save

Signed-off-by: Onur Özkan <work@onurozkan.dev>

ground-suite/docs/SAFETY_MODEL.md

@@ -0,0 +1,21 @@
+# Safety model
+
+Selection is local attention; authority is a mission-truth lease. Selected,
+observed, requested, authority-held, conflict, and unavailable states use text
+and symbols as well as color. No selection shortcut changes a lease.
+
+Consequential commands always show what and where, the exact affected vehicle
+set, current holder, reason for allowance/rejection, next state, and failure
+effect. Validation covers simulated energy reserve, link quality, telemetry
+freshness, route/constraint warning, capability where applicable, authority,
+and source connectivity. A failed preview cannot be confirmed. Source
+rejections carry a remediation path and are journaled.
+
+UI movement is presentation only. The event stream is telemetry truth. The
+persistent `SIMULATED DATA` badge and server warning distinguish every
+interaction from real aircraft control. Local storage contains no telemetry,
+lease, credential, receipt, or audit truth. Critical-state mandatory layers
+cannot be hidden.
+
+This is an operator workflow prototype and simulation test surface, not a
+flight-safety approval or physical command system.