Ford: fire the stall-rescue pulse only on a fractional delivery deficit

[jrneulight]

The angle-mode reactive stall detector (the 300 ms mode-0 "rescue pulse" that resets
post-override PSCM attenuation) arms on |desired| > |measured| plus an absolute gap
threshold. That condition cannot tell a stalled PSCM from an honestly-lagging one: on a
deep curve entry the car tracks at 0.7–0.85× of a large, fast-rising demand, clears
the gap threshold on magnitude alone, and the pulse releases steering mid-curve exactly
when the car is already behind.

The evidence that motivated this

• On one windy section of a single drive (route 0000001e--be********, 25–31 mph,
  |desired curvature| 0.016–0.021), the detector fired twice mid-curve while the car was
  delivering 0.71–0.83× — each pulse followed by the driver grabbing the wheel within
  0.2 s.
• Settled hands-off delivery on the same drive measured ~1.0 in every speed band: these
  were entry transients, not stalls.
• True stalls measure differently: 0.28–0.59× delivered, across five diagnosed routes
  (~47 engaged minutes).

Why the fix is shaped this way

A stall is a fractional failure, not an absolute gap. The pulse now arms only when
the car is delivering under 0.65× of the demand (_STALL_DELIVERY_FRACTION) — one
constant and one condition. The measured separation is wide: every true stall in the
archive sits at ≤ 0.59×, every honest transient at ≥ 0.71×. All other guards (0.5 s
hold, 2 s cooldown, 3-pulse episode cap, press/lane-change resets) are untouched, so a
genuinely stuck PSCM is rescued exactly as before.

The evidence afterwards

Detector replay, ported verbatim and measurement-faithful (live steer ratio,
instantaneous angle offset, roll compensation, the recorded devLim flag), across five
routes:

• Baseline reproduces every recorded pulse — including both misfires — so the sim
  is calibrated, not curve-fit.
• With the fractional gate: every true rescue kept (all fire at 0.28–0.59×
  delivered), both misfires eliminated, zero new fires anywhere.

On-road since opening (update, two drives on a branch carrying this gate): a windy
hands-on route (00000027--97********, 26 min) crossed 38 qualifying curve entries with
zero entry-transient fires — a per-blip audit shows the gate honored on every pulse
that did fire — while a true stall still rescued cleanly; a follow-up drive
(0000002a--ce********) fired 4 pulses, each in a legitimate post-press window, zero
misfires. The gate's exact claim, confirmed on the road in its target scenario.

What each change is

1. _STALL_DELIVERY_FRACTION = 0.65 constant with the measured justification in the
   comment.
2. The arming condition's abs(desired) > abs(measured) becomes
   abs(measured) < 0.65 * abs(desired).
3. New unit tests (plus the minimal test scaffolding for this module): an entry
   transient (0.72× of a deep demand, gap over threshold) must never fire; a true stall
   (0.20×) must.

Test it yourself

# unit tests (no hardware)
cd opendbc_repo && pytest opendbc/sunnypilot/car/ford/tests/test_lateral_angle_ext.py

# on any Ford angle-mode route: count mode-0 pulses and check the delivery ratio at
# each fire — with this change, every fire should sit well under 0.65x

Risks / limits

• Strictly reduces when the pulse fires; no new firing conditions. A stall that hovers
  just above 0.65× delivered will no longer pulse — by measurement, everything in that
  band was an honest transient the pulse made worse.
• Should land before Ford: extend the angle-mode stall rescue below 9 m/s with the pinion measurement #153. This is independent of the pinion measurement (Ford: opt-in pinion curvature measurement (Use Pinion Yaw Sensor) #145,
  now merged) and applies in yaw mode too. Ford: extend the angle-mode stall rescue below 9 m/s with the pinion measurement #153 extends the stall rescue down to 5 m/s
  with the pinion measurement, which widens exposure to the old absolute-gap trigger
  this PR replaces — merged in the other order, Ford: extend the angle-mode stall rescue below 9 m/s with the pinion measurement #153 carries a known-imperfect trigger
  into a new speed range. A further flag-on follow-up (1.5× gap floor for the pinion
  path, validated jointly with this gate) comes after both.
• Rebased onto bp-dev after Ford: opt-in pinion curvature measurement (Use Pinion Yaw Sensor) #145 merged. The only conflict was the Ford ext test file:
  this branch had added a self-contained scaffold back when bp-dev had no
  car/ford/tests/, and Ford: opt-in pinion curvature measurement (Use Pinion Yaw Sensor) #145 has since added a fuller one. Resolved by keeping Ford: opt-in pinion curvature measurement (Use Pinion Yaw Sensor) #145's
  scaffold and porting TestStallFractionalGate onto its _pinion_harness(flag=False)
  — the detector change itself applied unchanged.