# Safety model

Selection is local attention; authority is a mission-truth lease. Selected,
observed, requested, authority-held, conflict, and unavailable states use text
and symbols as well as color. No selection shortcut changes a lease.

Consequential commands always show what and where, the exact affected vehicle
set, current holder, reason for allowance/rejection, next state, and failure
effect. Validation covers simulated energy reserve, link quality, telemetry
freshness, route/constraint warning, capability where applicable, authority,
and source connectivity. A failed preview cannot be confirmed. Source
rejections carry a remediation path and are journaled.

UI movement is presentation only. The event stream is telemetry truth. The
persistent `SIMULATED DATA` badge and server warning distinguish every
interaction from real aircraft control. Local storage contains no telemetry,
lease, credential, receipt, or audit truth. Critical-state mandatory layers
cannot be hidden.

This is an operator workflow prototype and simulation test surface, not a
flight-safety approval or physical command system.