# 决策融合状态机

> 本页由仓库源文件生成。请不要直接编辑本页；修改下方 source 文件后运行 `vp run docs:generate`。

> 中文支持说明：本页是中文站点镜像，保留论文标题、证据状态和来源字段的原始表述，避免未经核实的翻译改变证据边界。

> 来源: `system/state-machine.md`

## Decision Fusion State Machine

Status: `runtime binding draft`

This state machine specifies the proposed `SAH-BRI-Grasp` runtime control logic. It is an implementation-facing design artifact, not evidence of tested performance.

## Evidence Boundary

* Shared-autonomy arbitration is evidence-motivated by `SA-001`, `SA-002`, `BRI-002`, and `BRI-004`.
* SSVEP target selection is evidence-motivated by `SSVEP-001`, `SSVEP-003`, `SSVEP-004`, `SSVEP-005`, `SSVEP-007`, and `SSVEP-010`, but object-bound dynamic target performance remains unverified.
* MI mode control is evidence-motivated by `MI-005`, `MI-006`, `MI-008`, and `BRI-004`, but project-specific no-control false activation remains unverified.
* Robot execution must keep object detection separate from grasp-pose planning and hand-eye calibration, following `GRASP-001`, `GRASP-005`, `GRASP-006`, and `GRASP-007`.

All thresholds, durations, confidence criteria, and physical safety parameters are `needs confirmation` and must be loaded from `experiments/templates/threshold-freeze-record.md` before evidence-producing sessions.

## Runtime Records

This state machine consumes and emits records defined in `system/runtime-interfaces.md`, especially:

* candidate freeze sets;
* stimulus bindings;
* SSVEP decisions;
* MI decisions;
* fused intents;
* robot plans;
* robot executions;
* verification results;
* safety gate results.

## Runtime Binding

The canonical runtime trace is the JSONL event log defined in `system/runtime-interfaces.md`. State transitions must reference `record_id` values from that log rather than relying on middleware-specific message IDs. Middleware adapters may publish the same records to ROS or a local process bus, but the JSONL log is the evidence source for analysis and replay.

## State List

| State | Purpose | Entry Output | Exit Condition |
| --- | --- | --- | --- |
| `Idle` | wait for session start or operator reset | session-ready record | start command and preflight pass |
| `PreflightCheck` | verify hardware, protocol, calibration, thresholds, and logs | safety gate results | all required records present |
| `SceneScan` | acquire frames and detections | vision frames, detections | candidate generation possible |
| `CandidateGeneration` | track and score selectable objects | candidates | enough eligible candidates or timeout |
| `CandidateFreeze` | freeze candidate set for SSVEP binding | candidate freeze set | freeze set accepted |
| `TargetSelection` | decode SSVEP over bound candidates | SSVEP decisions | accepted selection or rejection route |
| `TargetLocked` | bind selected candidate as current target | fused intent | confirmation required or direct planning allowed |
| `SelectionConfirmation` | accept MI/SSVEP confirmation, cancel, pause, or no-control | MI/SSVEP decisions, fused intent | confirmed, canceled, paused, or rejected |
| `ApproachPlanning` | plan robot-safe pregrasp/approach | robot plan | plan accepted or failed |
| `ApproachExecution` | move only when plan and safety gates pass | robot execution | reached pregrasp, aborted, or stopped |
| `GraspPointConfirmation` | optionally confirm grasp point or action | fused intent | confirmed, canceled, paused, or rejected |
| `GraspExecution` | execute grasp attempt | robot execution | completed, aborted, or stopped |
| `Verify` | verify task/grasp outcome | verification result | success, recoverable failure, or terminal failure |
| `Success` | completed trial | trial outcome | reset or next trial |
| `Pause` | hold motion and wait for operator/user action | pause record | resume, cancel, or emergency stop |
| `Cancel` | cancel current target/action and return safely | cancel record | return to scan or idle |
| `Recovery` | recover from target loss, low confidence, or failed plan | recovery record | retry route or abort |
| `EmergencyStop` | stop all robot motion immediately | emergency record | manual reset only |

## Event List

| Event | Source | Notes |
| --- | --- | --- |
| `start_session` | operator/runtime | requires session record |
| `preflight_passed` | safety gate | hardware/protocol/calibration as applicable |
| `frame_received` | vision source | begins scan/update cycle |
| `detections_ready` | object detector | feeds candidate manager |
| `candidates_ready` | candidate manager | enough eligible candidates |
| `freeze_set_ready` | candidate manager | candidate set ready for stimulation |
| `ssvep_selection_accepted` | SSVEP decoder/fusion | selected candidate passed gates |
| `ssvep_selection_rejected` | SSVEP decoder/fusion | low confidence, artifact, conflict, or target loss |
| `mi_confirm` | MI decoder/fusion | confirmation command accepted |
| `mi_cancel` | MI decoder/fusion | cancel command accepted |
| `mi_pause_or_stop` | MI decoder/fusion | pause/stop command accepted |
| `no_control` | MI decoder/fusion | no accepted action |
| `plan_ready` | robot planner | plan generated and checked |
| `plan_failed` | robot planner | no safe/valid plan |
| `execution_complete` | robot executor | robot action finished |
| `verification_success` | verification module | task success criterion passed |
| `verification_failed_recoverable` | verification module | retry or refreeze allowed |
| `verification_failed_terminal` | verification module | abort trial |
| `safety_block` | any safety gate | route by severity |
| `emergency_stop` | operator/runtime/safety | terminal until manual reset |

## Nominal Flow

```text
Idle
-> PreflightCheck
-> SceneScan
-> CandidateGeneration
-> CandidateFreeze
-> TargetSelection
-> TargetLocked
-> SelectionConfirmation
-> ApproachPlanning
-> ApproachExecution
-> GraspPointConfirmation
-> GraspExecution
-> Verify
-> Success
```

## Transition Table

| From | Event | Guard | Action | To |
| --- | --- | --- | --- | --- |
| `Idle` | `start_session` | session record exists | initialize logs | `PreflightCheck` |
| `PreflightCheck` | `preflight_passed` | required session, protocol, schema, thresholds, logs, and calibration records present as applicable | emit preflight pass | `SceneScan` |
| `PreflightCheck` | `safety_block` | missing required record | emit preflight block | `Idle` |
| `SceneScan` | `detections_ready` | detector output available | update candidate tracks | `CandidateGeneration` |
| `CandidateGeneration` | `candidates_ready` | eligible candidate count and stability gates pass | create freeze set | `CandidateFreeze` |
| `CandidateGeneration` | `safety_block` | no eligible candidates or target loss | log reason | `Recovery` |
| `CandidateFreeze` | `freeze_set_ready` | freeze duration/configuration valid | bind SSVEP stimuli | `TargetSelection` |
| `TargetSelection` | `ssvep_selection_accepted` | decoder confidence and consistency gates pass | emit selected target intent | `TargetLocked` |
| `TargetSelection` | `ssvep_selection_rejected` | low confidence, artifact, or conflict | log rejected decision | `Recovery` |
| `TargetLocked` | `mi_confirm` | confirmation policy requires MI and MI passes | emit confirmed intent | `ApproachPlanning` |
| `TargetLocked` | `ssvep_selection_accepted` | confirmation policy allows SSVEP-only confirmation | emit confirmed intent | `ApproachPlanning` |
| `TargetLocked` | `mi_cancel` | cancel accepted | emit cancel | `Cancel` |
| `TargetLocked` | `mi_pause_or_stop` | pause/stop accepted | emit pause or stop | `Pause` |
| `SelectionConfirmation` | `mi_confirm` | confirmation accepted | emit confirmed intent | `ApproachPlanning` |
| `SelectionConfirmation` | `mi_cancel` | cancel accepted | emit cancel | `Cancel` |
| `SelectionConfirmation` | `no_control` | no-control accepted | keep target locked or timeout by policy | `SelectionConfirmation` |
| `ApproachPlanning` | `plan_ready` | transform, reachability, and collision gates pass | emit robot plan | `ApproachExecution` |
| `ApproachPlanning` | `plan_failed` | invalid transform, unreachable target, or collision risk | log planning failure | `Recovery` |
| `ApproachExecution` | `execution_complete` | pregrasp reached | verify target still valid | `GraspPointConfirmation` |
| `ApproachExecution` | `safety_block` | motion safety gate failed | stop or hold | `Pause` |
| `GraspPointConfirmation` | `mi_confirm` | grasp/action confirmation accepted | emit grasp intent | `GraspExecution` |
| `GraspPointConfirmation` | `mi_cancel` | cancel accepted | emit cancel | `Cancel` |
| `GraspExecution` | `execution_complete` | grasp action finished | request verification | `Verify` |
| `Verify` | `verification_success` | task/grasp success criterion passes | emit trial success | `Success` |
| `Verify` | `verification_failed_recoverable` | retry budget and safety gates allow recovery | emit recovery action | `Recovery` |
| `Verify` | `verification_failed_terminal` | terminal failure or retry budget exhausted | emit trial failure | `Cancel` |
| any nonterminal state | `mi_pause_or_stop` | accepted stop/pause command | hold motion and log state | `Pause` |
| any nonterminal state | `emergency_stop` | emergency command or safety severity emergency | stop robot motion | `EmergencyStop` |

## Safety Gate Matrix

| Gate | Applies Before | Blocks To | Status |
| --- | --- | --- | --- |
| protocol/session completeness | `PreflightCheck` | `Idle` | needs confirmation |
| hardware inventory completeness | `PreflightCheck` | `Idle` | needs confirmation |
| hand-eye calibration validity | physical `ApproachPlanning` | `Idle` or `Recovery` | needs confirmation |
| detector confidence | `CandidateGeneration` | `Recovery` | needs confirmation |
| candidate stability/loss | `CandidateFreeze`, `TargetSelection` | `Recovery` | needs confirmation |
| SSVEP confidence/consistency | `TargetSelection` | `Recovery` | needs confirmation |
| MI no-control and false activation | `SelectionConfirmation`, any override | `Pause` or stay | needs confirmation |
| intent conflict | `DecisionFusion` | `Pause` | inferred |
| transform validity | `ApproachPlanning` | `Recovery` | inferred |
| reachability/collision | `ApproachPlanning`, execution states | `Pause` or `EmergencyStop` | inferred |
| operator stop | any nonterminal state | `Pause` or `EmergencyStop` | system requirement |

## Recovery Routes

| Failure | Preferred First Route | Escalation |
| --- | --- | --- |
| no candidates | rescan scene | cancel trial |
| target lost before selection | regenerate candidate set | cancel trial |
| low SSVEP confidence | repeat selection with same freeze set if valid | regenerate candidate set |
| MI no-control | remain in confirmation state | timeout to pause |
| conflicting SSVEP and MI | pause and request confirmation | cancel trial |
| invalid transform | pause and require calibration check | cancel physical trial |
| planning failure | try alternate grasp/approach if configured | cancel trial |
| execution safety block | pause | emergency stop by severity |
| grasp verification failure | retry if allowed and safe | cancel trial |

## Logging Requirements

Every transition must log:

* source state;
* event;
* guard result;
* threshold record used;
* runtime record IDs consumed;
* runtime record IDs emitted;
* destination state;
* failure or rejection reason when applicable.

Trial logs must preserve failed, rejected, safety-blocked, and timed-out transitions. Successful grasp attempts alone are not sufficient evidence.