* test_onroad: chestnut usb unplug fallback
* test_onroad: fix chestnut unplug test
* test_onroad: chestnut fallback
* check that small model is running
* fix small model check
(cherry picked from commit 043759da3627803304956abbab4d10341cee8328)
Release inherited Params locks correctly across fork and exec. Preserve qualified lateral armed intent through temporary faults, restore the Big UI CEM gauge, improve speed typography, and hide unavailable CEM initialization text. Include matching device artifacts and focused regression coverage.
Keep existing ordinary controls under the normal soft-disable countdown when current vehicle data and native permissions remain healthy. Preserve original command deadlines and qualify retained steering intent against completed publication provenance.
Evaluate the existing active-axis and source-age predicates before the
pure vehicle qualification predicate. Preserve the same captured clock,
branch body, deadlines, native permission checks and output behavior.
Validation: 39 exact owner-output/clock comparisons, 1728 Capnp cases,
and 851 broad plus 70 rebased functional passes. An unchanged Card-only
host timing test failed in aggregate and passed isolated without importing
SelfdriveD; retain that performance limitation rather than claim all-green.
One qualification call is removed on the healthy fixture path. Host timing
benefit is small/noisy and is not evidence that road stalls are fixed.
Update protected source inventory receipt.
Use the existing settings worker for proactive conditional-mode source
verification. Adopt one immutable snapshot per Card frame, with verified
age strictly below 500 ms. Busy, invalid, or stale snapshots defer
conditional proposals without disengaging ordinary control or AOL.
Preserve fresh per-request SafeMode and gesture mapping checks. Replay
retains its source-clock synchronous owner. Polling phase changes; no
blanket one-second cached permission is added.
Validation: 353 aggregate tests, independent boundary and actual-control
continuity checks, exact source imports and inventory receipt verification.
Measured conditional source reads on main drop from 36 to zero over a
three-second initialized fixture; worker reads increase proactively.
This removes a blocking path, not a demonstrated cure for all road stalls.
Enable compact Card phase capture for qualified Ioniq6 production runs,
including unlatched ordinary control. Record publication gaps, source and
receive clocks, thread CPU, settings-worker context, and latch-clear reasons.
Add bounded SelfdriveD phase, admission, original-proof and Ratekeeper
snapshots with off-thread reporting and suppression counters. Preserve
control predicates, original deadlines, thresholds and scheduling policy.
Validation: 583 combined tests pass on unchanged rerun; an initial host
wall-time microbenchmark failure and isolated pass are retained. Exact-source
import audits and independent review pass. Host overhead is measured, not
a target-device bound. This adds diagnostics, not a producer-lag fix.
Update protected source inventory receipt.
Use the same post-drain clock for source-expiry deferral and intent
admission, avoiding premature state disable when draining crosses the
source freshness cutoff. Preserve the original proof and deadline.
Add cutoff, follow-through, and restrictive-input regression coverage.
Update the protected source inventory receipt.
Validation: 416 focused aggregate tests and 79 independent boundary and
restriction checks; exact source import audits, Ruff, and ty pass.
This addresses a reproduced admission race, not underlying producer lag.
Exclude HYUNDAI_IONIQ_6 from the recent Hyundai CAN-FD highway friction wrapper, restoring original friction threshold/error passthrough in both controller modes. Preserve all steering limits, ramp rates, startup PID settings, scalar calibration, other vehicles, native assets and dropout repairs.
Update regression expectations and add exact Ioniq friction passthrough coverage. Focused suite: 22 passed; 559 repository Python imports match exact parent plus the three intended files. Independent numerical checks: 80,640 comparisons. Protected inventory receipt independently verified. This is the user-requested tuning revert, not a lag fix or on-device qualification.
Recognize the existing qualified Ioniq lateral-only held-brake override when checking fresh-source renewal after an old output deadline. Exempt only recurring pedalPressed USER_DISABLE; retain new physical edges, other disable events, source/intent/session validation, native permission checks, and all expired-output enforcement. Do not extend leases or reenable longitudinal control.
Add 28 owner/Controls/Card regression cases and update two old held-brake handoff expectations. Clean serial focused suite: 369 passed; independent adversarial review: 56 passed. Exact parent import inventory and protected receipt verified. Host validation is not device/road qualification; separate lag and producer-stall failures remain under investigation.
Do not gate nonblocking carState reconciliation on an old output packet's deadline. Process queued physical samples once before selected-source owners and the state-machine decision; retain the existing total 32-envelope bound, freshness/native/intent checks and no blocking wait beyond the old deadline.
Controlled route52-shaped retained-timeout schedules reproduce stale-selected-carState/fresh-intent rejection on the parent, including ordinary unlatched critical disable. Candidate consumes the fresh pair before deciding. 341 focused tests and 84 independent adversarial cases passed; exact-source import audit, Ruff, type and inventory checks passed.
No lease extension, scheduling rewrite or native artifact change. Separate Card production gaps remain unproven fixed.
Check bounded retention after event processing before source-expiry handling mutates authority. Preserve only the original unexpired proof for one normal tick; track all intent drains in the step so a later empty drain cannot conceal an intermediate deny.
Preserve fd14 fresh-owner continuity semantics and reconcile five legacy test expectations. Add early handoff and engagement/deny recovery regressions. 239 distinct focused tests and 277 platform tests passed; Ruff, type checks and exact-source import/inventory audits passed.
No native artifacts or lease extensions. This does not establish a fix for the separate measured Card production stall.
Keep an existing unexpired axis proof for one normal iteration when the selected source expires at publication, without renewing the proof or re-running stateful owners. Preserve physical overrides, restrictive intents, original deadlines and alerts; reject stale construction-time publication.
Add 79 owner-chain cases and refresh the protected source inventory. 183 focused tests, lint and type checks pass. Longer Card producer stalls remain outside this fix.
Daniel Koepping