# Data plane

`DataSource` exposes descriptor/capabilities, connect, disconnect, command
submission, and optional replay controls. It contains no WebSocket, serial,
MAVLink, or Cerebrum types.

Every `EventEnvelope` carries schema version, stable event and stream IDs,
monotonic sequence, type, entity reference, source/receive timestamps,
optional correlation/causation IDs, payload, and quality/staleness metadata.
Unsupported schemas, invalid identity, sequence, timestamp, type, or quality
metadata are rejected into observable source diagnostics. Duplicate event IDs
and sequences at or below a stream high-water mark never mutate mission truth.
The fake journal is bounded to 1,000 envelopes and activity projection to 500
rows.

A snapshot replaces the projection. Telemetry updates known vehicles and
never creates identities. Source-health events represent pause, loss,
degradation, and recovery. An eventual live adapter must add unknown-reference
quarantine, signed source identity, restart epochs, and durable replay storage.

Commands use explicit lifecycle names. This release exercises Draft →
Validating → Validated → Dispatched → Acknowledged through preview and receipt
events, and represents queued/executing/completed intents in the action queue.
Rejected previews or source receipts include a human reason and remediation;
they do not mutate mission truth.