Adaptive channel migration 4/5: conservative autonomous migration policy

[josephnef]

Summary

Allow the recommendation engine from #277 to initiate the proven migration protocol from #278 automatically under conservative, configurable policy. Preserve stable single-channel video as the normal state; migrations are exceptional events with hysteresis, cooldown, rollback, and an operator kill switch.

Experiment 4 of 5; blocked by #278's ≥1,000-cycle reliability and bounded-recovery gate.

Control policy

Automation may submit a proposal only when all are true:

1. primary video delivery/FEC margin is persistently impaired;
2. primary/scout telemetry is healthy and time-synchronized enough;
3. a legal candidate has sufficient recent complete-width observations;
4. candidate improvement exceeds a configured margin with confidence;
5. impairment is not broad-band, weak-link-only, receiver saturation, USB loss, or scout failure;
6. cooldown/migration-rate limits permit a move;
7. no migration/recovery generation is already active.

The drone retains final commit authority and all validation from #278.

Step-by-step

• Add an explicit opt-in mode (off, advisory, manual, automatic) defaulting to off or advisory; expose current mode in every decision/migration event.
• Implement a pure automation gate over versioned recommendation evidence. Pin initial conservative defaults: multiple bad windows, multiple full scan rounds, improvement/confidence minimums, evidence max age, long cooldown, daily/session move cap, and one migration in flight.
• Add fault-domain classification so channel migration is not used to "fix" low wanted-signal level, broad interference, receiver saturation, thermal/USB failure, invalid counters, or loss caused after the decoder/transport.
• Require a currently verified fallback/rescue channel and enough control-link margin to complete proposal/commit. If the current control path is failing, prefer recovery behavior over an unconfirmed move.
• Freeze the evidence generation used by a proposal; if candidate conditions materially change before commit, abort and rescore rather than silently changing target.
• After successful migration, enter probation. Require stable destination delivery before marking it preferred; otherwise invoke Adaptive channel migration 3/5: authenticated manual proposal, commit, verify, and rollback #278 rollback. Keep old-channel scout evidence fresh during probation.
• Add anti-oscillation state: minimum residency, channel-specific failure penalty/hold-down, exponential backoff after rollback, candidate diversity/tie-breaking, and broad-degradation hold.
• Add operator controls: global disable, inhibit-until, pin channel, approve-next-only, force rollback/rescue, and inspect exact policy reason. Operator actions must be authenticated/audited where remote.
• Persist bounded channel history and calibration identity for diagnostics, but start each process in a safe explicit mode and invalidate stale in-flight generations.

Simulation and replay tests

• Parked interferer appears/remains/disappears.
• Bursty interference straddles threshold and scan timing.
• Interferer follows each migration (herding).
• Two candidates alternate rank.
• All channels degrade together.
• Drone flies out of range with clean spectrum.
• Ground receiver saturates near another transmitter.
• Scout disconnects, stalls, or reports invalid/stale counters.
• Current channel recovers while commit is pending.
• Destination becomes occupied between recommendation and activation.
• Repeated rollback and session move-cap exhaustion.

Compare automatic decisions against recorded operator/manual outcomes from #277/#278. Policy code must remain deterministic for a fixed event trace.

Hardware validation ladder

1. Automation enabled with migration transport replaced by a recorder (shadow actuation).
2. Attenuated bench with controlled interferer and automatic old→new migration.
3. Bad destination and automatic rollback.
4. Bursty/adjacent/broad-band cases that must hold.
5. Moving/herding interferer; verify cooldown and bounded migration rate.
6. Long-duration video run with ordinary Wi-Fi traffic and no injected fault; quantify false moves.
7. Supervised field test with immediate operator inhibit/rescue control.

Metrics

• impairment onset to proposal/commit/recovery;
• video outage and FEC recovery time;
• delivery/goodput before and after;
• successful, unnecessary, failed, and rolled-back moves;
• oscillations and moves/hour;
• time spent impaired while correctly holding;
• false moves during clean long-duration control;
• control overhead and scout power/USB cost.

Acceptance criteria

• Default behavior remains unchanged unless automation is explicitly enabled.
• Deterministic tests cover every scenario and policy reason.
• Controlled persistent interference triggers one successful migration and improves measured delivery.
• Weak-signal, broad-band, saturation, stale-scout, and transient-burst cases do not trigger inappropriate migration.
• Bad destinations recover through bounded rollback with no persistent split-brain.
• Long-duration control establishes and documents a low false-migration rate and no oscillation.
• Operator disable/pin/rescue works during every protocol phase.