Public safety: coordinate search, fire and disaster observation missions

What to build

Give authorized operators a coordinated search/disaster mission workflow with live observations and an auditable handover.

Acceptance criteria

• Demonstrate search-area planning, thermal/visible evidence, incident annotations and team handover in simulation.
• Define role-based access, retention, privacy and operator review for rescue, firefighting and lawful police observation.
• Handle communications loss, incident boundaries and resource/endurance changes without autonomous person enforcement.

Blocked by

• #18 Aerial mapping: fly a camera-triggered survey with georeferenced imagery
• #20 Infrastructure inspection: repeat an asset route and attach evidence
• #7 Drivers: implement acknowledged MAVLink commands, missions and parameters

Scope and evidence

The owned collection/runtime foundation is implemented below. Full coordinated incident workflow, operational and physical acceptance remain open. Preserve explicit operator authority and report simulator, bench, HIL and vehicle evidence separately. The owned implementation must remain replaceable behind the shared driver and mission contracts.

Collection and runtime foundation

Commit f3e30d326558aa34f0549c8a111e7252a957de59 adds the owned collection foundation for the complete workflow above:

• Strict incident/revision/visit scope, one selected bounded sector, complete operating-boundary transit validation, explicit purpose/retention declarations and separate no-observe zones.
• Actual owned raw sensor/estimator/supervisor/controller/board/quad execution, calibrated capture-time visible RGBA and independent numeric synthetic thermal fields, pre-storage privacy masks, explicit unknown support and exact scoped shutter ACK joins. Rejected ACKs remain unmatched uncertainty evidence.
• Real per-epoch link and resource observations, retained freshness across missing or withdrawn providers, fail-closed clocks and nominal battery ceilings. Boundary and endurance updates retain actual payload/revision, release targets and require new pilot acceptance while preserving the accepted graph and spent time/energy.
• Causal live-in-simulation events, pinned whole owned collection re-execution, private exclusive PNG/numeric thermal/support/source datasets and final content-hash completion manifests.
• Native Stacks public-safety:plan, public-safety:simulate and public-safety:replay, including the standalone binary outside the checkout. Physical outputs remain inhibited and actor identity remains unauthenticated.

See collection semantics and full remaining scope, ADR23 and synthetic incident example.

Validation: 613 Bun tests / 62,900 assertions, 13 Python bridge tests, clean lint and application/runtime/view typechecks, expanded observation-test type coverage, and roadmap/parity integrity checks. Both independent review axes pass after regressions fixed withdrawn-provider resource restoration, disguised shared memory, explicit null configuration and actual post-collection position loss. The standalone binary passes four purposes, all nine faults, 98 exact file hashes, all little-endian thermal/support samples, private modes, exact replay, no-overwrite and null/premature rejection outside the checkout. Exact-head CI passed, including the Linux standalone collection workflows and both neutral-only Pico 2 cross-builds.

Required next implementation and full acceptance

All three acceptance checkboxes remain open. Collection is a dependency of the coordinated workflow, not completion of it:

• Extend the implemented authorized read and command workspace with actual owned in-progress execution and deliberate completed-source admission, preserving uncertainty and unresolved observations.
• Extend persisted native incident access and source/annotation/review APIs to managed exports and live observations. Preserve revocation, purpose and retention checks on every new path; access denial alone does not implement automatic erasure.
• Extend explicit enrollment and append-only hold review to actual managed binary/derivative ownership and resumable purge receipts, without claiming deletion of uncontrolled copies.
• Extend the implemented recipient-confirmed whole-incident coordination handover to sector/team responsibility, independent from vehicle control authority.
• Real in-progress collection delivery and qualified searched/unsearched/unknown support across SAR, fire, disaster and expressly lawful observation.
• Qualified visible/thermal hardware and calibration, measured georeferencing/uncertainty, actual communications and team operations, jurisdiction/operator/legal-purpose qualification, firmware interoperability and bench/HIL/vehicle campaigns.

Synthetic thermal counts do not establish a person, fire perimeter, medical diagnosis, measured radiometry or structural safety. There is no autonomous identification, pursuit or person enforcement. Stopping the fixture releases targets and modeled thrust; it is not a physical emergency landing.

Persisted authenticated incident access (#23)

Commit dbe3a50 implements native Stacks accounts, persisted incident scope and membership, role Gates, token scopes/platform permissions, closure and bounded audit pages. Five native HTTP endpoints use current credential/membership checks, private sanitized responses, bounded bodies after authorization and default cookie CSRF. Mutations reauthorize inside the native transaction and atomically advance the incident version, membership and audit. Server retention expiry denies private reads and writes. Exactly one coordinator is retained; membership changes cannot silently perform handover.

Native Buddy public-safety:access provisions a scoped, short-lived credential for an existing account into a new private directory without printing the token. Native account bootstrap, password hashing, token storage, SQL permissions and model-derived migrations are reused. Explicit application middleware refuses generic dashboard/model data surfaces even if default bundles are mounted.

Validation: seven focused subprocess/loopback tests pass across four files, using actual native models, file-backed SQLite, minted personal and PKCE-delegated credentials, real Gates/RBAC, both HTTP routing modes and the real Buddy command. Coverage includes post-preflight revocation, role/retention conflicts, CAS races, atomic audit rollback, more than 1,000 mutations with cursor pagination, fresh-process durability, private provisioning rollback, unread unauthorized bodies, cookie CSRF and alternate generic routes. Lint, app/runtime/view types, roadmap/parity checks, 13 Python bridge tests and outside-checkout compiled mission/public-safety checks pass. Independent Standards and Spec reviews pass. The full local suite encountered timeout failures on a heavily overloaded host; it is not reported as passing. Exact-head Drone CI passed: 626 Bun tests / 63,040 assertions with zero failures, all Linux compiled CLI workflows and both neutral-only Pico 2 cross-builds.

The reusable Stacks contribution adds explicit dashboard.access: false exclusion before generic model catalog/count/search/read/write, preserving enabled as sidebar visibility and leaving named Actions, direct ORM and separately authorized generated APIs available. See implementation and nested-override fix and generated catalog correction. Local focused native tests, framework typechecks and independent reviews pass. The introduced generated catalog count failure is corrected. Follow-up Stacks CI passed artifact freshness, lint, typechecks, compilation and scaffold smoke, and failed its test job on auth/MySQL password-reset, composables/AGENTS inventory and default preloader cases. The exact same three failure groups occur in pre-change baseline CI, and the added dashboard fixture passed in CI. Full native CI remains red on those baseline failures; no completed deployment is claimed. Drone retains its explicit route boundary for its installed framework version; dependency adoption follows normal publication and buddy-bot updates.

This phase authenticates the requesting account, not the offline collection producer, operator legal authority or a physical sensor. It does not erase retained files or copies, implement review/handover/live coordination, restore a vehicle or enable physical commands. The next #23 phase is source-bound explicit observations and append-only operator review, followed by managed retention/hold/purge, atomic recipient-bound handover and an authorized live workspace. All original full-acceptance checkboxes, remaining application issues and hardware/HIL/operational gates stay open. See access semantics and setup.

Persisted source, observation and review records (#23)

Commit 7ce3db2 adds private native source, explicit source-pixel observation and append-only operator review models, generated migrations and eight authenticated HTTP operations. Source admission replays the pinned owned collection, computes a canonical digest, and compares the complete incident configuration inside the final transaction. Confirmed visible/thermal pixels retain original support and uncertainty. Review declarations preserve a latest-pointer history and report self-review accurately. Authenticated uploader identity is separate from unqualified source-producer and physical-sensor identity.

Every append rechecks current native credentials, permissions, membership, retention and immutable referenced records, then advances the common incident version and audit atomically. Metadata-only bounded lists avoid loading source planes. Native cookie CSRF, role/token scope checks, strict bounded wire parsing, private response headers and generic model refusals remain enforced.

Validation: focused real native file-SQLite, Auth/Gates, migration and loopback HTTP tests pass, including both routing modes, fresh-process durability, rollback, mixed mutation races, fourteen staged-read interleavings, post-preflight revocation, source/config tampering, original pixel support and byte limits. Independent Standards and Spec/coverage reviews pass. Lint, application/runtime/view types, roadmap/parity checks, 13 Python tests, rebuilt standalone plan/fault/mission checks pass. The full local run finished with 629 passes and three record subprocess timeouts on an overloaded host; it is not reported as passing. Exact-head CI passed: 632 Bun tests / 63,052 assertions with zero failures, 13 Python tests, all compiled Linux CLI workflows and both neutral-only Pico 2 builds.

Privacy fix e069d46 excludes future private incident SQL from native query persistence and failed-query diagnostics, with five qualified sensitive-column fallbacks. A real enabled-binding regression reproduces the earlier leak and passes after the fix while public diagnostics remain active. Both independent review axes and focused checks pass. Exact fix CI passed: 633 Bun tests / 63,057 assertions with zero failures, 13 Python tests, all Linux compiled CLI workflows and both neutral-only Pico 2 builds. Existing logs require separate enrollment and cleanup; no retroactive erasure is claimed. Managed retention/hold/purge receipts, atomic recipient-bound handover, the authorized live workspace, incident-scope evolution and operational/hardware qualification remain open. All original full-acceptance boxes remain open. See record semantics and limits.

Explicit retention enrollment and human hold review (#23)

Commit 8acb0f1 adds two native private custody models and six native Actions/routes for inventory preview, explicit enrollment, minimal custody status, append-only hold review/events and post-expiry membership revocation. The inventory is incident/version-bound and paged without loading source planes. Existing incidents remain unenrolled until a current coordinator or custodian explicitly accepts the inventory. Closed and expired custody status excludes configuration, imagery, individual source digests and private notes. Held content still expires through every ordinary content route.

Decisions record the actual native human account and server time. Pending or overdue holds never release automatically. Identical request retries reauthorize against current token, platform permissions and real membership before returning the original event with fresh scope. Changed request contents conflict. Custody operations atomically advance shared incident and retention versions with their human event; removed custodians immediately lose custody access. Read-only credentials accurately report no mutation capability.

Focused verification uses actual native Auth/Gates, file SQLite, old-schema upgrade preservation and two generator no-ops, SQL rollback, nine allowed-preflight revocations, concurrent decisions, over 100 real reviews/events, fresh-process durability and private projection checks. Nine HTTP/fixture-guard cases pass across both native modes. Review caught and fixed three inherited Session fixture writes before disposable-directory validation; real direct-execution regressions reproduce the earlier overwrite and prove existing sentinel files and directory trees stay unchanged after rejection. Both independent review axes, lint and application/runtime/view typechecks pass. The local full suite passed 636 tests / 63,063 assertions with zero failures. Its discovery preceded the final HTTP/guard test files; the nine focused HTTP/guard cases above cover those additions separately against the same implementation. Exact-head CI passed against the complete final tree: 641 Bun tests / 63,088 assertions with zero failures, 13 Python tests, all Linux compiled CLI workflows and both neutral-only Pico 2 builds.

This tracer explicitly reports purgeImplemented:false and contentDeletionPerformed:false. It preserves current source/configuration/note rows and offline exports. No deletion job, file registry, forensic erasure, legal adjudication or physical command is claimed. Next: actual managed artifact ownership, resumable controlled-file/database deletion and receipts, then recipient-bound atomic handover and the authorized live workspace. All original acceptance boxes and operational/hardware gates remain open. Custody API semantics.

Native prepared artifact storage prerequisite

Published to stacksjs/stacks main as Chris, without coauthors: 627a59acee, with generated evidence inventory 8c16debe21. New prepareCompletedArtifactDirectorySync returns a frozen zero-content identity receipt and a live single-use synchronous publication closure. Payload follows the caller's ownership checkpoint; JSON receipts cannot rehydrate a writer. Existing asynchronous writer behavior is unchanged.

Qualified locally: 33 focused real filesystem cases, all 548 storage tests, standard 565 application tests passed with six service-dependent skips, native typecheck, package JS/declaration build, actual root/subpath export consumer, native catalog check, and independent Standards/Spec review. Lint has zero errors and six existing warnings in untouched frontend class ordering. Tests include input-code nonexecution, identity replacement/mode/link refusal, FIFO/descriptor closure, actual process interruption, exact caps and measured blocking latency. Exact native CI passed every required job, including all core package tests, native provider fixtures, types, scaffold, artifact freshness and CLI compilation. Linux storage ran549tests with0fail; the standard application suite ran571tests with0fail.

Separate installed Drone .221 SQLite probes verified captured synchronous nonce checks, close/reset refusal before file effects, retries0, persisted fresh-process outcomes, and an actual stopped-writer competing-process lock. This is protocol feasibility evidence, not domain Auth/registry acceptance or hardware power-loss evidence; observed WAL synchronous=NORMAL remains disclosed.

Still open: real source-derived managed artifact registry and staged ownership/publication, binary download and read-only reconciliation, then separately accepted resumable purge. Drone dependencies remain unchanged. No deletion, backfill, custody policy reinterpretation or physical qualification is enabled by this native contribution. Existing local-managed-v1 enrollment never grants future destructive acceptance.

Mount-only prerequisite published to Stacks main as Chris: 516c587bd1. inspectDirectoryMounts reuses native own-namespace mount inspection without requiring legitimate file readers to stop. Existing retirement/process checks are unchanged. Real mounted-root, active-reader and canonical-path tests plus all551storage tests, native types/build/public-export consumer/catalog and both review axes passed locally. Exact followup CI passed its test job and failed inherited template import parsing. Mechanical fix 22b2b8c passes every validation job in followup CI, including 552 storage and 712 application/server tests. Deployment failed at the revision ancestry guard; no successful deployment is claimed.

The deployment ancestry correction is now published in 6b9779a4fe. A real shallow merge regression reproduces the older-release misclassification; the fix completes exclusion history while preserving refusal of newly merged side releases. Independent Standards and Spec reviews, nine real Git tests, native typecheck and lint pass. Exact fix CI was canceled while pending, before any checks ran. That successor run was also canceled while pending. Later successor bdf1648 contains the reviewed guard and regression test byte-for-byte; its CI passed artifact freshness, compilation, dependency locks, lint and types, but its test job failed on a likeable-trait raw count expression and a browser-declaration assertion. Those failures are outside the unchanged reviewed ancestry guard and test. No manual deployment or successful deployment is claimed.

Managed source datasets and read-only recovery (#23)

Commit 4e42cd2 adds three private native models, generated migrations, six native HTTP/domain operations and actual source-derived private datasets. Shared rendering preserves the offline exporter, canonical recording, decoded PNG pixels, little-endian thermal values, support bytes and unsigned/physical-unqualified flags. Intent commits before any directory effect; empty inode ownership commits before payload; the same live synchronous writer publishes under fresh captured SQLite authority. Lost writers are never restored from JSON.

Discovery, bounded verified binary delivery and read-only reconciliation use current native Auth/Gates, role/scope/membership, source binding and expiry checks. Real pending/complete aliases and interrupted inodes are accounted separately from planned bytes. Custody inventory includes real managed attempts while preserving original enrollment history. Holds never extend content access. No deletion, automatic job, offline-copy adoption or new physical authority is enabled.

Independent Standards and Spec reviews pass. Real native tests cover role/credential/revocation and mixed public CAS cases, both synchronous transaction fences, SQL failure after filesystem effects, stopped competing writers, actual process death/fresh-process recovery, genuine partial payload observation, controlled alias states, 101-artifact/105-event pagination, old-data upgrades/no-op generation, held expiry, both HTTP route modes, CSRF, compression/HEAD and final response expiry. A committed version/source-qualified derivation bounds the current admitted profile at 26,995,930 bytes including manifest, below the still-enforced 32 MiB cap. Lint, application/runtime/template types, roadmap/parity accounting, 13 Python tests and rebuilt standalone CLI scenarios pass.

The first full local Buddy run used Pantry Bun 1.4.2 and finished 657 passes, two failures and one error. One was the stopped-writer fixture: actual OS probes exposed Bun 1.4.2 SIGCONT delivery and an early-resume race. Both are fixed without changing production behavior or timeouts; the real seam passes on Bun 1.4.2/1.4.3. The existing camera IPC failure passes its isolated same-version recheck. This local run is not reported as green. Exact published-head CI passed both required check and firmware jobs: 659 Bun tests, zero failures, 63,430 assertions across 88 files, 13 Python tests, all Linux compiled CLI scenarios and both neutral-only Pico 2 builds. These exact-head results qualify the published managed-artifact phase; the earlier local run above remains recorded accurately.

The explicit published native storage bridge records exact source provenance without a dependency upgrade. Native validation CI passes all validation jobs, including 552 storage tests and 712 application/server tests. Its deployment failed in the ancestry guard. The separately reviewed correction is now published at 6b9779a4fe, with exact fix CI canceled before checks. The later fac7c67 run was also canceled while pending. Verified byte-identical guard and test remain in later successor bdf1648, whose CI passed artifact freshness, compilation, dependency locks, lint and types but failed tests in the likeable trait and browser declarations; no full native CI pass or successful deployment is claimed. Forced SQLite connection retirement also retains the documented same-process availability limit tracked in Stacks #2922, with no GC workaround.

Still open: separately accepted resumable local purge, recipient-bound handover, authorized live workspace, full parity and operational/hardware qualification. All original full-acceptance boxes remain open. Existing local-managed-v1 enrollment never grants destructive acceptance. Managed API and limits.

Separately accepted local purge (#23)

Published to main as Chris, without coauthors: 8990a0b. Separate local-managed-purge-v1 acceptance binds a current exact inventory and explicit exclusions. Existing enrollment never authorizes destruction. Operator execution is disabled by default; no automatic scheduler is registered.

Three private native models, generated migrations, five native Actions/Gates and an awaited native Job implement bounded durable arms, independent accepted DB and exact registered namespace removal, recovery and minimized receipts. Unknown ownership, active references, mounts and identity drift preserve files. Diagnostics, offline exports, downloads, backups, replicas, process memory and media residuals are excluded; all-copy, diagnostics and media-erasure claims remain false. Current custody controls receipt access and member revocation. Expired receipt reads are denied even with cleanup disabled; actual metadata retirement is required before incident-key reuse.

Both independent source review axes pass at the fixed revision. Actual native qualifications cover Auth/roles/CSRF, both route modes, post-COMMIT and late HTTP deadline crossings, five genuine historical schema states, SQL rollback, captured transaction retirement, file and directory process death, foreign relations, byte/counter bounds, stopped writers, six concurrent public writers versus accepted freeze and actual receipt cleanup/key reuse. Historical overdue dates and controlled fault states are explicitly labeled. These do not qualify hardware, power loss, media or all-copy erasure, the exact syscall gap between alias unlinks, or process death between receipt metadata-retirement units.

Exact-revision CI passed: the main check ran680 Bun tests with0 failures and63,548 assertions across101 files (37 skips),13 Python tests, all compiled Linux CLI workflows and both neutral-only Pico2 builds. A separate mandatory Linux namespace job passed22 tests with0 failures and200 assertions, including real root/parent UID drift, positive metadata retirement/key reuse and the concurrent freeze matrix. The same-revision post-push CI also passed all three jobs after publication.

Earlier failures remain recorded accurately. The first immutable CI ran671 passes and2 historical migration-fixture failures; both now use matching archived code before a fresh current upgrade. The later immutable local full suite at6669240 ran693 passes,21 skips and1 provisioning setup failure in1373.68s: the fresh checkout lacked an application key, causing nested Buddy key generation to fail in a fixture without.env.example. The unchanged case passed on the same Bun1.4.2 with an explicit disposable test key. That local aggregate is not reported as green. Final8990 differs from666 only in the five independently qualified test files and is qualified by the exact-revision green CI above.

API, execution and exclusions. Recipient-confirmed incident coordination is published below. The authorized live workspace and sector responsibility remain next. Full parity and operational/hardware qualification remain open. All original full-acceptance boxes remain open.

Recipient-confirmed incident coordination handover (#23)

Published to main as Chris, without coauthors: f1dde60. Native Stacks Actions, Gates, current personal credentials and cache-free SQL permissions expose a desk, offer and decision interface. A coordinator offers whole-incident responsibility to one existing active human member. Explicit recipient acceptance binds the selected source, context cutoff, uncertainty, assignment and both membership generations. Both roles/versions, the coordinator pointer, common sequence and one terminal audit commit together. Cancellation and decline do not move responsibility.

The selected-source briefing pages actual observations and append-only reviews, preserving original uncertainty and counting later records separately. Current platform eligibility is checked independently for both participants. Role/membership changes and coordinator A-to-B-to-A invalidate old offers. Exact actor/request retries reauthorize current access before returning history; they never repeat the transfer. New receipts retain the minimum offer/incident deadline through actual COMMIT and final HTTP delivery. Later authorized terminal history can remain through incident retention without an actionable briefing. Closed, frozen, expired, revoked and conflicting states retain their documented refusals.

Five hidden nullable audit fields and native generated SQLite migration/indexes retain the existing accepted purge-v1 inventory, digest and counts. Real old-schema upgrades preserve IDs, facts, foreign keys, indexes and an already accepted purge. Actual new offer/accept rows and their lookup/details/fingerprints are removed by whole-audit purge without per-offer surviving copies. Corrupted terminal lookup/lineage refuses the operation rather than reviving a canceled offer. Private SQL diagnostic exclusions cover the new protocol fields.

Both independent source review axes pass after reproducing and fixing terminal NULL-step revival. Focused real native Auth/Gates, file SQLite, two-mode HTTP and process tests cover staged canonical source/config changes, SQL rollback and zero-row CAS, concurrent terminal/offer winners, exact semantic retry conflicts, native credential/platform/member revocation, role and coordinator ABA, bounded source-only context, malformed persisted protocol, actual UTF8 overflow rollback, strict escaped/nested duplicate JSON, unread unauthorized bodies, CSRF and actual commit/middleware deadline crossings. No fake Auth or database replaces these seams.

Corrected exact-revision CI passed all three jobs: 699 Bun passes, 37 skips, zero failures and 63,617 assertions across 105 files, 13 Python camera tests, all compiled Linux CLI workflows and both neutral-only Pico 2 builds. The separate mandatory Linux namespace job passed 22 tests, zero failures and 200 assertions. Lint and application/runtime/view types and roadmap/parity accounting passed. The same-revision post-push main CI also passed all three jobs after publication. Parity accounting is not full parity or physical qualification.

The first immutable local aggregate and first CI remain failed: local 713 passes, 22 skips and one failure; CI 698 passes, 37 skips and one failure. Both exposed the old records-migration fixture applying a later handover rebuild before restoring older migrations. The corrected fixture seeds the genuine published access-era code and schema in a separate process, then applies the complete current migration corpus in native order. Exact old rows/IDs/projections, five present nullable handover fields, indexes, foreign keys, integrity and two unchanged migration-generator runs are checked. The supported Bun 1.4.2 focused regression passes and both independent fixture review axes pass. No production migration was changed to accommodate the fixture.

Reusable native parsing is published to Stacks at b3184eba. The opt-in strict JSON parser preserves normal parsing by default and is covered by862 passing router tests,567 passing standard application tests (six service-dependent skips), native typechecks, build, runtime/typed export consumers, generated capability checks and both review axes locally. Exact native CI was canceled before any job ran. No full native CI or deployment pass is claimed. Drone uses the exact source-provenance bridge without a dependency upgrade.

A second reusable native contribution is published at 058eda31. Native broadcast authorization now retains the subscriber's complete async context and method receiver, avoiding emitter identity leakage. The actual revoked-reader regression and method-style receiver regression pass, alongside 67 realtime tests, 567 standard application passes, types, package build, actual built-export consumers, capability checks and two independent source review axes locally. Its exact CI was canceled while pending before any job ran; no full native CI or deployment pass is claimed. The workspace phase below uses installed .221 with an explicit complete-context binding, without a dependency upgrade.

This phase transfers incident-wide coordination, not vehicle control, RC authority, pilot qualification or sector/team responsibility. An acknowledgement records an explicit human assertion and does not prove comprehension. The read and command workspace is published below. True in-progress event transport remains next; operational, legal-purpose, sensor, firmware interoperability, HIL/vehicle and complete feature parity remain open. All original full-acceptance checkboxes stay open. API and limits, ADR24.

Authorized incident read and command workspace (#23)

Published to main as Chris, without coauthors: 935f11b. Open /incidents to connect an existing native personal credential and incident key. The STX screen combines current incident scope, explicitly selected source imagery, source-bound observations, append-only reviews and recipient-confirmed coordination. Credentials stay volatile in Authorization headers, clear from the input after connection and never enter URLs, SSR or browser storage. Identity, incarnation and access refusal clear private panes and old bindings. The actual no-JavaScript submission omits credentials from URL and body.

Native Auth, Gates, current cache-free SQL permissions, token scopes, membership, purpose and retention remain authoritative. A bounded coherent snapshot stages canonical source verification before its final native transaction, then reads one common incident sequence and rechecks complete source/configuration/incarnation and authority on the same handle. Selected-source context and handover briefing have independent cutoffs. Coordinator recipient pages contain only bounded member IDs, roles and generations, without asserting current platform eligibility. Row limits and a 4 MiB UTF8 ceiling exclude recording planes. Minimum private deadlines survive nesting, actual COMMIT and final HTTP release.

The installed native broadcast response carries fixed content-free refresh hints. Actual afterCommit hooks announce durable writes, including a response withheld after COMMIT; rollback and exact replay announce no new write. Subscriber async context is captured before any transaction and independently reauthorized before native chunk release. Finite connection/frame/pending/lifetime limits, reconnect reads and periodic reconciliation retain no replay payload or durable outbox. Installed .221 retains the explicit complete-context binding; the separately published native correction remains documented in the handover phase above.

Human forms bind source, original observation, review head and recipient membership generation. Target changes clear former drafts; a late success preserves newer unsent edits. Ordinary renewal preserves drafts only after fresh same-authority reconciliation. Conflicts require deliberate rebinding. Ambiguous writes retain warnings without blind observation/review retry. Handover keeps exact actor/request retry and offer-specific acknowledgement.

Exact-revision CI passed all four jobs. The main check passed 733 Bun tests, 38 skips, zero failures and 63,780 assertions across 110 files, 13 Python bridge tests, all compiled Linux CLI workflows and both neutral-only Pico 2 builds. The mandatory Linux browser job passed 4 tests with no skips or failures and 12 assertions; the separate namespace job passed 22 tests with zero failures and 200 assertions. Browser checks cover genuine native two-account writes and SQL audit oracles, default 30-second renewal with a measured new connection, selected-evidence read-only controls, revocation, draft binding, escaped text, no-JavaScript omission, empty local/session stores, owned process cleanup and 375px overflow. Four actual CI screenshots were inspected. Linux browser evidence does not qualify the unsuccessful local macOS Chrome lifecycle attempts.

The immutable local full Buddy run passed 748 tests, 23 skips, zero failures and 63,846 assertions across 110 files in 2,001.26 seconds. Both independent source review axes pass at 935f11b; Pickier, application/runtime/STX types and roadmap/parity accounting pass. Same-revision post-push main CI passed all four jobs: 733 Bun tests passed, 38 skipped, zero failed and 63,780 assertions; the browser job passed 4 tests with 12 assertions and the namespace job passed 22 tests with 200 assertions. The 13 Python tests, compiled CLI workflows and both neutral firmware builds also passed. Accounting is not complete parity or physical qualification.

This tracer adds no simulator start, Worker control, source auto-admission, private artifact, model, migration or accepted purge-v1 inventory change. Volatile memory remains excluded from forensic erasure. Pixels retain explicit synthetic observed/unknown/masked support and original uncertainty; unsigned producer identity and physical sensing remain unqualified. Counts and route positions cannot establish searched area or absence of people/fire.

Next: actual owned in-progress execution, original-owner cancellation/revocation and deliberate completed-source admission; then sector/team responsibility and qualified support. All original issue23 acceptance boxes, legal/operator/hardware/HIL/vehicle gates and full parity remain open. Workspace semantics, ADR25.

Owner-bound live synthetic execution (#23)

Published to main as Chris with conventional commits and no coauthors: 2e6d43e.

The incident STX workspace now explicitly starts a genuine file Worker, displays credited in-progress synthetic telemetry, stops original-owner work and separately admits one completed canonical source. Five native Actions cover start, status, events, close and admission. GET/HEAD never start work. Native Auth/Gates/current SQL bind the original personal-token row, account, member generation/incarnation, complete incident configuration, purpose and retention at progress, result, terminal release and source admission. A newly issued credential for the same account cannot adopt retained work.

There is one process-wide reservation, one subscriber and at most one uncredited event. Worker bootstrap receives no inherited environment or preload. Parent validation checks exact full canonical bytes and digest before a genuine finished ACK and fresh authority can complete it. Missing ACK remains quarantined through the real terminal TTL and a late ACK. Completed execution writes no source; deliberate admission uses the existing checked transactional writer, CAS/audit and afterCommit hint. Unknown outcomes retain reconciliation without blind retry. Browser state remains volatile and newer drafts/source selection remain explicit.

A narrow source bridge preserves the installed native realtime wire contract and shared hub while using reviewed enqueue/close observers contributed to Stacks main. Gate bundle registration and colocated Action resolution improvements were also contributed to Stacks. No package release or complete authenticated bundled deployment is claimed.

All five exact-revision CI jobs passed. The Linux check passed 836 Bun tests, 39 skips, zero failures and 64,037 assertions across 143 files, plus 13 Python tests and all compiled CLI workflows. Separate browser jobs passed six tests with zero failures; namespace isolation passed 22 tests with 200 assertions; both neutral Pico 2 builds passed. Actual live/completed desktop and mobile screenshots were inspected. The immutable local full Buddy run passed 851 tests, 24 skips, zero failures and 64,103 assertions across 143 files in 2,918.59 seconds. Both independent review axes, Pickier, application/runtime/STX types and roadmap/parity accounting pass. Targeted regressions cover the acknowledged-finish/close race, exact byte identity, retained quarantine and elapsed native checks with separately measured work and controlled stalls. Earlier interrupted or failed qualification attempts remain preserved and are not counted as passing runs. These results do not establish physical qualification or complete parity.

Sector/team responsibility, searched-area support, legal/operator qualification, physical sensors, HIL/vehicle evidence and full upstream parity remain open. Original issue acceptance boxes remain open. Execution API and limits, ADR26.