Mission engine: run and resume an owned waypoint mission

What to build

Plan, validate, execute, pause, resume and recover a simple geofenced mission in the owned simulator with a visible mission state in Stacks.

Acceptance criteria

• Version mission graph and task semantics; include waypoint, takeoff, land, loiter, return, payload trigger and abort behavior. Implemented v1 simulation profile with camera events, not physical payload dispatch.
• Validate coordinate frames, terrain/altitude reference, fence/rally constraints and power/endurance budget. Fixed LOCAL_NED origin, flat origin-plane terrain, bounded cylinder/rally and conservative longest-path hover-energy budget. Other terrain/reference modes are rejected.
• Prove cancellation, checkpoint recovery and conditional branches from recorded mission traces. Pure decision-prefix replay, paused recovery with fresh compatible supervised authority, explicit operator resume and retained event identities are tested.

Implemented simulation slice

Commit 6fb8268 adds:

• Strict versioned acyclic mission graphs, target ramps, task timeouts and settling, pause holds, reserve/endurance checks, authority/reference revocation and abort release.
• Owned raw sensor, estimator, multirotor controller, authority and independent modeled board-watchdog physics integration. The mission policy never arms itself. The fixture provides explicit operator authority.
• Native Stacks commands missions:validate, missions:simulate, missions:replay, plus standalone CLI support outside the checkout.
• Native stx /missions viewer with recorded time, task/state transitions, position targets and camera-event count.
• Private bounded trace persistence, exact decision recomputation and operator-controlled checkpoint recovery.

Read mission semantics and limitations, ADR 10 and the example plan.

Validation evidence

• 211 Bun tests, 17,424 assertions, zero failures. Twelve mission tests cover complete routes, pause/resume, recovery, branches, cancellation, RC takeover, reserves, resets, clocks, malformed plans, tampered decisions, trace exhaustion and repeated action/time accounting.

• Buddy lint, application/runtime/view typechecks, roadmap check and standalone CLI build passed. The compiled binary validates, records recovery and replays the paused epoch outside the checkout.

• Real browser checks: nominal completion, recovery paused at 6000 ms, return branch without a camera event, abort release, numeric slider synchronization, empty error console and zero horizontal overflow at 320 and 375 px. Desktop and phone layouts visually inspected.

• Independent Standards and Spec reviews passed after correcting required timeout validation, capacity release and elapsed-time edge cases.

• Evidence is owned physics simulation. This is not native C++ board execution, external firmware SITL, HIL or physical flight. Physical outputs remain inhibited.

• CI passed for the pushed commit: check, standalone CLI and both Pico 2 cross-builds, including 13 Python bridge tests.

Shared vehicle mission integration

8dde96a extends graph budgeting, replay, paused checkpoint recovery, authority and payload command scope to explicit v2 fixed-wing, ground and surface missions, preserving v1 quadcopter limits. One stx workspace now shows each profile's budget, estimated route, playback and correlated modeled payload ACKs. Independent session ownership, uncertain-action blocking, scenario binding and landing pause are regression-tested. This adds modeled payload reconciliation; physical exactly-once delivery and durable whole-runtime restart remain open below.

CI for this pushed commit passed, including all Linux standalone CLI scenarios and both neutral-only Pico 2 cross-builds.

Portable mission-process checkpoint commands

Commit abae457 adds native Stacks missions:checkpoint and missions:recover. Checkpoint extraction verifies the whole source before retaining an exact active epoch. Recovery requires an explicit fresh compatible simulation observation, writes a separate private trace and returns paused for operator resume. Changed references, stale clocks, estimator/authority loss and exhausted reserves fail before output publication. This does not restore whole-runtime or physical payload state.

The standalone CLI passes outside the checkout; 452 local Bun tests / 25,978 assertions, lint and app/runtime types pass. Exact-head CI passed, including Linux compiled recovery commands and both neutral-only Pico 2 cross-builds.

Explicit portable operator resume

Commit 4e0fdec adds native Stacks missions:resume and the public resumeMission API. They verify a paused v1 trace, require the next fresh compatible supervised simulation observation, reuse authority/reference/fence/reserve/endurance checks, and preserve the source while writing a separate private replayable decision trace. Longer scheduling outages require paused recovery first. A legitimate immediate planned abort is recorded with its target released.

Local validation: 530 Bun tests / 48,102 assertions, 13 Python bridge tests, zero lint errors or warnings, app/runtime/view typechecks, roadmap/parity checks and standalone CLI compilation pass. The compiled checkpoint/recover/resume/replay sequence passes outside the checkout. Three new public API and native CLI tests cover source preservation, private permissions, invalid epochs/authority/reference/reserve, corrupt prefixes, planned-abort persistence and retained payload event identity. Independent Standards and Spec reviews pass.

Exact-head CI passed, including Linux standalone checkpoint/recovery/resume/replay and both neutral-only Pico 2 cross-builds.

This remains a single mission-policy decision over unsigned simulation evidence. It does not start a vehicle loop, authenticate a supervisor, restore the whole runtime or establish physical payload delivery. The remaining acceptance gates below stay open.

Portable v2 vehicle mission decisions

Commit 76bd6e8 extends native Stacks missions:simulate --profile, missions:checkpoint, missions:recover, missions:resume and missions:replay to the existing v2 fixed-wing, ground, surface and subsea policies. Quadcopter behavior remains v1. Each version retains its own schema, row and byte limits; full source verification precedes prefix selection. Checkpoints refuse pending payload commands, recovery remains paused, explicit resume checks current compatible observations, and valid immediate terminal releases are recorded. Confirmed modeled acknowledgements and event identities survive continuation without a new payload event.

Local validation: 619 Bun tests / 63,024 assertions, zero failures; Buddy lint, app/runtime/view typechecks and roadmap/parity integrity checks pass. The compiled CLI completes the simulation/checkpoint/recover/resume/replay workflow for all four v2 profiles outside the checkout. Separate Standards and Spec reviews pass. Added coverage includes full-prefix verification, uncertain payload refusal, retained modeled ACK identity, immediate terminal release, recovery interlocks, private files, source preservation, rejected-output absence and the 9,001/9,002-row boundary.

Exact-head CI passed, including all Linux standalone workflows, all four portable v2 vehicle mission round trips and both neutral-only Pico 2 cross-builds.

This is portable unsigned mission-policy evidence. It does not restore a whole runtime or board session, authenticate a supervisor, establish physical payload delivery, or translate graphs to external firmware. Those acceptance gates remain open below.

Remaining work

Keep this issue open for the broader mission integration and acceptance gates:

• Durable correlated checkpoints across runtime, sensor/estimator/controller/authority state and logs. A mission-process checkpoint does not restore a board session or an aircraft after power loss.
• Physical payload transaction/ACK reconciliation and uncertain-outcome recovery. Simulated task events do not establish exactly-once shutter delivery.
• Reviewed graph compilation, coordinate/frame and capability translation behind the shared ArduPilot/PX4 driver contracts.
• Richer terrain/rally and measured energy planning, real landing detection, restart/HIL campaigns and physical mission validation.

Blocked by

• #4 Estimation: publish owned attitude and local-position estimates
• #6 Authority: verify arming, manual override and independent failsafes

Scope and evidence

Preserve explicit operator authority and report simulator, bench, HIL and vehicle evidence separately. The owned implementation must remain replaceable behind the shared driver and mission contracts. Abort or authority loss releases targets and zeros modeled thrust; this is not an emergency landing. Recovery requires retained supervised authority and an explicit resume.

Moving-camera readiness counterexample

The first fixed-path experiment on an unpublished candidate based on 2c7b495 returned halted / move-not-ready, with zero exposures and actual native aborted / operator-abort. The stage-to-waypoint transition occurred at 8120 ms; the next consumer observation at 8140 ms had only 21 consecutive qualified readiness samples from 7720 through 8120 ms, a 400 ms span. The contract requires 26 samples spanning 500 ms. The 8240 ms entry deadline had not expired.

Independent retained controller/encoder arithmetic confirmed that the missing earlier samples also failed angular readiness; changing a floating rate comparison would not repair the suffix. The complete first result and source were preserved. No dwell, threshold, gain, timeout or oracle was retuned. The candidate remains unaccepted and unpublished; its initial typecheck is not moving-shot, compatibility or full-suite qualification.

Next work is a separately versioned, source/task/epoch-bound readiness condition on native stage advancement, under existing authority, fence, reserve, timeout and replay rules. The initial proposal preserves the 1500 ms minimum dwell, 3000 ms stage timeout, 26-sample/500 ms readiness requirement and 1600 ms camera entry window. It is not implemented or predicted to pass. Pure native policy/replay comes before integration into the existing vehicle loop. Moving exposures, source loss during translation, image quality and actual landing remain unverified.

Tracked with cinematography #26.

Pure native readiness prerequisite (Phase A)

368a428 adds a separate pure library v3 readiness policy. A readiness-loiter retains its position hold until both 1,500 ms of continuous native arrival acceptance and a fresh selected declaration permit its planned edge. The 3,000 ms task timeout stays bounded. Declarations bind the current plan, run, task visit, source, reference and observation epoch; local labels are unsigned and are not authentication. Safety checks precede applicable abort; abort precedes running task timeout; timeout precedes readiness.

LIVE input is captured into canonical own data. Strict replay recomputes accepted decisions. Invalid observation/action and capacity errors permanently end the new engine's step availability while preserving the last accepted replayable prefix; the unrecorded blocked snapshot is not invented as a trace row.

Focused validation passed 12 tests / 278 assertions; the coherent affected suite passed 52 tests / 857 assertions. Types, Pickier and integrity checks passed. All 44 complete old native/vehicle library artifacts and nine complete Cinema outputs remain byte-exact. Twenty-two actual compiled legacy command cases matched all 44 retained stdout/stderr streams byte-for-byte. These compiled checks cover existing commands; no readiness CLI was added.

The local full-suite attempt at this exact commit failed with 17 recorded storage-resource errors (one SQLITE_FULL and 16 ENOSPC), then was stopped with exit -15 and no final summary. Its original log and failures remain preserved. After authorized cache cleanup, a separate exact-commit Bun 1.4.2 recovery check passed those 17 test cases: 39 assertions across four files in 72.37 seconds, exit 0. This focused recovery is not a local full-suite pass.

Separately, five existing nominal mission-workspace module results ran on both published 2c7 and candidate 368 in a real headless browser. All ten calls completed; the five complete JSON-plus-LF pairs matched byte-for-byte, totaling 1,842,364 bytes per source, with no browser errors. This checks existing module behavior, not a mounted stx UI or the new readiness API. Earlier probe-harness and launch-environment failures remain retained.

Exact-commit CI passed all five jobs on Ubuntu 24.04.5 / Bun 1.4.3: 1,090 passed, 39 skipped, zero failed and 407,935 assertions across 1,129 tests in 162 files (3,447.38 seconds). All 12 new readiness cases passed, along with 13 Python tests and the types, lint, build and compiled checks. Skipped tests were not executed. 368a428 was published to origin/main by a normal fast-forward push at 16:57:36 UTC on 20 October 2026, as Chris with no coauthors; the remote readback matched the exact commit.

This is a pure declared-policy prerequisite, with no readiness simulator or camera declaration producer connected. The earlier fixed-stage experiment remains failed and unaccepted: 21 readiness samples and zero exposures. Phase B integration is separate, unpublished work and has no qualified moving-camera result. Moving-camera readiness, exposures, source loss, raster quality and landing still require actual one-world qualification. No physical output, authenticated readiness or completed cinematography capability is established.

The camera consumer remains tracked in cinematography #26. Existing broader mission acceptance gates remain open.

Native simulator integration checkpoint, 2026-10-20

The follow-up shared-world candidate is stopped and unpublished. Its first native vertical test passed its actual start/stage/release binding assertions, then failed the required completed-flight assertion with state blocked; that first invocation did not print its reason. A separately authorized unchanged diagnostic recorded blocked/task-timeout on land at 36,440 ms. Land entered at 29,440 ms, ground contact was first observed during land at 36,320 ms, and only 120 ms of qualifying settlement was credited before the unchanged 7,000 ms deadline. Native landing requires 500 ms. Replay matched the diagnostic decision; modeled board outputs ended zero and authority disarmed. Contact and neutral outputs are not a completed landing.

The existing global speedMps: 0.2 ramps position targets for every spatial task, including landing. This is a target-rate bound, not a measured vehicle speed cap. Static review found no landing-path extraction discrepancy. This single diagnostic does not prove universal infeasibility at that rate or a future camera result. No Cinema run was attempted, no later completion was observed, and the original failed test, source, diagnostic and earlier 21-sample/zero-image counterexample remain preserved. No deadline, gain, contact threshold, settling requirement, camera window or completion oracle was relaxed.

A separate legacy compatibility regression was reproduced: the refactor cached options.instrument, ignoring replacement by an aborting instrument. A limited repair preserves the original live options reference. Its new public test failed before the repair and passed afterward, with the replacement abort accepted at 620 ms; 25 existing mission tests passed, along with application/runtime/scoped TypeScript and Buddy lint. That repair is still part of the unpublished candidate. It neither explains nor resolves the native landing shortfall, and full output compatibility has not been requalified after it.

The next proposed prerequisite is a separate native version 4 plan/policy capability for explicit per-spatial-task target rates, with canonical plan data and exact replay. Published v1/v3 and vehicle v2 would retain their existing contracts. This is a reviewed direction awaiting an exact implementation contract, not implemented support or a selected faster landing rate. Simulator integration and any new cinematic profile still require their own first actual qualification. This issue remains open.

Published pure native task-motion v4, 2026-10-20

Commit 673d81462b300605ca65e1ec4e576d1324ad92a8 implements the pure per-spatial-task position-target rate capability and documents its boundaries. Omitted rates resolve once from the plan default into explicit canonical task fields. One shared policy uses the current task's rate before advancing; the successor rate starts on its next decision. Exact replay recomputes targets from those recorded rates. Native v1, vehicle v2 and readiness v3 remain separate contracts.

The final focused check passed 33 tests with zero failures and 788 assertions: 21 new v4 tests plus 12 existing v3 tests. Independent source reviews reported no actionable findings. All 53 complete prior library artifact pairs remain byte-equal. Their actual suffix is LF (hexadecimal 7d0a); a handoff label incorrectly said literal backslash+n and is corrected by a separate root evidence supplement, preserving the originals. Library artifacts do not establish compiled CLI stdout or browser execution.

This pure addition connects no v4 simulator, camera, physical control, CLI or recording consumer and selects no cinematic transit or landing rates. It does not qualify landing, image quality or the stopped translating experiment. Both earlier failed experiments and their unchanged acceptance limits remain preserved. Any future consumer proposal is still separate work; this issue remains open.

Local full-suite qualification passed 1,126 tests with 24 skips, zero failures and 408,511 assertions across 163 files. The Linux check passed 1,111 tests with 39 skips, zero failures and 408,445 assertions across the same 1,150 tests, plus 13 Python tests. All five effective CI jobs succeeded after one failed-browser-only retry. The original admission failure remains unexplained and open in #34; the retry does not erase it.

All 22 existing compiled mission/camera cases passed outside the checkout, with all 44 complete stdout/stderr streams byte-equal to the accepted previous version. Ten real-browser legacy module calls produced five complete output pairs, byte-equal across the two source versions, with no browser errors. These checks establish existing-consumer compatibility, not a new v4 consumer.

Commit 673d814 is published on origin/main through a normal fast-forward push as Chris, without coauthors. Its subsequent push-triggered CI run is still running; no later result is inferred.

Owned native4 mission world

The owned native4 mission world is published in commit f860f360289c41f1cb49977a64cc496160006202, integrating feature 45d25f6e4575350b6e916912da719bc478c2d94f with the published diagnostics and hardware guide. simulateTaskMotionMission uses the actual native4 engine on the same owned body, sensor, estimator, controller, supervisor and watchdog loop as legacy missions. It preserves the concrete native4 trace and replay contract.

The first complete modeled five-task flight held stage, used a 0.2m/s dolly target rate with 0.6m/s ordinary-leg target rates, traversed the authored two-meter goal, returned and completed landing at 25,600ms with neutral board output. These are commanded-target rates and modeled evidence. The readiness producer in this world fixture is a standalone declaration; it does not qualify camera readiness, moving images or physical flight.

Exact feature CI 39489236399 passed all five jobs. The actual local full suite passed 1,138 tests with 24 skipped and zero failures; Linux passed 1,123 with 39 skipped and zero failures. All 44 output streams from 22 compiled legacy CLI cases and five complete legacy browser-profile results matched the accepted baseline. The combined published commit separately passed Buddy lint, application/runtime type checks and the real native execution-browser test (2 passed, zero failed, 6 assertions). Its automatic post-main CI 39496510042 was still running at this update; no post-main pass is inferred.

This adds actual owned-world execution to the earlier pure per-task mission policy. Existing limitations and unchecked acceptance criteria remain open; no new native4 CLI, browser UI, physical-control capability or issue completion is claimed.

Published native4 world CI checkpoint, October 20, 2026

The automatic post-main CI run for exact combined main commit f860f36 completed successfully in all five jobs. Its Linux full suite reports 1,123 passed, 39 skipped, zero failed and 408,789 assertions across 1,162 tests in 164 files; 13 Python bridge tests also pass. Skips remain unexecuted evidence. This qualifies the published task-motion world plus the integrated diagnostics and hardware documentation; physical actuation remains disabled.

This automatic combined-main result supplements the earlier feature-commit and local evidence. It does not add a task-motion CLI or browser consumer, restore whole-runtime or physical payload state, or qualify physical flight. The remaining-work sections above continue to apply.