firmware: fail closed occupancy and stabilize C6 temporal sensing

[ruvnet]

Outcome

This change prevents ESP32 person count evidence from contradicting the debounced presence gate and gives temporal filters the measured sample clock they actually receive.

Changes

1. Enforce presence=false implies n_persons=0 in firmware and repeat the invariant in the sensing server for older nodes.

2. Expose person count validity to WebSocket and node inventory consumers instead of silently accepting contradictory evidence.

3. Replace the fixed edge sample rate assumption with timestamp window measurement and filter retuning.

4. Separate the raw CSI network cadence from the C6 Tier 2 DSP cadence. Raw delivery remains independent. C6 defaults to the physically sustained 8 Hz DSP rate. S3 remains at 20 Hz.

5. Make connected station probing configurable from 10 through 50 Hz with a hard 50 Hz safety ceiling.

6. Use the selected OTA partition size rather than a stale fixed image ceiling.

7. Add ADR 346, ADR 347, focused host tests, and two physical validation records.

Measured validation

Physical target: ESP32 C6 QFN40 revision 0.2, logical node 4, firmware 0.8.8.

1. Five minute serial burn in: 300 controller ticks, raw mean 34.92 pps, range 22 through 41 pps, DSP 8.00 Hz throughout.

2. Device stability: zero ENOMEM, UDP send failures, other steady state errors, watchdogs, panics, or reboots.

3. Five minute sensing WebSocket run: 26,786 frames, zero JSON parse errors, zero reconnects, 97.62 percent node 4 coverage, maximum node 4 age 176 ms, maximum frame gap 110 ms, and zero fused presence count contradictions.

4. Occupancy qualification: 242 edge packets, including 61 absent packets, with zero presence=false and nonzero person count contradictions after the fix.

5. Firmware host tests: 59 assertions passed across rate estimation, occupancy evidence, ADR 110 encoding, and mmWave framing.

6. cargo test -p wifi-densepose-sensing-server: passed, including unit, integration, and documentation targets.

7. ESP IDF 5.4 ARM64 builds: C6 passed at 1,051,552 bytes with 45 percent application headroom. S3 passed at 1,127,104 bytes with 46 percent headroom. The S3 result is compile only because no S3 was attached for runtime qualification.

Qualification boundary

This proves timing, transport stability, and fail closed logical consistency. It does not prove heartbeat, respiration, gesture, pose, identity, or multi person accuracy without synchronized held out labels.

The access point rejected optional iTWT parameters once during boot and firmware selected its documented opportunistic CSI fallback. No iTWT or other error recurred during steady state.

Repository wide cargo fmt --all -- --check still reports extensive preexisting drift across unrelated crates and the sensing server package. No formatting rewrite is included here. The local Xcode toolchain also lacks libclang_rt.fuzzer_osx.a, so the libFuzzer aggregate was not rerun locally.

Acceptance test

Repeat the five minute hardware and server capture after timing, WiFi, filtering, or task scheduling changes. Require raw yield of at least 20 pps, DSP within one hertz of configuration, zero device stability errors, zero parser errors or reconnects, fresh node evidence, and zero presence count contradictions.