CAD.3:4.2 - Translate error into planner and actuator constraints

With x=Pz+e and u=Qz+Rv+Ke, require

Pz+E\subseteq X,\qquad Qz+Rv+KE\subseteq U.

These constraints reserve physical room and actuator authority for correction. For an output constraint use the actual output map, including the mismatch term in CAD.2:4.1.

For example, if X=\{x:Lx\leq b\} and E is the ellipsoid above, each row must satisfy

L_iPz+\varepsilon\sqrt{L_iM^{-1}L_i^\mathsf{T}}\leq b_i.

If U=\{u:Du\leq f\}, the input row becomes

D_i(Qz+Rv)+ \varepsilon\sqrt{D_iKM^{-1}K^\mathsf{T}D_i^\mathsf{T}}\leq f_i.

Thus the amount of tightening comes from the connected dynamics and geometry. It is not a universal safety percentage.

Enforce these conditions at every instant covered by the claim. If z evolves between slow updates, an upper constraint checked only at those updates does not bound Qz at every fast instant. Propagate the nominal trajectory or bound its intermediate states. Continuous-time constraints require a continuous evolution argument, not denser-looking sampled plots.