Day 09 — Push recovery & disturbance rejection

Day 08 made stepping a mode machine on top of stance: intended gait clock vs measured contact_set, swing as soft tasks, landings into Day 07 friction / unilaterality, abort when torque_scale or confidence collapses. Day 07 owned the feasible program. Day 06 owned the estimate and impact settle. Day 05 owned sag honesty.

Today owns disturbance rejection on that same stack: detect CoM / capture-point escapes, choose recover-in-place vs emergency step, and keep abort / soften paths when power or contact confidence collapses mid-recovery — without inventing a second torque plant that “just catches pushes.”

Recovery is a decision layer, not a second plant

A push is not a new dynamics model. It is an escape of the capture-point / CoM relative to the current support polygon, under the same EstimatorState, contact quality, and torque_scale ceilings the stance and gait layers already trust.

Core thesis: push recovery consumes capture-point / CoM escape + contact quality + torque_scale. It publishes tasks and (when needed) footsteps into the Day 07 / 08 faces. It does not replace QP constraints, FOC, or the BMS derate path.

Ownership rule: one writer for recovery intent (RecoveryCommand / recovery fields on GaitCommand) and one writer for measured support (contact_set). When they disagree mid-recovery, measured contact wins for constraints; the recovery layer aborts, softens, or re-plans — it does not fight a still-loaded sole or lean into air because a capture-point heuristic said so.

Detecting disturbance vs Day 06 impact settle

Not every CoP spike or CoM jolt is a push that needs a step.

Do not confuse impact settle with disturbance rejection. Chasing a touchdown CoP spike as an escape will chatter feet and invent emergency steps on every heel-strike. Gate recovery behind: (1) not inside Day 06 impact window, (2) capture-point / CoM excursion past a frozen margin, (3) estimate age and confidence inside budget.

Capture-point intuition at the decision layer (planning, not a new plant):

• If the extrapolated capture-point stays inside an enlarged support with healthy torque_scale and contact_set, prefer recover-in-place.
• If it leaves the recoverable region, or in-place tasks would demand infeasible wrench under current cones / ceilings, prefer an emergency step that reuses Day 08’s FootstepPlan + gait mode machine.
• If confidence or power already collapsed, prefer abort / soften over either.

Decision table: in-place vs emergency step vs abort

Do not let a high-level net “push through” a recovery the ceilings already declared infeasible. The net may choose in-place vs step or a shorter foothold; it may not replace friction cones, unilaterality, or FOC.

In-place recovery under Day 07 ceilings

Recover-in-place is still the Day 07 program with raised priorities, not a special torque mode:

Hard vs soft: support constraints stay hard. Recovery authority lives in task weights and foothold choice. If the QP goes infeasible, the honest answer is soften / abort / step — not silently dropping friction.

Emergency step reuses Day 08

When in-place cannot contain the escape, recovery does not invent a parallel walker. It issues a short-horizon FootstepPlan and rides the Day 08 gait mode machine:

• Mode: DS → weight-shift → SS → impact settle → DS, same ownership rules.
• Swing: soft clearance + foot tasks; measured contact_set owns constraints.
• Touchdown: Day 06 ContactState gate, then Day 07 cones on the new support.
• Abort / shorten: first-class if stale / gated / derate hits mid-step — same as locomotion.

If teleop, a learned recovery net, and a scripted capture heuristic each flip mode independently, the QP will fight a still-support foot or plant into sag. One writer for recovery intent; measured contact wins for constraints.

Mid-recovery abort / soften honesty

Recovery is where teams love to disable safety “just this once.” Do not.

Abort and soften are success paths when the world lied or the pack sagged. A robot that always finishes the planned recovery step into a collapsing bus is ignoring Day 05 with nicer branding.

Shared API: recovery face on the same stack

Keep Day 02 / 04 wire honesty. Cyclic commands still carry BusHeader. Extend Day 07 / 08 faces rather than inventing a parallel “push bus”:

BusHeader:
  node_id, seq
  t_sample, clock_domain, age_budget_ms
  faults

# Upstream (read-only here)
EstimatorState, ContactState, PowerState  ⊇ BusHeader

# Thin recovery face (host / mid-rate)
RecoveryCommand ⊇ BusHeader:
  intent               # IDLE | RECOVER_IN_PLACE | EMERGENCY_STEP | ABORT | HOLD
  escape_metric?       # capture / CoM excursion in named frames — document units
  prefer_step          # bool hint; ceilings may still force abort/soften
  relax_on_fault       # stale / POWER_GATED / low torque_scale → abort/soften

# Reuse / extend Day 08 locomotion face
GaitCommand ⊇ BusHeader:
  mode                 # DS | SS_L | SS_R | STEP | ABORT | HOLD | RECOVER
  phase_or_clock?
  cadence_hz?
  recovery_intent?     # optional mirror of RecoveryCommand.intent
  relax_on_fault

FootstepPlan ⊇ BusHeader:
  footholds[]
  swing_clearance?
  capture_ref?
  abort_policy         # shorten | freeze_ds | recover_in_place | abort
  urgency?             # nominal | emergency — same cones, tighter windows

# Extended Day 07 task face
WbcTaskSet ⊇ BusHeader:
  mode                 # STANCE_DS | STANCE_SS | SWING | IMPACT | RECOVER_IP | ...
  com_ref / capture_ref?
  foot_refs[]          # each tagged support | swing | settling
  posture_bias?
  priority_order[]     # temporarily raise CoM / capture during RECOVER_IP
  relax_on_fault

# Downstream muscle (Day 02) — ceilings still reflect torque_scale
JointCommand ⊇ BusHeader:
  q_des? / qd_des? / tau_ff?
  iq_ceiling? / tau_ceiling?
  flags                # STO / soften / hold

Higher layers publish recovery intent + optional emergency footholds + task priorities. Rate loops enforce BMS ceilings. Nobody re-implements FOC or AHRS inside the capture-point detector.

Physical ↔ digital pairing for push recovery

If the twin always recovers with perfect Boolean contacts and a full pack while hardware sees delayed contact_set and sag, you will tune recovery gains forever and never ship a catch that survives a real shove on a tired bus.

Bring-up sequence (before free push tests)

Day 07 stance green and Day 08 steps 1–5 stay green (controlled step + mid-step faults). Then:

1. Stance + step green — Day 07 fault injection and Day 08 one controlled step + mid-step abort still behave.
2. Small in-place only — gentle disturbance in DS; raised CoM / capture tasks; no emergency FootstepPlan; confirm impact settle is not classified as recovery.
3. Scripted decision — force escape metric across the in-place vs step threshold in twin; confirm mode and task priorities flip cleanly.
4. One emergency step — single recovery FootstepPlan; mode flip tied to measured contact_set; land into cones.
5. Mid-recovery faults — force stale / gated / derate in twin and on hardware during in-place and during emergency swing; confirm abort or soften, not heroic completion.
6. Then add learned residuals that choose intent or foothold above the QP — never replace cones, FOC, or torque_scale.

Skip to “RL recovers in sim” and hardware’s first real shove becomes an unplanned brownout experiment with better video.

Failure gallery

What to freeze this week

Extend frames and your control config with:

• Escape metric: capture-point / CoM margins, frames, and impact-settle exclusion aligned with Day 06
• Who owns recovery intent vs measured contact_set (disagree → abort/hold)
• RecoveryCommand fields (or recovery fields on GaitCommand) + mid-rate tick budget
• In-place task priority policy under Day 07 friction / unilaterality
• Emergency step: reuse FootstepPlan / gait mode; same abort/shorten as Day 08
• Mid-recovery abort / soften for stale, POWER_GATED, and low torque_scale
• Twin hooks: matched push impulses, contact delay, sag under recovery peaks — same as hardware
• Bring-up gate: no free push testing / learned recovery residuals until steps 1–5 above are green

The lesson is not “implement ankle strategy vs hip strategy vs a recovery transformer.” It is make disturbance rejection the same contact-rich program in silicon and in the twin: one estimate, honest power ceilings, in-place tasks that do not fight cones, emergency steps that inherit Day 08, and abort paths that stay honest when the world or the pack lies mid-catch.

Next

Day 10 — Upper-body / manipulation on shared balance ceilings: reach and grasp as soft tasks under the same EstimatorState + friction / unilaterality + torque_scale, without a second “arm plant” that steals support wrench or ignores mid-reach power and contact honesty.