Recover safely after source restarts and time resets #68

Parent: #60

Problem

Two identity-lifecycle gaps remain after #66:

• A new VP session with a later source stamp is accepted without a restart-specific latch. Existing restart runs needed re-enable because the outage exceeded the watchdog, not because session changes enforce it.
• After source time moves backwards (rosbag replay or a CARLA episode reset), identity baselines keep the previous high stamp. Later input is rejected, the source goes stale and re-enable cannot recover; SI must currently be restarted.

Retired VP sessions are already rejected in both modes. The remaining task is to define recovery without weakening replay protection.

Done when

• Define and enforce whether a VP session change requires SI_STOP and explicit re-enable, consistently in VP_CONTROL and SI_CONTROL + VP.
• Define an explicit, authorized timeline-reset rule for Autoware and VP. Legitimate resets can recover, but re-enable must not silently make old sessions/cycles or old-episode ego data acceptable again. No mode/source fallback.
• Controller-level tests cover a fast VP restart, alternating producers, repeated frames, cycle/stamp regressions, rosbag replay and CARLA episode reset. Verify duplicates do not refresh watchdogs, retired/replayed input stays rejected, and authorized recovery resumes only as specified.
• Verify SI's own output-session identity across restarts on supported targets, including targets without RTC/SNTP; fix collisions if found. The clock-derived session concern from SI: hardening and test backlog from the #66 review #69 is not yet target-verified. Check session/sequence correlation across reboot.
• Document the rules in the Finalize the VP–SI control contract #62 contract and link repeatable recovery/replay evidence.

References

• Consolidates the remaining restart policy from SI: a VisionPilot restart is not forced through re-enable; VP_CONTROL does not track retired sessions #67, the original timeline-reset bug in this issue, and identity/test findings from SI: hardening and test backlog from the #66 review #69.
• Existing fixes and rig evidence: feat(si): supervised single output with startup mode selection and native VisionPilot ingress #66, especially 2e541a3. Watchdog and latch execution: Keep SI fault response running when the follower hangs #64. Startup source selection remains fixed under Configure SI startup and required inputs per deployment #70.

The original timeline-reset finding came from code review, not a reproduced rig run; add reproduction evidence rather than treating it as already measured.