Hz, 0.8 s. Motion: trajectory, 10 Hz, 0.3 s. Control: torques, 1 kHz, 1 ms. The lesson: the spaces and cadences’ differences are the composition’s difficulty.

E 4.2.2.2 (transfer). The task tier’s cadence falls to 2 Hz and the chunk is unchanged. Compute the blind window and the pipelined latency.

S 4.2.2.2. The blind window is $8/2 = 4$ s; the pipelined latency is 500 ms. The lesson: the cadence’s fall multiplies the blind window, and the layer’s reactivity’s bound is the product.

E 4.2.2.3. Compute the handoff’s threshold at 15 cm/s with a 100 ms preparation and a 5 cm margin.

S 4.2.2.3. The travel is $15 \times 0.1 = 1.5$ cm; the threshold is $1.5 + 5 = 6.5$ cm. The lesson: the threshold’s computation is the preparation’s travel plus the margin.

E 4.2.2.4 (diagnostic). The authority’s force is 15 N and the residual’s clip is 2 cm at $K_d = 1000$ N/m. Compute the total’s worst case.

S 4.2.2.4. $15 + 20 = 35$ N, above the 20 N limit. The residual’s allowance is 5 N, and the clip must be 5 mm. The lesson: the clip’s split is the limit minus the authority’s.

E 4.2.2.5. State the three arbitration’s rules and their priority.

S 4.2.2.5. Safety unconditional, feasibility conditional, residual attribution; the priority is the safety’s, then the feasibility’s, then the residual’s. The lesson: the priority is the failure’s severity’s ordering.

E 4.2.2.6 (transfer). A failure’s trace has the task tier’s 2 cm, the motion’s 0.5 cm, and the contact’s 22 N. Attribute the failure and justify.

S 4.2.2.6. The task tier’s 2 cm exceeds its 1 cm tolerance and its error’s propagation explains the collision; the attribution is the task tier’s. The lesson: the attribution is the earliest’s error’s.

E 4.2.2.7 (diagnostic). The handoff’s success is 0.92 and the task’s dwell is 0.48. Diagnose and fix.

S 4.2.2.7. The threshold is too wide — the premature fires spend the task’s dwell on the motion tier’s plans — and the handoff’s discontinuity’s 0.92 is the late fires’ complement. The fix is the threshold’s re-computation to the 6 cm’s. The lesson: the threshold’s width is the efficiency’s and the handoff’s success’s trade.

E 4.2.2.8. State why the attribution’s distribution’s concentration is a diagnostic rather than a score.

S 4.2.2.8. The concentration’s tier is the tuning’s priority, and the concentration’s absence is the healthy state; the distribution’s shape is the tuning’s signal, not the composition’s quality’s. The lesson: the attribution’s distribution is the tuning’s diagnostic.

E 4.2.2.9 (transfer). The fallback’s rate is 0.03, above the 0.02 bound. Name two causes and the fix.

S 4.2.2.9. The failure’s trigger’s threshold is too sensitive (the provenance’s false absence) or the Q-shield’s threshold is too tight; the fix is the trigger’s and the shield’s recalibration. The lesson: the fallback’s rate is the safety’s thresholds’ calibration’s signal.

Exit test

You are ready for Lesson 4.2.3 when you can, without notes:

1. State the three tiers’ output spaces, cadences, and horizons.
2. Compute the serial and pipelined latencies and the blind window.
3. State the authority’s exclusivity’s three reasons.
4. Name the four authorities and their triggers.
5. State the veto’s priority ordering and its justification.
6. Write the handoff’s protocol’s four steps.
7. Compute the handoff’s threshold from the preparation’s travel and the margin.
8. Write the residual’s form and the split’s arithmetic.
9. State the three arbitration’s rules and their priority.
10. State the loop’s stability’s condition and the oscillation’s frequency.
11. Run the attribution’s procedure’s three steps.
12. Name the five metrics and their bounds.
13. Read the evidence’s table and the register’s entries.
14. Assemble the running case’s layer’s parameters and the state machine’s transitions.
15. State why the attribution is the earliest’s error’s, not the last entry’s.

Cross-references. 4.2.1 supplies the perception contract and the 95th’s age restated in §L.A.1 and §L.B.4. 4.1.3 supplies the suite and the replay restated in §L.D.3. 3.1.4 supplies the VLA’s chunk and the decision conjunction restated in §L.A.2. 3.2.3 supplies the planner’s horizon and the four checks restated in §L.B.2. 2.3.3 supplies the impedance law, the force budget, and the residual’s clip restated in §L.A.2 and §L.C.1. 1.1.3 supplies the computed-torque law restated in §L.A.2. 3.3.4 supplies the four-layer stack restated in §L.B.2. 2.2.4 supplies the Q-shield restated in §L.B.2. Lesson 4.2.3 (the reasoning layer) supplies the goals the task authority consumes. Lesson 4.2.4 (safety and recovery) consumes the arbitration’s rules. Module 4.3 uses the attribution as its diagnostic’s template.

Ready. The next lesson to write is 4.2.3 — Reasoning Layer. Say “next” to generate it.