#30 · stacks/drone

Direction

Own the flight/vehicle runtime, estimation, controls, mission engine and operator experience. ArduPilot and PX4 remain explicit optional drivers. Live Pi camera acquisition remains image-space only; calibrated metric vision requires explicitly qualified depth and pose. Physical commands remain disabled.

Roadmap

#2 Native runtime: run a deterministic sensor-to-actuator bench loop
#3 Sensors: calibrate and replay time-aligned IMU, GNSS and pressure samples
#4 Estimation: publish owned attitude and local-position estimates
#5 Multirotor control: stabilize the first simulated quadcopter
#6 Authority: verify arming, manual override and independent failsafes
#7 Drivers: implement acknowledged MAVLink commands, missions and parameters
#8 Hardware adapters: command and verify the first camera or payload
#9 Operations: record, replay and diagnose native missions
#10 Mission engine: run and resume an owned waypoint mission
#11 Navigation: avoid an obstacle and land at a selected site
#12 Air vehicles: add fixed-wing, VTOL and helicopter simulation profiles
#13 Ground vehicles: execute a rover logistics or mowing route
#14 Surface vessels: survey a water route and collect a sample
#15 Subsea ROV: inspect a structure through a tethered control profile
#16 Antenna tracking: point a pan-tilt mount at a telemetry target
#17 Vision: localize a selected target and fuse camera observations
#18 Aerial mapping: fly a camera-triggered survey with georeferenced imagery
#19 Survey processing: measure a stockpile from a LiDAR or photogrammetric surface
#20 Infrastructure inspection: repeat an asset route and attach evidence
#21 Agriculture sensing: scout a field with calibrated multispectral data
#22 Agriculture application: simulate spraying and spreading with interlocks
#23 Public safety: coordinate search, fire and disaster observation missions
#24 Patrol: repeat a scheduled mission and dock under supervised authority
#25 Cargo: simulate delivery, redundant links and a BVLOS operations case
#26 Cinematography: coordinate a repeatable camera path and gimbal
#27 Environment: survey wildlife or atmosphere with traceable samples
#28 Parity audit: expand the pinned upstream inventory into behavior-level coverage
#29 Pi AI Camera: complete on-device capture and loss-validation evidence

The repository contains the pinned upstream inventory, feature coverage matrix and implementation sequence. Directory accounting is not feature parity; the parity-audit ticket expands it to parameter/protocol/hardware behavior with executable evidence.

Implemented frontier, October 18, 2026

The owned runtime through mission execution (#2-10) has bounded implementation slices and retained tests. Commit d91a014 adds range-backed navigation/selected-site landing (#11), antenna tracking simulation (#16) and the executable upstream behavior audit (#28), with native Stacks commands and standalone CLI support.

The integrated suite passed 248 Bun tests, 21,254 assertions and 13 Python bridge tests, plus lint, application/runtime/view typechecks, roadmap/audit gates, all 25 audit evidence selectors and standalone navigation/antenna checks. CI for this pushed head passed, including the Linux replanning scenario and both Pico 2 cross-builds. The authored detour now uses two terrain-aligned waypoint legs within the existing v1 task deadlines and completion guards.

A reusable bounded regular-file UTF-8 reader was also added to Stacks storage in c9138d3. Stacks CI passed. The application will adopt it through the normal published dependency update path.

The roadmap boxes remain open because simulation slices do not satisfy physical/HIL, complete firmware coverage or every integration criterion. The audit explicitly retains 53 unsupported cases and 1,327 unclassified detail dimensions. See each issue's implementation and remaining-work sections.

Shared vehicle frontier, October 18, 2026

8dde96a adds owned fixed-wing, differential ground and planar surface profiles for #12-14 on the common raw sensor/estimator/mission/authority loop. Native Stacks commands, isolated execution sessions, scoped modeled payload ACKs, corrected single-beam export and one shared stx workspace are implemented. The full integrated suite passes 320 Bun tests, 22,849 assertions and 13 Python tests; lint, types, standalone CLI, roadmap/parity and browser checks pass. Physical/HIL acceptance and unsupported air/chassis/hull families remain open on their issues.

CI for this pushed commit passed, including all Linux standalone CLI scenarios and both neutral-only Pico 2 cross-builds.

Tethered underwater frontier, October 18, 2026

Commit e1cb211 implements the owned simulated ROV slice for #15: eight-thruster 6DOF dynamics/allocation, pressure/DVL local estimation without underwater GNSS, depth hold, tether/leak/link/authority fault handling, capture-bound synthetic camera/sonar evidence, native CLI/storage and the common stx workspace. Exact water-surface datum and sensor source counts remain explicit. The integrated suite passes 353 Bun tests, 23,514 assertions and 13 Python tests, plus lint/types/roadmap/parity/standaloneCLI/browser checks. CI for this head passed, including all Linux standalone commands and both Pico 2 cross-builds. Physical/HIL/native board and real inspection acceptance remain open in #15.

The calibrated vision software slice is recorded below. Next dependency-ready frontier is #18 aerial mapping and the remaining application workflows #19-27. Hardware acceptance remains explicitly open, including #29. Full upstream mode/parameter/hardware parity is not claimed.

Calibrated vision frontier, October 18, 2026

Commit 6660d1b implements the owned software slice for #17: Brown5/pinhole/crop/mount calibration import and held-out correspondence checks, exact selected-frame registered-depth localization, capture-pose uncertainty, explicit GNSS source pairing, conservative covariance intersection, and qualified expiry preserved through fusion/navigation. The raw sensor/estimator/authority/control physics follow fixture proves latched crossing/occlusion/camera/depth/target/identity/reference/manual loss, including good data returning without automatic recovery. Native Stacks commands and stx /vision playback expose the same modules.

Exact-head CI passed: 393 Bun tests, 24,031 assertions and 13 Python tests, lint, app/runtime/view types, roadmap/parity integrity, Linux standalone commands and both neutral-only Pico 2 cross-builds. Final local affected suite passed 76 tests/698 assertions. The compiled CLI works outside the checkout; real browser checks include scenario changes, initial-time pairing visibility, camera loss, scrubbing, clear, empty console and zero overflow at 320/375 px.

Issue #17 stays open for independently measured physical lens/mount/ROI and timing calibration, registered depth hardware, surveyed heading/capture pose, held-out physical uncertainty trajectories, on-Pi/HIL/vehicle campaigns and any future measured appearance/privacy case. The live Pi camera remains 2D, and the synthetic north alignment, depth and accuracy evidence do not qualify physical flight. Roadmap checkboxes still represent complete acceptance, not software-slice completion.

Aerial collection frontier, October 18, 2026

Commit 2aad9f3 adds the owned software slice for #18: strict clipped polygon/hole/crosshatch planning, calibrated terrain-plane/GSD/overlap/trigger/endurance constraints, shared camera geometry, exact WGS84 optical-center conversion, real synthetic image pixels tied to owned sensor/estimator/mission/authority/control physics, scoped shutter ACKs and capture-pose uncertainty. Native Stacks mapping commands and stx /mapping playback use the same domain modules. Server-only PNG/ODM-style export includes hashes, pose/calibration/correction availability and collection quality, with file/directory sync barriers before an exclusive completion manifest.

Nominal/crosshatch/terrain runs collect 32/63/35 distinct images. Actual camera/ACK/IMU/position/manual faults inhibit modeled outputs. Independent landmark geometry, PNG CRC/scanline/hash checks and outside-checkout CLI runs passed. Browser checks covered full/partial collection, playback, clear/scenario reset, empty error console and 320/375 px layouts. Both independent review axes passed after the retained regression fixes. Local pre-review integrated suite passed 408 tests/25,604 assertions; final affected suite passed 74/1,851, plus 13 Python tests, lint and application/runtime/view typechecks.

Exact-head CI passed: 414 Bun tests, 25,631 assertions, 13 Python tests, lint and application/runtime/view types, roadmap/parity integrity, all Linux standalone scenarios including mapping exports/crosshatch/camera loss, and both neutral-only Pico 2 cross-builds.

Issue #18 remains open for measured camera/timing/heading/correction/GCP inputs, durable physical shutter reconciliation, real DEM/collision and battery planning, external reconstruction interchange, surveyed uncertainty, HIL/vehicle and storage power-loss campaigns. Image collection is not reconstruction or measured survey accuracy. Physical outputs remain inhibited. The next software frontier is #19, auditable volume processing from a known georeferenced surface; the remaining application workflows #20-27 and full upstream/hardware acceptance stay open.

Known-surface processing frontier, October 18, 2026

Commit e71b1df adds the bounded owned processing slice for #19: exact known-TIN/cell-grid clipping, explicit reference and plane base, cut/fill zero-line integration, missing coverage, conditional vertical bounds, independent declared-reference comparison, ASC/PLY sidecars and private hashed audit exports. Native Stacks volume commands, outside-checkout standalone execution and stx /volumes expose the same numerical contracts. Acquisition, reconstruction and physical surveyed accuracy remain distinct.

Final local suite passes 450 Bun tests / 25,937 assertions and 13 Python tests, lint, app/runtime/view types and roadmap/parity checks. Independent review fixes are regression-tested. Actual browser checks include numeric grid/nodata, paginated contributions, cut/fill, reference and unknown-bound evidence, clear/scenario reset, empty console and 320/375 px layouts. Drone exact-head CI passed, including Linux standalone volume commands and both neutral-only Pico 2 cross-builds.

The reusable completion-manifest artifact writer was also pushed to Stacks in 20b7887836. Local 564 application tests (six skip), 521 storage tests, full framework typecheck, package build and native documentation checks pass; Stacks CI failed on two pre-existing mobile types-subpath assertions. The correction is published in 009e5b715b: build the mobile entrypoint, ship explicit JavaScript/declaration exports and resolve it from source in every TypeScript config. Its 55 integrated boundary/types tests, isolated installed-package runtime/typing consumer, actual package build, full framework typecheck and both independent review axes pass. Follow-up Stacks CI passed, including the quality checks, scaffold smoke and deployment. Package adoption follows normal publication/dependency updates.

Issue #19 remains open for measured independent surveyed comparison, qualified acquisition, real external datasets, richer formats/meshing and full field acceptance. No overall accuracy bound or complete upstream parity is claimed. The next dependency-ready application frontier is #20 infrastructure inspection, followed by #21-27; all remaining native/hardware/integration acceptance stays in scope.

Infrastructure inspection frontier, October 18, 2026

Commit 019b392 adds the owned software slice for #20: a finite bridge-face stand-off plan, all-leg inflated clearances, fresh measured-range registration through estimated pose, owned mission/authority/control physics with wind, scoped shutter ACKs, ray-cast visible pixels and independent synthetic temperature counts. Source-bound operator declarations, quality/uncertainty, repeat-visit station comparison, private hashed PNG/thermal datasets, native Stacks commands and stx /inspection use the same domain contracts. Mapping and inspection share the extracted modeled shutter protocol.

Final integrated local suite passes 482 Bun tests / 33,221 assertions and 13 Python tests, lint, application/runtime/view types and roadmap/parity integrity. Both independent review axes pass. Outside-checkout compiled commands collect three qualified images per visit, compare all three station pairs, bind an explicit synthetic QA review, verify 39 exported file hashes and prove structure-motion abort. Actual browser checks cover image loading, annotations/background rejection, baseline review retention, capture selection, comparison, GNSS/structure failures, reset/clear, empty error/warning console and 320/375 px layouts. Exact-head Drone CI passed, including all Linux standalone inspection scenarios and both neutral-only Pico 2 cross-builds.

The prior mission-checkpoint extension is also green in CI: native missions:checkpoint/missions:recover persist an exact verified decision prefix and explicit paused simulation recovery. Whole-runtime, board and physical payload restoration remain open under #10.

Issue #20 remains open for measured real asset/range/pose/visible/thermal calibration, actual human-reviewed defect evidence, richer asset families and occlusions, storage qualification and bench/HIL/vehicle campaigns. Synthetic pixels, thermal counts and unsigned review hashes do not prove physical inspection accuracy, radiometry, identity or deterioration. Physical outputs remain inhibited. The next dependency-ready application frontier is #21 agriculture sensing, followed by #22-27; the full native/hardware/integration and upstream parity requirements stay in scope. Roadmap checkboxes continue to represent full acceptance.

Agriculture sensing software progress

Commit fd8445a adds the owned software implementation for #21: actual survey-runtime raw red/NIR acquisition with separate visible pixels, declared panel/irradiance calibration and synchronization admission, conditional calibrated NDVI, exact field/parcel support, source-bound explicit livestock declarations, private exports, four native Stacks commands and stx /agriculture. Default collection completes with 32 acknowledged frames. Missing/masked data and material mixing remain explicit; there is no crop diagnosis, identity inference or spray prescription.

Final local verification passes 527 Bun tests / 48,048 assertions, 13 Python tests, lint, app/runtime/view types and roadmap/parity integrity. Independent review fixed a pending-declaration draft race with five controlled-response actual-source action regressions. Outside-checkout compiled commands transfer the full 220 KB result, preserve declarations through reprocessing and verify 134 file hashes. Real browser checks cover source images/index samples, explicit animal selection/original capture retention, failure/clear/reset and 320/375 px layouts. Drone exact-head CI passed, including all seven agriculture standalone steps, the full Linux checks and both neutral-only Pico 2 builds.

The generic backpressure-aware output helper is also pushed to Stacks, with source alias/catalog fixes, 86 package tests, real compiled Unicode/slow-pipe/EPIPE tests and full framework typing. Follow-up Stacks CI passed test, lint, typecheck, compile, deployment-target, scaffold-smoke and artifact-freshness jobs. Its production deployment was cancelled, so this does not claim a completed production deployment. The app adopts the published helper through normal dependency updates.

Issue #21 remains open for measured hardware/panels/irradiance and registration, physical geospatial accuracy, external registered crop-map comparisons, agronomy ground data, real reviewed livestock and bench/HIL/vehicle campaigns. The retained vendor panel extract and independent synthetic map fixtures are separate evidence. Physical outputs remain inhibited. The #22 metered application software is implemented below. The next dependency-ready software frontier is #23 public-safety mission coordination, followed by #24-27; all full native/hardware/integration and upstream parity requirements remain in scope. Roadmap checkboxes continue to represent full acceptance.

Owned prescribed agriculture application software (#22)

Commit bd4d8cd publishes an inert-water sprayer and inert-granule spreader on the actual owned ground sensor/estimator/mission/authority/watchdog runtime. It includes strict SI calibration and polygon planning, speed compensation, explicit independent implement leases, dry defaults, delayed quantized instruments, exclusion/weather guards, fault latches and calibrated independent settling tails. Exact finite-kernel coverage, missed support, distinct-pass overlap and material conservation remain separate from measured delivery estimates.

Native Stacks plan/simulate/process/replay commands, a stx /application workspace and private complete hashed datasets use the same public library. Source replay verifies mission/controller decisions, input counters, exact shutdown/residual boundaries and same-epoch independent truth joins; unsigned consistency is not producer authentication or whole-physics replay. A failed double barrier remains positive-flow/unverified. Pending scenario faults cannot begin only after an earlier terminal stop.

Validation: 580 Bun tests / 54,036 assertions, 13 Python bridge tests, clean lint and app/runtime/view types, roadmap/parity checks and independent Standards/Spec reviews. The standalone binary passes 28 metered cases, three dry-mode gates, source reprocessing, tail replay, 16 file hashes and non-default long-closure, zero-dose and low-inventory audits outside the checkout. Actual browser evidence includes 320/375px layouts, synchronized/rejected numeric playback, no fresh host data after loss and failed closure. Exact-head CI passed, including Linux standalone application commands and both neutral-only Pico 2 cross-builds.

Read application semantics and limits. #22 remains open for measured material/response/distribution/dose/drift, physical isolation and HIL/vehicle campaigns, and qualified jurisdiction/operator/material requirements before a physical trial. Current local declarations remain unqualified and physicalTrialEligible is false. No physical output or full upstream parity acceptance is implied; roadmap checkboxes continue to represent full acceptance.

Public-safety collection/runtime foundation (#23)

Commit f3e30d326558aa34f0549c8a111e7252a957de59 adds strict scoped incident-sector planning, actual capture-time visible/numeric thermal imagery with pre-storage privacy masks, owned runtime link/resource inputs and retained boundary/endurance revision stops. Native Stacks plan/simulate/replay commands, causal virtual-execution events, full pinned owned collection re-execution and private hashed datasets share the same library. Actor identity, legal purpose and physical radiometry remain unqualified.

Validation: 613 Bun tests / 62,900 assertions, 13 Python bridge tests, clean lint and application/runtime/view typechecks, expanded observation-test type coverage, and roadmap/parity integrity checks. Independent Standards and Spec reviews pass; the compiled binary passes all four purposes/nine faults, 98 hashes, every thermal/support sample, private modes, exact replay and null/premature/no-overwrite rejection outside the checkout. Exact-head CI passed, including the Linux standalone collection workflows and both neutral-only Pico 2 cross-builds.

The next dependency remains #23: native persisted incident access, source-bound annotations/review, retention enforcement, atomic two-phase team handover and the authorized operator workspace/live coordination. Full software acceptance is not claimed and all original checkboxes remain open. Semantics and remaining scope distinguish the collection foundation from complete operational and physical acceptance. Issues #24-27, upstream parity and all native/hardware/HIL gates remain in scope.

Persisted authenticated incident access (#23)

Commit dbe3a50 implements native Stacks accounts, persisted incident scope and membership, role Gates, token scopes/platform permissions, closure and bounded audit pages. Five native HTTP endpoints use current credential/membership checks, private sanitized responses, bounded bodies after authorization and default cookie CSRF. Mutations reauthorize inside the native transaction and atomically advance the incident version, membership and audit. Server retention expiry denies private reads and writes. Exactly one coordinator is retained; membership changes cannot silently perform handover.

Native Buddy public-safety:access provisions a scoped, short-lived credential for an existing account into a new private directory without printing the token. Native account bootstrap, password hashing, token storage, SQL permissions and model-derived migrations are reused. Explicit application middleware refuses generic dashboard/model data surfaces even if default bundles are mounted.

Validation: seven focused subprocess/loopback tests pass across four files, using actual native models, file-backed SQLite, minted personal and PKCE-delegated credentials, real Gates/RBAC, both HTTP routing modes and the real Buddy command. Coverage includes post-preflight revocation, role/retention conflicts, CAS races, atomic audit rollback, more than 1,000 mutations with cursor pagination, fresh-process durability, private provisioning rollback, unread unauthorized bodies, cookie CSRF and alternate generic routes. Lint, app/runtime/view types, roadmap/parity checks, 13 Python bridge tests and outside-checkout compiled mission/public-safety checks pass. Independent Standards and Spec reviews pass. The full local suite encountered timeout failures on a heavily overloaded host; it is not reported as passing. Exact-head Drone CI passed: 626 Bun tests / 63,040 assertions with zero failures, all Linux compiled CLI workflows and both neutral-only Pico 2 cross-builds.

The reusable Stacks contribution adds explicit dashboard.access: false exclusion before generic model catalog/count/search/read/write, preserving enabled as sidebar visibility and leaving named Actions, direct ORM and separately authorized generated APIs available. See implementation and nested-override fix and generated catalog correction. Local focused native tests, framework typechecks and independent reviews pass. The introduced generated catalog count failure is corrected. Follow-up Stacks CI passed artifact freshness, lint, typechecks, compilation and scaffold smoke, and failed its test job on auth/MySQL password-reset, composables/AGENTS inventory and default preloader cases. The exact same three failure groups occur in pre-change baseline CI, and the added dashboard fixture passed in CI. Full native CI remains red on those baseline failures; no completed deployment is claimed. Drone retains its explicit route boundary for its installed framework version; dependency adoption follows normal publication and buddy-bot updates.

This phase authenticates the requesting account, not the offline collection producer, operator legal authority or a physical sensor. It does not erase retained files or copies, implement review/handover/live coordination, restore a vehicle or enable physical commands. The next #23 phase is source-bound explicit observations and append-only operator review, followed by managed retention/hold/purge, atomic recipient-bound handover and an authorized live workspace. All original full-acceptance checkboxes, remaining application issues and hardware/HIL/operational gates stay open. See access semantics and setup.

Persisted source, observation and review records (#23)

Commit 7ce3db2 adds private native source, explicit source-pixel observation and append-only operator review models, generated migrations and eight authenticated HTTP operations. Source admission replays the pinned owned collection, computes a canonical digest, and compares the complete incident configuration inside the final transaction. Confirmed visible/thermal pixels retain original support and uncertainty. Review declarations preserve a latest-pointer history and report self-review accurately. Authenticated uploader identity is separate from unqualified source-producer and physical-sensor identity.

Every append rechecks current native credentials, permissions, membership, retention and immutable referenced records, then advances the common incident version and audit atomically. Metadata-only bounded lists avoid loading source planes. Native cookie CSRF, role/token scope checks, strict bounded wire parsing, private response headers and generic model refusals remain enforced.

Validation: focused real native file-SQLite, Auth/Gates, migration and loopback HTTP tests pass, including both routing modes, fresh-process durability, rollback, mixed mutation races, fourteen staged-read interleavings, post-preflight revocation, source/config tampering, original pixel support and byte limits. Independent Standards and Spec/coverage reviews pass. Lint, application/runtime/view types, roadmap/parity checks, 13 Python tests, rebuilt standalone plan/fault/mission checks pass. The full local run finished with 629 passes and three record subprocess timeouts on an overloaded host; it is not reported as passing. Exact-head CI passed: 632 Bun tests / 63,052 assertions with zero failures, 13 Python tests, all compiled Linux CLI workflows and both neutral-only Pico 2 builds.

Privacy fix e069d46 excludes future private incident SQL from native query persistence and failed-query diagnostics, with five qualified sensitive-column fallbacks. A real enabled-binding regression reproduces the earlier leak and passes after the fix while public diagnostics remain active. Both independent review axes and focused checks pass. Exact fix CI passed: 633 Bun tests / 63,057 assertions with zero failures, 13 Python tests, all Linux compiled CLI workflows and both neutral-only Pico 2 builds. Existing logs require separate enrollment and cleanup; no retroactive erasure is claimed. Managed retention/hold/purge receipts, atomic recipient-bound handover, the authorized live workspace, incident-scope evolution and operational/hardware qualification remain open. All original full-acceptance boxes remain open. See record semantics and limits.

Explicit retention enrollment and human hold review (#23)

Commit 8acb0f1 adds two native private custody models and six native Actions/routes for inventory preview, explicit enrollment, minimal custody status, append-only hold review/events and post-expiry membership revocation. The inventory is incident/version-bound and paged without loading source planes. Existing incidents remain unenrolled until a current coordinator or custodian explicitly accepts the inventory. Closed and expired custody status excludes configuration, imagery, individual source digests and private notes. Held content still expires through every ordinary content route.

Decisions record the actual native human account and server time. Pending or overdue holds never release automatically. Identical request retries reauthorize against current token, platform permissions and real membership before returning the original event with fresh scope. Changed request contents conflict. Custody operations atomically advance shared incident and retention versions with their human event; removed custodians immediately lose custody access. Read-only credentials accurately report no mutation capability.

Focused verification uses actual native Auth/Gates, file SQLite, old-schema upgrade preservation and two generator no-ops, SQL rollback, nine allowed-preflight revocations, concurrent decisions, over 100 real reviews/events, fresh-process durability and private projection checks. Nine HTTP/fixture-guard cases pass across both native modes. Review caught and fixed three inherited Session fixture writes before disposable-directory validation; real direct-execution regressions reproduce the earlier overwrite and prove existing sentinel files and directory trees stay unchanged after rejection. Both independent review axes, lint and application/runtime/view typechecks pass. The local full suite passed 636 tests / 63,063 assertions with zero failures. Its discovery preceded the final HTTP/guard test files; the nine focused HTTP/guard cases above cover those additions separately against the same implementation. Exact-head CI passed against the complete final tree: 641 Bun tests / 63,088 assertions with zero failures, 13 Python tests, all Linux compiled CLI workflows and both neutral-only Pico 2 builds.

This tracer explicitly reports purgeImplemented:false and contentDeletionPerformed:false. It preserves current source/configuration/note rows and offline exports. No deletion job, file registry, forensic erasure, legal adjudication or physical command is claimed. Next: actual managed artifact ownership, resumable controlled-file/database deletion and receipts, then recipient-bound atomic handover and the authorized live workspace. All original acceptance boxes and operational/hardware gates remain open. Custody API semantics.

Native prepared artifact storage prerequisite

Published to stacksjs/stacks main as Chris, without coauthors: 627a59acee, with generated evidence inventory 8c16debe21. New prepareCompletedArtifactDirectorySync returns a frozen zero-content identity receipt and a live single-use synchronous publication closure. Payload follows the caller's ownership checkpoint; JSON receipts cannot rehydrate a writer. Existing asynchronous writer behavior is unchanged.

Qualified locally: 33 focused real filesystem cases, all 548 storage tests, standard 565 application tests passed with six service-dependent skips, native typecheck, package JS/declaration build, actual root/subpath export consumer, native catalog check, and independent Standards/Spec review. Lint has zero errors and six existing warnings in untouched frontend class ordering. Tests include input-code nonexecution, identity replacement/mode/link refusal, FIFO/descriptor closure, actual process interruption, exact caps and measured blocking latency. Exact native CI passed every required job, including all core package tests, native provider fixtures, types, scaffold, artifact freshness and CLI compilation. Linux storage ran549tests with0fail; the standard application suite ran571tests with0fail.

Separate installed Drone .221 SQLite probes verified captured synchronous nonce checks, close/reset refusal before file effects, retries0, persisted fresh-process outcomes, and an actual stopped-writer competing-process lock. This is protocol feasibility evidence, not domain Auth/registry acceptance or hardware power-loss evidence; observed WAL synchronous=NORMAL remains disclosed.

Still open: real source-derived managed artifact registry and staged ownership/publication, binary download and read-only reconciliation, then separately accepted resumable purge. Drone dependencies remain unchanged. No deletion, backfill, custody policy reinterpretation or physical qualification is enabled by this native contribution. Existing local-managed-v1 enrollment never grants future destructive acceptance.

Mount-only prerequisite published to Stacks main as Chris: 516c587bd1. inspectDirectoryMounts reuses native own-namespace mount inspection without requiring legitimate file readers to stop. Existing retirement/process checks are unchanged. Real mounted-root, active-reader and canonical-path tests plus all551storage tests, native types/build/public-export consumer/catalog and both review axes passed locally. Exact followup CI passed its test job and failed inherited template import parsing. Mechanical fix 22b2b8c passes every validation job in followup CI, including 552 storage and 712 application/server tests. Deployment failed at the revision ancestry guard; no successful deployment is claimed.

The deployment ancestry correction is now published in 6b9779a4fe. A real shallow merge regression reproduces the older-release misclassification; the fix completes exclusion history while preserving refusal of newly merged side releases. Independent Standards and Spec reviews, nine real Git tests, native typecheck and lint pass. Exact fix CI was canceled while pending, before any checks ran. That successor run was also canceled while pending. Later successor bdf1648 contains the reviewed guard and regression test byte-for-byte; its CI passed artifact freshness, compilation, dependency locks, lint and types, but its test job failed on a likeable-trait raw count expression and a browser-declaration assertion. Those failures are outside the unchanged reviewed ancestry guard and test. No manual deployment or successful deployment is claimed.

Managed source datasets and read-only recovery (#23)

Commit 4e42cd2 adds three private native models, generated migrations, six native HTTP/domain operations and actual source-derived private datasets. Shared rendering preserves the offline exporter, canonical recording, decoded PNG pixels, little-endian thermal values, support bytes and unsigned/physical-unqualified flags. Intent commits before any directory effect; empty inode ownership commits before payload; the same live synchronous writer publishes under fresh captured SQLite authority. Lost writers are never restored from JSON.

Discovery, bounded verified binary delivery and read-only reconciliation use current native Auth/Gates, role/scope/membership, source binding and expiry checks. Real pending/complete aliases and interrupted inodes are accounted separately from planned bytes. Custody inventory includes real managed attempts while preserving original enrollment history. Holds never extend content access. No deletion, automatic job, offline-copy adoption or new physical authority is enabled.

Independent Standards and Spec reviews pass. Real native tests cover role/credential/revocation and mixed public CAS cases, both synchronous transaction fences, SQL failure after filesystem effects, stopped competing writers, actual process death/fresh-process recovery, genuine partial payload observation, controlled alias states, 101-artifact/105-event pagination, old-data upgrades/no-op generation, held expiry, both HTTP route modes, CSRF, compression/HEAD and final response expiry. A committed version/source-qualified derivation bounds the current admitted profile at 26,995,930 bytes including manifest, below the still-enforced 32 MiB cap. Lint, application/runtime/template types, roadmap/parity accounting, 13 Python tests and rebuilt standalone CLI scenarios pass.

The first full local Buddy run used Pantry Bun 1.4.2 and finished 657 passes, two failures and one error. One was the stopped-writer fixture: actual OS probes exposed Bun 1.4.2 SIGCONT delivery and an early-resume race. Both are fixed without changing production behavior or timeouts; the real seam passes on Bun 1.4.2/1.4.3. The existing camera IPC failure passes its isolated same-version recheck. This local run is not reported as green. Exact published-head CI passed both required check and firmware jobs: 659 Bun tests, zero failures, 63,430 assertions across 88 files, 13 Python tests, all Linux compiled CLI scenarios and both neutral-only Pico 2 builds. These exact-head results qualify the published managed-artifact phase; the earlier local run above remains recorded accurately.

The explicit published native storage bridge records exact source provenance without a dependency upgrade. Native validation CI passes all validation jobs, including 552 storage tests and 712 application/server tests. Its deployment failed in the ancestry guard. The separately reviewed correction is now published at 6b9779a4fe, with exact fix CI canceled before checks. The later fac7c67 run was also canceled while pending. Verified byte-identical guard and test remain in later successor bdf1648, whose CI passed artifact freshness, compilation, dependency locks, lint and types but failed tests in the likeable trait and browser declarations; no full native CI pass or successful deployment is claimed. Forced SQLite connection retirement also retains the documented same-process availability limit tracked in Stacks #2922, with no GC workaround.

Still open: separately accepted resumable local purge, recipient-bound handover, authorized live workspace, full parity and operational/hardware qualification. All original full-acceptance boxes remain open. Existing local-managed-v1 enrollment never grants destructive acceptance. Managed API and limits.

Separately accepted local purge (#23)

Published to main as Chris, without coauthors: 8990a0b. Separate local-managed-purge-v1 acceptance binds a current exact inventory and explicit exclusions. Existing enrollment never authorizes destruction. Operator execution is disabled by default; no automatic scheduler is registered.

Three private native models, generated migrations, five native Actions/Gates and an awaited native Job implement bounded durable arms, independent accepted DB and exact registered namespace removal, recovery and minimized receipts. Unknown ownership, active references, mounts and identity drift preserve files. Diagnostics, offline exports, downloads, backups, replicas, process memory and media residuals are excluded; all-copy, diagnostics and media-erasure claims remain false. Current custody controls receipt access and member revocation. Expired receipt reads are denied even with cleanup disabled; actual metadata retirement is required before incident-key reuse.

Both independent source review axes pass at the fixed revision. Actual native qualifications cover Auth/roles/CSRF, both route modes, post-COMMIT and late HTTP deadline crossings, five genuine historical schema states, SQL rollback, captured transaction retirement, file and directory process death, foreign relations, byte/counter bounds, stopped writers, six concurrent public writers versus accepted freeze and actual receipt cleanup/key reuse. Historical overdue dates and controlled fault states are explicitly labeled. These do not qualify hardware, power loss, media or all-copy erasure, the exact syscall gap between alias unlinks, or process death between receipt metadata-retirement units.

Exact-revision CI passed: the main check ran680 Bun tests with0 failures and63,548 assertions across101 files (37 skips),13 Python tests, all compiled Linux CLI workflows and both neutral-only Pico2 builds. A separate mandatory Linux namespace job passed22 tests with0 failures and200 assertions, including real root/parent UID drift, positive metadata retirement/key reuse and the concurrent freeze matrix. The same-revision post-push CI also passed all three jobs after publication.

Earlier failures remain recorded accurately. The first immutable CI ran671 passes and2 historical migration-fixture failures; both now use matching archived code before a fresh current upgrade. The later immutable local full suite at6669240 ran693 passes,21 skips and1 provisioning setup failure in1373.68s: the fresh checkout lacked an application key, causing nested Buddy key generation to fail in a fixture without.env.example. The unchanged case passed on the same Bun 1.4.2 with an explicit disposable test key. That local aggregate is not reported as green. Final8990 differs from666 only in the five independently qualified test files and is qualified by the exact-revision green CI above.

API, execution and exclusions. Recipient-confirmed incident coordination is published below. The authorized live workspace and sector responsibility remain next. Full parity and operational/hardware qualification remain open. All original full-acceptance boxes remain open.

Recipient-confirmed incident coordination handover (#23)

Published to main as Chris, without coauthors: f1dde60. Native Stacks Actions, Gates, current personal credentials and cache-free SQL permissions expose a desk, offer and decision interface. A coordinator offers whole-incident responsibility to one existing active human member. Explicit recipient acceptance binds the selected source, context cutoff, uncertainty, assignment and both membership generations. Both roles/versions, the coordinator pointer, common sequence and one terminal audit commit together. Cancellation and decline do not move responsibility.

The selected-source briefing pages actual observations and append-only reviews, preserving original uncertainty and counting later records separately. Current platform eligibility is checked independently for both participants. Role/membership changes and coordinator A-to-B-to-A invalidate old offers. Exact actor/request retries reauthorize current access before returning history; they never repeat the transfer. New receipts retain the minimum offer/incident deadline through actual COMMIT and final HTTP delivery. Later authorized terminal history can remain through incident retention without an actionable briefing. Closed, frozen, expired, revoked and conflicting states retain their documented refusals.

Five hidden nullable audit fields and native generated SQLite migration/indexes retain the existing accepted purge-v1 inventory, digest and counts. Real old-schema upgrades preserve IDs, facts, foreign keys, indexes and an already accepted purge. Actual new offer/accept rows and their lookup/details/fingerprints are removed by whole-audit purge without per-offer surviving copies. Corrupted terminal lookup/lineage refuses the operation rather than reviving a canceled offer. Private SQL diagnostic exclusions cover the new protocol fields.

Both independent source review axes pass after reproducing and fixing terminal NULL-step revival. Focused real native Auth/Gates, file SQLite, two-mode HTTP and process tests cover staged canonical source/config changes, SQL rollback and zero-row CAS, concurrent terminal/offer winners, exact semantic retry conflicts, native credential/platform/member revocation, role and coordinator ABA, bounded source-only context, malformed persisted protocol, actual UTF8 overflow rollback, strict escaped/nested duplicate JSON, unread unauthorized bodies, CSRF and actual commit/middleware deadline crossings. No fake Auth or database replaces these seams.

Corrected exact-revision CI passed all three jobs: 699 Bun passes, 37 skips, zero failures and 63,617 assertions across 105 files, 13 Python camera tests, all compiled Linux CLI workflows and both neutral-only Pico 2 builds. The separate mandatory Linux namespace job passed 22 tests, zero failures and 200 assertions. Lint and application/runtime/view types and roadmap/parity accounting passed. The same-revision post-push main CI also passed all three jobs after publication. Parity accounting is not full parity or physical qualification.

The first immutable local aggregate and first CI remain failed: local 713 passes, 22 skips and one failure; CI 698 passes, 37 skips and one failure. Both exposed the old records-migration fixture applying a later handover rebuild before restoring older migrations. The corrected fixture seeds the genuine published access-era code and schema in a separate process, then applies the complete current migration corpus in native order. Exact old rows/IDs/projections, five present nullable handover fields, indexes, foreign keys, integrity and two unchanged migration-generator runs are checked. The supported Bun 1.4.2 focused regression passes and both independent fixture review axes pass. No production migration was changed to accommodate the fixture.

Reusable native parsing is published to Stacks at b3184eba. The opt-in strict JSON parser preserves normal parsing by default and is covered by862 passing router tests,567 passing standard application tests (six service-dependent skips), native typechecks, build, runtime/typed export consumers, generated capability checks and both review axes locally. Exact native CI was canceled before any job ran. No full native CI or deployment pass is claimed. Drone uses the exact source-provenance bridge without a dependency upgrade.

A second reusable native contribution is published at 058eda31. Native broadcast authorization now retains the subscriber's complete async context and method receiver, avoiding emitter identity leakage. The actual revoked-reader regression and method-style receiver regression pass, alongside 67 realtime tests, 567 standard application passes, types, package build, actual built-export consumers, capability checks and two independent source review axes locally. Its exact CI was canceled while pending before any job ran; no full native CI or deployment pass is claimed. The workspace phase below uses installed .221 with an explicit complete-context binding, without a dependency upgrade.

This phase transfers incident-wide coordination, not vehicle control, RC authority, pilot qualification or sector/team responsibility. An acknowledgement records an explicit human assertion and does not prove comprehension. The read and command workspace is published below. True in-progress event transport remains next; operational, legal-purpose, sensor, firmware interoperability, HIL/vehicle and complete feature parity remain open. All original full-acceptance checkboxes stay open. API and limits, ADR24.

Authorized incident read and command workspace (#23)

Published to main as Chris, without coauthors: 935f11b. Open /incidents to connect an existing native personal credential and incident key. The STX screen combines current incident scope, explicitly selected source imagery, source-bound observations, append-only reviews and recipient-confirmed coordination. Credentials stay volatile in Authorization headers, clear from the input after connection and never enter URLs, SSR or browser storage. Identity, incarnation and access refusal clear private panes and old bindings. The actual no-JavaScript submission omits credentials from URL and body.

Native Auth, Gates, current cache-free SQL permissions, token scopes, membership, purpose and retention remain authoritative. A bounded coherent snapshot stages canonical source verification before its final native transaction, then reads one common incident sequence and rechecks complete source/configuration/incarnation and authority on the same handle. Selected-source context and handover briefing have independent cutoffs. Coordinator recipient pages contain only bounded member IDs, roles and generations, without asserting current platform eligibility. Row limits and a 4 MiB UTF8 ceiling exclude recording planes. Minimum private deadlines survive nesting, actual COMMIT and final HTTP release.

The installed native broadcast response carries fixed content-free refresh hints. Actual afterCommit hooks announce durable writes, including a response withheld after COMMIT; rollback and exact replay announce no new write. Subscriber async context is captured before any transaction and independently reauthorized before native chunk release. Finite connection/frame/pending/lifetime limits, reconnect reads and periodic reconciliation retain no replay payload or durable outbox. Installed .221 retains the explicit complete-context binding; the separately published native correction remains documented in the handover phase above.

Human forms bind source, original observation, review head and recipient membership generation. Target changes clear former drafts; a late success preserves newer unsent edits. Ordinary renewal preserves drafts only after fresh same-authority reconciliation. Conflicts require deliberate rebinding. Ambiguous writes retain warnings without blind observation/review retry. Handover keeps exact actor/request retry and offer-specific acknowledgement.

Exact-revision CI passed all four jobs. The main check passed 733 Bun tests, 38 skips, zero failures and 63,780 assertions across 110 files, 13 Python bridge tests, all compiled Linux CLI workflows and both neutral-only Pico 2 builds. The mandatory Linux browser job passed 4 tests with no skips or failures and 12 assertions; the separate namespace job passed 22 tests with zero failures and 200 assertions. Browser checks cover genuine native two-account writes and SQL audit oracles, default 30-second renewal with a measured new connection, selected-evidence read-only controls, revocation, draft binding, escaped text, no-JavaScript omission, empty local/session stores, owned process cleanup and 375px overflow. Four actual CI screenshots were inspected. Linux browser evidence does not qualify the unsuccessful local macOS Chrome lifecycle attempts.

The immutable local full Buddy run passed 748 tests, 23 skips, zero failures and 63,846 assertions across 110 files in 2,001.26 seconds. Both independent source review axes pass at 935f11b; Pickier, application/runtime/STX types and roadmap/parity accounting pass. Same-revision post-push main CI passed all four jobs: 733 Bun tests passed, 38 skipped, zero failed and 63,780 assertions; the browser job passed 4 tests with 12 assertions and the namespace job passed 22 tests with 200 assertions. The 13 Python tests, compiled CLI workflows and both neutral firmware builds also passed. Accounting is not complete parity or physical qualification.

This tracer adds no simulator start, Worker control, source auto-admission, private artifact, model, migration or accepted purge-v1 inventory change. Volatile memory remains excluded from forensic erasure. Pixels retain explicit synthetic observed/unknown/masked support and original uncertainty; unsigned producer identity and physical sensing remain unqualified. Counts and route positions cannot establish searched area or absence of people/fire.

Next: actual owned in-progress execution, original-owner cancellation/revocation and deliberate completed-source admission; then sector/team responsibility and qualified support. All original issue23 acceptance boxes, legal/operator/hardware/HIL/vehicle gates and full parity remain open. Workspace semantics, ADR25.

Owner-bound live synthetic execution (#23)

Published to main as Chris with conventional commits and no coauthors: 2e6d43e.

The incident STX workspace now explicitly starts a genuine file Worker, displays credited in-progress synthetic telemetry, stops original-owner work and separately admits one completed canonical source. Five native Actions cover start, status, events, close and admission. GET/HEAD never start work. Native Auth/Gates/current SQL bind the original personal-token row, account, member generation/incarnation, complete incident configuration, purpose and retention at progress, result, terminal release and source admission. A newly issued credential for the same account cannot adopt retained work.

There is one process-wide reservation, one subscriber and at most one uncredited event. Worker bootstrap receives no inherited environment or preload. Parent validation checks exact full canonical bytes and digest before a genuine finished ACK and fresh authority can complete it. Missing ACK remains quarantined through the real terminal TTL and a late ACK. Completed execution writes no source; deliberate admission uses the existing checked transactional writer, CAS/audit and afterCommit hint. Unknown outcomes retain reconciliation without blind retry. Browser state remains volatile and newer drafts/source selection remain explicit.

A narrow source bridge preserves the installed native realtime wire contract and shared hub while using reviewed enqueue/close observers contributed to Stacks main. Gate bundle registration and colocated Action resolution improvements were also contributed to Stacks. No package release or complete authenticated bundled deployment is claimed.

All five exact-revision CI jobs passed. The Linux check passed 836 Bun tests, 39 skips, zero failures and 64,037 assertions across 143 files, plus 13 Python tests and all compiled CLI workflows. Separate browser jobs passed six tests with zero failures; namespace isolation passed 22 tests with 200 assertions; both neutral Pico 2 builds passed. Actual live/completed desktop and mobile screenshots were inspected. The immutable local full Buddy run passed 851 tests, 24 skips, zero failures and 64,103 assertions across 143 files in 2,918.59 seconds. Both independent review axes, Pickier, application/runtime/STX types and roadmap/parity accounting pass. Targeted regressions cover the acknowledged-finish/close race, exact byte identity, retained quarantine and elapsed native checks with separately measured work and controlled stalls. Earlier interrupted or failed qualification attempts remain preserved and are not counted as passing runs. These results do not establish physical qualification or complete parity.

Sector/team responsibility, searched-area support, legal/operator qualification, physical sensors, HIL/vehicle evidence and full upstream parity remain open. Original issue acceptance boxes remain open. Execution API and limits, ADR26.

Current patrol and owned domain checkpoint

Source c0779cf adds authenticated owner-only patrol review/consumption metadata through native Actions, Gates, tokens, model-derived migrations and transactional audit. It grants no launch/charge permission. Exact SQLite 5/517 contention is refused without retry; fixture startup imports follow temporary setup. Earlier failed CI runs and unresolved startup/browser causes remain recorded in #24.

The owned multirotor loop now characterizes carried mass/CG and prescribed splitting (#25), a closed hover POI angular reframe with simulated joints and three exposure-bound modeled stills (#26), and two-height synthetic environmental collection with conditional uncertainty and private unsigned exports (#27). Native Stacks commands expose these bounded scenarios. Thirty-five compiled command checks passed outside the checkout on the pinned current-host Bun 1.4.2 binary. Published to origin/main at c0779cf. Exact-commit CI passed all five jobs on Linux/Bun 1.4.3: 1,066 passed, 39 skipped, zero failed and 407,300 assertions across 159 files, plus 13 Python bridge tests and compiled command checks. Skips are not executed evidence. Post-main CI also passed all five jobs.

Original issue criteria remain open. These slices do not establish a delivery mission/release custody/energy reserve, cinematography path/handoff/lens/video/timecode, physical samples/wildlife authority, hardware/HIL/flight, full authenticated bundles, hard CPU/RSS bounds or complete upstream parity. See the linked issues and repository docs for exact evidence and remaining work.

Pinned gimbal and mount audit

Published c47a384 adds ten unsupported behavior cases for pinned PX4 gimbal and ArduPilot mount sources. Current accounting is 69 cases, 38 source records, 26 unchanged support claims, 43 unsupported cases and 1,337 unclassified dimensions. Exact-commit CI passed all five jobs, including 1,066 Bun tests with zero failures. Issue #28 retains the original failed local full-suite result and separate fresh provisioning pass. Both completion flags and full-acceptance boxes remain open.

Owned gimbal authority and camera audit

2c7b495 adds an immutable selected-angle source manager and a separate managed Cinema library API. Foreign packets cannot renew the selected lease; original expiry wins the returning-renewal/ACK tie after a real modeled exposure, preserving an uncertain image and reaching native abort with the residual-motion tail. Nominal still lands with three qualified frames. All seven legacy results and eleven compiled v1 command cases remain byte-exact. Affected checks passed 48 tests/331,856 assertions; both independent source reviews and types/lint pass. The same tree adds ten camera-feedback/capture gaps: 79 cases, 42 sources, 26 unchanged claims, 53 unsupported and 1,327 unclassified. All 42 sources/25 selectors pass. Published to origin/main. Local full suite: 1,093 passed, 24 skipped, zero failed. Exact-commit CI passed all five jobs: 1,078 passed, 39 skipped, zero failed, plus 13 Python tests and compiled checks. Skips are not executed evidence. #8, #26 and #28 retain exact limits and open acceptance. No physical/handoff/host-death/authentication or full parity claim.

Open Farming integration

The additional product scope is tracked in the all-19-capability Open Farming roadmap, with 19 domain tickets, four app foundations/publication tasks and verified native sub-issue/dependency links. Shared-library work starts with #37 versioned owned planning previews, then #38 source-bound synthetic collection previews. App authentication/records, machine interchange, domain science/control and actual field/hardware evidence remain explicit separate work. Planning and simulated collection do not count as completed physical flights or every advertised farming capability.