Summary
Adds a retained createVehicleSimulationSession interface over the existing owned vehicle loop, so distinct vehicles advance at the same 4 ms epochs. Actual raw IMU/GNSS packets, clock anchors, estimator references, authority and watchdogs use captured uint64 boot/session scopes. The synchronous runVehicleSimulation command path drains this same interface.
shared epoch -> session A: raw sensors -> estimator -> policy -> independent board
-> session B: raw sensors -> estimator -> policy -> independent boardstep, terminal-only detached result and idempotent close preserve cleanup ownership. Host loss freezes host policy while an optional board/plant tail and the peer continue. Initial state and method references are captured before exposure; returned adapter data is captured inside closure checks. Reentrant close, recursive stepping and deferred getters cannot reopen an output lease or perform later owned work.
Refs #25. This is the shared-clock prerequisite; actual distinct-vehicle parcel/custody transfer remains open. Built on #97, now published on main.
Evidence
- Before: no retained scoped-session interface. Actual closing controller/actuator/ACK/fault/snapshot/method fixtures reproduced reopened leases, confirmed payload work or callbacks after teardown. After: 14 focused lifecycle/session tests passed with 1,849 assertions.
- Final cross-vehicle campaign: 308 passed, zero failed, 16,472 assertions across 21 files. Includes quad, fixed-wing, VTOL transition/recovery, ground, surface, subsea, raw sensors, authority, mission replay and cargo faults.
- Six complete default 12-second runtime reports remained byte-identical to pre-change source. All 31 actual copied cargo CLI outputs remained byte-identical to #97 qualification.
- Native Buddy runtime/app types, Pickier lint, docs and portable CLI builds passed. Generated docs: 95 pages, 7,160 local links and 95 assets without missing targets.
- Independent Spec and Standards reviews passed on all six changed files relative to #97. Exact-source workflow 40078358290 finished failure: the native check, workspace-browser, firmware and purge-namespace jobs passed, while execution-browser failed before CDP discovery as tracked in #72. Native results were 2,090 passed, 41 skipped, zero failed and 506,826 assertions across 235 files in 4,673.76 seconds; all 31 copied cargo cases passed. The original workflow ZIP and startup artifact were each retained once. This workflow does not qualify the source for main. Later superset #99 passed and #100 remains pending. Neither is an explanation of this failure. Full local suite was not launched below the host's 4 GB available-space floor.
Merge Danger
Door: two-way. No migration, network protocol or physical actuator endpoint.
Blast Radius: runtime. All owned vehicle simulation profiles use the same retained loop. Default scope and report shapes are preserved; adapter methods are fixed when a session opens. Explicit cancellation halts simulation with a neutral board, without claiming recovery/landing. Scope labels are not authenticated identity; deterministic model epochs are not distributed clock or real-time hardware qualification.
Publication checkpoint
Exact-source CI 40080999116 passed all five jobs: 2,098 native tests passed, 41 skipped, zero failed and 507,032 assertions across 236 files, plus 13 Python bridge tests and all 31 copied cargo cases. Original workflow and cargo ZIPs were each retained once. All cargo report hashes match the previous qualified Linux f22 release; local Mac reports have tiny binary64 differences and cross-host byte equality is not claimed. Both prerequisite commits retained their reviewed source hashes and were published to origin/main at 0eac2af as Chris with no coauthors through a normal fast-forward. PR #98's failed workflow remains a distinct unresolved startup failure under #72; this later success does not explain it. Finite station handling and actual two-vehicle authority/custody integration remain in progress, so issue #25 remains incomplete.