1.1 KiB
Safety model
Selection is local attention; authority is a mission-truth lease. Selected, observed, requested, authority-held, conflict, and unavailable states use text and symbols as well as color. No selection shortcut changes a lease.
Consequential commands always show what and where, the exact affected vehicle set, current holder, reason for allowance/rejection, next state, and failure effect. Validation covers simulated energy reserve, link quality, telemetry freshness, route/constraint warning, capability where applicable, authority, and source connectivity. A failed preview cannot be confirmed. Source rejections carry a remediation path and are journaled.
UI movement is presentation only. The event stream is telemetry truth. The
persistent SIMULATED DATA badge and server warning distinguish every
interaction from real aircraft control. Local storage contains no telemetry,
lease, credential, receipt, or audit truth. Critical-state mandatory layers
cannot be hidden.
This is an operator workflow prototype and simulation test surface, not a flight-safety approval or physical command system.