08/04/2026
Perception gets the demos. The decision layer gets the postmortems.
Here's the thing that layer has to do, all at once: decide fast, decide in a way you can explain, and stay safe when it's working from a picture of the world that's incomplete. Each of those is manageable on its own. Together, in the same control loop, they fight.
Take safe-under-uncertainty first. The planner is acting on a fused estimate from sensors that disagree, with a confidence that's usually rosier than it should be, because nobody models the tails honestly. So the right move often isn't the one that looks best on the current picture. It's the one that keeps you recoverable if the picture turns out wrong. Plan for the expected case and bolt a safety check on afterward, and that's exactly the gap that bites you.
Now add fast. Not good average latency, worst case. A planner that's quick on average and ugly at the tail will blow the loop on the one cycle that mattered, and that's the cycle you'll be explaining later. The moment you harden the worst case, you're usually giving up decision quality to do it. That's the tradeoff, right there.
Now add explainable. When the safety review asks why it braked, "the model decided" is not an answer anyone signs off on. So you keep the decision logic inspectable on purpose, which constrains how much you can lean on a policy you can't trace. A layer you can't explain is one you can't certify, however good the numbers look.
None of these is hard in isolation. The engineering is that a real deployment demands all three in the same loop, at the same time, and they trade against each other directly. That's the layer where strong programs stall, usually in integration, usually later than they wanted.