I agree with you overall - in my post, I was trying to accept the premise of the overall safety model: "the ML will break but as long as the driver is paying at

I agree with you overall - in my post, I was trying to accept the premise of the overall safety model: "the ML will break but as long as the driver is paying attention it's OK." This was out of an effort to be fair to Comma, as, to your point, this is the overall state of the industry. I disagree, however that code style rules and procedures amount to hoop-jumping, as not every failure mode is the same (especially if you do accept the driver-attention / driver-in-control premise). An unexpected failure at the control layer (especially the control override layer) is a different class of failure to an unexpected direction command from the ML model, for example.