COMPASS: Temporally Consistent Topological Passing Decisions for Socially Aware Robot Navigation

1. Introduction

Autonomous serving, delivery, and guide robots are no longer confined to isolated industrial spaces; they now operate in corridors, lobbies, and sidewalks where people move freely. The central difficulty of such shared spaces is not static-obstacle avoidance but interactive passing decisions with people who continuously change position and intent. In narrow-corridor head-on encounters, situations where the robot overtakes a person or a person overtakes the robot, and crossing-style traversals, the robot must continually judge “which side to pass on, whether to proceed or yield, whether to stop.”

Widely used local planners (the DWA family [1], MPPI [2], TEB [3]) re-optimize a cost function at every control cycle. This greedy re-optimization is natural in static environments, but in ambiguous configurations where the costs of the two passing directions are similar, minor sensor noise or a small movement by the person alone can flip the choice from one cycle to the next. As a result, the robot dithers side to side (oscillation) or, unable to commit to either side, comes to a stop — an outcome reminiscent of the freezing robot problem [4], whose original diagnosis is uncertainty growth rather than commitment failure. Oscillation is not only inefficient — it also prevents people from reading the robot’s intent, undermining both safety and trust. The problem is recognized in prior work. Topology-aware planners bias the choice toward the previously followed class through a soft topological-invariance cost [5], an implementation-level selection hysteresis [3], or a consistency parameter or weight on the previous homotopy class [6,7]; SHINE introduces its weight explicitly because fast switching between topology classes can make navigation indecisive and non-social [7], and a related mechanism keeps the previous trajectory as a candidate so that pedestrians can discern a stable intention [8]. Opinion-dynamics methods go further: they make the passing side an explicit, stateful decision variable with analytical deadlock-breaking and opinion-formation guarantees [9], and opinion dynamics has been combined with vortex fields [10] and with dynamical-system modulation [11]. Concurrent work selects among discrete behaviors, including passing left and right, with a switching cost, a minimum dwell time and a relative switching-improvement threshold, under a hard safety filter [12]. Any selector with a minimum dwell time or a fixed selection period already bounds the rate at which the passing decision can flip, by construction. The gap addressed here is narrower: a commitment rule whose minimum interval between discretionary switches follows from leaky evidence accumulation rather than from a fixed dwell timer, stated together with a conditional bound on how soon a sustained advantage of a persistently selected challenger forces a switch (Section 2).

We study insufficient temporal inertia in the passing decision as one mechanism that can contribute to oscillation; this does not exclude perception, prediction, or interaction uncertainty as other causes. To overcome it, we introduce COMPASS, a decision-layer planner that adds explicit temporal consistency to the passing decision itself (Figure 1). The intuition mirrors human walking behavior: once a person decides which way to step aside, they tend to hold that direction, changing it only for a clear reason, and stopping immediately when it becomes dangerous. A related intuition — that committing to a passing direction aids mutual coordination — appears in the social-navigation literature as social momentum [13], and opinion-driven navigation forms a passing-side opinion through explicit decision dynamics [9]; COMPASS embodies the “hold a once-chosen direction” behavior as an explicit rule at the decision layer whose minimum interval between discretionary switches follows from the accumulator dynamics rather than from a fixed dwell timer. Concretely, COMPASS makes three contributions:

• ID-Indexed Topological Classes: Topological passing classes relative to other agents are established in the literature, as joint braid classes of the multi-agent scene [14] and as per-pedestrian winding classes [5]; we bind the identity of such a class to a person’s track ID rather than to a flickering geometric gap, so that “the corridor chosen last cycle” can be re-identified at every cycle. The spawning, removal, merging, and splitting of classes caused by people entering, leaving, clustering, and separating are specified via explicit lifecycle rules and TTLs. These are design contracts that the current implementation only partially realizes (it uses input-order top-K labels) and that the reported experiments, which use fixed two-label inputs, do not exercise (Section 3.2 and Section 4.4).
• Commitment Switching Rule with Lexicographic Safety: The switching margin (hysteresis), dwell (persistence), and progress hardening (point of no return) are folded into a single leaky evidence accumulation equation. Its ingredients are standard: without the leak and with a constant threshold, the recursion is Page’s one-sided CUSUM statistic [15]; leaky accumulation of evidence toward a threshold is a classical model of perceptual choice [16]; and hysteresis switching with a bounded number of switches is established in supervisory control [17]. Our additions are the use of such an accumulator as the commitment rule for a social passing decision and the progress-dependent threshold. Safety is placed lexicographically above the rule; this is standard priority arbitration [18,19], included as a design element rather than claimed as a contribution. Discretionary changes are slowed relative to immediate argmin (“not rushed”), while the safety override is never delayed by commitment inertia (Section 3.4 and Section 3.5).
• Formal Properties with Offline Validation: We state anti-oscillation (P1), switching-rate bound (P2), safety dominance (P3), maneuver completion (P4), and conditional finite-window escalation to HOLD (P5) as propositions. They are applications of standard arguments to this rule, not new mathematics; what we add is a statement, for the passing decision, of the assumptions each guarantee needs. The load-bearing anti-oscillation guarantee is P2, an elementary bounded-increment argument that gives the discretionary branch a dwell time in the sense of switching-system theory [20]: a deterministic lower bound of $N_{min}=\lceil E_{\mathrm{th}}\left(\rho \right)/\left((D_{max}-{\Delta }_{\mathrm{floor}})dt\right)\rceil$ control cycles on the interval between consecutive discretionary switches for fixed $dt$ and zero post-switch evidence, holding on every sample path under the range bound $D_k\le D_{max}$ that the $[0,1]$ cost normalization of Section 3.3 supplies by construction, and informative under the declared design condition $E_0>(D_{max}-{\Delta }_{\mathrm{floor}})dt$ ($N_{min}\ge 2$; Remark 10). Because P2 is an upper bound on the switching rate and says nothing about switches occurring, we pair it with a conditional response-time bound (Proposition 3): the finite deadline applies only while the same challenger remains selected and eligible, updates proceed without reset or HOLD, its advantage stays above the stated lower bound, and the clip/leak equilibrium has sufficient threshold headroom. P1 refines this, for i.i.d. challenger advantages, to an exponentially small per-cycle switching probability and per-unit-time switching rate; the proof dominates the rule pathwise by the Lindley (one-sided CUSUM) recursion [15,21] and applies Kingman’s bound [22], with the exponent given by the exact Lundberg root ${\theta }^{*}$ of the increment law (the closed form ${\theta }^{*}\approx 2{\Delta }_{\mathrm{floor}}/\left({\sigma }_D^{2}dt\right)$ is retained as tuning guidance only); the exponential form is conditional on that independence hypothesis (Section 3.7). P4 is proven, on top of the progress $\rho$ dynamics and a lower bound on the lateral progress rate, via a reachable-upper-bound containment condition on the challenger accumulator $e^{\mathrm{rev}}$. Verification is split into two tiers. The decision layer’s behavioral consistency, a decision-stream observer statistic, and cyclic latency are measured using an offline harness that drives the actual decision core (Section 4); performance metrics requiring physical simulation or a real robot, along with external baselines and user studies, are left as planned evaluations specified via a protocol fixed in advance of measurement, which is not a formal preregistration (Appendix E).

We evaluate COMPASS in an offline harness that drives the actual decision core over 5 reproducible encounter scenarios × 50 seeds against internal comparators and knob ablations. In the ambiguous-tie scenario, the immediate-argmin comparator changes its decision 98.16 times per 10 s encounter on average, whereas COMPASS keeps its commitment with zero changes; the 0.6 s simple-dwell comparator also records zero changes there, so this scenario separates filtering from no filtering rather than accumulation from dwell; across all 250 trials COMPASS averages 0.40 decision changes per encounter against 29.74 for argmin, and no trial exceeds one change (Table 2 and Table 3). The ablations also contradict a design-stage hypothesis: removing the hysteresis margin or progress hardening alone produces no observed regression in this regime, so the leaky accumulator itself, rather than the margin or progress hardening, is the primary oscillation-suppression mechanism. A historical decision-core-only timing run gives p99 $58.6\mu$s and max $651.3\mu$s at $K=3$ (8 classes); the max is about $1.30\%$ of the 50 ms period at 20 Hz. These results establish the conditional decision rule and its offline behavioral consistency against internal comparators only. They do not measure physical safety, closed-loop behavior, human-perceived legibility, or comparison against external planners, a previous-class consistency weight [6,7], or opinion-dynamics passing [9]; these remain the planned next step (Appendix E).

Algorithm 1:COMPASS decision-layer control cycle (Figure 1)

2. Related Work

Local Planners and Topological Consistency.DWA [1] selects a velocity command from a dynamic window at every cycle; each cycle’s selection is made anew, with no memory of previous decisions, so nothing in the scheme itself discourages the chosen side from flipping between cycles (a structural observation of ours, not a claim made by Fox et al. [1]). TEB [3] maintains and optimizes several topological alternatives in parallel; its ROS implementation adds a selection-cost hysteresis that discourages switching between alternatives, but this is an implementation-level heuristic — the formulation itself does not define commitment across cycles. MPPI [2] is a sampling-based MPC formulation; it does not treat the discrete structure of social passing decisions as first class. H-signature-based enumeration of homotopy classes [23] rigorously represents the topological identity of a path but focuses mainly on static-obstacle topology; the branch that extends this topological view to moving-pedestrian environments is most relevant to this paper. Topological braids model the joint avoidance strategy of several agents, and a planner can then comply with the avoidance intentions inferred from their past behavior [14]. Dynamic Channel [24] is a real-time crowd-navigation framework that searches a triangulated spatial graph, combining pedestrian dynamics with topological-corridor selection; it picks one topology per planning cycle but does not formalize the temporal consistency of that choice via an explicit commitment rule or switching-rate guarantee. Winding Through [5] tracks the homotopy class the robot’s path holds relative to each pedestrian and penalizes changes to that class over time as a cost — being motivated by suppressing passing-side switches, it is among the closest prior work, but it operates as a soft topological-invariance cost internal to the planner and does not define a track-ID-indexed class lifecycle or a provable switching-rate bound. Topology-driven parallel trajectory optimization [6] runs local MPC optimizers constrained to different homotopy classes in parallel, executes the lowest-cost feasible trajectory in a receding-horizon manner while maintaining consistency of the chosen class, and is demonstrated on a mobile robot navigating among pedestrians — at the discrete selection step among the parallel optimizers it multiplies the cost of the previously selected trajectory by a consistency parameter $c_i\in [0,1]$, and a sensitivity study reports the trade-off: with $c_i=1$ (no preference for the previous class) the planner becomes infeasible more often, which the authors describe as indecisive. It uses no evidence accumulator and states no bound on switching frequency. SHINE [7] selects among topologically distinct guidance trajectories with a network trained on human motion data and reduces the selection cost of the homology class followed in the previous control period by a consistency weight, stating explicitly that fast switching between topology classes can lead to indecisive and ultimately non-social navigation. SHINE therefore treats decision oscillation in social navigation as a design problem; its remedy is a one-step, previous-class cost bias, and it does not state a bound on switching frequency. Zhou et al. [8] keep the previously selected trajectory as a candidate with a time-decaying weight, motivated by the observation that a high decision frequency, together with perception noise, can keep pedestrians from discerning a stable intention and cause oscillation. In multi-agent navigation, a learned planner can choose target winding numbers that a model-predictive controller then realizes [25], a decision–control split aimed at breaking symmetry deadlocks rather than at bounding switching. COMPASS differs from these mainly in making the cross-cycle commitment rule itself, rather than a per-cycle cost bias, the object of analysis, and in specifying class correspondence over time (lifecycle) against track identity.

Explicit Passing-Side Decisions and Opinion Dynamics. Opinion-dynamics navigation makes the passing side an explicit decision state. Cathcart et al. [9] drive robot social navigation with nonlinear opinion dynamics in which the robot forms, over time, an opinion about which way and by how much to pass human movers crossing its path; they show analytically that when the robot’s attention exceeds a critical value, deadlock in decision making is broken and the robot rapidly forms a strong opinion, even with no bias or evidence for which way to pass, and they validate the deadlock-breaking results in human–robot experiments. Opinion dynamics has also been combined with vortex fields so that robot and humans reach a consensus on the direction of motion [10], and with dynamical-system modulation so that the robot chooses a passing side from onboard sensing, with simulation and human-participant experiments [11]. These methods are the closest prior work on a stateful, analyzed decision layer for the passing side. The formal target of Cathcart et al. [9] is the formation of a decision (deadlock breaking); that of COMPASS is the revision of a formed decision, over multi-person track-indexed labels. COMPASS has no comparable human or closed-loop evidence. Concurrently with this work, BIG-CBF [12] separates maneuver selection from safety enforcement: it selects among six closed-loop behaviors, including passing left and right, with a switching cost relative to the retained mode, a minimum dwell time and a relative switching-improvement threshold, gives a hard control-barrier-function filter final safety authority, and reports closed-loop simulation and physical-robot experiments. BIG-CBF thus covers mode retention, dwell and improvement gating, and safety priority, with much broader empirical evidence than this paper; it does not use an evidence accumulator, a progress-dependent threshold or track-indexed topological classes; it states no switching proposition, but its minimum dwell time and 0.5 s behavior-selection period bound mode changes by construction.

Change Detection, Switching Logic, and Arbitration. The mathematics used in this paper is standard. Page’s cumulative-sum (CUSUM) inspection scheme [15] accumulates the deviations of observations from a reference value and signals when the cumulative sum rises by a decision interval above its running minimum; in recursive form this is a sum reflected at zero. With the leak removed and a constant threshold, the accumulator of Section 3.4 is this statistic, written as Lindley’s queueing recursion [21], and the exponential bound of P1 is the classical tail bound for that recursion [22]. Leaky accumulation of evidence toward a threshold is a standard model of perceptual choice [16]. In supervisory control, hysteresis switching logic changes the active candidate only when its monitoring signal reaches $(1+h)$ times the smallest one, for a hysteresis constant $h>0$, and yields a bound on the number of switches on an arbitrary time interval [17]; dwell-time switching separates consecutive switches by at least a prescribed interval, and an average dwell-time bounds the number of switches on any interval by a chatter bound plus a term linear in the interval length [20]. P2 is a dwell-time guarantee of this kind for the discretionary branch, obtained by an elementary bounded-increment argument. Finally, placing a safety behavior strictly above nominal behaviors is standard priority-based behavior arbitration [18], which has been extended with verification and fallback layers [19]. We use these results as tools and claim neither the accumulator nor its bounds as new mathematics.

Human Models, Prediction, and Learned Social Costs. The Social Force Model [26] describes pedestrian motion as interaction forces, and ORCA/RVO [27] formalizes reciprocal multi-agent collision avoidance; social-navigation work that addresses freezing models such human reactivity and cooperation explicitly [4,28]. Proxemics [29] contributes qualitative, culture-dependent interpersonal distance zones, which robotics work has operationalized as cost fields — notably the asymmetric-Gaussian formulation of Kirby [30]. Learning-based probabilistic predictors — Social-LSTM [31], Social-GAN [32], Trajectron++ [33] — predict a person’s future trajectory as a distribution, and the line of work that learns socially compliant costs and prediction models from pedestrian trajectory features via maximum-entropy inverse reinforcement learning [34,35] models human cooperative avoidance behavior as a trajectory distribution (including a mixture distribution over joint path choices), generating robot trajectories that conform to observed walking conventions. While these provide rich human models and learned cost/prediction models for trajectory generation, the works cited in this paragraph do not treat the oscillation of the robot’s decision itself as a measurement target or design goal, nor state switching-rate bounds for a discrete passing decision. Learned topology selection differs in this respect: SHINE [7] explicitly treats fast class switching as a design problem (first paragraph of this section). COMPASS adopts such cost fields as input and uses a Kalman constant-velocity prediction over a short horizon (Section 3.1 and Section 5); the learned predictors can be incorporated as a replaceable input module, since this contribution is orthogonal to the choice of predictor — only the mean-trajectory and covariance input need be replaced.

Social Momentum, Legibility, and Group Awareness. Cooperation-aware navigation that jointly models robot and human trajectories in planning [28] addresses cooperative navigation amid dense crowds. In particular, social momentum [13] scores candidate actions by the angular momentum of the joint robot–human configuration to reconcile human–robot passing-side intentions and reinforce implicit coordination; it is a per-cycle objective rather than a persistent accumulator, but it articulates the intuition — committing to a passing side aids coordination — that COMPASS formalizes as an explicit scalar evidence accumulator. Legible/predictable motion [36] presents the view that robot motion should reveal intent to an observer; the commitment mechanism of COMPASS suppresses oscillation of the discrete decision label, which we hypothesize can support legible motion; this paper does not show it, because the offline observer scores decision-label streams only (Section 4.1) and motion legibility is not measured. The methodology for human validation of legibility is elaborated via the observer model of Section 3.8 together with the user-study protocol of Appendix E. Metrics for human comfort and social appropriateness are undergoing standardization in social-navigation surveys [37,38,39], and COMPASS takes the axes of decision oscillation and legibility as its quantitative target among these. The spatial arrangement people form during conversation/interaction (F-formation) was formalized by Kendon [40] via the concepts of o-space and p-space; treating such formations as “groups that must not be split” is a norm adopted in robot navigation, not part of Kendon’s own definition, and detecting and respecting F-formations has been treated as a core element of group-aware navigation [41]. Automatic F-formation detection itself is outside the scope of this paper and is assumed to be provided by an external perception module; COMPASS extends the merge rule of Section 3.2 to interaction-based groups so as to avoid splitting F-formations (Section 3.9).

Positioning. The problem of temporal consistency on the passing side has been recognized in prior work, with mechanisms of varying explicitness — a soft topological-invariance penalty [5], the selection-cost hysteresis in the ROS implementation of TEB [3], per-cycle topological-corridor selection [24] (one corridor is chosen each cycle, but no cross-cycle commitment is defined), the social-momentum objective [13], and previous-trajectory retention [8]. de Groot et al. [6] do formalize inter-cycle topological consistency: a consistency parameter trades off following the previously selected homotopy class against switching to a better one, and at one extreme enforces the previous class as long as it remains valid. Both de Groot et al. [6] and SHINE [7] apply previous-class consistency in navigation among pedestrians, SHINE for the stated purpose of avoiding indecisive navigation, and de Groot et al. [6] with a sensitivity study in which removing the previous-class preference makes the planner indecisive; at the extreme that keeps the previous class while it remains valid, discretionary switches are ruled out by construction. Opinion-dynamics methods make the passing side an explicit, stateful decision with analytical deadlock-breaking guarantees [9], and concurrent work combines passing-mode retention, dwell and relative-improvement gating, and a hard safety filter in closed loop [12]. The mechanisms and mathematics we use are also standard (see Change Detection, Switching Logic, and Arbitration above). Any minimum-dwell or fixed-period selector satisfies a deterministic inter-switch bound by construction: so do BIG-CBF’s minimum dwell time and 0.5 s selection period [12], the extreme setting of de Groot et al. [6] that keeps the previous class while it remains valid, and the 0.6 s (12-cycle) simple-dwell comparator of Section 4, a continuous-persistence timer that, after a switch, needs 12 consecutive cycles of challenger advantage before it can switch again. At the default knobs, that comparator’s bound is stronger than P2’s worst case of 3 cycles (0.15 s; Remark 10). The delta is therefore not the existence of a bound but its source and its pairing with a response-time bound; it is narrow, and we state it precisely: (i) a leaky, CUSUM-type evidence accumulator with a progress-dependent threshold, used as the commitment rule for a social passing decision; (ii) an inter-switch bound for that decision that is derived from the accumulator dynamics, with no fixed dwell timer — the deterministic, pathwise bound P2 — paired with the conditional response-time bound of Proposition 3 and the conditional exponential refinement P1, each stated with the assumptions it needs; and (iii) a track-ID-indexed class representation with explicit lifecycle rules (spawn, removal, merge, split, TTL). Unlike per-cycle class selectors [3,6,7,24], it indexes classes by person identity. Winding Through [5] already tracks passing-side consistency relative to each pedestrian over time, so on point (iii) the only difference from it is the explicit lifecycle specification, a design contract that the current implementation only partly realizes and that the experiments do not exercise. Separately, we release an open ROS 2 Nav2 controller plugin and an offline harness; its ablations indicate that, in the tested regime, the accumulator rather than the margin or progress hardening carries the oscillation suppression. This is a released artifact, not a novelty claim. We claim neither the individual mechanisms nor the mathematics as new, and we have not compared against consistency-weight, opinion-dynamics or dwell-plus-relative-improvement baselines (Section 5).

3. COMPASS: Commitment-Based Passing Decisions at the Decision Layer

COMPASS is a decision-layer planner: at every control cycle it chooses which topological passing class to commit to, and whether to proceed, decelerate, stop, or hold, before a trajectory layer instantiates that choice. We first formulate the decision problem and its assumptions (Section 3.1). COMPASS then enumerates track-ID-indexed topological classes and keeps them in correspondence across cycles (Section 3.2), scores each class with a normalized, asymmetric social cost (Section 3.3), accumulates the challenger’s advantage in a single leaky evidence variable that governs discretionary switching (Section 3.4), and overrides that rule lexicographically whenever the committed class becomes unsafe (Section 3.5). Section 3.6 integrates these stages into one control cycle (Algorithm 1) and states the implemented interface. Section 3.7 states and proves the five properties P1–P5; Section 3.8—Section 3.10 define the legibility observer, the group and vulnerable-pedestrian extensions, and the analysis of the leak against a simple dwell timer.

3.1. Formulating the Decision Layer: Layers, Assumptions, and Objective

Layer separation. We separate social navigation into three layers. (i) The decision layer — the layer that determines discrete intents such as which side to pass on, and whether to yield, proceed, overtake, or stop. (ii) The trajectory layer — the layer that instantiates a given decision as a curvature-continuous ($G^2$) trajectory. (iii) The presentation layer — the layer that visually reveals the planned trajectory to people (e.g., an AR overlay). The contribution of this paper lies entirely in the decision layer; the ideal trajectory interface is a design assumption, not an end-to-end validation claim for the current adapter (implementation scope in Section 3.6).

Notation. Let k denote the control cycle and $dt$ the cycle interval. Let ${\mathcal{C}}_k$ denote the set of candidate topological classes at cycle k, and let $J_k\left(c\right)\in {\mathbb{R}}^{+}\cup \{\infty \}$ denote the representative trajectory cost of class c (∞ when unavailable). Let $c_{k-1}^{*}$ denote the previously committed class, and let ${\mathcal{S}}_k=\{c\in {\mathcal{C}}_k:{\mathrm{Safe}}_k\left(c\right)\}$ denote the safe/available set. Prediction of person i is provided by a Kalman constant-velocity estimator, giving a mean trajectory ${\widehat{p}}_i\left(t\right)$ and covariance ${\Sigma }_i\left(t\right)$, where ${\Sigma }_i\left(t\right)$ grows with the prediction horizon. A notation table is given in Appendix B.

Assumption A1 

(Assumptions and scope). (a) Planar (2D) navigation. (b) A short prediction horizon $[0,T]$ (typically 2–4 seconds). (c) Person tracking and data association are provided by an external module. (d) The trajectory generator, given aclass, corridor, and target speed, is assumed capable of generating a trackable trajectory and of realizing a commandedcross-track progress rateof at least $v_{\mathrm{lat},\min }>0$ (used in P4). Here $v_{\mathrm{lat},\min }$ is not the vehicle body’s lateral (swerve) velocity but the per-unit-time progress rate of the cross-track coordinate toward the planned lateral offset; for non-holonomic drives (differential, Ackermann) it is realized as the product of forward speed and steering (curvature), while for holonomic drives it is realized as a direct lateral-velocity component. Hence $v_{\mathrm{lat},\min }>0$ presupposes forward clearance and a positive forward speed. (e) Pedestrian passing conventions (e.g., right-side passing) are a locale setting and are not assumed to be a universal constant (Section 3.3, Appendix D).

Objective. A decision policy maps, at each cycle, the retained decision state and the current $({\mathcal{C}}_k,J_k,{\mathcal{S}}_k)$ to a committed class $c_k^{*}$, a target speed, and a mode. For cycles $s<t$, write

$$N_{(s,t]}^{\mathrm{disc}}={\displaystyle \sum _{k=s+1}^t}\mathbb{1}\left[c_k^{*}\ne c_{k-1}^{*}\mathrm{and}\mathrm{the}\mathrm{change}\mathrm{is}\mathrm{made}\mathrm{by}\mathrm{the}\mathrm{discretionary}\mathrm{branch}\right]$$

(1)

for the number of discretionary decision changes in $(s,t]$; changes made by the safety branch are not counted. We design a decision policy that prioritizes the supplied safety/availability predicates at every active decision cycle and bounds the discretionary decision changes counted by (1). Physical safety, motion legibility, goal progress, and social comfort require independent validation and are not guaranteed by branch priority.

3.2. Enumerating Topological Classes: Cross-Cycle Correspondence by Track ID

Enumeration. We index the K relevant agents (typically 1–3) within the radius of influence and prediction horizon by track ID. The class label is defined as a vector of left/right passing signs over each relevant agent. The lifecycle and winding-sign procedures below are intended design contracts; the current input-order top-K implementation is distinguished explicitly at the end of this subsection and in Section 4.4.

$$c=(s_{{\mathrm{id}}_1},\dots ,s_{{\mathrm{id}}_K}),s\in \{L,R\}$$

(2)

Among the up to $2^K$ combinations, any combination whose corresponding corridor width is narrower than the sum of the robot’s width and the safety margin is immediately pruned with $J=\infty$. This corridor-width comparison presupposes a circular-footprint approximation (treating the robot’s width as an orientation-independent constant); for elongated rectangular footprints, the occupied area varies with orientation during rotation, making pruning and availability decisions conservative, which we discuss separately in Section 5 (rectangular-footprint conservatism). The left/right sign of each class is computed from the winding sign (cross-product integral or H-signature integral) by which the representative path winds around the predicted human positions. Front/rear (temporal-axis) passing is not treated as a separate class but handled through the asymmetric social cost of Section 3.3. A more rigorous spatiotemporal homotopy extension is discussed as future work in Section 5. The combinatorial explosion of enumeration and the analytical bound on the number of effective classes after pruning are analyzed in Section 4.4.

Cross-cycle correspondence (key). For “retain the previous $c^{*}$” to be meaningful, $c^{*}$ must be re-identified every cycle. Because class identity is bound to track IDs rather than geometry, correspondence reduces to label matching such as “right of agent #7, left of agent #12,” which rides for free on IDs already provided by the tracking module. The design specifies the following lifecycle rules (Figure 2).

• Creation (a relevant agent enters, or a new corridor appears): a new class appears as a challenger but starts from evidence $e=0$, so there is no immediate jump.
• Extinction (a relevant agent leaves): the corresponding dimension is removed from all labels. If $c^{*}$ was distinguished solely by that person, it is absorbed into a coarser class; progress $\rho$ is retained if the actual path is unchanged, and reset if it changes.
• Temporary unavailability (corridor closes, $J=\infty$): identity is retained but passage is momentarily blocked. If $c^{*}$ is affected, the safety override takes over, and the identity is remembered for a short TTL so that a momentary flicker does not break the commitment.
• Merge (two people form one cluster): the two dimensions collapse into one, leaving only the sign shared by both sides, with “between” becoming ∞. The old $c^{*}$ is mapped to the surviving coarser class. Merge decisions use not only spatial proximity but also interaction cues (mutual stillness, mutual orientation, sustained proximity); details are given in Section 3.9.
• Split (a cluster separates): the reverse process — the old $c^{*}$ is mapped to the child that is consistent with the robot’s current lateral offset and heading.

These lifecycle rules specify the intended correspondence layer. The current decision-core enumeration constructs labels for the first $K_{\mathrm{cap}}$ input tracks; the presence of label operations does not establish an integrated TTL, merge/split, winding-sign, or group-lifecycle manager. The offline two-label harness holds track identity fixed, so it validates neither those lifecycle rules nor their effect in a tracker. The accumulator is the implemented and measured temporal decision mechanism.

3.3. Scoring Classes: A Normalized Asymmetric Social Cost

The cost of each class is defined as a weighted sum integrated over the horizon $[0,T]$ along the representative trajectory ${\tau }_c$.

$$J\left(c\right)=w_g{J}_{\mathrm{goal}}+w_s{J}_{\mathrm{social}}+w_e{J}_{\mathrm{effort}}+w_r{J}_{\mathrm{rule}},J\left(c\right)=\infty \mathrm{if}\mathrm{unavailable}$$

(3)

• Progress $J_{\mathrm{goal}}$. Distance from the local goal g at the end of the horizon: $J_{\mathrm{goal}}=\parallel p_r\left(T\right)-g\parallel$. This penalizes detour/stopping classes.
• Asymmetric social cost $J_{\mathrm{social}}$. A proxemics cost field is laid over each person and integrated for intrusion (Figure 3).

  $$\begin{array}{cc}\hfill J_{\mathrm{social}}& =\sum _i{\int }_0^T{g}_i(p_r\left(t\right),t)dt\hfill \end{array}$$

  (4)

  $$\begin{array}{cc}\hfill g_i(p,t)& =exp\left(-\frac{1}{2}{\delta }^{\top }{M}_i{\left(t\right)}^{-1}\delta \right),\delta =p-{\widehat{p}}_i\left(t\right)\hfill \end{array}$$

  (5)

  $$\begin{array}{cc}\hfill M_i\left(t\right)& =R_i\left(t\right)\mathrm{diag}({\sigma }_h^2,{\sigma }_s^2)R_i{\left(t\right)}^{\top }+{\Sigma }_i\left(t\right)\hfill \end{array}$$

  (6)
  Here the heading component ${\sigma }_h$ is set to be front/rear asymmetric (${\sigma }_{\mathrm{front}}$ for the front half-plane, ${\sigma }_{\mathrm{rear}}$ for the rear). This makes the cost of cutting in front of a person differ from that of passing behind them, so that the choice of passing side aligns with social norms. ${\sigma }_{\mathrm{rear}}$ appears in two distinct mechanisms in this paper and must be distinguished. (i) As the base shape of the cost-field asymmetry, ${\sigma }_{\mathrm{front}}>{\sigma }_{\mathrm{rear}}$ (the static shape in which the front personal-space region is wider than the rear), and (ii) as a contextual upward adjustment in the overtaking regime (a dynamic adjustment that deliberately raises the rear cost to suppress the surprise of a blind-spot approach) — these are distinct operating principles: the former induces yielding to the rear in head-on encounters, and the latter suppresses rear approach during overtaking/close passing. In addition, the predictive covariance ${\Sigma }_i\left(t\right)$ is added to the cost field, so that the personal-space ellipse widens further into the future and the robot gives wider berth accordingly. ${\sigma }_s$ determines the lateral width. Which of ${\sigma }_{\mathrm{front}}$ or ${\sigma }_{\mathrm{rear}}$ applies to a given person is computed from that person’s heading and the robot–person relative motion. That is, ${\sigma }_{\mathrm{front}}$ is applied in the head-on-encounter regime where the robot crosses the person’s front half-plane, and ${\sigma }_{\mathrm{rear}}$ is applied in the overtaking regime where the robot enters the person’s rear half-plane; half-plane assignment is determined by projecting $\delta$ into local coordinates referenced to the person’s heading. Here, the ${\sigma }_{\mathrm{rear}}$ regime switch (head-on encounter ↔ overtaking) is not driven by a separate variable but by the same variable as the rear half-plane projection judgment above (the sign of $\delta$’s local projection onto the person’s heading) — that is, the selection of the cost-field asymmetry and the assignment to the overtaking regime are consistently derived from a single judgment.
  Parameter grounding and locale configurability.${\sigma }_{\mathrm{front}}$, ${\sigma }_{\mathrm{rear}}$, ${\sigma }_s$, and the passing-side preference are not treated as universal constants but as locale/culture configuration values. The basic form of the asymmetric Gaussian proxemics is grounded in Kirby [30], and the forward-extended shape draws on Hall’s personal-space zones [29] and the social navigation survey [41]. However, we do not adopt the unconditional assumption that “passing behind is always preferable.” Since approach from a person’s blind spot (rear) can plausibly induce surprise or discomfort — a design consideration this paper adopts, rather than a finding reported in the surveys cited above — this cost exposes ${\sigma }_{\mathrm{rear}}$ as a context-dependent knob, so that (i) rear yielding is preferred in head-on encounters, while (ii) the rear cost is raised during overtaking/close passing to suppress blind-spot entry. The passing-side preference is locale-dependent and configurable (e.g., some pedestrian environments are reported to favor the right, others the left, or a mix). For an experimental study of a single population (Bordeaux, France) showing that avoidance-side conventions in pedestrian crowds can emerge through self-organization, see [42]; however, since that study is not a cross-cultural comparison, we do not extrapolate it as direct evidence that “the passing side varies by culture”; this paper takes the conservative choice of not fixing the passing side as a universal constant but separating it out as a locale.keep_side$\in \{\mathrm{right},\mathrm{left},\mathrm{none}\}$ setting. The design of the sensitivity analysis for these parameters is described in Appendix D, and their measurement is left to the planned evaluation (Appendix E).
• Effort/smoothness $J_{\mathrm{effort}}$.$J_{\mathrm{effort}}={\int }_0^T(\alpha {\kappa }^2+\beta a^2+\gamma {\dot{\kappa }}^2)dt$. The $\dot{\kappa }$ (curvature rate) term induces $G^2$ continuity, which directly benefits smooth tracking and the curvature display of the presentation layer.
• Rule $J_{\mathrm{rule}}$. A soft penalty for pedestrian traffic conventions (preference per locale.keep_side) and lane keeping. The design of the sensitivity curve for the weight $w_r$ is given in Appendix D.

Hard availability.$J=\infty$ if any of the following holds: static collision ($d_{\mathrm{obs}}<r_{\mathrm{safe}}$), insufficient corridor width, violation of kinematic limits, or violation of the hard safety distance $d_{\mathrm{safe}}$ from a predicted person. This is a dual structure in which soft discomfort is handled by $J_{\mathrm{social}}$ while physical/safety constraints are handled by hard availability.

Normalization, range, and units. For each term X, choose finite calibration bounds with $J_X^{max}>J_X^{min}$ and use ${\widehat{J}}_X=\mathrm{clip}((J_X-J_X^{min})/(J_X^{max}-J_X^{min}),0,1)$. With nonnegative finite weights, available finite costs satisfy $0\le J={\sum }_X{w}_X{\widehat{J}}_X\le {\sum }_X{w}_X$, so $|D_k|\le {\sum }_X{w}_X$. Unavailable classes are excluded from discretionary comparison; their infinite cost is not an admissible accumulator input. This bound is a property of the normalized cost path, not of arbitrary externally supplied step_evals inputs.

Fixed pre-calibrated constants preserve the meaning of normalized advantage across cycles. If cost units are rescaled, the calibration constants must co-transform to preserve affine invariance; that can be done for fixed constants as well as per-cycle statistics. Per-cycle min–max statistics instead change the raw-cost margin with the candidate range: a narrower range requires a smaller, not larger, raw-cost difference to exceed the same normalized ${\Delta }_{\mathrm{floor}}$. That changes its semantic interpretation, but P2 still holds whenever its stated normalized advantage bound holds. P1 separately requires its explicit distributional hypotheses.

J, $D_k$ and ${\Delta }_{\mathrm{floor}}$ are dimensionless under normalized weights. Because updates multiply by $dt$ measured in seconds, evidence e, $E_0$ and $e_{max}$ have normalized-cost–second units; $\lambda$, $k_{\rho }$, $\rho$ and p are dimensionless, and ${\theta }^{*}$ has reciprocal-evidence units. Hence ${\theta }^{*}{E}_0$ is dimensionless. The value ${\Delta }_{\mathrm{floor}}=0.05$ is five percent of one unit-weight normalized term, not five percent of the full weighted range when ${\sum }_X{w}_X=2.8$. The numerical knob values and reported experiments are unchanged by making these units explicit.

3.4. Accumulating Evidence: A Commitment Switching Rule

Let the challenger be $c_k^{\prime }={argmin}_{c\in {\mathcal{S}}_k,c\ne c^{*}}{J}_k\left(c\right)$, and the challenger advantage $D_k=J_k\left(c_{k-1}^{*}\right)-J_k\left(c_k^{\prime }\right)$. We fold the margin, dwell, and progress hardening into a single leaky-evidence-accumulation equation.

$$\begin{array}{cc}\hfill e_k& =\mathrm{clip}\left(\lambda e_{k-1}+(D_k-{\Delta }_{\mathrm{floor}})dt,0,e_{max}\right)\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill \mathrm{Switching}\mathrm{condition}\text{:}& e_k\ge E_{\mathrm{th}}\left({\rho }_k\right)\hfill \end{array}$$

(8)

$$\begin{array}{cc}\hfill E_{\mathrm{th}}\left(\rho \right)& =E_0·(1+k_{\rho }{\rho }^p),p\ge 1\hfill \end{array}$$

(9)

$$\begin{array}{cc}\hfill {\rho }_k& =\mathrm{clip}\left({\displaystyle \frac{\left|\mathrm{realized}\mathrm{cross}-\mathrm{track}\mathrm{progress}\right|}{|\mathrm{planned}\mathrm{lateral}\mathrm{offset}\mathrm{of}{c}^{*}|}},0,1\right)\hfill \end{array}$$

(10)

This is the design definition of $\rho$. The default implementation does not measure its numerator: it uses a forward-speed progress proxy ($L_{\mathrm{real}}+=\left|v_{\mathrm{cmd}}\right|dt$ with a fixed normalization $L_{\mathrm{plan}}=1.0$ m), and realized cross-track progress is an opt-in adapter mode (Section 3.6). Here ${\Delta }_{\mathrm{floor}}$ is the instantaneous margin (a dimensionless fraction of the normalized range per Section 3.3; advantage beyond this is dissipated by leak $\lambda \in (0,1]$), $E_{\mathrm{th}}$ is the persistence requirement (dwell), and $k_{\rho }{\rho }^p$ is progress hardening (point of no return). An equivalence relation gives intuition. If $\lambda =1$ and the advantage is a constant $\overline{D}>{\Delta }_{\mathrm{floor}}$, then e grows as $(\overline{D}-{\Delta }_{\mathrm{floor}})t$, switching at $t=E_{\mathrm{th}}/(\overline{D}-{\Delta }_{\mathrm{floor}})$; hence the larger the advantage, the faster the switch (proportional urgency), and as $E_{\mathrm{th}}\to 0^{+}$ this reduces to a pure margin, while a large $E_{\mathrm{th}}$ means a long dwell. When the challenge target changes ($c^{\prime }$ changes), we reset $e\leftarrow 0$, and at the moment of switching/committing, we reset $e\leftarrow 0,\rho \leftarrow 0$.

Here, ${\Delta }_{\mathrm{floor}}$ is a dimensionless switching margin under the normalization premise of Section 3.3, and its absolute meaning is held constant across cycles only when the normalization constants are fixed as pre-calibrated constants (time-invariance of the normalization map) (see the drift analysis in Section 3.3). If per-cycle min–max statistics are used, the effective margin of the same ${\Delta }_{\mathrm{floor}}$ drifts with the candidate set, so care is needed in interpreting margin-dependent statements such as the safety dwell and the switching-rate lower bound.

The linear case ($p=1$) hardens uniformly, while the superlinear case ($p>1$) is a “point of no return”-emphasizing form that allows slack through the middle of the maneuver but locks sharply near the end.

Relation to CUSUM and hysteresis switching. With $\lambda =1$, a constant threshold $E_0$, no upper clip and no resets, (7) is Page’s one-sided CUSUM statistic [15] for the challenger advantage, with reference value ${\Delta }_{\mathrm{floor}}$, increments scaled by $dt$, and decision interval $E_0$, written as Lindley’s recursion [21]; the proof of P1 uses exactly this companion recursion. For $\lambda <1$ the rule is a rectified, leaky variant rather than Page’s statistic itself (leaky accumulation of evidence toward a threshold is also a standard model of perceptual choice [16]), and the progress-dependent threshold () and the challenger-reset semantics are specific to this rule. The rule is also related to hysteresis switching in supervisory control [17], which changes the active candidate only when its monitoring signal reaches a fixed multiple of the smallest one and bounds the number of switches on any interval. We use this lineage as design background; the properties of Section 3.7 apply standard arguments to this particular recursion.

Challenger tie-breaking. If $c_k^{\prime }=argmin$ is not unique (two challengers’ normalized costs are tied within numerical tolerance $\epsilon$), the argmin can waver from cycle to cycle, and the $c^{\prime }\ne {\mathrm{prev}}_{c^{\prime }}$ reset becomes a new source of oscillation that disturbs the accumulator. To prevent this, when tied, we fix a single challenger by the following deterministic priority order.

1.

Prefer the previous challenger. If the previous cycle’s $c^{\prime }$ (${\mathrm{prev}}_{c^{\prime }}$) is in the current tied set, select it (temporal consistency of challenger identity). Because this priority rule applies only within a set of costs tied within the exit threshold ${\epsilon }_{\mathrm{out}}$, choosing ${\mathrm{prev}}_{c^{\prime }}$ costs no more than ${\epsilon }_{\mathrm{out}}$ (the hysteresis exit threshold) relative to the optimal challenger — i.e., it does not sacrifice more than ${\epsilon }_{\mathrm{out}}$ of optimality (consistent with the ${\epsilon }_{\mathrm{in}}<{\epsilon }_{\mathrm{out}}$ entry/exit hysteresis in the paragraph below).

2.

Topological distance from $c^{*}$. Otherwise, select the challenger with the smaller label Hamming distance (number of differing signs) from the current commitment $c^{*}$ (preferring the adjacent class with lower switching cost).

3.

Deterministic lexicographic order. If still tied, select the smallest by lexicographic order of class labels (ascending ID, with $L<R$ at each position).

Because this rule is deterministic, $c^{\prime }$ does not waver across cycles within a tied configuration, eliminating the artificial oscillation caused by accumulator resets. Meanwhile, $e\leftarrow 0$ fires only when $c^{\prime }$ genuinely changes (an advantage reversal, not a tie).

Hysteresis at the tie boundary itself. Because boundary chattering can also occur at the tie threshold $\epsilon$ itself (if the cost difference wobbles near $\epsilon$, “tied ↔ untied” can flicker across cycles), we place entry/exit hysteresis on the $\epsilon$ boundary. That is, we separate the threshold ${\epsilon }_{\mathrm{in}}$ at which two challengers enter a tied set from the untied state and the threshold ${\epsilon }_{\mathrm{out}}$ at which they exit the tied set, with ${\epsilon }_{\mathrm{in}}<{\epsilon }_{\mathrm{out}}$, so that once a pair of challengers is bound as tied, they are only released as untied when their cost difference exceeds ${\epsilon }_{\mathrm{out}}$. This blocks the secondary oscillation in which the tiebreak’s own activation/deactivation wobbles at the boundary.

Conservatism trade-off of the safety dwell. The safety dwell and progress hardening of Section 3.5 reduce oscillation by delaying switching, but at the cost of equally delaying the response when a genuinely better alternative appears. That is, increasing ${\Delta }_{\mathrm{floor}}·E_0·k_{\rho }$ strengthens anti-oscillation but increases the delay of legitimate replanning (conservatism), and this trade-off’s operating point is tuned via the sensitivity analysis of Appendix D.

3.5. Overriding for Safety: Lexicographic Priority and a HOLD Guard

Safety/availability is judged by

$${\mathrm{Safe}}_k\left(c\right)=[\mathrm{clearance}\ge d_{\mathrm{safe}}]\wedge [\mathrm{TTC}\ge {\mathrm{TTC}}_{min}]\wedge \left[\mathrm{kinematically}\mathrm{feasible}\right].$$

(11)

If the committed $c^{*}$ leaves the safe set, all accumulation and hardening from Section 3.4 are entirely disregarded (margin is zero in an emergency), and the system drops down the following ladder.

1.

Switch to a safe alternative class (if one exists).

2.

Otherwise, decelerate to buy time.

3.

If still hazardous, stop and yield (this is a commanded fallback; collision freedom additionally depends on braking and the environment).

Hysteresis on the safety branch itself. If the safety ladder chatters at stage 1 (switching) — i.e., high-frequency repeated safety switches — this itself becomes a new source of oscillation. To prevent this, we also impose minimal hysteresis on the safety branch. (i) Safety dwell. During a brief protection window $T_{\mathrm{bad}\mathrm{hbox}}$ immediately following a safety switch, further safety switches are blocked; if the violation persists, the system falls straight through to stage 2 (deceleration). That is, “if a safety switch was just attempted and safety is immediately violated again,” the system does not chatter at stage 1 again but transitions to deceleration priority. (ii) Deceleration-priority condition. If the number of qualifying safety interventions within the rolling window reaches a threshold (a partial threshold of $N_{\mathrm{thrash}}$ below), stage 1 is skipped and the system starts directly from stage 2. These conditions suppress repeated safety switching while active; as windows expire or the environment changes, they do not imply globally monotone mode descent.

Thrash guard. A qualifying event is an invocation of the unsafe-commitment branch, including interventions that decelerate without changing class. At most one event per decision time is retained in $(t-W,t]$, giving the window count

$$C_W\left(t\right)=\#\{i:t-W<{\tau }_i\le t\}$$

(12)

over qualifying event times ${\tau }_i$. If this count reaches $N_{\mathrm{thrash}}$, the controller enters zero-command HOLD and retains it until explicit external release; this is not a deadlock-recovery guarantee. The release operation clears mode/window/dwell state. Any re-commit and progress re-anchoring are separate state operations, not an implicit effect of release.

3.6. Integrating the Cycle: Algorithm and Trajectory Interface

Algorithm 1 integrates the stages above into one decision cycle; its structure is shown conceptually in Figure 1. The cycle interval is measured rather than assumed,

$$h_k=\left\{\begin{array}{cc}{t}_k-t_{k-1},\hfill & k>1\mathrm{and}{t}_k>t_{k-1},\hfill \\ 0.1\mathrm{s},\hfill & \mathrm{first}\mathrm{cycle}\mathrm{or}\mathrm{non}-\mathrm{advancing}\mathrm{clock},\hfill \end{array}\right.$$

(13)

and every braking branch applies the interval-scaled speed bound

$$v_{\mathrm{target}}=max(0,v_{\mathrm{in}}-a_{\mathrm{brake}}{h}_k),$$

(14)

which is a command limit, not a physical braking-distance guarantee.

The implementation is a controller plugin, compass_nav2::CompassController, implementing the nav2_core::Controller interface of ROS2 Nav2 [43], hosted by the controller_server. One decision cycle executes per computeVelocityCommands call; the cycle rate is set by the controller_server’s controller_frequency parameter (20.0 Hz in the example configuration); the costmap comes from Costmap2DROS, and human tracks are received via a subscription to /people (compass_msgs/People). The plugin complies with the Nav2 lifecycle contract (configure/activate/deactivate/cleanup), outputs TwistStamped, and maintains corresponding state (labels, e, $\rho$, ${\mathrm{prev}}_{c^{\prime }}$, safety dwell and intervention-window state) across cycles.

Implemented opt-in scope and evidence versions. The reported R1/R5 experiments use the legacy scripted-cost entry point, fixed two-label inputs, default knobs, and the historical forward-speed progress proxy. Corrected observer outputs are regenerated from the unchanged decision streams; R3 is a separate historical decision-core latency measurement, not a benchmark of the newly added adapter. The new options use_measured_progress and use_candidate_trajectories default to false. Measured progress uses signed pose displacement on a frozen path normal; invalid intervals fail explicitly, a commitment change discards the previous maneuver’s increment, and changed plan geometry re-anchors progress. In this opt-in mode $L_{\mathrm{plan}}$ is the planned lateral offset of the committed class, fixed when its epoch is anchored: the path tracker’s equilibrium offset $k_{\mathrm{side}}\left|\overline{s}\right|/k_e$ toward the class side, where $\overline{s}\in [-1,1]$ is the mean pair sign ($L=+1$, $R=-1$) that the tracker’s side-bias term itself uses ($0.133$ m at the default gains for a single-side class and one third of that for two people passed on one side and one on the other; a balanced class has $\overline{s}=0$, no side, and is rejected by the estimator) minus the anchor’s signed offset from the path, plus progress already credited to the same commitment. A non-positive value means no lateral maneuver and keeps $\rho =0$ rather than dividing by a near-zero length. It is not a general multi-person progress estimator, and neither the planned-offset model nor its effect on closed-loop behavior has been validated. The default remains the forward-speed proxy with $L_{\mathrm{plan}}=1.0$ m: all reported R1/R5 results, the paired responsive-profile sweep, and the scripted unicycle diagnostic use their historical progress inputs with that fixed normalization, so they are sensitivities of the proxy, not evaluations of the measured estimator. Making measured progress the default and evaluating it in closed loop remain open.

The optional candidate path evaluates and executes a matched one-second unicycle rollout with a circular-footprint costmap proxy and constant-velocity person prediction. Empty, invalid, unsupported mixed-side, unknown-map and out-of-map candidates fail closed. A changed braking speed requires regeneration and revalidation before command emission. This supplies bounded candidate-specific cost and command plumbing, not a proof that the rollout realizes each label’s homotopy or satisfies the ideal $G^2$ generator, group-lifecycle, sensing-freshness, braking-distance or P4 actuation assumptions. The safety speed bound subtracts $a_{\mathrm{brake}}{h}_k$, with $a_{\mathrm{brake}}$ expressed as acceleration and $h_k$ the validated cycle interval; command limiting is not a physical braking-distance guarantee. STOP/HOLD are enforced as zero commands by the adapter. Source/configuration and software-test limits are documented in docs/CANDIDATE_TRAJECTORIES.md and src/compass_eval/RESPONSIVENESS.md.

The separate research profile sets $k_{\rho }=0.5$, lowering the maximum threshold to $0.45<e_{max}=0.50$. For persistent selected advantage $D\ge 0.40$ at $dt=0.05$, $\lambda =0.97$, and uninterrupted updates, the response bound is 49 cycles (the software helper conservatively returns 50). It does not satisfy the default profile’s interior permanent-lock containment for that advantage range. The 3,750-run paired scripted sweep and deterministic scripted-cost unicycle diagnostic are supplementary software evidence; neither is a Gazebo/robot experiment, an independent physical oracle, or evidence for the new candidate path retroactively. Their original inputs and result sets remain separately identified.

System interface of the decision layer.Table 1 transcribes the interface contract directly from the implementation code.

Here $dt$ is not a fixed constant but the measured inter-call interval (distinct from the offline harness’s fixed $dt=0.05$ s in Section 4.1), as in (13), and the absence of a message-age cutoff for /people is a fact of the implementation as-is — the TTL of Section 3.2 is the TTL of class identity, a separate mechanism from this. Meanwhile, end-to-end pipeline characteristics — executor scheduling jitter, rmw/DDS queueing, TF delay, costmap update concurrency, controller_server dispatch overhead, and the effect of input-freshness handling — are not characterized in this paper; their measurement belongs to the planned evaluation (Appendix E).

3.7. Analyzing Properties: Anti-Oscillation, Response, Safety, Completion, and HOLD

We state five properties as propositions. P1, P2, and P4 include proofs; P3 and P5 are argued. None of them is new mathematics: P2 is an elementary bounded-increment argument that gives the discretionary branch a dwell time in the sense of switching-system theory [20]; P1 applies the classical exponential tail bound for the Lindley (one-sided CUSUM) recursion [15,21,22] after a pathwise domination step; and P3 and P5 are branch-priority and guard contracts. What this subsection contributes is a statement, for this decision rule, of the assumptions under which each guarantee holds. This paper formulates P1 as a probabilistic statement (a per-cycle upper bound on switching probability and rate) and P4 on the basis of $\rho$ dynamics, a lower bound on the lateral-progress rate, and the containment of the reachable upper bound of the single-challenger accumulator.

One point of scope is worth stating before the propositions rather than after them. The anti-oscillation guarantee this paper carries in its headline claims is P2 (Proposition 2): a deterministic lower bound of $N_{min}\left(\rho \right)=\lceil E_{\mathrm{th}}\left(\rho \right)/\left((D_{max}-{\Delta }_{\mathrm{floor}})dt\right)\rceil$ control cycles on the interval between two consecutive discretionary switches, which holds on every sample path and assumes nothing about the distribution of $D_k$ beyond the range bound $D_k\le D_{max}$. Two qualifications are stated with it rather than left implicit. First, the bound is informative only under the non-vacuity condition $E_0>(D_{max}-{\Delta }_{\mathrm{floor}})dt$ ($N_{min}\left(0\right)\ge 2$), which we declare as a design condition alongside (15) (Remark 10); without it P2 collapses to the one-cycle bound that every discrete-time policy satisfies. Second, P2 is an upper bound on the switching rate only — a policy that never switches satisfies it — so temporal consistency in the sense this paper intends is P2 together with the conditional response-time bound of Proposition 3. That deadline applies only while the same challenger remains selected and eligible, receives uninterrupted updates without reset or HOLD, maintains the stated advantage lower bound, and has sufficient clip and leak-equilibrium headroom. P1’s exponential form (part (ii)) is a sharper statement — it upgrades “switching is infrequent” to “switching is exponentially rare” — but it is conditional on an independence hypothesis on $\left\{D_k\right\}$ that stationarity alone does not supply, as Remark 3 shows by counterexample. We therefore state P1(ii) as a conditional refinement and rest the paper’s temporal-consistency claim on P2.

The single-challenger accumulator and notation (a premise for P4/Section 3.10 consistency). The switching dynamics of this paper close over the single leaky-evidence accumulator of Section 3.4/Section 3.6. Since this accumulator, by definition, always integrates the advantage evidence of the challenger $c^{\prime }$ seeking to overturn the current commitment $c^{*}$, we denote it in the property analysis below as the challenger accumulator$e^{\mathrm{rev}}$ — it is exactly the same single variable as the accumulation equation of Section 3.4 and the state variable e of the Section 3.6 algorithm; the superscript rev merely denotes the role “evidence for a challenge that would reverse the current commitment” and is not a separate accumulator. We write the maximum value $e^{\mathrm{rev}}$ can reach as $e_{max}^{\mathrm{rev}}$ (the smaller of the leak equilibrium bound and the clip bound $e_{max}$ when $\lambda <1$; derived in P4).

The soundness of the switching dynamics is summarized by a single two-sided condition on the reachable upper bound of this single accumulator.

$$E_0<e_{max}^{\mathrm{rev}}<E_0(1+k_{\rho })$$

(15)

The lower bound ($e_{max}^{\mathrm{rev}}>E_0$) is an algebraic reachability headroom condition under the declared input bound at $\rho =0$ (Section 3.10); actual finite response also requires the persistent-selection and advantage hypotheses below. The upper bound ($e_{max}^{\mathrm{rev}}<E_0(1+k_{\rho })$) is the P4 containment condition that once the maneuver is sufficiently progressed ($\rho >\overline{\rho }$; the boundary point itself belongs to the switching window, see Remark 12), challenge accumulation is trapped below the threshold and reversal is blocked. Since both requirements are a lower and upper bound on the same variable $e_{max}^{\mathrm{rev}}$, they can be satisfied simultaneously without contradiction. A third declared condition, $E_0>(D_{max}-{\Delta }_{\mathrm{floor}})dt$ (P2 non-vacuity, Remark 10), is independent of (15): it bounds the threshold from below by the largest single-cycle innovation rather than from above by the reachable bound. An additional “above-threshold headroom” requirement ($e_{max}>E_0(1+k_{\rho })$) on the same upper bound would collide head-on with this containment upper bound; as discussed in Section 3.10, it is not a soundness condition and is not imposed.

Proposition 1 

(Anti-oscillation — probabilistic form). Suppose the challenger advantage $D_k$ is a stationary stochastic process with mean 0, bounded variance $\mathrm{Var}\left[D_k\right]\le {\sigma }_D^2$, andbounded range$|D_k|\le D_{max}$ almost surely, and let $0<{\Delta }_{\mathrm{floor}}<D_{max}$. Write $X_k:=(D_k-{\Delta }_{\mathrm{floor}})dt$ for thedriving innovationof the accumulation recursion of Section 3.4. Then (i) the innovation has strictly negative mean,

$$\mathbb{E}\left[X_k\right]=(\mathbb{E}\left[D_k\right]-{\Delta }_{\mathrm{floor}})dt=-{\Delta }_{\mathrm{floor}}dt<0,$$

(16)

so in ambiguous configurations (mean advantage 0) a discretionary switch requires the fluctuations of $D_k$ to overcome a persistent negative bias in the input. We emphasize that (16) is a statement about theraw inputto the recursion,notabout the one-cycle increment of the reflected state $e_k^{\mathrm{rev}}$: the lower clip at 0 truncates negative innovations, so the expected state increment $\mathbb{E}[e_{k+1}^{\mathrm{rev}}-e_k^{\mathrm{rev}}]$ can be strictly positive at the boundary even though $\mathbb{E}\left[X_k\right]<0$ (Remark 1). Rarity is therefore quantified below as a crossing-probability bound, not as a drift argument on the state.

Suppose further that $\left\{D_k\right\}$ isi.i.d.(theindependence hypothesisof this proposition). Start with zero evidence and consider consecutive evidence-update cycles (or an externally fixed observation schedule on which the stated i.i.d. law holds). No claim is made for a data-dependent subsequence of retained advantages. Let $q_{k-1}$ be the evidence stored after cycle $k-1$, let $r_k\in [0,q_{k-1}]$ be the value after any challenger reset, and define the pre-test evidence $x_k=\mathrm{clip}(\lambda r_k+X_k,0,e_{max})$; a successful switch may reset the subsequently stored $q_k$ to zero in that same cycle. If $\mathbb{P}(X_1>0)=0$, the accumulator never leaves 0 and the discretionary switching probability is exactly 0. Otherwise, boundedness of $X_1$ together with $\mathbb{E}\left[X_1\right]<0$ implies that theLundberg equation$\mathbb{E}\left[e^{\theta X_1}\right]=1$ has a unique positive root ${\theta }^{*}>0$ (the adjustment coefficient), and (ii) the pre-test crossing probability, and hence the per-cycle switching probability, admits the uniform bound

$$\mathbb{P}\left(x_k\ge E_0\right)\le e^{-{\theta }^{*}{E}_0}\mathrm{for}\mathrm{every}\mathrm{cycle}k,$$

(17)

whence the expected number of discretionary switches in any window of N cycles is at most $N{e}^{-{\theta }^{*}{E}_0}$, and the expected switching rate per unit time is at most $(1/dt)e^{-{\theta }^{*}{E}_0}$ — both exponentially small in $E_0$, with an exponent ${\theta }^{*}$ that is increasing in the margin ${\Delta }_{\mathrm{floor}}$. The bound (17) is amarginal, per-cyclebound: over an unbounded horizon of persistent ambiguity an eventual crossing is not excluded (nor should it be — the reachability-headroom condition of Section 3.10 requires the threshold to be reachable); what is guaranteed is that crossings are exponentially rare per cycle.

Part (ii) isconditional on the independence hypothesis and is not established under stationarity alone; see Remark 3 for a counterexample. Accordingly the guarantee this paper carries in its headline claims is thedeterministicswitching-rate bound P2 (Proposition 2), which requires no distributional hypothesis on $D_k$ beyond the range bound; P1(ii) is a refinement that sharpens rarity from “bounded frequency” to “exponentially rare” when the independence hypothesis holds. Extension to dependent inputs is discussed — and deliberatelynotclaimed as a theorem — in Remark 6.

Remark 1 

(Sign of the state increment at the reflecting boundary). The distinction drawn in part (i) is not pedantic; it is tempting to call (16) “the one-cycle expected increment of the challenger accumulator,” but that reading is false under the proposition’s own hypotheses. Take $D_k$ i.i.d. uniform on $\{-a,+a\}$ with ${\Delta }_{\mathrm{floor}}<a\le D_{max}$, and start at the boundary $e_0^{\mathrm{rev}}=0$. Then $e_1^{\mathrm{rev}}=\mathrm{clip}(X_1,0,e_{max})$, so (for $(a-{\Delta }_{\mathrm{floor}})dt\le e_{max}$)

$$\mathbb{E}[e_1^{\mathrm{rev}}-e_0^{\mathrm{rev}}]=\frac{1}{2}(a-{\Delta }_{\mathrm{floor}})dt>0,$$

(18)

even though $\mathbb{E}\left[X_1\right]=-{\Delta }_{\mathrm{floor}}dt<0$: reflection truncates the negative half of the innovation and keeps the positive half. A negative-mean input therefore doesnotmake the reflected state a supermartingale, and no drift argument on the state can carry part (ii). This is the standard situation of queueing theory — a stable queue has negative-mean net input yet strictly positive expected growth from empty — and it is why the proof below routes through a pathwise domination by an unreflected random walk and a maximal inequality, rather than through the state’s expected increment.

Remark 2 

(On the boundedness hypothesis). The range hypothesis $|D_k|\le D_{max}$ is not an additional restriction on the system: by the $[0,1]$ normalization of Section 3.3 the cost $J={\sum }_X{w}_X{\widehat{J}}_X$ is bounded, so the advantage $D_k=J_k\left(c_{k-1}^{*}\right)-J_k\left(c_k^{\prime }\right)$ of Section 3.4 is bounded by construction, and $D_k\le D_{max}$ is the same hypothesis already carried by P2 (Proposition 2), P4 (Proposition 5), and the reachable bound $e_{max}^{\mathrm{rev}}$ (25). It is nevertheless statedexplicitlyhere, because part (ii) is an exponential bound and an exponential bound requires a finite exponential moment, which stationarity, zero mean, and finite variance do not supply on their own. A centred Student-$t_3$ advantage, for instance, satisfies every one of those three conditions yet has a polynomially decaying tail and no finite moment generating function, so no adjustment coefficient exists for it and a bound of the form (17) cannot hold. Under $|D_k|\le D_{max}$ this failure mode is excluded, and the normalization of Section 3.3 guarantees the hypothesis holds for the object this paper actually constructs.

Remark 3 

(Why stationarity alone is not enough). Stationarity, zero mean, bounded variance and bounded range together are still not enough for part (ii), and it is worth being explicit about why, because the gap is not a technicality of the proof method but a genuine failure of the conclusion.

Draw $Z\in \{-a,+a\}$ once with equal probabilities, with ${\Delta }_{\mathrm{floor}}<a\le D_{max}$, and set $D_k=Z$ for every k. This is a stationary, mean-zero, bounded process. Choose $\lambda =1$, constant $\rho =0$, $E_0=n(a-{\Delta }_{\mathrm{floor}})dt$, and $e_{max}\ge E_0$, with uninterrupted updates from zero. On the positive branch the first threshold crossing is exactly at cycle n; on the negative branch it never occurs. Hence $\mathbb{P}(x_n\ge E_0)=1/2$, even with reset-on-switch semantics, since this is the first crossing. The positive Lundberg root of the one-step marginal law is independent of n, so $e^{-{\theta }^{*}{E}_0}$ can be arbitrarily smaller than $1/2$ as n grows. This disproves the stationarity-only extension. For $\lambda <1$ the constant-positive branch instead uses the geometric hitting formula in Proposition 3, when its equilibrium and clip permit crossing; the linear ceiling is not applicable. No claim that the reset-on-switch process has a fixed-cycle marginal converging to $1/2$ is needed.

The mechanism is that a single draw persisting forever is perfectly admissible under stationarity, and no amount of bounded support repairs it: the process never forgets its regime, so no argument that needs fresh randomness — independent increments, or independent blocks — has anything to work with. This is precisely the failure mode the i.i.d. hypothesis of part (ii) excludes, and any relaxation of that hypothesis would have to exclude it too (Remark 6). Note also that this counterexample says nothing about P2 (Proposition 2), whose inter-switch interval bound is deterministic and holds on every sample path, including the adversarial one just constructed — which is why P2, not P1(ii), carries the headline guarantee.

Proof. 

Throughout, $\left\{D_k\right\}$ is i.i.d. with the moment and range hypotheses of the statement, and $X_k=(D_k-{\Delta }_{\mathrm{floor}})dt$. Part (i) is the one-line computation (16); Remark 1 explains why it must be read as a statement about the input, not about the state. Note first that the lower clip is a reflecting (saturating) boundary, not an absorbing one: $e^{\mathrm{rev}}$ is held at 0 only while the update would go non-positive, and leaves 0 on the first sufficiently positive innovation, so negative input drift does not trap the process at 0 — which is exactly why the earlier “expected hitting time” framings were uninformative, and why part (ii) is stated as a per-cycle probability bound whose scaling in $E_0$ is the design-relevant quantity. We prove part (ii) in three steps; the trivial case $\mathbb{P}(X_1>0)=0$ was dispatched in the statement.

Step 1 (pathwise domination). Let $q_{k-1}$ be the evidence stored after all tests and resets of cycle $k-1$, and let $r_k\in [0,q_{k-1}]$ be the value after any challenger reset but before cycle k’s update. Denote the evidence presented to the threshold test by

$$x_k=\mathrm{clip}(\lambda r_k+X_k,0,e_{max}).$$

If a switch fires, the stored value is then reset to $q_k=0$; otherwise $q_k=x_k$ (or a later operation can only reduce it). Define the Lindley recursion[21] driven by the same innovations, $W_0=0$, $W_k=max(W_{k-1}+X_k,0)$: the leak-free ($\lambda =1$), unclipped-above, never-reset companion of the recursion of Section 3.4. We claim $q_k\le W_k$ and $x_k\le W_k$ for every k. Induction starts from $q_0=W_0=0$. If $q_{k-1}\le W_{k-1}$, then $r_k\le q_{k-1}$ and

$$x_k\le max(q_{k-1}+X_k,0)\le W_k.$$

The post-test stored value satisfies $q_k\le x_k\le W_k$. Thus the pre-test quantity that can trigger a switch, as well as the stored post-reset state, is dominated pathwise by the Lindley walk.

Step 2 (adjustment coefficient and maximal inequality). Unfolding the Lindley recursion gives the suffix-sum representation $W_k={max}_{0\le j\le k}(X_k+X_{k-1}+\dots +X_{k-j+1})$ (empty sum $=0$), and since the $X_i$ are i.i.d., reversing the order of the increments shows that $W_k$ has, for each fixed k, the same distribution as ${max}_{0\le j\le k}{S}_j$ with $S_j=X_1+\dots +X_j$. Let $\psi \left(\theta \right)=log\mathbb{E}\left[e^{\theta X_1}\right]$: it is finite for all $\theta$ (bounded range), convex, with $\psi \left(0\right)=0$ and ${\psi }^{\prime }\left(0\right)=\mathbb{E}\left[X_1\right]=-{\Delta }_{\mathrm{floor}}dt<0$; and since $\mathbb{P}(X_1>0)>0$, $\psi \left(\theta \right)\to \infty$ as $\theta \to \infty$. Hence $\psi$ has a unique positive root ${\theta }^{*}$, i.e., $\mathbb{E}\left[e^{{\theta }^{*}{X}_1}\right]=1$. Then $M_j=e^{{\theta }^{*}{S}_j}$ is a nonnegative martingale with $M_0=1$, and the maximal inequality for nonnegative supermartingales (Ville’s inequality) gives

$$\mathbb{P}\left(\underset{j\ge 0}{sup}{S}_j\ge E_0\right)=\mathbb{P}\left(\underset{j\ge 0}{sup}{M}_j\ge e^{{\theta }^{*}{E}_0}\right)\le e^{-{\theta }^{*}{E}_0}.$$

This is Kingman’s bound on the waiting time of a single-server queue [22], specialized to our increments; it enters as a theorem, not an analogy. Since $W_k$ is Page’s one-sided CUSUM statistic of the innovations [15], this step is the standard exponential tail bound for that statistic; P1 applies it rather than deriving a new result. (Under zero mean and finite variance alone no root ${\theta }^{*}$ need exist; see the remark on the boundedness hypothesis above. The i.i.d. hypothesis is consumed twice in this step — once for the reversal identity, once for the martingale property — and neither survives bare stationarity, per Remark 3.)

Step 3 (from crossing to switching). A discretionary switch at cycle k requires the pre-test value $x_k\ge E_{\mathrm{th}}\left({\rho }_k\right)\ge E_0$ (progress hardening only raises the threshold); the stored post-reset value may already be zero in that same cycle. By Steps 1–2, for every k,

$$\mathbb{P}\left(\mathrm{switch}\mathrm{at}\mathrm{cycle}k\right)\le \mathbb{P}(x_k\ge E_0)\le \mathbb{P}(W_k\ge E_0)=\mathbb{P}\left(\underset{0\le j\le k}{max}{S}_j\ge E_0\right)\le e^{-{\theta }^{*}{E}_0},$$

which is (17). Linearity of expectation then bounds the expected number of discretionary switches in any N-cycle window by $N{e}^{-{\theta }^{*}{E}_0}$, i.e., the expected switching rate per unit time by $(1/dt)e^{-{\theta }^{*}{E}_0}$. Monotonicity of ${\theta }^{*}$ in the margin follows from $\psi$ decreasing pointwise (for $\theta >0$) as ${\Delta }_{\mathrm{floor}}$ grows. Finally, since the leak and the resets were absorbed in Step 1, the bound holds verbatim for every $\lambda \le 1$; a smaller $\lambda$ only widens the gap between the implemented process and the dominating walk, so in practice the true switching probability is further below the bound.

Thus the extreme-cycle oscillation that memoryless argmin exhibits near a symmetric point is probabilistically suppressed: in ambiguous configurations a discretionary switch occurs in any given cycle only with exponentially small probability, when the fluctuations of $D_k$ have accumulated enough to push the evidence over the threshold.    □

Remark 4 

(Tuning guidance: a closed-form approximation of ${\theta }^{*}$). The exact adjustment coefficient ${\theta }^{*}$ of Proposition 1 depends on the full law of $D_1$ through the Lundberg equation $\mathbb{E}\left[e^{\theta (D_1-{\Delta }_{\mathrm{floor}})dt}\right]=1$; boundedness and variance alone do not determine it. For parameter tuning it is nevertheless useful to have a closed form. Expanding the log-moment-generating function to second order, $\psi \left(\theta \right)\approx -\theta {\Delta }_{\mathrm{floor}}dt+\frac{1}{2}{\theta }^2{\sigma }_D^{2}d{t}^2$, and solving $\psi \left(\theta \right)=0$ gives thesmall-drift, quasi-Gaussian approximation

$${\theta }^{*}\approx {\displaystyle \frac{2{\Delta }_{\mathrm{floor}}}{{\sigma }_D^{2}dt}},\mathrm{whence}{r}_{\mathrm{switch}}\lesssim {\displaystyle \frac{1}{dt}}exp\left(-{\displaystyle \frac{2{\Delta }_{\mathrm{floor}}{E}_0}{{\sigma }_D^{2}dt}}\right).$$

(19)

We use (19)onlyas design guidance — it indicates how rarity scales as the margin ${\Delta }_{\mathrm{floor}}$ or the threshold $E_0$ grows, the variance ${\sigma }_D^2$ shrinks, or the cycle time $dt$ shortens — and it isnotthe coefficient the guarantee is stated with: the guarantee (17) carries the exact root ${\theta }^{*}$. The variance scale in (19) is matched to theper-cycle increment variance ${\sigma }_D^{2}d{t}^2$(equivalently, the per-unit-time variance ${\sigma }_D^{2}dt$), which restores the $1/dt$ factor in ${\theta }^{*}$ and in the switching-rate bound that an unnormalized reading would drop.

Remark 5 

(Deterministic special case). If $|D_k|\le {\Delta }_{\mathrm{floor}}$ for all k, the increment is always $\le 0$, so $e_k^{\mathrm{rev}}\equiv 0$ and the switching probability is exactly 0 — this is the trivial case $\mathbb{P}(X_1>0)=0$ of Proposition 1(ii), and the statement of the initial deterministic formulation. This probabilistic form relaxes that strong assumption — from “every realization is inside the margin” to “mean 0, bounded variance, and range bounded by $D_{max}$” — and as ${\sigma }_D^2\to 0$ in the tuning approximation (19) the bound tends to 0, continuously recovering the deterministic case. Note that only the pointwise margin condition $|D_k|\le {\Delta }_{\mathrm{floor}}$ is relaxed; the range bound $|D_k|\le D_{max}$, being a structural consequence of the cost normalization rather than an assumption about the environment, is retained.

Remark 6 

(IID hypothesis and autocorrelation). Proposition 1(ii) is stated and proved for i.i.d. $D_k$. The $D_k$ of this paper, however, is a stationary process that allows autocorrelation due to the temporal correlation of human motion and prediction, and we are explicit about what is and is not claimed across that gap. A natural route to a dependent version exists — under geometric α-mixing one would decompose the trajectory into regenerative blocks, whose finite exponential moments the range hypothesis $|D_k|\le D_{max}$ supplies, and re-run the Step-2 argument on block sums — but turning that route into a theorem requires quantified hypotheses (an explicit regeneration structure, a mixing rate, and a dependence-adjusted adjustment coefficient) that this paper does not formalize, sono exponential bound is claimed here for dependent inputs. A tempting fallback reads ${\theta }^{*}$, or the effective variance replacing ${\sigma }_D^2$, as “absorbing the autocorrelation structure” — with the long-run variance ${\sum }_k\mathrm{Cov}(D_0,D_k)$ substituted for the marginal variance — while claiming only the qualitative form “exponential decay in ${\Delta }_{\mathrm{floor}}·E_0$.” That fallback is not valid: a long-run variance does not determine a large-deviation rate, no theorem connects it to the first-passage behaviour of this reflected recursion, and Remark 3 exhibits a stationary process for which the qualitative form itself is false. Where independence cannot be asserted, the guarantee available is P2 (Proposition 2), which is deterministic, pathwise, and indifferent to the dependence structure. Whether approximate independence is defensible for a given deployment is an empirical question, and estimating the autocorrelation structure of $D_k$ from logged encounters is a measurement target of Appendix D and the planned evaluation (Appendix E). Finally, the leak requires no separate treatment: Step 1 of the proof absorbs every $\lambda \le 1$, so introducing $\lambda <1$ leaves the bound (17) valid verbatim — it only widens the gap between the implemented process and the dominating walk.

Remark 7 

($\lambda ·E_{\mathrm{th}}$ interaction). The interaction of λ and $E_{\mathrm{th}}$ (the leak makes reaching the threshold depend not on the simple integral of D but on its temporalshape— a short, strong advantage pulse accumulates before leaking away and easily crosses the threshold, whereas a long, weak advantage is offset by leaking and falls short of the threshold) is further analyzed in Section 3.10.

Proposition 2 

(Discretionary inter-switch separation). Let $h_k>0$ be the interval at cycle k, let $0<{\lambda }_k\le 1$, and suppose $D_k\le D_{max}$ with $b=D_{max}-{\Delta }_{\mathrm{floor}}>0$. Every discretionary switch resets the stored evidence to zero; all other resets only decrease it, and no external operation adds evidence. Let $s<t$ be consecutive discretionary-switch cycles and let $E_t=E_{\mathrm{th}}\left({\rho }_t\right)\ge E_0>0$ denote the threshold used immediately before the switch at t. Then

$${\displaystyle \sum _{k=s+1}^t}{h}_k\ge {\displaystyle \frac{E_t}{b}}.$$

(20)

For fixed $h_k=dt$, this implies

$$t-s\ge N_{min}\left({\rho }_t\right):=⌈{\displaystyle \frac{E_{\mathrm{th}}\left({\rho }_t\right)}{(D_{max}-{\Delta }_{\mathrm{floor}})dt}}⌉\ge N_0:=⌈{\displaystyle \frac{E_0}{(D_{max}-{\Delta }_{\mathrm{floor}})dt}}⌉.$$

(21)

The declared non-vacuity condition is

$$E_0>(D_{max}-{\Delta }_{\mathrm{floor}})dt,N_0\ge 2.$$

(22)

For variable intervals with a verified upper bound $h_k\le h_{max}$, replace $dt$ by $h_{max}$ in the cycle-count bound and non-vacuity condition. Without such a bound, only the accumulated-time inequality is claimed. These guarantees concern discretionary switches, not safety-triggered changes, class-lifecycle changes, physical oscillation, or human-perceived legibility.

Proof. 

Write $q_{k-1}$ for the stored post-reset evidence and $r_k\in [0,q_{k-1}]$ for the evidence after any pre-update reset. The pre-test evidence is

$$x_k=min(e_{max},max(0,{\lambda }_k{r}_k+(D_k-{\Delta }_{\mathrm{floor}})h_k)).$$

Since $q_{k-1}\ge 0$, $b>0$ and ${\lambda }_k\le 1$,

$$x_k\le max(0,q_{k-1}+b{h}_k)=q_{k-1}+b{h}_k.$$

The upper clip and subsequent resets only decrease this bound, and a cycle with no evidence update cannot increase the stored state. Starting from $q_s=0$, induction gives $x_t\le b{\sum }_{k=s+1}^t{h}_k$. The switch requires $x_t\ge E_t$, proving the accumulated-time inequality. Fixed or upper-bounded intervals give the ceiling bounds. This proof explicitly accounts for the lower reflecting clip, which can increase a negative update argument to zero.    □

Remark 8 

(Finite observation windows and implementation timing). In any N consecutive fixed-period cycles, there are at most $1+\lfloor (N-1)/N_0\rfloor$ discretionary switches. In the terminology of switching-system theory [20], P2 gives the discretionary switches (not the safety-triggered ones) a fixed dwell time of $N_{0}dt$ for fixed $dt$, and this window count is the corresponding average-dwell-time bound with chatter bound one; the argument is elementary and is not claimed as new. The asymptotic rate is at most $1/\left(N_{0}dt\right)$; a finite-window rate needs the boundary term. The Nav2 adapter uses measured inter-call intervals, so configuring 20 Hz alone does not establish the fixed-$dt$ cycle bound. For example, the admissible input $D=2.8$ over a single $h=0.12$ s update yields $x=0.33\ge E_0=0.30$ from zero. This is consistent with (20). Progress in (21) is the value before switching, not the value after the commit reset.

Remark 9 

(Variable sampling intervals: leak time and claimed range). The implemented leak coefficient λ is applied once per update, not per unit time. With a fixed per-cycle λ, the fraction of evidence retained over an interval of physical time depends on how many updates fall in it, so the physical leak time ${\tau }_{\mathrm{leak}}=-h/ln\lambda$ changes with the actual interval h: at $\lambda =0.97$ it is $1.64$ s for $h=0.05$ s, $3.28$ s for the adapter’s $0.1$ s fallback, and $0.82$ s for $h=0.025$ s. The per-update innovation $(D_k-{\Delta }_{\mathrm{floor}})h_k$ also scales with $h_k$, so the leak equilibrium $(D-{\Delta }_{\mathrm{floor}})h/(1-\lambda )$, the reachable bound $e_{max}^{\mathrm{rev}}$, the containment threshold $\overline{\rho }$ and the response-time bound change with the interval as well. A per-second leak would use ${\lambda }_k=exp(-h_k/{\tau }_{\mathrm{leak}})$, equivalently ${\lambda }_k={\lambda }^{h_k/d{t}_{\mathrm{ref}}}$ for a reference period $d{t}_{\mathrm{ref}}$; it is not implemented, and introducing it is a separate algorithm change that would need its own evaluation. Claimed range: the accumulated-time inequality (20) holds for every $h_k>0$ and every ${\lambda }_k\in (0,1]$, so it covers both the fixed and the per-second forms. All cycle counts and time constants in this paper ($N_{min}=3$, 7, 14; the response times 76, 24, 17, 7 cycles; ${\tau }_{\mathrm{leak}}\approx 1.64$ s; the leak-equilibrium values of Section 3.10 and Section 4.3; P1’s per-cycle bound and P4’s $e_{max}^{\mathrm{rev}}$) and all offline results are claimed only for the fixed $dt=0.05$ s. The Nav2 adapter accepts any positive measured interval, with a 0.1 s fallback, and enforces no upper bound $h_{max}$; no interval range has been validated for it, so for the adapter only (20) is claimed.

Remark 10 

(Non-vacuity of P2 and the default knobs). Condition (22) is not implied by the two-sided condition (15), and the boundary instance of Remark 12 shows the difference: with $dt=0.05$, ${\Delta }_{\mathrm{floor}}=0.05$, $D_{max}=0.95$ and $E_0=0.03$, (15) holds but $(D_{max}-{\Delta }_{\mathrm{floor}})dt=0.045>E_0$, so $N_{min}\left(0\right)=1$ and P2 is vacuous there: an advantage sequence that takes the value $D_{max}$ against whicheverclassis currently committed drives $e^{\mathrm{rev}}$ from 0 to $0.045\ge E_0$ in one cycle after every reset and flips the class every cycle while satisfying the bound exactly. That instance is retained only to exhibit the boundary of the lock region; it is not an admissible operating point once (22) is imposed. For the default knobs of Table A1 the condition holds with margin. By the $[0,1]$ normalization of Section 3.3, $D_k=J_k\left(c_{k-1}^{*}\right)-J_k\left(c_k^{\prime }\right)$ satisfies $|D_k|\le {\sum }_X{w}_X=2.8$ for the default weights, so in the worst case $(D_{max}-{\Delta }_{\mathrm{floor}})dt=0.1375<E_0=0.30$ and $N_{min}\left(0\right)=3$ cycles ($0.15$ s); if the realized advantage is bounded by a single normalized term, $D_{max}\le 1$, then $N_{min}\left(0\right)=7$ cycles ($0.35$ s), and for $D_{max}\le 0.5$, $N_{min}\left(0\right)=14$ cycles ($0.70$ s). Progress hardening multiplies the threshold inside the ceiling by $(1+k_{\rho }{\rho }^p)$, not the rounded cycle count. The worst-case figure is reported deliberately: P2 is a weak guarantee when the advantage can saturate every cost term at once, and the practical content of temporal consistency at the default knobs rests on the response-time bound below and, for i.i.d. inputs, on P1(ii).

Proposition 3 

(Conditional response time to a persistent selected challenger). Fix a cycle $k_0$ with stored evidence $q_{k_0}\ge 0$. Until the first discretionary switch, or through the next $N_{\mathrm{resp}}$ cycles, suppose (i) the same selected challenger remains eligible; (ii) no safety intervention, HOLD, retarget, lifecycle reset, or external reset interrupts accumulation; (iii) an update and threshold test run each cycle; (iv) $D_k\ge D_{\mathrm{sus}}>{\Delta }_{\mathrm{floor}}$; and (v) $0<E_{\mathrm{th}}\left({\rho }_k\right)\le \overline{E}\le e_{max}$. Let $dt$ and $\lambda \in (0,1]$ be fixed and $a=(D_{\mathrm{sus}}-{\Delta }_{\mathrm{floor}})dt$. If $\lambda =1$, or $\lambda <1$ and $a/(1-\lambda )>\overline{E}$, the first switch occurs within

$$N_{\mathrm{resp}}=\left\{\begin{array}{cc}⌈{\displaystyle \frac{ln(1-\overline{E}(1-\lambda )/a)}{ln\lambda }}⌉,\hfill & 0<\lambda <1,\hfill \\ \lceil \overline{E}/a\rceil ,\hfill & \lambda =1.\hfill \end{array}\right.$$

(23)

Conversely, let $L>0$, $q_{k_0}<L$, $0<\lambda <1$, $D_k\le \overline{D}$, and $E_{\mathrm{th}}\left({\rho }_k\right)\ge L$ throughout a window. If $(\overline{D}-{\Delta }_{\mathrm{floor}})dt\le (1-\lambda )L$ and no external operation increases evidence, no discretionary switch occurs in that window. Independently, $E_{\mathrm{th}}\left({\rho }_k\right)>e_{max}$ blocks switching in that cycle regardless of the advantage.

Proof. 

Let $z_0=0$, $z_n=\lambda z_{n-1}+a$. Thus $z_n=a(1-{\lambda }^n)/(1-\lambda )$ for $\lambda <1$, and $z_n=na$ for $\lambda =1$. The stated condition ensures a finite first $n^{*}=N_{\mathrm{resp}}$ with $z_{n^{*}}\ge \overline{E}$. For $n<n^{*}$, $z_n<\overline{E}\le e_{max}$, and monotonicity gives implemented pre-test evidence at least $z_n$, inductively until the first switch. At $n^{*}$ it is at least $min(e_{max},z_{n^{*}})\ge \overline{E}\ge E_{\mathrm{th}}\left({\rho }_{k_0+n^{*}}\right)$, so the threshold test switches by that cycle. For the converse, if stored evidence $q<L$, then

$$\lambda q+(\overline{D}-{\Delta }_{\mathrm{floor}})dt<\lambda L+(1-\lambda )L=L.$$

Lower clipping preserves strict inequality because $0<L$; upper clipping and resets only decrease the result. Induction keeps pre-test evidence below L, so no switch fires. This argument remains valid for a negative input upper bound. Finally, the clip obstruction follows from $x_k\le e_{max}$.    □

Remark 11 

(Response time, clip lockout, and scope). For $dt=0.05$, ${\Delta }_{\mathrm{floor}}=0.05$, $E_0=0.30$, $\lambda =0.97$, and constant $\rho =0$, a constant advantage from zero crosses the baseline threshold only when $D>0.23$. Equation (23) gives 76, 24, 17, and 7 cycles (3.80, 1.20, 0.85, and 0.35 s) for $D=0.25,0.40,0.50,1.0$, respectively. These are derived fixed-threshold results, not measured response delays. Their equality with the P2 lower bound in the last case is a numerical coincidence, not a general requirement. The default $e_{max}=0.50$ is below $E_{\mathrm{th}}\left(1\right)=0.60$. For $k_{\rho }=1,p=2$, every cycle with $\rho >\sqrt{2/3}\approx 0.8165$ is therefore locked against discretionary switching regardless of advantage. The value $0.41$ is only the leak-equilibrium threshold for $\overline{E}=0.60$ in a hypothetical configuration with enough clip headroom; it does not restore response at $\rho =1$ under the defaults. Clip equality $e_{max}=\overline{E}$ is permitted by the response theorem, whereas an equilibrium equal to a threshold is approached from below and not reached in finite cycles from a below-threshold start in the exact-real model. This proposition is conditional on persistent selection and continued updates. It is not an unconditional recall or deadline guarantee for all warranted alternatives; hypothesis coverage and missed opportunities must be measured separately.

Proposition 4 

(Safety dominance). In an active decision cycle outside an already absorbing HOLD, if $c^{*}\notin \mathcal{S}$, the safety ladder fires regardless of accumulator state or progress. In HOLD, the zero-command contract takes precedence.

Proof 

(Argument). Because stage 2 (safety) of the algorithm is evaluated before stage 3 (discretionary) with lexicographic priority, commitment inertia can never delay the safety response in any case when a safety violation occurs. The safety-branch hysteresis of Section 3.5 changes the form of response while its dwell/window conditions are active; it is not a proof of globally monotone mode descent or physical collision freedom.    □

Proposition 5 

(Maneuver completion — $\rho$ dynamics and containment of the challenger accumulator). Suppose there is no safety intervention, the challenger advantage is bounded ($D_k\le D_{max}$), the trajectory layer realizes the commanded cross-track progress rate at at least $v_{\mathrm{lat},\min }>0$ as in Assumption A1(d), and the cumulative disturbance retreat is bounded, ${\sum }_k{b}_k\le B<L_{\mathrm{plan}}$ (the quantity used in the proof below). Then containment ispointwise: in every cycle whose progress ρstrictly exceedsthe containment threshold $\overline{\rho }$ (derived below), reversal to the oppositeclassis blocked. If, moreover, ρ never returns to or below $\overline{\rho }$ after first exceeding it (forward invariance; Remark 14), the maneuver completes without reversal within at most $\lceil (L_{\mathrm{plan}}+B)/\left(v_{\mathrm{lat},\min }dt\right)\rceil$ cycles of an uninterrupted commitment starting with zero progress. In the pre-lock region ($\rho \le \overline{\rho }$), a sustained challenger advantage can still cross $E_{\mathrm{th}}\left(\rho \right)$ and trigger a discretionary switch — this is not a defect but a legitimate switching window intentionally left open by the reachability-headroom lower bound $e_{max}^{\mathrm{rev}}>E_0$ (e.g., the one legitimate switch per encounter measured inclean_commitin Section 4.2), in which case the algorithm restarts with $e^{\mathrm{rev}}\leftarrow 0·\rho \leftarrow 0$, and this guarantee applies identically to the new commitment. That is, what P4 excludes is reversal in the locked region ($\rho >\overline{\rho }$; the completion clause additionally requires the forward invariance stated above).

Proof. 

First we define the dynamics of $\rho$. Let progress be ${\rho }_k=\mathrm{clip}(L_{\mathrm{real},k}/L_{\mathrm{plan}},0,1)$, where $L_{\mathrm{real},k}$ is the cumulative realized cross-track progress and $L_{\mathrm{plan}}=\left|\mathrm{planned}\mathrm{lateral}\mathrm{offset}\mathrm{of}{c}^{*}\right|$. The one-cycle realized progress is $\Delta L_k=v_{\mathrm{lat},k}·dt$, and by assumption $v_{\mathrm{lat},k}\ge v_{\mathrm{lat},\min }$ (per Assumption A1(d), $v_{\mathrm{lat},k}$ is not the vehicle’s lateral body-frame velocity but the progress rate along the cross-track coordinate, realized in non-holonomic drives as the product of forward speed and steering). However, since $\rho$ can stagnate or decrease if the robot is pushed by environmental change or the corridor narrows, we do not assume monotone increase and instead use a lower bound on the non-negative net increment. Letting $b_k\ge 0$ denote retreat due to disturbance ($b_k$ covers the non-negative decrement of net progress due to disturbance — it collects all unplanned retreats that erode cross-track progress, such as being pushed, corridor narrowing, or momentary reversal, into a single non-negative term), $L_{\mathrm{real},k}=L_{\mathrm{real},k-1}+v_{\mathrm{lat},k}dt-b_k$. Under the condition that the disturbance is bounded (${\sum }_k{b}_k\le B<L_{\mathrm{plan}}$, i.e., cumulative retreat does not consume the entire planned displacement), the lower bound on net progress is

$$L_{\mathrm{real},K}\ge K·v_{\mathrm{lat},\min }·dt-B,$$

(24)

so after $K\ge (L_{\mathrm{plan}}+B)/(v_{\mathrm{lat},\min }·dt)$ cycles, $L_{\mathrm{real},K}\ge L_{\mathrm{plan}}$, i.e., $\rho \to 1$ is reached.

Meanwhile, for locking (blocking reversal to the opposite class) to hold, the progress-hardening threshold $E_{\mathrm{th}}\left(\rho \right)=E_0(1+k_{\rho }{\rho }^p)$ must exceed the maximum value reachable by the challenger accumulator $e^{\mathrm{rev}}$. The challenger accumulator increases by at most $(D_{max}-{\Delta }_{\mathrm{floor}})dt$ per cycle, decreases via the leak $\lambda$, and is clipped at $e_{max}$. Hence, under $\lambda <1$ (leak present), the reachable maximum of the challenger accumulator is the smaller of the leak-integral equilibrium bound and the clip bound, namely

$$e_{max}^{\mathrm{rev}}=min\left(e_{max},{\displaystyle \frac{(D_{max}-{\Delta }_{\mathrm{floor}})dt}{1-\lambda }}\right)$$

(25)

(the geometric series ${\sum }_{j\ge 0}{\lambda }^j(D_{max}-{\Delta }_{\mathrm{floor}})dt=(D_{max}-{\Delta }_{\mathrm{floor}})dt/(1-\lambda )$ is the leak equilibrium bound, and the clip further caps it at $e_{max}$). Only under the pure-integrator assumption $\lambda =1$ does the leak-equilibrium term diverge to infinity, so that the reachable bound simplifies to the clip bound $e_{max}$. Below, for generality, we write $e_{max}^{\mathrm{rev}}$ as the reachable bound. The containment condition is thus

$$E_{\mathrm{th}}\left(\rho \right)=E_0(1+k_{\rho }{\rho }^p)>e_{max}^{\mathrm{rev}}(\mathrm{P}4\mathrm{containment}\mathrm{condition}\mathrm{at}\mathrm{progress}\rho )$$

(26)

and the boundary value at which the corresponding equality $E_{\mathrm{th}}\left(\overline{\rho }\right)=e_{max}^{\mathrm{rev}}$ holds is

$$\overline{\rho }={\left({\displaystyle \frac{e_{max}^{\mathrm{rev}}/E_0-1}{k_{\rho }}}\right)}^{1/p}$$

(27)

Since $E_{\mathrm{th}}$ is strictly increasing in $\rho$ (for $k_{\rho }>0$, $p\ge 1$), the containment condition holds exactly on the open region $\rho >\overline{\rho }$; the boundary point $\rho =\overline{\rho }$ belongs to the switching window whenever $e_{max}^{\mathrm{rev}}$ is attained (Remark 12). The existence condition for a nonempty lock region $(\overline{\rho },1]$ is $\overline{\rho }<1$ with $\overline{\rho }>0$, i.e., $E_0<e_{max}^{\mathrm{rev}}<E_0(1+k_{\rho })$.

Non-vacuity of containment. Note that the lower bound $e_{max}^{\mathrm{rev}}>E_0$ in the above existence condition is a sufficient headroom design condition, not an unconditional liveness theorem. If the reachable bound $e_{max}^{\mathrm{rev}}$ of the challenger accumulator is below $E_0$, then $e^{\mathrm{rev}}$ cannot even reach the threshold $E_{\mathrm{th}}\left(0\right)=E_0$ at $\rho =0$, so no discretionary switch can ever occur, and consequently the entire switching dynamics addressed by P1 and P2 becomes inert. That is, even though containment holds (since nothing ever switches), it is not “the maneuver was locked” but rather a degeneracy of “there was never any switching capability to begin with,” and the guarantee loses its meaning. At equality, a binding clip can be attained while a leak equilibrium from below is only approached; the two-sided open condition deliberately avoids that distinction. The designer can preserve a region of $(\lambda ,e_{max}^{\mathrm{rev}})$ that simultaneously satisfies containment (upper bound $e_{max}^{\mathrm{rev}}<E_0(1+k_{\rho })$) and switchability (lower bound $e_{max}^{\mathrm{rev}}>E_0$); concrete guidance for this is given in the knob tuning of Appendix D.

Combined with the non-vacuity lower bound above, this containment condition organizes into the two-sided condition $E_0<e_{max}^{\mathrm{rev}}<E_0(1+k_{\rho })$ stated at the start of Section 3.7 — the lower bound is algebraic reachability headroom at $\rho =0$ (actual response additionally needs the hypotheses of Proposition 3), and the upper bound is the existence of a nonempty lock region ($\overline{\rho }<1$). Since both are a lower and upper bound on the same variable $e_{max}^{\mathrm{rev}}$, they can be satisfied simultaneously; the separate “above-threshold headroom” requirement ($e_{max}>E_0(1+k_{\rho })$) would contradict this containment and is not imposed (Section 3.10). Design is done by adjusting the leak-equilibrium term (via $\lambda$) and the clip bound $e_{max}$ so as to place $e_{max}^{\mathrm{rev}}$ in the open interval $(E_0,E_0(1+k_{\rho }))$, ensuring that a nonempty lock region $(\overline{\rho },1]$ exists (design guidance is given in the knob tuning of Appendix D).

Once $\rho$ lies in the lock region ($\overline{\rho }<\rho \le 1$), switching to the opposite class is blocked; provided $\rho$ does not retreat to or below $\overline{\rho }$ thereafter (Remark 14), $\rho$ reaches 1 along the lower bound above, and the maneuver completes; the number of cycles to completion is finitely bounded by $K\le \lceil (L_{\mathrm{plan}}+B)/(v_{\mathrm{lat},\min }·dt)\rceil$ for an uninterrupted commitment.    □

Remark 12 

(Boundary of the lock region). The lock region is open at $\overline{\rho }$ by necessity, not by convention. When the clip binds strictly ($e_{max}<(D_{max}-{\Delta }_{\mathrm{floor}})dt/(1-\lambda )$, so that $e_{max}^{\mathrm{rev}}=e_{max}$ isattained), the boundary case is realizable: take $dt=0.05$, ${\Delta }_{\mathrm{floor}}=0.05$, $D_{max}=0.95$, $\lambda =0.5$, $E_0=0.03$, $k_{\rho }=1$, $p=1$, $e_{max}=0.045$. These values satisfy the two-sided condition (15) — though not the P2 non-vacuity condition (22), since $(D_{max}-{\Delta }_{\mathrm{floor}})dt=0.045>E_0$; the instance is used here only to exhibit the boundary of the lock region and is not an admissible operating point (Remark 10) — and give $\overline{\rho }=0.5$; a single cycle at $D_k=D_{max}$ from $e_{k-1}=0$ drives $e_k$ to exactly $e_{max}=0.045=E_{\mathrm{th}}\left(0.5\right)$, and the switching rule of Section 3.4 ($e_k\ge E_{\mathrm{th}}\left({\rho }_k\right)$) fires at $\rho =\overline{\rho }$ exactly. The boundary point therefore belongs to the switching window, and any statement that locking begins “at” $\overline{\rho }$ would be false on this instance. When instead the leak equilibrium is no larger than the clip bound ($(D_{max}-{\Delta }_{\mathrm{floor}})dt/(1-\lambda )\le e_{max}$), including equality, $e^{\mathrm{rev}}$ approaches $e_{max}^{\mathrm{rev}}$ from below without attaining it from a below-equilibrium start in finite exact-real updates, and containment in fact holds on the closed region $\rho \ge \overline{\rho }$; we do not use this sharpening, and state P4 uniformly on the open region.

Remark 13 

(Estimated versus realized progress). P4 is a statement about realized cross-track progress under Assumption A1(d). In every reported experiment ρ is computed from the scripted forward-speed proxy, so a proxy value $\rho =1$ is not evidence that a lateral maneuver was completed, and the lock it induces is not evidence of physical maneuver success.

Remark 14 

(Non-monotonicity within the locked region). The above containment does not release once locked, as long as the progress ρ increases monotonically; however, if the disturbance retreat $b_k$ exceeds $v_{\mathrm{lat},\min }·dt$ in a given cycle enough to make ρ behave non-monotonically (ρ rises above $\overline{\rho }$ and then retreats back below $\overline{\rho }$), containment can be temporarily released along that path. Precisely, then,containment is valid only within the interval where $\rho >\overline{\rho }$ holds, and it is released if $\rho$ retreats to or below $\overline{\rho }$.For locking to be permanent, in addition to the cumulative-retreat boundedness condition (${\sum }_k{b}_k\le B<L_{\mathrm{plan}}$, now part of the proposition’s hypotheses), it is also necessary that, once ρ exceeds $\overline{\rho }$, it is realized as never retreating to or below it again (the forward-invariance hypothesis of the completion clause); disturbance paths that fail to satisfy this are handed off to P3/P5 (the safety/availability layer).

Remark 15. 

If the disturbance is unbounded, so that ${\sum }_k{b}_k$ exceeds $L_{\mathrm{plan}}$ (the corridor is permanently blocked), this is no longer a “maneuver completion” situation but a loss of safety/availability, and P3/P5 (the safety ladder, HOLD) take over. That is, P4 is a completion guarantee that holds as long as availability is maintained, and responsibility for loss of availability rests with the safety layer.

Proposition 6 

(Conditional finite-window escalation to HOLD). Let qualifying safety interventions occur at decision times ${\tau }_i$, at most once per cycle, and define $C_W\left(t\right)=\#\{i:t-W<{\tau }_i\le t\}$. Suppose the guard records the current event before evaluating $C_W$, enters HOLD whenever $C_W\ge N_{\mathrm{thrash}}$, and retains HOLD until explicit external release. If an active episode contains $N_{\mathrm{thrash}}$ interventions in one such window, HOLD is entered no later than the cycle recording its $N_{\mathrm{thrash}}$-th intervention. If the output adapter enforces HOLD, subsequent cycles command zero motion until release.

Proof. 

At the threshold event all $N_{\mathrm{thrash}}$ timestamps lie in the counted window. The guard therefore enters HOLD in that cycle. The absorbing-mode rule retains HOLD until release, and the assumed output contract supplies zero commands during those cycles.    □

Remark 16 

(No unconditional termination or collision guarantee). This is a conditional guard contract. Events at $t=0,4,8,\dots$ with $W=3$ s never exceed one event per window and can continue indefinitely. A rolling-window guard alone therefore does not exclude infinite sparse oscillation or guarantee episode termination. A global event budget or deadline would be an additional design. Zero commanded motion neither implies instantaneous physical stopping nor proves collision freedom in a moving environment. P3 specifies branch priority; P5 specifies conditional escalation, not deadlock recovery or physical safety. The reference implementation records at most one safety intervention per decision time, prunes the open-left window $(t-W,t]$, and synchronizesn_thrashto that window count before testing the threshold. HOLD returns a zero target command and is retained by the decision core until an explicitrelease_hold()call clears the episode state. These software checks establish the guard contract only; they do not establish physical stopping or collision freedom.

3.8. Observing Legibility: A Bayesian Time-to-Legible Proxy

To make the legibility claim measurable, we must define “when does an observer become confident of the passing side.” This paper operationalizes time-to-legible using a Bayesian observer model.

Let the hypothesis space be the passing side $H\in \{L,R\}$; the observer performs a Bayesian update of the posterior $P(H\mid o_{0:t})$ from the robot’s observable motion cues (lateral offset, heading, curvature, the trajectory $o_{0:t}$ up to time t).

$$P(H\mid o_{0:t})\propto P(o_{0:t}\mid H)·P\left(H\right),$$

(28)

where the likelihood $P(o_{0:t}\mid H)$ is given by an expected motion model under each hypothesis (e.g., the standard trajectory distribution for yielding to that side). This likelihood motion model is treated as an observer-side prior, independent of this paper’s decision policy. That is, the observer model does not see the robot’s internal cost J or accumulator state, and assigns the likelihood for each hypothesis solely from the externally observable kinematic trajectory. This is to prevent the evaluation metric from circularly favoring the very policy under evaluation by copying it; the likelihood model is fixed (following the observer-inference perspective of the legible-motion literature [36]) as a generic “lateral avoidance trajectory distribution.” This likelihood model is applied identically to the proposed method and all baselines, providing a common scoring convention rather than evidence of construct validity or unbiased human perception. All policies’ decision streams are scored under the same observer prior, but this decision-stream proxy does not by itself validate motion legibility.time-to-legible is defined as the earliest time at which the posterior exceeds a threshold $p^{*}$ (e.g., 0.9) and remains so thereafter.

$$t_{\mathrm{legible}}=min\{t:P(H^{*}\mid o_{0:\tau })\ge p^{*}\forall \tau \in [t,t+{\Delta }_{\mathrm{hold}}]\},$$

(29)

where $H^{*}$ is the actually realized passing side and ${\Delta }_{\mathrm{hold}}$ is a hold window excluding transient overshoots. This definition applies identically to both (i) an automatically computable proxy metric (obtained by running the observer model over simulation logs) and (ii) a user study asking human perception (protocol in Appendix E). A policy that oscillates fails to stabilize its posterior above the threshold, making $t_{\mathrm{legible}}$ late or undefined, whereas a policy that commits fixes the posterior early, advancing $t_{\mathrm{legible}}$ — this is the measurable core of this paper’s legibility claim. The offline harness does not compute this fixed-${\Delta }_{\mathrm{hold}}$ quantity; it reports the related but distinct endpoint-suffix statistic $t_{\mathrm{sfx}}$ defined in Section 4.1. Observer-model parameters (the likelihood motion model, $p^{*}$, ${\Delta }_{\mathrm{hold}}$) are configuration values, and their sensitivity (Appendix D) and correlation with human judgment are left to the user-study protocol of the planned evaluation (Appendix E).

Limitation of the population-independence assumption of the likelihood model. This model fixes the likelihood motion model as a single generic “lateral avoidance trajectory distribution,” but since intent attribution in fact depends on an observer’s culture, age, and familiarity with robots, and legibility is itself a social construct, this assumption of assigning the same likelihood to all observer populations is only an approximation and has the limitation that it cannot capture population-specific variation in legibility (quantifying this limitation is possible only with human data from the Appendix E user study).

3.9. Extending Classes to Groups: F-Formations and Vulnerable Pedestrians

Interaction-based groups (F-formation). If the merge rule of Section 3.2 is based on spatial proximity alone, a group of people conversing can be seen as “just two nearby people,” opening a corridor between them and splitting the group. To prevent this, we extend merge/group judgment with interaction cues. If two people $i,j$ satisfy (i) sustained mutual proximity over some duration, (ii) mutual orientation (headings pointed toward a common o-space center, per Kendon’s F-formation), and (iii) low relative velocity (walking together or standing in conversation), we bind them as a social group, and the handling of the class that splits between them (passing between the two) follows one of two approaches, chosen by the following criterion. In situations with a strong social norm under which passing between a group should never be geometrically permitted (e.g., a clearly identified stationary conversation group, or a group including a vulnerable pedestrian), the class in question is excluded from availability ($J=\infty$); in situations where the norm is weaker or group-detection confidence is low enough that excluding availability would be excessively conservative, it is instead suppressed with a large soft penalty$P_{\mathrm{grp}}$, leaving room as a fallback if all other corridors are blocked:

$$J\left(c\right)\leftarrow \left\{\begin{array}{cc}\infty ,\hfill & \mathrm{strong}\mathrm{never}-\mathrm{split}\mathrm{norm},\hfill \\ J\left(c\right)+P_{\mathrm{grp}},\hfill & \mathrm{weaker}\mathrm{norm}\mathrm{or}\mathrm{low}\mathrm{group}-\mathrm{detection}\mathrm{confidence},\hfill \end{array}\right.$$

(30)

for every class c that passes between the members of a social group. That is, exclusion from availability expresses “never split,” while the soft penalty expresses “avoid splitting where possible, but allow it as a last resort.”

F-formation detection is assumed to be an external module. This paper does not claim F-formation detection itself as a contribution, and assumes that group composition and o-space estimates are provided by an external perception module. Primary literature on automatic F-formation detection includes the graph-cut-based GCFF [44] and subsequent cluster-based detectors, and this decision layer takes their output as input — group membership and an o-space center; where a detector (e.g., GCFF) does not output an o-space radius explicitly, the radius is derived from member positions. The o-space concept follows [40], as surveyed in [41]. This incorporates the social norm “do not split an interacting group” into the decision layer. Simple clusters (accidental proximity without interaction) are handled as coarse classes under the existing merge rule as before. However, when a route is chosen that goes around a group without splitting it, the social cost asymmetry depending on which side is taken (the side that blocks the conversational sightline of the F-formation’s o-space versus the side that does not) is outside the scope of this paper and is noted as future work (Section 5).

Accommodation of vulnerable pedestrians. When vulnerable pedestrians — children, the elderly, wheelchair users, etc. — are identified (assuming an external perception module provides attribute tags), for that person we (i) widen the proxemics width $\sigma$ to secure a larger social distance, (ii) raise the passing-side commitment threshold $E_0$ and dwell to pass more conservatively (less hastily), and (iii) raise the safety distance $d_{\mathrm{safe}}$ and ${\mathrm{TTC}}_{min}$. Additionally, near vulnerable pedestrians we further raise the cost of rear/blind-spot passing (raising ${\sigma }_{\mathrm{rear}}$) to reduce surprise.

Bounding the freezing side-effect of conservative defaults. However, if the above conservative knobs (especially raising $E_0$/dwell) are increased without limit, the robot may delay passing excessively, causing a freezing side-effect. Accordingly, this policy applies vulnerable-pedestrian conservatism only within a finite bound, and if the resulting inability to commit to any corridor persists for a certain duration, this is treated as a deadlock and handed off to P5’s HOLD (stop-and-wait). That is, the conservative default is responsible only for “more cautious passing,” but a time-based freezing detector is an additional implementation requirement: the finite-window safety-event guard in P5 alone does not detect a persistent lack of discretionary switching.

Policy under misclassification and ethical limitations. Because the estimation of vulnerable-pedestrian attributes may be uncertain or misclassified, this decision layer adopts a conservative default under uncertainty. That is, if attribute confidence is below a threshold, the person is provisionally treated as a vulnerable pedestrian and the above conservative knobs ($\sigma$, $E_0$, dwell, $d_{\mathrm{safe}}$, ${\mathrm{TTC}}_{min}$ raised) are applied — the principle being that “losses in safety and comfort due to misclassification should be biased toward the conservative side.” However, since attribute classification itself may carry bias, privacy, and stigmatization concerns, this paper does not claim classifier design or fairness as a contribution and explicitly states this as an ethical limitation (Section 5). Determination of concrete margin values and their effects is left to user/field evaluation, i.e., the planned evaluation (Appendix E).

3.10. Comparing Leak and Dwell: Shape Dependence and $e_{max}$ Saturation

$\lambda$ (leaky accumulation) vs. simple dwell timer. A simple dwell timer is a rule that “switches if the challenger has held the advantage continuously for $T_{\mathrm{dwell}}$,” looking only at the continuous persistence of the advantage. In contrast, the leaky accumulation $e_k=\mathrm{clip}(\lambda e_{k-1}+(D_k-{\Delta }_{\mathrm{floor}})dt,0,e_{max})$ looks at the time integral of the advantage together with a leak. The analytical differences between the two rules are as follows.

• Handling of intermittent advantage. A simple dwell timer resets the moment the advantage is interrupted even once, which can permanently block a legitimate switch in an ambiguous configuration where the advantage holds “almost always but occasionally breaks.” Leaky accumulation treats an interruption only as a leak (not a reset), so if the advantage is sufficient on average, the accumulation crosses the threshold and switching occurs. That is, leaky accumulation replaces the simple dwell’s brittle reset with smooth decay. This brittleness is a property of the persistence form tested here. It has not been tested for selectors that combine a post-switch minimum dwell with an improvement threshold [12,20].
• Shape dependence. As the core of this comparison, threshold attainment under leaky accumulation depends not on the simple integral of the advantage but on its temporal shape. A strong advantage arriving as a pulse shorter than the time constant ${\tau }_{\mathrm{leak}}=-dt/ln\lambda$ ($\lambda <1$; a per-update constant whose physical value changes with the interval, Remark 9) accumulates before it can leak away and triggers a switch, while a weak advantage spread over a duration longer than ${\tau }_{\mathrm{leak}}$ is offset by leaking and falls short of triggering a switch. The simple dwell timer has no such notion of a time constant, only a single axis of “continuous duration.”
• Coincidence in the special case. If $\lambda =1$ (no leak) and the advantage is a constant $\overline{D}$, leaky accumulation becomes a linear integrator that switches at $t=E_{\mathrm{th}}/(\overline{D}-{\Delta }_{\mathrm{floor}})$, which, expressed in terms of time-to-threshold, is equivalent to a dwell timer. That is, a simple dwell timer is the special case of leaky accumulation in the $\lambda \to 1$, constant-advantage limit. The reason for introducing $\lambda <1$ is precisely to obtain the shape-dependence above (the ability to forget old, weak evidence).

This quantitative comparison (switch count and legibility for $\lambda$ leaky accumulation vs. a simple dwell) is measured in the ablation of Section 4.1 as a “simple dwell” variant (separate from the immediate argmin without the accumulator term) (Table 2 and Table 3). In particular, the above first-item prediction — that the simple dwell’s reset brittleness under intermittent advantage blocks legitimate switching — is indeed observed (0 switches for the simple dwell versus 1 switch for the proposed method in intermittent; detailed interpretation in Section 4.3).

The role of $e_{max}$ saturation. The upper clip $e_{max}$ serves two roles. (i) Prevention of windup. If a strong advantage persists for a long time, e can grow unboundedly, causing integrator windup in which e stays above the threshold for a long time even after the advantage disappears. $e_{max}$ bounds the accumulation, so when the advantage disappears, the leak acts quickly starting from $e_{max}$, restoring responsiveness. (ii) Post-switch symmetry. Combined with the $e\leftarrow 0$ reset immediately after switching, $e_{max}$ prevents an “already sufficiently decided” advantage from accumulating further and prematurely advancing the next switch.

Why no above-threshold headroom condition is needed, and the reachability-headroom condition. One might require that “if $e_{max}$ is too small, it saturates before reaching $E_{\mathrm{th}}$ in P2’s switching argument and blocks switching, so $e_{max}>{max}_{\rho }{E}_{\mathrm{th}}\left(\rho \right)=E_0(1+k_{\rho })$ (above-threshold headroom) is a soundness condition,” but this headroom condition is not needed and would be wrong, for two reasons. (i) What P2 guarantees is a lower bound on the switching interval (an upper bound on switching rate), and this lower bound holds regardless of the clip — saturation can only delay or block threshold attainment, never advance it, so the switching-rate bound does not break even if $e_{max}$ becomes smaller (the P2 argument). (ii) Requiring $e_{max}^{\mathrm{rev}}>E_0(1+k_{\rho })$ would make $e_{max}^{\mathrm{rev}}>E_{\mathrm{th}}\left(\rho \right)$ hold for all $\rho \in [0,1]$, so that no containment threshold $\overline{\rho }<1$ could exist, colliding head-on with P4’s containment — this is why the condition cannot be imposed.

What saturation actually threatens is not the switching-rate bound but switchability itself. If the reachable bound is strictly below the baseline threshold ($e_{max}^{\mathrm{rev}}<E_0$), no discretionary switch can occur from the zero-evidence initial state. Equality must be distinguished: a binding clip $e_{max}=E_0$ can be reached in finite updates when the sustained-input leak equilibrium exceeds $E_0$, whereas an equilibrium equal to $E_0$ is only approached from below in finite exact-real updates. Thus $e_{max}^{\mathrm{rev}}\le E_0$ is not a blanket no-switch condition. The open design condition below provides algebraic reachability headroom; actual response still requires the selected-challenger hypotheses of Proposition 3:

$$e_{max}^{\mathrm{rev}}>E_0(\mathrm{algebraic}\mathrm{headroom}\mathrm{at}\rho =0,\mathrm{not}\mathrm{unconditional}\mathrm{liveness})$$

(31)

which, combined with the P4 containment upper bound, becomes the single two-sided condition $E_0<e_{max}^{\mathrm{rev}}<E_0(1+k_{\rho })$ (Section 3.7). That is, the precise formalization of the design intent is that initial switching headroom exists at $\rho =0$ (lower bound, subject to the response theorem’s input/selection conditions) and reversal is blocked once the maneuver has sufficiently progressed ($\rho >\overline{\rho }$) (upper bound); since both requirements are a lower and upper bound on the same reachable bound $e_{max}^{\mathrm{rev}}=min(e_{max},(D_{max}-{\Delta }_{\mathrm{floor}})dt/(1-\lambda ))$, they can be satisfied simultaneously without conflict. The sensitivity analysis sweeping $e_{max}·\lambda ·k_{\rho }$ around this condition is designed in Appendix D; the measurement of the progress-hardening-related axis ($\rho$-driven rate) is given in Section 4.2, and measurement of the remaining axes is left to the planned evaluation (Appendix E).

4. Experiments

This section reports as results only what was actually measured. The behavioral consistency, a decision-stream observer statistic, and the per-cycle latency of the decision layer are measured with an offline harness that drives the actual decision core, and are presented in Section 4.2 and Section 4.3 (ablation and $\rho$-sweep) and Section 4.4 (per-cycle latency); the harness setup and metrics are given in Section 4.1, and the sensitivity-analysis design is given in Appendix D. Performance metrics that require physical simulation or a real robot, the external baselines, and the user study were not measured and are therefore not presented as results; their protocols are specified in the Planned Evaluation of Appendix E, fixed in advance of measurement, with per-case values still to be bound before any run. No measured value is fabricated.

4.1. Experimental Setup

Harness and hardware. The measurements in this section are obtained by driving the actual decision core (DecisionCore) with the compass_eval offline harness across 5 reproducible encounter scenarios × 50 seeds × 6 variants ($dt=0.05\mathrm{s}=20$ Hz, horizon 10 s; behavioral rerun CPU AMD EPYC 9V74; historical latency CPU AMD Ryzen 5 5500GT). For a fixed C++ standard library (see Standard-library dependence below), all figures are computed deterministically from the decision stream, and the raw data (compass_eval/results/ablation_raw.csv) are released; Table A1 lists the default knobs used. What this harness measures is the decision layer’s behavioral consistency, a decision-stream observer statistic, and per-cycle latency; performance metrics that require physical simulation (success rate, collision rate, minimum social distance, lateral jerk) and the external baselines / user study are separated into the Planned Evaluation (Appendix E).

Scenarios and comparators. The scenarios are ambiguous tie (near_tie), transient spike (transient_spike), mid-course reversal (mid_reversal), clean advantage (clean_commit), and intermittent advantage (intermittent). The measured configurations and internal comparators are the proposed method (full) and −hysteresis (${\Delta }_{\mathrm{floor}}=0$), −progress hardening ($k_{\rho }=0$), −accumulator (immediate argmin), simple dwell (a continuous-persistence, or debounce, timer in place of leaky accumulation: the challenger must be strictly better for 12 consecutive cycles (0.6 s), any interruption resets the count, and no margin is applied; it is not a post-switch minimum dwell combined with an improvement threshold of the kind in switching-system theory [20] or concurrent work [12]; comparison in Section 3.10), and a synthetic correspondence-loss stress comparator (historical CSV key: −class correspondence). This last comparator randomly selects a label when $|J_R-J_L|<0.10$ and otherwise uses argmin; it also lacks the accumulator, so it is not an isolated removal of class correspondence from COMPASS. Immediate argmin and simple dwell are separate comparator policies, whereas only −hysteresis and −progress hardening are knob-only core ablations. The −safety-override variant is equivalent to the proposed method in offline scenarios that contain no safety event (its effect lies in the collision regime), so it is excluded from this measurement set; its evaluation belongs to the physical-simulation evaluation (Appendix E). No external comparator is evaluated. In particular, the harness includes neither a previous-class consistency weight of the kind used by de Groot et al. [6] and SHINE [7], nor an opinion-dynamics passing rule [9], nor a dwell-plus-relative-improvement selector as in concurrent work [12]; the 0.6 s simple dwell is the only fixed-dwell rule tested. The results therefore do not show that evidence accumulation outperforms these mechanisms; that comparison is planned (Appendix E).

Decision-stream observer statistic. The offline observer statistic is computed by applying the Section 3.8 Bayesian observer to the decision stream, but because the offline harness has no realized trajectory, the observer here consumes the per-cycle committed passing side (the decision stream) as a proxy observation in place of the kinematic motion cues specified in Section 3.8, using log-odds updates to avoid posterior saturation, with a symmetric misread likelihood parameter $\epsilon$ — an assumed observation error probability, not separately sampled corruptions of the stream ($\epsilon =0.2$, $p^{*}=0.9$ in this measurement). This is an additional simplification of the Section 3.8 kinematic-cue observer (implementation: src/compass_eval/include/compass_eval/harness.hpp:170-239). The offline statistic is not $t_{\mathrm{legible}}$ with a fixed ${\Delta }_{\mathrm{hold}}$. We report the endpoint-suffix time$t_{\mathrm{sfx}}$: the first sample of the maximal final run of samples whose posterior for the final output side is at least $p^{*}$. A value is reported only if at least 0.30 s of observed follow-up follows that first sample; otherwise, including a crossing at the final sample, the trial is censored at the 10 s horizon. The 0.30 s follow-up length was chosen after the review of the log-odds-only version (PR 12) found 22 final-sample-only crossings; it was not preregistered, and no sensitivity over this length is reported. Because the suffix is anchored at the end of a finite log, $t_{\mathrm{sfx}}$ is neither a fixed positive-hold implementation nor a conservative bound on $t_{\mathrm{legible}}$. It measures the stability of the decision stream, not motion or human legibility; the kinematic-cue observer and human validation are left to the planned evaluation (Appendix E). The censoring rate is the fraction of trials with no reported $t_{\mathrm{sfx}}$ (right-censored).

Input and counting conventions. The archived scenario generator supplies unclipped Gaussian perturbations directly to step_evals; that distribution is not bounded almost surely. It is a scripted robustness experiment, not an empirical verification of P1/P2’s bounded-input hypothesis or the normalized production-cost path. Bounded deterministic/property tests provide separate software checks. All six policy streams use the same switch-count convention ${\sum }_{i=1}^{n-1}[s_i\ne s_{i-1}]$: the initialized class to first emitted output is excluded for every policy. Thus an argmin choice of L on its first output in clean_commit records zero subsequent transitions, not an absence of an initial decision. This boundary convention is retained for archived reproducibility and is distinct from the opportunity scorer’s response-event accounting.

Observer result versions. The original main snapshot at 9fe495a used probability-space updates, whose posterior rounds to exactly 1.0 and then absorbs later reversals. The log-odds-only observer (PR 12, 5343d457) is the saturation-only numerical correction. The current results additionally apply the post-hoc 0.30 s follow-up rule, a metric-definition change. All three versions are retained as raw CSVs in src/compass_eval/results/observer_versions/, together with a per-row comparison of the same 1,500 decision streams; each version column is regenerated from source and checked against its archive, and switch, sign-change and entropy columns are identical across versions. The numerical correction changes 200 rows (all become uncensored). The follow-up rule changes 47 further rows, all in the immediate-argmin and synthetic correspondence-loss comparators (all become censored); the proposed method and the two knob-only ablations are identical under both log-odds versions. These versions must not be pooled.

Standard-library dependence. The scenario generator draws its perturbations with std::normal_distribution, and the synthetic correspondence-loss comparator draws its random label with std::uniform_int_distribution. The C++ standard fixes the std::mt19937 sequence but leaves these distribution algorithms to the implementation, so the realized inputs depend on the standard library. All offline-harness values in this paper (R1 and R5, including those quoted in the abstract, introduction, figure captions and conclusion) are libstdc++ (GCC) results; the archived latency figures are a separate, machine-dependent measurement. Building the unchanged harness against LLVM libc++ (versions 18 and 23, Linux x86-64) changes 425 of the 1,500 rows. For the proposed method and the two knob-only ablations, the switch count, sign-change rate and entropy are identical in all 750 rows, and no encounter exceeds one switch; only $t_{\mathrm{sfx}}$ moves (full: 1.33 to 1.34 s). The comparator values move: immediate argmin goes from 29.74 to 30.22 switches per encounter, the synthetic correspondence-loss comparator goes from 37.20 to 37.24 switches with censoring 71/250 to 65/250, and one simple-dwell near_tie encounter gains a switch (0.00 to 0.02 per encounter). In R5 the switched fractions (50/50 up to 0.20 m/s, 0/50 from 0.35 m/s), and hence the blocking interval, are unchanged, and the mean $t_{\mathrm{sfx}}$ values move by at most 0.03 s. In this comparison the qualitative separation is therefore unchanged, but exact digits, including the proposed method’s $t_{\mathrm{sfx}}$, are specific to the library. The libc++ outputs are kept separately in src/compass_eval/results/stdlib_sensitivity/ and must not be pooled with the canonical results. An external rerun, documented in docs/reviews/omnilink-reproduction-2026-09-14.md, first exposed this dependence on the historical harness.

Metrics.

• Headline (directly tied to the contribution): decision-switch count per encounter (excluding safety-justified switches — here “safety-justified” is determined by the Section 3.5 safety-branch log, i.e., a safety-triggered switch fired by $c^{*}\notin \mathcal{S}$ at the safety branch of Algorithm 1; only switches marked by this log are excluded from the headline aggregate), lateral-command sign-change rate or decision entropy, legibility metrics (time-to-legible and illegibility rate (right-censoring rate) computed with the observer model of Section 3.8, plus the human judgments that the Planned Evaluation’s (Appendix E) user study will provide). Offline, only the decision-stream statistic $t_{\mathrm{sfx}}$ and its censoring rate are available.
• Delineation of what is measurable now. Of the headline items above, those computable from the decision stream (switch count, sign-change rate, decision entropy, and the $t_{\mathrm{sfx}}$ statistic with its censoring rate) are measured in this section (Section 4.2). Lateral jerk, which requires trajectory realization, and standard (safety/efficiency) metrics (success rate, minimum social distance, etc.), which depend on physical simulation, have their definitions and reporting protocols placed in the Planned Evaluation (Appendix E).

4.2. Main Results

Strongly confirmed findings. (i) Oscillation control (core claim). The immediate-argmin and synthetic correspondence-loss stress comparators produce about 98 decision changes per encounter in the ambiguous-tie scenario, whereas the proposed method maintains commitment at 0 (Figure 4; Table 2 and Table 3). The two distributions do not overlap in range (proposed method entirely 0 vs. −accumulator 98.16±7.85, non-overlapping observed ranges), so the observed separation is complete within these runs, not a statement about distributional support. Because the core separation in this offline measurement is categorical, a formal test would not change the conclusion, so we omit one here; Mann-Whitney U tests, effect sizes, and confidence intervals are reported for the physical performance metrics of the Planned Evaluation (Appendix E). The 0.6 s simple dwell also records 0 switches in near_tie (Table 3), so this separation shows that filtering suppresses tie-induced flips; it does not single out evidence accumulation. The two rules differ in transient_spike, mid_reversal and intermittent. (ii) Spurious-input suppression. In the transient-spike scenario, the proposed method has 0 switches (spike ignored), while argmin has 2 (entering and returning). The simple dwell has 2, because the 1 s spike outlasts its 0.6 s persistence window. (iii) Rapid commitment. In the clean-advantage scenario, the proposed method has 1 switch, with $t_{\mathrm{sfx}}$ 2.37 s. (iv) Decision-stream observer statistic. The oscillatory variants are frequently censored because the posterior fails to stabilize (argmin and synthetic −class censoring 72/250 and 71/250, respectively, under the post-hoc 0.30 s follow-up rule; near_tie$t_{\mathrm{sfx}}$ 7.9 s vs. 0.05 s for the proposed method; Table A3). This is a property of the scored label streams, not a measured human or motion legibility result.

4.3. Ablation Studies

Knob ablations: findings that diverged from the design-stage hypothesis (correction by measurement).−Hysteresis (${\Delta }_{\mathrm{floor}}=0$) and −progress hardening ($k_{\rho }=0$) showed no observed regression relative to the proposed method in these scenarios. Because the leaky accumulator’s threshold $E_0$ and leakage already reject zero-mean noise, the primary oscillation-suppression mechanism in this operating regime is not ${\Delta }_{\mathrm{floor}}$ or $k_{\rho }$ but the accumulator itself. In other words, the design-stage hypothesis, stated before measurement, that “−hysteresis → switch-count blowup” does not hold under the leaky-accumulator design, and this is a hypothesis correction provided by the ablation measurements. In intermittent, the proposed method switches once at 1.55–2.10 s across the 50 seeds (src/compass_eval/results/README.md) and has 0/50 censored trials, with mean $t_{\mathrm{sfx}}$ 4.11 s. The earlier report of 50/50 censoring resulted from floating-point posterior saturation, not a late-horizon switch. Computing the same observer in log-odds space removes this numerical absorbing state without changing the decision policy or observer likelihood; these intermittent values are identical under the saturation-only version and the current version, which additionally applies the separate post-hoc 0.30 s follow-up rule. In the same scenario, simple dwell never completes the justified switch because intermittent advantage keeps resetting the timer (0 switches), but because it remains in the initial class, it is scored immediately by the observer (0/50 censored, $t_{\mathrm{sfx}}$ 0.05 s) — a case where the observer statistic alone masks the switching failure. Simple dwell’s total censoring (50/50) occurs not in intermittent but in mid_reversal (after the mid-course switch, the posterior fails to re-stabilize by the end of the horizon), whereas in the same scenario the proposed method maintains commitment (0 switches) and is scored immediately with 0/50 censoring. However, the proposed method’s zero switches in mid_reversal is the flip side of this same masking effect: at the default knobs the accumulator does not track the late-horizon reversal within the 10 s log (in the scenario script the mean challenger advantage ramps linearly from $-0.25$ to $+0.25$, i.e., $5\times {\Delta }_{\mathrm{floor}}$, by the end of the horizon; verified at harness.hpp:56), and because the final label equals the initial label the observer scores the stream immediately. We report this as an observed outcome of this scripted experiment, not as a prediction of the analysis. Proposition 3 does not explain it: its response bound $N_{\mathrm{resp}}$ is an upper bound on the time to switch that applies only while a persistent advantage stays above some $D_{\mathrm{sus}}>{\Delta }_{\mathrm{floor}}$, and it gives no lower bound on response time, so the fact that the window in which the mean advantage exceeds the reachability level $0.23$ (Remark 11) is shorter than $N_{\mathrm{resp}}$ does not imply that no switch occurs. Its converse (no-switch) part needs an almost-sure upper bound $D_k\le \overline{D}$ with $(\overline{D}-{\Delta }_{\mathrm{floor}})dt\le (1-\lambda )L$ over the window, which the unbounded Gaussian perturbations ($\sigma =0.03$) of this scenario do not supply. A noiseless-ramp calculation therefore describes a different input and is not evidence about the noisy runs. Whether the zero-switch outcome is a missed warranted switch, and how long a response to it may take, can only be scored against an independently labelled opportunity with an onset and a response deadline (Appendix E), which this harness does not supply. The switch-count and observer columns here therefore neither confirm responsiveness nor establish a response failure; they are consistent with the conservatism cost noted in Section 3.4. Separately, and not as an explanation of this scenario, clip-induced lockout is a distinct, noise-independent mechanism: whenever $E_{\mathrm{th}}\left({\rho }_k\right)>e_{max}$ no discretionary switch can fire in that cycle regardless of the advantage (Remark 11); it applies to the $\rho$-rate sweep below, whereas mid_reversal keeps $\rho \le 0.5$ and $E_{\mathrm{th}}\le 0.375<e_{max}$ throughout. Finally, the $t_{\mathrm{sfx}}$ and censoring-rate figures in this section, obtained from the decision-stream observer of Section 4.1, measure the stability of the decision stream, not an independent axis of motion legibility, as already noted.

$\rho$-rate sensitivity and offline transition blocking. The effect of progress hardening depends strongly on the $\rho$ drive rate. Measuring in the scripted clean_commit decision-core harness while raising its progress input $v_{\mathrm{lat}}$ from 0.05 to 0.50 m/s, the proposed method always commits (Figure 5) (50/50, $t_{\mathrm{sfx}}\approx$ 2.4 s) for $v_{\mathrm{lat}}\le 0.20$ m/s, but switching is blocked (0/50) for $v_{\mathrm{lat}}\ge 0.35$ m/s. This is because a rapidly saturating $\rho$ raises $E_{\mathrm{th}}$ to $E_0(1+k_{\rho })=0.60$, blocking even justified switches — the clip obstruction in Proposition 3 gives a noise-independent blocking mechanism: with the scenario’s advantage of $+0.40$ the leak equilibrium is $(0.40-{\Delta }_{\mathrm{floor}})dt/(1-\lambda )=0.583<0.60$, in the noiseless constant-advantage model; independently, the clip bound $e_{max}=0.50<0.60$ blocks every discretionary switch after saturation regardless of noise, whereas in the same noiseless model at $\rho =0$ the advantage would switch within the upper bound $N_{\mathrm{resp}}=24$ cycles ($1.2$ s). The noisy runs are not covered by these noiseless calculations; whether the switch wins the race against the rising threshold before the clip lockout is what the sweep measures empirically; the offline transition-blocking interval is $v_{\mathrm{lat}}\in (0.20,0.35)$ m/s. This is a sensitivity of the scripted input and the core’s former simplification $v_{\mathrm{lat}}=\left|v_{\mathrm{cmd}}\right|$; it does not demonstrate robot immobility, physical freezing, or goal failure. It motivates separating measured cross-track progress from forward speed (compass_eval/results/R5_rho_sweep.md).

4.4. Real-Time Performance and Enumeration Complexity

Enumeration complexity (analytical bound). The current core enumerates $2^K$ labels with $K=min(N_{\mathrm{people}},K_{\mathrm{cap}})$ and evaluates each candidate before forming its safe set. At the default $K_{\mathrm{cap}}=3$, that is at most eight labels. This is a configured enumeration bound, not evidence that influence ranking, coarse group merging, or a particular pruning distribution has been implemented. The cost of each evaluation also depends on rollout samples, people, and environment queries; the distribution of the resulting $|{\mathcal{S}}_k|$ in physical scenes remains unmeasured. The ideal pruning/lifecycle design in Section 3.2 is not a reason to treat the present loop as evaluating only already-safe classes.

$K_{\mathrm{cap}}$ operating rule. The current implementation retains the first $K_{\mathrm{cap}}$ people in input order as explicit class dimensions, with default value 3. It does not compute an influence ranking or merge overflow people into coarse classes. Input selection and ordering therefore matter. Person-cost and safety queries can still examine the supplied people beyond those label dimensions, but that is not a guarantee of a realized passing-side relationship for them.

Historical finite-batch timing. The archived compass_eval latency experiment measured DecisionCore::step on an AMD Ryzen 5 5500GT with Radeon Graphics for 20,000 iterations per condition, using all $2^K$ enumerated labels and an all-safe environment fixture. The observed p99/max pairs (Table 4) are 2.6/153.6 $\mu$s at $K=1$, 7.9/356.1 $\mu$s at $K=2$, and 58.6/651.3 $\mu$s at $K=3$. The largest observed maximum is about 1.30% of a 50 ms (20 Hz) period. These are finite-batch measurements, not a proven worst-case execution-time (WCET) bound or an upper bound on deployment latency. The loop evaluates the enumerated candidates before constructing ${\mathcal{S}}_k$; its work also depends on all supplied people, rollout samples, and environment-query costs, not only $|{\mathcal{S}}_k|$. Limiting explicit label dimensions does not independently bound all these costs. This historical measurement does not benchmark the new candidate adapter, live costmap access or the end-to-end ROS 2 pipeline (callbacks, TF, controller dispatch, DDS/executor jitter). Those timings and the physical-scene safe-set distribution remain separate evaluation targets.

5. Discussion and Limitations

What the Guarantees Cover. The temporal-consistency claim of COMPASS rests on P2, a deterministic and pathwise lower bound on the interval between discretionary switches that needs only the range bound of the normalized cost and the declared non-vacuity condition (22); P1(ii) sharpens it to exponential rarity only under an i.i.d. hypothesis that stationarity alone does not supply (Remark 3). Because P2 is satisfied by a policy that never switches, it is paired with the conditional response-time bound of Proposition 3, and the ablations show both sides of that pairing in data: the leaky accumulator suppresses argmin oscillation in near_tie, while at the same default knobs the late reversal in mid_reversal is not tracked within the log (an observed outcome that the response bound does not predict, and that only an independent opportunity oracle could score as a miss) and the fast-saturating progress input of Figure 5 triggers clip-induced lockout (Section 4.3). P3 and P5 are branch-priority and guard contracts, not physical collision-freedom or termination guarantees (Propositions 4 and 6). P1 and P2 apply standard CUSUM/queueing and dwell-time arguments, P3 and P5 are branch-priority and guard contracts, and P4 is a progress-rate and accumulator-containment argument (Section 2 and Section 3.7); none is new mathematics, and their value lies in stating, for this rule, the assumptions under which each holds.

Cost Analysis. The historical decision-core timing of Table 4 leaves the per-cycle decision computation well inside a 20 Hz period at the default $K_{\mathrm{cap}}=3$, but it is a finite-batch measurement of DecisionCore::step only; the candidate-trajectory adapter, live costmap access, and the end-to-end ROS 2 pipeline are not timed (Section 4.4).

Limitations. (i) The planar (2D) assumption means multi-level or sloped environments are not handled. (ii) Constant-velocity Kalman prediction is strong in the short term but has limits under abrupt intent changes or multi-modal crowds (a learning-based predictor can be substituted as an interchangeable input, Section 2). (iii) Front/rear passing is handled only as cost and is not separated into distinct classes. (iv) The empirical scope of this paper is limited to the decision layer. Behavioral consistency, the decision-stream observer statistic, and per-cycle latency were measured with an offline harness driving the actual decision core (Section 4.2, Section 4.3 and Section 4.4), but performance metrics requiring physical simulation (success rate, collision, minimum social distance), the external baselines, and the user study have not yet been measured in this evidence set; their protocols have been fixed in advance in the Planned Evaluation (Appendix E), with per-case values still to be bound before any run. Meanwhile, the ablations showed that the leaky accumulator, rather than the margin or progress hardening, is the primary oscillation-suppression mechanism (removing −hysteresis or −hardening alone produced no regression in this regime), and revealed an offline transition-blocking interval for the scripted $\rho$ drive rate ($v_{\mathrm{lat}}\in (0.20,0.35)$ m/s), not a physical freezing threshold. (v) No consistency-weight, opinion-dynamics or closed-loop comparison. The comparators are internal (immediate argmin, simple dwell, knob ablations and a synthetic correspondence-loss stress comparator). The most direct missing baseline is a previous-class consistency weight [6,7] applied to exactly the same candidates and cost streams; opinion-dynamics passing [9] and dwell-plus-relative-improvement selection [12] are further baselines. None of these was run and no closed-loop simulation was performed, so the offline results show only that the implemented rule filters scripted, noisy decision-label streams; whether it improves on these mechanisms, or on navigation outcomes, is untested. These comparisons are part of the planned evaluation (Appendix E). (vi) Strength of the guarantees. At the default knobs the worst-case separation guaranteed by P2 is short: 3 cycles (0.15 s; Remark 10), fewer than the 12 cycles (0.6 s) enforced by a fixed dwell timer such as the simple-dwell comparator of Section 4; P1 relies on an i.i.d. hypothesis that temporally correlated social costs need not satisfy (Remark 6), and a policy that never switches satisfies P2; the guarantees are contracts about the decision rule, not evidence of legible or effective navigation. The current contribution is therefore the conditional decision-rule design and formal properties together with offline empirical validation of decision-layer consistency; physical performance, external comparison, and human-data validation are to be filled in subsequently according to the protocol of Appendix E.

Generalization limits (P4, actuation, sensing). P4’s guarantee of maneuver completion depends on $v_{\mathrm{lat},\min }>0$ in Assumption A1(d), which presupposes the following. (i) Actuation type. For nonholonomic drives (differential, Ackermann), cross-track progress is realized only as the product of forward speed and steering, so $v_{\mathrm{lat},\min }>0$ requires positive forward speed and forward clearance. That is, if the robot stops or the front is blocked, the lateral progress rate becomes 0, breaking P4’s premise, and the safety layer (P3, P5) takes over. For holonomic (omnidirectional) drives, direct lateral motion is possible even while stationary, relaxing this premise. (ii) Footprint. The corridor-width and pruning analysis in this paper assumes a circular footprint approximation; a rectangular footprint (an elongated body) has an occupied area that varies with orientation during rotation, which can make corridor-availability determination and the realization of $v_{\mathrm{lat},\min }$ more conservative. (iii) Dependence on forward speed. As noted in (i), $v_{\mathrm{lat},\min }>0$ depends on forward speed, so in congested environments with frequent low-speed or stopped intervals, the upper bound K on maneuver-completion time increases. (iv) Sensor modality. This design receives person tracking, F-formation, and vulnerable-pedestrian attributes from external modules; 2D-laser-based tracking has weak heading and attribute estimation, whereas depth/RGB-D-based tracking is richer. The quality of ${\sigma }_{\mathrm{front}}/{\sigma }_{\mathrm{rear}}$ regime determination and of group/attribute recognition therefore depends on sensor modality, and the guarantees of this paper’s decision layer hold on the premise that these inputs are of adequate quality.

Ethical limitations. The vulnerable-pedestrian handling of Section 3.9 relies on external attribute classification, which carries risks of bias, privacy, and stigma. This paper specifies only a policy of choosing conservative defaults under uncertainty and does not claim the fairness of the classifier itself as a contribution, and it explicitly notes that a separate ethics and privacy review is needed for real deployment.

Future work. Carrying out the Planned Evaluation (Appendix E) — physical-simulation performance metrics, independently tuned comparison against the external baselines, and validating time-to-legible against human data via the user study — is the top priority; beyond that, we propose extending front/rear passing into explicit classes via spatiotemporal $(x,y,t)$ homotopy, and combining the approach with learning-based prediction.

6. Conclusions

This paper proposes a decision-layer planner for social navigation that treats the temporal consistency of passing decisions as a first-class objective, combining an ID-indexed, cross-cycle-correspondent representation of class (a design contract that the current implementation only partly realizes) with a commitment switching rule based on leaky evidence accumulation — a rectified, leaky variant of Page’s one-sided CUSUM statistic [15] with a progress-dependent threshold — and a lexicographic safety override of the standard priority-arbitration kind. We state five properties (P1–P5): P1 and P2 follow from standard CUSUM/queueing and dwell-time arguments, P3 and P5 are branch-priority and guard contracts, and P4 is a progress-rate and accumulator-containment argument; none is new mathematics. The anti-oscillation guarantee we claim is the deterministic, pathwise inter-switch bound P2 — at least $N_{min}=\lceil E_{\mathrm{th}}\left(\rho \right)/\left((D_{max}-{\Delta }_{\mathrm{floor}})dt\right)\rceil$ cycles between discretionary switches for fixed $dt$ (for variable measured intervals, as in the Nav2 adapter, only the accumulated-time form is claimed; Remark 9), zero post-switch evidence, and a range bound on the challenger advantage, informative under the declared condition $E_0>(D_{max}-{\Delta }_{\mathrm{floor}})dt$ that the default knobs satisfy — paired with the conditional response-time bound of Proposition 3: its deadline requires the same eligible challenger to remain selected, uninterrupted updates without reset or HOLD, a sustained advantage lower bound, and sufficient clip/leak-equilibrium headroom. P1 states the sharper probabilistic form — a per-cycle switching probability and per-unit-time switching rate exponentially small in ${\theta }^{*}{E}_0$, obtained by dominating the rule with the Lindley (CUSUM) recursion and applying Kingman’s bound, with ${\theta }^{*}$ the exact Lundberg root of the increment law (the closed form ${\theta }^{*}\approx 2{\Delta }_{\mathrm{floor}}/\left({\sigma }_D^{2}dt\right)$ is tuning guidance only, and the per-unit-time bound carries a factor of $1/dt$) — as a refinement conditional on an i.i.d. hypothesis on the challenger advantage, since bare stationarity with zero mean and bounded variance admits a counterexample that defeats the exponential form. We also prove P4 on top of the dynamics of progress $\rho$, a lower bound on lateral progress rate, and a containment condition on the challenger accumulator $e^{\mathrm{rev}}$ ($\overline{\rho }$). In particular, the switching dynamics close over the single-challenger accumulator of Section 3.4/Section 3.6, and the two-sided condition on its reachable upper bound $E_0<e_{max}^{\mathrm{rev}}<E_0(1+k_{\rho })$ — the lower bound providing algebraic reachability headroom at $\rho =0$ and the upper bound being P4 containment — replaces any above-threshold headroom requirement $e_{max}>E_0(1+k_{\rho })$, which would contradict P4 containment; the reachability-headroom condition is necessary for any discretionary switch from zero evidence but is not by itself a liveness guarantee, since actual response also requires the persistent-selection, uninterrupted-update and advantage hypotheses of Proposition 3, and the clip $e_{max}$ can separately lock out switching at high progress. On the empirical side, using an offline harness that drives the actual decision core, we measured anti-oscillation behavior (about 98 oscillations per encounter in the ambiguous-tie scenario for the immediate-argmin comparator, vs. 0 for the proposed method and also 0 for the 0.6 s simple dwell, so that scenario separates filtering from no filtering; the accumulator and the dwell differ in the transient-spike, mid-reversal and intermittent scenarios), a decision-stream observer statistic ($t_{\mathrm{sfx}}$ and its right-censoring rate; not a validated legibility measure), and real-time performance ($K=3$ p99 58.6 $\mu$s, max 651.3 $\mu$s; the max is about 1.30% of the 20 Hz budget) (Section 4.2 and Section 4.4), and also obtained, by measurement, an offline transition-blocking sensitivity interval for progress hardening ($v_{\mathrm{lat}}\in (0.20,0.35)$ m/s); this is not a physical freezing threshold. The comparison that would test whether evidence accumulation improves on existing mechanisms — previous-class consistency weights [6,7], opinion-dynamics passing [9] and, in concurrent work, dwell-plus-relative-improvement selection [12] — and closed-loop evaluation remain planned (Appendix E).