22 lines
1.1 KiB
Markdown
22 lines
1.1 KiB
Markdown
# Safety model
|
|
|
|
Selection is local attention; authority is a mission-truth lease. Selected,
|
|
observed, requested, authority-held, conflict, and unavailable states use text
|
|
and symbols as well as color. No selection shortcut changes a lease.
|
|
|
|
Consequential commands always show what and where, the exact affected vehicle
|
|
set, current holder, reason for allowance/rejection, next state, and failure
|
|
effect. Validation covers simulated energy reserve, link quality, telemetry
|
|
freshness, route/constraint warning, capability where applicable, authority,
|
|
and source connectivity. A failed preview cannot be confirmed. Source
|
|
rejections carry a remediation path and are journaled.
|
|
|
|
UI movement is presentation only. The event stream is telemetry truth. The
|
|
persistent `SIMULATED DATA` badge and server warning distinguish every
|
|
interaction from real aircraft control. Local storage contains no telemetry,
|
|
lease, credential, receipt, or audit truth. Critical-state mandatory layers
|
|
cannot be hidden.
|
|
|
|
This is an operator workflow prototype and simulation test surface, not a
|
|
flight-safety approval or physical command system.
|