ReviewOS

also looking at this

stacks/drone

feat: add owned VTOL hover development

#76
Merged chris wants to merge codex/owned-vtol-lift-and-cruise into main
30 files +780 -111

Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.

docs/adr/0007-driver-transactions.mdmodified+4-2
Changes to docs/adr/0007-driver-transactions.md
@@ -18,7 +18,9 @@ a scripted peer does not establish that a pinned autopilot firmware implements e
1818Do not add a database transaction queue, HTTP arm endpoint or dependency on an external autopilot
1919to our own runtime or mission engine.
2020
21Keep serial/TCP, command-specific behavior, complete mission/parameter variants, key lifecycle,
22FTP/log/event/time/RTCM services and payload/ROS/CAN gateways as explicit remaining sub-capabilities.
21The initial slice deferred serial and TCP. Explicit loopback TCP was subsequently implemented with
22scripted peers and shared protocol transactions; see the [TCP qualification record](../validation.md#tcp-transport-software-slice).
23Serial, actual firmware transport campaigns, command-specific behavior, complete mission/parameter
24variants, key lifecycle, FTP/log/event/time/RTCM services and payload/ROS/CAN gateways remain open.
2325See [the driver contract and limits](../driver-protocols.md) and
2426[retained conformance evidence](https://github.com/stacksjs/drone/blob/main/docs/driver-protocol-evidence.json).
docs/roadmap/feature-coverage.mdmodified+5-5
Changes to docs/roadmap/feature-coverage.md
@@ -10,11 +10,11 @@ means there is no native implementation yet. A protocol-compatible transport is
1010| Calibration, sensor timing and quality | Native register acquisition, SI conversion, thermal/mount calibration profiles, independent age/stuck/dropout checks and replay; physical capture/calibration/timing pending | Local position/battery telemetry subset | [#3](https://github.com/stacksjs/drone/issues/3) |
1111| Attitude, navigation estimation, EKF, VIO, RTK and redundancy | Complementary tilt/relative-yaw, GNSS local-position Kalman blocks and pressure-relative height; heading, inertial EKF and hardware validation pending | Estimator output subset; no health-fusion parity | [#4](https://github.com/stacksjs/drone/issues/4) |
1212| Rate, attitude, velocity, position, allocation and tuning | Owned simulated cascaded loops/quad-X allocation with estimator feedback and rigid-body scenarios; board port, tuning and physical validation pending | Velocity-only quadcopter SITL | [#5](https://github.com/stacksjs/drone/issues/5) |
13| Arming, RC override, kill, fences, battery and recovery | Versioned simulation authority, explicit arming/override/fault latches and modeled independent output expiry; board port, HIL and recovery controllers pending | No arm/mode/kill commands; physical receive-only | [#6](https://github.com/stacksjs/drone/issues/6) |
14| MAVLink routing, ACK, mission/parameter protocol, signing, time and transport | Bounded MAVLink 2 command ACK/retry, named parameters, waypoint transfer/resume and optional signing; full firmware SITL, serial/TCP and deeper services pending | ArduPilot/PX4 telemetry, SITL velocity and shared acknowledged protocol subset; scripted UDP evidence only | [#7](https://github.com/stacksjs/drone/issues/7) |
13| Arming, RC override, kill, fences, battery and recovery | Versioned simulation authority, explicit arming/override/fault latches and modeled independent output expiry; board port, HIL and recovery controllers pending | No dedicated arm/mode/kill workflow; generic SITL commands require caller-selected IDs and parameters; physical receive-only | [#6](https://github.com/stacksjs/drone/issues/6) |
14| MAVLink routing, ACK, mission/parameter protocol, signing, time and transport | Bounded MAVLink 2 command ACK/retry, named parameters, waypoint transfer/resume and optional signing over UDP or explicit loopback TCP; full firmware SITL, serial and deeper services pending | ArduPilot/PX4 telemetry, SITL velocity and the [shared acknowledged protocol subset](../driver-protocols.md); scripted UDP/TCP peer evidence, without firmware execution qualification | [#7](https://github.com/stacksjs/drone/issues/7) |
1515| Payloads, buses, camera triggers, ESCs, power, gimbals and winches | Owned still-capture ACKs, bounded clock sync and estimator-pose association, Pi IMX500 adapter, replay and bus contracts; physical validation and other payload drivers pending | No payload actuator exposure | [#8](https://github.com/stacksjs/drone/issues/8) |
16| Diagnostics, logs, replay, firmware update and configuration provenance | Owned runtime journal, loss accounting, replay, CLI/viewer and [protected signed preparation, owned candidates, host slots, observed image/session health and fresh-policy rollback](../runtime-updates.md); full mission correlation, key repair, complete storage faults and board install/boot/rollback qualification remain pending | No log/FTP/parameter management | [#9](https://github.com/stacksjs/drone/issues/9) |
17| Missions, tasks, waypoints, terrain, rally and resume | Owned versioned graph, flat-terrain/fence/rally/energy validation, physics execution, pause/resume, recorded recovery, CLI and stx viewer; correlated durable checkpoints, driver translation and hardware evidence pending | No mission upload or mission-mode control | [#10](https://github.com/stacksjs/drone/issues/10) |
16| Diagnostics, logs, replay, firmware update and configuration provenance | Owned runtime journal, loss accounting, replay, CLI/viewer and [protected signed preparation, owned candidates, host slots, observed image/session health and fresh-policy rollback](../runtime-updates.md); full mission correlation, key repair, complete storage faults and board install/boot/rollback qualification remain pending | Named parameter read/write with bounded readback in the SITL adapter; no log/FTP services, full-table synchronization or reboot persistence qualification | [#9](https://github.com/stacksjs/drone/issues/9) |
17| Missions, tasks, waypoints, terrain, rally and resume | Owned versioned graph, flat-terrain/fence/rally/energy validation, physics execution, pause/resume, recorded recovery, CLI and stx viewer; correlated durable checkpoints, driver translation and hardware evidence pending | Bounded SITL waypoint upload/download and acknowledged item selection/resume; no arming, automatic flight-mode selection or owned-plan translation | [#10](https://github.com/stacksjs/drone/issues/10) |
1818| Avoidance, route planning, precision landing, follow and orbit | Owned modeled range detection, inflated route planning, terrain-clearance/RTL/selected-site landing physics; metric follow/orbit goals; physical calibration and dynamic obstacle campaigns pending | No avoidance/landing integration | [#11](https://github.com/stacksjs/drone/issues/11) |
1919| Fixed-wing, VTOL, heli, blimp and experimental airframes | Owned fixed-wing aerodynamic trainer with runway takeoff/survey/landing and wind/airspeed-loss tests; VTOL, helicopter, soaring, blimp and experimental families remain planned | Current drivers reject non-quadcopter heartbeats | [#12](https://github.com/stacksjs/drone/issues/12) |
2020| Rovers, mowing, logistics and materials handling | Owned differential traction/braking, encoder/GNSS odometry, guarded mowing coverage and scoped material-drop simulation; hardware and broader chassis/implements pending | Not exposed | [#13](https://github.com/stacksjs/drone/issues/13) |
@@ -32,7 +32,7 @@ means there is no native implementation yet. A protocol-compatible transport is
3232| Cargo, long-range/BVLOS cases and redundant links | Partial: owned carried-point-mass/CG physics, prescribed split and native link-loss characterization; delivery mission, release ACK, custody, energy margin and redundant links remain open | Native `cargo:load-bench` [simulation evidence and limits](../cargo-load.md); no physical or BVLOS qualification | [#25](https://github.com/stacksjs/drone/issues/25) |
3333| Gimbal/camera control, smooth paths and broadcast timecode | Partial: owned hover POI angular reframe, lagged/quantized gimbal, exposure-bound modeled stills and latched target/camera/authority faults; translational paths, physical integration, lens/video and handoff remain open | Native `cinema:simulate` [simulation semantics and limits](../cinema.md); no physical/broadcast timing qualification | [#26](https://github.com/stacksjs/drone/issues/26) |
3434| Environment, wildlife, anti-poaching observation and atmospheric samples | Partial: owned two-height synthetic cell sampling, calibration/geotags, conditional uncertainty, collection-policy faults and unsigned five-file provenance/export; physical samples, wildlife/authority and actual geofence qualification remain open | Native `environment:simulate` [semantics and limits](../environment.md); human review required | [#27](https://github.com/stacksjs/drone/issues/27) |
35| Deep feature audit, refresh and conformance gates | Pinned directory accounting and sampled behavior audit: 79 cases, including ten gimbal/mount and ten camera-feedback/capture gaps; deeper review and implementation remain open | [Audit integrity and source provenance](../parity.md); 26 bounded claims, no general parity claim | [#28](https://github.com/stacksjs/drone/issues/28) |
35| Deep feature audit, refresh and conformance gates | Pinned directory accounting and sampled behavior audit: 89 cases, including ten transport and ten camera-feedback/capture gaps; deeper review and implementation remain open | [Audit integrity and source provenance](../parity.md); 26 bounded claims, no general parity claim | [#28](https://github.com/stacksjs/drone/issues/28) |
3636
3737## Auditable source baseline
3838
docs/validation.mdmodified+15-1
Changes to docs/validation.md
@@ -61,9 +61,23 @@ not explain an earlier failure whose Chrome evidence was removed.
6161 The generated server function registry also loads successfully without duplicate runtime exports.
6262- This is scripted protocol-peer conformance, not actual autopilot firmware SITL, flight or HIL.
6363 [Issue #7](https://github.com/stacksjs/drone/issues/7) remains open for pinned-firmware campaigns,
64 serial/TCP, complete command/mission/parameter variants, persistent signing/key lifecycle and the
64 serial, complete command/mission/parameter variants, persistent signing/key lifecycle and the
6565 explicit FTP/log/event/time/RTCM/payload/ROS/CAN sub-capabilities. Physical writes remain disabled.
6666
67## TCP transport software slice
68
69The optional ArduPilot and PX4 factories also expose explicit loopback TCP. Scripted peer tests
70cover incremental framing, bounded pending writes, link loss, cancellation, signed input and fresh
71session construction after failure. The native `drivers:bench --transport tcp` command uses the same
72protocol implementation as UDP; copied standalone CLI campaigns exercise both firmware identities
73and transports outside the checkout.
74
75This transport slice was published in [b18e1d6](https://github.com/stacksjs/drone/commit/b18e1d63d344452cf45719cf3b4072a752b71bce),
76with its [exact-head qualification run](https://github.com/stacksjs/drone/actions/runs/39870834185).
77These are scripted peer and software-runtime results. They do not qualify actual firmware execution,
78physical writes, serial transport, transparent operation replay or persistent signing state.
79Read the [transport deadlines, queue limits and reconnection contract](driver-protocols.md#tcp-framing-loss-and-reconnection).
80
6781## Simulated authority and failsafe slice
6882
6983- 146 Bun tests pass with 16,781 assertions, including 15 authority tests. The two native CTest