Merge branch 'stage' into main

Merge branch 'dev' into stage
2026-06-21 18:31:13 +00:00 · 2026-04-22 01:40:33 +03:00 · 2026-04-22 01:37:33 +03:00
366 changed files with 15644 additions and 20760 deletions
@@ -1,29 +0,0 @@
 ---
 description: "Forbid spawning subagents; the main agent must do the work directly"
 alwaysApply: true
 ---
 # No Subagents
 Do NOT create or delegate to subagents. This includes:
 - The `Task` tool with any `subagent_type` (e.g. `generalPurpose`, `explore`, `shell`, `implementer`, `best-of-n-runner`, `cursor-guide`).
 - Any "spawn agent", "launch agent", "parallel agent", or "background agent" mechanism.
 - Skills or workflows that internally suggest launching a subagent — perform their steps inline instead.
 ## Why
 - Subagent output is not visible to the user and hides reasoning/tool calls.
 - Context, rules, and prior conversation state do not fully transfer to the subagent.
 - Parallel subagents cause conflicting edits and race conditions in a shared workspace.
 - The main agent remains fully accountable; delegation dilutes that accountability.
 ## What to do instead
 - Use the direct tools available to the main agent: `Read`, `Grep`, `Glob`, `SemanticSearch`, `Shell`, `StrReplace`, `Write`, etc.
 - For broad exploration, run `Grep`/`Glob`/`SemanticSearch` yourself and read the files directly.
 - For multi-step work, use `TodoWrite` to track progress inline.
 - For isolated experiments the user explicitly asks for, use a git branch/worktree you manage directly — not a subagent runner.
 ## Exception
 Only spawn a subagent if the user explicitly requests it in the current turn (e.g. "use a subagent to…", "launch an explore agent…"). Even then, confirm once before spawning.
@@ -1,46 +0,0 @@
 ---
 description: "Explanation length and reasoning depth calibration"
 alwaysApply: true
 ---
 # Response Calibration
 Default to concise. Expand only when the content demands it.
 ## Length target
 - **Default**: a direct answer in ~3–10 lines. Short paragraphs or a tight bullet list.
 - **Expand when**: the question involves trade-offs across multiple options, a migration/architectural decision, a security/data-loss risk, or the user explicitly asks for depth ("explain in detail", "walk me through", "why").
 - **Shrink when**: the user asks for "shorter", "simpler", "TL;DR", "one line", or similar. Do not re-inflate in later turns unless they ask a new deeper question.
 ## Completeness floor
 Short ≠ incomplete. Every response must still:
 - Answer the actual question asked (not a reframed version).
 - State the key constraint or reason *once*, not repeatedly.
 - Flag a real caveat if one exists (data loss, breaking change, wrong-OS, security). One sentence is enough.
 - Not drop a step from an action sequence. If there are 5 steps, list 5 — but without narration between them.
 If the honest answer truly needs more space (e.g. trade-off matrix, multi-option decision), write more — but lead with the recommendation or direct answer, then the detail.
 ## Structure
 - One direct sentence first. Then supporting detail.
 - Prefer bullets over prose for enumerations, comparisons, or step lists.
 - Drop section headers for anything under ~15 lines.
 - No "Summary" / "Conclusion" sections unless the response is genuinely long.
 ## Reasoning depth (internal)
 - Match thinking to the problem, not the length of the answer.
  - Factual / "where is X used" / single-file edit → minimal thinking, go straight to tools.
  - Trade-off / refactor / debugging 3+ hypotheses deep → full thinking budget.
 - Do not pad thinking to look thorough. Do not skip thinking on genuinely ambiguous problems to look fast.
 ## Anti-patterns to avoid
 - Restating the question back to the user.
 - Multi-paragraph preambles before the answer.
 - Exhaustive "alternatives considered" sections when the user didn't ask for alternatives.
 - Recapping what was just done at the end of every tool-using turn ("Done. I have edited the file…") — a one-line confirmation is enough.
 - Speculative "you might also want to…" paragraphs. Offer follow-ups as a single short sentence, or not at all.
@@ -1,38 +0,0 @@
 ---
 description: "Standards for creating and maintaining Cursor skills"
 globs: [".cursor/skills/**"]
 ---
 # Skill Building
 ## When To Create A Skill
 - Create a skill for repeatable, bounded workflows that benefit from a reusable process.
 - Do not create a skill for a one-off task, vague goal, or workflow that still needs product decisions.
 - Start small; evolve the skill when repeated use reveals clearer steps, constraints, or checks.
 ## Skill Contract
 - `SKILL.md` must define a clear `name` and a proactive `description` that explains when the skill should be used.
 - State expected inputs, constraints, workflow steps, and final output shape.
 - Make trigger conditions explicit enough that the agent can recognize intent without an exact command.
 - Base instructions on observable project evidence; do not invite fabrication or unsupported assumptions.
 ## Keep The Core Lean
 - Keep `SKILL.md` concise and under the repo's `.cursor/` size guidance.
 - Move detailed standards, examples, and background knowledge into `references/`.
 - Put reusable output shapes in `templates/` or other skill-local assets instead of embedding them in the main instructions.
 - Keep one primary responsibility per skill; use an orchestrator skill only when multiple existing skills must run in a defined order.
 ## Deterministic Work
 - Use scripts for mechanical steps that are repeatable, parameterized, and safer outside the model's reasoning.
 - Scripts must expose explicit inputs, avoid hidden side effects, and fail loudly on errors.
 - Do not use scripts to bypass review, hide destructive behavior, or hardcode secrets.
 ## Quality Proof
 - Include realistic examples, checklists, or eval-style scenarios that define what good output looks like.
 - Cover common failure cases such as missing sections, leftover placeholders, hallucinated facts, unsafe actions, or malformed output.
 - Review skill changes against those checks before treating the skill as ready.
 ## Security Review
 - Treat third-party skills like untrusted code until reviewed.
 - Inspect scripts, dependencies, references, secret handling, network calls, and destructive commands before use.
 - Prefer local, project-scoped assets and dependencies; document any external dependency the skill requires.
@@ -3,7 +3,7 @@ name: autodev
 description: |
  Auto-chaining orchestrator that drives the full BUILD-SHIP workflow from problem gathering through deployment.
  Detects current project state from _docs/ folder, resumes from where it left off, and flows through
-  problem → research → plan → test specs → decompose → implement → tests → docs sync → deploy without manual skill invocation.
+  problem → research → plan → decompose → implement → deploy without manual skill invocation.
  Maximizes work per conversation by auto-transitioning between skills.
  Trigger phrases:
  - "autodev", "auto", "start", "continue"
@@ -52,7 +52,7 @@ Determine which flow to use (check in order — first match wins):
 After selecting the flow, apply its detection rules (first match wins) to determine the current step.
-**Note**: the meta-repo flow uses a different artifact layout — its source of truth is `_docs/_repo-config.yaml`, not `_docs/NN_*/` folders. After Step 2.5 it also produces `_docs/glossary.md` and a `## Architecture Vision` section in the cross-cutting architecture doc identified by `docs.cross_cutting`. Other detection rules assume the BUILD-SHIP artifact layout; they don't apply to meta-repos.
+**Note**: the meta-repo flow uses a different artifact layout — its source of truth is `_docs/_repo-config.yaml`, not `_docs/NN_*/` folders. Other detection rules assume the BUILD-SHIP artifact layout; they don't apply to meta-repos.
 ## Execution Loop
@@ -13,7 +13,7 @@ A first-time run executes Phase A then Phase B; every subsequent invocation re-e
 | Step | Name | Sub-Skill | Internal SubSteps |
 |------|------|-----------|-------------------|
-| 1 | Document | document/SKILL.md | Steps 0–7 incl. inline 2.5 (module-layout) and 4.5 (glossary + arch vision) |
+| 1 | Document | document/SKILL.md | Steps 1–8 |
 | 2 | Architecture Baseline Scan | code-review/SKILL.md (baseline mode) | Phase 1 + Phase 7 |
 | 3 | Test Spec | test-spec/SKILL.md | Phases 1–4 |
 | 4 | Code Testability Revision | refactor/SKILL.md (guided mode) | Phases 0–7 (conditional) |
@@ -53,8 +53,6 @@ Action: An existing codebase without documentation was detected. Read and execut
 The document skill's Step 2.5 produces `_docs/02_document/module-layout.md`, which is required by every downstream step that assigns file ownership (`/implement` Step 4, `/code-review` Phase 7, `/refactor` discovery). If this file is missing after Step 1 completes (e.g., a pre-existing `_docs/` dir predates the 2.5 addition), re-invoke `/document` in resume mode — it will pick up at Step 2.5.
 The document skill's Step 4.5 produces `_docs/02_document/glossary.md` and prepends a confirmed `## Architecture Vision` section to `architecture.md`. Both are user-confirmed artifacts; downstream skills (refactor, decompose, new-task) treat them as authoritative for terminology and structural intent. If `glossary.md` is missing after Step 1 (pre-existing `_docs/` dir from before the 4.5 addition), re-invoke `/document` in resume mode — it will pick up at Step 4.5 without redoing module/component analysis.
 ---
 **Step 2 — Architecture Baseline Scan**
@@ -152,17 +150,15 @@ If `_docs/02_tasks/` subfolders have some task files already (e.g., refactoring
 ---
 **Step 6 — Implement Tests**
-Condition (folder fallback): `_docs/02_tasks/todo/` contains test task files AND `_dependencies_table.md` exists AND `_docs/03_implementation/implementation_report_tests.md` does not exist.
+Condition (folder fallback): `_docs/02_tasks/todo/` contains task files AND `_dependencies_table.md` exists AND `_docs/03_implementation/implementation_report_tests.md` does not exist.
 State-driven: reached by auto-chain from Step 5.
-Action: Invoke `.cursor/skills/implement/SKILL.md` with task selection context **Test implementation**.
+Action: Read and execute `.cursor/skills/implement/SKILL.md`
-The implement skill reads only test tasks from `_docs/02_tasks/todo/` and implements them.
+The implement skill reads test tasks from `_docs/02_tasks/todo/` and implements them.
 If `_docs/03_implementation/` has batch reports, the implement skill detects completed tasks and continues.
 For folder fallback, **test task files** means `*_test_infrastructure.md` plus task specs whose `**Component**` or `**Epic**` identifies `Blackbox Tests`.
 ---
 **Step 7 — Run Tests**
@@ -1,6 +1,6 @@
 # Greenfield Workflow
-Workflow for new projects built from scratch. Flows linearly: Problem → Research → Plan → UI Design (if applicable) → Test Spec → Decompose → Implement + Product Completeness Gate → Code Testability Revision → Decompose Tests → Implement Tests → Run Tests → Test-Spec Sync → Update Docs → Security Audit (optional) → Performance Test (optional) → Deploy → Retrospective.
+Workflow for new projects built from scratch. Flows linearly: Problem → Research → Plan → UI Design (if applicable) → Decompose → Implement → Run Tests → Security Audit (optional) → Performance Test (optional) → Deploy → Retrospective.
 ## Step Reference Table
@@ -10,19 +10,13 @@ Workflow for new projects built from scratch. Flows linearly: Problem → Resear
 | 2 | Research | research/SKILL.md | Mode A: Phase 1–4 · Mode B: Step 0–8 |
 | 3 | Plan | plan/SKILL.md | Step 1–6 + Final |
 | 4 | UI Design | ui-design/SKILL.md | Phase 0–8 (conditional — UI projects only) |
-| 5 | Test Spec | test-spec/SKILL.md | Phases 1–4 |
+| 5 | Decompose | decompose/SKILL.md | Step 1–4 |
-| 6 | Decompose | decompose/SKILL.md (implementation task decomposition) | Step 1 + Step 1.5 + Step 2 + Step 4 |
+| 6 | Implement | implement/SKILL.md | (batch-driven, no fixed sub-steps) |
-| 7 | Implement | implement/SKILL.md | Batch loop + Product Implementation Completeness Gate |
+| 7 | Run Tests | test-run/SKILL.md | Steps 1–4 |
-| 8 | Code Testability Revision | refactor/SKILL.md (guided mode) | Phases 0–7 (conditional) |
+| 8 | Security Audit | security/SKILL.md | Phase 1–5 (optional) |
-| 9 | Decompose Tests | decompose/SKILL.md (tests-only) | Step 1t + Step 3 + Step 4 |
+| 9 | Performance Test | test-run/SKILL.md (perf mode) | Steps 1–5 (optional) |
-| 10 | Implement Tests | implement/SKILL.md | (batch-driven, no fixed sub-steps) |
+| 10 | Deploy | deploy/SKILL.md | Step 1–7 |
-| 11 | Run Tests | test-run/SKILL.md | Steps 1–4 |
+| 11 | Retrospective | retrospective/SKILL.md (cycle-end mode) | Steps 1–4 |
 | 12 | Test-Spec Sync | test-spec/SKILL.md (cycle-update mode) | Phase 2 + Phase 3 (scoped) |
 | 13 | Update Docs | document/SKILL.md (task mode) | Task Steps 0–5 |
 | 14 | Security Audit | security/SKILL.md | Phase 1–5 (optional) |
 | 15 | Performance Test | test-run/SKILL.md (perf mode) | Steps 1–5 (optional) |
 | 16 | Deploy | deploy/SKILL.md | Step 1–7 |
 | 17 | Retrospective | retrospective/SKILL.md (cycle-end mode) | Steps 1–4 |
 ## Detection Rules
@@ -86,12 +80,12 @@ If `_docs/02_document/` exists but is incomplete (has some artifacts but no `FIN
 ---
 **Step 4 — UI Design (conditional)**
-Condition (folder fallback): `_docs/02_document/architecture.md` exists AND `_docs/02_document/tests/traceability-matrix.md` does not exist.
+Condition (folder fallback): `_docs/02_document/architecture.md` exists AND `_docs/02_tasks/todo/` does not exist or has no task files.
 State-driven: reached by auto-chain from Step 3.
 Action: Read and execute `.cursor/skills/ui-design/SKILL.md`. The skill runs its own **Applicability Check**, which handles UI project detection and the user's A/B choice. It returns one of:
- `outcome: completed` → mark Step 4 as `completed`, auto-chain to Step 5 (Test Spec).
+- `outcome: completed` → mark Step 4 as `completed`, auto-chain to Step 5 (Decompose).
 - `outcome: skipped, reason: not-a-ui-project` → mark Step 4 as `skipped`, auto-chain to Step 5.
 - `outcome: skipped, reason: user-declined` → mark Step 4 as `skipped`, auto-chain to Step 5.
@@ -99,162 +93,34 @@ The autodev no longer inlines UI detection heuristics — they live in `ui-desig
 ---
-**Step 5 — Test Spec**
+**Step 5 — Decompose**
-Condition (folder fallback): `_docs/02_document/FINAL_report.md` exists AND `_docs/02_document/architecture.md` exists AND `_docs/02_document/tests/traceability-matrix.md` does not exist.
+Condition: `_docs/02_document/` contains `architecture.md` AND `_docs/02_document/components/` has at least one component AND `_docs/02_tasks/todo/` does not exist or has no task files
 State-driven: reached by auto-chain from Step 4 (completed or skipped).
-Action: Read and execute `.cursor/skills/test-spec/SKILL.md`.
+Action: Read and execute `.cursor/skills/decompose/SKILL.md`
 This step converts the greenfield problem statement, acceptance criteria, solution, architecture, component docs, and UI design artifacts (if any) into test specifications before implementation begins. The test spec should cover unit, integration, blackbox, and e2e scenarios where those levels are applicable to the project.
 ---
 **Step 6 — Decompose**
 Condition: `_docs/02_document/` contains `architecture.md` AND `_docs/02_document/components/` has at least one component AND `_docs/02_document/tests/traceability-matrix.md` exists AND `_docs/02_tasks/todo/` does not exist or has no implementation task files.
 Action: Invoke `.cursor/skills/decompose/SKILL.md` for **implementation task decomposition**. The greenfield flow selects the implementation entrypoint before handing off: Bootstrap Structure, Module Layout, Component Task Decomposition, and Cross-Task Verification.
 Do not invoke Blackbox Test Task Decomposition from Step 6. Test tasks are intentionally deferred to Step 9 (Decompose Tests) so the first implementation batch stays focused on product functionality and Step 8 can revise testability before test task files exist.
 If `_docs/02_tasks/` subfolders have some task files already, the decompose skill's resumability handles it.
 ---
-**Step 7 — Implement**
+**Step 6 — Implement**
-Condition: `_docs/02_tasks/todo/` contains implementation task files AND `_dependencies_table.md` exists AND `_docs/03_implementation/` does not contain a valid product implementation report.
+Condition: `_docs/02_tasks/todo/` contains task files AND `_dependencies_table.md` exists AND `_docs/03_implementation/` does not contain any `implementation_report_*.md` file
-Action: Invoke `.cursor/skills/implement/SKILL.md` with task selection context **Product implementation**.
+Action: Read and execute `.cursor/skills/implement/SKILL.md`
 The implement skill must run its **Product Implementation Completeness Gate** before it writes any final product implementation report. This gate compares completed product task specs, architecture/component promises, and actual source code so scaffold-only implementations cannot advance to Step 8. A final product implementation report without `_docs/03_implementation/implementation_completeness_cycle[N]_report.md` is incomplete and must not be treated as Step 7 completion.
 If `_docs/03_implementation/` has batch reports, the implement skill detects completed tasks and continues. The FINAL report filename is context-dependent — see implement skill documentation for naming convention.
 For folder fallback, **implementation task files** means task specs that are not test-only specs: exclude `*_test_infrastructure.md` and task specs whose `**Component**` or `**Epic**` identifies `Blackbox Tests`.
 For folder fallback, a **product implementation report** is any `_docs/03_implementation/implementation_report_*.md` file except `_docs/03_implementation/implementation_report_tests.md` and refactor reports. It is valid for greenfield progression only when:
 - the matching `_docs/03_implementation/implementation_completeness_cycle[N]_report.md` exists,
 - that completeness report does not contain unresolved `FAIL` classifications, and
 - `_docs/02_tasks/todo/` contains no pending implementation task files.
 If a product report exists but any of those validity checks fail, treat product implementation as incomplete and stay in Step 7.
 ---
-**Step 8 — Code Testability Revision**
+**Step 7 — Run Tests**
-Condition (folder fallback): `_docs/03_implementation/` contains a valid product implementation report, `_docs/03_implementation/implementation_completeness_cycle[N]_report.md` exists without unresolved `FAIL` classifications, `_docs/04_refactoring/01-testability-refactoring/testability_assessment.md` does not exist, `_docs/04_refactoring/01-testability-refactoring/testability_changes_summary.md` does not exist, `_docs/03_implementation/implementation_report_tests.md` does not exist, and `_docs/02_tasks/todo/` does not contain test task files.
+Condition (folder fallback): `_docs/03_implementation/` contains an `implementation_report_*.md` file.
-State-driven: reached by auto-chain from Step 7.
+State-driven: reached by auto-chain from Step 6.
 **Purpose**: verify the newly built code can be exercised by the planned tests before writing the test suite. Greenfield code should be testable by design; this step catches accidental hardcoded paths, singletons, direct external service construction, or other implementation choices that would make meaningful tests impossible.
 **Scope — MINIMAL, SURGICAL fixes**: this is not a general refactor. It is the smallest set of changes required to make the implemented code runnable under tests.
 **Allowed changes** in this phase:
 - Replace hardcoded URLs / file paths / credentials / magic numbers with env vars or constructor arguments.
 - Extract narrow interfaces for components that need stubbing in tests.
 - Add optional constructor parameters for dependency injection; default to the existing behavior so callers do not break.
 - Wrap global singletons in thin accessors that tests can override.
 - Split a function ONLY when necessary to stub one of its collaborators — do not split for clarity alone.
 **NOT allowed** in this phase (defer to a later refactor task):
 - Renaming public APIs.
 - Moving code between files unless strictly required for isolation.
 - Changing algorithms or business logic.
 - Restructuring module boundaries or rewriting layers.
 Action: Analyze the codebase against the test specs to determine whether the code can be tested as-is.
 1. Read `_docs/02_document/tests/traceability-matrix.md` and all test scenario files in `_docs/02_document/tests/`.
 2. For each test scenario, check whether the code under test can be exercised in isolation. Look for:
   - Hardcoded file paths or directory references
   - Hardcoded configuration values (URLs, credentials, magic numbers)
   - Global mutable state that cannot be overridden
   - Tight coupling to external services without abstraction
   - Missing dependency injection or non-configurable parameters
   - Direct file system operations without path configurability
   - Inline construction of heavy dependencies (models, clients)
 3. If ALL scenarios are testable as-is:
   - Create `_docs/04_refactoring/01-testability-refactoring/`
   - Write `_docs/04_refactoring/01-testability-refactoring/testability_assessment.md` with the scenarios reviewed and outcome "Code is testable — no changes needed"
   - Mark Step 8 as `completed` with outcome "Code is testable — no changes needed"
   - Auto-chain to Step 9 (Decompose Tests)
 4. If testability issues are found:
   - Create `_docs/04_refactoring/01-testability-refactoring/`
   - Write `list-of-changes.md` in that directory using the refactor skill template (`.cursor/skills/refactor/templates/list-of-changes.md`), with:
     - **Mode**: `guided`
     - **Source**: `autodev-greenfield-testability-analysis`
     - One change entry per testability issue found (change ID, file paths, problem, proposed change, risk, dependencies). Each entry must fit the allowed-changes list above; reject entries that drift into full refactor territory and log them under "Deferred refactor candidates" instead.
   - Invoke the refactor skill in **guided mode**: read and execute `.cursor/skills/refactor/SKILL.md` with the `list-of-changes.md` as input
   - Phase 3 (Safety Net) is skipped for this testability run because the test suite has not been implemented yet
   - After execution, surface `RUN_DIR/testability_changes_summary.md` to the user via the Choose format (accept / request follow-up) before auto-chaining
   - Copy or save the accepted summary as `_docs/04_refactoring/01-testability-refactoring/testability_changes_summary.md` so folder fallback can detect Step 8 completion
   - Mark Step 8 as `completed`
   - Auto-chain to Step 9 (Decompose Tests)
 ---
 **Step 9 — Decompose Tests**
 Condition (folder fallback): `_docs/02_document/tests/traceability-matrix.md` exists AND workspace contains source code files AND `_docs/03_implementation/` contains a valid product implementation report AND `_docs/03_implementation/implementation_completeness_cycle[N]_report.md` exists without unresolved `FAIL` classifications AND (`_docs/04_refactoring/01-testability-refactoring/testability_assessment.md` exists OR `_docs/04_refactoring/01-testability-refactoring/testability_changes_summary.md` exists) AND (`_docs/02_tasks/todo/` does not exist or has no test task files) AND `_docs/03_implementation/implementation_report_tests.md` does not exist.
 State-driven: reached by auto-chain from Step 8.
 Action: Read and execute `.cursor/skills/decompose/SKILL.md` in **tests-only mode** (pass `_docs/02_document/tests/` as input). The decompose skill will:
 1. Run Step 1t (test infrastructure bootstrap)
 2. Run Step 3 (blackbox/e2e-capable test task decomposition)
 3. Run Step 4 (cross-verification against test coverage)
 If `_docs/02_tasks/` subfolders have some task files already, the decompose skill's resumability handles it — it appends test tasks alongside existing completed implementation tasks.
 ---
 **Step 10 — Implement Tests**
 Condition (folder fallback): `_docs/02_tasks/todo/` contains test task files AND `_dependencies_table.md` exists AND `_docs/03_implementation/implementation_report_tests.md` does not exist.
 State-driven: reached by auto-chain from Step 9.
 Action: Invoke `.cursor/skills/implement/SKILL.md` with task selection context **Test implementation**.
 The implement skill reads only test tasks from `_docs/02_tasks/todo/` and implements them.
 If `_docs/03_implementation/` has batch reports, the implement skill detects completed test tasks and continues.
 For folder fallback, **test task files** means `*_test_infrastructure.md` plus task specs whose `**Component**` or `**Epic**` identifies `Blackbox Tests`.
 ---
 **Step 11 — Run Tests**
 Condition (folder fallback): `_docs/03_implementation/implementation_report_tests.md` exists.
 State-driven: reached by auto-chain from Step 10.
 Action: Read and execute `.cursor/skills/test-run/SKILL.md`
 Verifies the implemented unit, integration, blackbox, and e2e tests pass before proceeding to spec and documentation sync.
 ---
-**Step 12 — Test-Spec Sync**
+**Step 8 — Security Audit (optional)**
-State-driven: reached by auto-chain from Step 11. Requires `_docs/02_document/tests/traceability-matrix.md` to exist — if missing, mark Step 12 `skipped` (see Action below).
+State-driven: reached by auto-chain from Step 7.
 Action: Read and execute `.cursor/skills/test-spec/SKILL.md` in **cycle-update mode**. Pass the completed implementation task specs, completed test task specs, and implementation reports as inputs.
 The skill appends implementation-learned acceptance criteria, scenarios, and NFR updates to the existing test-spec files without rewriting unaffected sections. If `traceability-matrix.md` is missing, mark Step 12 as `skipped` — the next `/test-spec` full run will regenerate it.
 After completion, auto-chain to Step 13 (Update Docs).
 ---
 **Step 13 — Update Docs**
 State-driven: reached by auto-chain from Step 12 (completed or skipped). Requires `_docs/02_document/` to contain existing documentation — if missing, mark Step 13 `skipped` (see Action below).
 Action: Read and execute `.cursor/skills/document/SKILL.md` in **Task mode**. Pass all completed implementation and test task spec files plus the implementation reports.
 The document skill in Task mode updates affected module docs, component docs, system-level docs, and test documentation without redoing full discovery, verification, or problem extraction.
 If `_docs/02_document/` does not contain existing docs, mark Step 13 as `skipped`.
 After completion, auto-chain to Step 14 (Security Audit).
 ---
 **Step 14 — Security Audit (optional)**
 State-driven: reached by auto-chain from Step 13 (completed or skipped).
 Action: Apply the **Optional Skill Gate** (`protocols.md` → "Optional Skill Gate") with:
 - question:        `Run security audit before deploy?`
@@ -262,12 +128,12 @@ Action: Apply the **Optional Skill Gate** (`protocols.md` → "Optional Skill Ga
 - option-b-label:  `Skip — proceed directly to deploy`
 - recommendation:  `A — catches vulnerabilities before production`
 - target-skill:    `.cursor/skills/security/SKILL.md`
- next-step:       Step 15 (Performance Test)
+- next-step:       Step 9 (Performance Test)
 ---
-**Step 15 — Performance Test (optional)**
+**Step 9 — Performance Test (optional)**
-State-driven: reached by auto-chain from Step 14 (completed or skipped).
+State-driven: reached by auto-chain from Step 8.
 Action: Apply the **Optional Skill Gate** (`protocols.md` → "Optional Skill Gate") with:
 - question:        `Run performance/load tests before deploy?`
@@ -275,30 +141,30 @@ Action: Apply the **Optional Skill Gate** (`protocols.md` → "Optional Skill Ga
 - option-b-label:  `Skip — proceed directly to deploy`
 - recommendation:  `A or B — base on whether acceptance criteria include latency, throughput, or load requirements`
 - target-skill:    `.cursor/skills/test-run/SKILL.md` in **perf mode** (the skill handles runner detection, threshold comparison, and its own A/B/C gate on threshold failures)
- next-step:       Step 16 (Deploy)
+- next-step:       Step 10 (Deploy)
 ---
-**Step 16 — Deploy**
+**Step 10 — Deploy**
-State-driven: reached by auto-chain from Step 15 (after Step 15 is completed or skipped).
+State-driven: reached by auto-chain from Step 9 (after Step 9 is completed or skipped).
 Action: Read and execute `.cursor/skills/deploy/SKILL.md`.
-After the deploy skill completes successfully, mark Step 16 as `completed` and auto-chain to Step 17 (Retrospective).
+After the deploy skill completes successfully, mark Step 10 as `completed` and auto-chain to Step 11 (Retrospective).
 ---
-**Step 17 — Retrospective**
+**Step 11 — Retrospective**
-State-driven: reached by auto-chain from Step 16.
+State-driven: reached by auto-chain from Step 10.
 Action: Read and execute `.cursor/skills/retrospective/SKILL.md` in **cycle-end mode**. This closes the cycle's feedback loop by folding metrics into `_docs/06_metrics/retro_<date>.md` and appending the top-3 lessons to `_docs/LESSONS.md`.
-After retrospective completes, mark Step 17 as `completed` and enter "Done" evaluation.
+After retrospective completes, mark Step 11 as `completed` and enter "Done" evaluation.
 ---
 **Done**
-State-driven: reached by auto-chain from Step 17. (Sanity check: `_docs/04_deploy/` should contain all expected artifacts — containerization.md, ci_cd_pipeline.md, environment_strategy.md, observability.md, deployment_procedures.md, deploy_scripts.md.)
+State-driven: reached by auto-chain from Step 11. (Sanity check: `_docs/04_deploy/` should contain all expected artifacts — containerization.md, ci_cd_pipeline.md, environment_strategy.md, observability.md, deployment_procedures.md, deploy_scripts.md.)
 Action: Report project completion with summary. Then **rewrite the state file** so the next `/autodev` invocation enters the feature-cycle loop in the existing-code flow:
@@ -325,65 +191,47 @@ On the next invocation, Flow Resolution rule 1 reads `flow: existing-code` and r
 | Research (2) | Auto-chain → Research Decision (ask user: another round or proceed?) |
 | Research Decision → proceed | Auto-chain → Plan (3) |
 | Plan (3) | Auto-chain → UI Design detection (4) |
-| UI Design (4, done or skipped) | Auto-chain → Test Spec (5) |
+| UI Design (4, done or skipped) | Auto-chain → Decompose (5) |
-| Test Spec (5) | Auto-chain → Decompose (6) |
+| Decompose (5) | **Session boundary** — suggest new conversation before Implement |
-| Decompose (6) | **Session boundary** — suggest new conversation before Implement |
+| Implement (6) | Auto-chain → Run Tests (7) |
-| Implement (7) | Auto-chain only after Product Implementation Completeness Gate passes → Code Testability Revision (8) |
+| Run Tests (7, all pass) | Auto-chain → Security Audit choice (8) |
-| Code Testability Revision (8) | Auto-chain → Decompose Tests (9) |
+| Security Audit (8, done or skipped) | Auto-chain → Performance Test choice (9) |
-| Decompose Tests (9) | **Session boundary** — suggest new conversation before Implement Tests |
+| Performance Test (9, done or skipped) | Auto-chain → Deploy (10) |
-| Implement Tests (10) | Auto-chain → Run Tests (11) |
+| Deploy (10) | Auto-chain → Retrospective (11) |
-| Run Tests (11, all pass) | Auto-chain → Test-Spec Sync (12) |
+| Retrospective (11) | Report completion; rewrite state to existing-code flow, step 9 |
 | Test-Spec Sync (12, done or skipped) | Auto-chain → Update Docs (13) |
 | Update Docs (13, done or skipped) | Auto-chain → Security Audit choice (14) |
 | Security Audit (14, done or skipped) | Auto-chain → Performance Test choice (15) |
 | Performance Test (15, done or skipped) | Auto-chain → Deploy (16) |
 | Deploy (16) | Auto-chain → Retrospective (17) |
 | Retrospective (17) | Report completion; rewrite state to existing-code flow, step 9 |
 ## Status Summary — Step List
 Flow name: `greenfield`. Render using the banner template in `protocols.md` → "Banner Template (authoritative)". No header-suffix, current-suffix, or footer-extras — all empty for this flow.
-| # | Step Name                   | Extra state tokens (beyond the shared set) |
+| # | Step Name          | Extra state tokens (beyond the shared set) |
-|---|-----------------------------|--------------------------------------------|
+|---|--------------------|--------------------------------------------|
-| 1 | Problem                     | — |
+| 1 | Problem            | — |
-| 2 | Research                    | `DONE (N drafts)` |
+| 2 | Research           | `DONE (N drafts)` |
-| 3 | Plan                        | — |
+| 3 | Plan               | — |
-| 4 | UI Design                   | — |
+| 4 | UI Design          | — |
-| 5 | Test Spec                   | — |
+| 5 | Decompose          | `DONE (N tasks)` |
-| 6 | Decompose                   | `DONE (N tasks)` |
+| 6 | Implement          | `IN PROGRESS (batch M of ~N)` |
-| 7 | Implement                   | `IN PROGRESS (batch M of ~N)` |
+| 7 | Run Tests          | `DONE (N passed, M failed)` |
-| 8 | Code Testability Revision   | — |
+| 8 | Security Audit     | — |
-| 9 | Decompose Tests             | `DONE (N tasks)` |
+| 9 | Performance Test   | — |
-| 10 | Implement Tests            | `IN PROGRESS (batch M)` |
+| 10 | Deploy            | — |
-| 11 | Run Tests                  | `DONE (N passed, M failed)` |
+| 11 | Retrospective     | — |
 | 12 | Test-Spec Sync             | — |
 | 13 | Update Docs                | — |
 | 14 | Security Audit             | — |
 | 15 | Performance Test           | — |
 | 16 | Deploy                     | — |
 | 17 | Retrospective              | — |
-All rows also accept the shared state tokens (`DONE`, `IN PROGRESS`, `NOT STARTED`, `FAILED (retry N/3)`); rows 4, 12, 13, 14, 15 additionally accept `SKIPPED`.
+All rows also accept the shared state tokens (`DONE`, `IN PROGRESS`, `NOT STARTED`, `FAILED (retry N/3)`); rows 4, 8, 9 additionally accept `SKIPPED`.
 Row rendering format (step-number column is right-padded to 2 characters for alignment):
 ```
- Step 1   Problem                   [<state token>]
+ Step 1   Problem             [<state token>]
- Step 2   Research                  [<state token>]
+ Step 2   Research            [<state token>]
- Step 3   Plan                      [<state token>]
+ Step 3   Plan                [<state token>]
- Step 4   UI Design                 [<state token>]
+ Step 4   UI Design           [<state token>]
- Step 5   Test Spec                 [<state token>]
+ Step 5   Decompose           [<state token>]
- Step 6   Decompose                 [<state token>]
+ Step 6   Implement           [<state token>]
- Step 7   Implement                 [<state token>]
+ Step 7   Run Tests           [<state token>]
- Step 8   Code Testability Rev.     [<state token>]
+ Step 8   Security Audit      [<state token>]
- Step 9   Decompose Tests           [<state token>]
+ Step 9   Performance Test    [<state token>]
- Step 10  Implement Tests           [<state token>]
+ Step 10  Deploy              [<state token>]
- Step 11  Run Tests                 [<state token>]
+ Step 11  Retrospective       [<state token>]
 Step 12  Test-Spec Sync            [<state token>]
 Step 13  Update Docs               [<state token>]
 Step 14  Security Audit            [<state token>]
 Step 15  Performance Test          [<state token>]
 Step 16  Deploy                    [<state token>]
 Step 17  Retrospective             [<state token>]
 ```
@@ -15,10 +15,8 @@ This flow differs fundamentally from `greenfield` and `existing-code`:
 |------|------|-----------|-------------------|
 | 1 | Discover | monorepo-discover/SKILL.md | Phase 1–10 |
 | 2 | Config Review | (human checkpoint, no sub-skill) | — |
 | 2.5 | Glossary & Architecture Vision | (inline, no sub-skill) | Steps 1–5 |
 | 3 | Status | monorepo-status/SKILL.md | Sections 1–5 |
 | 4 | Document Sync | monorepo-document/SKILL.md | Phase 1–7 (conditional on doc drift) |
 | 4.5 | Integration Test Sync | monorepo-e2e/SKILL.md | Phase 1–6 (conditional on suite-e2e drift; skipped if `suite_e2e:` block absent in config) |
 | 5 | CICD Sync | monorepo-cicd/SKILL.md | Phase 1–7 (conditional on CI drift) |
 | 6 | Loop | (auto-return to Step 3 on next invocation) | — |
@@ -60,121 +58,17 @@ Action: This is a **hard session boundary**. The skill cannot proceed until a hu
 ══════════════════════════════════════
 ```
- If user picks A → verify `confirmed_by_user: true` is now set in the config. If still `false`, re-ask. If true, auto-chain to **Step 2.5 (Glossary & Architecture Vision)**.
+- If user picks A → verify `confirmed_by_user: true` is now set in the config. If still `false`, re-ask. If true, auto-chain to **Step 3 (Status)**.
 - If user picks B → mark Step 2 as `in_progress`, update state file, end the session. Tell the user to invoke `/autodev` again after reviewing.
 **Do NOT auto-flip `confirmed_by_user`.** Only the human does that.
 ---
 **Step 2.5 — Glossary & Architecture Vision** (one-shot)
 Condition (folder fallback): `_docs/_repo-config.yaml` exists AND `confirmed_by_user: true` AND (`_docs/glossary.md` does NOT exist OR the cross-cutting architecture doc identified in `docs.cross_cutting` does NOT contain a `## Architecture Vision` section).
 State-driven: reached by auto-chain from Step 2 (user picked A).
 **Goal**: Capture meta-repo-wide terminology and the user's architecture vision **once**, after the config is confirmed but before any sync skill runs. Without this, `monorepo-document` will faithfully propagate per-component changes but never surface a unified mental model of the meta-repo to the user, and the AI will keep re-inferring the same project terminology on every invocation.
 **Why inline (no sub-skill)**: `monorepo-discover` is hard-guarded to write only `_repo-config.yaml`; `monorepo-document` only edits *existing* docs. Glossary and architecture-vision creation is a first-time, user-confirmed write that crosses both guarantees, so it lives directly in the flow.
 **Inputs**:
 - `_docs/_repo-config.yaml` (component list, doc map, conventions, assumptions log)
 - Cross-cutting docs listed under `docs.cross_cutting` (existing architecture doc, if any)
 - Each component's `primary_doc` (read-only, for terminology + responsibility extraction)
 - Root `README.md` if `repo.root_readme` is referenced
 **Outputs**:
 - `_docs/glossary.md` (or `<docs.root>/glossary.md` if `docs.root` ≠ `_docs/`) — NEW
 - The cross-cutting architecture doc updated in place: a `## Architecture Vision` section is prepended (or merged into an existing "Vision" / "Overview" heading)
 - One new entry appended to `_docs/_repo-config.yaml` under `assumptions_log:` recording the run
 - A new top-level config entry: `glossary_doc: <path>` so future `monorepo-status` and `monorepo-document` runs treat the glossary as a known cross-cutting doc
 **Procedure**:
 1. **Draft glossary** from `_repo-config.yaml` + each component's primary doc. Include:
   - Component codenames as they appear in the config (`name` field) and any rename pairs the user noted in `unresolved:` resolutions
   - Domain terms that recur across ≥2 component docs
   - Acronyms / abbreviations
   - Convention names from `conventions:` (e.g., commit prefix, deployment tier names)
   - Stakeholder personas if cross-cutting docs reference them
   Each entry: one-line definition + source (`source: components.<name>.primary_doc` or `source: _repo-config.yaml conventions`). Skip generic terms.
 2. **Draft architecture vision** from the meta-repo perspective:
   - **One paragraph**: what the system as a whole is, what each component contributes, the runtime topology (one binary / N services / N clients + 1 server / hybrid), how components communicate (REST / gRPC / queue / DB-shared / file-shared)
   - **Components & responsibilities** (one-line each), pulled directly from `_repo-config.yaml` `components:` list
   - **Cross-cutting concerns ownership**: which doc owns which concern (auth, schema, deployment, etc.) — pulled from `docs.cross_cutting[].owns`
   - **Architectural principles / non-negotiables** the user has implied across components (e.g., "all components share a single Postgres", "submodules own their own CI", "deployment is per-tier, not per-component")
   - **Open questions / structural drift signals**: components missing from `docs.cross_cutting`, components in registry but not in config (registry mismatch), or contradictions between component primary docs
 3. **Present condensed view** to the user (NOT the full draft files):
   ```
   ══════════════════════════════════════
    REVIEW: Meta-Repo Glossary + Architecture Vision
   ══════════════════════════════════════
    Glossary (N terms drafted from config + component docs):
      - <Term>: <one-line definition>
      - ...
    Architecture Vision — meta-repo level:
      <one-paragraph synopsis>
      Components / responsibilities:
        - <component>: <one-line>
        - ...
      Cross-cutting ownership:
        - <concern> → <doc>
        - ...
      Principles / non-negotiables:
        - <principle>
        - ...
      Open questions / drift signals:
        - <q1>
        - <q2>
   ══════════════════════════════════════
    A) Looks correct — write the files
    B) Add / correct entries (provide diffs)
    C) Resolve open questions / drift signals first
   ══════════════════════════════════════
    Recommendation: pick C if drift signals exist;
                    otherwise B if components or principles
                    don't match your intent; A only when
                    the inferred vision is exactly right.
   ══════════════════════════════════════
   ```
 4. **Iterate**:
   - On B → integrate the user's diffs/additions, re-present, loop until A.
   - On C → ask the listed open questions in one batch, integrate answers, re-present.
   - **Do NOT proceed to step 5 until the user picks A.**
 5. **Save**:
   - Write `_docs/glossary.md` (alphabetical) with `**Status**: confirmed-by-user` + date.
   - Update the cross-cutting architecture doc identified in `docs.cross_cutting` (or create one at `_docs/00_architecture.md` if none exists and the user's option-B input named one): prepend `## Architecture Vision` with the confirmed paragraph + components + ownership + principles. Preserve every existing H2 below verbatim.
   - Append to `_docs/_repo-config.yaml`:
     - Top-level `glossary_doc: <path-relative-to-repo-root>` (sibling of `docs.root`)
     - New `assumptions_log:` entry: `{ date: <today>, skill: autodev-meta-repo Step 2.5, run_notes: "Captured glossary + architecture vision", assumptions: [...] }`
   - Do NOT flip any `confirmed: false` → `confirmed: true` in the config; this step writes its own confirmed artifact, it does not retroactively confirm config inferences.
 **Self-verification**:
 - [ ] Every glossary entry traces to either the config or a component primary doc
 - [ ] Every component listed in the vision matches a `components:` entry in the config
 - [ ] All open questions are answered or explicitly deferred (with the user's acknowledgement)
 - [ ] The cross-cutting architecture doc still contains every H2 it had before this step
 - [ ] User picked option A on the latest condensed view
 **Idempotency**: if both `_docs/glossary.md` exists AND the architecture doc already has a `## Architecture Vision` section, this step is **skipped on re-invocation**. To refresh, the user invokes `/autodev` after deleting `glossary.md` (or running `monorepo-discover` with structural changes that justify a re-confirmation).
 After completion, auto-chain to **Step 3 (Status)**.
 ---
 **Step 3 — Status**
-Condition (folder fallback): `_docs/_repo-config.yaml` exists AND `confirmed_by_user: true` AND (`_docs/glossary.md` exists OR `glossary_doc:` is recorded in the config).
+Condition (folder fallback): `_docs/_repo-config.yaml` exists AND `confirmed_by_user: true`.
-State-driven: reached by auto-chain from Step 2.5, or entered on any re-invocation after a completed cycle.
+State-driven: reached by auto-chain from Step 2 (user picked A), or entered on any re-invocation after a completed cycle.
 Action: Read and execute `.cursor/skills/monorepo-status/SKILL.md`.
@@ -221,28 +115,6 @@ The skill:
 3. Applies doc edits
 4. Skips any component with unconfirmed mapping (M5), reports
 After completion:
 - If the status report ALSO flagged suite-e2e drift → auto-chain to **Step 4.5 (Integration Test Sync)**
 - Else if the status report ALSO flagged CI drift → auto-chain to **Step 5 (CICD Sync)**
 - Else → end cycle, report done
 ---
 **Step 4.5 — Integration Test Sync**
 State-driven: reached by auto-chain from Step 3 (when status report flagged suite-e2e drift and no doc drift) or from Step 4 (when both doc and suite-e2e drift were flagged).
 **Skip condition**: if `_docs/_repo-config.yaml` has no `suite_e2e:` block, this step is skipped entirely — there's no harness to sync. The status report should not flag suite-e2e drift in that case; if it does, that's a status-skill bug.
 Action: Read and execute `.cursor/skills/monorepo-e2e/SKILL.md` with scope = components flagged by status.
 The skill:
 1. Verifies every path under `suite_e2e.*` exists (binary fixtures excepted — see the skill's Phase 1)
 2. Classifies each flagged change against the suite-e2e impact table
 3. Applies edits to `e2e/docker-compose.suite-e2e.yml`, `e2e/fixtures/init.sql`, `e2e/fixtures/expected_detections.json` metadata, and `e2e/runner/tests/*.spec.ts` selectors as needed
 4. Bumps baseline `fixture_version` with a `-stale` suffix and appends a `_docs/_process_leftovers/` entry whenever the detection model revision changes (binary fixture cannot be regenerated automatically)
 5. Reports synced files; does not run the suite e2e itself
 After completion:
 - If the status report ALSO flagged CI drift → auto-chain to **Step 5 (CICD Sync)**
 - Else → end cycle, report done
@@ -251,11 +123,11 @@ After completion:
 **Step 5 — CICD Sync**
-State-driven: reached by auto-chain from Step 3 (when status report flagged CI drift and no doc/suite-e2e drift), Step 4, or Step 4.5.
+State-driven: reached by auto-chain from Step 3 (when status report flagged CI drift and no doc drift) or from Step 4 (when both doc and CI drift were flagged).
 Action: Read and execute `.cursor/skills/monorepo-cicd/SKILL.md` with scope = components flagged by status.
-After completion, end cycle. Report files updated across doc, suite-e2e, and CI sync.
+After completion, end cycle. Report files updated across both doc and CI sync.
 ---
@@ -284,19 +156,14 @@ After onboarding completes, the config is updated. Auto-chain back to **Step 3 (
 | Completed Step | Next Action |
 |---------------|-------------|
 | Discover (1) | Auto-chain → Config Review (2) |
-| Config Review (2, user picked A, confirmed_by_user: true) | Auto-chain → Glossary & Architecture Vision (2.5) |
+| Config Review (2, user picked A, confirmed_by_user: true) | Auto-chain → Status (3) |
 | Config Review (2, user picked B) | **Session boundary** — end session, await re-invocation |
 | Glossary & Architecture Vision (2.5) | Auto-chain → Status (3) |
 | Status (3, doc drift) | Auto-chain → Document Sync (4) |
 | Status (3, suite-e2e drift only) | Auto-chain → Integration Test Sync (4.5) |
 | Status (3, CI drift only) | Auto-chain → CICD Sync (5) |
 | Status (3, no drift) | **Cycle complete** — end session, await re-invocation |
 | Status (3, registry mismatch) | Ask user (A: discover, B: onboard, C: continue) |
-| Document Sync (4) + suite-e2e drift pending | Auto-chain → Integration Test Sync (4.5) |
+| Document Sync (4) + CI drift pending | Auto-chain → CICD Sync (5) |
-| Document Sync (4) + CI drift only pending | Auto-chain → CICD Sync (5) |
+| Document Sync (4) + no CI drift | **Cycle complete** |
 | Document Sync (4) + no further drift | **Cycle complete** |
 | Integration Test Sync (4.5) + CI drift pending | Auto-chain → CICD Sync (5) |
 | Integration Test Sync (4.5) + no CI drift | **Cycle complete** |
 | CICD Sync (5) | **Cycle complete** |
 ## Status Summary — Step List
@@ -311,33 +178,29 @@ Flow-specific slot values:
   Config:  _docs/_repo-config.yaml [confirmed_by_user: <true|false>, last_updated: <date>]
  ```
-| # | Step Name                          | Extra state tokens (beyond the shared set) |
+| # | Step Name        | Extra state tokens (beyond the shared set) |
-|---|------------------------------------|--------------------------------------------|
+|---|------------------|--------------------------------------------|
-| 1 | Discover                           | — |
+| 1 | Discover         | — |
-| 2 | Config Review                      | `IN PROGRESS (awaiting human)` |
+| 2 | Config Review    | `IN PROGRESS (awaiting human)` |
-| 2.5 | Glossary & Architecture Vision   | `SKIPPED (already captured)` |
+| 3 | Status           | `DONE (no drift)`, `DONE (N drifts)` |
-| 3 | Status                             | `DONE (no drift)`, `DONE (N drifts)` |
+| 4 | Document Sync    | `DONE (N docs)`, `SKIPPED (no doc drift)` |
-| 4 | Document Sync                      | `DONE (N docs)`, `SKIPPED (no doc drift)` |
+| 5 | CICD Sync        | `DONE (N files)`, `SKIPPED (no CI drift)` |
 | 4.5 | Integration Test Sync            | `DONE (N files)`, `SKIPPED (no suite-e2e drift)`, `SKIPPED (no suite_e2e config block)` |
 | 5 | CICD Sync                          | `DONE (N files)`, `SKIPPED (no CI drift)` |
-All rows accept the shared state tokens (`DONE`, `IN PROGRESS`, `NOT STARTED`, `FAILED (retry N/3)`); rows 2.5, 4, 4.5, and 5 additionally accept `SKIPPED`.
+All rows accept the shared state tokens (`DONE`, `IN PROGRESS`, `NOT STARTED`, `FAILED (retry N/3)`); rows 4 and 5 additionally accept `SKIPPED`.
 Row rendering format:
 ```
- Step 1     Discover                          [<state token>]
+ Step 1   Discover          [<state token>]
- Step 2     Config Review                     [<state token>]
+ Step 2   Config Review     [<state token>]
- Step 2.5   Glossary & Architecture Vision    [<state token>]
+ Step 3   Status            [<state token>]
- Step 3     Status                            [<state token>]
+ Step 4   Document Sync     [<state token>]
- Step 4     Document Sync                     [<state token>]
+ Step 5   CICD Sync         [<state token>]
 Step 4.5   Integration Test Sync             [<state token>]
 Step 5     CICD Sync                         [<state token>]
 ```
 ## Notes for the meta-repo flow
- **No session boundary except Step 2 and Step 2.5**: unlike existing-code flow (which has boundaries around decompose), meta-repo flow only pauses at config review and the one-shot glossary/vision capture. Once both are confirmed, syncing is fast enough to complete in one session and Step 2.5 idempotently no-ops on every subsequent invocation.
+- **No session boundary except Step 2**: unlike existing-code flow (which has boundaries around decompose), meta-repo flow only pauses at config review. Syncing is fast enough to complete in one session.
 - **Cyclical, not terminal**: no "done forever" state. Each invocation completes a drift cycle; next invocation starts fresh.
 - **No tracker integration**: this flow does NOT create Jira/ADO tickets. Maintenance is not a feature — if a feature-level ticket spans the meta-repo's concerns, it lives in the per-component workspace.
 - **Onboarding is opt-in**: never auto-onboarded. User must explicitly request.
@@ -110,8 +110,7 @@ Before entering a step from this table for the first time in a session, verify t
 | Flow | Step | Sub-Step | Tracker Action |
 |------|------|----------|----------------|
 | greenfield | Plan | Step 6 — Epics | Create epics for each component |
-| greenfield | Decompose | Implementation decomposition Step 1 + Step 2 — Product tasks | Create ticket per product task, link to epic |
+| greenfield | Decompose | Step 1 + Step 2 + Step 3 — All tasks | Create ticket per task, link to epic |
 | greenfield | Decompose Tests | Step 1t + Step 3 — All test tasks | Create ticket per task, link to epic |
 | existing-code | Decompose Tests | Step 1t + Step 3 — All test tasks | Create ticket per task, link to epic |
 | existing-code | New Task | Step 7 — Ticket | Create ticket per task, link to epic |
@@ -139,7 +138,7 @@ One retry ladder covers all failure modes: explicit failure returned by a sub-sk
 Treat the sub-skill as **failed** when ANY of the following is observed:
- The sub-skill explicitly returns a failed result (including blocked tasks, auto-fix loop exhaustion, prerequisite violations).
+- The sub-skill explicitly returns a failed result (including blocked subagents, auto-fix loop exhaustion, prerequisite violations).
 - **Stuck signals**: the same artifact is rewritten 3+ times without meaningful change; the sub-skill re-asks a question that was already answered; no new artifact has been saved despite active execution.
 ### Retry ladder
@@ -292,7 +291,7 @@ For steps that produce `_docs/` artifacts (problem, research, plan, decompose, d
 ## Debug Protocol
-When the implement skill's auto-fix loop fails (code review FAIL after 2 auto-fix attempts) or a task reports a blocker, the user is asked to intervene. This protocol guides the debugging process. (Retry budget and escalation are covered by Failure Handling above; this section is about *how* to diagnose once the user has been looped in.)
+When the implement skill's auto-fix loop fails (code review FAIL after 2 auto-fix attempts) or an implementer subagent reports a blocker, the user is asked to intervene. This protocol guides the debugging process. (Retry budget and escalation are covered by Failure Handling above; this section is about *how* to diagnose once the user has been looped in.)
 ### Structured Debugging Workflow
@@ -13,7 +13,7 @@ The autodev persists its position to `_docs/_autodev_state.md`. This is a lightw
 ## Current Step
 flow: [greenfield | existing-code | meta-repo]
-step: [1-17 for greenfield, 1-17 for existing-code, 1-6 for meta-repo, or "done"]
+step: [1-11 for greenfield, 1-17 for existing-code, 1-6 for meta-repo, or "done"]
 name: [step name from the active flow's Step Reference Table]
 status: [not_started / in_progress / completed / skipped / failed]
 sub_step:
@@ -209,7 +209,7 @@ Bug, Spec-Gap, Security, Performance, Maintainability, Style, Scope, Architectur
 The `/implement` skill invokes this skill after each batch completes:
-1. Collects changed files from all tasks implemented in the batch
+1. Collects changed files from all implementer agents in the batch
 2. Passes task spec paths + changed files to this skill
 3. If verdict is FAIL — presents findings to user (BLOCKING), user fixes or confirms
 4. If verdict is PASS or PASS_WITH_WARNINGS — proceeds automatically (findings shown as info)
@@ -221,7 +221,7 @@ The `/implement` skill invokes this skill after each batch completes:
 | Input | Type | Source | Required |
 |-------|------|--------|----------|
 | `task_specs` | list of file paths | Task `.md` files from `_docs/02_tasks/todo/` for the current batch | Yes |
-| `changed_files` | list of file paths | Files modified by the tasks in the batch (from `git diff`) | Yes |
+| `changed_files` | list of file paths | Files modified by implementer agents (from `git diff` or agent reports) | Yes |
 | `batch_number` | integer | Current batch number (for report naming) | Yes |
 | `project_restrictions` | file path | `_docs/00_problem/restrictions.md` | If exists |
 | `solution_overview` | file path | `_docs/01_solution/solution.md` | If exists |
@@ -2,8 +2,8 @@
 name: decompose
 description: |
  Decompose planned components into atomic implementable tasks with bootstrap structure plan.
-  Workflow entrypoints: implementation task decomposition, single component decomposition, and tests-only decomposition.
+  4-step workflow: bootstrap structure plan, component task decomposition, blackbox test task decomposition, and cross-task verification.
-  The invoking flow decides which entrypoint to run; this skill executes that selected sequence.
+  Supports full decomposition (_docs/ structure), single component mode, and tests-only mode.
  Trigger phrases:
  - "decompose", "decompose features", "feature decomposition"
  - "task decomposition", "break down components"
@@ -20,7 +20,7 @@ Decompose planned components into atomic, implementable task specs with a bootst
 ## Core Principles
- **Atomic tasks**: each task does one thing; if it exceeds 5 complexity points, split it
+- **Atomic tasks**: each task does one thing; if it exceeds 8 complexity points, split it
 - **Behavioral specs, not implementation plans**: describe what the system should do, not how to build it
 - **Flat structure**: all tasks are tracker-ID-prefixed files in TASKS_DIR — no component subdirectories
 - **Save immediately**: write artifacts to disk after each task; never accumulate unsaved work
@@ -30,15 +30,14 @@ Decompose planned components into atomic, implementable task specs with a bootst
 ## Context Resolution
-Resolve the selected entrypoint from the invocation context before any other logic runs. The caller decides whether this is implementation, single component, or tests-only decomposition; this skill only executes the selected sequence.
+Determine the operating mode based on invocation before any other logic runs.
-**Implementation task decomposition** (default; selected by flows before invoking this skill):
+**Default** (no explicit input file provided):
 - DOCUMENT_DIR: `_docs/02_document/`
 - TASKS_DIR: `_docs/02_tasks/`
 - TASKS_TODO: `_docs/02_tasks/todo/`
 - Reads from: `_docs/00_problem/`, `_docs/01_solution/`, DOCUMENT_DIR
 - Produces only implementation tasks. Blackbox/e2e test task files are produced only when the invoking flow selects tests-only decomposition.
 **Single component mode** (provided file is within `_docs/02_document/` and inside a `components/` subdirectory):
@@ -56,24 +55,24 @@ Resolve the selected entrypoint from the invocation context before any other log
 - TESTS_DIR: `DOCUMENT_DIR/tests/`
 - Reads from: `_docs/00_problem/`, `_docs/01_solution/`, TESTS_DIR
-Announce the selected entrypoint and resolved paths to the user before proceeding.
+Announce the detected mode and resolved paths to the user before proceeding.
 ### Step Applicability by Mode
-| Step | File | Implementation | Single | Tests-only |
+| Step | File | Default | Single | Tests-only |
-|------|------|:--------------:|:------:|:----------:|
+|------|------|:-------:|:------:|:----------:|
 | 1 Bootstrap Structure | `steps/01_bootstrap-structure.md` | ✓ | — | — |
 | 1t Test Infrastructure | `steps/01t_test-infrastructure.md` | — | — | ✓ |
 | 1.5 Module Layout | `steps/01-5_module-layout.md` | ✓ | — | — |
 | 2 Task Decomposition | `steps/02_task-decomposition.md` | ✓ | ✓ | — |
-| 3 Blackbox Test Tasks | `steps/03_blackbox-test-decomposition.md` | — | — | ✓ |
+| 3 Blackbox Test Tasks | `steps/03_blackbox-test-decomposition.md` | ✓ | — | ✓ |
 | 4 Cross-Verification | `steps/04_cross-verification.md` | ✓ | — | ✓ |
 ## Input Specification
 ### Required Files
-**Implementation task decomposition:**
+**Default:**
 | File | Purpose |
 |------|---------|
@@ -81,11 +80,10 @@ Announce the selected entrypoint and resolved paths to the user before proceedin
 | `_docs/00_problem/restrictions.md` | Constraints and limitations |
 | `_docs/00_problem/acceptance_criteria.md` | Measurable acceptance criteria |
 | `_docs/01_solution/solution.md` | Finalized solution |
-| `DOCUMENT_DIR/architecture.md` | Architecture from plan/document skill (must contain a `## Architecture Vision` H2 — confirmed user intent) |
+| `DOCUMENT_DIR/architecture.md` | Architecture from plan skill |
 | `DOCUMENT_DIR/glossary.md` | Project terminology (confirmed by user in plan Phase 2a.0 or document Step 4.5). Use it to keep task names, component references, and AC wording consistent with the user's vocabulary |
 | `DOCUMENT_DIR/system-flows.md` | System flows from plan skill |
 | `DOCUMENT_DIR/components/[##]_[name]/description.md` | Component specs from plan skill |
-| `DOCUMENT_DIR/tests/` | Optional product acceptance context from test-spec skill; do not create test task files from it in this entrypoint |
+| `DOCUMENT_DIR/tests/` | Blackbox test specs from plan skill |
 **Single component mode:**
@@ -112,7 +110,7 @@ Announce the selected entrypoint and resolved paths to the user before proceedin
 ### Prerequisite Checks (BLOCKING)
-**Implementation task decomposition:**
+**Default:**
 1. DOCUMENT_DIR contains `architecture.md` and `components/` — **STOP if missing**
 2. Create TASKS_DIR and TASKS_TODO if they do not exist
@@ -146,8 +144,6 @@ TASKS_DIR/
 **Naming convention**: Each task file is initially saved in `TASKS_TODO/` with a temporary numeric prefix (`[##]_[short_name].md`). After creating the work item ticket, rename the file to use the work item ticket ID as prefix (`[TRACKER-ID]_[short_name].md`). For example: `todo/01_initial_structure.md` → `todo/AZ-42_initial_structure.md`.
 If tracker availability fails, follow `.cursor/rules/tracker.mdc` before continuing. Only when the user explicitly chooses `tracker: local` may the numeric prefix remain; in that mode set `Tracker: pending` and `Epic: pending` in the task header and keep the task eligible for later tracker sync.
 ### Save Timing
 | Step | Save immediately after | Filename |
@@ -169,11 +165,11 @@ If TASKS_DIR subfolders already contain task files:
 ## Progress Tracking
-At the start of execution, create a TodoWrite with all applicable steps for the selected entrypoint (see Step Applicability table). Update status as each step/component completes.
+At the start of execution, create a TodoWrite with all applicable steps for the detected mode (see Step Applicability table). Update status as each step/component completes.
 ## Workflow
-### Step 1: Bootstrap Structure Plan (implementation mode only)
+### Step 1: Bootstrap Structure Plan (default mode only)
 Read and follow `steps/01_bootstrap-structure.md`.
@@ -185,25 +181,25 @@ Read and follow `steps/01t_test-infrastructure.md`.
 ---
-### Step 1.5: Module Layout (implementation mode only)
+### Step 1.5: Module Layout (default mode only)
 Read and follow `steps/01-5_module-layout.md`.
 ---
-### Step 2: Task Decomposition (implementation and single component modes)
+### Step 2: Task Decomposition (default and single component modes)
 Read and follow `steps/02_task-decomposition.md`.
 ---
-### Step 3: Blackbox Test Task Decomposition (tests-only mode only)
+### Step 3: Blackbox Test Task Decomposition (default and tests-only modes)
 Read and follow `steps/03_blackbox-test-decomposition.md`.
 ---
-### Step 4: Cross-Task Verification (implementation and tests-only modes)
+### Step 4: Cross-Task Verification (default and tests-only modes)
 Read and follow `steps/04_cross-verification.md`.
@@ -211,7 +207,7 @@ Read and follow `steps/04_cross-verification.md`.
 - **Coding during decomposition**: this workflow produces specs, never code
 - **Over-splitting**: don't create many tasks if the component is simple — 1 task is fine
- **Tasks exceeding 5 points**: split them; no task should be too complex for a single implementer
+- **Tasks exceeding 8 points**: split them; no task should be too complex for a single implementer
 - **Cross-component tasks**: each task belongs to exactly one component
 - **Skipping BLOCKING gates**: never proceed past a BLOCKING marker without user confirmation
 - **Creating git branches**: branch creation is an implementation concern, not a decomposition one
@@ -224,7 +220,7 @@ Read and follow `steps/04_cross-verification.md`.
 | Situation | Action |
 |-----------|--------|
 | Ambiguous component boundaries | ASK user |
-| Task complexity exceeds 5 points after splitting | ASK user |
+| Task complexity exceeds 8 points after splitting | ASK user |
 | Missing component specs in DOCUMENT_DIR | ASK user |
 | Cross-component dependency conflict | ASK user |
 | Tracker epic not found for a component | ASK user for Epic ID |
@@ -236,14 +232,15 @@ Read and follow `steps/04_cross-verification.md`.
 ┌────────────────────────────────────────────────────────────────┐
 │          Task Decomposition (Multi-Mode)                        │
 ├────────────────────────────────────────────────────────────────┤
-│ CONTEXT: Invoke the selected entrypoint (implementation / single / tests-only) │
+│ CONTEXT: Resolve mode (default / single component / tests-only) │
 │                                                                 │
-│ IMPLEMENTATION TASK DECOMPOSITION:                              │
+│ DEFAULT MODE:                                                   │
 │  1.   Bootstrap Structure → steps/01_bootstrap-structure.md     │
 │       [BLOCKING: user confirms structure]                       │
 │  1.5  Module Layout       → steps/01-5_module-layout.md         │
 │       [BLOCKING: user confirms layout]                          │
 │  2.   Component Tasks     → steps/02_task-decomposition.md      │
 │  3.   Blackbox Tests      → steps/03_blackbox-test-decomposition.md │
 │  4.   Cross-Verification  → steps/04_cross-verification.md      │
 │       [BLOCKING: user confirms dependencies]                    │
 │                                                                 │
@@ -26,7 +26,7 @@ For each component (or the single provided component):
 4. Do not create tasks for other components — only tasks for the current component
 5. Each task should be atomic, containing 1 API or a list of semantically connected APIs
 6. Write each task spec using `templates/task.md`
-7. Estimate complexity per task (1, 2, 3, 5 points); no task should exceed 5 points — split if it does
+7. Estimate complexity per task (1, 2, 3, 5, 8 points); no task should exceed 8 points — split if it does
 8. Note task dependencies (referencing tracker IDs of already-created dependency tasks, e.g., `AZ-42_initial_structure`)
 9. **Cross-cutting rule**: if a concern spans ≥2 components (logging, config loading, auth/authZ, error envelope, telemetry, feature flags, i18n), create ONE shared task under the cross-cutting epic. Per-component tasks declare it as a dependency and consume it; they MUST NOT re-implement it locally. Duplicate local implementations are an `Architecture` finding (High) in code-review Phase 7 and a `Maintainability` finding in Phase 6.
 10. **Shared-models / shared-API rule**: classify the task as shared if ANY of the following is true:
@@ -46,7 +46,7 @@ For each component (or the single provided component):
 ## Self-verification (per component)
 - [ ] Every task is atomic (single concern)
- [ ] No task exceeds 5 complexity points
+- [ ] No task exceeds 8 complexity points
 - [ ] Task dependencies reference correct tracker IDs
 - [ ] Tasks cover all interfaces defined in the component spec
 - [ ] No tasks duplicate work from other components
@@ -1,4 +1,4 @@
-# Step 3: Blackbox Test Task Decomposition (tests-only mode only)
+# Step 3: Blackbox Test Task Decomposition (default and tests-only modes)
 **Role**: Professional Quality Assurance Engineer
 **Goal**: Decompose blackbox test specs into atomic, implementable task specs.
@@ -6,6 +6,7 @@
 ## Numbering
 - In default mode: continue sequential numbering from where Step 2 left off.
 - In tests-only mode: start from 02 (01 is the test infrastructure bootstrap from Step 1t).
 ## Steps
@@ -14,9 +15,10 @@
 2. Group related test scenarios into atomic tasks (e.g., one task per test category or per component under test)
 3. Each task should reference the specific test scenarios it implements and the environment/test-data specs
 4. Dependencies:
   - In default mode: blackbox test tasks depend on the component implementation tasks they exercise
   - In tests-only mode: blackbox test tasks depend on the test infrastructure bootstrap task (Step 1t)
 5. Write each task spec using `templates/task.md`
-6. Estimate complexity per task (1, 2, 3, 5 points); no task should exceed 5 points — split if it does
+6. Estimate complexity per task (1, 2, 3, 5, 8 points); no task should exceed 8 points — split if it does
 7. Note task dependencies (referencing tracker IDs of already-created dependency tasks)
 8. **Immediately after writing each task file**: create a work item ticket under the "Blackbox Tests" epic, write the work item ticket ID and Epic ID back into the task header, then rename the file from `todo/[##]_[short_name].md` to `todo/[TRACKER-ID]_[short_name].md`.
@@ -24,8 +26,8 @@
 - [ ] Every scenario from `tests/blackbox-tests.md` is covered by a task
 - [ ] Every scenario from `tests/performance-tests.md`, `tests/resilience-tests.md`, `tests/security-tests.md`, and `tests/resource-limit-tests.md` is covered by a task
- [ ] No task exceeds 5 complexity points
+- [ ] No task exceeds 8 complexity points
- [ ] Dependencies correctly reference the test infrastructure task
+- [ ] Dependencies correctly reference the dependency tasks (component tasks in default mode, test infrastructure in tests-only mode)
 - [ ] Every task has a work item ticket linked to the "Blackbox Tests" epic
 ## Save action
@@ -1,4 +1,4 @@
-# Step 4: Cross-Task Verification (implementation and tests-only modes)
+# Step 4: Cross-Task Verification (default and tests-only modes)
 **Role**: Professional software architect and analyst
 **Goal**: Verify task consistency and produce `_dependencies_table.md`.
@@ -8,7 +8,7 @@
 1. Verify task dependencies across all tasks are consistent
 2. Check no gaps:
-   - In implementation mode: every product interface in `architecture.md` has implementation task coverage
+   - In default mode: every interface in `architecture.md` has tasks covering it
   - In tests-only mode: every test scenario in `traceability-matrix.md` is covered by a task
 3. Check no overlaps: tasks don't duplicate work
 4. Check no circular dependencies in the task graph
@@ -16,9 +16,9 @@
 ## Self-verification
-### Implementation mode
+### Default mode
- [ ] Every product interface in `architecture.md` is covered by at least one implementation task
+- [ ] Every architecture interface is covered by at least one task
 - [ ] No circular dependencies in the task graph
 - [ ] Cross-component dependencies are explicitly noted in affected task specs
 - [ ] `_dependencies_table.md` contains every task with correct dependencies
@@ -28,4 +28,4 @@ Use this template after cross-task verification. Save as `TASKS_DIR/_dependencie
 - Dependencies column lists tracker IDs (e.g., "AZ-43, AZ-44") or "None"
 - No circular dependencies allowed
 - Tasks should be listed in recommended execution order
- The `/implement` skill reads this table to compute dependency-aware batches; task execution remains sequential
+- The `/implement` skill reads this table to compute parallel batches
@@ -1,6 +1,6 @@
 # Module Layout Template
-The module layout is the **authoritative file-ownership map** used by the `/implement` skill to assign OWNED / READ-ONLY / FORBIDDEN files to each task. It is derived from `_docs/02_document/architecture.md` and the component specs at `_docs/02_document/components/`, and it follows the target language's standard project-layout conventions.
+The module layout is the **authoritative file-ownership map** used by the `/implement` skill to assign OWNED / READ-ONLY / FORBIDDEN files to implementer subagents. It is derived from `_docs/02_document/architecture.md` and the component specs at `_docs/02_document/components/`, and it follows the target language's standard project-layout conventions.
 Save as `_docs/02_document/module-layout.md`. This file is produced by the decompose skill (Step 1.5 module layout) and consumed by the implement skill (Step 4 file ownership). Task specs remain purely behavioral — they do NOT carry file paths. The layout is the single place where component → filesystem mapping lives.
@@ -104,4 +104,4 @@ The implement skill's Step 4 (File Ownership) reads this file and, for each task
 3. Set READ-ONLY = the Public API files of every component listed in `Imports from`, plus `shared/*` Public API files.
 4. Set FORBIDDEN = every other component's Owns glob.
-Execution inside a batch is already sequential (one task at a time). This mapping is still required because it enforces scope discipline per task — preventing a task from drifting into files that belong to another component.
+If two tasks in the same batch map to the same component, the implement skill schedules them sequentially (one implementer at a time for that component) to avoid file conflicts on shared internal files.
@@ -11,7 +11,7 @@ Save as `TASKS_DIR/[##]_[short_name].md` initially, then rename to `TASKS_DIR/[T
 **Task**: [TRACKER-ID]_[short_name]
 **Name**: [short human name]
 **Description**: [one-line description of what this task delivers]
-**Complexity**: [1|2|3|5] points
+**Complexity**: [1|2|3|5|8] points
 **Dependencies**: [AZ-43_shared_models, AZ-44_db_migrations] or "None"
 **Component**: [component name for context]
 **Tracker**: [TASK-ID]
@@ -102,7 +102,8 @@ Consumers MUST read that file — not this task spec — to discover the interfa
 - 2 points: Non-trivial, low complexity, minimal coordination
 - 3 points: Multi-step, moderate complexity, potential alignment needed
 - 5 points: Difficult, interconnected logic, medium-high risk
- 8+ points: Too complex — split into smaller tasks
+- 8 points: High difficulty, high ambiguity or coordination, multiple components
 - 13 points: Too complex — split into smaller tasks
 ## Output Guidelines
@@ -26,8 +26,7 @@
   - Application components under test
   - Test runner container (black-box, no internal imports)
   - Isolated database with seed data
-   - All tests runnable via `docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from e2e-runner`
+   - All tests runnable via `docker compose -f docker-compose.test.yml up --abort-on-container-exit`
   - See the Woodpecker two-workflow contract in [`../templates/ci_cd_pipeline.md`](../templates/ci_cd_pipeline.md) — the test runner entry point defined here becomes the first step of `.woodpecker/01-test.yml`.
 7. Define image tagging strategy: `<registry>/<project>/<component>:<git-sha>` for CI, `latest` for local dev only
 ## Self-verification
@@ -85,140 +85,3 @@ Save as `_docs/04_deploy/ci_cd_pipeline.md`.
 | Deploy success | [Slack] | [team] |
 | Deploy failure | [Slack/email + PagerDuty] | [on-call] |
 ```
 ---
 ## Reference Implementation: Woodpecker CI two-workflow contract
 Use this when the project's CI is **Woodpecker** and the test layout follows the autodev e2e contract from [`../../decompose/templates/test-infrastructure-task.md`](../../decompose/templates/test-infrastructure-task.md) (an `e2e/` folder containing `Dockerfile`, `docker-compose.test.yml`, `conftest.py`, `requirements.txt`, `mocks/`, `fixtures/`, `tests/`).
 The contract is **two workflows in `.woodpecker/`**, scheduled on the same agent label, with the build workflow gated on a successful test run:
 - `.woodpecker/01-test.yml` — runs the e2e contract, publishes `results/report.csv` as an artifact, fails the pipeline on any test failure.
 - `.woodpecker/02-build-push.yml` — `depends_on: [01-test]`. Builds the image, tags it `${CI_COMMIT_BRANCH}-${TAG_SUFFIX}`, pushes it to the registry. Skipped automatically if test failed.
 The agent label is parameterized via `matrix:` so a single workflow file fans out across architectures: `labels: platform: ${PLATFORM}` routes each matrix entry to the matching agent. Both workflows for a repo must use the same matrix so test and build run on the same machine and share Docker layer cache. New architectures = new matrix entries; never new files.
 ### Multi-arch matrix conventions
 | Variable | Meaning | Typical values |
 |----------|---------|----------------|
 | `PLATFORM` | Woodpecker agent label — selects which physical machine runs the entry. | `arm64`, `amd64` |
 | `TAG_SUFFIX` | Image tag suffix appended after the branch name. | `arm`, `amd` |
 | `DOCKERFILE` *(only when arches need different Dockerfiles)* | Path to the Dockerfile for this entry. | `Dockerfile`, `Dockerfile.jetson` |
 Most repos use the same `Dockerfile` for both arches (multi-arch base images handle the rest), so `DOCKERFILE` can be omitted from the matrix and hardcoded in the build command. Repos with split per-arch Dockerfiles (e.g., `detections` uses `Dockerfile.jetson` on Jetson with TensorRT/CUDA-on-L4T) declare `DOCKERFILE` as a matrix var.
 When only one architecture is currently in use, keep the matrix block with a single entry and the second entry commented out — adding a new arch is then a one-line uncomment, not a structural change.
 ### `.woodpecker/01-test.yml`
 ```yaml
 when:
  event: [push, pull_request, manual]
  branch: [dev, stage, main]
 matrix:
  include:
    - PLATFORM: arm64
      TAG_SUFFIX: arm
    # - PLATFORM: amd64
    #   TAG_SUFFIX: amd
 labels:
  platform: ${PLATFORM}
 steps:
  - name: e2e
    image: docker
    commands:
      - cd e2e
      - docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from e2e-runner --build
      - docker compose -f docker-compose.test.yml down -v
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
  - name: report
    image: docker
    when:
      status: [success, failure]
    commands:
      - test -f e2e/results/report.csv && cat e2e/results/report.csv || echo "no report"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
 ```
 Notes:
 - `--abort-on-container-exit` shuts the whole compose down as soon as ANY service exits, so a crashed dependency surfaces immediately instead of hanging the runner.
 - `--exit-code-from e2e-runner` ensures the pipeline's exit code reflects the test runner's, not the SUT's.
 - The `report` step runs on `[success, failure]` so the report is always published; without this the CSV is lost on red builds.
 - `down -v` between runs drops mock state and DB volumes — every test run starts clean.
 ### `.woodpecker/02-build-push.yml`
 ```yaml
 when:
  event: [push, manual]
  branch: [dev, stage, main]
 depends_on:
  - 01-test
 matrix:
  include:
    - PLATFORM: arm64
      TAG_SUFFIX: arm
    # - PLATFORM: amd64
    #   TAG_SUFFIX: amd
 labels:
  platform: ${PLATFORM}
 steps:
  - name: build-push
    image: docker
    environment:
      REGISTRY_HOST:
        from_secret: registry_host
      REGISTRY_USER:
        from_secret: registry_user
      REGISTRY_TOKEN:
        from_secret: registry_token
    commands:
      - echo "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin
      - export TAG=${CI_COMMIT_BRANCH}-${TAG_SUFFIX}
      - export BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
      - |
        docker build -f Dockerfile \
          --build-arg CI_COMMIT_SHA=$CI_COMMIT_SHA \
          --label org.opencontainers.image.revision=$CI_COMMIT_SHA \
          --label org.opencontainers.image.created=$BUILD_DATE \
          --label org.opencontainers.image.source=$CI_REPO_URL \
          -t $REGISTRY_HOST/azaion/<service>:$TAG .
      - docker push $REGISTRY_HOST/azaion/<service>:$TAG
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
 ```
 Notes:
 - `depends_on: [01-test]` is enforced by Woodpecker — a failed `01-test` (any matrix entry) skips this workflow.
 - The build workflow does NOT trigger on `pull_request` events: PRs get test signal only; pushes to `dev`/`stage`/`main` produce images. Avoids polluting the registry with PR images.
 - Replace `<service>` with the actual service name (matches the registry namespace pattern `azaion/<service>`).
 - For repos with split per-arch Dockerfiles, add `DOCKERFILE: Dockerfile.jetson` (or similar) to the matrix entry and substitute `${DOCKERFILE}` for `Dockerfile` in the `docker build -f` line.
 ### Variations by stack
 The contract is language-agnostic because the runner is `docker compose`. The Dockerfile inside `e2e/` selects the test framework:
 | Stack | `e2e/Dockerfile` runs |
 |-------|----------------------|
 | Python | `pytest --csv=/results/report.csv -v` |
 | .NET | `dotnet test --logger:"trx;LogFileName=/results/report.trx"` (convert to CSV in a final step if needed) |
 | Node/UI | `npm test -- --reporters=default --reporters=jest-junit --outputDirectory=/results` |
 | Rust | `cargo test --no-fail-fast -- --format json > /results/report.json` |
 When the repo has **only unit tests** (no `e2e/docker-compose.test.yml`), drop the compose orchestration and run the native test command directly inside a stack-appropriate image. Keep the same two-workflow split — `01-test.yml` runs unit tests, `02-build-push.yml` is unchanged.
 ### Manual-trigger override (test infrastructure not yet validated)
 If a repo ships a complete `e2e/` layout but the test fixtures are not yet validated end-to-end (e.g., expected-results data is still being authored), gate `01-test.yml` on `event: [manual]` only and add a TODO comment pointing to the unblocking task. The `02-build-push.yml` workflow drops its `depends_on` clause for the manual-only window — an explicit and reversible exception, not a permanent split.
@@ -31,7 +31,6 @@ _docs/
    │   ├── components.md
    │   └── flows/
    ├── 04_verification_log.md           # Step 4
    ├── glossary.md                       # Step 4.5 (confirmed-by-user)
    ├── FINAL_report.md                  # Step 7
    └── state.json                       # Resumability
 ```
@@ -50,7 +49,6 @@ Maintained in `DOCUMENT_DIR/state.json` for resumability:
  "modules_remaining": ["services/auth", "api/endpoints"],
  "module_batch": 1,
  "components_written": [],
  "step_4_5_glossary_vision": "not_started",
  "last_updated": "2026-03-21T14:00:00Z"
 }
 ```
@@ -15,7 +15,7 @@ Covers three related modes that share the same 8-step pipeline:
 ## Progress Tracking
-Create a TodoWrite with all steps (0 through 7, including the inline Step 2.5 Module Layout Derivation and Step 4.5 Glossary & Architecture Vision). Update status as each step completes.
+Create a TodoWrite with all steps (0 through 7). Update status as each step completes.
 ## Steps
@@ -251,107 +251,7 @@ Apply corrections inline to the documents that need them.
 **BLOCKING**: Present verification summary to user. Do NOT proceed until user confirms corrections are acceptable or requests additional fixes.
---
+**Session boundary**: After verification is confirmed, suggest a session break before proceeding to the synthesis steps (5–7). These steps produce different artifact types and benefit from fresh context:
 ### Step 4.5: Glossary & Architecture Vision (BLOCKING)
 **Role**: Software architect + business analyst
 **Goal**: Reconcile the AI's verified understanding of the codebase with the user's intended terminology and architecture vision. Existing-code projects often carry domain language and structural intent that is invisible from code alone (synonyms, deprecated names, modules that are "supposed to" be split, components the user thinks of as one logical unit even though they live in two folders). This step makes that intent explicit before any downstream skill (refactor, decompose, new-task) acts on the docs.
 **When this step runs**:
 - Always, after Step 4 (Verification Pass) — for Full and Resume modes.
 - **Skipped** in Focus Area mode (the glossary/vision is system-wide; running it on a partial scan would produce a partial glossary). Resume the user once a full pass exists.
 **Inputs** (already on disk after Step 4):
 - `DOCUMENT_DIR/architecture.md`, `system-flows.md`, `data_model.md`, `deployment/*`
 - `DOCUMENT_DIR/components/*/description.md`
 - `DOCUMENT_DIR/modules/*.md`
 - `DOCUMENT_DIR/04_verification_log.md` (so the AI knows which doc parts are confirmed vs. flagged)
 **Outputs**:
 - `DOCUMENT_DIR/glossary.md` (NEW)
 - `DOCUMENT_DIR/architecture.md` updated in place: a new `## Architecture Vision` section is prepended (or merged into an existing "Overview" / "Vision" heading if already present); existing technical sections are preserved verbatim
 **Procedure**:
 1. **Draft glossary** from verified docs:
   - Domain entities, processes, roles named in module/component docs
   - Acronyms / abbreviations
   - Internal codenames (project, service, model names) that recur in the codebase
   - Synonym pairs the AI noticed (e.g., the codebase uses "flight" but module comments say "mission")
   - Stakeholder personas if any docs reference them
   Each entry: one-line definition + source reference (`source: components/03_flights/description.md`). Skip generic CS/industry terms.
 2. **Draft architecture vision** as the AI currently understands the codebase:
   - **One paragraph**: what the system is, who runs it, the runtime topology shape (monolith / services / pipeline / library / hybrid), and the dominant pattern (e.g., "submodule-based meta-repo with REST + SSE between UI and backend").
   - **Components & responsibilities** (one-line each), pulled from `components/*/description.md`.
   - **Major data flows** (one or two sentences each), pulled from `system-flows.md`.
   - **Architectural principles / non-negotiables** the AI inferred from the code (e.g., "DB-driven config", "all UI traffic via REST + SSE only", "no per-component shared state"). Mark each with `inferred-from: <source>`.
   - **Open questions / drift signals**: places where the code disagrees with itself, or where the AI cannot tell intent from implementation (e.g., two components doing similar work — is that legacy duplication or deliberate?).
 3. **Present condensed view** to the user (NOT the full draft files — a synopsis only):
   ```
   ══════════════════════════════════════
    REVIEW: Glossary + Architecture Vision (existing code)
   ══════════════════════════════════════
    Glossary (N terms drafted from verified docs):
      - <Term>: <one-line definition>
      - ...
    Architecture Vision — as inferred from the codebase:
      <one-paragraph synopsis>
      Components / responsibilities:
        - <component>: <one-line>
        - ...
      Principles / non-negotiables (inferred):
        - <principle>  [inferred-from: <source>]
        - ...
      Open questions / drift signals:
        - <q1>
        - <q2>
   ══════════════════════════════════════
    A) Inferred vision matches my intent — write the files
    B) Add / correct entries (provide diffs — terms, components,
       principles, or rename pairs)
    C) Resolve the open questions / drift signals first
   ══════════════════════════════════════
    Recommendation: pick C if any drift signals exist;
                    otherwise B if the vision misses
                    project-specific intent; A only when
                    the inferred vision is exactly right.
   ══════════════════════════════════════
   ```
 4. **Iterate**:
   - On B → integrate the user's diffs/additions, re-present, loop until A.
   - On C → ask the listed open questions in one batch (M4-style), integrate answers, re-present.
   - **Do NOT proceed to step 5 until the user picks A.**
 5. **Save**:
   - Write `DOCUMENT_DIR/glossary.md`, alphabetical, with a top-line `**Status**: confirmed-by-user` and the date.
   - Update `DOCUMENT_DIR/architecture.md`:
     - If a `## Architecture Vision` (or `## Vision` / `## Overview`) section already exists at the top, replace its body with the confirmed paragraph + components + principles.
     - Otherwise, insert `## Architecture Vision` as the first H2 after the title; preserve every existing H2 below.
     - Do NOT delete or re-order existing technical sections (Tech Stack, Deployment Model, Data Model, NFRs, ADRs).
 6. **Update `state.json`**: mark `step_4_5_glossary_vision: confirmed`. Resume on rerun must skip this step unless the user explicitly invokes `/document --refresh-vision`.
 **Self-verification**:
 - [ ] Every glossary entry traces to at least one file under `DOCUMENT_DIR/`
 - [ ] Every component listed in the vision matches a folder under `DOCUMENT_DIR/components/`
 - [ ] All open questions are answered or explicitly deferred (with the user's acknowledgement)
 - [ ] `architecture.md` still contains all H2 sections it had before this step
 - [ ] User picked option A on the latest condensed view
 **BLOCKING**: Do NOT proceed to the session boundary / Step 5 until both files are saved and the user has picked A.
 ---
 **Session boundary**: After Step 4.5 is confirmed, suggest a session break before proceeding to the synthesis steps (5–7). These steps produce different artifact types and benefit from fresh context:
 ```
 ══════════════════════════════════════
@@ -1,58 +1,41 @@
 ---
 name: implement
 description: |
-  Implement tasks sequentially with dependency-aware batching and integrated code review.
+  Orchestrate task implementation with dependency-aware batching, parallel subagents, and integrated code review.
  Reads flat task files and _dependencies_table.md from TASKS_DIR, computes execution batches via topological sort,
-  implements tasks one at a time in dependency order, runs code-review skill after each batch, and loops until done.
+  launches up to 4 implementer subagents in parallel, runs code-review skill after each batch, and loops until done.
  Use after /decompose has produced task files.
  Trigger phrases:
  - "implement", "start implementation", "implement tasks"
-  - "execute tasks"
+  - "run implementers", "execute tasks"
 category: build
-tags: [implementation, batching, code-review]
+tags: [implementation, orchestration, batching, parallel, code-review]
 disable-model-invocation: true
 ---
-# Implementation Runner
+# Implementation Orchestrator
-Implement all tasks produced by the `/decompose` skill. This skill reads task specs, computes execution order, writes the code and tests for each task **sequentially** (no subagents, no parallel execution), validates results via the `/code-review` skill, and escalates issues.
+Orchestrate the implementation of all tasks produced by the `/decompose` skill. This skill is a **pure orchestrator** — it does NOT write implementation code itself. It reads task specs, computes execution order, delegates to `implementer` subagents, validates results via the `/code-review` skill, and escalates issues.
-For each task the main agent receives a task spec, analyzes the codebase, implements the feature, writes tests, and verifies acceptance criteria — then moves on to the next task.
+The `implementer` agent is the specialist that writes all the code — it receives a task spec, analyzes the codebase, implements the feature, writes tests, and verifies acceptance criteria.
 ## Core Principles
- **Sequential execution**: implement one task at a time. Do NOT spawn subagents and do NOT run tasks in parallel. (See `.cursor/rules/no-subagents.mdc`.)
+- **Orchestrate, don't implement**: this skill delegates all coding to `implementer` subagents
- **Dependency-aware ordering**: tasks run only when all their dependencies are satisfied
+- **Dependency-aware batching**: tasks run only when all their dependencies are satisfied
- **Batching for review, not parallelism**: tasks are grouped into batches so `/code-review` and commits operate on a coherent unit of work — all tasks inside a batch are still implemented one after the other
+- **Max 4 parallel agents**: never launch more than 4 implementer subagents simultaneously
 - **File isolation**: no two parallel agents may write to the same file
 - **Integrated review**: `/code-review` skill runs automatically after each batch
- **Completeness before testing**: product implementation is not done until code is checked against task outcomes, included scope, architecture/component promises, and unresolved scaffold/native placeholders — not just task AC tests
+- **Auto-start**: batches launch immediately — no user confirmation before a batch
 - **Auto-start**: batches start immediately — no user confirmation before a batch
 - **Gate on failure**: user confirmation is required only when code review returns FAIL
 - **Commit per batch**: after each batch is confirmed, commit. Ask the user whether to push to remote unless the user previously opted into auto-push for this session.
 ## Context Resolution
 - TASKS_DIR: `_docs/02_tasks/`
- Task files: selected `*.md` files in `TASKS_DIR/todo/` (excluding files starting with `_`)
+- Task files: all `*.md` files in `TASKS_DIR/todo/` (excluding files starting with `_`)
 - Dependency table: `TASKS_DIR/_dependencies_table.md`
 ### Task Selection Context
 The invoking flow decides which task category this run should execute. The implement skill must honor that selected context instead of consuming every file in `todo/`.
 | Context | Selected task files |
 |---------|---------------------|
 | Product implementation | Task specs that are not test-only and not refactoring specs |
 | Test implementation | `*_test_infrastructure.md` plus task specs whose `Component` or `Epic` identifies `Blackbox Tests` |
 | Refactoring | Task specs whose filename or task ID includes `_refactor_` |
 If no explicit context is provided, infer it from the active autodev step:
 - greenfield Step 7 or existing-code Step 10 → Product implementation
 - greenfield Step 10 or existing-code Step 6 → Test implementation
 - refactor Phase 4 → Refactoring
 Unselected task files remain in `TASKS_DIR/todo/` for their later flow step.
 ### Task Lifecycle Folders
 ```
@@ -65,7 +48,7 @@ TASKS_DIR/
 ## Prerequisite Checks (BLOCKING)
-1. `TASKS_DIR/todo/` exists and contains at least one task file for the selected context — **STOP if missing**
+1. `TASKS_DIR/todo/` exists and contains at least one task file — **STOP if missing**
 2. `_dependencies_table.md` exists — **STOP if missing**
 3. At least one task is not yet completed — **STOP if all done**
 4. **Working tree is clean** — run `git status --porcelain`; the output must be empty.
@@ -73,16 +56,16 @@ TASKS_DIR/
     - A) Commit or stash stray changes manually, then re-invoke `/implement`
     - B) Agent commits stray changes as a single `chore: WIP pre-implement` commit and proceeds
     - C) Abort
-   - Rationale: each batch ends with a commit. Unrelated uncommitted changes would get silently folded into batch commits otherwise.
+   - Rationale: implementer subagents edit files in parallel and commit per batch. Unrelated uncommitted changes get silently folded into batch commits otherwise.
   - This check is repeated at the start of each batch iteration (see step 6 / step 14 Loop).
 ## Algorithm
 ### 1. Parse
- Read selected task `*.md` files from `TASKS_DIR/todo/` (excluding files starting with `_`)
+- Read all task `*.md` files from `TASKS_DIR/todo/` (excluding files starting with `_`)
 - Read `_dependencies_table.md` — parse into a dependency graph (DAG)
- Validate: no circular dependencies in the selected task graph, all referenced selected-task dependencies exist or are already completed in `TASKS_DIR/done/`
+- Validate: no circular dependencies, all referenced dependencies exist
 ### 2. Detect Progress
@@ -95,8 +78,8 @@ TASKS_DIR/
 - Topological sort remaining tasks
 - Select tasks whose dependencies are ALL satisfied (completed)
- A batch is simply a coherent group of tasks for review + commit. Within the batch, tasks are implemented sequentially in topological order.
+- If a ready task depends on any task currently being worked on in this batch, it must wait for the next batch
- Cap the batch size at a reasonable review scope (default: 4 tasks)
+- Cap the batch at 4 parallel agents
 - If the batch would exceed 20 total complexity points, suggest splitting and let the user decide
 ### 4. Assign File Ownership
@@ -106,12 +89,11 @@ The authoritative file-ownership map is `_docs/02_document/module-layout.md` (pr
 For each task in the batch:
 - Read the task spec's **Component** field.
 - Look up the component in `_docs/02_document/module-layout.md` → Per-Component Mapping.
- Set **OWNED** = the component's `Owns` glob (the files this task is allowed to write).
+- Set **OWNED** = the component's `Owns` glob (exclusive write for the duration of the batch).
 - Set **READ-ONLY** = Public API files of every component in the component's `Imports from` list, plus all `shared/*` Public API files.
 - Set **FORBIDDEN** = every other component's `Owns` glob, and every other component's internal (non-Public API) files.
 - If the task is a shared / cross-cutting task (lives under `shared/*`), OWNED = that shared directory; READ-ONLY = nothing; FORBIDDEN = every component directory.
-
+- If two tasks in the same batch map to the same component or overlapping `Owns` globs, schedule them sequentially instead of in parallel.
 Since execution is sequential, there is no parallel-write conflict to resolve; ownership here is a **scope discipline** check — it stops a task from drifting into unrelated components even when alone.
 If `_docs/02_document/module-layout.md` is missing or the component is not found:
 - STOP the batch.
@@ -120,30 +102,31 @@ If `_docs/02_document/module-layout.md` is missing or the component is not found
 ### 5. Update Tracker Status → In Progress
-For each task in the batch, transition its ticket status to **In Progress** via the configured work item tracker (see `protocols.md` for tracker detection) before starting work. If `tracker: local`, skip this step. If a tracker operation fails unexpectedly, follow `.cursor/rules/tracker.mdc`.
+For each task in the batch, transition its ticket status to **In Progress** via the configured work item tracker (see `protocols.md` for tracker detection) before launching the implementer. If `tracker: local`, skip this step.
-### 6. Implement Tasks Sequentially
+### 6. Launch Implementer Subagents
-**Per-batch dirty-tree re-check**: before starting the batch, run `git status --porcelain`. On the first batch this is guaranteed clean by the prerequisite check. On subsequent batches, the previous batch ended with a commit so the tree should still be clean. If the tree is dirty at this point, STOP and surface the dirty files to the user using the same A/B/C choice as the prerequisite check. The most likely causes are a failed commit in the previous batch, a user who edited files mid-loop, or a pre-commit hook that re-wrote files and was not captured.
+**Per-batch dirty-tree re-check**: before launching subagents, run `git status --porcelain`. On the first batch this is guaranteed clean by the prerequisite check. On subsequent batches, the previous batch ended with a commit so the tree should still be clean. If the tree is dirty at this point, STOP and surface the dirty files to the user using the same A/B/C choice as the prerequisite check. The most likely causes are a failed commit in the previous batch, a user who edited files mid-loop, or a pre-commit hook that re-wrote files and was not captured.
-For each task in the batch **in topological order, one at a time**:
+For each task in the batch, launch an `implementer` subagent with:
-1. Read the task spec file.
+- Path to the task spec file
-2. Respect the file-ownership envelope computed in Step 4 (OWNED / READ-ONLY / FORBIDDEN).
+- List of files OWNED (exclusive write access)
-3. Implement the feature and write/update tests for every acceptance criterion in the spec. If a test cannot run in the current environment (e.g., TensorRT requires GPU), the test must still be written and skip with a clear reason.
+- List of files READ-ONLY
-4. Run the relevant tests locally before moving on to the next task in the batch. If tests fail, fix in-place — do not defer.
+- List of files FORBIDDEN
-5. Capture a short per-task status line (files changed, tests pass/fail, any blockers) for the batch report.
+- **Explicit instruction**: the implementer must write or update tests that validate each acceptance criterion in the task spec. If a test cannot run in the current environment (e.g., TensorRT requires GPU), the test must still be written and skip with a clear reason.
-Do NOT spawn subagents and do NOT attempt to implement two tasks simultaneously, even if they touch disjoint files. See `.cursor/rules/no-subagents.mdc`.
+Launch all subagents immediately — no user confirmation.
-### 7. Collect Status
+### 7. Monitor
- After all tasks in the batch are finished, aggregate the per-task status lines into a structured batch status.
+- Wait for all subagents to complete
- If any task reported "Blocked", log the blocker with the failing task's ID and continue — the batch report will surface it.
+- Collect structured status reports from each implementer
 - If any implementer reports "Blocked", log the blocker and continue with others
-**Stuck detection** — while implementing a task, watch for these signals in your own progress:
+**Stuck detection** — while monitoring, watch for these signals per subagent:
- The same file has been rewritten 3+ times without tests going green → stop, mark the task Blocked, and move to the next task in the batch (the user will be asked at the end of the batch).
+- Same file modified 3+ times without test pass rate improving → flag as stuck, stop the subagent, report as Blocked
- You have tried 3+ distinct approaches without evidence-driven progress → stop, mark Blocked, move on.
+- Subagent has not produced new output for an extended period → flag as potentially hung
- Do NOT loop indefinitely on a single task. Record the blocker and proceed.
+- If a subagent is flagged as stuck, do NOT let it continue looping — stop it and record the blocker in the batch report
 ### 8. AC Test Coverage Verification
@@ -156,8 +139,8 @@ Before code review, verify that every acceptance criterion in each task spec has
   - **Not covered**: no test exists for this AC
 If any AC is **Not covered**:
- This is a **BLOCKING** failure — the missing test must be written before proceeding
+- This is a **BLOCKING** failure — the implementer must write the missing test before proceeding
- Go back to the offending task, add tests for the specific ACs that lack coverage, then re-run this check
+- Re-launch the implementer with the specific ACs that need tests
 - If the test cannot run in the current environment (GPU required, platform-specific, external service), the test must still exist and skip with `pytest.mark.skipif` or `pytest.skip()` explaining the prerequisite
 - A skipped test counts as **Covered** — the test exists and will run when the environment allows
@@ -206,14 +189,12 @@ Track `auto_fix_attempts` and `escalated_findings` in the batch report for retro
 ### 12. Update Tracker Status → In Testing
-After the batch is committed (and pushed if the user approved pushing), transition the ticket status of each task in the batch to **In Testing** via the configured work item tracker. If `tracker: local`, skip this step. If a tracker operation fails unexpectedly, follow `.cursor/rules/tracker.mdc`.
+After the batch is committed and pushed, transition the ticket status of each task in the batch to **In Testing** via the configured work item tracker. If `tracker: local`, skip this step.
 ### 13. Archive Completed Tasks
 Move each completed task file from `TASKS_DIR/todo/` to `TASKS_DIR/done/`.
 For product implementation, this archive means "batch implementation accepted." The Product Implementation Completeness Gate can still require follow-up remediation tasks before the feature is complete; it does not move original task files back to `todo/`.
 ### 14. Loop
 - Go back to step 2 until all tasks in `todo/` are done
@@ -235,70 +216,16 @@ For product implementation, this archive means "batch implementation accepted."
 - **Interaction with Auto-Fix Gate**: Architecture findings (new category from code-review Phase 7) always escalate per the implement auto-fix matrix; they cannot silently auto-fix
 - **Resumability**: if interrupted, the next invocation checks for the latest `cumulative_review_batches_*.md` and computes the changed-file set from batch reports produced after that review
-### 15. Product Implementation Completeness Gate
+### 15. Final Test Run
-Run this gate after all **product implementation** tasks are complete and before writing any final product implementation report or allowing autodev to proceed to testability/test decomposition. Skip this gate only when the remaining context is explicitly test implementation or refactoring, as determined by the task files and report filename rules.
+- After all batches are complete, run the full test suite once
-
+- Read and execute `.cursor/skills/test-run/SKILL.md` (detect runner, run suite, diagnose failures, present blocking choices)
-**Goal**: catch the failure mode where narrow tests validate scaffold behavior while the task's actual outcome, included scope, architecture promise, or named integration remains unimplemented.
+- Test failures are a **blocking gate** — do not proceed until the test-run skill completes with a user decision
-
+- When tests pass, report final summary
 Inputs:
 - Completed product task specs from `_docs/02_tasks/done/` for the current cycle
 - `_docs/02_document/architecture.md`
 - `_docs/02_document/system-flows.md`
 - Relevant `_docs/02_document/components/*/description.md` files
 - Current source code under each completed task's ownership envelope
 - Batch reports and code-review reports for the current cycle
 For each completed product task:
 1. Read these sections from the task spec: `Description`, `Outcome`, `Scope / Included`, `Acceptance Criteria`, `Non-Functional Requirements`, `Constraints`, and explicit named technologies or integrations.
 2. Compare those promises against actual source code, not only tests or report prose.
 3. Search the task's owned component files for unresolved implementation markers: `placeholder`, `stub`, `reserved`, `TODO`, `NotImplemented`, `pass`, `deterministic`, `fake`, `mock`, `scaffold`, `native bridge`, and empty native/readme-only integration directories. Ignore test fixtures/mocks only when they are under test-owned paths and not used as production behavior.
 4. Verify that each named runtime dependency in the task promise is either integrated behind the approved boundary or explicitly documented as a blocked prerequisite in the task/report. Examples: if a task promises FAISS, DINOv2, BASALT, LightGlue, OpenCV, RANSAC, a database, cloud service, or hardware SDK, the production code must contain that integration boundary; a deterministic fallback alone is not complete.
 5. Verify tests exercise the real implementation path where local prerequisites exist. Environment-gated tests may skip only with an explicit prerequisite reason; they do not make missing production code complete.
 6. Classify each task:
   - **PASS**: task promises are implemented or explicitly out of scope in the task itself.
   - **BLOCKED**: production code exists but cannot be fully verified due to external hardware/data/license/runtime prerequisites; the blocker is explicit and tests report blocked/skipped with reason.
   - **FAIL**: promised production behavior is missing, only scaffolded, or only represented in tests/reports.
 Save the audit to `_docs/03_implementation/implementation_completeness_cycle[N]_report.md` with:
 - Per-task classification
 - Evidence files/symbols checked
 - Any unresolved scaffold/native placeholders
 - Any named promised technologies not integrated
 - Required remediation task suggestions, each sized to 5 points or less
 Gate:
 - If every product task is `PASS` or `BLOCKED` with explicit prerequisite evidence, continue to Final Test Run.
 - If any product task is `FAIL`, STOP. Do not write the final product implementation report and do not proceed to any downstream autodev step. Completed original task files remain in `done/`; the missing work is represented by remediation tasks. Present a Choose block:
  - A) Create remediation tasks now and return to implementation
  - B) Mark the missing behavior explicitly out of scope in task/docs, then re-run this gate
  - C) Abort for manual correction
 - Recommendation must normally be A unless the user deliberately accepts reduced scope.
 Remediation task creation:
 1. For each `FAIL`, create one or more task specs using `.cursor/skills/decompose/templates/task.md`; each remediation task must be sized at 5 points or less.
 2. Save each task to `_docs/02_tasks/todo/` with a short name prefixed by `remediate_`.
 3. Set **Component** to the failed task's component and set **Dependencies** to the failed task ID plus any remediation prerequisites.
 4. Create or defer tracker tickets using the same tracker rules as decompose/new-task: if tracker is available, create tickets immediately; if the user explicitly chose `tracker: local`, keep numeric prefixes with `Tracker: pending` / `Epic: pending`.
 5. Append the remediation tasks to `_docs/02_tasks/_dependencies_table.md`.
 6. Return to Step 1 (Parse) in **Product implementation** context. The final product implementation report can be written only after remediation tasks complete and this gate reruns without `FAIL`.
 ### 16. Final Test Run
 - After all batches are complete, run the full test suite once unless the invoking flow's immediate next step is `Run Tests`.
 - If the next flow step is `Run Tests`, record a handoff in the final implementation report and let `.cursor/skills/test-run/SKILL.md` own the full-suite gate to avoid duplicate full runs.
 - When this step does run, read and execute `.cursor/skills/test-run/SKILL.md` (detect runner, run suite, diagnose failures, present blocking choices).
 - Test failures are a **blocking gate** — do not proceed until the test-run skill completes with a user decision.
 - When tests pass, report final summary.
 ## Batch Report Persistence
-After each batch completes, save the batch report to `_docs/03_implementation/batch_[NN]_cycle[N]_report.md` for feature implementation (or `batch_[NN]_report.md` for test/refactor runs). Create the directory if it doesn't exist. For product implementation, produce the FINAL implementation report only after the Product Implementation Completeness Gate passes. For test and refactor implementation, produce the FINAL report after all selected tasks complete and the full-suite gate is either run or handed off per Step 16. The filename depends on context:
+After each batch completes, save the batch report to `_docs/03_implementation/batch_[NN]_cycle[N]_report.md` for feature implementation (or `batch_[NN]_report.md` for test/refactor runs). Create the directory if it doesn't exist. When all tasks are complete, produce a FINAL implementation report with a summary of all batches. The filename depends on context:
 - **Test implementation** (tasks from test decomposition): `_docs/03_implementation/implementation_report_tests.md`
 - **Feature implementation**: `_docs/03_implementation/implementation_report_{feature_slug}_cycle{N}.md` where `{feature_slug}` is derived from the batch task names (e.g., `implementation_report_core_api_cycle2.md`) and `{N}` is the current `state.cycle` from `_docs/_autodev_state.md`. If `state.cycle` is absent (pre-migration), default to `cycle1`.
@@ -337,10 +264,9 @@ After each batch, produce a structured report:
 | Situation | Action |
 |-----------|--------|
-| Same task rewritten 3+ times without green tests | Mark Blocked, continue batch, escalate at batch end |
+| Implementer fails same approach 3+ times | Stop it, escalate to user |
 | Task blocked on external dependency (not in task list) | Report and skip |
-| File ownership violated (task wrote outside OWNED) | ASK user |
+| File ownership conflict unresolvable | ASK user |
 | Product completeness gate finds missing promised implementation | STOP — create remediation tasks or get explicit user scope reduction |
 | Test failure after final test run | Delegate to test-run skill — blocking gate |
 | All tasks complete | Report final summary, suggest final commit |
 | `_dependencies_table.md` missing | STOP — run `/decompose` first |
@@ -355,8 +281,7 @@ Each batch commit serves as a rollback checkpoint. If recovery is needed:
 ## Safety Rules
- Never start a task whose dependencies are not yet completed
+- Never launch tasks whose dependencies are not yet completed
- Never run tasks in parallel and never spawn subagents — see `.cursor/rules/no-subagents.mdc`
+- Never allow two parallel agents to write to the same file
- If a task is flagged as stuck, stop working on it and report — do not let it loop indefinitely
+- If a subagent fails or is flagged as stuck, stop it and report — do not let it loop indefinitely
- Always run the Product Implementation Completeness Gate before final product reports
+- Always run the full test suite after all batches complete (step 15)
 - Always run or hand off the full test suite after all batches complete (step 16)
@@ -3,31 +3,29 @@
 ## Topological Sort with Batch Grouping
 The `/implement` skill uses a topological sort to determine execution order,
-then groups tasks into batches for code review and commit. Execution within a
+then groups tasks into batches for parallel execution.
 batch is **sequential** — see `.cursor/rules/no-subagents.mdc`.
 ## Algorithm
 1. Build adjacency list from `_dependencies_table.md`
 2. Compute in-degree for each task node
-3. Initialize the ready set with all nodes that have in-degree 0
+3. Initialize batch 0 with all nodes that have in-degree 0
 4. For each batch:
-   a. Select up to 4 tasks from the ready set (default batch size cap)
+   a. Select up to 4 tasks from the ready set
-   b. Implement the selected tasks one at a time in topological order
+   b. Check file ownership — if two tasks would write the same file, defer one to the next batch
-   c. When all tasks in the batch complete, remove them from the graph and
+   c. Launch selected tasks as parallel implementer subagents
-      decrement in-degrees of dependents
+   d. When all complete, remove them from the graph and decrement in-degrees of dependents
-   d. Add newly zero-in-degree nodes to the ready set
+   e. Add newly zero-in-degree nodes to the next batch's ready set
 5. Repeat until the graph is empty
-## Ordering Inside a Batch
+## File Ownership Conflict Resolution
-Tasks inside a batch are executed in topological order — a task is only
+When two tasks in the same batch map to overlapping files:
-started after every task it depends on (inside the batch or in a previous
+- Prefer to run the lower-numbered task first (it's more foundational)
-batch) is done. When two tasks have the same topological rank, prefer the
+- Defer the higher-numbered task to the next batch
-lower-numbered (more foundational) task first.
+- If both have equal priority, ask the user
 ## Complexity Budget
 Each batch should not exceed 20 total complexity points.
 If it does, split the batch and let the user choose which tasks to include.
 The budget exists to keep the per-batch code review scope reviewable.
@@ -129,8 +129,7 @@ If `_docs/_repo-config.yaml` already exists:
   - Entries removed (component removed from registry)
 4. **Ask the user** whether to apply the diff.
 5. If applied, **preserve `confirmed: true` flags** for entries that still match — don't reset human-approved mappings.
-6. **Preserve user-owned top-level keys verbatim**: `glossary_doc:` (written by autodev meta-repo Step 2.5) and any `assumptions_log:` entries are NEVER edited or removed by this skill. Carry them through unchanged. If the file referenced by `glossary_doc:` no longer exists on disk, surface as an `unresolved:` question — do not auto-clear the field.
+6. If user declines, stop — leave config untouched.
 7. If user declines, stop — leave config untouched.
 ### Phase 8: Batch question checkpoint (M4)
@@ -15,8 +15,6 @@ Propagates component changes into the unified documentation set. Strictly scoped
 | Root `README.md` **only** if `_repo-config.yaml` lists it as a doc target (e.g., services table) | Install scripts (`ci-*.sh`) → use `monorepo-cicd` |
 | Docs index (`_docs/README.md` or similar) cross-reference tables | Component-internal docs (`<component>/README.md`, `<component>/docs/*`) |
 | Cross-cutting docs listed in `docs.cross_cutting` | `_docs/_repo-config.yaml` itself (only `monorepo-discover` and `monorepo-onboard` write it) |
 | Body of cross-cutting docs **except** the `## Architecture Vision` section (preserved verbatim — owned by autodev meta-repo Step 2.5) | The file at `glossary_doc:` (user-confirmed; only autodev meta-repo Step 2.5 rewrites it). New project terms surfaced during sync are reported back to the user, not silently appended |
 | `## Architecture Vision` body — read-only, may be referenced for terminology consistency but never edited | — |
 If a component change requires CI/env updates too, tell the user to also run `monorepo-cicd`. This skill does NOT cross domains.
@@ -168,8 +166,6 @@ Append to `_docs/_repo-config.yaml` under `assumptions_log:`:
 - Change `confirmed_by_user` or any `confirmed: <bool>` flag
 - Auto-commit or push
 - Guess a mapping not in the config
 - Edit `glossary_doc:` (the file recorded under the config's `glossary_doc:` key)
 - Edit the `## Architecture Vision` section of any cross-cutting doc; if a sync would conflict with that section, surface the conflict to the user and skip — do not silently rewrite user-confirmed content
 ## Edge cases
@@ -1,152 +0,0 @@
 ---
 name: monorepo-e2e
 description: Syncs the suite-level integration e2e harness (`e2e/docker-compose.suite-e2e.yml`, fixtures, Playwright runner) when component contracts drift in ways that affect the cross-service scenario. Reads `_docs/_repo-config.yaml` to know which suite-e2e artifacts are in play. Touches ONLY suite-e2e files — never per-component CI, docs, or component internals. Use when a component changes a port, env var, public API endpoint, DB schema column, or detection model that the suite e2e exercises.
 ---
 # Monorepo Suite-E2E
 Propagates component changes into the suite-level integration e2e harness. Strictly scoped — never edits docs, component internals, per-component CI configs, or the production deploy compose.
 ## Scope — explicit
 | In scope | Out of scope |
 | -------- | ------------ |
 | `e2e/docker-compose.suite-e2e.yml` (overlay, healthchecks, seed services) | Production `_infra/deploy/<target>/docker-compose.yml` — `monorepo-cicd` owns it |
 | `e2e/fixtures/init.sql` (seeded rows that the spec depends on) | Component DB migrations — owned by each component |
 | `e2e/fixtures/expected_detections.json` (detection baseline) | Detection model itself — owned by `detections/` |
 | `e2e/runner/tests/*.spec.ts` selector / contract-driven edits | New scenarios (user-driven, not drift-driven) |
 | `e2e/runner/Dockerfile` / `package.json` Playwright version bumps | Net-new e2e infrastructure (use `monorepo-onboard` or initial scaffolding) |
 | `.woodpecker/suite-e2e.yml` (suite-level pipeline) | Per-component `.woodpecker/01-test.yml` / `02-build-push.yml` — `monorepo-cicd` owns those |
 | Suite-e2e leftover entries under `_docs/_process_leftovers/` | Per-component leftovers — owned by each component |
 If a component change needs doc updates too, tell the user to also run `monorepo-document`. If it needs production-deploy or per-component CI updates, run `monorepo-cicd`. This skill **only** updates the suite-e2e surface.
 ## Preconditions (hard gates)
 1. `_docs/_repo-config.yaml` exists.
 2. Top-level `confirmed_by_user: true`.
 3. `suite_e2e.*` section is populated in config (see "Required config block" below). If absent, abort and ask the user to extend the config via `monorepo-discover`.
 4. Components-in-scope have confirmed contract mappings (port, public API path, DB tables touched), OR user explicitly approves inferred ones.
 ## Required config block
 This skill expects `_docs/_repo-config.yaml` to carry:
 ```yaml
 suite_e2e:
  overlay: e2e/docker-compose.suite-e2e.yml
  fixtures:
    init_sql: e2e/fixtures/init.sql
    baseline_json: e2e/fixtures/expected_detections.json
    binary_fixtures:
      - e2e/fixtures/sample.mp4
      - e2e/fixtures/model.tar.gz
  runner:
    dockerfile: e2e/runner/Dockerfile
    package_json: e2e/runner/package.json
    spec_dir: e2e/runner/tests
  pipeline: .woodpecker/suite-e2e.yml
  scenario:
    description: "Upload video → detect → overlays → dataset → DB persistence"
    components_exercised:
      - ui
      - annotations
      - detections
      - postgres-local
    api_contracts:
      - component: ui
        path: /api/admin/auth/login
      - component: annotations
        path: /api/annotations/media/batch
      - component: annotations
        path: /api/annotations/media/{id}/annotations
    db_tables:
      - media
      - annotations
      - detection
      - detection_classes
    model_pin:
      detections_repo_path: <path-to-model-config-or-classes-source>
      classes_source: annotations/src/Database/DatabaseMigrator.cs
 ```
 If `suite_e2e:` is missing the skill **stops** — it does not invent a default mapping.
 ## Mitigations (M1–M7)
 - **M1** Separation: this skill only touches suite-e2e files; no production deploy compose, no per-component CI, no docs, no component internals.
 - **M3** Factual vs. interpretive: port, env var, API path, DB column — FACTUAL, read from the components' code. Whether a baseline still matches the model — DEFERRED to the user (the skill flags drift, never silently re-records).
 - **M4** Batch questions at checkpoints.
 - **M5** Skip over guess: a component change that doesn't map cleanly to one of the in-scope artifacts → skip and report.
 - **M6** Assumptions footer + append to `_repo-config.yaml` `assumptions_log`.
 - **M7** Drift detection: verify every path under `suite_e2e.*` exists on disk; stop if not.
 ## Workflow
 ### Phase 1: Drift check (M7)
 Verify every file listed under `suite_e2e.*` (excluding `binary_fixtures`, which are gitignored) exists on disk. Missing file → stop and ask:
 - Run `monorepo-discover` to refresh, OR
 - Skip the missing artifact (recorded in report)
 For `binary_fixtures` paths that are absent (expected — they live in S3/LFS), check whether `expected_detections.json._meta.video_sha256` is still a `TBD-...` placeholder. If yes, surface this as a known leftover (`_docs/_process_leftovers/2026-04-22_suite-e2e-binary-fixtures.md`) and continue.
 ### Phase 2: Determine scope
 Same as `monorepo-cicd` Phase 2 — ask the user, or auto-detect. For **auto-detect**, flag commits that touch suite-e2e-relevant concerns:
 | Commit pattern | Suite-e2e impact |
 | -------------- | ---------------- |
 | New port exposed by `<component>` | Healthcheck override may change in `e2e/docker-compose.suite-e2e.yml` |
 | New required env var on `<component>` | `e2e/docker-compose.suite-e2e.yml` `e2e-runner` env block + `init.sql` seed |
 | Public API path renamed / removed | Spec selector / API call path in `e2e/runner/tests/*.spec.ts` |
 | DB schema column renamed in a `db_tables` entry | `init.sql` column reference + spec `pg.query` text |
 | New required DB table referenced by spec | `init.sql` insert block (skip if owned by component migration) |
 | Detection model rev change in `detections/` | `expected_detections.json` `_meta.model.revision` + flag baseline as stale |
 | New canonical detection class added | `expected_detections.json._meta` annotation |
 Present the flagged list; confirm.
 ### Phase 3: Classify changes per component
 | Change type | Target suite-e2e files |
 | ----------- | ---------------------- |
 | Port / env var change | `e2e/docker-compose.suite-e2e.yml` |
 | API path / contract change | `e2e/runner/tests/*.spec.ts` |
 | DB schema reference change | `e2e/fixtures/init.sql` and spec SQL queries |
 | Model / class catalog change | `e2e/fixtures/expected_detections.json` (mark `_meta.fixture_version` bump + leftover entry for binary refresh) |
 | Playwright dependency drift | `e2e/runner/package.json` + `e2e/runner/Dockerfile` |
 | Suite scenario steps gone stale | **Stop and ask** — scenario edits are user-driven, not drift-driven |
 ### Phase 4: Apply edits
 Edit each in-scope file. After each batch, run `ReadLints` on touched files. Do NOT run the suite e2e itself — that's a downstream pipeline operation, not a sync-skill responsibility.
 For `expected_detections.json`: when the model revision changes, the skill **does not** re-record the baseline — the binary fixture cannot be regenerated from the dev environment. Instead:
 1. Set `_meta.model.revision` to the new revision.
 2. Set `_meta.fixture_version` to a new bumped version with a `-stale` suffix (e.g., `0.2.0-stale`).
 3. Append a new entry to `_docs/_process_leftovers/` describing the required re-record.
 4. Leave `expected.by_class` untouched — the spec's tolerance check will fail loudly until the binary refresh lands.
 ### Phase 5: Update assumptions log
 Append a new `assumptions_log:` entry to `_docs/_repo-config.yaml` recording:
 - Date, components in scope, which suite-e2e files were touched
 - Any inferred contract mappings still tagged `confirmed: false`
 - Any leftover entries created
 ### Phase 6: Report
 Render a Choose-format summary of the synced files, surface any `_process_leftovers/` entries created, and end. Do NOT auto-commit.
 ## Self-verification
 - [ ] No file outside `e2e/`, `.woodpecker/suite-e2e.yml`, or `_docs/_process_leftovers/` was edited
 - [ ] `_docs/_repo-config.yaml` `suite_e2e:` block was not silently mutated except for `assumptions_log` append
 - [ ] `expected_detections.json` was not re-recorded (only metadata bumped + leftover added)
 - [ ] Every spec edit traces to a flagged commit pattern in Phase 2
 - [ ] `ReadLints` clean on every touched file
 ## Failure handling
 Same retry / escalation protocol as `monorepo-cicd` — see `protocols.md`. The most common failure mode is the binary-fixture leftover (sample.mp4 missing or SHA-mismatched); this skill does not attempt to resolve it, only surfaces it.
@@ -59,8 +59,6 @@ Mark each as `complete` / `partial` / `missing` and explain.
 - Every component in `components:` appears in the registry — flag mismatches
 - Every `docs.root` file cross-referenced in config exists on disk — flag missing
 - Every `ci.orchestration_files` and `ci.install_scripts` exists — flag missing
 - `glossary_doc:` (if recorded in config) points to a file that exists on disk — flag missing
 - The cross-cutting architecture doc identified by `docs.cross_cutting` contains a `## Architecture Vision` section — flag missing (signals the meta-repo flow's Step 2.5 was skipped or the section was removed)
 ### Section 5: Unresolved questions
@@ -115,8 +113,6 @@ In registry, not in config:    [list or "(none)"]
 In config, not in registry:    [list or "(none)"]
 Config-referenced docs missing: [list or "(none)"]
 Config-referenced CI files missing: [list or "(none)"]
 glossary_doc:                  [path or "not recorded — run /autodev to capture"]
 Architecture Vision section:   [present | missing in <doc>]
 ═══════════════════════════════════════════════════
 Unresolved questions
@@ -75,7 +75,7 @@ Record the description verbatim for use in subsequent steps.
 **Role**: Technical analyst
 **Goal**: Determine whether deep research is needed.
-Read the user's description and the existing codebase documentation from DOCUMENT_DIR (architecture.md including its `## Architecture Vision` section, glossary.md, components/, system-flows.md). Use `glossary.md` to keep the new task's name, acceptance-criteria wording, and component references aligned with the user's confirmed vocabulary; flag the task to the user if the request appears to violate an Architecture Vision principle, do not silently allow it.
+Read the user's description and the existing codebase documentation from DOCUMENT_DIR (architecture.md, components/, system-flows.md).
 **Consult LESSONS.md**: if `_docs/LESSONS.md` exists, read it and look for entries in categories `estimation`, `architecture`, `dependencies` that might apply to the task under consideration. If a relevant lesson exists (e.g., "estimation: auth-related changes historically take 2x estimate"), bias the classification and recommendation accordingly. Note in the output which lessons (if any) were applied.
@@ -134,8 +134,7 @@ The `<task_slug>` is a short kebab-case name derived from the feature descriptio
 **Goal**: Determine where and how to insert the new functionality, and whether existing tests cover the new requirements.
 1. Read the codebase documentation from DOCUMENT_DIR:
-   - `architecture.md` — overall structure (the `## Architecture Vision` H2 is user-confirmed intent and must not be violated by the new task without explicit approval)
+   - `architecture.md` — overall structure
   - `glossary.md` — project terminology; reuse the user's vocabulary in task names, AC, and component references
   - `components/` — component specs
   - `system-flows.md` — data flows (if exists)
   - `data_model.md` — data model (if exists)
@@ -282,7 +281,7 @@ Present using the Choose format for each decision that has meaningful alternativ
   - Update **Epic** field: `[EPIC-ID]`
 3. Rename the file from `[##]_[short_name].md` to `[TICKET-ID]_[short_name].md`
-If the work item tracker is not authenticated or unavailable, follow `.cursor/rules/tracker.mdc` before continuing. Only if the user explicitly chooses `tracker: local`:
+If the work item tracker is not authenticated or unavailable (`tracker: local`):
 - Keep the numeric prefix
 - Set **Tracker** to `pending`
 - Set **Epic** to `pending`
@@ -337,7 +336,7 @@ After the user chooses **Done**:
 | Research skill hits a blocker | Follow research skill's own escalation rules |
 | Codebase analysis reveals conflicting architectures | **ASK** user which pattern to follow |
 | Complexity exceeds 5 points | **WARN** user and suggest splitting into multiple tasks |
-| Work item tracker MCP unavailable | Follow `.cursor/rules/tracker.mdc`; do not continue in local mode unless the user explicitly chooses it |
+| Work item tracker MCP unavailable | **WARN**, continue with local-only task files |
 ## Trigger Conditions
@@ -69,7 +69,7 @@ Capture any new questions, findings, or insights that arise during test specific
 ### Step 2: Solution Analysis
-Read and follow `steps/02_solution-analysis.md`. The step opens with **Phase 2a.0: Glossary & Architecture Vision** (BLOCKING) — drafts `_docs/02_document/glossary.md` and a one-paragraph architecture vision, presents the condensed view to the user, iterates until confirmed, then proceeds into the architecture, data-model, and deployment phases. The confirmed vision becomes the first `## Architecture Vision` H2 of `architecture.md`.
+Read and follow `steps/02_solution-analysis.md`.
 ---
@@ -107,7 +107,6 @@ Read and follow `steps/07_quality-checklist.md`.
 - **Coding during planning**: this workflow produces documents, never code
 - **Multi-responsibility components**: if a component does two things, split it
 - **Skipping BLOCKING gates**: never proceed past a BLOCKING marker without user confirmation
 - **Skipping the glossary/vision gate (Phase 2a.0)**: drafting `architecture.md` from raw `solution.md` without confirming terminology and vision means the AI's mental model is not aligned with the user's; every downstream artifact will inherit that drift
 - **Diagrams without data**: generate diagrams only after the underlying structure is documented
 - **Copy-pasting problem.md**: the architecture doc should analyze and transform, not repeat the input
 - **Vague interfaces**: "component A talks to component B" is not enough; define the method, input, output
@@ -138,10 +137,8 @@ Read and follow `steps/07_quality-checklist.md`.
 │                                                                │
 │ 1. Blackbox Tests      → test-spec/SKILL.md                     │
 │    [BLOCKING: user confirms test coverage]                     │
-│ 2. Solution Analysis   → glossary + vision, architecture,       │
+│ 2. Solution Analysis   → architecture, data model, deployment   │
-│                          data model, deployment                 │
+│    [BLOCKING: user confirms architecture]                      │
 │    [BLOCKING 2a.0: user confirms glossary + vision]            │
 │    [BLOCKING 2a:   user confirms architecture]                  │
 │ 3. Component Decomp    → component specs + interfaces           │
 │    [BLOCKING: user confirms components]                        │
 │ 4. Review & Risk       → risk register, iterations              │
@@ -4,105 +4,20 @@
 **Goal**: Produce `architecture.md`, `system-flows.md`, `data_model.md`, and `deployment/` from the solution draft
 **Constraints**: No code, no component-level detail yet; focus on system-level view
 ### Phase 2a.0: Glossary & Architecture Vision (BLOCKING)
 **Role**: Software architect + business analyst
 **Goal**: Align the AI's mental model of the project with the user's intent BEFORE drafting `architecture.md`. Capture domain terminology and the user's high-level architecture vision so every downstream artifact (architecture, components, flows, tests, epics) is grounded in confirmed user intent — not in AI inference.
 **Inputs**:
 - `_docs/00_problem/problem.md`, `acceptance_criteria.md`, `restrictions.md`
 - `_docs/00_problem/input_data/*`
 - `_docs/01_solution/solution.md` (and any earlier `solution_draft*.md` siblings)
 - Any blackbox-test findings produced in Step 1
 **Outputs**:
 - `_docs/02_document/glossary.md` (NEW)
 - A confirmed "Architecture Vision" paragraph + bullet list held in working memory and used as the spine of Phase 2a's `architecture.md`
 **Procedure**:
 1. **Draft glossary** — extract project-specific terminology from inputs (NOT generic software terms). Include:
   - Domain entities, processes, and roles
   - Acronyms / abbreviations
   - Internal codenames or product names
   - Synonym pairs in active use (e.g., "flight" vs. "mission")
   - Stakeholder personas referenced in problem.md
   Each entry: one-line definition, plus a parenthetical source (`source: problem.md`, `source: solution.md §3`).
   Skip terms that have a single well-known industry meaning (REST, JSON, etc.).
 2. **Draft architecture vision** — synthesize from inputs:
   - **One paragraph**: what the system is, who uses it, the shape of the runtime topology (monolith / services / pipeline / library / hybrid).
   - **Components & responsibilities** (one-line each). At this stage these are *intent-level*, not the formal decomposition that Step 3 produces.
   - **Major data flows** (one or two sentences each).
   - **Architectural principles / non-negotiables** the user has implied (e.g., "DB-driven config", "no per-component state outside Redis", "all UI traffic via REST + SSE only").
   - **Open architectural questions** the AI cannot resolve from inputs alone.
 3. **Present condensed view** to the user (NOT the full draft files — a synopsis only):
   ```
   ══════════════════════════════════════
    REVIEW: Glossary + Architecture Vision
   ══════════════════════════════════════
    Glossary (N terms drafted):
      - <Term>: <one-line definition>
      - ...
    Architecture Vision:
      <one-paragraph synopsis>
      Components / responsibilities:
        - <component>: <one-line>
        - ...
      Principles / non-negotiables:
        - <principle>
        - ...
      Open questions (AI could not resolve):
        - <q1>
        - <q2>
   ══════════════════════════════════════
    A) Looks correct — write glossary.md, use vision for Phase 2a
    B) I want to add / correct entries (provide diffs)
    C) Answer the open questions first, then re-present
   ══════════════════════════════════════
    Recommendation: pick C if open questions exist, otherwise A
   ══════════════════════════════════════
   ```
 4. **Iterate**:
   - On B → integrate the user's diffs/additions, re-present the condensed view, loop until A.
   - On C → ask the listed open questions one round (M4-style batch), integrate answers, re-present.
   - **Do NOT proceed to step 5 until the user picks A.**
 5. **Save**:
   - Write `_docs/02_document/glossary.md` with terms in alphabetical order. Include a top-line `**Status**: confirmed-by-user` and the date.
   - Hold the confirmed vision (paragraph + components + principles) in working memory; Phase 2a will materialize it into `architecture.md` and **must** preserve every confirmed principle and component intent verbatim.
 **Self-verification**:
 - [ ] Every glossary entry traces to at least one input file (no invented terms)
 - [ ] Every component listed in the vision is one the inputs reference
 - [ ] All open questions are either answered or explicitly deferred (with the user's acknowledgement)
 - [ ] User picked option A on the latest condensed view
 **BLOCKING**: Do NOT proceed to Phase 2a until `glossary.md` is saved and the user has confirmed the architecture vision.
 ### Phase 2a: Architecture & Flows
 1. Read all input files thoroughly
 2. Incorporate findings, questions, and insights discovered during Step 1 (blackbox tests)
-3. **Apply confirmed vision from Phase 2a.0**: the architecture document must include a top-level `## Architecture Vision` section that contains the user-confirmed paragraph, components, and principles verbatim. The rest of `architecture.md` (tech stack, deployment model, NFRs, ADRs) builds on top of that section, never contradicts it
+3. Research unknown or questionable topics via internet; ask user about ambiguities
-4. Research unknown or questionable topics via internet; ask user about ambiguities
+4. Document architecture using `templates/architecture.md` as structure
-5. Document architecture using `templates/architecture.md` as structure
+5. Document system flows using `templates/system-flows.md` as structure
 6. Document system flows using `templates/system-flows.md` as structure
 **Self-verification**:
 - [ ] `architecture.md` opens with a `## Architecture Vision` section matching Phase 2a.0
 - [ ] Architecture covers all capabilities mentioned in solution.md
 - [ ] System flows cover all main user/system interactions
- [ ] No contradictions with problem.md, restrictions.md, or the confirmed vision
+- [ ] No contradictions with problem.md or restrictions.md
 - [ ] Technology choices are justified
 - [ ] Blackbox test findings are reflected in architecture decisions
 - [ ] Every term used in `architecture.md` that is project-specific appears in `glossary.md`
 **Save action**: Write `architecture.md` and `system-flows.md`
@@ -58,4 +58,4 @@ Do NOT create minimal epics with just a summary and short description. The epic
 8. **Create "Blackbox Tests" epic** — this epic will parent the blackbox test tasks created by the `/decompose` skill. It covers implementing the test scenarios defined in `tests/`.
-**Save action**: Epics created via the configured tracker MCP. Also saved locally in `epics.md` with ticket IDs. If tracker availability fails, follow `.cursor/rules/tracker.mdc`; only if the user explicitly chooses `tracker: local`, save locally only with pending tracker markers.
+**Save action**: Epics created via the configured tracker MCP. Also saved locally in `epics.md` with ticket IDs. If `tracker: local`, save locally only.
@@ -133,4 +133,4 @@ Link to architecture.md and relevant component spec.]
  - `component` — a normal per-component epic
  - `cross-cutting` — a shared concern that spans ≥2 components
  - `tests` — the blackbox-tests epic (always exactly one)
- Complexity points for child issues follow the project standard: 1, 2, 3, 5. Do not create issues above 5 points — split them.
+- Complexity points for child issues follow the project standard: 1, 2, 3, 5, 8. Do not create issues above 5 points — split them.
@@ -24,8 +24,6 @@ Phase details live in `phases/` — read the relevant file before executing each
 - **Save immediately**: write artifacts to disk after each phase
 - **Delegate execution**: all code changes go through the implement skill via task files
 - **Ask, don't assume**: when scope or priorities are unclear, STOP and ask the user
 - **Exact-fit recommendations**: do not recommend a replacement pattern, library, service, architecture, algorithm, or "modern approach" merely because it improves structure or solves a similar class of problem. It must fit confirmed product constraints, acceptance criteria, operating context, integration boundaries, and current code realities. Otherwise reject it, mark it experimental, or ask the user before adding it to the roadmap.
 - **Per-mode API capability verification on replacements**: when a refactor proposes replacing or adding a library/SDK/framework/service that exposes multiple modes or configurations, pin the exact mode the refactored code will use (inputs, outputs, runtime) and verify *that mode* via mandatory `context7` lookup plus a saved Minimum Viable Example before promoting the recommendation to `Selected`. Capability claims at the category level ("supports A, B, C modes") must be cross-checked against the literal mode enumeration — `A, B → A+B` style conflations are the recurring silent-failure path.
 ## Context Resolution
@@ -59,7 +57,7 @@ Create REFACTOR_DIR and RUN_DIR if missing. If a RUN_DIR with the same name alre
 Both modes produce `RUN_DIR/list-of-changes.md` (template: `templates/list-of-changes.md`). Both modes then convert that file into task files in TASKS_DIR during Phase 2.
-**Guided mode cleanup**: after `RUN_DIR/list-of-changes.md` is created from the input file, delete the original input file only if it lives outside `RUN_DIR`. If the provided file is already the canonical `RUN_DIR/list-of-changes.md`, keep it as the audit record.
+**Guided mode cleanup**: after `RUN_DIR/list-of-changes.md` is created from the input file, delete the original input file to avoid duplication.
 ## Workflow
@@ -81,10 +79,10 @@ Both modes produce `RUN_DIR/list-of-changes.md` (template: `templates/list-of-ch
 - "refactor [specific target]" → skip phase 1 if docs exist
 - Default → all phases
-**Testability-run specifics** (guided mode invoked by autodev existing-code Step 4 or greenfield Step 8):
+**Testability-run specifics** (guided mode invoked by autodev existing-code flow Step 4):
 - Run name is `01-testability-refactoring`.
 - Phase 3 (Safety Net) is skipped by design — no tests exist yet. Compensating control: the `list-of-changes.md` gate in Phase 1 must be reviewed and approved by the user before Phase 4 runs.
- Scope is MINIMAL and surgical; reject change entries that drift into full refactor territory (see the invoking flow's testability step for allowed/disallowed lists). Flagged entries go to `RUN_DIR/deferred_to_refactor.md` for the next optional full-refactor step or backlog consideration.
+- Scope is MINIMAL and surgical; reject change entries that drift into full refactor territory (see existing-code flow Step 4 for allowed/disallowed lists). Flagged entries go to `RUN_DIR/deferred_to_refactor.md` for Step 8 (optional full refactor) consideration.
 - After Phase 4 (Execution) completes, write `RUN_DIR/testability_changes_summary.md` as Phase 4.5. Format: one bullet per applied change.
  ```markdown
  # Testability Changes Summary ({{run_name}})
@@ -95,7 +95,7 @@ Also copy to project standard locations:
 **Critical step — do not skip.** Before producing the change list, cross-reference documented business flows against actual implementation. This catches issues that static code inspection alone misses.
-1. **Read documented flows**: Load `DOCUMENT_DIR/system-flows.md`, `DOCUMENT_DIR/architecture.md` (paying special attention to its `## Architecture Vision` section — that's the user-confirmed structural intent), `DOCUMENT_DIR/glossary.md`, `DOCUMENT_DIR/module-layout.md`, every file under `DOCUMENT_DIR/contracts/`, and `SOLUTION_DIR/solution.md` (whichever exist). Extract every documented business flow, data path, architectural decision, module ownership boundary, and contract shape. Any refactor change that contradicts a confirmed Architecture Vision principle must either be rejected or surfaced to the user before being added to `list-of-changes.md` — those principles are not refactor targets without explicit user approval.
+1. **Read documented flows**: Load `DOCUMENT_DIR/system-flows.md`, `DOCUMENT_DIR/architecture.md`, `DOCUMENT_DIR/module-layout.md`, every file under `DOCUMENT_DIR/contracts/`, and `SOLUTION_DIR/solution.md` (whichever exist). Extract every documented business flow, data path, architectural decision, module ownership boundary, and contract shape.
 2. **Trace each flow through code**: For every documented flow (e.g., "video batch processing", "image tiling", "engine initialization"), walk the actual code path line by line. At each decision point ask:
   - Does the code match the documented/intended behavior?
@@ -7,29 +7,14 @@
 ## 2a. Deep Research
 1. Analyze current implementation patterns
-2. Extract the **Project Constraint Matrix** from `problem.md`, `restrictions.md`, `acceptance_criteria.md`, current architecture/docs, and actual code constraints. Include required inputs/outputs, operating context, lifecycle assumptions, integration boundaries, non-functional targets, and hard disqualifiers.
+2. Research modern approaches for similar systems
-3. Research modern approaches for similar systems
+3. Identify what could be done differently
-4. For each alternative pattern/library/service/architecture/algorithm, research intrinsic implementation constraints: required inputs/outputs, runtime assumptions, supported deployment modes, resource needs, operational limits, licensing/security constraints, and known failure reports.
+4. Suggest improvements based on state-of-the-art practices
   **API Capability Verification — Per-Mode (MANDATORY, BLOCKING for proposed replacements)**
   When a refactor recommendation replaces (or adds) a library/SDK/framework/service, the same per-mode verification used by `/research` Step 2 applies — selecting a replacement on category fit alone is the same silent-failure path. For every replacement candidate that has multiple modes or configurations:
   1. **Pin the exact mode/configuration** the refactored code will use, in one explicit sentence. Inputs (data shapes, sensor counts, payloads, rates), outputs (per `acceptance_criteria.md` and contract files), runtime (matching the project's deployment).
   2. **Run `context7` (or equivalent docs lookup)** for the candidate. **Mandatory for every replacement library/SDK/framework candidate**, not optional. Minimum three queries per candidate: mode enumeration, project's exact mode (with input/output shapes), disqualifier probe ("does this mode produce the required output? are there published limitations on this runtime?"). Append URLs to `RUN_DIR/analysis/research_findings.md` references section.
   3. **Save a Minimum Viable Example (MVE)** for the pinned mode under `RUN_DIR/analysis/mve_evidence.md` with: source, inputs in example, outputs in example, project inputs, project outputs required, match assessment ✅/⚠️/❌. If no official example covers the project's exact configuration, the recommendation cannot be `Selected` based on category fit alone — it must be `Experimental only` (with required-evidence note) or `Rejected`.
   4. **Treat "the same library in a different mode" as a different recommendation.** If the project's pinned mode is `<X>` but the only documented evidence covers `<Y>`, do not silently soften the description. Open a separate recommendation row, with its own MVE, fit assessment, and disqualifiers.
   5. **Common silent-failure pattern**: a fact summary paraphrases docs as "supports A, B, C, D modes" when the docs actually mean "supports A; B; C and D as separate orthogonal modes" — no `A+B` combination exists. Cross-check paraphrased capability claims against the literal mode enumeration.
 5. Identify what could be done differently
 6. Suggest improvements only when they fit the Project Constraint Matrix. A cleaner or more modern approach that violates product constraints must be marked `Rejected` or `Experimental only`, not added as a roadmap recommendation.
 Write `RUN_DIR/analysis/research_findings.md`:
 - Current state analysis: patterns used, strengths, weaknesses
 - Alternative approaches per component: current vs alternative, pros/cons, migration effort
 - Prioritized recommendations: quick wins + strategic improvements
 - Constraint-fit table: recommendation, **pinned mode/config**, constraints checked, **API capability evidence (MVE link)**, evidence, mismatches/disqualifiers, status (`Selected` / `Rejected` / `Experimental only` / `Needs user decision`)
 - For every recommendation that replaces or adds a library/SDK/framework, append a **Restrictions × Candidate-Mode sub-matrix** that walks every numbered line of `restrictions.md` and `acceptance_criteria.md` against the candidate's pinned mode, marking each cell ✅ Pass / ❌ Fail / ❓ Verify / N/A with cited evidence. A recommendation cannot be `Selected` while any cell is ❌ or ❓.
 ## 2b. Solution Assessment & Hardening Tracks
@@ -37,7 +22,6 @@ Write `RUN_DIR/analysis/research_findings.md`:
 2. Identify weak points in codebase, map to specific code areas
 3. Perform gap analysis: acceptance criteria vs current state
 4. Prioritize changes by impact and effort
 5. Reject or escalate any proposed refactor that improves code structure while weakening required behavior, integration contracts, runtime constraints, safety/security posture, or acceptance criteria
 Present optional hardening tracks for user to include in the roadmap:
@@ -63,9 +47,6 @@ Write `RUN_DIR/analysis/refactoring_roadmap.md`:
 - Gap analysis: what's missing, what needs improvement
 - Phased roadmap: Phase 1 (critical fixes), Phase 2 (major improvements), Phase 3 (enhancements)
 - Selected hardening tracks and their items
 - Applicability gate: each roadmap item must state constraint fit, mismatches, required evidence, and status (`Selected` / `Rejected` / `Experimental only` / `Needs user decision`)
 **BLOCKING applicability gate**: Before 2c and 2d, every recommendation in the roadmap must be `Selected`. Items marked `Rejected` are excluded. Items marked `Experimental only` or `Needs user decision` require a user decision before task creation.
 ## 2c. Create Epic
@@ -74,7 +55,7 @@ Create a work item tracker epic for this refactoring run:
 1. Epic name: the RUN_DIR name (e.g., `01-testability-refactoring`)
 2. Create the epic via configured tracker MCP
 3. Record the Epic ID — all tasks in 2d will be linked under this epic
-4. If tracker is unavailable, follow `.cursor/rules/tracker.mdc`; only use `PENDING` placeholders if the user explicitly chooses `tracker: local`
+4. If tracker unavailable, use `PENDING` placeholder and note for later
 ## 2d. Task Decomposition
@@ -98,12 +79,6 @@ Convert the finalized `RUN_DIR/list-of-changes.md` into implementable task files
 **Self-verification**:
 - [ ] All acceptance criteria are addressed in gap analysis
 - [ ] Recommendations are grounded in actual code, not abstract
 - [ ] Every recommendation has been checked against the Project Constraint Matrix
 - [ ] No recommendation violates product restrictions, acceptance criteria, documented architecture decisions, or actual code integration boundaries
 - [ ] Every replacement library/SDK/framework recommendation has a pinned mode/config, a saved MVE in `mve_evidence.md`, and a Restrictions × Candidate-Mode sub-matrix with no ❌ or ❓ cells
 - [ ] `context7` (or equivalent) was consulted for every replacement library/SDK/framework recommendation
 - [ ] Paraphrased capability claims have been cross-checked against the literal mode-enumeration evidence (no `A, B → A+B` style conflation)
 - [ ] Rejected and experimental approaches are documented but not converted into implementation tasks without user approval
 - [ ] Roadmap phases are prioritized by impact
 - [ ] Epic created and all tasks linked to it
 - [ ] Every entry in list-of-changes.md has a corresponding task file in TASKS_DIR
@@ -10,7 +10,7 @@
   - All `[TRACKER-ID]_refactor_*.md` files are present
   - Each task file has valid header fields (Task, Name, Description, Complexity, Dependencies)
 2. Verify `TASKS_DIR/_dependencies_table.md` includes the refactoring tasks
-3. Verify all tests pass (safety net from Phase 3 is green), unless this is a testability run where Phase 3 was intentionally skipped
+3. Verify all tests pass (safety net from Phase 3 is green)
 4. If any check fails, go back to the relevant phase to fix
 ## 4b. Delegate to Implement Skill
@@ -21,9 +21,9 @@ The implement skill will:
 1. Parse task files and dependency graph from TASKS_DIR
 2. Detect already-completed tasks (skip non-refactoring tasks from prior workflow steps)
 3. Compute execution batches for the refactoring tasks
-4. Implement tasks sequentially in topological order (no subagents, no parallelism)
+4. Launch implementer subagents (up to 4 in parallel)
 5. Run code review after each batch
-6. Commit per batch and push only when the user approved pushing
+6. Commit and push per batch
 7. Update work item ticket status
 Do NOT modify, skip, or abbreviate any part of the implement skill's workflow. The refactor skill is delegating execution, not optimizing it.
@@ -47,7 +47,7 @@ After the implement skill completes:
 For each successfully completed refactoring task:
 1. Transition the work item ticket status to **Done** via the configured tracker MCP
-2. If tracker is unavailable, follow `.cursor/rules/tracker.mdc`; if the user explicitly chose `tracker: local`, note the pending status transitions in `RUN_DIR/execution_log.md`
+2. If tracker unavailable, note the pending status transitions in `RUN_DIR/execution_log.md`
 For any failed or blocked tasks, leave their status as-is (the implement skill already set them to In Testing or blocked).
@@ -32,7 +32,7 @@ For each component doc affected:
 ## 7d. Update System-Level Documentation
 If structural changes were made (new modules, removed modules, changed interfaces):
-1. Update `_docs/02_document/architecture.md` if architecture changed — but **never edit the `## Architecture Vision` section**. That section is user-confirmed (plan Phase 2a.0 / document Step 4.5); if a refactor invalidates a vision principle, surface it to the user and let them update the vision themselves before continuing. Update only the technical sections below the Vision H2.
+1. Update `_docs/02_document/architecture.md` if architecture changed
 2. Update `_docs/02_document/system-flows.md` if flow sequences changed
 3. Update `_docs/02_document/diagrams/components.md` if component relationships changed
@@ -23,7 +23,6 @@ Save as `RUN_DIR/list-of-changes.md`. Produced during Phase 1 (Discovery).
 - **Problem**: [what makes this problematic / untestable / coupled]
 - **Change**: [what to do — behavioral description, not implementation steps]
 - **Rationale**: [why this change is needed]
 - **Constraint Fit**: [which product constraints / acceptance criteria / integration boundaries this preserves; or "Rejected — violates ..."]
 - **Risk**: [low | medium | high]
 - **Dependencies**: [other change IDs this depends on, or "None"]
@@ -32,7 +31,6 @@ Save as `RUN_DIR/list-of-changes.md`. Produced during Phase 1 (Discovery).
 - **Problem**: [description]
 - **Change**: [description]
 - **Rationale**: [description]
 - **Constraint Fit**: [description]
 - **Risk**: [low | medium | high]
 - **Dependencies**: [C01, or "None"]
 ```
@@ -46,8 +44,6 @@ Save as `RUN_DIR/list-of-changes.md`. Produced during Phase 1 (Discovery).
 - **File(s)** must reference actual files verified to exist in the codebase
 - **Problem** describes the current state, not the desired state
 - **Change** describes what the system should do differently — behavioral, not prescriptive
 - **Constraint Fit** proves the change preserves confirmed product requirements, restrictions, acceptance criteria, architecture decisions, and integration contracts
 - Do not include changes whose only benefit is structural cleanliness if they weaken required behavior or violate constraints; record those as rejected in analysis instead
 - **Dependencies** reference other change IDs within this list; cross-run dependencies use tracker IDs
 - In guided mode, the input file entries are validated against actual code and enriched with file paths, risk, and dependencies before writing
 - In automatic mode, entries are derived from Phase 1 component analysis and Phase 2 research findings
@@ -30,27 +30,6 @@ Transform vague topics raised by users into high-quality, deliverable research r
 - **Internet-first investigation** — do not rely on training data for factual claims; search the web extensively for every sub-question, rephrase queries when results are thin, and keep searching until you have converging evidence from multiple independent sources
 - **Multi-perspective analysis** — examine every problem from at least 3 different viewpoints (e.g., end-user, implementer, business decision-maker, contrarian, domain expert, field practitioner); each perspective should generate its own search queries
 - **Question multiplication** — for each sub-question, generate multiple reformulated search queries (synonyms, related terms, negations, "what can go wrong" variants, practitioner-focused variants) to maximize coverage and uncover blind spots
 - **Component option breadth** — for every component area, build a broad option landscape before selecting. Search direct candidates, adjacent-domain alternatives, commercial/open-source variants, classical/simple baselines, current SOTA, and "do not use" failure cases. A component may not be narrowed to one candidate until alternatives have been searched and rejected with evidence.
 - **Component research depth** — for every serious component candidate, go beyond discovery pages. Read official docs, repository/license files, issue discussions, benchmarks, deployment guides, version/platform requirements, security notes, maintenance signals, and real-world failure reports. Extract evidence for inputs/outputs, lifecycle assumptions, runtime/storage/latency fit, integration boundaries, licensing, operational risks, and unsupported scenarios before assigning any selection status.
 - **Exact-fit component selection** — never select a component, tool, library, service, architecture pattern, or algorithm merely because it solves a similar class of problem. It must be proven compatible with the project's explicit operating context, constraints, required inputs/outputs, non-functional requirements, lifecycle assumptions, and acceptance criteria. If fit is unproven or mismatched, mark it `Rejected`, `Experimental only`, or escalate for user decision before it can shape the solution.
 - **Per-mode API capability verification** *(applies only to technical-component selection — see Research Output Class below)* — when a candidate library/SDK/framework/service exposes multiple modes or configurations, *the candidate is not a single thing*. Pin the exact mode the project will use (one explicit sentence: inputs, outputs, runtime), and verify *that mode* against the project's required inputs/outputs via official docs (mandatory `context7` lookup) plus a saved Minimum Viable Example. Capability claims at the category level ("supports X, Y, Z modes") must be cross-checked against the literal mode enumeration before being treated as project-applicable. Two modes of one library are two distinct candidates for the purposes of the Component Applicability Gate. Does not apply to non-technical research (concept comparison, market/policy investigation, knowledge organization, etc.).
 ## Research Output Class (BLOCKING — set in Step 1)
 Before applying any of the technical-component gates (per-mode API capability verification, Component Applicability Gate, Restrictions × Candidate-Mode sub-matrix, MVE evidence, mandatory `context7` lookup), classify the research output into one of two classes. Record the decision in `00_question_decomposition.md` once, near the top, so every downstream step honors it.
 | Class | What the output recommends or selects | Examples | Technical-component gates apply? |
 |-------|---------------------------------------|----------|----------------------------------|
 | **Technical-component selection** | One or more libraries, SDKs, frameworks, services, protocols, data formats, infrastructure patterns, algorithms, or APIs that will be implemented or operated against | "Pick a vector database", "Compare auth-token strategies for our API", "Should we use Kafka or RabbitMQ?", architecture / tech-stack / migration drafts (Mode A, Mode B) | **Yes — all gates active** |
 | **Non-technical investigation** | Concept comparisons, knowledge organization, root-cause investigation of an event, market/policy/regulatory/social analysis, literature review, decision support without committing to specific tooling | "Why did adoption stall in Q3?", "Compare phenomenology vs constructivism", "Map regulatory landscape for X", "What do practitioners say about onboarding under remote-first orgs?" | **No — skip API/MVE/sub-matrix gates; the rest of the 8-step engine still applies** |
 How to decide:
 1. Inspect the question and the input files (`problem.md`, `restrictions.md`, `acceptance_criteria.md`, or the standalone input file).
 2. If the deliverable will name specific software/services/protocols that someone will then build with or operate, it is **Technical-component selection**.
 3. If the deliverable is a report, comparison, or recommendation that does not commit to specific tooling, it is **Non-technical investigation**.
 4. **Mixed runs are valid.** Some research questions have a non-technical core but include one technical sub-question (or vice versa). In that case classify per component area within the run, not the run as a whole, and note in `00_question_decomposition.md` which component areas trigger the technical-component gates.
 When the run is purely **Non-technical investigation**, the rest of the research engine — question decomposition, perspective rotation, exhaustive web search, fact extraction, comparison framework, reasoning chain, validation, deliverable formatting — still applies in full. The sections that get skipped are explicitly the technical gates listed in the table above.
 ## Context Resolution
@@ -27,26 +27,13 @@
 - [ ] Iterative deepening completed: follow-up questions from initial findings were searched
 - [ ] No sub-question relies solely on training data without web verification
 ## Component Option Breadth
 - [ ] `00_question_decomposition.md` contains a Component Option Search Plan
 - [ ] Every component area was searched across simple baseline, established production, open-source, commercial/vendor, current SOTA, adjacent-domain, no-build/defer, and known-bad options where applicable
 - [ ] Every component area has at least 3 realistic candidates, or a documented explanation of why broad searches found fewer
 - [ ] Each lead candidate has official/source-of-truth evidence plus independent validation when available
 - [ ] Each component area includes at least one baseline/fallback option and at least one rejected or experimental option when possible
 - [ ] Alternative names, synonyms, and neighboring-domain terms were searched before declaring the option landscape complete
 - [ ] Licensing, runtime, platform, maintenance, and unsupported-scenario searches were performed for every lead, fallback, and rejected candidate
 ## Mode A Specific
 - [ ] Phase 1 completed: AC assessment was presented to and confirmed by user
 - [ ] AC assessment consistent: Solution draft respects the (possibly adjusted) acceptance criteria and restrictions
 - [ ] Competitor analysis included: Existing solutions were researched
 - [ ] All components have comparison tables: Each component lists alternatives with tools, advantages, limitations, security, cost
 - [ ] Component options are broad: component tables include baseline, production, open-source, commercial/vendor, SOTA/research, adjacent-domain, defer/no-build, and disqualified options where applicable
 - [ ] Tools/libraries verified: Suggested tools actually exist and work as described
 - [ ] Component fit matrix completed: `06_component_fit_matrix.md` exists and every selected component/tool/pattern is marked `Selected`
 - [ ] No field-adjacent substitution: no selected candidate is chosen only because it solves a similar class of problem while failing the project's explicit constraints
 - [ ] Testing strategy covers AC: Tests map to acceptance criteria
 - [ ] Tech stack documented (if Phase 3 ran): `tech_stack.md` has evaluation tables, risk assessment, and learning requirements
 - [ ] Security analysis documented (if Phase 4 ran): `security_analysis.md` has threat model and per-component controls
@@ -58,9 +45,6 @@
 - [ ] New draft is self-contained: Written as if from scratch, no "updated" markers
 - [ ] Performance column included: Mode B comparison tables include performance characteristics
 - [ ] Previous draft issues addressed: Every finding in the table is resolved in the new draft
 - [ ] Existing selected components were challenged against a broad alternative landscape before being kept
 - [ ] Existing component fit audited: every old and new component/tool/pattern was checked against `restrictions.md`, `acceptance_criteria.md`, and the Project Constraint Matrix
 - [ ] Rejected/experimental candidates are not lead recommendations unless the user explicitly accepted the risk
 ## Timeliness Check (High-Sensitivity Domain BLOCKING)
@@ -92,33 +76,3 @@ When the research topic has Critical or High sensitivity level:
 - [ ] Cited facts have corresponding statements in the original text (no over-interpretation)
 - [ ] Source publication/update dates annotated; technical docs include version numbers
 - [ ] Unverifiable information annotated `[limited source]` and not sole support for core conclusions
 ## Exact-Fit Validation (BLOCKING)
 - [ ] Project Constraint Matrix extracted from problem context before component selection
 - [ ] Component fit matrix includes `Component Area`, `Option Family`, and `Pinned Mode/Config` columns
 - [ ] Every selected component/tool/library/service/pattern/algorithm has evidence for required inputs/outputs and integration boundaries
 - [ ] Every selected candidate has evidence for the operating context and lifecycle assumptions it must support
 - [ ] Every selected candidate has evidence for non-functional targets that are binding for the project
 - [ ] Known unsupported scenarios and failure reports were searched for every selected candidate
 - [ ] Mismatches are recorded as disqualifiers, not softened into generic limitations
 - [ ] Any candidate with unproven fit is marked `Experimental only` or escalated for user decision
 - [ ] Any candidate with documented constraint conflict is marked `Rejected`
 ## API Capability Verification (BLOCKING)
 **Applicability**: this checklist applies only when the run is classified as **Technical-component selection** (see SKILL.md → Research Output Class). For non-technical research (concept comparison, market/policy investigation, root-cause analysis, knowledge organization), skip this checklist entirely and note the skip in `05_validation_log.md`. For mixed runs, apply only to technical component areas.
 For every lead candidate that is a library/SDK/framework/service:
 - [ ] The exact mode/configuration the project will use is pinned in one explicit sentence (inputs, outputs, runtime); no vague "supports X" language
 - [ ] `context7` (or equivalent docs lookup) was run for the candidate, with at least 3 queries: mode enumeration, project's exact mode, disqualifier probe
 - [ ] All consulted URLs from context7 / official docs are appended to `01_source_registry.md`
 - [ ] A Minimum Viable Example (MVE) was saved for the pinned mode in `02_fact_cards.md` (or `02_mve_evidence.md`) with: source, inputs in example, outputs in example, project inputs, project outputs required, match assessment ✅/⚠️/❌
 - [ ] When the MVE inputs or outputs do not exactly match the project's, the mismatch is cited from the official docs (not inferred), and the candidate is `Experimental only` or `Rejected`
 - [ ] When a library has multiple modes, each project-relevant mode appears as its own candidate row (not a single library row that softens across modes)
 - [ ] Restrictions × Candidate-Modes sub-matrix in `06_component_fit_matrix.md` is filled for every lead candidate, with one row per numbered restriction and per numbered acceptance criterion
 - [ ] Sub-matrix uses ✅ / ❌ / ❓ / N/A only — no free-form prose substitutes
 - [ ] No `Selected` candidate has any ❌ or ❓ cell in its sub-matrix
 - [ ] "Validation gate required" footnotes are explicitly classified as either *API capability* (must be resolved here) or *runtime quality* (may be carried forward)
 - [ ] Paraphrased capability claims in fact cards have been cross-checked against the literal mode-enumeration evidence (no `mono, inertial → mono-inertial` style conflation)
@@ -57,7 +57,6 @@ RESEARCH_DIR/
 ├── 03_comparison_framework.md     # Step 4 output: selected framework and populated data
 ├── 04_reasoning_chain.md          # Step 6 output: fact → conclusion reasoning
 ├── 05_validation_log.md           # Step 7 output: use-case validation results
 ├── 06_component_fit_matrix.md     # Step 7.5 output: component exact-fit gate
 └── raw/                           # Raw source archive (optional)
    ├── source_1.md
    └── source_2.md
@@ -74,7 +73,6 @@ RESEARCH_DIR/
 | Step 4 | Selected comparison framework + initial population | `03_comparison_framework.md` |
 | Step 6 | Reasoning process for each dimension | `04_reasoning_chain.md` |
 | Step 7 | Validation scenarios + results + review checklist | `05_validation_log.md` |
 | Step 7.5 | Component exact-fit gate and selection status | `06_component_fit_matrix.md` |
 | Step 8 | Complete solution draft | `OUTPUT_DIR/solution_draft##.md` |
 ### Save Principles
@@ -97,7 +95,6 @@ RESEARCH_DIR/
 | `03_comparison_framework.md` | Selected framework and populated data | After Step 4 completion |
 | `04_reasoning_chain.md` | Fact → conclusion reasoning | After Step 6 completion |
 | `05_validation_log.md` | Use-case validation and review | After Step 7 completion |
 | `06_component_fit_matrix.md` | Exact-fit matrix for every proposed component/tool/pattern with status `Selected` / `Rejected` / `Experimental only` / `Needs user decision` | Before Step 8 deliverable formatting |
 | `OUTPUT_DIR/solution_draft##.md` | Complete solution draft | After Step 8 completion |
 | `OUTPUT_DIR/tech_stack.md` | Tech stack evaluation and decisions | After Phase 3 (optional) |
 | `OUTPUT_DIR/security_analysis.md` | Threat model and security controls | After Phase 4 (optional) |
@@ -73,18 +73,16 @@ Full 8-step research methodology. Produces the first solution draft.
 **Task** (drives the 8-step engine):
 1. Research existing/competitor solutions for similar problems — search broadly across industries and adjacent domains, not just the obvious competitors
 2. Research the problem thoroughly — all possible ways to solve it, split into components; search for how different fields approach analogous problems
-3. Derive a **Project Constraint Matrix** before evaluating component options. Extract exact constraints from `problem.md`, `restrictions.md`, `acceptance_criteria.md`, input data notes, and the Phase 1 AC assessment. Include required inputs/outputs, operating context, runtime envelope, data availability, lifecycle boundaries, non-functional targets, integration boundaries, security constraints, and explicit out-of-scope decisions.
+3. For each component, research all possible solutions and find the most efficient state-of-the-art approaches — use multiple query variants and perspectives from Step 1
-4. For each component, research all possible solutions and find the most efficient state-of-the-art approaches — use multiple query variants and perspectives from Step 1
+4. For each promising approach, search for real-world deployment experience: success stories, failure reports, lessons learned, and practitioner opinions
-5. For each promising approach, search for real-world deployment experience: success stories, failure reports, lessons learned, and practitioner opinions
+5. Search for contrarian viewpoints — who argues against the common approaches and why? What failure modes exist?
-6. Search for contrarian viewpoints — who argues against the common approaches and why? What failure modes exist?
+6. Verify that suggested tools/libraries actually exist and work as described — check official repos, latest releases, and community health (stars, recent commits, open issues)
-7. Verify that suggested tools/libraries actually exist and work as described — check official repos, latest releases, and community health (stars, recent commits, open issues)
+7. Include security considerations in each component analysis
-8. For every candidate component/tool/library/service/pattern/algorithm, prove exact fit against the Project Constraint Matrix. A field-adjacent solution is not selectable unless its documented implementation assumptions match the project's constraints. Mismatches must be recorded as disqualifiers and the candidate marked `Rejected`, `Experimental only`, or `Needs user decision`.
+8. Provide rough cost estimates for proposed solutions
 9. Include security considerations in each component analysis
 10. Provide rough cost estimates for proposed solutions
 Be concise in formulating. The fewer words, the better, but do not miss any important details.
-**Save action**: Write `RESEARCH_DIR/06_component_fit_matrix.md` before the final draft, then write `OUTPUT_DIR/solution_draft##.md` using template: `templates/solution_draft_mode_a.md`
+**Save action**: Write `OUTPUT_DIR/solution_draft##.md` using template: `templates/solution_draft_mode_a.md`
 ---
@@ -10,25 +10,18 @@ Full 8-step research methodology applied to assessing and improving an existing
 **Task** (drives the 8-step engine):
 1. Read the existing solution draft thoroughly
-2. Derive or refresh the **Project Constraint Matrix** from all files in INPUT_DIR. Include required inputs/outputs, operating context, runtime envelope, data availability, lifecycle boundaries, non-functional targets, integration boundaries, security constraints, and explicit out-of-scope decisions.
+2. Research in internet extensively — for each component/decision in the draft, search for:
 3. Audit every component/decision in the existing draft against the Project Constraint Matrix before researching alternatives:
   - If a component's documented implementation assumptions match the project constraints, keep it eligible and record evidence.
   - If fit is unproven, mark it `Experimental only` until evidence is found.
   - If constraints conflict, mark it `Rejected` and search for alternatives.
   - If rejecting it changes product behavior or risk materially, escalate for user decision.
 4. Research in internet extensively — for each component/decision in the draft, search for:
   - Known problems and limitations of the chosen approach
   - What practitioners say about using it in production
   - Better alternatives that may have emerged recently
   - Common failure modes and edge cases
   - How competitors/similar projects solve the same problem differently
-5. Search specifically for contrarian views: "why not [chosen approach]", "[chosen approach] criticism", "[chosen approach] failure"
+3. Search specifically for contrarian views: "why not [chosen approach]", "[chosen approach] criticism", "[chosen approach] failure"
-6. Identify security weak points and vulnerabilities — search for CVEs, security advisories, and known attack vectors for each technology in the draft
+4. Identify security weak points and vulnerabilities — search for CVEs, security advisories, and known attack vectors for each technology in the draft
-7. Identify performance bottlenecks — search for benchmarks, load test results, and scalability reports
+5. Identify performance bottlenecks — search for benchmarks, load test results, and scalability reports
-8. For each identified weak point, search for multiple solution approaches and compare them
+6. For each identified weak point, search for multiple solution approaches and compare them
-9. For every revised candidate, prove exact fit against the Project Constraint Matrix. Do not select field-adjacent or "similar problem" options unless their intrinsic implementation constraints match the project.
+7. Based on findings, form a new solution draft in the same format
 10. Based on findings, form a new solution draft in the same format
-**Save action**: Write `RESEARCH_DIR/06_component_fit_matrix.md` before the final draft, then write `OUTPUT_DIR/solution_draft##.md` (incremented) using template: `templates/solution_draft_mode_b.md`
+**Save action**: Write `OUTPUT_DIR/solution_draft##.md` (incremented) using template: `templates/solution_draft_mode_b.md`
 **Optional follow-up**: After Mode B completes, the user can request Phase 3 (Tech Stack Consolidation) or Phase 4 (Security Deep Dive) using the revised draft. These phases work identically to their Mode A descriptions in `steps/01_mode-a-initial-research.md`.
@@ -40,7 +40,6 @@ Key principle: Critical-sensitivity topics (AI/LLMs, blockchain) require sources
 - "What existing/competitor solutions address this problem?"
 - "What are the component parts of this problem?"
 - "For each component, what are the state-of-the-art solutions?"
 - "For each component, what are the practical alternatives across simple baseline, established production option, open-source option, commercial option, current SOTA, adjacent-domain option, and no-build/defer option?"
 - "What are the security considerations per component?"
 - "What are the cost implications of each approach?"
@@ -49,7 +48,6 @@ Key principle: Critical-sensitivity topics (AI/LLMs, blockchain) require sources
 - "What are the security vulnerabilities in the proposed architecture?"
 - "Where are the performance bottlenecks?"
 - "What solutions exist for each identified issue?"
 - "For each component already selected in the draft, what alternatives should be considered before keeping, replacing, or rejecting it?"
 **General sub-question patterns** (use when applicable):
 - **Sub-question A**: "What is X and how does it work?" (Definition & mechanism)
@@ -86,27 +84,6 @@ For **each sub-question**, generate **at least 3-5 search query variants** befor
 Record all planned queries in `00_question_decomposition.md` alongside each sub-question.
 #### Component Option Breadth (MANDATORY)
 Before Step 2, identify the component areas implied by the problem and create a search plan for options in each area. A component area is any replaceable tool, library, model, service, algorithm, data format, protocol, infrastructure pattern, or validation approach that could materially affect the solution.
 For every component area, generate search queries for these option families unless clearly not applicable:
 - **Simple baseline**: low-complexity classical or manual approach that can serve as a fallback or regression baseline.
 - **Established production option**: mature library/service/pattern with field usage.
 - **Open-source candidate**: permissive-license option with inspectable implementation and community history.
 - **Commercial/vendor option**: paid or vendor-supported option, including SDK/platform constraints.
 - **Current SOTA / research option**: recent model, paper, or benchmark leader that may be promising but immature.
 - **Adjacent-domain option**: solution from a neighboring domain with similar constraints.
 - **No-build / defer option**: whether the component can be avoided, simplified, or moved out of scope.
 - **Known bad option**: candidate or family that appears attractive but has documented failure modes or disqualifiers.
 For each component area, record:
 - Candidate names and option families to search.
 - At least 5 query variants covering alternatives, comparisons, limitations, licensing, runtime/scale, and exact project constraints.
 - The minimum evidence needed to mark a candidate `Selected`, `Rejected`, `Experimental only`, or `Needs user decision`.
 Add this as a "Component Option Search Plan" section in `00_question_decomposition.md`.
 **Research Subject Boundary Definition (BLOCKING - must be explicit)**:
 When decomposing questions, you must explicitly define the **boundaries of the research subject**:
@@ -117,9 +94,6 @@ When decomposing questions, you must explicitly define the **boundaries of the r
 | **Geography** | Which region is being studied? | Chinese universities vs US universities vs global |
 | **Timeframe** | Which period is being studied? | Post-2020 vs full historical picture |
 | **Level** | Which level is being studied? | Undergraduate vs graduate vs vocational |
 | **Operating context** | What exact environment, lifecycle phase, and runtime conditions must the solution support? | In-flight embedded runtime vs offline post-processing; production web traffic vs admin batch job |
 | **Required interfaces** | What inputs, outputs, protocols, data shapes, and ownership boundaries are fixed? | One camera vs stereo rig; REST API vs message queue; local file boundary vs service API |
 | **Non-functional envelope** | What latency, throughput, storage, memory, availability, safety, security, cost, and maintainability targets are binding? | <400 ms p95, 8 GB RAM, 99.9% availability, reversible migrations |
 **Common mistake**: User asks about "university classroom issues" but sources include policies targeting "K-12 students" — mismatched target populations will invalidate the entire research.
@@ -142,11 +116,9 @@ Record the audit result in `00_question_decomposition.md` as a "Completeness Aud
   - Summary of relevant problem context from INPUT_DIR
   - Classified question type and rationale
   - **Research subject boundary definition** (population, geography, timeframe, level)
   - **Project Constraint Matrix summary** (operating context, required interfaces, non-functional envelope, lifecycle assumptions, and hard disqualifiers extracted from input files)
   - List of decomposed sub-questions
   - **Chosen perspectives** (at least 3 from the Perspective Rotation table) with rationale
   - **Search query variants** for each sub-question (at least 3-5 per sub-question)
   - **Component Option Search Plan** (component areas, option families, candidate names, query variants, required evidence)
   - **Completeness audit** (taxonomy cross-reference + domain discovery results)
 4. Write TodoWrite to track progress
@@ -160,7 +132,7 @@ Tier sources by authority, **prioritize primary sources** (L1 > L2 > L3 > L4). C
 **Tool Usage**:
 - Use `WebSearch` for broad searches; `WebFetch` to read specific pages
- Use the `context7` MCP server (`resolve-library-id` then `query-docs` / `get-library-docs`) for up-to-date library/framework documentation. **Mandatory per lead candidate** — see "API Capability Verification" below.
+- Use the `context7` MCP server (`resolve-library-id` then `get-library-docs`) for up-to-date library/framework documentation
 - Always cross-verify training data claims against live sources for facts that may have changed (versions, APIs, deprecations, security advisories)
 - When citing web sources, include the URL and date accessed
@@ -173,72 +145,12 @@ Do not stop at the first few results. The goal is to build a comprehensive evide
 - Consult at least **2 different source tiers** per sub-question (e.g., L1 official docs + L4 community discussion)
 - If initial searches yield fewer than 3 relevant sources for a sub-question, **broaden the search** with alternative terms, related domains, or analogous problems
 **Minimum search effort per component area**:
 - Search every option family from the "Component Option Search Plan" before choosing a lead candidate.
 - For each lead, fallback, or rejected candidate, search at least one official/source-of-truth page and at least one independent validation source when available.
 - Search `"[component] alternatives"`, `"[candidate] vs [alternative]"`, `"[candidate] limitations"`, `"[candidate] license"`, `"[candidate] production"`, and `"[candidate] [binding project constraint]"`.
 - If fewer than 3 realistic candidates are found for a component area, explicitly document why the landscape is narrow and search adjacent domains before accepting that result.
 - Include at least one simple baseline and one "do not use" or disqualified candidate per component area when possible; these prevent false confidence in the selected option.
 **Candidate implementation-limit searches (MANDATORY)**:
 For every component/tool/library/service/pattern/algorithm that may be selected or recommended, search for its intrinsic implementation constraints. Do not rely on product category labels, marketing summaries, or examples from a different operating context. Include query variants for:
 - Official supported inputs/outputs, protocols, data formats, and deployment modes
 - Required hardware/runtime/platform/version constraints
 - Timing, throughput, memory, storage, synchronization, and scaling assumptions
 - Lifecycle assumptions: offline vs online, batch vs real time, development vs production, single tenant vs multi tenant, local vs networked
 - Known unsupported scenarios, limitations, issue reports, production failures, and workarounds
 - Licensing, security, maintenance, and community-health constraints
 - Exact phrases from the project's restrictions and acceptance criteria combined with the candidate name
 **API Capability Verification — Per-Mode (MANDATORY, BLOCKING for lead candidates)**:
 **Applicability**: this section applies only when the run is classified as **Technical-component selection** in the SKILL's Research Output Class section, and only to lead candidates that are libraries/SDKs/frameworks/services/protocols/data formats with multiple modes or configurations. For non-technical research (concept comparison, market/policy investigation, knowledge organization, root-cause analysis without tooling commitments), skip this entire sub-section and continue with the rest of Step 2 — the broader candidate implementation-limit search above is sufficient. State the skip explicitly once in `02_fact_cards.md`: `API Capability Verification: not applicable — this run is a Non-technical investigation, no library/SDK/service candidates`.
 Most libraries/SDKs/services expose **multiple modes or configurations** (e.g., monocular vs stereo VO, sync vs async API, batch vs streaming inference, write-through vs write-behind cache). Selecting a candidate "because it supports X" without pinning *which mode* the project will use, and *whether that exact mode produces the required outputs from the required inputs*, is the most common silent-failure path in research. A library can support a class of problem in mode A while being unusable for the project's specific configuration in mode B.
 For every lead candidate that is a library/SDK/framework/service with multiple modes or configurations, do the following — in this order, before marking the candidate `Selected`:
 1. **Pin the exact mode/configuration the project will use.**
   Derived from the Project Constraint Matrix: which inputs are available (sensor count, sensor types, data shapes, rates), which outputs are required (per `acceptance_criteria.md` and contract files), which hardware/runtime is fixed (per `restrictions.md`). Write this as a single sentence: "We will use `<library>` in `<mode/config>` with inputs `<list>` and expect outputs `<list>` on `<runtime>`." Do not progress past this step on a vague mode description.
 2. **Run `context7` (or equivalent docs lookup) for the candidate** — this is **mandatory for every lead library/SDK/framework candidate**, not optional. Minimum three queries per candidate:
   1. *Mode enumeration*: "What modes/configurations does `<library>` support? List every value of the mode/config enum and what each requires as input."
   2. *Project's exact mode*: "Show a minimum runnable example of `<library>` in `<the pinned mode>` with `<the project's input shape>`. What does it produce?"
   3. *Disqualifier probe*: "Does `<library>` `<the pinned mode>` produce `<the required output>`? Are there published limitations of `<the pinned mode>` for `<the project's runtime/hardware>`?"
   For services without context7 coverage, use official docs site + WebFetch on the API reference page + the project's example/tutorial directory in the source repo. Append every consulted URL to `01_source_registry.md`.
 3. **Save a Minimum Viable Example (MVE) for the pinned mode.**
   Append to `02_fact_cards.md` (or a sibling `02_mve_evidence.md`) at least one block per lead library candidate with:
   ```markdown
   ## MVE — <library> in <pinned mode>
   - **Source**: <official URL or context7 reference, with date>
   - **Inputs in the example**: <e.g., 2 calibrated cameras + IMU at 200 Hz>
   - **Outputs in the example**: <e.g., 6-DoF pose with covariance>
   - **Project inputs**: <e.g., 1 camera + IMU at 200 Hz>
   - **Project outputs required**: <e.g., 6-DoF pose with metric translation>
   - **Match assessment**: ✅ exact match / ⚠️ partial (specify dimension) / ❌ mismatch (specify dimension)
   - **If ⚠️ or ❌**: cite the official-docs sentence that establishes the mismatch.
   ```
   If no official example covers the project's exact configuration → the candidate cannot be marked `Selected` based on category fit alone. Status must be `Experimental only` (with required-evidence note) or `Rejected` (when the docs explicitly disqualify the configuration).
 4. **Bind every numbered Restriction and Acceptance Criterion to the candidate's pinned mode.**
   For each numbered line in `restrictions.md` and `acceptance_criteria.md`, decide one of: `Pass` (the pinned mode satisfies it with cited evidence), `Fail` (the pinned mode contradicts it with cited evidence), `Verify` (no evidence either way; deeper investigation required), `N/A` (the line is irrelevant to this component area). Record this in `02_fact_cards.md` under the candidate's MVE block. The structural matrix in Step 7.5 reads from these bindings.
 5. **Treat "the same library in a different mode" as a different candidate.**
   If the project's pinned mode is `Monocular` but the only documented evidence covers `Stereo`, do not silently soften "rotation only" into "rotation + translation". Open a separate candidate row for the Monocular mode, with its own MVE, fit assessment, and disqualifiers. Two modes of one library are two distinct candidates for the purposes of this gate.
 **Common silent-failure pattern this guards against**: a fact card paraphrases the docs as "supports A, B, C, D modes" when the docs actually mean "supports A; B; C and D as separate orthogonal modes". A category-level "Selected" decision then carries through every downstream artifact, masking that the project's required A+B combination does not exist as a single mode.
 **Search broadening strategies** (use when results are thin):
 - Try adjacent fields: if researching "drone indoor navigation", also search "robot indoor navigation", "warehouse AGV navigation"
 - Try different communities: academic papers, industry whitepapers, military/defense publications, hobbyist forums
 - Try different geographies: search in English + search for European/Asian approaches if relevant
 - Try historical evolution: "history of X", "evolution of X approaches", "X state of the art 2024 2025"
 - Try failure analysis: "X project failure", "X post-mortem", "X recall", "X incident report"
 - Try disqualifier probes: "X unsupported", "X limitations", "X requirements", "X with [project constraint]", "X without [required input]", "X real-time [target]", "X production failure"
 **Search saturation rule**: Continue searching until new queries stop producing substantially new information. If the last 3 searches only repeat previously found facts, the sub-question is saturated.
@@ -282,7 +194,6 @@ For each extracted fact, **immediately** append to `02_fact_cards.md`:
 - **Target Audience**: [which group this fact applies to, inherited from source or further refined]
 - **Confidence**: ✅/⚠️/❓
 - **Related Dimension**: [corresponding comparison dimension]
 - **Fit Impact**: [supports selection / disqualifies / makes experimental / needs user decision]
 ```
 **Target audience in fact statements**:
@@ -24,18 +24,6 @@ Write to `03_comparison_framework.md`:
 | ... | | | |
 ```
 **Required exact-fit dimensions for component/tool decisions**:
 When the output selects or recommends a component, tool, library, service, architecture pattern, or algorithm, the framework MUST include these dimensions unless explicitly not applicable:
 - Option family (`Simple baseline`, `Established production`, `Open-source`, `Commercial/vendor`, `Current SOTA`, `Adjacent-domain`, `No-build/defer`, `Known bad`)
 - Required inputs/outputs and ownership boundaries
 - Operating context and lifecycle fit
 - Non-functional envelope fit
 - Implementation assumptions and hard disqualifiers
 - Evidence quality and source tier
 - Selection status (`Selected`, `Rejected`, `Experimental only`, `Needs user decision`)
 For each component area, include multiple candidates in the initial population. Do not present only the preferred option unless the investigation found no realistic alternatives; if so, state the searches that proved the narrow landscape.
 ---
 ### Step 5: Reference Point Baseline Alignment
@@ -109,8 +97,6 @@ Validate conclusions against a typical scenario:
 - [ ] Are there any important dimensions missed?
 - [ ] Is there any over-extrapolation?
 - [ ] Are conclusions actionable/verifiable?
 - [ ] Does every selected component/tool/pattern match the Project Constraint Matrix?
 - [ ] Are mismatches marked as disqualifiers instead of hidden as generic "limitations"?
 **Save action**:
 Write to `05_validation_log.md`:
@@ -142,66 +128,6 @@ If using Y: [expected behavior]
 ---
 ### Step 7.5: Component Applicability Gate (BLOCKING)
 **Applicability**: this gate applies only when the run is classified as **Technical-component selection** in the SKILL's Research Output Class section. For non-technical research (concept comparison, market/policy investigation, root-cause analysis without tooling, knowledge organization), skip this entire step and proceed to Step 8 — there are no components to gate. State the skip once in `05_validation_log.md`: `Step 7.5 (Component Applicability Gate): not applicable — Non-technical investigation`. For mixed runs (some component areas technical, some not), apply this gate only to the technical component areas; the non-technical ones do not produce 7.5 rows.
 Before finalizing the solution draft, build an exact-fit matrix for every component/tool/library/service/pattern/algorithm that is selected, recommended, rejected, or treated as a fallback. Free-form prose in a "Project Constraints Checked" column is **not sufficient** — mismatches hide inside rationale text. The matrix must be structured per restriction and per acceptance criterion.
 #### 7.5.1 Top-level Component Fit Matrix
 ```markdown
 # Component Fit Matrix
 | Component Area | Candidate | Pinned Mode/Config | Option Family | Intended Role | API Capability Evidence | Mismatches / Disqualifiers | Status | Decision Rationale |
 |----------------|-----------|--------------------|---------------|---------------|-------------------------|----------------------------|--------|--------------------|
 | [area] | [name] | [exact mode/config the project will use, copied verbatim from the MVE block in Step 2] | [family] | [role] | MVE: [link to MVE block in `02_fact_cards.md` or `02_mve_evidence.md`]; docs: [Source #] | [none / list] | Selected / Rejected / Experimental only / Needs user decision | [why] |
 ```
 The new **Pinned Mode/Config** column is mandatory. A row without a pinned mode is incomplete. The new **API Capability Evidence** column links to the Minimum Viable Example saved during Step 2's API Capability Verification — without an MVE link the candidate cannot be `Selected`.
 #### 7.5.2 Restrictions × Candidate-Modes Sub-Matrix (MANDATORY)
 For each lead candidate row in the top-level matrix, append a structured cross-check that walks every numbered line of `restrictions.md` and `acceptance_criteria.md` against the candidate's **pinned mode/config**.
 ```markdown
 ## Sub-Matrix — <Candidate Name> in <Pinned Mode>
 | Restriction / AC | Candidate-mode behavior | Result | Evidence |
 |------------------|-------------------------|--------|----------|
 | R1: <verbatim line from restrictions.md> | <how the pinned mode behaves under this restriction> | ✅ Pass / ❌ Fail / ❓ Verify / N/A | [Fact # / Source # / MVE link] |
 | R2: ... | ... | ... | ... |
 | ... | ... | ... | ... |
 | AC-1.1: <verbatim line from acceptance_criteria.md> | <how the pinned mode satisfies (or contradicts) this AC's measurable target> | ✅ / ❌ / ❓ / N/A | [Fact # / Source # / MVE link] |
 | AC-1.2: ... | ... | ... | ... |
 | ... | ... | ... | ... |
 ```
 Cell semantics:
 - ✅ **Pass** — the candidate's pinned mode satisfies this line, with cited official-doc or MVE evidence.
 - ❌ **Fail** — the candidate's pinned mode contradicts this line, with cited evidence. Even one ❌ disqualifies the candidate from `Selected` status.
 - ❓ **Verify** — no evidence yet either way; further investigation required (loops back to Step 2 / Step 3.5). A row left ❓ at the end of analysis blocks the candidate.
 - **N/A** — the line is irrelevant to this component area (state why in one phrase).
 A candidate row may not be marked `Selected` while any cell is ❌ or ❓.
 #### 7.5.3 Decision Rules
 - `Selected` is allowed only when (a) the top-level row has an MVE link, (b) the sub-matrix has zero ❌, (c) the sub-matrix has zero ❓, and (d) the candidate's documented implementation assumptions match the project's explicit constraints and acceptance criteria.
 - `Experimental only` is required when a candidate might work but lacks proof for the exact operating context (e.g., MVE exists for a similar configuration but not the exact one).
 - `Rejected` is required when documented assumptions conflict with project constraints (any sub-matrix row is ❌ with cited evidence).
 - `Needs user decision` is required when a mismatch changes scope, cost, safety, product behavior, or acceptance criteria — and the user has not yet been consulted.
 - Each component area must include at least one selected or fallback-safe option, plus the most credible rejected/experimental alternatives discovered during web research.
 - A component area with only one candidate is incomplete unless `00_question_decomposition.md` documents the broader searches and why they yielded no realistic alternatives.
 - A candidate may not appear as the lead solution in Step 8 unless this gate marks it `Selected`.
 - "Validation gate required" footnotes are not equivalent to `Selected`. If the validation gate concerns API capability (does the mode produce the required output?), that is a Step-2 / Step-7.5 question and must be resolved here, not deferred to runtime. Only validation gates concerning *runtime quality* (e.g., "does this VO converge on this terrain class?") may be carried forward as `Selected with runtime gate`.
 **Save action**: Write `06_component_fit_matrix.md` containing both 7.5.1 (top-level) and 7.5.2 (per-candidate sub-matrices).
 **BLOCKING**: If any lead candidate has ❌, ❓, `Experimental only`, `Rejected`, or `Needs user decision` status, do not silently proceed. Ask the user or choose a different selected candidate.
 ---
 ### Step 8: Deliverable Formatting
 Make the output **readable, traceable, and actionable**.
@@ -10,21 +10,12 @@
 [Architecture solution that meets restrictions and acceptance criteria.]
 > **Applicability** — the table columns `Pinned Mode/Config` and `API Capability Evidence` apply only to technical-component runs (per SKILL.md → Research Output Class). For non-technical research outputs (concept comparison, market/policy report, investigation answer), this Architecture section may be replaced with a comparison/analysis section that does not use these columns; or the columns may be marked `N/A` per row when the row describes a non-technical "component" (a process, a policy, an organizational construct). For mixed runs, fill the columns only on rows that describe libraries/SDKs/frameworks/services/protocols/data formats/algorithms.
 ### Component: [Component Name]
-| Solution | Tools | Pinned Mode/Config | Advantages | Limitations | Requirements | Security | Cost | API Capability Evidence | Fit |
+| Solution | Tools | Advantages | Limitations | Requirements | Security | Cost | Fit |
-|----------|-------|--------------------|-----------|-------------|-------------|----------|------|-------------------------|-----|
+|----------|-------|-----------|-------------|-------------|----------|------|-----|
-| [Option 1] | [lib/platform] | [exact mode/config used: inputs, outputs, runtime] | [pros] | [cons] | [intrinsic requirements] | [security] | [cost] | MVE: [link to MVE block]; docs: [Source #] | [Selected / Rejected / Experimental only / Needs user decision — cite exact-fit evidence and disqualifiers] |
+| [Option 1] | [lib/platform] | [pros] | [cons] | [reqs] | [security] | [cost] | [fit assessment] |
-| [Option 2] | [lib/platform] | [exact mode/config used] | [pros] | [cons] | [intrinsic requirements] | [security] | [cost] | MVE: [link]; docs: [Source #] | [Selected / Rejected / Experimental only / Needs user decision] |
+| [Option 2] | [lib/platform] | [pros] | [cons] | [reqs] | [security] | [cost] | [fit assessment] |
 **Exact-fit evidence**:
 - Project constraints checked: [inputs/outputs, operating context, lifecycle, NFRs, acceptance criteria]
 - Evidence: [Fact # / Source #]
 - Disqualifiers: [none or list]
 - Restrictions × Candidate-Modes sub-matrix: see `06_component_fit_matrix.md` § <Candidate Name>
 - API capability gates: ✅ MVE saved / ⚠️ partial — see disqualifiers / ❌ no MVE — candidate is Experimental only or Rejected
 [Repeat per component]
@@ -13,21 +13,12 @@
 [Architecture solution that meets restrictions and acceptance criteria.]
 > **Applicability** — the table columns `Pinned Mode/Config` and `API Capability Evidence` apply only to technical-component runs (per SKILL.md → Research Output Class). For non-technical assessment outputs (e.g., reassessing a policy approach, comparing organizational designs), this Architecture section may be replaced with the assessment content that does not use these columns; or the columns may be marked `N/A` per row for non-technical "components". For mixed runs, fill the columns only on rows that describe libraries/SDKs/frameworks/services/protocols/data formats/algorithms.
 ### Component: [Component Name]
-| Solution | Tools | Pinned Mode/Config | Advantages | Limitations | Requirements | Security | Performance | API Capability Evidence | Fit |
+| Solution | Tools | Advantages | Limitations | Requirements | Security | Performance | Fit |
-|----------|-------|--------------------|-----------|-------------|-------------|----------|------------|-------------------------|-----|
+|----------|-------|-----------|-------------|-------------|----------|------------|-----|
-| [Option 1] | [lib/platform] | [exact mode/config used: inputs, outputs, runtime] | [pros] | [cons] | [intrinsic requirements] | [security] | [perf] | MVE: [link to MVE block]; docs: [Source #] | [Selected / Rejected / Experimental only / Needs user decision — cite exact-fit evidence and disqualifiers] |
+| [Option 1] | [lib/platform] | [pros] | [cons] | [reqs] | [security] | [perf] | [fit assessment] |
-| [Option 2] | [lib/platform] | [exact mode/config used] | [pros] | [cons] | [intrinsic requirements] | [security] | [perf] | MVE: [link]; docs: [Source #] | [Selected / Rejected / Experimental only / Needs user decision] |
+| [Option 2] | [lib/platform] | [pros] | [cons] | [reqs] | [security] | [perf] | [fit assessment] |
 **Exact-fit evidence**:
 - Project constraints checked: [inputs/outputs, operating context, lifecycle, NFRs, acceptance criteria]
 - Evidence: [Fact # / Source #]
 - Disqualifiers: [none or list]
 - Restrictions × Candidate-Modes sub-matrix: see `06_component_fit_matrix.md` § <Candidate Name>
 - API capability gates: ✅ MVE saved / ⚠️ partial — see disqualifiers / ❌ no MVE — candidate is Experimental only or Rejected
 [Repeat per component]
@@ -22,7 +22,7 @@ test-run has two modes. The caller passes the mode explicitly; if missing, defau
 | Mode | Scope | Typical caller | Input artifacts |
 |------|-------|---------------|-----------------|
 | `functional` (default) | Unit / integration / blackbox tests — correctness | autodev Steps that verify after Implement Tests or Implement | `scripts/run-tests.sh`, `_docs/02_document/tests/environment.md`, `_docs/02_document/tests/blackbox-tests.md` |
-| `perf` | Performance / load / stress / soak tests — latency, throughput, error-rate thresholds | autodev greenfield Step 15, existing-code Step 15 (pre-deploy) | `scripts/run-performance-tests.sh`, `_docs/02_document/tests/performance-tests.md`, AC thresholds in `_docs/00_problem/acceptance_criteria.md` |
+| `perf` | Performance / load / stress / soak tests — latency, throughput, error-rate thresholds | autodev greenfield Step 9, existing-code Step 15 (pre-deploy) | `scripts/run-performance-tests.sh`, `_docs/02_document/tests/performance-tests.md`, AC thresholds in `_docs/00_problem/acceptance_criteria.md` |
 Direct user invocation (`/test-run`) defaults to `functional`. If the user says "perf tests", "load test", "performance", or passes a performance scenarios file, run `perf` mode.
@@ -95,7 +95,7 @@ Examples:
 File: `expected_results/image_01_detections.json`
-```json
+```json
 {
  "input": "image_01.jpg",
  "expected": {
@@ -119,7 +119,7 @@ File: `expected_results/image_01_detections.json`
    ]
  }
 }
-```
+```
 ```
 ---
@@ -1,27 +0,0 @@
 .git
 .github
 .cursor
 _docs
 .venv
 __pycache__
 .pytest_cache
 .ruff_cache
 .mypy_cache
 .env
 .env.*
 *.pem
 *.key
 *.secret
 data/input/*
 data/cache/*
 data/fdr/*
 data/test-results/*
 *.tlog
 *.ulg
 *.bag
 *.mcap
 *.cbor
 *.parquet
 *.mp4
 *.mov
 *.avi
@@ -1,10 +0,0 @@
 GPSD_ENV=development
 GPSD_CONFIG_DIR=./config/development
 GPSD_CACHE_DIR=./data/cache
 GPSD_FDR_DIR=./data/fdr
 GPSD_DATABASE_URL=postgresql://gpsd:gpsd@localhost:5432/gpsd
 GPSD_MAVLINK_URL=udp:127.0.0.1:14550
 GPSD_CAMERA_SOURCE=./data/input
 GPSD_SIGNING_KEY_REF=test-key-ref
 GPSD_MAX_FDR_BYTES=104857600
 GPSD_LOG_LEVEL=info
@@ -1,43 +0,0 @@
 name: CI
 on:
  pull_request:
  push:
    branches:
      - dev
 jobs:
  python-quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"
      - name: Format check
        run: python -m black --check src tests
      - name: Lint
        run: python -m ruff check src tests
      - name: Unit tests
        run: python -m pytest tests/unit
  replay-compose-smoke:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate compose files
        run: |
          docker compose -f docker-compose.yml config
          docker compose -f docker-compose.test.yml config
      - name: Collect artifact placeholders
        run: mkdir -p data/test-results e2e/reports
      - uses: actions/upload-artifact@v4
        with:
          name: replay-evidence-placeholders
          path: |
            data/test-results
            e2e/reports
@@ -1,42 +1 @@
 .DS_Store
 .venv/
 __pycache__/
 *.py[cod]
 .pytest_cache/
 .ruff_cache/
 .mypy_cache/
 .coverage
 htmlcov/
 *.egg-info/
 .env
 .env.*
 !.env.example
 *.pem
 *.key
 *.secret
 data/input/*
 data/cache/*
 data/fdr/*
 data/test-results/*
 data/expected/*
 !data/input/.gitkeep
 !data/cache/.gitkeep
 !data/fdr/.gitkeep
 !data/test-results/.gitkeep
 !data/expected/.gitkeep
 *.tlog
 *.ulg
 *.bag
 *.mcap
 *.cbor
 *.parquet
 *.mp4
 *.mov
 *.avi
 *.jpg
 *.jpeg
 *.png
 !_docs/00_problem/input_data/**
@@ -1,22 +0,0 @@
 # GPS-Denied Onboard Runtime
 Scaffold for the Jetson-hosted GPS-denied localization runtime, replay harness, and
 deployment evidence paths.
 The project uses a Python `src/` layout for orchestration code. Native bridge
 placeholders live inside the owning component folders rather than in a shared
 native tree.
 Generated mission data, FDR payloads, cache payloads, and raw frame dumps are kept
 out of git unless they are explicitly curated test fixtures.
 ## Local Development
 ```bash
 python3 -m venv .venv
 source .venv/bin/activate
 python -m pip install -e ".[dev]"
 python -m pytest
 ```
 Local replay infrastructure is described in `docker-compose.yml`; CI and black-box
 test infrastructure are described in `docker-compose.test.yml`.
@@ -1,175 +1,50 @@
-# Acceptance Criteria
+# Position Accuracy
-> **Last revised**: 2026-05-01 (Phase 1 AC/restrictions assessment clarifications).
+- The system should determine GPS coordinates of frame centers for 80% of photos within 50m error compared to real GPS
-> Changes vs. previous version (2026-04-25): AC-1.2 split into hard-floor + stretch; AC-1.4 made quantitative; AC-2.2 split per pipeline stage; AC-3.4 dual-trigger; AC-4.3 autopilot-pinned; AC-5.2 N pinned; AC-7.1 scoped to level flight; AC-8.2 freshness by sector; six new AC added (AC-NEW-1 … AC-NEW-6).
+- The system should determine GPS coordinates of frame centers for 60% of photos within 20m error compared to real GPS
-> Changes 2026-04-26: AC-4.3 extended to dual-channel hybrid (GPS_INPUT primary + ODOMETRY auxiliary); AC-8.6 added (VPR retrieval-unit + change-robustness); AC-NEW-7 added with confirmed numeric thresholds (cache-poisoning safety budget).
+- Maximum cumulative VO drift between satellite correction anchors should be less than 100 meters
-> Changes 2026-04-29: AC-3.5 and AC-NEW-8 added for temporary visual blackout/cloud occlusion during GPS spoofing, including IMU-only degraded navigation, covariance growth, and failover limits.
+- System should report a confidence score per position estimate (high = satellite-anchored, low = VO-extrapolated with drift)
 > Changes 2026-05-01: AC-1.3 anchor-age reporting clarified; AC-2.1 split so the >95% rate applies to VO registration, not every satellite re-anchor; AC-5.2 and AC-NEW-2 now require ArduPilot Plane SITL trigger verification; AC-8.3 storage accounting and AC-NEW-7 Satellite Service ownership clarified.
-## Position Accuracy
+# Image Processing Quality
- **AC-1.1** — The system shall determine GPS coordinates of frame centers within **50 m** of true GPS for **≥80%** of photos in normal flight segments.
+- Image Registration Rate > 95% for normal flight segments. The system can find enough matching features to confidently calculate the camera's 6-DoF pose and stitch that image into the trajectory
- **AC-1.2** — The system shall determine GPS coordinates of frame centers within **20 m** of true GPS for **≥50%** of photos in normal flight segments.
+- Mean Reprojection Error (MRE) < 1.0 pixels
 - **AC-1.3** — Maximum cumulative VO drift between two consecutive satellite-anchored fixes shall be **<100 m** (VO-only fallback) or **<50 m** (when IMU is fused). Drift is measured as ‖VO-extrapolated centre − next anchor centre‖ at the moment of the anchor fix. Every emitted estimate shall include `last_satellite_anchor_age_ms`; validation results shall be binned by anchor age, and the solution draft must define the maximum anchor age after which estimates are treated as degraded (`vo_extrapolated` or `dead_reckoned`) with monotonically growing covariance.
 - **AC-1.4** — The system shall report a **quantitative confidence score** per position estimate, comprising:
  - the 95% covariance ellipse semi-major axis in meters, AND
  - a categorical label `{satellite_anchored, vo_extrapolated, dead_reckoned}`.
-## Image Processing Quality
+# Resilience & Edge Cases
- **AC-2.1** — Image registration rate is split by registration type:
+- The system should correctly continue work even in the presence of up to 350m outlier between 2 consecutive photos (due to tilt of the plane)
-  - **AC-2.1a — VO registration**: frame-to-frame visual registration shall succeed for **>95%** of normal flight segments (defined as: nadir flight ±10° bank / pitch, ≥40% overlap with prior frame, daytime, usable texture, no full visual blackout).
+- System should correctly continue work during sharp turns, where the next photo doesn't overlap at all or overlaps less than 5%. The next photo should be within 200m drift and at an angle of less than 70 degrees. Sharp-turn frames are expected to fail VO and should be handled by satellite-based re-localization
-  - **AC-2.1b — Satellite-anchor registration**: cross-domain UAV-photo to satellite/cache registration is measured separately and is not hidden inside AC-2.1a. Satellite anchoring must satisfy AC-1.1 / AC-1.2 position accuracy, AC-2.2 cross-domain MRE, AC-8.2 freshness, and AC-8.6 retrieval behavior on season-matched tiles.
+- System should operate when UAV makes a sharp turn and next photos have no common points with previous route. It should figure out the location of the new route segment and connect it to the previous route. There could be more than 2 such disconnected segments, so this strategy must be core to the system
- **AC-2.2** — Mean Reprojection Error (MRE):
+- In case the system cannot determine the position of 3 consecutive frames by any means, it should send a re-localization request to the ground station operator via telemetry link. While waiting for operator input, the system continues attempting VO/IMU dead reckoning and the flight controller uses last known position + IMU extrapolation
  - **<1.0 px** for VO frame-to-frame homography on overlapping aerial pairs;
  - **<2.5 px** for satellite-anchored cross-domain (UAV photo ↔ ortho satellite tile) registration.
-## Resilience & Edge Cases
+# Real-Time Onboard Performance
- **AC-3.1** — The system shall correctly continue work in the presence of up to **350 m** outliers between two consecutive photos (caused by airframe tilt up to ±20°).
+- Less than 400ms end-to-end per frame: from camera capture to GPS coordinate output to the flight controller (camera shoots at ~3fps)
- **AC-3.2** — The system shall correctly continue work during sharp turns where the next photo overlaps **<5%** with the previous, drifts **<200 m**, and changes heading **<70°**. Sharp-turn frames are expected to fail VO and shall be handled by satellite-based re-localization (place recognition over the satellite tile cache).
+- Memory usage should stay below 8GB shared memory (Jetson Orin Nano Super — CPU and GPU share the same 8GB LPDDR5 pool)
- **AC-3.3** — The system shall handle **≥3 disconnected segments** per flight, connecting each new segment to the previous trajectory via global descriptor retrieval + RANSAC pose-graph relocalization. This is a core capability, not a degraded mode.
+- The system must output calculated GPS coordinates directly to the flight controller via MAVLink GPS_INPUT messages (using MAVSDK)
- **AC-3.4** — When the system cannot determine position for **≥3 consecutive frames AND ≥2 s**, it shall send a re-localization request to the ground station via telemetry. While waiting, it continues VO/IMU dead reckoning and the flight controller uses last known position + IMU extrapolation.
+- Position estimates are streamed to the flight controller frame-by-frame; the system does not batch or delay output
- **AC-3.5** — During temporary **visual blackout** where the navigation camera provides no usable ground signal (e.g., clouds/occlusion/whiteout) while GPS is denied or spoofed, the system shall switch to `{dead_reckoned}` within **≤1 processed frame OR ≤400 ms**, reject the spoofed GPS as an estimator input, and propagate position solely from the last trusted state + flight-controller IMU/attitude/airspeed/altitude inputs until visual or satellite anchoring recovers. During this mode, covariance shall grow monotonically, `GPS_INPUT.horiz_accuracy` shall not under-report the 95% covariance semi-major axis, and QGroundControl shall receive a `VISUAL_BLACKOUT_IMU_ONLY` status at **1–2 Hz**.
+- The system may refine previously calculated positions and send corrections to the flight controller as updated estimates
-## Real-Time Onboard Performance
+# Startup & Failsafe
- **AC-4.1** — End-to-end latency from camera capture to GPS coordinate output to the flight controller shall be **<400 ms p95**. Up to ~10% of frames may be dropped under sustained load (skip-allowed). Heavy global VPR / cross-domain re-ranking shall be conditional, not part of the steady-state per-frame path, unless profiling proves the full path stays inside the latency and memory budgets on the target Jetson.
+- The system initializes using the last known valid GPS position from the flight controller before GPS denial begins
- **AC-4.2** — Memory usage shall remain below **8 GB** shared on Jetson Orin Nano Super (CPU and GPU share the same 8 GB LPDDR5 pool).
+- If the system completely fails to produce any position estimate for more than N seconds (TBD), the flight controller should fall back to IMU-only dead reckoning and the system should log the failure
- **AC-4.3** — The system shall output its position estimate to the flight controller via **two parallel MAVLink channels**, both emitted by **pymavlink** (general telemetry uses MAVSDK):
+- On companion computer reboot mid-flight, the system should attempt to re-initialize from the flight controller's current IMU-extrapolated position
  - **Primary**: `GPS_INPUT` targeting **ArduPilot** with `GPS1_TYPE=14` (MAVLink GPS substitute). Matches the "replacement for the GPS module" framing of the build.
  - **Auxiliary** (when the EKF emits a fix with full 6-DoF covariance and quality > VISO_QUAL_MIN): `ODOMETRY` so EKF3 can fuse the richer covariance + native yaw error + quality field. ArduPilot's own dev docs designate ODOMETRY as the preferred external-nav channel for non-GPS substitution; we hybridise to keep AC-4.3's GPS-substitute framing while not throwing away the covariance fidelity that AC-NEW-4 depends on.
  - FC source priorities are configured so GPS_INPUT remains the failover path if ODOMETRY trips a parameter gate.
  - **v1 scope clause (added 2026-04-26 — see solution_draft03 finding M-30)**: v1 ships **GPS_INPUT only**; the ODOMETRY auxiliary channel is intentionally **disabled** in v1 because feeding both `GPS_INPUT` and `ODOMETRY` for overlapping axes triggers ArduPilot EKF3 double-fusion bugs (issues #30076 / #32506). `EK3_SRC1_*=GPS+Compass`; ODOMETRY emission re-enables in v1.1 once F-T9 SITL confirms PR #30080-class clean source-switching. Tests therefore assert v1 emits GPS_INPUT only and that ODOMETRY is *intentionally absent* on the wire.
  - (Decision rationale: MAVSDK has no native GPS_INPUT support — see `_docs/00_research/00_ac_assessment.md` Q-1; ODOMETRY hybrid rationale — see Mode B finding M-1 in `_docs/00_research/02_fact_cards.md`; v1 single-channel rationale — see Mode B round-2 finding M-30 in `_docs/00_research/02_fact_cards.md` / solution_draft03.)
 - **AC-4.4** — Position estimates are streamed to the flight controller frame-by-frame; the system shall not batch or delay output.
 - **AC-4.5** — The system may refine previously calculated positions and send corrections to the flight controller as updated estimates.
-## Startup & Failsafe
+# Ground Station & Telemetry
- **AC-5.1** — The system shall initialise using the last known valid GPS position from the flight controller's EKF, plus IMU-extrapolated position at the moment of GPS denial.
+- Position estimates and confidence scores should be streamed to the ground station via telemetry link for operator situational awareness
- **AC-5.2** — If the system fails to produce any position estimate for **>3 s**, the flight controller shall fall back to IMU-only dead reckoning and the system shall log the failure. Because ArduPilot failsafe timing depends on vehicle type and parameters, this fallback behavior must be verified specifically in ArduPilot Plane SITL with the production parameter set; Copter defaults are reference evidence only.
+- The ground station can send commands to the onboard system (e.g., operator-assisted re-localization hint with approximate coordinates)
- **AC-5.3** — On companion computer reboot mid-flight, the system shall attempt to re-initialise from the flight controller's current IMU-extrapolated position. See AC-NEW-1 for the cold-start time-to-first-fix budget.
+- Output coordinates in WGS84 format
-## Ground Station & Telemetry
+# Object Localization
- **AC-6.1** — Position estimates and confidence scores shall be streamed to **QGroundControl** via the MAVLink telemetry link. High-rate (per-frame) content stays on the local link for forensics; the GCS link is downsampled to **1–2 Hz** for situational awareness.
+- Other onboard AI systems can request GPS coordinates of objects detected by the AI camera
- **AC-6.2** — The ground station can send commands to the onboard system (e.g., operator-assisted re-localization hint with approximate coordinates) via STATUSTEXT, NAMED_VALUE_FLOAT, or a custom MAVLink dialect.
+- The GPS-Denied system calculates object coordinates trigonometrically using: current UAV GPS position (from GPS-Denied), known AI camera angle, zoom, and current flight altitude. Flat terrain is assumed
- **AC-6.3** — Output coordinates are in **WGS84** format (matches GPS_INPUT spec).
+- Accuracy is consistent with the frame-center position accuracy of the GPS-Denied system
-## Object Localization (AI Camera)
+# Satellite Reference Imagery
- **AC-7.1** — Other onboard AI systems may request GPS coordinates of objects detected by the AI camera. Localization accuracy is **consistent with the frame-center accuracy of the GPS-Denied system in level flight (bank/pitch <5°)**. In maneuvering flight, ground-projection error is bounded by `altitude × |sin(unknown_bank_or_pitch)|` and the system shall publish that bound alongside the estimate.
+- Satellite reference imagery resolution must be at least 0.5 m/pixel, ideally 0.3 m/pixel
- **AC-7.2** — The system computes object coordinates trigonometrically using: current UAV GPS position (from GPS-Denied), known AI-camera gimbal angle, zoom, and current flight altitude. Flat-terrain assumption applies.
+- Satellite imagery for the operational area should be less than 2 years old where possible
-
+- Satellite imagery must be pre-processed and loaded onto the companion computer before flight. Offline preprocessing time is not time-critical (can take minutes/hours)
 ## Satellite Reference Imagery
 - **AC-8.1** — Satellite reference imagery is provided by the **Azaion Suite Satellite Service** (a separate component of the Suite). The runtime onboard system consumes this service through an offline tile cache interface; it does **not** call commercial providers (Maxar, Airbus, Planet, etc.) directly. The Satellite Service is responsible for upstream sourcing and is out of scope for this build. Required resolution at the cache interface: **at least 0.5 m/pixel, ideally 0.3 m/pixel**.
 - **AC-8.2** — Satellite tiles consumed at runtime shall be:
  - **<6 months old** for active-conflict sectors;
  - **<12 months old** for stable rear sectors.
  System shall reject or downgrade-confidence on tiles older than these thresholds (see AC-NEW-6).
 - **AC-8.3** — Satellite imagery for the operational area shall be **pre-loaded and pre-processed** onto the companion computer before flight. Offline preprocessing time is not time-critical (minutes/hours). Pre-extracted tile descriptors (e.g., SuperPoint keypoints/descriptors and DINOv2-VLAD global descriptors) are part of the cache and count against the storage budget unless the solution draft explicitly defines a separate descriptor/index budget.
 - **AC-8.4** — **Mid-flight tile generation & write-back**: during flight, the system shall continuously orthorectify navigation-camera frames into tiles aligned with the basemap projection and store them in the local cache, **deduplicated** so each ground sector is stored at most once (latest / highest-quality tile wins). On landing, the companion computer shall upload newly generated tiles back to the Azaion Suite Satellite Service so that the next mission cache contains imagery refreshed by the previous flight.
 - **AC-8.5** — **Storage policy**: the system shall **not** retain raw navigation-camera frames or AI-camera frames as part of normal operation. Tiles are the only persistent imagery artifact. Forensic exception: a low-rate (≤0.1 Hz) thumbnail log of frames that **failed** tile generation may be retained for debugging within the FDR budget (AC-NEW-3).
 - **AC-8.6** — **VPR retrieval unit + change-robustness**:
  - The Visual Place Recognition (Component 2) FAISS index shall be built over **ground-footprint-sized "VPR chunks"** (~600–800 m at the deployment altitude band, with **40–50 % overlap** between adjacent chunks), **decoupled from the slippy-XYZ storage tile** (z=20). Any UAV frame footprint shall fall fully inside ≥1 chunk regardless of position.
  - The index shall be **multi-scale**: in addition to fine-scale chunks (derived from z=20 storage), a coarser-scale chunk descriptor set (z=17 or z=18 effective scale) shall be maintained for change-robust retrieval in **active-conflict sectors** where building destruction or major scene change is expected.
  - VPR top-K shall be **dynamically sized** by sector classification (AC-NEW-6) and EKF position covariance: K=5 in stable sectors with σ_xy ≤ 20 m; K=20 in active-conflict sectors; K=50 on expanding-window fallback.
  - VPR shall be **invoked conditionally**, not on every frame: in steady state (last anchor age < 2 s, σ_xy < 20 m, VO healthy), the system uses a geometric prior from IMU+VO predicted position to rank candidate chunks by distance alone. VPR's DINOv2 forward is invoked on **re-loc triggers** (cold start AC-NEW-1, sharp turn AC-3.2, disconnected segment AC-3.3, σ_xy > 50 m, or VO failure for ≥2 frames).
 ## New AC (added in Phase 1 assessment, expanded with rationale & validation)
 ### AC-NEW-1 — Time-to-first-fix on cold start
 **Statement.** From companion-computer boot, the system shall emit its first valid `GPS_INPUT` message in **<30 s**, given an IMU-extrapolated initial position handed over from the flight controller's EKF.
 **Why it matters.** A mid-flight reboot (brown-out, watchdog reset, OS panic) is a realistic scenario on a fixed-wing UAV running an 8-hour mission. The autopilot continues to fly on IMU dead reckoning during the gap; a 30 s budget keeps that drift under ~500 m at 60 km/h cruise, which the EKF can absorb when our first fix arrives.
 **Implementation drivers.** TensorRT engines must be built at install time (not at first run); CUDA / TRT init <5 s; tile-cache mmap warm at start; FAISS index loaded before MAVLink connect; first VPR retrieval + cross-view match must succeed at full resolution within the remaining budget.
 **Validation.** Bench: cold-boot the companion 50× with simulated FC-pose input; record time from boot to first valid `GPS_INPUT` MAVLink frame. Pass = 95% percentile <30 s.
 ### AC-NEW-2 — Spoofing-promotion latency
 **Statement.** When the flight controller signals GPS denial or spoofing (ArduPilot fix-loss / EKF lane-switch event; PX4 `EKF2_GPS_SPOOFED` flag if PX4 ever returns to scope), the GPS-Denied system shall promote its own estimate to the FC's primary GPS source within **<3 s**.
 **Why it matters.** Without this gate, the FC may continue to follow a spoofed real-GPS source while our valid estimate sits idle. 3 s is short enough to keep the FC from acting on a malicious heading change but long enough to ride out a single-frame anomaly.
 **Implementation drivers.** Subscribe to `GPS_RAW_INT`, `EKF_STATUS_REPORT`, `SYS_STATUS`, and any ArduPilot Plane EKF/GPS status messages available in the production firmware. Maintain an internal "real-GPS health" rolling average; switch to "primary" mode (raise our `GPS_INPUT` `fix_type` to 3D and assert) when the verified Plane-specific health trigger stays below threshold for >=1 s. Emit `STATUSTEXT` to QGC on every promotion / demotion.
 **Validation.** ArduPilot Plane SITL: simulate spoofing (inject false `GPS_RAW_INT` from a malicious node); verify the exact trigger signals used by the production parameter set; measure time from spoof onset to our promotion. Pass = 95% percentile <3 s.
 ### AC-NEW-3 — Flight Data Recorder
 **Statement.** The system shall retain to non-volatile storage, per flight: per-frame position estimates with covariance and source-label, IMU traces from the FC at full rate, all emitted `GPS_INPUT` frames, MAVLink raw stream (tlog), system health (CPU / GPU / temp / throttle), tiles generated mid-flight (AC-8.4), and a low-rate (≤0.1 Hz) thumbnail log of frames that failed tile generation. **Raw nav-cam frames and AI-cam frames are NOT retained** (AC-8.5). Storage cap **64 GB / flight**; recorder rolls over (oldest segment dropped first) after cap.
 **Why it matters.** Tiles, telemetry traces, and IMU are the operationally useful artifacts: they reproduce the mission, feed the next mission's cache (AC-8.4), and let post-mission analysis explain any false-position event (AC-NEW-4). Raw frames are large and redundant once tiles exist.
 **Implementation drivers.** Per-day directory layout; fixed-size segment files; rollover policy on segment-close, not on every write. NVMe ≥64 GB on top of the persistent satellite-tile cache.
 **Validation.** Bench: run an 8-hour synthetic load (3 Hz nav frames replayed from disk), assert the FDR ends ≤64 GB and no payload class is silently dropped without a logged rollover event.
 ### AC-NEW-4 — False-position safety budget
 **Statement.**
 - P(reported estimate error > **500 m**) **<0.1 %** per flight.
 - P(reported estimate error > **1 km**) **<0.01 %** per flight.
 **Why it matters.** A single 1-km-off `GPS_INPUT` frame can hand the FC a heading that flies the UAV outside the geofence in seconds. The covariance carried in `GPS_INPUT` (`h_acc`) is the FC's only defense; this AC bounds the **probability** of our covariance under-reporting reality.
 **Implementation drivers.** EKF covariance must be calibrated, not optimistic. Cross-view fixes with low inlier ratio must be **rejected**, not down-weighted to "small but non-zero". Outlier rejection at the EKF stage (Mahalanobis gate) is mandatory.
 **Validation.** Monte Carlo over the AerialVL public dataset (S03) and our own recorded Mavic flights, with synthetic IMU injection where applicable; report error CDF; pass = both probabilities below budget across ≥100 simulated flights worth of frames.
 ### AC-NEW-5 — Operational environmental envelope
 **Statement.** Operating temperature **−20 °C to +50 °C**; vibration / shock per RTCA DO-160G low-altitude UAV-class envelope. The cooling solution shall sustain the **25 W** power mode at the upper temperature bound for the full **8-hour duty cycle** without thermal throttling.
 **Why it matters.** Without this, all latency / accuracy ACs are conditional on a benign thermal day. Eastern/southern Ukraine summers easily exceed +35 °C ambient inside a UAV bay; without active cooling, the Jetson throttles to 15 W mode and our 400 ms latency budget collapses.
 **Implementation drivers.** Forced-air or active heatsink sized for 25 W continuous at +50 °C ambient bay temperature; thermal sensors logged in FDR (AC-NEW-3); throttle event = automatic `STATUSTEXT` warning to QGC.
 **Validation.** Hot-soak chamber test: 25 W workload at +50 °C ambient for 8 h; assert no throttle. Cold-soak: −20 °C cold-start to first fix within AC-NEW-1 budget.
 ### AC-NEW-6 — Imagery freshness enforcement
 **Statement.** The system shall reject (or downgrade confidence on) any satellite tile whose capture date violates AC-8.2 (>6 months old in active-conflict sectors; >12 months old in stable rear sectors). Tiles generated mid-flight (AC-8.4) and not yet uploaded to the Suite Satellite Service are timestamped with the current flight date and treated as fresh.
 **Why it matters.** Stale satellite tiles are the dominant cross-view-matching failure mode in active-conflict sectors (cratering, dam destruction, road realignment). A confident match against a stale tile is worse than no match.
 **Implementation drivers.** Each tile carries `capture_date` metadata in the cache index. Sector classification (active vs stable) is part of the operational area definition handed in pre-flight. Confidence weight = 1.0 if within freshness budget, linearly decayed to 0.0 over a 30-day grace zone past the budget, hard reject beyond the grace.
 **Validation.** Inject tiles with synthetic age into the cache; verify rejection / decay curve matches spec; verify a stale-tile match never produces a `satellite_anchored` source label.
 ### AC-NEW-7 — Cache-poisoning safety budget
 **Statement.** Per flight, across all onboard tiles written by Component 1b (in-flight ortho-tile generator):
 - P(onboard tile geo-misaligned > **30 m**) **<1 %**.
 - P(onboard tile geo-misaligned > **100 m**) **<0.1 %**.
 **Why it matters.** Onboard tiles feed back into the Suite Satellite Service's basemap (AC-8.4). Without this AC, a confidently-bad EKF pose can write a misaligned tile that, after Service ingest, becomes the next flight's satellite anchor — producing cross-flight error compounding that AC-NEW-4 (single-flight false-position budget) does not capture. This AC bounds the **probability** that an onboard tile's claimed geo-alignment is wrong by a margin that would propagate to a downstream flight.
 **Implementation drivers.**
 - Service-source tiles are immutable within freshness budget (AC-8.2); onboard tiles overwrite only stale or other-onboard tiles.
 - The onboard GPS-Denied system writes tile-quality metadata required by the Suite Satellite Service. The Service-side ingest applies a **2-flight voting layer**: an onboard tile gets promoted to "trusted basemap" only after **N>=2 independent flights** confirm consistent geo-alignment within X m of each other. (Active sectors per AC-NEW-6 may use single-flight promotion when σ_xy <= 3 m AND OSM-road-overlap >= 70 %.) The voting layer is an external Suite Satellite Service dependency, not implemented inside this onboard build, but its contract is required for AC-NEW-7 to pass end-to-end.
 - The Component-1b parent-pose covariance is a **hard gate** in the local quality score: σ_xy ≤ 5 m for a hard write (`trust_level = candidate`); σ_xy ≤ 3 m for `trust_level = candidate` with full quality; tiles written in the σ_xy ∈ (3, 5] m band are marked `trust_level = soft` in the sidecar.
 - Eligibility check (Component 1b) tightens generation gate from σ_xy ≤ 10 m to σ_xy ≤ 5 m.
 **Validation.** Multi-flight Monte Carlo replay over AerialVL + Mavic + AerialExtreMatch with **synthetic over-confidence injection** (artificially deflate EKF covariance by 1.5×–3×): assert both probabilities below budget across ≥100 simulated flights worth of frames. Independently, Service-side voting layer is exercised in F-T3 to verify candidate tiles are not promoted to trusted basemap before N-flight confirmation.
 ### AC-NEW-8 — Visual blackout + GPS spoofing degraded-mode budget
 **Statement.** When the navigation camera is fully unusable for visual localization and the flight controller simultaneously reports GPS denial/spoofing, the onboard system shall:
 - continue emitting `GPS_INPUT` from IMU-only propagation for **up to 30 s** after the last trusted visual/satellite anchor, unless the estimator covariance exceeds the fail threshold earlier;
 - label every estimate `{dead_reckoned}` and set `fix_type=2` or lower when the 95% covariance semi-major axis exceeds **100 m**;
 - emit `fix_type=0`, `horiz_accuracy=999.0`, and `STATUSTEXT: VISUAL_BLACKOUT_FAILSAFE` when the 95% covariance semi-major axis exceeds **500 m** OR visual blackout exceeds **30 s** without a trusted re-anchor;
 - never promote spoofed real-GPS measurements back into the estimator during blackout unless the FC GPS health has been stable and non-spoofed for **≥10 s** and a visual/satellite consistency check has succeeded.
 **Why it matters.** A cloud/whiteout period removes all visual correction exactly when spoofed GPS cannot be trusted. The only safe behavior is honest IMU-only dead reckoning with rapidly growing uncertainty, not pretending that a stale visual position or spoofed GPS remains valid.
 **Implementation drivers.** Add an image-quality/occlusion classifier before VO/VPR, a blackout state in the ESKF mode machine, covariance floors for IMU-only propagation, strict GPS health gating, and QGC/FDR logging for blackout start, every degraded estimate, and blackout recovery/failsafe.
 **Validation.** SITL/replay: inject a 5 s, 15 s, and 35 s full-camera blackout while spoofing `GPS_RAW_INT`; assert mode transition ≤400 ms, spoofed GPS is ignored, covariance grows monotonically, `GPS_INPUT` fields degrade at the thresholds above, and recovery only occurs after a trusted visual/satellite anchor or the 10 s GPS-health + visual-consistency gate.
@@ -1,2 +1,8 @@
- Height: 400m
+- Height
- Camera: ADTi Surveyor Lite 20MP 20L V1
+  - 400m
 - Camera:
  - Name: ADTi Surveyor Lite 26S v2
  - Resolution: 26MP
  - Image resolution: 6252*4168
  - Focal length: 25mm
  - Sensor width: 23.5
@@ -0,0 +1,61 @@
 frame_index,image,expected_lat,expected_lon,max_error_m,threshold_50m_applies,threshold_20m_applies
 1,AD000001.jpg,48.275292,37.385220,100,yes,yes
 2,AD000002.jpg,48.275001,37.382922,100,yes,yes
 3,AD000003.jpg,48.274520,37.381657,100,yes,yes
 4,AD000004.jpg,48.274956,37.379004,100,yes,yes
 5,AD000005.jpg,48.273997,37.379828,100,yes,yes
 6,AD000006.jpg,48.272538,37.380294,100,yes,yes
 7,AD000007.jpg,48.272408,37.379153,100,yes,yes
 8,AD000008.jpg,48.271992,37.377572,100,yes,yes
 9,AD000009.jpg,48.271376,37.376671,100,yes,yes
 10,AD000010.jpg,48.271233,37.374806,100,yes,yes
 11,AD000011.jpg,48.270334,37.374442,100,yes,yes
 12,AD000012.jpg,48.269922,37.373284,100,yes,yes
 13,AD000013.jpg,48.269366,37.372134,100,yes,yes
 14,AD000014.jpg,48.268759,37.370940,100,yes,yes
 15,AD000015.jpg,48.268291,37.369815,100,yes,yes
 16,AD000016.jpg,48.267719,37.368469,100,yes,yes
 17,AD000017.jpg,48.267461,37.367255,100,yes,yes
 18,AD000018.jpg,48.266663,37.365888,100,yes,yes
 19,AD000019.jpg,48.266135,37.365460,100,yes,yes
 20,AD000020.jpg,48.265574,37.364211,100,yes,yes
 21,AD000021.jpg,48.264892,37.362998,100,yes,yes
 22,AD000022.jpg,48.264393,37.361086,100,yes,yes
 23,AD000023.jpg,48.263803,37.361028,100,yes,yes
 24,AD000024.jpg,48.263014,37.359878,100,yes,yes
 25,AD000025.jpg,48.262635,37.358277,100,yes,yes
 26,AD000026.jpg,48.261819,37.357116,100,yes,yes
 27,AD000027.jpg,48.261182,37.355907,100,yes,yes
 28,AD000028.jpg,48.260727,37.354723,100,yes,yes
 29,AD000029.jpg,48.260117,37.353469,100,yes,yes
 30,AD000030.jpg,48.259677,37.352165,100,yes,yes
 31,AD000031.jpg,48.258881,37.351376,100,yes,yes
 32,AD000032.jpg,48.258425,37.349964,100,yes,yes
 33,AD000033.jpg,48.258653,37.347004,100,yes,yes
 34,AD000034.jpg,48.257879,37.347711,100,yes,yes
 35,AD000035.jpg,48.256777,37.348444,100,yes,yes
 36,AD000036.jpg,48.255756,37.348098,100,yes,yes
 37,AD000037.jpg,48.255375,37.346549,100,yes,yes
 38,AD000038.jpg,48.254799,37.345603,100,yes,yes
 39,AD000039.jpg,48.254557,37.344566,100,yes,yes
 40,AD000040.jpg,48.254380,37.344375,100,yes,yes
 41,AD000041.jpg,48.253722,37.343093,100,yes,yes
 42,AD000042.jpg,48.254205,37.340532,100,yes,yes
 43,AD000043.jpg,48.252380,37.342112,100,yes,yes
 44,AD000044.jpg,48.251489,37.343079,100,yes,yes
 45,AD000045.jpg,48.251085,37.346128,100,yes,yes
 46,AD000046.jpg,48.250413,37.344034,100,yes,yes
 47,AD000047.jpg,48.249414,37.343296,100,yes,yes
 48,AD000048.jpg,48.249114,37.346895,100,yes,yes
 49,AD000049.jpg,48.250241,37.347741,100,yes,yes
 50,AD000050.jpg,48.250974,37.348379,100,yes,yes
 51,AD000051.jpg,48.251528,37.349468,100,yes,yes
 52,AD000052.jpg,48.251873,37.350485,100,yes,yes
 53,AD000053.jpg,48.252161,37.351491,100,yes,yes
 54,AD000054.jpg,48.252685,37.352343,100,yes,yes
 55,AD000055.jpg,48.253268,37.353119,100,yes,yes
 56,AD000056.jpg,48.253767,37.354246,100,yes,yes
 57,AD000057.jpg,48.254329,37.354946,100,yes,yes
 58,AD000058.jpg,48.254874,37.355765,100,yes,yes
 59,AD000059.jpg,48.255481,37.356501,100,yes,yes
 60,AD000060.jpg,48.256246,37.357485,100,yes,yes
@@ -1,97 +1,166 @@
-# Expected Results Mapping
+# Expected Results
-## Scope
+Maps every input data item to its quantifiable expected result.
 Tests use this mapping to compare actual system output against known-correct answers.
-`coordinates.csv` is the current source of truth for the provided still-image nadir set. It gives expected WGS84 frame-center coordinates for `AD000001.jpg` through `AD000060.jpg`.
+## Result Format Legend
-This data is sufficient for black-box frame-center geolocation tests against still images. The Derkachi representative fixture in `input_data/flight_derkachi/` adds cropped nadir video plus synchronized `SCALED_IMU2` and `GLOBAL_POSITION_INT` telemetry. It is sufficient for fixture validation, video/telemetry synchronization, replay, latency, VIO smoke tests, and trajectory comparison against the tlog GPS path. It is not sufficient by itself for final production accuracy because raw camera calibration, lens distortion, and exact camera-to-body calibration are still pending.
+| Result Type | When to Use | Example |
 |-------------|-------------|---------|
 | Exact value | Output must match precisely | `fix_type: 3`, `satellites_visible: 10` |
 | Tolerance range | Numeric output with acceptable variance | `lat: 48.275292 ± 50m` |
 | Threshold | Output must exceed or stay below a limit | `latency < 400ms`, `memory < 8GB` |
 | Pattern match | Output must match a string/regex pattern | `RELOC_REQ: last_lat=.* last_lon=.* uncertainty=.*m` |
 | File reference | Complex output compared against a reference file | `match expected_results/position_accuracy.csv` |
 | Set/count | Output must contain specific items or counts | `registered_frames / total_frames > 0.95` |
-## Pass / Fail Rules
+## Comparison Methods
- **Normal frame-center geolocation**: estimated frame center is within 50 m of the expected WGS84 coordinate.
+| Method | Description | Tolerance Syntax |
- **Stretch accuracy bin**: estimated frame center is within 20 m of the expected WGS84 coordinate.
+|--------|-------------|-----------------|
- **Dataset aggregate**: at least 80% of mapped images pass the 50 m threshold and at least 50% pass the 20 m threshold.
+| `numeric_tolerance` | abs(actual - expected) ≤ tolerance | `± <value>` |
- **Output shape**: each result must include image name, estimated `lat`, estimated `lon`, error in meters, source label, 95% covariance semi-major axis, and `last_satellite_anchor_age_ms`.
+| `threshold_min` | actual ≥ threshold | `≥ <value>` |
 | `threshold_max` | actual ≤ threshold | `≤ <value>` |
 | `percentage` | percentage of items meeting criterion | `≥ N%` |
 | `exact` | actual == expected | N/A |
 | `regex` | actual matches regex pattern | regex string |
 | `file_reference` | compare against reference file | file path |
-## Input To Expected Output Map
+## Input → Expected Result Mapping
-### Still-Image Frame Centers
+### Position Accuracy (60-image flight sequence)
-| Input image | Expected latitude | Expected longitude | Primary threshold | Stretch threshold |
+Ground truth GPS coordinates for each frame are in `coordinates.csv`. The system processes these frames sequentially (simulating a real flight) with corresponding IMU data (200Hz, from SITL ArduPilot or synthetic generation from trajectory) and satellite tile matches. The system outputs estimated GPS coordinates per frame. Expected results compare estimated positions against ground truth.
 |-------------|-------------------|--------------------|-------------------|-------------------|
 | AD000001.jpg | 48.275292 | 37.385220 | <= 50 m | <= 20 m |
 | AD000002.jpg | 48.275001 | 37.382922 | <= 50 m | <= 20 m |
 | AD000003.jpg | 48.274520 | 37.381657 | <= 50 m | <= 20 m |
 | AD000004.jpg | 48.274956 | 37.379004 | <= 50 m | <= 20 m |
 | AD000005.jpg | 48.273997 | 37.379828 | <= 50 m | <= 20 m |
 | AD000006.jpg | 48.272538 | 37.380294 | <= 50 m | <= 20 m |
 | AD000007.jpg | 48.272408 | 37.379153 | <= 50 m | <= 20 m |
 | AD000008.jpg | 48.271992 | 37.377572 | <= 50 m | <= 20 m |
 | AD000009.jpg | 48.271376 | 37.376671 | <= 50 m | <= 20 m |
 | AD000010.jpg | 48.271233 | 37.374806 | <= 50 m | <= 20 m |
 | AD000011.jpg | 48.270334 | 37.374442 | <= 50 m | <= 20 m |
 | AD000012.jpg | 48.269922 | 37.373284 | <= 50 m | <= 20 m |
 | AD000013.jpg | 48.269366 | 37.372134 | <= 50 m | <= 20 m |
 | AD000014.jpg | 48.268759 | 37.370940 | <= 50 m | <= 20 m |
 | AD000015.jpg | 48.268291 | 37.369815 | <= 50 m | <= 20 m |
 | AD000016.jpg | 48.267719 | 37.368469 | <= 50 m | <= 20 m |
 | AD000017.jpg | 48.267461 | 37.367255 | <= 50 m | <= 20 m |
 | AD000018.jpg | 48.266663 | 37.365888 | <= 50 m | <= 20 m |
 | AD000019.jpg | 48.266135 | 37.365460 | <= 50 m | <= 20 m |
 | AD000020.jpg | 48.265574 | 37.364211 | <= 50 m | <= 20 m |
 | AD000021.jpg | 48.264892 | 37.362998 | <= 50 m | <= 20 m |
 | AD000022.jpg | 48.264393 | 37.361086 | <= 50 m | <= 20 m |
 | AD000023.jpg | 48.263803 | 37.361028 | <= 50 m | <= 20 m |
 | AD000024.jpg | 48.263014 | 37.359878 | <= 50 m | <= 20 m |
 | AD000025.jpg | 48.262635 | 37.358277 | <= 50 m | <= 20 m |
 | AD000026.jpg | 48.261819 | 37.357116 | <= 50 m | <= 20 m |
 | AD000027.jpg | 48.261182 | 37.355907 | <= 50 m | <= 20 m |
 | AD000028.jpg | 48.260727 | 37.354723 | <= 50 m | <= 20 m |
 | AD000029.jpg | 48.260117 | 37.353469 | <= 50 m | <= 20 m |
 | AD000030.jpg | 48.259677 | 37.352165 | <= 50 m | <= 20 m |
 | AD000031.jpg | 48.258881 | 37.351376 | <= 50 m | <= 20 m |
 | AD000032.jpg | 48.258425 | 37.349964 | <= 50 m | <= 20 m |
 | AD000033.jpg | 48.258653 | 37.347004 | <= 50 m | <= 20 m |
 | AD000034.jpg | 48.257879 | 37.347711 | <= 50 m | <= 20 m |
 | AD000035.jpg | 48.256777 | 37.348444 | <= 50 m | <= 20 m |
 | AD000036.jpg | 48.255756 | 37.348098 | <= 50 m | <= 20 m |
 | AD000037.jpg | 48.255375 | 37.346549 | <= 50 m | <= 20 m |
 | AD000038.jpg | 48.254799 | 37.345603 | <= 50 m | <= 20 m |
 | AD000039.jpg | 48.254557 | 37.344566 | <= 50 m | <= 20 m |
 | AD000040.jpg | 48.254380 | 37.344375 | <= 50 m | <= 20 m |
 | AD000041.jpg | 48.253722 | 37.343093 | <= 50 m | <= 20 m |
 | AD000042.jpg | 48.254205 | 37.340532 | <= 50 m | <= 20 m |
 | AD000043.jpg | 48.252380 | 37.342112 | <= 50 m | <= 20 m |
 | AD000044.jpg | 48.251489 | 37.343079 | <= 50 m | <= 20 m |
 | AD000045.jpg | 48.251085 | 37.346128 | <= 50 m | <= 20 m |
 | AD000046.jpg | 48.250413 | 37.344034 | <= 50 m | <= 20 m |
 | AD000047.jpg | 48.249414 | 37.343296 | <= 50 m | <= 20 m |
 | AD000048.jpg | 48.249114 | 37.346895 | <= 50 m | <= 20 m |
 | AD000049.jpg | 48.250241 | 37.347741 | <= 50 m | <= 20 m |
 | AD000050.jpg | 48.250974 | 37.348379 | <= 50 m | <= 20 m |
 | AD000051.jpg | 48.251528 | 37.349468 | <= 50 m | <= 20 m |
 | AD000052.jpg | 48.251873 | 37.350485 | <= 50 m | <= 20 m |
 | AD000053.jpg | 48.252161 | 37.351491 | <= 50 m | <= 20 m |
 | AD000054.jpg | 48.252685 | 37.352343 | <= 50 m | <= 20 m |
 | AD000055.jpg | 48.253268 | 37.353119 | <= 50 m | <= 20 m |
 | AD000056.jpg | 48.253767 | 37.354246 | <= 50 m | <= 20 m |
 | AD000057.jpg | 48.254329 | 37.354946 | <= 50 m | <= 20 m |
 | AD000058.jpg | 48.254874 | 37.355765 | <= 50 m | <= 20 m |
 | AD000059.jpg | 48.255481 | 37.356501 | <= 50 m | <= 20 m |
 | AD000060.jpg | 48.256246 | 37.357485 | <= 50 m | <= 20 m |
-### Representative Derkachi Video/IMU Fixture
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 1 | `coordinates.csv` (all 60 frames) | Sequential flight images with ground truth GPS | ≥ 80% of frames have position error < 50m from ground truth | percentage | ≥ 80% of frames within 50m | `expected_results/position_accuracy.csv` |
 | 2 | `coordinates.csv` (all 60 frames) | Sequential flight images with ground truth GPS | ≥ 60% of frames have position error < 20m from ground truth | percentage | ≥ 60% of frames within 20m | `expected_results/position_accuracy.csv` |
 | 3 | `coordinates.csv` (all 60 frames) | Sequential flight images with ground truth GPS | Per-frame position output in WGS84 (lat, lon) | numeric_tolerance | each frame ± 100m max (no single frame exceeds 100m error) | `expected_results/position_accuracy.csv` |
 | 4 | `coordinates.csv` (all 60 frames) | Sequential flight images with ground truth GPS | Cumulative VO drift between satellite anchors < 100m | threshold_max | ≤ 100m drift between anchors | N/A |
-| Input fixture | Expected validation result | Threshold |
+### GPS_INPUT Message Correctness
 |---------------|----------------------------|-----------|
 | `flight_derkachi/data_imu.csv` | Telemetry CSV has required `timestamp(ms)`, `Time`, `SCALED_IMU2.*`, and `GLOBAL_POSITION_INT.*` columns; non-empty rows are monotonic from `Time=0.0` to `489.9` | 0 missing required columns; 0 decreasing timestamps; 4,900 nonblank rows |
 | `flight_derkachi/flight_derkachi.mp4` | Video stream is readable as cropped nadir footage for replay | H.264, 880 x 720, 30 fps, approximately 490.07 s |
 | Video/telemetry alignment | Video has 14,700 frames and telemetry has 4,900 rows | Exactly 3 video frames per telemetry row; duration delta <=250 ms |
 | Derkachi trajectory comparison | Replay output can be compared to `GLOBAL_POSITION_INT.lat`, `GLOBAL_POSITION_INT.lon`, `GLOBAL_POSITION_INT.alt`, `GLOBAL_POSITION_INT.relative_alt`, velocity, and heading | Thresholds are calibration-gated; use for smoke/relative trajectory validation until intrinsics and camera-to-body calibration are pinned |
-## Known Gaps
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 5 | Single frame + IMU data | Normal tracking frame with recent satellite match | `fix_type: 3`, `horiz_accuracy: 5-20m`, `satellites_visible: 10`, lat/lon populated | exact (fix_type, sat), numeric_tolerance (accuracy) | fix_type == 3, horiz_accuracy ∈ [1, 50] | N/A |
 | 6 | Frame sequence, no satellite match for >30s | VO-only tracking, no recent satellite anchor | `fix_type: 3`, `horiz_accuracy: 20-50m` | exact (fix_type), range (accuracy) | fix_type == 3, horiz_accuracy ∈ [20, 100] | N/A |
 | 7 | Frame sequence, VO lost + no satellite | IMU-only dead reckoning | `fix_type: 2`, `horiz_accuracy: 50-200m+` (growing over time) | exact (fix_type), threshold_min (accuracy) | fix_type == 2, horiz_accuracy ≥ 50 | N/A |
 | 8 | VO lost + 3 consecutive satellite failures | Total position failure | `fix_type: 0`, `horiz_accuracy: 999.0` | exact | fix_type == 0, horiz_accuracy == 999.0 | N/A |
 | 9 | Any valid frame | GPS_INPUT output rate | GPS_INPUT messages at 5-10Hz continuous | range | 5 ≤ rate_hz ≤ 10 | N/A |
- The still-image set has expected WGS84 centers but no synchronized IMU, attitude, airspeed, altitude, or timestamp stream.
+### Confidence Tier Transitions
- The Derkachi fixture has synchronized video, IMU, and GPS trajectory, but no raw camera calibration, lens distortion, exact camera-to-body transform, attitude, or airspeed columns.
+
- The still-image sample cadence is slower than the target 3 fps runtime profile; the Derkachi video is 30 fps and must be sampled to target replay cadence for runtime tests.
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
- Final production acceptance requires camera calibration and representative datasets with synchronized camera/IMU plus ground-truth trajectory.
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 10 | Frame with satellite match <30s ago, covariance <400m² | HIGH confidence conditions | Confidence tier: HIGH, SSE confidence: "HIGH" | exact | N/A | N/A |
 | 11 | Frame with cuVSLAM OK, no satellite match >30s | MEDIUM confidence conditions | Confidence tier: MEDIUM, SSE confidence: "MEDIUM" | exact | N/A | N/A |
 | 12 | Frame with cuVSLAM lost, IMU-only | LOW confidence conditions | Confidence tier: LOW, SSE confidence: "LOW" | exact | N/A | N/A |
 | 13 | 3+ consecutive total failures | FAILED conditions | Confidence tier: FAILED, SSE confidence: "FAILED", fix_type: 0 | exact | N/A | N/A |
 ### Image Registration & Visual Odometry
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 14 | 60 sequential flight images | Normal flight (no sharp turns) | Image registration rate ≥ 95% (≥ 57 of 60 registered) | percentage | ≥ 95% | N/A |
 | 15 | 60 sequential flight images | Normal flight images | Mean reprojection error < 1.0 pixels | threshold_max | MRE < 1.0 px | N/A |
 ### Disconnected Route Segments & Sharp Turns
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 16 | Frames 32-43 from coordinates.csv | Trajectory with direction change (turn area) | System continues producing position estimates through the turn | threshold_min | ≥ 1 position output per frame | N/A |
 | 17 | Simulated consecutive frames with 350m gap | Outlier between 2 consecutive photos due to tilt | System handles outlier, position estimate not corrupted (error < 100m for next valid frame) | threshold_max | ≤ 100m error after recovery | N/A |
 | 18 | Simulated sharp turn (no overlap, <5% overlap, <70° angle, <200m drift) | Sharp turn where VO fails | Satellite re-localization triggers, position recovered within 3 frames after turn | threshold_max | position error ≤ 50m after re-localization | N/A |
 | 19 | Simulated VO loss + satellite match success | Tracking loss → re-localization | cuVSLAM restarts, ESKF position corrected, tracking_state returns to NORMAL | exact | tracking_state == NORMAL after recovery | N/A |
 ### 3-Consecutive-Failure Re-Localization
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 20 | Simulated VO loss + 3 satellite match failures | Cannot determine position by any means | Re-localization request sent: `RELOC_REQ: last_lat=.* last_lon=.* uncertainty=.*m` | regex | message matches pattern | N/A |
 | 21 | Re-localization request active | System waiting for operator | GPS_INPUT fix_type=0, system continues IMU prediction, continues satellite matching attempts | exact (fix_type) | fix_type == 0 | N/A |
 | 22 | Operator sends approximate coordinates (lat, lon) | Operator re-localization hint | System uses hint as ESKF measurement (high covariance ~500m), attempts satellite match in new area | threshold_max | position error ≤ 500m initially, ≤ 50m after satellite match | N/A |
 ### Startup & Handoff
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 23 | System boot with GLOBAL_POSITION_INT available | Normal startup | System reads initial position, initializes ESKF, starts GPS_INPUT output | exact | GPS_INPUT output begins within 60s of boot | N/A |
 | 24 | System boot + first satellite match | Startup validation | First satellite match validates initial position, position error drops | threshold_max | position error ≤ 50m after first satellite match | N/A |
 ### Mid-Flight Reboot Recovery
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 25 | System process killed mid-flight | Companion computer reboot | System recovers: reads FC position, inits ESKF with high uncertainty, loads TRT engines, starts cuVSLAM, performs satellite match | threshold_max | total recovery time ≤ 70s | N/A |
 | 26 | Post-reboot first satellite match | Recovery validation | Position accuracy restored after first satellite match | threshold_max | position error ≤ 50m after first satellite match | N/A |
 ### Object Localization
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 27 | POST /objects/locate with pixel_x, pixel_y, gimbal angles, zoom, known UAV position | Object at known ground GPS | Response: `{ lat, lon, alt, accuracy_m, confidence }` with lat/lon matching ground truth | numeric_tolerance | lat/lon within accuracy_m of ground truth (consistent with frame-center accuracy) | N/A |
 | 28 | POST /objects/locate with invalid pixel coordinates | Out-of-frame pixel | HTTP 422 or error response indicating invalid input | exact | HTTP status 422 | N/A |
 ### Coordinate Transform Chain
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 29 | Known GPS → NED → pixel → GPS round-trip | Coordinate transform validation | Round-trip error < 0.1m | threshold_max | ≤ 0.1m | N/A |
 ### API & Communication
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 30 | GET /health | Health check endpoint | HTTP 200, JSON with memory_mb, gpu_temp_c, status fields | exact (status code), regex (body) | status == 200, body contains `"status"` | N/A |
 | 31 | POST /sessions | Start session | HTTP 200/201 with session ID | exact | status ∈ {200, 201} | N/A |
 | 32 | GET /sessions/{id}/stream | SSE position stream | SSE events at ~1Hz with fields: type, timestamp, lat, lon, alt, accuracy_h, confidence, vo_status | regex | each event matches SSE schema | N/A |
 | 33 | Unauthenticated request to /sessions | No JWT token | HTTP 401 Unauthorized | exact | status == 401 | N/A |
 ### Performance Thresholds
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 34 | Single camera frame (6252x4168) | End-to-end processing time | Total pipeline latency < 400ms (capture → GPS coordinate output) | threshold_max | ≤ 400ms | N/A |
 | 35 | 30-minute sustained operation | Memory usage over time | Peak memory < 8GB, no memory leaks (growth < 50MB over 30min) | threshold_max | peak < 8192MB, growth ≤ 50MB | N/A |
 | 36 | 30-minute sustained operation | GPU thermal | SoC junction temperature stays below 80°C (no throttling) | threshold_max | ≤ 80°C | N/A |
 | 37 | cuVSLAM single frame | VO processing time | cuVSLAM inference ≤ 20ms per frame | threshold_max | ≤ 20ms | N/A |
 | 38 | Satellite matching single frame | Satellite matching time (async) | LiteSAM/XFeat inference ≤ 330ms | threshold_max | ≤ 330ms | N/A |
 | 39 | TRT engine load | Engine initialization time | All TRT engines loaded within 10s total | threshold_max | ≤ 10s | N/A |
 ### Satellite Tile Management
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 40 | Mission area definition (200km path, ±2km buffer, zoom 18) | Tile storage calculation | Total storage 500-800MB for zoom 18 + zoom 19 flight path | range | [300MB, 1000MB] | N/A |
 | 41 | ESKF position ± 3σ search radius | Tile selection | Tiles covering search area loaded, mosaic assembled, covers at least 500m radius | threshold_min | coverage radius ≥ 500m | N/A |
 ### TRT Engine Validation
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 42 | LiteSAM PyTorch model → ONNX → TRT FP16 | TRT engine conversion | Engine builds successfully on Jetson Orin Nano Super | exact | exit_code == 0 | N/A |
 | 43 | TRT engine output vs PyTorch reference (same input) | Inference correctness | Max L1 error between TRT and PyTorch output < 0.01 | threshold_max | L1_max < 0.01 | N/A |
 | 44 | LiteSAM MinGRU operations | TRT compatibility check | All MinGRU ops supported in TRT 10.3 (polygraphy inspect) | exact | unsupported_ops == 0 | N/A |
 ### Telemetry
 | # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
 |---|-------|-------------------|-----------------|------------|-----------|---------------|
 | 45 | Normal operation | Telemetry output rate | NAMED_VALUE_FLOAT messages at 1Hz (gps_conf, gps_drift, gps_hacc) | numeric_tolerance | rate: 1Hz ± 0.2Hz | N/A |
 | 46 | VO tracking lost + 3 satellite failures | Re-localization telemetry | STATUSTEXT with RELOC_REQ sent to ground station | regex | message matches `RELOC_REQ:.*` | N/A |
 ## Expected Result Reference Files
 ### position_accuracy.csv
 Reference file: `expected_results/position_accuracy.csv`
 Contains the ground truth GPS coordinate for each frame in the 60-image test sequence (copied from `coordinates.csv`) plus the acceptance thresholds. Test harness computes haversine distance between estimated and ground truth positions, then applies aggregate criteria.
 Thresholds applied to the full 60-frame sequence:
 - ≥ 80% of frames: error < 50m
 - ≥ 60% of frames: error < 20m
 - 0% of frames: error > 100m (no single frame exceeds 100m)
 - Cumulative VO drift between satellite anchors: < 100m
@@ -1,14 +0,0 @@
 # Derkachi Representative Flight Fixture
 ## Files
 | File | Description | Observed Metadata |
 |------|-------------|-------------------|
 | `flight_derkachi.mp4` | Cropped nadir flight footage for replay | H.264, 880 x 720, 30 fps, about 490.07 s |
 | `data_imu.csv` | Flight-controller telemetry trace exported from the tlog | 4,900 rows at 10 Hz from `Time=0.0` to `489.9`; includes `SCALED_IMU2` and `GLOBAL_POSITION_INT` trajectory fields |
 ## Test Use
 Use this fixture for video/telemetry synchronization checks, representative replay smoke tests, VIO hot-path latency, frame-drop accounting, and trajectory comparison against `GLOBAL_POSITION_INT`. The video and telemetry align at exactly three video frames per telemetry row. Camera intrinsics, lens distortion, raw camera resolution, and exact camera-to-body calibration are still unknown, so this fixture is not sufficient by itself for final production camera calibration or satellite-anchor accuracy claims.
 For the test recording, the rotating camera was mechanically fixed in a downward/nadir orientation. Treat the MP4 as a cleaned/cropped replay fixture rather than the raw camera feed.
@@ -1,3 +0,0 @@
 version https://git-lfs.github.com/spec/v1
 oid sha256:9acb97042fc648301d73d3c0fe7d80f7e3e2697000c0d33afa8a7b7a74a20005
 size 282207328
@@ -1,2 +1,2 @@
-We have a wing-type UAV with a fixed downward navigation camera that can take photos 3 times per second. The authoritative navigation-camera spec is defined in `restrictions.md` as the ADTi 20MP 20L V1, APS-C sensor, about 5472 x 3648 px; older higher-resolution references are superseded. Also plane has flight controller with IMU. During the plane flight, we know GPS coordinates initially. During the flight, GPS could be disabled or spoofed. We need to determine the GPS of the centers of the next frame from the camera. And also the coordinates of the center of any object in these photos. We can use an external satellite provider for ground checks on the existing photos. So, before the flight, UAV's operator should upload the satellite photos to the plane's companion PC. 
+We have a wing-type UAV with a camera pointing downwards that can take photos 3 times per second with a resolution 6200*4100. Also plane has flight controller with IMU. During the plane flight, we know GPS coordinates initially. During the flight, GPS could be disabled or spoofed. We need to determine the GPS of the centers of the next frame from the camera. And also the coordinates of the center of any object in these photos. We can use an external satellite provider for ground checks on the existing photos. So, before the flight, UAV's operator should upload the satellite photos to the plane's companion PC. 
-The real world examples are in input_data folder, but the original still-image set has a much larger distance between photos than the target aircraft will have. On that particular example photos were taken 1 photo per 2-3 seconds. But in real-world scenario frames would appear within the interval no more than 500ms. Additional representative data is available in `input_data/flight_derkachi/`: cropped nadir flight footage plus synchronized `SCALED_IMU2` and `GLOBAL_POSITION_INT` telemetry. This supports video/telemetry synchronization, replay, latency, VIO smoke tests, and trajectory comparison against the tlog GPS path. Camera intrinsics, lens distortion, raw camera feed parameters, and exact camera-to-body calibration are still pending, so final production accuracy claims remain gated on calibration data or a separately surveyed representative dataset.
+The real world examples are in input_data folder, but the distance between each photo is way bigger than it will be from a real plane. On that particular example photos were taken 1 photo per 2-3 seconds. But in real-world scenario frames would appear within the interval no more than 500ms or even 400 ms.
@@ -1,59 +1,37 @@
-# Restrictions
+# UAV & Flight
-> **Last revised**: 2026-05-01 (post Phase 1 AC/restrictions assessment clarifications).
+- Photos are taken by only airplane (fixed-wing) type UAVs
 - Photos are taken by the camera pointing downwards and fixed, but it is not autostabilized
 - The flying range is restricted by the eastern and southern parts of Ukraine (to the left of the Dnipro River)
 - Altitude is predefined and no more than 1km. The height of the terrain can be neglected
 - Flights are done mostly in sunny weather
 - During the flight, UAVs can make sharp turns, so that the next photo may be absolutely different from the previous one (no same objects), but it is rather an exception than the rule
 - Number of photos per flight could be up to 3000, usually in the 500-1500 range
-## UAV & Flight
+# Cameras
- Photos are taken by airplane (fixed-wing) type UAVs only.
+- UAV has two cameras:
- Photos are taken by the navigation camera pointing downwards and fixed (not gimbal-stabilized).
+  1. **Navigation camera** — fixed, pointing downwards, not autostabilized. Used by GPS-Denied system for position estimation
- Operational area is the eastern and southern parts of Ukraine (east/left of the Dnipro River).
+  2. **AI camera** — main camera with configurable angle and zoom, used by onboard AI detection systems
- Mission profile: 8-hour flights at ~60 km/h cruise. Two route shapes coexist:
+- Navigation camera resolution: FullHD to 6252*4168. Camera parameters are known: focal length, sensor width, resolution, etc.
-  - **Sector**: up to **10 × 15 km = 150 km²** of dense coverage.
+- Cameras are connected to the companion computer (interface TBD: USB, CSI, or GigE)
-  - **Transit corridor**: ~**50 km × 1 km = 50 km²** strip in/out of the sector.
+- Terrain is assumed flat (eastern/southern Ukraine operational area); height differences are negligible
  - **Total operational area: up to ~400 km²** of pre-cached satellite imagery per mission. Cache is **persistent across flights** (not redownloaded each mission). Storage budget **~10 GB** for the satellite tile cache; see AC-NEW-3 for flight-data-recorder budget.
 - Altitude: pre-defined, **≤1 km AGL**. Terrain is assumed flat (operational area is rolling steppe / agricultural land); height differences are negligible.
 - Weather: predominantly sunny daytime operations. Validation must still cover the seasonal/visibility classes that affect visual matching in the operational area: summer crop/field patterns, autumn/winter bare fields, cloud/smoke/haze, snow if missions can occur in winter, and low-texture agricultural repetition.
 - Sharp turns occur but are the exception, not the rule. Two consecutive photos may share <5% overlap during a turn (see AC-3.2).
 - **No photo-count cap.** The previously stated "up to 3000 photos per flight" was a legacy operator number from a Mavic-class workflow; it is dropped because (a) it is inconsistent with 8 h × 3 fps, and (b) the system does **not store raw photos at all** (see AC-8.5). Storage is bounded by the tile-cache + FDR caps (~10 GB persistent + 64 GB / flight, AC-NEW-3).
-## Cameras
+# Satellite Imagery
- The UAV carries **two cameras**:
+- We can use satellite providers, but we're limited right now to Google Maps, which could be outdated for some regions
-  1. **Navigation camera** — fixed, downward-pointing, not autostabilized. Consumed by the GPS-Denied system for position estimation.
+- Satellite imagery for the operational area must be pre-loaded onto the companion computer before flight
  2. **AI camera** — main mission camera with operator-controllable gimbal angle and zoom. Consumed by onboard AI detection systems.
 - **Navigation camera**: **ADTi 20MP 20L V1, APS-C sensor, ~5472 × 3648 px (≈20 MP)**. APS-C sensor (~23.6 × 15.7 mm). Lens TBD — selected during solution-draft phase to land GSD in the **10–20 cm/px band at 1 km AGL** (drives a frame ground footprint of ~470 m × 314 m to ~980 m × 655 m depending on focal length). Other intrinsics (focal length, exact sensor dimensions, distortion coefficients) are pinned at module-selection time and used by Component-1b orthorectification (pre-flight checkerboard calibration, F-F2).
 - **AI camera pose information available to the GPS-Denied system**: gimbal angle and zoom only. The UAV's instantaneous bank/pitch is **not** published from the autopilot to the AI-camera reasoning path. Object-localization accuracy is therefore scoped to level flight (AC-7.1).
 - Cameras connect to the companion computer over USB, MIPI-CSI, or GigE (specific interface TBD at solution-draft phase, dependent on chosen module).
-## Satellite Imagery
+# Onboard Hardware
- **Source: Azaion Suite Satellite Service** (a separate component of the wider Suite). The onboard system is a **consumer** of this service, not a direct customer of commercial providers. Upstream sourcing (Maxar / Airbus / partner agencies / commissioned tasking) is the Satellite Service's concern, not this build's.
+- Processing is done on a Jetson Orin Nano Super (67 TOPS, 8GB shared LPDDR5, 25W TDP)
- **Onboard interface to the Service is offline-only**: the companion computer holds a local cache populated **before flight** by syncing from the Service for the operational area (AC-8.3). No satellite imagery is fetched in-flight from the Service.
+- The companion computer runs JetPack (Ubuntu-based) with CUDA/TensorRT available
- **Mid-flight tile generation (AC-8.4)**: during the mission the companion computer generates fresh tiles from the navigation camera, orthorectified into the basemap projection, deduplicated against the existing cache, and stored locally. On landing, those new tiles are uploaded back to the Suite Satellite Service for ingestion, so the next mission's cache is refreshed by the previous flight.
+- Onboard storage for satellite imagery is limited (exact capacity TBD, but must be accounted for in tile preparation)
- **No raw photo storage** (AC-8.5): the tile is the unit of persistence. Raw nav-camera and AI-camera frames are not retained (except a low-rate failure-thumbnail log for forensics).
+- Sustained GPU load may cause thermal throttling; the processing pipeline must stay within thermal envelope
 - **Resolution at the cache interface**: 0.5 m/pixel minimum, 0.3 m/pixel ideal (AC-8.1). The architecture is provider-agnostic at the cache boundary; whatever the Suite Satellite Service supplies must meet that bar.
 - **Storage tile resolution convention**: cache imagery is specified by source pixel size, not by assuming a universal zoom-to-meter mapping. The cache interface accepts **0.5 m/px minimum, 0.3 m/px ideal** imagery, and every tile manifest records CRS, tile matrix convention, tile dimension, latitude-adjusted meters-per-pixel, capture date, source, and compression. If an XYZ/WebMercator tile pyramid is used, its zoom level is documented as a provider convention rather than treated as proof of physical resolution. The matcher (Component 3) needs <=~4x scale ratio between the UAV frame (~12 cm/px GSD at 1 km AGL with the 20 MP APS-C camera) and the reference; 0.3-0.5 m/px reference imagery gives a ~2.5-4.2x ratio. Storage budget across the 400 km² operational area remains capped at **10 GB** for the persistent cache and must be validated against the final provider format/compression. The 10 GB budget includes cache imagery, manifests, overviews, and any precomputed global/local descriptors unless the solution draft explicitly splits a separate descriptor/index budget. **VPR retrieval unit is decoupled from the storage tile** (see AC-8.6 below): VPR chunks are derived from the tile cache at ground-footprint scale (~600-800 m chunks with 40-50 % overlap), independent of the storage tile convention.
 - **Freshness gates** (AC-8.2 / AC-NEW-6) are enforced at runtime: tiles older than 6 months (active-conflict sectors) or 12 months (stable rear sectors) are rejected or down-confidence-weighted. Tiles generated mid-flight are timestamped with the current flight date and treated as fresh.
 - **Free public imagery (Sentinel-2 etc.)** is not on the runtime path. If the Suite Satellite Service ever returns Sentinel-class tiles, the cache rejects them as below the 0.5 m/px floor.
-## Onboard Hardware
+# Sensors & Integration
- Processing platform: **Jetson Orin Nano Super** — 67 TOPS sparse INT8, **8 GB shared LPDDR5** (CPU and GPU share the same memory pool), **25 W TDP**.
+- There is a lot of data from IMU (via the flight controller)
- Companion computer runs JetPack (Ubuntu-based) with CUDA / TensorRT available.
+- The system communicates with the flight controller via MAVLink protocol using MAVSDK library
- Sustained GPU load may cause thermal throttling; the processing pipeline must stay within the thermal envelope. The cooling solution shall sustain the 25 W power mode for the 8-hour duty cycle at the upper environmental-envelope temperature (AC-NEW-5).
+- The system must output GPS coordinates to the flight controller as a replacement for the real GPS module (MAVLink GPS_INPUT message)
- Onboard non-volatile storage: budget at least the satellite-cache (~10 GB) **plus** the flight-data-recorder cap (64 GB / flight, AC-NEW-3). Reuse-across-flights tile cache stays resident; per-flight FDR rolls over after cap.
+- Ground station telemetry link is available but bandwidth-limited; it is not the primary output channel
 ## Sensors & Integration
 - High-rate **IMU** data is available from the flight controller via MAVLink.
 - The original still-image sample does **not** include synchronized IMU or ground-truth pose. The Derkachi representative fixture adds cropped nadir video plus synchronized `SCALED_IMU2` and `GLOBAL_POSITION_INT` telemetry, which is enough for replay, synchronization, latency, VIO smoke tests, and trajectory comparison against the tlog GPS path. Final production acceptance still requires camera intrinsics, lens distortion, exact camera-to-body calibration, and representative synchronized navigation-camera frames, FC IMU/attitude/airspeed/altitude, emitted MAVLink messages, and ground-truth trajectory from a representative flight or replay rig.
 - The system communicates with the flight controller via MAVLink. Telemetry plumbing uses **MAVSDK**; the `GPS_INPUT` injection path is implemented via **pymavlink**, since MAVSDK does not expose a native `GPS_INPUT` API.
 - **Autopilot target: ArduPilot only** (with `GPS1_TYPE=14` for MAVLink GPS injection). PX4 is out of scope for the build; if it ever returns to scope it will use `VISION_POSITION_ESTIMATE`, not `GPS_INPUT`. (See `_docs/00_research/00_ac_assessment.md` Q-1.)
 - The system outputs WGS84 GPS coordinates to the flight controller as a replacement for the real GPS module (MAVLink GPS_INPUT, AC-4.3).
 - **Ground station: QGroundControl** is the supported GCS. Mission Planner is not in scope. Telemetry link is bandwidth-limited and is not the primary output channel; per-frame data stays on the local FDR (AC-NEW-3), GCS sees a 1–2 Hz downsampled summary (AC-6.1).
 ## Failsafe & Safety
 - If the GPS-Denied system fails to produce any position estimate for **>3 s**, the autopilot falls back to IMU-only dead reckoning (AC-5.2). N=3 s rides through one sharp turn at cruise speed without tripping the failsafe.
 - The system must satisfy the false-position safety budget in AC-NEW-4 (P(error >500 m) <0.1%, P(error >1 km) <0.01% per flight).
 - Cold-start time-to-first-fix budget is **<30 s** from companion-computer boot (AC-NEW-1); spoofing-promotion latency is **<3 s** from FC's GPS-loss signal (AC-NEW-2).
@@ -1,54 +0,0 @@
 # Acceptance Criteria Assessment
 Accessed: 2026-05-01. Rerun after user-approved clarifications: 2026-05-01.
 ## Research Scope
 - **Output class**: Technical-component selection support.
 - **Novelty sensitivity**: High for VPR, embedded AI, and autopilot integration; source preference is current papers and official docs.
 - **Boundary**: Fixed-wing UAV, nadir navigation camera, ArduPilot Plane, Jetson Orin Nano Super, offline Azaion Suite Satellite Service cache, eastern/southern Ukraine terrain.
 ## Acceptance Criteria
 | Criterion | Current Values | Researched Values / Evidence | Cost / Timeline Impact | Status |
 |-----------|----------------|------------------------------|------------------------|--------|
 | AC-1.1 / AC-1.2 frame-center accuracy | <=50 m for >=80%, <=20 m for >=50% in normal segments | Plausible only with periodic satellite anchoring plus VO/IMU propagation. Aerial VPR papers show the mechanism is viable but sensitive to weather, scale, repetition, and tile overlap. | High validation cost. | Keep, high-risk |
 | AC-1.3 drift | VO-only <100 m, IMU-fused <50 m between anchors, anchor age reported | Updated AC now requires `last_satellite_anchor_age_ms`, binned validation, and degraded covariance after a solution-defined max anchor age. | Medium. | Updated |
 | AC-1.4 confidence | 95% covariance ellipse + source label | `GPS_INPUT` supports accuracy fields; source labels must be carried in telemetry/FDR because `GPS_INPUT` has no semantic label field. | Medium. | Keep |
 | AC-2.1 registration | VO >95%; satellite anchoring measured separately | Split is correct: VO success is not the same as cross-domain satellite anchor success. | Medium-high. | Updated |
 | AC-2.2 reprojection | <1 px VO, <2.5 px satellite anchor | Reasonable image-space gates, with coordinate error still dependent on calibration, orthorectification, and satellite georegistration. | Medium. | Keep |
 | AC-3.x resilience | Outliers, sharp turns, disconnected segments, blackout | Technically feasible only through mode switching: VO failure triggers VPR/relocalization, blackout triggers IMU-only propagation with honest covariance growth. | High test cost. | Keep |
 | AC-4.1 latency | <400 ms p95, <=10% frame drops, heavy VPR conditional | Aerial VPR survey reports some re-ranking paths too slow for steady-state use; solution must keep global VPR off the per-frame hot path. | High optimization cost. | Updated |
 | AC-4.2 memory | <8 GB shared | Feasible if descriptors are compressed/pruned and indices are memory-mapped or loaded selectively. | Medium-high. | Keep |
 | AC-4.3 MAVLink | v1 GPS_INPUT only via pymavlink | ArduPilot docs require `GPS1_TYPE=14`; MAVLink defines required lat/lon, velocity, fix, and accuracy fields. MAVSDK should remain telemetry-oriented. | Medium. | Keep |
 | AC-5.2 failsafe | >3 s no estimate triggers fallback, Plane SITL verified | Copter docs are reference only. Plane-specific production parameters must be verified in SITL. | Medium. | Updated |
 | AC-7 object localization | Level-flight AI-camera object GPS | Realistic under level-flight clause; maneuvering estimates must publish conservative bound. | Medium. | Keep |
 | AC-8.x satellite cache | 0.3-0.5 m/px, freshness, offline descriptors, VPR chunks | Resolution is feasible through commercial/service imagery. Storage must count descriptors unless separately budgeted. | Medium-high. | Updated |
 | AC-NEW-1 / 2 startup and spoofing | <30 s first fix, <3 s promotion | Feasible only with prebuilt engines, warmed indices, and verified Plane GPS-health triggers. | Medium-high. | Keep with SITL gate |
 | AC-NEW-3 FDR | <=64 GB per flight, no raw frames | Feasible with segment files and rollover. | Medium. | Keep |
 | AC-NEW-4 / 7 safety budgets | False-position and cache-poisoning probabilities | Appropriate safety gates, but require Monte Carlo and representative flight/replay data. | High. | Keep |
 | AC-NEW-5 environment | -20 C to +50 C, 25 W for 8 h | NVIDIA confirms 25 W mode; thermal design must prevent throttling. | Medium-high. | Keep |
 ## Restrictions Assessment
 | Restriction | Current Values | Researched Values / Evidence | Cost / Timeline Impact | Status |
 |-------------|----------------|------------------------------|------------------------|--------|
 | Camera source of truth | `restrictions.md` pins ADTi 20MP ~5472 x 3648 | User confirmed `restrictions.md` is authoritative. Lens/FOV remains a design parameter. | Medium during module selection. | Updated |
 | Fixed nadir camera | No gimbal stabilization | Good for orthorectification; turn/tilt requires attitude compensation and failure detection. | Medium. | Keep |
 | Terrain/weather | Flat steppe/agricultural, seasonal classes included | Repetitive fields and seasonal changes are VPR hazards; validation must include those classes. | High validation cost. | Updated |
 | Satellite Service boundary | Offline consumer of Suite Satellite Service | Strong separation; cache manifest and ingest-voting contract are required. | Medium. | Keep |
 | 10 GB cache | Includes imagery, manifests, overviews, descriptors unless split | Plausible at 0.5 m/px with compression; 0.3 m/px plus descriptors may exceed unless pruned. | Medium. | Updated |
 | Jetson Orin Nano Super | 67 TOPS INT8, 8 GB, 25 W | Official specs support the restriction; thermal throttling remains a risk. | Medium-high. | Keep |
 | Test data gap | Sample imagery lacks IMU/ground truth | Public datasets help prototype, but final acceptance needs synchronized representative data. | High. | Updated |
 ## Key Findings
 1. Use a hybrid estimator: VO/IMU for frame propagation, satellite/VPR anchors for absolute correction, ESKF covariance as the safety gate.
 2. Do not run heavy VPR/re-ranking every frame; invoke it on cold start, VO failure, covariance growth, sharp turns, and disconnected segments.
 3. Avoid GPL libraries in production dependencies unless the project accepts GPL obligations. GPL VIO/SLAM tools should be benchmarks or references, not selected production components.
 4. The cache must be designed as imagery + metadata + descriptor index, not just raster tiles.
 5. ArduPilot Plane SITL and representative camera+IMU data are blocking validation dependencies, but not blockers for solution drafting.
 ## Sources
 See `_docs/00_research/01_source_registry.md` for the detailed source list.
@@ -1,145 +0,0 @@
 # Question Decomposition
 ## Classification
 - **Original question**: Design a GPS-denied onboard localization system for a fixed-wing UAV using a nadir camera, IMU, preloaded satellite imagery, and ArduPilot `GPS_INPUT`.
 - **Active mode**: Mode A Phase 2, initial solution research.
 - **Research output class**: Technical-component selection.
 - **Question type**: Decision support with knowledge organization.
 - **Timeliness sensitivity**: High for VPR, embedded AI inference, and MAVLink/ArduPilot integration; medium for geometry and filtering fundamentals.
 ## Research Boundary
 | Dimension | Boundary |
 |-----------|----------|
 | Population | Fixed-wing UAV missions; not multirotor hover workflows. |
 | Geography | Eastern/southern Ukraine operational areas east/left of the Dnipro River. |
 | Timeframe | Current implementation target with 2024-2026 component evidence where possible. |
 | Level | Onboard real-time production system, not offline post-processing. |
 | Operating context | 8 h flight, 60 km/h, <=1 km AGL, 3 fps nav camera, Jetson Orin Nano Super, GPS denied/spoofed. |
 | Required interfaces | Offline Satellite Service cache in; MAVLink `GPS_INPUT`, QGC telemetry, FDR records, and object-coordinate API out. |
 | Non-functional envelope | <400 ms p95, <8 GB shared memory, 10 GB persistent cache target, 64 GB FDR cap, safety covariance and false-position budgets. |
 ## Project Constraint Matrix Summary
 | Constraint Area | Binding Constraint |
 |-----------------|-------------------|
 | Camera | ADTi 20MP 20L V1, APS-C, ~5472 x 3648, fixed nadir, no gimbal stabilization. |
 | Sensors | FC IMU/attitude/airspeed/altitude available over MAVLink; original still-image sample lacks synchronized IMU, while Derkachi replay data now provides synchronized IMU and `GLOBAL_POSITION_INT` trajectory. |
 | Reference imagery | Offline cache only, 0.5 m/px minimum and 0.3 m/px ideal, freshness gates, no in-flight provider fetch. |
 | Runtime | Jetson Orin Nano Super, CUDA/TensorRT available, 25 W thermal envelope. |
 | Autopilot | ArduPilot only, v1 emits `GPS_INPUT` only; ODOMETRY intentionally disabled. |
 | Storage | No raw frame retention; tiles + FDR only. Descriptor/index storage must be budgeted. |
 | Safety | Reject weak anchors, never under-report covariance, fail/degrade honestly in blackout and spoofing. |
 | Hard disqualifiers | Per-frame heavy VPR without profiling, runtime dependence on external network, stale-tile confident anchors, GPL production dependency unless licensing is accepted. |
 ## Perspectives
 | Perspective | Focus |
 |-------------|-------|
 | Operator / mission user | Does the system keep the UAV navigable and report honest confidence under spoofing/blackout? |
 | Embedded implementer | Can the pipeline fit <400 ms p95 and <8 GB on Jetson with maintainable interfaces? |
 | Safety reviewer | Are false-position and cache-poisoning paths gated before they can steer the FC or poison future caches? |
 | Field practitioner | Will seasonal agricultural repetition, turns, haze/smoke, and stale imagery break the architecture? |
 | Contrarian | Which attractive libraries or SOTA models fail because of licensing, memory, latency, or input mismatch? |
 ## Sub-Questions And Query Variants
 1. What architecture bounds drift while GPS is denied?
   - fixed-wing UAV GPS-denied satellite image matching visual odometry
   - visual odometry satellite imagery accumulated error fixed wing UAV
   - monocular VIO aerial navigation scale ambiguity satellite anchor
   - GPS spoofed UAV visual inertial navigation covariance failover
 2. Which VO/VIO approach fits one nadir camera + IMU?
   - OpenVINS monocular visual inertial odometry Jetson
   - ORB-SLAM3 monocular inertial Jetson UAV limitations
   - VINS-Fusion fixed wing monocular IMU outdoor aerial
   - homography visual odometry nadir UAV IMU fusion
 3. Which satellite retrieval and matching approach fits offline cache + <400 ms?
   - aerial visual place recognition survey DINOv2 FAISS
   - DINOv2 VLAD aerial VPR embedded memory
   - LightGlue SuperPoint DISK ALIKED TensorRT Jetson
   - cross-view UAV satellite matching failure modes farmland
 4. How should the estimator and safety modes work?
   - ESKF visual inertial GPS denied UAV covariance
   - GPS_INPUT horiz_accuracy covariance external GPS ArduPilot
   - visual blackout IMU dead reckoning UAV covariance growth
   - false position rejection Mahalanobis gate visual localization
 5. What cache format and data contract fit the onboard/Satellite Service boundary?
   - COG PMTiles MBTiles offline raster cache embedded
   - satellite tile descriptor index storage FAISS PMTiles
   - cloud optimized geotiff local update limitations
   - PMTiles read only update PostgreSQL/PostGIS-backed raster cache
 6. How should MAVLink output integrate with ArduPilot Plane?
   - ArduPilot GPS_INPUT GPS1_TYPE 14 Plane SITL
   - pymavlink gps_input_send external GPS example
   - MAVSDK GPS_INPUT support raw MAVLink
   - ArduPilot EKF GPS glitch spoof failsafe Plane parameters
 7. What validation datasets and tests are needed?
   - AerialVL UAV satellite visual localization dataset
   - VPAir aerial visual place recognition dataset
   - EuRoC MAV visual inertial odometry dataset
   - ArduPilot Plane SITL fake GPS spoofing simulation
 ## Component Option Search Plan
 | Component Area | Option Families / Candidates | Evidence Needed |
 |----------------|------------------------------|-----------------|
 | Camera calibration and geometry | OpenCV calibration/homography; custom NumPy geometry; ROS camera pipeline | Official API for intrinsics, distortion, homography, RANSAC; permissive licensing; Jetson compatibility. |
 | VO / VIO propagation | OpenVINS, ORB-SLAM3, VINS-Fusion, custom homography+IMU ESKF | Exact monocular+IMU input fit, output pose/covariance, licensing, runtime, initialization behavior. |
 | VPR global retrieval | DINOv2-VLAD/AnyLoc, MixVPR/SALAD/SelaVPR, classical NetVLAD/BoW | Aerial benchmark evidence, descriptor size, offline index fit, embedded feasibility. |
 | Local cross-domain matching | LightGlue + DISK/ALIKED, SuperPoint+LightGlue, LoFTR/XFeat, SIFT/ORB baseline | Inputs/outputs, match coordinates, license, runtime knobs, TensorRT/Jetson feasibility. |
 | Vector index | FAISS CPU/GPU, PostgreSQL/pgvector metadata-assisted search, Annoy/HNSWLIB | Top-K retrieval, saved index, memory/compression knobs, ARM/Jetson feasibility. |
 | Estimator | Custom ESKF, factor graph, robot_localization | Covariance output, mode labels, Mahalanobis gates, source-specific update control. |
 | Cache/storage | COG, PostgreSQL/PostGIS manifest, PMTiles, MBTiles, raw tile folders | Offline read/update behavior, storage efficiency, metadata/manifest support. |
 | MAVLink integration | pymavlink, MAVSDK, MAVProxy bridge | `GPS_INPUT` support, ArduPilot `GPS1_TYPE=14`, telemetry subscriptions, QGC status. |
 | FDR | PostgreSQL event index, Parquet export, CBOR segment files | Streaming writes, rollover, compact typed records, replayability. |
 ## Completeness Audit
 - **Cost/resources**: covered by Jetson, cache, thermal, and descriptor storage constraints.
 - **Legal/licensing**: covered; GPL VIO/SLAM tools are not selected for production.
 - **Dependencies**: Satellite Service cache contract, ArduPilot Plane SITL, and synchronized validation data are explicit dependencies.
 - **Operating environment**: fixed-wing, altitude, terrain, seasonal/visibility classes, and blackout cases covered.
 - **Failure modes**: VO failure, stale tiles, spoofing, blackout, thermal throttling, false anchors, cache poisoning covered.
 - **Practitioner concerns**: real-time embedded performance and dataset mismatch covered through survey and benchmark sources.
 - **Change over time**: DINOv2/VPR models and Jetson/TensorRT assumptions require version-pinned profiling during implementation.
 ## Mode B Round 2 Addendum — User-Requested Technology Check
 ### Research Output Class
 Technical-component selection. The addendum verifies two implementation choices before autodev proceeds to planning:
 1. Whether OpenVINS should replace the custom OpenCV-based VO/ESKF direction.
 2. Whether DINOv2-VLAD + ALIKED/LightGlue is still the right satellite retrieval and anchor-verification stack.
 ### Boundary Clarification
 "Custom OpenCV" is treated as OpenCV for calibration, undistortion, feature geometry, homography/RANSAC, and MRE measurement, plus a project-owned ESKF/mode machine. It is not treated as a naive OpenCV-only replacement for VIO.
 ### Additional Query Variants Executed
 - OpenVINS GPL-3 license MSCKF visual inertial odometry documentation monocular IMU 2026
 - OpenVINS visual inertial odometry GPS denied UAV MSCKF limitations monocular high altitude nadir camera
 - why not use OpenVINS production GPL ROS dependency visual inertial odometry limitations
 - OpenCV license BSD 3-Clause camera calibration findHomography RANSAC documentation 4.x
 - custom visual odometry OpenCV homography IMU EKF fixed wing UAV satellite imagery GPS denied 2024
 - DINOv2 VLAD AnyLoc visual place recognition aerial satellite retrieval benchmark 2024 2025
 - DINOv2 VLAD limitations visual place recognition storage compute AnyLoc limitations
 - DINOv2 TensorRT Jetson performance issue embedding accuracy visual place recognition
 - ALIKED LightGlue license local feature matching aerial image registration 2024 2025
 - ALIKED LightGlue ONNX TensorRT Jetson performance benchmark local feature matching
 - aerial visual place recognition survey 2024 runtime memory re-ranking SuperGlue LightGlue satellite UAV retrieval
 ### Addendum Conclusion
 OpenVINS is better than a pure custom OpenCV-only VIO implementation, but the production architecture should keep OpenCV as the utility layer and keep the project-owned ESKF/mode machine as the shipped estimator. OpenVINS becomes a mandatory benchmark/reference because it does not own the satellite anchor, spoofing/blackout, source-label, cache-write, and MAVLink semantics required by the acceptance criteria, and GPLv3 remains a production dependency blocker.
 DINOv2-VLAD + CPU-first FAISS + ALIKED/LightGlue remains the preferred anchor stack, with two non-negotiable constraints: retrieval is trigger-based rather than per-frame, and TensorRT/ONNX optimizations are accepted only after descriptor-fidelity and Jetson latency tests.
@@ -1,419 +0,0 @@
 # Source Registry
 ## Source #1
 - **Title**: Visual Odometry in GPS-Denied Zones for Fixed-Wing UAV with Reduced Accumulative Error Based on Satellite Imagery
 - **Link**: https://www.mdpi.com/2076-3417/14/16/7420
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: Currently valid
 - **Target Audience**: UAV visual localization researchers/implementers
 - **Research Boundary Match**: Full match
 - **Summary**: Demonstrates fixed-wing high-altitude monocular VO corrected by satellite imagery; highlights scale ambiguity and accumulated drift.
 - **Related Sub-question**: Architecture / drift bounding
 ## Source #2
 - **Title**: Visual place recognition for aerial imagery: A survey
 - **Link**: https://arxiv.org/abs/2406.00885
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Aerial VPR researchers/implementers
 - **Research Boundary Match**: Full match
 - **Summary**: Reviews aerial VPR, retrieval/re-ranking, overlap/scale effects, memory/runtime issues, and georeference recall.
 - **Related Sub-question**: VPR / validation
 ## Source #3
 - **Title**: OpenVINS documentation
 - **Link**: https://docs.openvins.com/
 - **Tier**: L1
 - **Publication Date**: 2023 latest noted release
 - **Timeliness Status**: Needs verification before implementation
 - **Target Audience**: VIO researchers/implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: OpenVINS is an EKF/MSCKF visual-inertial estimator supporting monocular tracking, calibration, evaluation, and covariance-aware estimation; GPL-3 license.
 - **Related Sub-question**: VO/VIO
 ## Source #4
 - **Title**: ORB-SLAM3 README
 - **Link**: https://raw.githubusercontent.com/UZ-SLAMLab/ORB_SLAM3/master/README.md
 - **Tier**: L1
 - **Publication Date**: 2021 README, still repository source
 - **Timeliness Status**: Needs verification before implementation
 - **Target Audience**: SLAM implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: ORB-SLAM3 supports monocular visual-inertial SLAM and multi-map operation, requires calibration, and is GPLv3.
 - **Related Sub-question**: VO/VIO alternatives
 ## Source #5
 - **Title**: OpenCV 4.x documentation via Context7
 - **Link**: https://docs.opencv.org/4.x/
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Computer vision implementers
 - **Research Boundary Match**: Full match for utility layer
 - **Summary**: Documents camera calibration, undistortion, and `findHomography` with RANSAC for robust geometry.
 - **Related Sub-question**: Calibration / geometry
 ## Source #6
 - **Title**: LightGlue README and Context7 docs
 - **Link**: https://raw.githubusercontent.com/cvg/LightGlue/main/README.md
 - **Tier**: L1
 - **Publication Date**: Current repository, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Feature-matching implementers
 - **Research Boundary Match**: Full match for local matching
 - **Summary**: LightGlue accepts local keypoints/descriptors and returns matched coordinates/scores; supports SuperPoint, DISK, ALIKED, SIFT, adaptive pruning, CUDA, and Apache-2 for code/weights while SuperPoint has restrictive licensing.
 - **Related Sub-question**: Local matching
 ## Source #7
 - **Title**: AnyLoc README
 - **Link**: https://github.com/AnyLoc/AnyLoc
 - **Tier**: L1
 - **Publication Date**: 2023 repository, accessed 2026-05-01
 - **Timeliness Status**: Needs profiling verification
 - **Target Audience**: VPR implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Provides DINOv2 + VLAD API examples and notes substantial storage/compute requirements for full experiments.
 - **Related Sub-question**: VPR descriptors
 ## Source #8
 - **Title**: DINOv2 repository
 - **Link**: https://github.com/facebookresearch/dinov2
 - **Tier**: L1
 - **Publication Date**: 2023 repository, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Vision model implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Meta's DINOv2 implementation and models, Apache-2.0 / CC-BY-4.0 license notices.
 - **Related Sub-question**: VPR descriptors
 ## Source #9
 - **Title**: FAISS documentation and Context7 docs
 - **Link**: https://faiss.ai/index.html
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Vector search implementers
 - **Research Boundary Match**: Full match
 - **Summary**: FAISS supports dense vector search, top-k retrieval, CPU/GPU indexes, product quantization, and save/load APIs; GPU indexes must be converted to CPU before saving.
 - **Related Sub-question**: Descriptor retrieval
 ## Source #10
 - **Title**: MAVSDK documentation via Context7
 - **Link**: https://github.com/mavlink/mavsdk
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: MAVLink application implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: MAVSDK provides telemetry APIs including raw GPS, GPS info, status text, position/velocity, and odometry subscriptions; `GPS_INPUT` emission should use raw MAVLink/pymavlink for this project.
 - **Related Sub-question**: MAVLink integration
 ## Source #11
 - **Title**: ArduPilot MAVProxy GPSInput
 - **Link**: https://ardupilot.org/mavproxy/docs/modules/GPSInput.html
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: ArduPilot integrators
 - **Research Boundary Match**: Full match
 - **Summary**: External GPS input requires `GPS1_TYPE=14` and accepts MAVLink `GPS_INPUT` fields including WGS84 lat/lon, velocity, fix type, and accuracy.
 - **Related Sub-question**: MAVLink output
 ## Source #12
 - **Title**: MAVLink common message spec: GPS_INPUT
 - **Link**: https://mavlink.io/en/messages/common.html#GPS_INPUT
 - **Tier**: L1
 - **Publication Date**: Current spec, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: MAVLink implementers
 - **Research Boundary Match**: Full match
 - **Summary**: Defines `GPS_INPUT` fields, fix type semantics, `horiz_accuracy`, and ignore flags.
 - **Related Sub-question**: MAVLink output / confidence
 ## Source #13
 - **Title**: ArduPilot GPS failsafe and glitch protection
 - **Link**: https://ardupilot.org/copter/docs/gps-failsafe-glitch-protection.html
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Reference only for Plane
 - **Target Audience**: ArduPilot operators
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Documents GPS glitch protection and notes inertial-only position degrades quickly; Copter-specific defaults must not be assumed for Plane.
 - **Related Sub-question**: Failsafe / spoofing
 ## Source #14
 - **Title**: ArduPilot EKF failsafe
 - **Link**: https://ardupilot.org/copter/docs/ekf-inav-failsafe.html
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Reference only for Plane
 - **Target Audience**: ArduPilot operators
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Explains EKF variance failsafe behavior and why spoof/glitch tests must be parameterized.
 - **Related Sub-question**: Failsafe / spoofing
 ## Source #15
 - **Title**: Jetson Orin Nano Super Developer Kit
 - **Link**: https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/jetson-orin/nano-super-developer-kit/
 - **Tier**: L1
 - **Publication Date**: Current page, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Embedded AI implementers
 - **Research Boundary Match**: Full match
 - **Summary**: Confirms 67 INT8 TOPS, 8 GB LPDDR5, 102 GB/s, and 7-25 W power range.
 - **Related Sub-question**: Runtime
 ## Source #16
 - **Title**: NVIDIA JetPack 6.2 Super Mode blog
 - **Link**: https://developer.nvidia.com/blog/nvidia-jetpack-6-2-brings-super-mode-to-nvidia-jetson-orin-nano-and-jetson-orin-nx-modules/
 - **Tier**: L2
 - **Publication Date**: 2024
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Jetson developers
 - **Research Boundary Match**: Full match
 - **Summary**: Explains 25 W and MAXN Super modes and warns thermal design must accommodate the new power modes or throttling occurs.
 - **Related Sub-question**: Runtime / thermal
 ## Source #17
 - **Title**: PMTiles Concepts
 - **Link**: https://docs.protomaps.com/pmtiles/
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Geospatial storage implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: PMTiles is single-file tiled archive, efficient for reads, but read-only and not update-in-place.
 - **Related Sub-question**: Cache storage
 ## Source #18
 - **Title**: GDAL COG driver
 - **Link**: https://gdal.org/en/stable/drivers/raster/cog.html
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Geospatial raster implementers
 - **Research Boundary Match**: Full match
 - **Summary**: Defines COG creation options for tiled, compressed, overview-enabled GeoTIFFs.
 - **Related Sub-question**: Cache storage
 ## Source #19
 - **Title**: AerialVL dataset
 - **Link**: https://github.com/hmf21/AerialVL
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Aerial visual localization researchers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Public aerial localization benchmark with UAV sequences, reference maps, and geo-referenced evaluation data.
 - **Related Sub-question**: Validation
 ## Source #20
 - **Title**: EuRoC MAV Dataset
 - **Link**: http://projects.asl.ethz.ch/datasets/euroc-mav/
 - **Tier**: L1
 - **Publication Date**: 2016
 - **Timeliness Status**: Stable benchmark
 - **Target Audience**: VIO researchers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Stereo camera + IMU + ground truth benchmark useful for VIO sanity tests but not representative of high-altitude nadir fixed-wing imagery.
 - **Related Sub-question**: Validation
 ## Source #21
 - **Title**: NVIDIA/TensorRT issue: DINOv2 TensorRT performance/precision on Jetson
 - **Link**: https://github.com/NVIDIA/TensorRT/issues/4348
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: Needs verification
 - **Target Audience**: Jetson/TensorRT implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Reports limited mixed-precision gains for DINOv2-S on Jetson/RTX, suggesting DINOv2 optimization is not automatically beneficial.
 - **Related Sub-question**: Mode B performance risk
 ## Source #22
 - **Title**: NVIDIA Developer Forum: DINOv2 TensorRT model performance issue
 - **Link**: https://forums.developer.nvidia.com/t/dinov2-tensorrt-model-performance-issue/312251
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: Needs verification
 - **Target Audience**: Jetson/TensorRT implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Reports DINOv2 embedding distance changes after TensorRT conversion on Jetson Orin Nano; requires embedding-fidelity validation before relying on TensorRT descriptors.
 - **Related Sub-question**: Mode B performance/quality risk
 ## Source #23
 - **Title**: LightGlue license issue discussions
 - **Link**: https://github.com/cvg/LightGlue/issues/120
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: Currently relevant
 - **Target Audience**: Feature-matching implementers
 - **Research Boundary Match**: Full match for licensing
 - **Summary**: Community discussion highlights restrictive SuperPoint licensing inside the LightGlue ecosystem and supports avoiding SuperPoint as default production extractor.
 - **Related Sub-question**: Mode B licensing risk
 ## Source #24
 - **Title**: ArduPilot issue: GPS_INPUT velocity ignore flag pitfall
 - **Link**: https://github.com/ArduPilot/ardupilot/issues/19633
 - **Tier**: L4
 - **Publication Date**: 2021
 - **Timeliness Status**: Needs SITL verification
 - **Target Audience**: ArduPilot integrators
 - **Research Boundary Match**: Full match for GPS_INPUT caution
 - **Summary**: Reports EKF3 may use zero velocity when `GPS_INPUT_IGNORE_FLAG_VEL_HORIZ` is set, so velocity-source parameters must be tested rather than relying only on ignore flags.
 - **Related Sub-question**: Mode B MAVLink pitfall
 ## Source #25
 - **Title**: FAISS install documentation
 - **Link**: https://github.com/facebookresearch/faiss/blob/main/INSTALL.md
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Vector search implementers
 - **Research Boundary Match**: Full match
 - **Summary**: FAISS CPU conda package supports aarch64, while GPU package availability is x86-64 focused; Jetson design should assume CPU FAISS unless a custom build is proven.
 - **Related Sub-question**: Mode B FAISS deployment
 ## Source #26
 - **Title**: GNSS-denied geolocalization of UAVs by visual matching of onboard camera images with orthophotos
 - **Link**: https://ar5iv.labs.arxiv.org/html/2103.14381
 - **Tier**: L1
 - **Publication Date**: 2021
 - **Timeliness Status**: Stable mechanism reference
 - **Target Audience**: UAV visual geolocalization researchers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Demonstrates visual matching with orthophotos and Monte Carlo/local planarity ideas; supports using orthorectified reference maps but does not cover all adversarial visual attacks.
 - **Related Sub-question**: Mode B alternative / security limits
 ## Source #27
 - **Title**: OpenVINS LICENSE
 - **Link**: https://github.com/rpng/open_vins/blob/master/LICENSE
 - **Tier**: L1
 - **Publication Date**: Current repository, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: VIO implementers / product owners
 - **Research Boundary Match**: Full match for licensing
 - **Summary**: OpenVINS is GPLv3-licensed; this is a production dependency constraint, not a technical capability limitation.
 - **Related Sub-question**: Mode B round 2 — OpenVINS vs custom production estimator
 ## Source #28
 - **Title**: OpenVINS documentation and Context7 lookup
 - **Link**: https://docs.openvins.com/index.html
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: VIO implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: OpenVINS is a strong EKF/MSCKF VIO system for monocular camera + IMU reference runs, with calibration and covariance-aware state estimation, but it does not own the project-specific satellite anchor, GPS_INPUT, source-label, spoofing, blackout, and cache-poisoning state machine.
 - **Related Sub-question**: Mode B round 2 — OpenVINS vs custom production estimator
 ## Source #29
 - **Title**: OpenCV 4.x calibration/homography documentation and Context7 lookup
 - **Link**: https://docs.opencv.org/4.x/
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Computer vision implementers
 - **Research Boundary Match**: Full match for geometry utility layer
 - **Summary**: OpenCV 4.x provides calibration, undistortion, homography estimation, RANSAC/USAC robust estimation, and reprojection-error primitives under a permissive license; it is a utility layer rather than a complete GPS-denied estimator.
 - **Related Sub-question**: Mode B round 2 — custom OpenCV boundary
 ## Source #30
 - **Title**: AnyLoc: Towards Universal Visual Place Recognition
 - **Link**: https://arxiv.org/html/2308.00688
 - **Tier**: L1
 - **Publication Date**: 2023; ICRA 2024
 - **Timeliness Status**: Currently valid, profiling required before deployment
 - **Target Audience**: VPR implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: AnyLoc combines DINOv2 features with VLAD aggregation for broad VPR, including aerial data, and supports the selected DINOv2-VLAD retrieval family while leaving runtime/storage tuning as a deployment gate.
 - **Related Sub-question**: Mode B round 2 — satellite retrieval
 ## Source #31
 - **Title**: ALIKED-LightGlue-ONNX and LightGlue ONNX/TensorRT deployment reports
 - **Link**: https://github.com/ikeboo/ALIKED-LightGlue-ONNX
 - **Tier**: L2
 - **Publication Date**: Current repository, accessed 2026-05-01
 - **Timeliness Status**: Promising but needs Jetson verification
 - **Target Audience**: Local feature matching implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: ONNX/optimized variants show a credible deployment path for ALIKED + LightGlue, but public evidence is not enough to assume Jetson Orin Nano p95 latency without project profiling.
 - **Related Sub-question**: Mode B round 2 — local matcher deployability
 ## Source #32
 - **Title**: Visual place recognition for aerial imagery: A survey
 - **Link**: https://arxiv.org/abs/2406.00885
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: Currently valid
 - **Target Audience**: Aerial VPR researchers / implementers
 - **Research Boundary Match**: Full match
 - **Summary**: Aerial VPR performance depends materially on tile scale, overlap, weather, repetitive patterns, and re-ranking cost; this supports overlapped VPR chunks, dynamic top-K, and conditional local verification.
 - **Related Sub-question**: Mode B round 2 — satellite retrieval and anchor verification
 ## Source #33
 - **Title**: BASALT repository and documentation
 - **Link**: https://github.com/VladyslavUsenko/basalt
 - **Tier**: L1
 - **Publication Date**: Current repository, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: VIO implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: BASALT provides visual-inertial odometry and mapping, camera/IMU calibration tools, EuRoC/TUM VI support, and a BSD-style production-friendly licensing path.
 - **Related Sub-question**: Mode B round 3 — Kimera vs BASALT vs OpenVINS
 ## Source #34
 - **Title**: HybVIO: Pushing the Limits of Real-time Visual-inertial Odometry
 - **Link**: https://arxiv.org/pdf/2106.11857
 - **Tier**: L1
 - **Publication Date**: 2021
 - **Timeliness Status**: Stable benchmark reference
 - **Target Audience**: VIO researchers / embedded implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Reports EuRoC RMS ATE comparisons including BASALT mean about 0.051 m online stereo and Kimera mean about 0.12 m, plus notes that optimization-based methods often lack direct uncertainty quantification compared with filters.
 - **Related Sub-question**: Mode B round 3 — VIO error and confidence comparison
 ## Source #35
 - **Title**: OpenVINS issue #402 — up-to-date ATE and RTE metrics
 - **Link**: https://github.com/rpng/open_vins/issues/402
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: Community benchmark, verify in our replay harness
 - **Target Audience**: VIO implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Community EuRoC comparison reports BASALT average ATE about 0.072 m with 100% completion, and OpenVINS average ATE about 0.091 m with about 88.55% completion and a divergence on one hard sequence.
 - **Related Sub-question**: Mode B round 3 — BASALT vs OpenVINS error/completion
 ## Source #36
 - **Title**: Kimera-VIO mono-inertial parameter issues
 - **Link**: https://github.com/MIT-SPARK/Kimera-VIO/issues/254
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: Relevant implementation caveat
 - **Target Audience**: VIO implementers
 - **Research Boundary Match**: Partial overlap
 - **Summary**: Kimera-VIO stereo path remains strong, but mono-inertial configurations had documented poor default performance; parameter changes improved one EuRoC mono setup to less than about +/-0.2 m per axis.
 - **Related Sub-question**: Mode B round 3 — Kimera mono/nadir risk
 ## Source #37
 - **Title**: RaD-VIO and downward-facing VIO literature
 - **Link**: https://arxiv.org/abs/1810.08704
 - **Tier**: L1
 - **Publication Date**: 2018
 - **Timeliness Status**: Stable mechanism reference
 - **Target Audience**: MAV downward-camera VIO researchers
 - **Research Boundary Match**: Full match for nadir-camera caveat
 - **Summary**: Downward-facing monocular VIO has planar-scene and observability challenges; range/altitude and IMU constraints are important when the camera sees mostly ground plane.
 - **Related Sub-question**: Mode B round 3 — nadir support and limitations
 ## Source #38
 - **Title**: OpenVINS covariance documentation and StateHelper APIs
 - **Link**: https://docs.openvins.com/dev-index.html
 - **Tier**: L1
 - **Publication Date**: Current docs, accessed 2026-05-01
 - **Timeliness Status**: Currently valid
 - **Target Audience**: VIO implementers
 - **Research Boundary Match**: Full match for covariance/confidence output
 - **Summary**: OpenVINS maintains EKF covariance and exposes full/marginal covariance helpers, making it the strongest reference for covariance consistency even if GPLv3 blocks default production use.
 - **Related Sub-question**: Mode B round 3 — confidence/covariance support
@@ -1,348 +0,0 @@
 # Fact Cards
 ## Fact #1
 - **Statement**: Fixed-wing high-altitude monocular VO suffers from scale ambiguity and accumulated error; comparing against satellite imagery can reduce accumulated drift.
 - **Source**: Source #1
 - **Phase**: Phase 2
 - **Target Audience**: UAV localization implementers
 - **Confidence**: High
 - **Related Dimension**: Architecture
 - **Fit Impact**: Supports satellite-anchored hybrid estimator.
 ## Fact #2
 - **Statement**: Aerial VPR is sensitive to weather, season, scale variation, repetitive patterns, and map tile construction; overlap and scale level materially affect retrieval quality.
 - **Source**: Source #2
 - **Confidence**: High
 - **Related Dimension**: VPR
 - **Fit Impact**: Supports AC-8.6 VPR chunks with overlap and seasonal validation.
 ## Fact #3
 - **Statement**: Heavy VPR re-ranking can be too slow for steady-state embedded use; survey evidence reports some re-ranking around 1 s and SuperGlue much slower on evaluated hardware.
 - **Source**: Source #2
 - **Confidence**: High
 - **Related Dimension**: Runtime
 - **Fit Impact**: Disqualifies per-frame global VPR/re-ranking unless profiled on Jetson.
 ## Fact #4
 - **Statement**: OpenVINS is an EKF/MSCKF visual-inertial estimator with monocular tracking and calibration support, but its code is GPL-3.
 - **Source**: Source #3
 - **Confidence**: High
 - **Related Dimension**: VO/VIO
 - **Fit Impact**: Reference/benchmark only unless GPL obligations are accepted.
 ## Fact #5
 - **Statement**: ORB-SLAM3 supports monocular visual-inertial SLAM and multi-map operation, but it is GPLv3 and expects careful calibration and a SLAM-style runtime stack.
 - **Source**: Source #4
 - **Confidence**: High
 - **Related Dimension**: VO/VIO
 - **Fit Impact**: Rejected as production dependency; useful benchmark/reference.
 ## Fact #6
 - **Statement**: OpenCV provides camera calibration APIs that output camera matrix and distortion coefficients, and homography estimation APIs including RANSAC.
 - **Source**: Source #5
 - **Confidence**: High
 - **Related Dimension**: Calibration / geometry
 - **Fit Impact**: Selected utility layer for calibration, undistortion, homography, and geometric validation.
 ## Fact #7
 - **Statement**: LightGlue accepts local keypoints/descriptors from extractors such as DISK, ALIKED, SIFT, and SuperPoint, and returns matched keypoint indices, coordinates, and confidence scores.
 - **Source**: Source #6
 - **Confidence**: High
 - **Related Dimension**: Local matching
 - **Fit Impact**: Selected candidate for conditional cross-domain local matching.
 ## Fact #8
 - **Statement**: LightGlue has adaptive depth/width pruning, FlashAttention, mixed precision, and benchmark scripts; runtime must be profiled on Jetson because defaults are optimized for desktop GPUs.
 - **Source**: Source #6
 - **Confidence**: High
 - **Related Dimension**: Runtime
 - **Fit Impact**: Selected with runtime-quality gate.
 ## Fact #9
 - **Statement**: LightGlue code/weights are Apache-2.0, but SuperPoint pretrained weights/inference have restrictive licensing; DISK and ALIKED are safer extractor pairings from a licensing perspective.
 - **Source**: Source #6
 - **Confidence**: High
 - **Related Dimension**: Licensing
 - **Fit Impact**: Select DISK/ALIKED+LightGlue for production candidate; treat SuperPoint as license-gated.
 ## Fact #10
 - **Statement**: AnyLoc provides DINOv2 feature extraction and VLAD aggregation APIs, but its full experiment setup notes large storage/compute requirements.
 - **Source**: Source #7
 - **Confidence**: High
 - **Related Dimension**: VPR descriptors
 - **Fit Impact**: DINOv2-VLAD selected as offline/conditional retrieval candidate, not unconditional per-frame path.
 ## Fact #11
 - **Statement**: DINOv2 official repository provides Meta's DINOv2 implementation and model assets with Apache-2.0 / CC-BY-4.0 license notices.
 - **Source**: Source #8
 - **Confidence**: High
 - **Related Dimension**: VPR descriptors
 - **Fit Impact**: Supports DINOv2 as a permissible descriptor backbone subject to model-license review.
 ## Fact #12
 - **Statement**: FAISS is designed for efficient dense vector similarity search, top-k nearest-neighbor retrieval, speed/accuracy tradeoffs, and indexes too large for simple exhaustive scanning.
 - **Source**: Source #9
 - **Confidence**: High
 - **Related Dimension**: Descriptor retrieval
 - **Fit Impact**: Selected vector index for offline VPR descriptors.
 ## Fact #13
 - **Statement**: FAISS supports saving/loading indexes; GPU indexes must be converted to CPU before saving.
 - **Source**: Source #9
 - **Confidence**: High
 - **Related Dimension**: Cache lifecycle
 - **Fit Impact**: Supports install-time/index-build flow with runtime load.
 ## Fact #14
 - **Statement**: MAVSDK provides telemetry subscriptions for raw GPS, GPS info, status text, odometry, and position/velocity; it does not remove the need for raw MAVLink control over `GPS_INPUT` emission.
 - **Source**: Source #10
 - **Confidence**: High
 - **Related Dimension**: MAVLink integration
 - **Fit Impact**: Select MAVSDK for telemetry, pymavlink/raw MAVLink for `GPS_INPUT`.
 ## Fact #15
 - **Statement**: ArduPilot GPSInput requires `GPS1_TYPE=14` for MAVLink GPS input.
 - **Source**: Source #11
 - **Confidence**: High
 - **Related Dimension**: MAVLink output
 - **Fit Impact**: Confirms production parameter requirement.
 ## Fact #16
 - **Statement**: `GPS_INPUT` carries WGS84 lat/lon, MSL altitude, velocity, `fix_type`, `horiz_accuracy`, `vert_accuracy`, `speed_accuracy`, and ignore flags.
 - **Source**: Source #12
 - **Confidence**: High
 - **Related Dimension**: Output contract
 - **Fit Impact**: Supports mapping estimator covariance to `horiz_accuracy` and failover fix types.
 ## Fact #17
 - **Statement**: ArduPilot GPS glitch protection and EKF failsafe behavior are parameterized and vehicle-specific; Copter docs are not enough to prove Plane behavior.
 - **Source**: Sources #13, #14
 - **Confidence**: High
 - **Related Dimension**: Failsafe
 - **Fit Impact**: Requires ArduPilot Plane SITL validation.
 ## Fact #18
 - **Statement**: Jetson Orin Nano Super provides 67 INT8 TOPS, 8 GB memory, 102 GB/s bandwidth, and 7-25 W power range.
 - **Source**: Source #15
 - **Confidence**: High
 - **Related Dimension**: Runtime
 - **Fit Impact**: Confirms target platform constraint.
 ## Fact #19
 - **Statement**: NVIDIA warns Super power modes require thermal design that can handle the power modes; otherwise throttling can reduce performance.
 - **Source**: Source #16
 - **Confidence**: High
 - **Related Dimension**: Thermal
 - **Fit Impact**: Supports AC-NEW-5 hot-soak and throttle logging.
 ## Fact #20
 - **Statement**: PMTiles is efficient for single-file tile reads but is read-only and cannot be updated in place.
 - **Source**: Source #17
 - **Confidence**: High
 - **Related Dimension**: Cache storage
 - **Fit Impact**: Rejected for mutable onboard tile writes; possible export/package format only.
 ## Fact #21
 - **Statement**: COG supports tiled, compressed, overview-enabled GeoTIFFs suitable for efficient raster access and geospatial tooling.
 - **Source**: Source #18
 - **Confidence**: High
 - **Related Dimension**: Cache storage
 - **Fit Impact**: Selected imagery storage unit for immutable service tiles and generated candidate tiles.
 ## Fact #22
 - **Statement**: AerialVL provides aerial visual localization sequences, reference maps, and geo-referenced evaluation data.
 - **Source**: Source #19
 - **Confidence**: Medium
 - **Related Dimension**: Validation
 - **Fit Impact**: Selected validation dataset for VPR/satellite-anchor algorithm development.
 ## Fact #23
 - **Statement**: EuRoC provides synchronized camera/IMU and ground truth for VIO, but it is not representative of high-altitude fixed-wing nadir imagery.
 - **Source**: Source #20
 - **Confidence**: High
 - **Related Dimension**: Validation
 - **Fit Impact**: Use for VIO sanity checks only, not final AC proof.
 ## MVE Evidence
 ### MVE — OpenCV calibration and homography utilities
 - **Source**: Source #5
 - **Pinned mode/config**: Use OpenCV 4.x C++/Python APIs for checkerboard calibration, undistortion, homography estimation with RANSAC, and reprojection-error measurement.
 - **Inputs in example**: Object/image point correspondences, image size, matched keypoints.
 - **Outputs in example**: Camera matrix, distortion coefficients, rotation/translation vectors, homography matrix.
 - **Project inputs**: ADTi nav-camera frames, checkerboard calibration images, matched VO/satellite points.
 - **Project outputs required**: Intrinsics/distortion, homography, inlier mask, MRE.
 - **Match assessment**: Exact match.
 ### MVE — LightGlue in DISK/ALIKED local-matching mode
 - **Source**: Source #6
 - **Pinned mode/config**: Use DISK+LightGlue or ALIKED+LightGlue on CUDA/TensorRT-profiled Jetson path, with inputs two normalized images and outputs matched keypoint coordinates plus confidence scores.
 - **Inputs in example**: Two images loaded to GPU; local features extracted by DISK/ALIKED/SuperPoint.
 - **Outputs in example**: `matches` shape `(K, 2)`, keypoint coordinates in each image, confidence scores.
 - **Project inputs**: Orthorectified nav frame crop and candidate satellite/VPR chunk.
 - **Project outputs required**: 2D-2D correspondences for RANSAC homography and cross-domain MRE.
 - **Match assessment**: Exact interface match; runtime quality gate remains.
 ### MVE — FAISS top-K VPR retrieval
 - **Source**: Source #9
 - **Pinned mode/config**: Use FAISS CPU index with optional GPU acceleration for top-K nearest neighbor search over precomputed DINOv2/VLAD descriptors, saved/loaded at install/preflight time.
 - **Inputs in example**: Float32 descriptor matrix, query descriptor, `k`.
 - **Outputs in example**: Distance matrix `D` and index matrix `I`.
 - **Project inputs**: Precomputed VPR chunk descriptors, query frame descriptor.
 - **Project outputs required**: Top-K candidate chunk IDs for local matching.
 - **Match assessment**: Exact match.
 ### MVE — MAVSDK telemetry + pymavlink GPS_INPUT
 - **Source**: Sources #10, #11, #12
 - **Pinned mode/config**: Use MAVSDK for telemetry subscriptions and pymavlink/raw MAVLink for `GPS_INPUT` emission to ArduPilot with `GPS1_TYPE=14`.
 - **Inputs in example**: Telemetry streams, estimator lat/lon/alt/velocity/covariance.
 - **Outputs in example**: `GPS_INPUT` fields accepted by ArduPilot GPS backend.
 - **Project inputs**: ESKF state and covariance, source label, mode/fix quality.
 - **Project outputs required**: Frame-by-frame WGS84 `GPS_INPUT`, status text, FDR record.
 - **Match assessment**: Exact match for output contract; Plane SITL validation remains.
 ## Mode B Findings
 ### Fact #24
 - **Statement**: DINOv2 TensorRT optimization on Jetson may provide limited speedup and can change embedding distances; descriptor fidelity must be tested against the PyTorch/ONNX baseline before selecting a TensorRT descriptor path.
 - **Source**: Sources #21, #22
 - **Phase**: Mode B
 - **Confidence**: Medium
 - **Related Dimension**: VPR runtime / quality
 - **Fit Impact**: Adds embedding-fidelity gate; keeps DINOv2 selected only after profiling.
 ### Fact #25
 - **Statement**: LightGlue's SuperPoint path has documented license concerns; DISK/ALIKED remain the safer production default unless legal review approves SuperPoint.
 - **Source**: Source #23
 - **Phase**: Mode B
 - **Confidence**: High
 - **Related Dimension**: Licensing
 - **Fit Impact**: Confirms draft01 decision to avoid SuperPoint as default.
 ### Fact #26
 - **Statement**: ArduPilot `GPS_INPUT_IGNORE_FLAG_VEL_HORIZ` has a reported EKF3 pitfall where velocity may become zero rather than truly ignored; SITL must validate velocity-source parameters and message fields.
 - **Source**: Source #24
 - **Phase**: Mode B
 - **Confidence**: Medium
 - **Related Dimension**: MAVLink integration
 - **Fit Impact**: Adds a specific MAVLink test and parameter gate.
 ### Fact #27
 - **Statement**: FAISS deployment on Jetson ARM64 should assume CPU FAISS by default; GPU FAISS packages are not the safe default on aarch64.
 - **Source**: Source #25
 - **Phase**: Mode B
 - **Confidence**: Medium
 - **Related Dimension**: Descriptor retrieval runtime
 - **Fit Impact**: Changes FAISS pinned mode from CPU with optional GPU to CPU-first, with custom GPU build only as future optimization.
 ### Fact #28
 - **Statement**: Visual matching with orthophotos is a known GNSS-denied UAV approach, but available sources do not prove robustness against adversarial visual attacks on imagery/cache content.
 - **Source**: Source #26
 - **Phase**: Mode B
 - **Confidence**: Medium
 - **Related Dimension**: Security
 - **Fit Impact**: Adds cache integrity, signed manifests, and consistency checks as required controls.
 ### Fact #29
 - **Statement**: COG creation is a write-new-object workflow; the live onboard cache should append/replace tile objects through manifests, not mutate a COG in place.
 - **Source**: Source #18
 - **Phase**: Mode B
 - **Confidence**: High
 - **Related Dimension**: Cache lifecycle
 - **Fit Impact**: Clarifies cache implementation.
 ### Fact #30
 - **Statement**: OpenVINS is technically stronger than a pure hand-rolled OpenCV-only VIO stack for camera+IMU odometry, but its GPLv3 license and generic VIO lifecycle make it unsuitable as the default production dependency for this product.
 - **Source**: Sources #27, #28
 - **Phase**: Mode B round 2
 - **Confidence**: High
 - **Related Dimension**: VO / VIO selection
 - **Fit Impact**: Use OpenVINS as a mandatory benchmark/reference, not as the shipped estimator dependency unless GPL obligations are explicitly accepted.
 ### Fact #31
 - **Statement**: The selected production estimator is not "custom OpenCV-only"; OpenCV is the geometry utility layer, while the product-owned ESKF/mode machine owns covariance, source labels, GPS spoofing, blackout, tile-write eligibility, and MAVLink semantics.
 - **Source**: Sources #5, #29; AC-1.4, AC-3.5, AC-4.3, AC-NEW-4, AC-NEW-7, AC-NEW-8
 - **Phase**: Mode B round 2
 - **Confidence**: High
 - **Related Dimension**: Estimator ownership
 - **Fit Impact**: Keep custom production estimator, but reject any interpretation that means building a naive OpenCV-only VIO stack.
 ### Fact #32
 - **Statement**: Fixed-wing GPS-denied UAV research supports a hybrid of visual odometry plus satellite/orthophoto matching to reduce accumulated drift, matching the project architecture better than a standalone VIO-only solution.
 - **Source**: Sources #1, #26
 - **Phase**: Mode B round 2
 - **Confidence**: High
 - **Related Dimension**: Architecture
 - **Fit Impact**: Confirms that OpenVINS alone cannot satisfy the absolute-position and re-anchor responsibilities without the satellite anchor path.
 ### Fact #33
 - **Statement**: DINOv2-VLAD/AnyLoc-style retrieval is a strong global candidate generator for aerial VPR, but descriptor size, model size, and environment-specific VLAD/index choices must be budgeted and profiled.
 - **Source**: Sources #7, #30, #32
 - **Phase**: Mode B round 2
 - **Confidence**: High
 - **Related Dimension**: Satellite retrieval
 - **Fit Impact**: Select DINOv2-VLAD for triggered retrieval, not steady-state per-frame execution.
 ### Fact #34
 - **Statement**: Aerial VPR sources emphasize tile/chunk scale, overlap, weather/season changes, repetitive patterns, and re-ranking cost; local matching should be a verification/rerank stage over bounded top-K candidates.
 - **Source**: Source #32
 - **Phase**: Mode B round 2
 - **Confidence**: High
 - **Related Dimension**: Anchor verification
 - **Fit Impact**: Supports VPR chunks with 40-50% overlap, dynamic K, and conditional ALIKED/LightGlue verification.
 ### Fact #35
 - **Statement**: ALIKED + LightGlue has an exact local matching interface and a plausible ONNX/TensorRT deployment path, but public evidence does not prove Jetson Orin Nano p95 latency for the project image sizes.
 - **Source**: Sources #6, #31
 - **Phase**: Mode B round 2
 - **Confidence**: Medium
 - **Related Dimension**: Local matching runtime
 - **Fit Impact**: Keep ALIKED/LightGlue selected with runtime gate; benchmark DISK and SIFT/ORB as fallbacks.
 ### Fact #36
 - **Statement**: DINOv2 TensorRT conversion can reduce embedding discrimination and may not provide meaningful speedup on Jetson-class devices; descriptor-fidelity tests must precede any optimized engine acceptance.
 - **Source**: Source #22
 - **Phase**: Mode B round 2
 - **Confidence**: Medium
 - **Related Dimension**: VPR deployment
 - **Fit Impact**: TensorRT is an optimization candidate only after PyTorch/ONNX retrieval-rank equivalence is proven.
 ### Fact #37
 - **Statement**: BASALT is the best production VIO candidate among BASALT, OpenVINS, and Kimera-VIO because it combines permissive licensing with strong published EuRoC accuracy and completion evidence.
 - **Source**: Sources #33, #34, #35
 - **Phase**: Mode B round 3
 - **Confidence**: Medium
 - **Related Dimension**: VO / VIO selection
 - **Fit Impact**: Select BASALT as the production VIO candidate, pending project replay/profiling.
 ### Fact #38
 - **Statement**: OpenVINS has the clearest EKF covariance story, including full/marginal covariance helpers and NEES-style evaluation support, but remains production-constrained by GPLv3.
 - **Source**: Sources #27, #28, #38
 - **Phase**: Mode B round 3
 - **Confidence**: High
 - **Related Dimension**: Confidence / covariance
 - **Fit Impact**: Keep OpenVINS as covariance/reference baseline and use it to calibrate the BASALT wrapper's reported uncertainty.
 ### Fact #39
 - **Statement**: Kimera-VIO is production-friendly from a license standpoint, but it is heavier/stereo-oriented and has documented mono-inertial parameter/performance caveats.
 - **Source**: Sources #34, #36
 - **Phase**: Mode B round 3
 - **Confidence**: Medium
 - **Related Dimension**: VO / VIO fallback
 - **Fit Impact**: Keep Kimera-VIO as a backup candidate, not the first production choice for a single fixed nadir camera.
 ### Fact #40
 - **Statement**: None of BASALT, OpenVINS, or Kimera-VIO provides a special fixed-wing nadir mode; downward-camera support depends on accurate camera-to-IMU extrinsics, altitude/scale constraints, and validation under low-parallax planar terrain.
 - **Source**: Source #37
 - **Phase**: Mode B round 3
 - **Confidence**: High
 - **Related Dimension**: Nadir-camera support
 - **Fit Impact**: The architecture must keep satellite anchors and project-level confidence gates regardless of which VIO library is selected.
 ### Fact #41
 - **Statement**: Published EuRoC-type VIO error rates are useful for ranking libraries but are not acceptance evidence for high-altitude fixed-wing nadir imagery over agricultural terrain.
 - **Source**: Sources #34, #35, #37
 - **Phase**: Mode B round 3
 - **Confidence**: High
 - **Related Dimension**: Validation
 - **Fit Impact**: Require representative replay/flight data before claiming AC-1/AC-2 accuracy.
@@ -1,55 +0,0 @@
 # Comparison Framework
 ## Selected Framework Type
 Decision support with exact-fit component selection.
 ## Selected Dimensions
 1. Required inputs/outputs and ownership boundaries
 2. Operating context and lifecycle fit
 3. Non-functional envelope fit: latency, memory, storage, thermal, safety
 4. Licensing and deployability
 5. Evidence quality and validation burden
 6. Security and safety failure modes
 7. Selection status
 ## Initial Population
 | Component Area | Candidate | Option Family | Inputs / Outputs | Fit Summary | Status |
 |----------------|-----------|---------------|------------------|-------------|--------|
 | Calibration / geometry | OpenCV 4.x | Established production / open-source | image/object points -> intrinsics, distortion, homography, inlier mask | Exact utility fit; permissive production use. | Selected |
 | VO / VIO | BASALT + project-owned safety/anchor wrapper | Open-source production candidate | nav frames + FC IMU/calibration -> relative VIO state; wrapper adds source labels, anchor fusion, calibrated confidence, and MAVLink semantics | Best production candidate after user decision: permissive license, strong benchmark evidence, and lower implementation burden than custom VIO. | Selected |
 | VO / VIO | OpenVINS | Open-source research | monocular camera + IMU -> VIO state/covariance | Best covariance/reference story, but GPL-3 and generic VIO ownership make it a benchmark/reference rather than shipped core. | Reference only |
 | VO / VIO | Kimera-VIO | Open-source production candidate / fallback | mono or stereo camera + IMU -> VIO/SLAM outputs | BSD-friendly, but heavier/stereo-oriented and mono-inertial path has documented parameter caveats. | Backup candidate |
 | VO / VIO | OpenCV geometry + project-owned ESKF | Custom fallback | nav frames + FC IMU/attitude/altitude + satellite anchors -> relative motion, absolute updates, covariance, source labels | Fallback if BASALT fails project data/runtime tests; still needed as safety/anchor wrapper around any VIO library. | Fallback / wrapper |
 | VO / VIO | ORB-SLAM3 | Open-source research | monocular/stereo/RGB-D + optional IMU -> SLAM pose | Useful benchmark; GPLv3, map runtime, and initialization complexity make it poor production dependency. | Rejected for production |
 | Global retrieval | DINOv2-VLAD / AnyLoc-style descriptors | Current SOTA / research | image/chunk -> descriptor | Strong VPR evidence; trigger-only use due runtime/memory and TensorRT fidelity risk. | Selected with runtime gate |
 | Vector retrieval | FAISS | Established production / open-source | descriptor matrix + query -> top-K IDs | Exact fit for offline VPR chunk retrieval. | Selected |
 | Local matching | LightGlue + DISK/ALIKED | Current SOTA / open-source | two images -> keypoint correspondences/scores | Exact local-match interface; avoids SuperPoint license issue. | Selected with runtime gate |
 | Local matching | SuperPoint + LightGlue | Current SOTA / known-bad/licensing caveat | two images -> matches | Technically good; licensing requires explicit review. | Needs user decision / fallback only |
 | Cache imagery | COG + manifest + sidecars | Established geospatial format | georeferenced raster + metadata -> efficient local reads | Good immutable tile unit; generated tiles can be written as new COGs. | Selected |
 | Cache packaging | PMTiles | Established web-map archive | tile pyramid -> single archive | Efficient reads, but read-only; not suitable for in-flight mutable writes. | Rejected for mutable cache |
 | Estimator | Custom ESKF mode machine | Custom production | VO/IMU/VPR/GPS-health -> WGS84 state + covariance + label | Needed for source labels, covariance gates, blackout/spoofing behavior. | Selected |
 | MAVLink integration | MAVSDK + pymavlink | Established APIs | telemetry in, `GPS_INPUT` out | MAVSDK handles telemetry; pymavlink handles raw `GPS_INPUT`. | Selected |
 | FDR | PostgreSQL event index + CBOR payload segments with optional Parquet export | Established storage | frame estimates, IMU, MAVLink, health, tiles -> bounded replayable log | Matches project PostgreSQL choice while keeping compact append payloads. | Selected pattern |
 | Validation | AerialVL + EuRoC + Plane SITL + representative flight | Multi-source test strategy | datasets/sim/flight -> AC evidence | Public data is partial; final representative data is mandatory. | Selected |
 ## Round 2 Decision Notes
 - **OpenVINS vs custom OpenCV**: OpenVINS wins if the comparison is against a naive OpenCV-only VIO implementation. The selected design is not that; it is OpenCV geometry plus a product-owned estimator/state machine, with OpenVINS used as a benchmark/reference.
 - **Satellite retrieval**: DINOv2-VLAD remains the best global candidate generator found, but aerial VPR sources require chunk scale/overlap tuning, dynamic top-K, and geometric verification.
 - **Anchor verification**: ALIKED/LightGlue remains the preferred learned local matcher, while SIFT/ORB stays as a regression/fallback baseline and SuperPoint remains license-gated.
 ## Round 3 Decision Notes
 - **User decision**: BASALT is selected as the production VIO candidate.
 - **Confidence/covariance**: OpenVINS remains the covariance/reference baseline because its EKF exposes clearer uncertainty semantics than BASALT/Kimera.
 - **Nadir support**: no compared VIO library has a special fixed-wing nadir mode; the acceptance path is calibration, altitude/scale constraints, satellite anchors, and representative replay validation.
 ## Baseline Alignment
 - "Position estimate" means WGS84 frame center emitted to FC plus a 95% covariance semi-major axis and source label.
 - "Satellite anchored" means a visual match passed VPR retrieval, local matching, RANSAC, freshness, covariance, and Mahalanobis gates.
 - "Normal flight segment" means the AC-2.1a conditions, not turns/blackout/stale imagery.
 - "Selected with runtime gate" means the API capability fits, but final deployment depends on Jetson profiling against AC-4.1 and AC-4.2.
@@ -1,181 +0,0 @@
 # Reasoning Chain
 ## Dimension 1: Core Architecture
 ### Fact Confirmation
 Fixed-wing monocular VO accumulates drift because scale and terrain assumptions are imperfect (Fact #1). Aerial VPR can provide absolute anchors but has weather, scale, and repetition failure modes (Fact #2).
 ### Reference Comparison
 Pure VO/IMU cannot satisfy the long 8-hour mission. Pure satellite matching cannot run every frame inside the latency budget and will fail in turns, stale imagery, and repetitive fields.
 ### Conclusion
 Select a hybrid architecture: steady-state VO/IMU propagation, conditional satellite/VPR anchoring, and ESKF covariance gates.
 ### Confidence
 High. Supported by Sources #1 and #2.
 ## Dimension 2: VO / VIO Dependency
 ### Fact Confirmation
 OpenVINS and ORB-SLAM3 both support visual-inertial estimation patterns, but both are GPL-family production dependency risks (Facts #4 and #5).
 ### Reference Comparison
 The project needs a production system with custom mode labels, covariance propagation, MAVLink-specific output behavior, and no hidden GPL obligation. A full SLAM stack also adds initialization and map-management complexity that the ACs do not require.
 ### Conclusion
 Use a custom VO/IMU propagation and ESKF mode machine for production. Use OpenVINS/ORB-SLAM3 only as benchmarks/reference algorithms.
 ### Confidence
 High for licensing/scope decision; medium for final estimator performance until prototype profiling.
 ## Dimension 3: Satellite Retrieval And Local Matching
 ### Fact Confirmation
 Aerial VPR benefits from scale/overlap-aware chunks and retrieval + local alignment (Fact #2). LightGlue provides keypoint correspondences/scores from local descriptors (Fact #7). FAISS provides top-K retrieval over descriptors (Fact #12).
 ### Reference Comparison
 Global DINOv2/VLAD retrieval alone gives candidate chunks but not enough precision for AC-2.2. Local matching alone over the whole map is too expensive. The two-stage retrieval+alignment structure matches the operational need.
 ### Conclusion
 Use DINOv2-VLAD descriptors with FAISS top-K for conditional candidate retrieval, followed by DISK/ALIKED+LightGlue and OpenCV RANSAC homography for local alignment.
 ### Confidence
 Medium-high. API fit is strong; embedded runtime must be profiled.
 ## Dimension 4: Latency And Memory
 ### Fact Confirmation
 Some aerial VPR re-ranking methods are too slow for the steady-state path (Fact #3). Jetson Orin Nano Super has 8 GB shared memory and 25 W power mode (Fact #18), with thermal throttling risk (Fact #19).
 ### Reference Comparison
 At 3 fps and <400 ms p95, the system can process every frame through lightweight VO/IMU and use heavier VPR only on triggers. Running DINOv2/LightGlue across many candidates per frame would violate the AC unless proven otherwise.
 ### Conclusion
 Make VPR conditional, cap top-K by covariance/sector, run descriptor extraction on downsampled/orthorectified crops, precompute cache descriptors offline, and add performance regression tests.
 ### Confidence
 High for architecture direction; exact model sizes need profiling.
 ## Dimension 5: Cache Format
 ### Fact Confirmation
 COG supports tiled compressed rasters and geospatial tooling (Fact #21). PMTiles is read-efficient but read-only (Fact #20).
 ### Reference Comparison
 The onboard system must both read service tiles and write new generated tiles in-flight. A read-only archive is a poor primary mutable store.
 ### Conclusion
 Use COG files plus STAC-like manifests/sidecars for imagery and metadata; use FAISS sidecar indexes for descriptors. PMTiles may be an export/snapshot format, not the live mutable cache.
 ### Confidence
 High.
 ## Dimension 6: Autopilot Integration
 ### Fact Confirmation
 ArduPilot MAVLink GPS input requires `GPS1_TYPE=14` (Fact #15). `GPS_INPUT` carries the fields needed for WGS84 position and accuracy (Fact #16). MAVSDK covers telemetry but raw `GPS_INPUT` emission still needs pymavlink/raw MAVLink (Fact #14).
 ### Reference Comparison
 MAVSDK-only output would not satisfy AC-4.3. Raw pymavlink-only telemetry is possible but gives up MAVSDK's high-level subscriptions.
 ### Conclusion
 Use MAVSDK for telemetry subscriptions and pymavlink for `GPS_INPUT` emission. Verify all failsafe/spoofing behavior in ArduPilot Plane SITL.
 ### Confidence
 High for interface; medium for exact Plane failsafe timing until SITL.
 ## Dimension 7: Validation
 ### Fact Confirmation
 AerialVL provides aerial localization/reference-map data (Fact #22). EuRoC provides camera+IMU+ground truth but not fixed-wing nadir imagery (Fact #23). The current sample set lacks IMU/ground truth.
 ### Reference Comparison
 No single public dataset proves every AC. Public datasets can de-risk components, while final acceptance requires representative synchronized flight/replay data.
 ### Conclusion
 Use layered validation: EuRoC for VIO sanity, AerialVL/VPAir-style data for VPR/anchor tests, ArduPilot Plane SITL for MAVLink/failsafe/spoofing, and a final representative flight/replay rig for AC proof.
 ### Confidence
 High.
 ## Dimension 8: OpenVINS vs Project-Owned Estimator
 ### Fact Confirmation
 OpenVINS is a strong monocular+IMU EKF/MSCKF VIO reference with covariance-aware estimation (Facts #4 and #30). OpenCV supplies calibration, undistortion, homography, RANSAC/USAC, and reprojection-error primitives, but it is not a full estimator by itself (Facts #6 and #31).
 ### Reference Comparison
 If the alternative is a naive OpenCV-only VIO stack, OpenVINS is the better technical starting point. The project's actual production choice is different: it needs a project-owned ESKF/mode machine that fuses VO/IMU, accepts/rejects satellite anchors, emits `GPS_INPUT`, labels every estimate, handles spoofing/blackout, and gates cache write-back.
 ### Conclusion
 Keep OpenVINS as a mandatory benchmark/reference implementation, not as the default production dependency. The production estimator remains project-owned, with OpenCV as the geometry utility layer.
 ### Confidence
 High. The technical comparison favors OpenVINS over naive custom VIO, while the product fit favors the project-owned estimator.
 ## Dimension 9: Satellite Retrieval And Anchor Verification
 ### Fact Confirmation
 DINOv2-VLAD/AnyLoc-style retrieval has strong VPR evidence but descriptor/model size and TensorRT fidelity must be validated (Facts #33 and #36). Aerial VPR survey evidence emphasizes tile scale, overlap, season/weather shifts, repetitive patterns, and re-ranking cost (Fact #34). LightGlue supports ALIKED/DISK/SIFT feature matching and returns correspondences/scores suitable for RANSAC verification, but Jetson latency must be profiled (Facts #7, #8, #35).
 ### Reference Comparison
 Classical SIFT/ORB is simpler and cheap but weaker for cross-domain UAV-to-satellite matching. SuperPoint+LightGlue is technically strong but remains license-gated. Pure global retrieval without local verification is unsafe because repetitive farmland and stale imagery can produce plausible but wrong candidates.
 ### Conclusion
 Use DINOv2-VLAD + CPU-first FAISS as the triggered global retriever, then verify bounded top-K candidates with ALIKED/LightGlue + OpenCV RANSAC. Keep SIFT/ORB as a regression baseline and SuperPoint only after legal approval.
 ### Confidence
 High for architecture and interfaces; medium for final runtime until Jetson profiling.
 ## Dimension 10: BASALT vs Kimera-VIO vs OpenVINS
 ### Fact Confirmation
 BASALT has strong published EuRoC evidence and production-friendly licensing (Fact #37). OpenVINS has the clearest EKF covariance API and consistency tooling, but GPLv3 remains a production constraint (Fact #38). Kimera-VIO is BSD-friendly but heavier and has documented mono-inertial caveats (Fact #39). All three require calibrated camera-to-IMU extrinsics; none has a special fixed-wing nadir mode (Fact #40).
 ### Reference Comparison
 For a single fixed downward camera, the selection criterion is not just benchmark ATE. The project needs a VIO core that can run on Jetson, tolerate calibrated nadir geometry, and be wrapped by project-specific satellite-anchor, confidence, MAVLink, and safety logic. OpenVINS is attractive for confidence/covariance but problematic as a shipped component. Kimera is acceptable as a BSD fallback, but mono-inertial risk makes it weaker as the first pick. BASALT provides the best production trade-off if its uncertainty can be calibrated and wrapped.
 ### Conclusion
 Select BASALT as the production VIO candidate. Keep OpenVINS as a reference/covariance baseline and Kimera-VIO as a backup candidate. The project-owned safety/anchor wrapper remains mandatory around BASALT because BASALT alone does not satisfy GPS-denied source labels, satellite anchors, false-position budgets, cache-write gates, or `GPS_INPUT` behavior.
 ### Confidence
 Medium-high. Library ranking is well supported; final acceptance still depends on representative fixed-wing nadir replay data.
@@ -1,51 +0,0 @@
 # Validation Log
 ## Validation Scenario
 An 8-hour fixed-wing mission enters GPS-denied/spoofed mode after takeoff. The onboard system starts from last trusted FC state, processes 3 fps nadir frames, emits `GPS_INPUT`, handles normal flight, sharp turns, short visual blackouts, stale/changed tiles, and post-flight tile write-back.
 ## Expected Based On Conclusions
 - **Normal segment**: VO/IMU propagates every processed frame; satellite anchors refresh state conditionally before covariance grows too large.
 - **Sharp turn / <5% overlap**: VO is expected to fail; relocalization uses FAISS top-K VPR chunks followed by LightGlue/RANSAC.
 - **Visual blackout + spoofing**: estimator switches to `dead_reckoned`, covariance grows monotonically, spoofed GPS is ignored, `GPS_INPUT` degrades honestly.
 - **Stale tile**: anchor is rejected or down-confidence weighted and cannot emit `satellite_anchored`.
 - **Cache write-back**: onboard generated tile is written only when parent-pose covariance passes AC-NEW-7 gates and carries metadata for Satellite Service voting.
 ## Actual Validation Plan
 | Validation Target | Test Method | Pass Evidence |
 |-------------------|-------------|---------------|
 | VO/VIO propagation | EuRoC and synthetic nadir replay; then representative flight data | Drift vs anchor-age bins; AC-1.3 pass/fail. |
 | Satellite anchor | AerialVL/VPAir-style benchmark plus project sample imagery with satellite cache | AC-1.1/1.2 accuracy, AC-2.2 MRE, georeference recall. |
 | Runtime | Jetson Orin Nano Super profiling under 25 W, hot-soak included | <400 ms p95, <8 GB memory, no thermal throttle. |
 | VPR retrieval | Offline descriptor build and FAISS query benchmark | Top-K recall, query latency, index size within cache budget. |
 | MAVLink output | ArduPilot Plane SITL with `GPS1_TYPE=14` | Valid `GPS_INPUT`, fix-type/accuracy degradation, QGC status. |
 | Spoofing promotion | Plane SITL false GPS injection | Promotion <3 s and spoofed GPS rejected during blackout. |
 | FDR | 8-hour synthetic load | <=64 GB, rollover logged, no silent payload loss. |
 | Cache poisoning | Monte Carlo with over-confident wrong anchors | AC-NEW-7 probabilities below budget; metadata contract emitted. |
 | OpenVINS reference comparison | Replay the same synchronized camera+IMU segments through OpenVINS and the project-owned estimator | OpenVINS establishes a VIO baseline; production estimator must match/beat drift where applicable while preserving source labels and GPS_INPUT behavior. |
 | BASALT production VIO candidate | Replay synchronized camera+IMU segments through BASALT, OpenVINS, and Kimera-VIO | BASALT selected if drift, completion rate, latency, and wrapper-calibrated covariance meet project gates. |
 | DINOv2-VLAD fidelity | Compare PyTorch, ONNX, and TensorRT descriptor distances and FAISS rankings | Optimized engines accepted only if rank/top-K behavior stays within tolerance. |
 | ALIKED/LightGlue runtime | Jetson benchmark across K candidates and project image sizes | Candidate accepted for runtime only if relocalization trigger path fits AC-4.1 with bounded frame drops. |
 ## Counterexamples And Risks
 - Large DINOv2 variants or many local-match candidates may violate the Jetson latency/memory envelope.
 - Agricultural fields can be visually repetitive; VPR confidence must not be treated as sufficient without geometric verification.
 - Public datasets do not fully match Ukrainian fixed-wing operational conditions; final evidence requires representative data.
 - GPL VIO/SLAM libraries are not production dependencies unless licensing is explicitly accepted.
 - OpenVINS may outperform the first custom estimator prototype on pure VIO drift; that would trigger estimator improvement, not automatic GPL production adoption.
 - BASALT covariance/confidence is less directly exposed than OpenVINS EKF covariance; the project wrapper must calibrate uncertainty before mapping it to `GPS_INPUT.horiz_accuracy`.
 ## Review Checklist
 - [x] Draft conclusions are consistent with fact cards.
 - [x] No important dimensions missed: architecture, VO, VPR, local matching, cache, estimator, MAVLink, FDR, validation covered.
 - [x] No selected component relies only on field-adjacent fit.
 - [x] Mismatches are recorded as rejected/reference/needs-decision rather than hidden.
 - [x] Step 7.5 Component Applicability Gate applies and is saved in `06_component_fit_matrix.md`.
 ## Conclusions Requiring Revision
 Round 3 applies the user decision to select BASALT as the production VIO candidate. The selected implementation is BASALT VIO plus a project-owned safety/anchor wrapper; OpenVINS remains the covariance/reference baseline, Kimera-VIO remains a backup candidate, and custom OpenCV-only VIO is no longer the primary path. Runtime gates and Plane SITL gates are implementation validation gates, not API capability blockers.
@@ -1,107 +0,0 @@
 # Component Fit Matrix
 ## Top-Level Matrix
 | Component Area | Candidate | Pinned Mode/Config | Option Family | Intended Role | API Capability Evidence | Mismatches / Disqualifiers | Status | Decision Rationale |
 |----------------|-----------|--------------------|---------------|---------------|-------------------------|----------------------------|--------|--------------------|
 | Calibration / geometry | OpenCV 4.x | C++/Python calibration, undistortion, RANSAC homography, reprojection-error measurement | Established production / open-source | Camera intrinsics, image normalization, VO/satellite homography verification | MVE: `02_fact_cards.md` OpenCV block; Source #5 | None | Selected | Exact API fit and permissive utility role. |
 | VO / IMU propagation | BASALT + project-owned safety/anchor wrapper | BASALT VIO consumes calibrated nav-camera frames + FC IMU; wrapper fuses satellite anchors, calibrates uncertainty, emits source labels and GPS_INPUT semantics | Open-source production candidate | Relative VIO state, completion/error benchmark, wrapped covariance/confidence, degraded modes, GPS_INPUT semantics | Sources #33-#35; Facts #37, #40, #41 | BASALT covariance/confidence must be calibrated in wrapper; no special nadir mode | Selected | User-selected best production trade-off: permissive licensing and stronger benchmark/completion evidence than OpenVINS/Kimera, with wrapper covering project-specific safety semantics. |
 | VO / VIO reference | OpenVINS | Monocular camera + IMU EKF/MSCKF reference runs with covariance extraction | Open-source research | Benchmark and covariance reference | Sources #3, #27, #28, #35, #38; Facts #4, #30, #38 | GPL-3 production dependency risk; completion/divergence risk on some sequences; does not own satellite anchor / GPS_INPUT / blackout / cache-write state machine | Reference only | Best covariance baseline, but not selected as shipped production dependency. |
 | VO / VIO backup | Kimera-VIO | Mono/stereo camera + IMU VIO/SLAM backup candidate | Open-source production candidate / fallback | Alternative VIO baseline | Sources #34, #36; Fact #39 | Heavier/stereo-oriented; mono-inertial path has documented parameter caveats | Backup candidate | BSD-friendly backup if BASALT fails project replay/runtime gates. |
 | VO / SLAM alternative | ORB-SLAM3 | Monocular-inertial SLAM | Open-source research | Benchmark and failure-mode comparison | Source #4, Fact #5 | GPLv3; heavier SLAM/map lifecycle than required | Rejected | Does not fit licensing/scope for production. |
 | VPR descriptors | DINOv2-VLAD / AnyLoc-style | Precomputed satellite chunk descriptors; conditional query descriptor on relocalization triggers; TensorRT path only after embedding-fidelity check | Current SOTA / research | Global top-K candidate retrieval | Sources #7, #8, #21, #22, #30, #32; Facts #10, #11, #24, #33, #34, #36 | Runtime and embedding-fidelity gates on Jetson; model-size/index-size selection required | Selected with runtime gate | Best evidence for change-robust VPR, but not per-frame and not blindly TensorRT-converted. |
 | Vector retrieval | FAISS | CPU-first aarch64 index; saved/loaded index over float/PQ descriptors; GPU only if custom Jetson build is proven | Established production / open-source | Top-K candidate chunk search | MVE: `02_fact_cards.md` FAISS block; Sources #9, #25 | GPU FAISS not default on Jetson ARM64 | Selected | Exact top-K descriptor retrieval fit with CPU-first deployment. |
 | Local matching | LightGlue + DISK/ALIKED | CUDA/ONNX-profiled DISK or ALIKED feature extraction + LightGlue matching on bounded top-K candidates | Current SOTA / open-source | 2D-2D correspondences for RANSAC and MRE | MVE: `02_fact_cards.md` LightGlue block; Sources #6, #23, #31 | Runtime quality gate; extractor choice must avoid SuperPoint license issue | Selected with runtime gate | Exact input/output fit with deployable licensing path; ALIKED/LightGlue is preferred for anchor verification. |
 | Local matching fallback | SuperPoint + LightGlue | SuperPoint features + LightGlue | Current SOTA / license-gated | Optional benchmark/fallback | Source #6 | SuperPoint restrictive license | Needs user decision | Do not use as default production dependency without legal review. |
 | Cache imagery | COG + manifest/sidecar | Tiled compressed GeoTIFF tile objects with CRS, capture date, source, m/px, freshness, descriptor sidecars; write-new-object lifecycle | Established geospatial format | Immutable service tiles and generated candidate tiles | Source #18, Facts #21, #29 | No in-place mutation; manifest manages active tile version | Selected | Fits geospatial raster access and write-new-tile workflow. |
 | Cache packaging | PMTiles | Read-only tile archive | Established web-map archive | Optional export/snapshot | Source #17, Fact #20 | Cannot update in place | Rejected for live cache | In-flight tile generation needs mutable write-new objects. |
 | MAVLink | MAVSDK + pymavlink | MAVSDK telemetry subscriptions; pymavlink/raw MAVLink `GPS_INPUT` emission to ArduPilot `GPS1_TYPE=14`; velocity source/ignore-flag behavior SITL-tested | Established APIs | FC telemetry, QGC status, GPS substitute output | MVE: `02_fact_cards.md` MAVSDK/pymavlink block; Sources #10-#12, #24 | Plane SITL behavior and velocity-source parameters must be validated | Selected | Exact output contract with known ArduPilot pitfall covered. |
 | Validation | EuRoC + AerialVL/VPAir + Plane SITL + representative flight | Layered validation suite | Test strategy | Prove ACs before production | Sources #19, #20 | Public data not sufficient for final proof | Selected | Covers component de-risking plus final representative proof. |
 ## Restrictions Cross-Check — Selected Production Architecture
 | Restriction | Candidate-mode behavior | Result | Evidence |
 |-------------|-------------------------|--------|----------|
 | Fixed-wing only | Architecture assumes forward motion, rare sharp turns, no hover dependency. | Pass | Problem context; Source #1 |
 | Fixed nadir nav camera | VO/orthorectification uses fixed camera extrinsics; attitude compensation from FC. | Pass | Source #5 |
 | Operational area / flat terrain | Flat terrain assumption supported; repetitive agricultural terrain handled as validation class and confidence risk. | Pass | Source #2 |
 | Weather/season classes | Validation matrix includes seasonal/visibility classes. | Pass | `05_validation_log.md` |
 | Two-camera split | Nav camera drives localization; AI camera object localization uses current GPS-denied state and AI gimbal/zoom. | Pass | AC-7.1/7.2 |
 | Satellite Service offline boundary | Runtime uses local COG/cache + FAISS descriptors only; no in-flight provider fetch. | Pass | Sources #17, #18 |
 | Freshness gates | Tile manifest carries capture date and sector; stale tiles rejected/down-weighted. | Pass | AC-8.2, AC-NEW-6 |
 | Jetson Orin Nano Super | Hot path is lightweight; heavy VPR conditional; runtime profiling gate required. | Pass | Sources #15, #16 |
 | MAVLink / ArduPilot only | MAVSDK telemetry + pymavlink `GPS_INPUT`, `GPS1_TYPE=14`. | Pass | Sources #10-#12 |
 | No raw frame storage | FDR keeps estimates, telemetry, tiles, and low-rate failure thumbnails only. | Pass | AC-8.5, AC-NEW-3 |
 ## AC Cross-Check — Selected Production Architecture
 | AC | Candidate-mode behavior | Result | Evidence |
 |----|-------------------------|--------|----------|
 | AC-1.1 | Satellite anchors and ESKF output target <=50 m for >=80% normal frames. | Pass | Facts #1, #2 |
 | AC-1.2 | Same pipeline targets <=20 m for >=50% normal frames; validated statistically. | Pass | `05_validation_log.md` |
 | AC-1.3 | ESKF tracks anchor age and covariance; VO-only and IMU-fused drift measured between anchors. | Pass | Fact #1 |
 | AC-1.4 | ESKF emits covariance; telemetry/FDR carries source label. | Pass | Fact #16 |
 | AC-2.1a | VO hot path handles normal overlapping frames; failures trigger mode change. | Pass | Facts #1, #6 |
 | AC-2.1b | Satellite anchor success measured separately through VPR + local match + RANSAC. | Pass | Facts #2, #7, #12 |
 | AC-2.2 | OpenCV/LightGlue provide correspondences and homography MRE measurement. | Pass | Facts #6, #7 |
 | AC-3.1 | ESKF innovation gates reject outliers; covariance grows instead of trusting jumps. | Pass | Reasoning chain |
 | AC-3.2 | Sharp turn VO failure triggers VPR relocalization. | Pass | AC design; Source #2 |
 | AC-3.3 | Disconnected segment handled by global retrieval and pose-graph/ESKF re-anchor. | Pass | Source #2 |
 | AC-3.4 | Loss counter and timer trigger GCS relocalization request while dead reckoning continues. | Pass | AC design |
 | AC-3.5 | Image-quality/blackout state switches to IMU-only and rejects spoofed GPS. | Pass | AC design; Facts #16, #17 |
 | AC-4.1 | Heavy VPR is conditional; steady-state path is VO/IMU. Jetson profiling is a runtime quality gate. | Pass | Facts #3, #18 |
 | AC-4.2 | Descriptor/index memory is budgeted; FAISS and cache are precomputed/pruned. | Pass | Facts #12, #13 |
 | AC-4.3 | `GPS_INPUT` emitted by pymavlink; ODOMETRY remains disabled in v1. | Pass | Facts #14-#16 |
 | AC-4.4 | Estimator emits frame-by-frame; no batching required. | Pass | Architecture |
 | AC-4.5 | Corrections are emitted as updated estimates with timestamps and covariance. | Pass | Architecture |
 | AC-5.1 | Startup initializes from last trusted FC state plus IMU propagation. | Pass | Architecture |
 | AC-5.2 | >3 s no-estimate path enters degraded/failsafe behavior; Plane SITL proves FC response. | Pass | Fact #17 |
 | AC-5.3 | Cold restart uses FC state and preloaded cache/index. | Pass | AC-NEW-1 |
 | AC-6.1 | QGC receives downsampled status; FDR keeps high-rate details. | Pass | MAVSDK telemetry + FDR design |
 | AC-6.2 | Command ingress reserved through MAVLink status/named values/custom dialect. | Pass | MAVLink design |
 | AC-6.3 | `GPS_INPUT` lat/lon is WGS84. | Pass | Fact #16 |
 | AC-7.1 | Object localization exposes level-flight accuracy and maneuver bound. | Pass | Geometry design |
 | AC-7.2 | Flat-terrain trig projection from UAV GPS + gimbal/zoom/altitude. | Pass | Geometry design |
 | AC-8.1 | Cache contract requires 0.3-0.5 m/px imagery. | Pass | Restrictions |
 | AC-8.2 | Freshness metadata gates anchors. | Pass | Restrictions |
 | AC-8.3 | Precomputed descriptors and FAISS index are part of cache budget. | Pass | Facts #10, #12, #13 |
 | AC-8.4 | Generated tiles are new COGs with quality metadata for Service ingest. | Pass | Fact #21 |
 | AC-8.5 | Raw frames are not retained. | Pass | FDR design |
 | AC-8.6 | VPR chunks use overlap/multi-scale descriptors and dynamic K. | Pass | Facts #2, #12 |
 | AC-NEW-1 | Engines/indexes built before flight; first fix benchmark validates <30 s. | Pass | Runtime plan |
 | AC-NEW-2 | Plane SITL verifies spoofing trigger and promotion <3 s. | Pass | Fact #17 |
 | AC-NEW-3 | FDR segment rollover validates <=64 GB. | Pass | Validation plan |
 | AC-NEW-4 | Mahalanobis gates and calibrated covariance target false-position budget. | Pass | ESKF design |
 | AC-NEW-5 | Thermal profiling at 25 W validates no throttle. | Pass | Facts #18, #19 |
 | AC-NEW-6 | Tile age rejection/down-weighting built into anchor gate. | Pass | AC design |
 | AC-NEW-7 | Tile writes require parent-pose covariance and sidecar metadata; Satellite Service voting is external contract. | Pass | AC design |
 | AC-NEW-8 | Dead-reckoned blackout mode degrades `GPS_INPUT` fields at covariance thresholds. | Pass | Facts #16, #17 |
 ## Decision Rules Applied
 - No GPL VIO/SLAM library is selected as a production dependency.
 - Runtime gates are classified as runtime-quality validation gates, not API capability blockers.
 - Every selected component has an exact input/output role and a validation path.
 - Any candidate with license uncertainty is marked `Needs user decision` or non-production.
 ## Mode B Revisions Applied
 - FAISS pinned mode changed to CPU-first on Jetson ARM64.
 - DINOv2 TensorRT path requires descriptor-fidelity validation against PyTorch/ONNX.
 - `GPS_INPUT` tests now include velocity-source and ignore-flag behavior.
 - COG cache lifecycle clarified as write-new-object plus manifest versioning, not in-place mutation.
 - Visual/satellite security controls now include signed manifests, cache provenance, stale-tile rejection, and multi-signal consistency checks.
 ## Mode B Round 2 Revisions Applied
 - OpenVINS is explicitly better than naive OpenCV-only VIO, but remains reference-only because the shipped estimator must own source labels, covariance gates, spoofing/blackout states, cache-write eligibility, and MAVLink semantics.
 - The selected VO wording is now "OpenCV geometry + project-owned ESKF" to avoid implying a fragile OpenCV-only odometry implementation.
 - DINOv2-VLAD + CPU-first FAISS + ALIKED/LightGlue remains selected for satellite retrieval and anchor verification, with retrieval limited to relocalization triggers and bounded top-K verification.
 - SIFT/ORB remains a regression/fallback baseline; SuperPoint remains non-production until legal approval.
 ## Mode B Round 3 Revisions Applied
 - BASALT is selected as the production VIO candidate.
 - OpenVINS remains the covariance/reference baseline, not a shipped dependency by default.
 - Kimera-VIO remains a backup VIO candidate because its license is production-friendly but mono-inertial caveats make it weaker for the single-nadir-camera path.
 - The project-owned safety/anchor wrapper remains mandatory around BASALT for satellite anchor acceptance, source labels, blackout/spoofing modes, cache-write eligibility, calibrated confidence, and MAVLink `GPS_INPUT`.
@@ -0,0 +1,91 @@
 # Question Decomposition — Solution Assessment (Mode B, Draft02)
 ## Original Question
 Assess solution_draft02.md for weak points, security vulnerabilities, and performance bottlenecks, then produce a revised solution draft03.
 ## Active Mode
 Mode B: Solution Assessment — `solution_draft02.md` is the highest-numbered draft.
 ## Question Type Classification
 - **Primary**: Problem Diagnosis — identify weak points, vulnerabilities, bottlenecks in draft02
 - **Secondary**: Decision Support — evaluate alternatives for identified issues
 ## Research Subject Boundary Definition
 | Dimension | Boundary |
 |-----------|----------|
 | **Domain** | GPS-denied UAV visual navigation, aerial geo-referencing |
 | **Geography** | Eastern/southern Ukraine (left of Dnipro River) — steppe terrain |
 | **Hardware** | Desktop/laptop with NVIDIA RTX 2060+, 16GB RAM, 6GB VRAM |
 | **Software** | Python ecosystem, GPU-accelerated CV/ML |
 | **Timeframe** | Current state-of-the-art (2024-2026), production-ready tools |
 | **Scale** | 500-3000 images per flight, up to 6252×4168 resolution |
 ## Problem Context Summary
 - UAV aerial photos taken consecutively ~100m apart, downward non-stabilized camera
 - Only starting GPS known — must determine GPS for all subsequent images
 - Must handle: sharp turns, outlier photos (up to 350m gap), disconnected route segments
 - Processing <5s/image, real-time SSE streaming, REST API service
 - No IMU data available
 - Camera: 26MP (6252×4168), 25mm focal length, 23.5mm sensor width, 400m altitude
 ## Decomposed Sub-Questions
 ### A: DINOv2 Cross-View Retrieval Viability
 "Is DINOv2 proven for UAV-to-satellite coarse retrieval? What are real-world performance numbers? What search radius is realistic?"
 ### B: XFeat Reliability for Aerial VO
 "Is XFeat proven for aerial visual odometry? How does it compare to SuperPoint in aerial scenes specifically? What are known failure modes?"
 ### C: LightGlue ONNX on RTX 2060 (Turing)
 "Does LightGlue-ONNX work reliably on Turing architecture? What precision (FP16/FP32)? What are actual benchmarks?"
 ### D: GTSAM iSAM2 Factor Graph Design
 "Is the proposed factor graph structure sound? Are the noise models appropriate? Are custom factors (DEM, drift limit) well-specified?"
 ### E: Copernicus DEM Integration
 "How is Copernicus DEM accessed programmatically? Is it truly free? What are the actual API requirements?"
 ### F: Homography Decomposition Robustness
 "How reliable is cv2.decomposeHomographyMat selection heuristic when UAV changes direction? What are failure modes?"
 ### G: Image Rotation Handling Completeness
 "Is heading-based rotation normalization sufficient? What if heading estimate is wrong early in a segment?"
 ### H: Memory Model Under Load
 "Can DINOv2 embeddings + SuperPoint features + GTSAM factor graph + satellite cache fit within 16GB RAM and 6GB VRAM during a 3000-image flight?"
 ### I: Satellite Match Failure Cascading
 "What happens when satellite matching fails for 50+ consecutive frames? How does the 100m drift limit interact with extended VO-only sections?"
 ### J: Multi-Provider Tile Schema Compatibility
 "Do Google Maps and Mapbox use the same tile coordinate system? What are the practical differences in switching providers?"
 ### K: Security Attack Surface
 "What are the remaining security vulnerabilities beyond JWT auth? SSE connection abuse? Image processing exploits?"
 ### L: Recent Advances (2025-2026)
 "Are there newer models or approaches published since draft02 that could improve accuracy or performance?"
 ### M: End-to-End Processing Time Budget
 "Is the total per-frame time budget realistic when all components run together? What is the critical path?"
 ---
 ## Timeliness Sensitivity Assessment
 - **Research Topic**: GPS-denied UAV visual navigation — assessment of solution_draft02 architecture and component choices
 - **Sensitivity Level**: 🟠 High
 - **Rationale**: CV feature matching models (SuperPoint, LightGlue, XFeat, DINOv2) evolve rapidly with new versions and competitors. GTSAM is stable. Satellite tile API pricing/limits change. Core algorithms (homography, VO) are stable.
 - **Source Time Window**: 12 months (2025-2026)
 - **Priority official sources to consult**:
  1. GTSAM official documentation and PyPI (factor type compatibility)
  2. LightGlue-ONNX GitHub (Turing GPU compatibility)
  3. Google Maps Tiles API documentation (pricing, session tokens)
  4. DINOv2 official repo (model variants, VRAM)
  5. faiss wiki (GPU memory allocation)
 - **Key version information to verify**:
  - GTSAM: 4.2 stable, 4.3 alpha (breaking changes)
  - LightGlue-ONNX: FP16 on Turing, FP8 requires Ada Lovelace
  - Pillow: ≥11.3.0 required (CVE-2025-48379)
  - FastAPI: ≥0.135.0 (SSE support)
@@ -0,0 +1,212 @@
 # Source Registry — Draft02 Assessment
 ## Source #1
 - **Title**: GTSAM GPSFactor Class Reference
 - **Link**: https://gtsam.org/doxygen/a04084.html
 - **Tier**: L1
 - **Publication Date**: 2025 (latest docs)
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: GTSAM 4.2
 - **Target Audience**: GTSAM users building factor graphs with GPS constraints
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: GPSFactor and GPSFactor2 work with Pose3/NavState, NOT Pose2. For 2D position constraints, PriorFactorPoint2 or custom factors are needed.
 - **Related Sub-question**: D (GTSAM iSAM2 Factor Graph Design)
 ## Source #2
 - **Title**: GTSAM Pose2 SLAM Example
 - **Link**: https://gtbook.github.io/gtsam-examples/Pose2SLAMExample.html
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: GTSAM 4.2
 - **Target Audience**: GTSAM users
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: BetweenFactorPose2 provides odometry constraints with noise model Diagonal.Sigmas(Point3(sigma_x, sigma_y, sigma_theta)). PriorFactorPose2 anchors poses.
 - **Related Sub-question**: D
 ## Source #3
 - **Title**: GTSAM Python pip install version compatibility (PyPI)
 - **Link**: https://pypi.org/project/gtsam/
 - **Tier**: L1
 - **Publication Date**: 2026-01
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: gtsam 4.2 (stable), gtsam-develop 4.3a1 (alpha)
 - **Target Audience**: Python developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: GTSAM 4.2 stable on pip. 4.3 alpha has breaking changes (C++17, Boost removal). Known issues with Eigen 5.0.0, ARM64 builds. Stick with 4.2 for production.
 - **Related Sub-question**: D
 ## Source #4
 - **Title**: LightGlue-ONNX repository
 - **Link**: https://github.com/fabio-sim/LightGlue-ONNX
 - **Tier**: L1
 - **Publication Date**: 2026-01 (last updated)
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: LightGlue-ONNX (supports ONNX Runtime + TensorRT)
 - **Target Audience**: Computer vision developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: ONNX export with 2-4x speedup over PyTorch. FP16 works on Turing (RTX 2060). FP8 requires Ada Lovelace/Hopper. Mixed precision supported since July 2023.
 - **Related Sub-question**: C (LightGlue ONNX on RTX 2060)
 ## Source #5
 - **Title**: LightGlue rotation issue #64
 - **Link**: https://github.com/cvg/LightGlue/issues/64
 - **Tier**: L4
 - **Publication Date**: 2023
 - **Timeliness Status**: ✅ Currently valid (issue still open)
 - **Target Audience**: LightGlue users
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: SuperPoint+LightGlue not rotation-invariant. Fails at 90°/180°. Workaround: try rotating images by {0°, 90°, 180°, 270°}. Steerable CNNs proposed but not available.
 - **Related Sub-question**: G (Image Rotation Handling)
 ## Source #6
 - **Title**: SIFT+LightGlue for UAV Image Mosaicking (ISPRS 2025)
 - **Link**: https://isprs-archives.copernicus.org/articles/XLVIII-2-W11-2025/169/2025/
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: SIFT+LightGlue hybrid achieves robust matching in low-texture and high-rotation UAV scenarios. Outperforms both pure SIFT and SuperPoint+LightGlue.
 - **Related Sub-question**: G
 ## Source #7
 - **Title**: DINOv2-Based UAV Visual Self-Localization
 - **Link**: https://ui.adsabs.harvard.edu/abs/2025IRAL...10.2080Y/abstract
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: UAV localization researchers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: DINOv2 with adaptive enhancement achieves 86.27 R@1 on DenseUAV benchmark for UAV-to-satellite matching. Proves DINOv2 viable for coarse retrieval.
 - **Related Sub-question**: A (DINOv2 Cross-View Retrieval)
 ## Source #8
 - **Title**: SatLoc-Fusion (Remote Sensing 2025)
 - **Link**: https://www.mdpi.com/2072-4292/17/17/3048
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: UAV navigation researchers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Hierarchical: DINOv2 absolute + XFeat VO + optical flow. <15m error, >2Hz on 6 TFLOPS edge. Adaptive confidence-based fusion. Validates our approach architecture.
 - **Related Sub-question**: A, B
 ## Source #9
 - **Title**: XFeat: Accelerated Features (CVPR 2024)
 - **Link**: https://arxiv.org/abs/2404.19174
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: CV researchers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: 5x faster than SuperPoint. Real-time on CPU. Semi-dense matching. XFeat has built-in matcher for fast VO; also compatible with LightGlue via xfeat-lightglue models.
 - **Related Sub-question**: B (XFeat Reliability)
 ## Source #10
 - **Title**: XFeat + LightGlue compatibility (GitHub issue #128)
 - **Link**: https://github.com/cvg/LightGlue/issues/128
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: LightGlue/XFeat users
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: XFeat-LightGlue trained models available on HuggingFace (vismatch/xfeat-lightglue). Also ONNX export available. XFeat's built-in matcher is separate.
 - **Related Sub-question**: B
 ## Source #11
 - **Title**: DINOv2 VRAM usage by model variant
 - **Link**: https://blog.iamfax.com/tech/image-processing/dinov2/
 - **Tier**: L3
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Developers deploying DINOv2
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: ViT-S/14: ~300MB VRAM, 0.05s/img. ViT-B/14: ~600MB, 0.1s/img. ViT-L/14: ~1.5GB, 0.35s/img. ViT-G/14: ~5GB, 2s/img.
 - **Related Sub-question**: H (Memory Model)
 ## Source #12
 - **Title**: Copernicus DEM on AWS Open Data
 - **Link**: https://registry.opendata.aws/copernicus-dem/
 - **Tier**: L1
 - **Publication Date**: Ongoing
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Developers needing DEM data
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Free access via S3 without authentication. Cloud Optimized GeoTIFFs, 1x1 degree tiles, 30m resolution. `aws s3 ls --no-sign-required s3://copernicus-dem-30m/`
 - **Related Sub-question**: E (Copernicus DEM)
 ## Source #13
 - **Title**: Google Maps Tiles API Usage and Billing
 - **Link**: https://developers.google.com/maps/documentation/tile/usage-and-billing
 - **Tier**: L1
 - **Publication Date**: 2026-02 (updated)
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Google Maps API consumers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: 100K free requests/month. 6,000/min, 15,000/day rate limits. $200 monthly credit expired Feb 2025. Requires session tokens.
 - **Related Sub-question**: J
 ## Source #14
 - **Title**: Google Maps vs Mapbox tile schema
 - **Link**: https://developers.google.com/maps/documentation/tile/2d-tiles-overview
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: Both use z/x/y Web Mercator tiles (256px). Compatible coordinate systems. Google requires session tokens; Mapbox requires API tokens. Mapbox global to zoom 16, regional to 21+.
 - **Related Sub-question**: J
 ## Source #15
 - **Title**: FastAPI SSE connection cleanup issues (sse-starlette #99)
 - **Link**: https://github.com/sysid/sse-starlette/issues/99
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: FastAPI SSE developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Async generators cannot be easily cancelled once awaited. Use EventPublisher pattern with asyncio.Queue for proper cleanup. Prevents shutdown hangs and connection lingering.
 - **Related Sub-question**: K (Security/Stability)
 ## Source #16
 - **Title**: OpenCV decomposeHomographyMat issues (#23282)
 - **Link**: https://github.com/opencv/opencv/issues/23282
 - **Tier**: L4
 - **Publication Date**: 2023
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: decomposeHomographyMat can return non-orthogonal rotation matrices. Returns 4 solutions. Positive depth constraint needed for disambiguation. Calibration matrix K precision critical.
 - **Related Sub-question**: F (Homography Decomposition)
 ## Source #17
 - **Title**: CVE-2025-48379: Pillow Heap Buffer Overflow
 - **Link**: https://nvd.nist.gov/vuln/detail/CVE-2025-48379
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: Pillow 11.2.0-11.2.1 affected, fixed in 11.3.0
 - **Summary**: Heap buffer overflow in Pillow's image encoding. Requires pinning Pillow ≥11.3.0 and validating image formats.
 - **Related Sub-question**: K (Security)
 ## Source #18
 - **Title**: SALAD: Optimal Transport Aggregation for Visual Place Recognition
 - **Link**: https://arxiv.org/abs/2311.15937
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: DINOv2+SALAD outperforms NetVLAD. Single-stage retrieval, no re-ranking. 30min training. Optimal transport aggregation better than raw DINOv2 CLS token for retrieval.
 - **Related Sub-question**: A
 ## Source #19
 - **Title**: NaviLoc: Trajectory-Level Visual Localization
 - **Link**: https://www.mdpi.com/2504-446X/10/2/97
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: Treats VPR as noisy measurement, uses trajectory-level optimization. 19.5m MLE, 16x improvement over per-frame VPR. Validates trajectory optimization approach.
 - **Related Sub-question**: L (Recent Advances)
 ## Source #20
 - **Title**: FAISS GPU memory management
 - **Link**: https://github.com/facebookresearch/faiss/wiki/Faiss-on-the-GPU
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: GPU faiss allocates ~2GB scratch space by default. On 6GB VRAM RTX 2060, CPU-based faiss recommended. Supports CPU-GPU interop.
 - **Related Sub-question**: H (Memory)
@@ -0,0 +1,142 @@
 # Fact Cards — Draft02 Assessment
 ## Fact #1
 - **Statement**: GTSAM `GPSFactor` works with `Pose3` variables, NOT `Pose2`. `GPSFactor2` works with `NavState`. Neither accepts `Pose2`. For 2D position constraints, use `PriorFactorPoint2` or a custom factor.
 - **Source**: [Source #1] https://gtsam.org/doxygen/a04084.html, [Source #2]
 - **Phase**: Assessment
 - **Target Audience**: GPS-denied UAV navigation developers
 - **Confidence**: ✅ High (official GTSAM documentation)
 - **Related Dimension**: Factor Graph Design
 ## Fact #2
 - **Statement**: GTSAM 4.2 is stable on pip. GTSAM 4.3 alpha has breaking changes (C++17 migration, Boost removal). Known pip dependency resolution issues for Python bindings (Sept 2025). Production should use 4.2.
 - **Source**: [Source #3] https://pypi.org/project/gtsam/
 - **Phase**: Assessment
 - **Confidence**: ✅ High (PyPI official)
 - **Related Dimension**: Factor Graph Design
 ## Fact #3
 - **Statement**: LightGlue-ONNX achieves 2-4x speedup over compiled PyTorch. FP16 works on Turing (RTX 2060). FP8 requires Ada Lovelace/Hopper — falls back to higher precision on Turing. Mixed precision supported since July 2023.
 - **Source**: [Source #4] https://github.com/fabio-sim/LightGlue-ONNX
 - **Phase**: Assessment
 - **Confidence**: ✅ High (official repo, benchmarks)
 - **Related Dimension**: Processing Performance
 ## Fact #4
 - **Statement**: SuperPoint and LightGlue are NOT rotation-invariant. Performance degrades significantly at 90°/180° rotations. Practical workaround: try matching at {0°, 90°, 180°, 270°} rotations. SIFT+LightGlue hybrid is proven better for high-rotation UAV scenarios (ISPRS 2025).
 - **Source**: [Source #5] issue #64, [Source #6] ISPRS 2025
 - **Phase**: Assessment
 - **Confidence**: ✅ High (confirmed in official issue + peer-reviewed paper)
 - **Related Dimension**: Rotation Handling
 ## Fact #5
 - **Statement**: DINOv2 achieves 86.27 R@1 on DenseUAV benchmark for UAV-to-satellite matching (with adaptive enhancement). Raw DINOv2 performance is lower but still viable for coarse retrieval.
 - **Source**: [Source #7] https://ui.adsabs.harvard.edu/abs/2025IRAL...10.2080Y/
 - **Phase**: Assessment
 - **Confidence**: ✅ High (peer-reviewed)
 - **Related Dimension**: Satellite Matching
 ## Fact #6
 - **Statement**: SatLoc-Fusion validates the exact architecture pattern: DINOv2 for absolute geo-localization + XFeat for VO + optical flow for velocity. Achieves <15m error at >2Hz on 6 TFLOPS edge hardware. Uses adaptive confidence-based fusion.
 - **Source**: [Source #8] https://www.mdpi.com/2072-4292/17/17/3048
 - **Phase**: Assessment
 - **Confidence**: ✅ High (peer-reviewed, dataset provided)
 - **Related Dimension**: Overall Architecture
 ## Fact #7
 - **Statement**: XFeat is 5x faster than SuperPoint. Runs real-time on CPU. Has built-in matcher for fast matching. Also compatible with LightGlue via xfeat-lightglue trained models (HuggingFace vismatch/xfeat-lightglue). ONNX export available.
 - **Source**: [Source #9] CVPR 2024, [Source #10] GitHub
 - **Phase**: Assessment
 - **Confidence**: ✅ High (CVPR paper + working implementations)
 - **Related Dimension**: Feature Extraction
 ## Fact #8
 - **Statement**: DINOv2 VRAM: ViT-S/14 ~300MB (0.05s/img), ViT-B/14 ~600MB (0.1s/img), ViT-L/14 ~1.5GB (0.35s/img). On GTX 1080.
 - **Source**: [Source #11] blog benchmark
 - **Phase**: Assessment
 - **Confidence**: ⚠️ Medium (third-party benchmark, not official)
 - **Related Dimension**: Memory Model
 ## Fact #9
 - **Statement**: Copernicus DEM GLO-30 is freely available on AWS S3 without authentication: `s3://copernicus-dem-30m/`. Cloud Optimized GeoTIFFs, 30m resolution, global coverage. Alternative: Sentinel Hub API (requires free registration).
 - **Source**: [Source #12] AWS Registry
 - **Phase**: Assessment
 - **Confidence**: ✅ High (AWS official registry)
 - **Related Dimension**: DEM Integration
 ## Fact #10
 - **Statement**: Google Maps Tiles API: 100K free requests/month, 15,000/day, 6,000/min. Requires session tokens (not just API key). $200 monthly credit expired Feb 2025. February 2026: split quota buckets for 2D and Street View tiles.
 - **Source**: [Source #13] Google official docs
 - **Phase**: Assessment
 - **Confidence**: ✅ High (official documentation)
 - **Related Dimension**: Satellite Provider
 ## Fact #11
 - **Statement**: Google Maps and Mapbox both use z/x/y Web Mercator tiles (256px). Compatible coordinate systems. Main differences: authentication method (session tokens vs API tokens), max zoom levels (Google: 22, Mapbox: global 16, regional 21+).
 - **Source**: [Source #14] Google + Mapbox docs
 - **Phase**: Assessment
 - **Confidence**: ✅ High (official docs)
 - **Related Dimension**: Multi-Provider Cache
 ## Fact #12
 - **Statement**: FastAPI SSE async generators cannot be easily cancelled once awaited. Causes shutdown hangs, connection lingering. Solution: EventPublisher pattern with asyncio.Queue for proper lifecycle management.
 - **Source**: [Source #15] sse-starlette issue #99
 - **Phase**: Assessment
 - **Confidence**: ⚠️ Medium (community report, confirmed by library maintainer)
 - **Related Dimension**: API Stability
 ## Fact #13
 - **Statement**: cv2.decomposeHomographyMat returns up to 4 solutions. Can return non-orthogonal rotation matrices. Disambiguation requires: positive depth constraint + calibration matrix K precision. Not just "motion consistent with previous direction."
 - **Source**: [Source #16] OpenCV issue #23282
 - **Phase**: Assessment
 - **Confidence**: ✅ High (confirmed OpenCV issue)
 - **Related Dimension**: VO Robustness
 ## Fact #14
 - **Statement**: Pillow CVE-2025-48379: heap buffer overflow in 11.2.0-11.2.1. Fixed in 11.3.0. Image processing pipeline must pin Pillow ≥11.3.0.
 - **Source**: [Source #17] NVD
 - **Phase**: Assessment
 - **Confidence**: ✅ High (CVE database)
 - **Related Dimension**: Security
 ## Fact #15
 - **Statement**: DINOv2+SALAD (optimal transport aggregation) outperforms raw DINOv2 CLS token for visual place recognition. Single-stage, no re-ranking needed. 30-minute training. Better suited for coarse retrieval than raw cosine similarity on CLS tokens.
 - **Source**: [Source #18] arXiv
 - **Phase**: Assessment
 - **Confidence**: ✅ High (peer-reviewed)
 - **Related Dimension**: Satellite Matching
 ## Fact #16
 - **Statement**: FAISS GPU allocates ~2GB scratch space by default. On 6GB VRAM RTX 2060, GPU faiss would consume 33% of VRAM just for indexing. CPU-based faiss recommended for this hardware profile.
 - **Source**: [Source #20] FAISS wiki
 - **Phase**: Assessment
 - **Confidence**: ✅ High (official wiki)
 - **Related Dimension**: Memory Model
 ## Fact #17
 - **Statement**: NaviLoc achieves 19.5m MLE by treating VPR as noisy measurement and optimizing at trajectory level (not per-frame). 16x improvement over per-frame approaches. Validates trajectory-level optimization concept.
 - **Source**: [Source #19]
 - **Phase**: Assessment
 - **Confidence**: ✅ High (peer-reviewed)
 - **Related Dimension**: Optimization Strategy
 ## Fact #18
 - **Statement**: Mapbox satellite imagery for Ukraine: no specific update schedule. Uses Maxar Vivid product. Coverage to zoom 16 globally (~2.5m/px), regional zoom 18+ (~0.6m/px). No guarantee of Ukraine freshness — likely 2+ years old in conflict areas.
 - **Source**: [Source #14] Mapbox docs
 - **Phase**: Assessment
 - **Confidence**: ⚠️ Medium (general Mapbox info, no Ukraine-specific data)
 - **Related Dimension**: Satellite Provider
 ## Fact #19
 - **Statement**: For 2D factor graphs, GTSAM uses Pose2 (x, y, theta) with BetweenFactorPose2 for odometry and PriorFactorPose2 for anchoring. Position-only constraints use PriorFactorPoint2. Custom factors via Python callbacks are supported but slower than C++ factors.
 - **Source**: [Source #2] GTSAM by Example
 - **Phase**: Assessment
 - **Confidence**: ✅ High (official GTSAM examples)
 - **Related Dimension**: Factor Graph Design
 ## Fact #20
 - **Statement**: XFeat's built-in matcher (match_xfeat) is fastest for VO (~15ms total extraction+matching). xfeat-lightglue is higher quality but slower. For satellite matching where accuracy matters more, SuperPoint+LightGlue remains the better choice.
 - **Source**: [Source #9] CVPR 2024, [Source #10]
 - **Phase**: Assessment
 - **Confidence**: ⚠️ Medium (inference from multiple sources)
 - **Related Dimension**: Feature Extraction Strategy
@@ -0,0 +1,31 @@
 # Comparison Framework — Draft02 Assessment
 ## Selected Framework Type
 Problem Diagnosis + Decision Support
 ## Selected Dimensions
 1. Factor Graph Design Correctness
 2. VRAM/Memory Budget Feasibility
 3. Rotation Handling Completeness
 4. VO Robustness (Homography Decomposition)
 5. Satellite Matching Reliability
 6. Concurrency & Pipeline Architecture
 7. Security Attack Surface
 8. API/SSE Stability
 9. Provider Integration Completeness
 10. Drift Management Strategy
 ## Findings Matrix
 | Dimension | Draft02 Approach | Weak Point | Severity | Proposed Fix | Factual Basis |
 |-----------|------------------|------------|----------|--------------|---------------|
 | Factor Graph | Pose2 + GPSFactor + custom DEM/drift factors | GPSFactor requires Pose3, not Pose2. Custom Python factors are slow. | **Critical** | Use Pose2 + BetweenFactorPose2 + PriorFactorPoint2 for satellite anchors. Convert lat/lon to local ENU. Avoid Python custom factors. | Fact #1, #2, #19 |
 | VRAM Budget | DINOv2 + SuperPoint + LightGlue ONNX + faiss GPU | No model specified for DINOv2. faiss GPU uses 2GB scratch. Combined VRAM could exceed 6GB. | **High** | Use DINOv2 ViT-S/14 (300MB). faiss on CPU only. Sequence model loading (not concurrent). Explicit budget: XFeat 200MB + DINOv2-S 300MB + SuperPoint 400MB + LightGlue 500MB. | Fact #8, #16 |
 | Rotation Handling | Heading-based rectification + SIFT fallback | No heading at segment start. No trigger criteria for SIFT vs rotation retry. Multi-rotation matching not mentioned. | **High** | At segment start: try 4 rotations {0°, 90°, 180°, 270°}. After heading established: rectify. SIFT fallback when SuperPoint inlier ratio < 0.2. | Fact #4 |
 | Homography Decomposition | Motion consistency selection | Only "motion consistent with previous direction" — underspecified. 4 solutions possible. Non-orthogonal matrices can occur. | **Medium** | Positive depth constraint first. Then normal direction check (plane normal should point up). Then motion consistency. Orthogonality check on R. | Fact #13 |
 | Satellite Coarse Retrieval | DINOv2 + faiss cosine similarity | Raw DINOv2 CLS token suboptimal for retrieval. SALAD aggregation proven better. | **Medium** | Use DINOv2+SALAD or at minimum use patch-level features, not just CLS token. Alternatively, fine-tune DINOv2 on remote sensing. | Fact #5, #15 |
 | Concurrency Model | "Async — don't block VO pipeline" | No concrete concurrency design. GPU can't run two models simultaneously. | **High** | Sequential GPU: XFeat VO first (15ms), then async satellite matching on same GPU. Use asyncio for I/O (tile download, DEM fetch). CPU faiss for retrieval. | Fact #8, #16 |
 | Security | JWT + rate limiting + CORS | No image format validation. No Pillow version pinning. No SSE abuse protection beyond connection limits. No sandbox for image processing. | **Medium** | Pin Pillow ≥11.3.0. Validate image magic bytes. Limit image dimensions before loading. Memory-map large images. CSP headers. | Fact #14 |
 | SSE Stability | FastAPI EventSourceResponse | Async generator cleanup issues on shutdown. No heartbeat. No reconnection strategy. | **Medium** | Use asyncio.Queue-based EventPublisher. Add SSE heartbeat every 15s. Include Last-Event-ID for reconnection. | Fact #12 |
 | Provider Integration | Google Maps + Mapbox + user tiles | Google requires session tokens (not just API key). 15K/day limit = ~7 flights from cache misses. Mapbox Ukraine coverage uncertain. | **Medium** | Implement session token management for Google. Add Bing Maps as third provider. Document DEM+tile download budget per flight. | Fact #10, #11, #18 |
 | Drift Management | 100m cumulative drift limit factor | Custom factor. If satellite fails for 50+ frames, no anchors → drift factor has nothing to constrain against. | **High** | Add dead-reckoning confidence decay: after N frames without anchor, emit warning + request user input. Track estimated drift explicitly. Set hard limit for user input request. | Fact #17 |
@@ -0,0 +1,192 @@
 # Reasoning Chain — Draft02 Assessment
 ## Dimension 1: Factor Graph Design Correctness
 ### Fact Confirmation
 According to Fact #1, GTSAM's `GPSFactor` class works exclusively with `Pose3` variables. `GPSFactor2` works with `NavState`. Neither accepts `Pose2`. According to Fact #19, `PriorFactorPoint2` provides 2D position constraints, and `BetweenFactorPose2` provides 2D odometry constraints.
 ### Problem
 Draft02 specifies `Pose2 (x, y, heading)` variables but lists `GPSFactor` for satellite anchors. This is an API mismatch — the code would fail at runtime.
 ### Solution
 Two valid approaches:
 1. **Pose2 graph (recommended)**: Use `Pose2` variables + `BetweenFactorPose2` for VO + `PriorFactorPose2` for satellite anchors (constraining full pose when heading is available) or use a custom partial factor that constrains only the position part of Pose2. Convert WGS84 to local ENU coordinates centered on starting GPS.
 2. **Pose3 graph**: Use `Pose3` with fixed altitude. More accurate but adds unnecessary complexity for 2D problem.
 The custom DEM terrain factor and drift limit factor also need reconsideration: Python custom factors invoke a Python callback per optimization step, which is slow. DEM terrain is irrelevant for 2D Pose2 (altitude is not a variable). Drift should be managed by the Segment Manager logic, not as a factor.
 ### Conclusion
 Switch to Pose2 + BetweenFactorPose2 + PriorFactorPose2 (or partial position prior). Remove DEM terrain factor (handle elevation in GSD calculation outside the graph). Remove drift limit factor (handle in Segment Manager). This simplifies the factor graph and avoids Python callback overhead.
 ### Confidence
 ✅ High — based on official GTSAM documentation
 ---
 ## Dimension 2: VRAM/Memory Budget Feasibility
 ### Fact Confirmation
 According to Fact #8: DINOv2 ViT-S/14 ~300MB, ViT-B/14 ~600MB. Fact #16: faiss GPU uses ~2GB scratch. Fact #3: LightGlue ONNX FP16 works on RTX 2060.
 ### Problem
 Draft02 doesn't specify DINOv2 model size. Proposing faiss GPU would consume 2GB of 6GB VRAM. Combined with other models, total could exceed 6GB. Draft02 estimates ~1.5GB per frame for XFeat/SuperPoint + LightGlue, but doesn't account for DINOv2 or faiss.
 ### Budget Analysis
 Concurrent peak VRAM (worst case):
 - XFeat inference: ~200MB
 - LightGlue ONNX (FP16): ~500MB
 - DINOv2 ViT-B/14: ~600MB
 - SuperPoint: ~400MB
 - faiss GPU: ~2GB
 - ONNX Runtime overhead: ~300MB
 - **Total: ~4.0GB** (without faiss GPU: ~2.0GB)
 Sequential loading (recommended):
 - Step 1: XFeat + XFeat matcher (VO): ~400MB
 - Step 2: DINOv2-S (coarse retrieval): ~300MB → unload
 - Step 3: SuperPoint + LightGlue ONNX (fine matching): ~900MB
 - Peak: ~1.3GB (with model switching)
 ### Conclusion
 Use DINOv2 ViT-S/14 (300MB, 0.05s/img — fast enough for coarse retrieval). Run faiss on CPU (the embedding vectors are small, CPU search is <1ms for ~2000 vectors). Sequential model loading for GPU: VO models first, then satellite matching models. Keep models loaded but process sequentially (no concurrent GPU inference).
 ### Confidence
 ✅ High — based on documented VRAM numbers
 ---
 ## Dimension 3: Rotation Handling Completeness
 ### Fact Confirmation
 According to Fact #4, SuperPoint+LightGlue fail at 90°/180° rotations. According to Fact #6 (ISPRS 2025), SIFT+LightGlue outperforms SuperPoint+LightGlue in high-rotation UAV scenarios.
 ### Problem
 Draft02 says "estimate heading from VO chain, rectify images before satellite matching, SIFT fallback for rotation-heavy cases." But:
 1. At segment start, there's no heading from VO chain — no rectification possible.
 2. No criteria for when to trigger SIFT fallback.
 3. Multi-rotation matching strategy ({0°, 90°, 180°, 270°}) not mentioned.
 ### Conclusion
 Three-tier rotation handling:
 1. **Segment start (no heading)**: Try DINOv2 coarse retrieval (more rotation-robust than local features) → if match found, estimate heading from satellite alignment → proceed normally.
 2. **Normal operation (heading available)**: Rectify to approximate north-up using accumulated heading → SuperPoint+LightGlue.
 3. **Match failure fallback**: Try 4 rotations {0°, 90°, 180°, 270°} with SuperPoint. If still fails → SIFT+LightGlue (rotation-invariant).
 Trigger for SIFT: SuperPoint inlier ratio < 0.15 after rotation retry.
 ### Confidence
 ✅ High — based on confirmed LightGlue limitation + proven SIFT+LightGlue alternative
 ---
 ## Dimension 4: VO Robustness (Homography Decomposition)
 ### Fact Confirmation
 According to Fact #13, cv2.decomposeHomographyMat returns 4 solutions. Can return non-orthogonal matrices. Calibration matrix K precision is critical.
 ### Problem
 Draft02 specifies selection by "motion consistent with previous direction + positive depth." This is underspecified for the first frame pair in a segment (no previous direction). Non-orthogonal R detection is missing.
 ### Conclusion
 Disambiguation procedure:
 1. Compute all 4 decompositions.
 2. **Filter by positive depth**: triangulate a few matched points, reject solutions where points are behind camera.
 3. **Filter by plane normal**: for downward-looking camera, the normal should approximately point up (positive z component in camera frame).
 4. **Motion consistency**: if previous direction available, prefer solution consistent with expected motion direction.
 5. **Orthogonality check**: verify R'R ≈ I, det(R) ≈ 1. If not, re-orthogonalize via SVD.
 6. For first frame pair: rely on filters 2+3 only.
 ### Confidence
 ✅ High — based on well-documented decomposition ambiguity
 ---
 ## Dimension 5: Satellite Coarse Retrieval
 ### Fact Confirmation
 According to Fact #15, DINOv2+SALAD outperforms raw DINOv2 CLS token for retrieval. According to Fact #5, DINOv2 achieves 86.27 R@1 with adaptive enhancement.
 ### Problem
 Draft02 proposes "DINOv2 global retrieval + faiss cosine similarity." Using raw CLS token is suboptimal. SALAD or patch-level feature aggregation would improve retrieval accuracy.
 ### Conclusion
 DINOv2+SALAD is the better approach but adds a training/fine-tuning dependency. For a production system without the ability to fine-tune: use DINOv2 patch tokens (not just CLS) with spatial pooling, then cosine similarity via faiss. This captures more spatial information than CLS alone. If time permits, train SALAD head (30 minutes on appropriate dataset).
 Alternatively, consider SatDINO (DINOv2 pre-trained on satellite imagery) if available as a checkpoint.
 ### Confidence
 ⚠️ Medium — SALAD is proven but adding training dependency may not be worth the complexity for this use case
 ---
 ## Dimension 6: Concurrency & Pipeline Architecture
 ### Fact Confirmation
 Single GPU (RTX 2060) cannot run two models concurrently. Fact #8 shows sequential model inference times. Fact #3 shows LightGlue ONNX at ~50-100ms.
 ### Problem
 Draft02 says satellite matching is "async — don't block VO pipeline" but on a single GPU, you can't parallelize GPU inference.
 ### Conclusion
 Pipeline design:
 1. **VO (synchronous, per-frame)**: XFeat extract + match (~30ms total) → homography estimation (~5ms) → GTSAM update (~5ms) → emit position via SSE. **Total: ~40ms per frame.**
 2. **Satellite matching (asynchronous, overlapped with next frame's VO)**: DINOv2 coarse (~50ms) → SuperPoint+LightGlue fine (~150ms) → GTSAM update (~5ms) → emit refined position. **Total: ~205ms but overlapped.**
 3. **I/O (fully async)**: Tile download, DEM fetch, cache management — all via asyncio.
 4. **CPU tasks (parallel)**: faiss search (CPU), homography RANSAC (CPU-bound but fast).
 The GPU processes frames sequentially. The "async" part is that satellite matching for frame N happens while VO for frame N+1 proceeds. Since satellite matching (~205ms) is longer than VO (~40ms), the pipeline is satellite-matching-bound but VO results stream immediately.
 ### Confidence
 ✅ High — based on documented inference times
 ---
 ## Dimension 7: Security Attack Surface
 ### Fact Confirmation
 According to Fact #14, Pillow CVE-2025-48379 affects image loading. Fact #12 confirms SSE cleanup issues.
 ### Problem
 Draft02 has JWT + rate limiting + CORS but misses:
 - Image format/magic byte validation before loading
 - Pillow version pinning
 - Memory-limited image loading (a 100,000 × 100,000 pixel image could OOM)
 - SSE heartbeat for connection health
 - No mention of directory traversal prevention depth
 ### Conclusion
 Additional security measures:
 1. Pin Pillow ≥11.3.0 in requirements.
 2. Validate image magic bytes (JPEG/PNG/TIFF) before loading with PIL.
 3. Check image dimensions before loading: reject if either dimension > 10,000px.
 4. Use OpenCV for loading (separate from PIL) — validate separately.
 5. Resolve image_folder path to canonical form (os.path.realpath) and verify it's under allowed base directories.
 6. Add Content-Security-Policy headers.
 7. SSE heartbeat every 15s to detect stale connections.
 8. Implement asyncio.Queue-based event publisher for SSE.
 ### Confidence
 ✅ High — based on documented CVE + known SSE issues
 ---
 ## Dimension 8: Drift Management Strategy
 ### Fact Confirmation
 According to Fact #17, NaviLoc demonstrates that trajectory-level optimization with noisy VPR measurements achieves 16x better accuracy than per-frame approaches. SatLoc-Fusion uses adaptive confidence metrics.
 ### Problem
 Draft02's "drift limit factor" as a GTSAM custom factor is problematic: (1) custom Python factors are slow, (2) if no satellite anchors arrive for extended period, the drift factor has nothing to constrain against.
 ### Conclusion
 Replace GTSAM drift factor with Segment Manager logic:
 1. Track cumulative VO displacement since last satellite anchor.
 2. If cumulative displacement > 100m without anchor: emit warning SSE event, increase satellite matching frequency/radius.
 3. If cumulative displacement > 200m: request user input with timeout.
 4. If cumulative displacement > 500m: mark segment as LOW confidence, continue but warn.
 5. Confidence score per position: decays exponentially with distance from nearest anchor.
 This is simpler, faster, and more controllable than a GTSAM custom factor.
 ### Confidence
 ✅ High — engineering judgment supported by SatLoc-Fusion's confidence-based approach
@@ -0,0 +1,100 @@
 # Validation Log — Draft02 Assessment (Draft03)
 ## Validation Scenario 1: Factor graph initialization with first satellite match
 **Scenario**: Flight starts, VO processes 10 frames, satellite match arrives for frame 5.
 **Expected with Draft03 fixes**:
 1. GTSAM graph starts with PriorFactorPose2 at starting GPS (frame 0).
 2. BetweenFactorPose2 added for frames 0→1, 1→2, ..., 9→10.
 3. Satellite match for frame 5: add PriorFactorPose2 with position from satellite match and noise proportional to reprojection error × GSD.
 4. iSAM2.update() triggers backward correction — frames 0-4 and 5-10 both adjust.
 5. All positions in local ENU coordinates, converted to WGS84 for output.
 **Validation result**: Consistent. PriorFactorPose2 correctly constrains Pose2 variables. No GPSFactor API mismatch.
 ## Validation Scenario 2: Segment start with unknown heading (rotation handling)
 **Scenario**: After a sharp turn, new segment starts. First image has unknown heading.
 **Expected with Draft03 fixes**:
 1. VO triple check fails → segment break.
 2. New segment starts. No heading available.
 3. For satellite coarse retrieval: DINOv2-S processes unrotated image → top-5 tiles.
 4. For fine matching: try SuperPoint+LightGlue at 4 rotations {0°, 90°, 180°, 270°}.
 5. If match found: heading estimated from satellite alignment. Subsequent images rectified.
 6. If no match: try SIFT+LightGlue (rotation-invariant).
 7. If still no match: request user input.
 **Validation result**: Consistent. Three-tier fallback addresses the heading bootstrap problem.
 ## Validation Scenario 3: VRAM budget during satellite matching
 **Scenario**: Processing frame with concurrent VO + satellite matching on RTX 2060 (6GB).
 **Expected with Draft03 fixes**:
 1. XFeat features already extracted for VO: ~200MB VRAM.
 2. DINOv2 ViT-S/14 loaded for coarse retrieval: ~300MB.
 3. After coarse retrieval, DINOv2 can be unloaded or kept resident.
 4. SuperPoint loaded for fine matching: ~400MB.
 5. LightGlue ONNX loaded: ~500MB.
 6. Peak if all loaded: ~1.4GB.
 7. ONNX Runtime workspace: ~300MB.
 8. Total peak: ~1.7GB — well within 6GB.
 9. faiss runs on CPU — no VRAM impact.
 **Validation result**: Consistent. VRAM budget is comfortable even without model unloading.
 ## Validation Scenario 4: Extended satellite failure (50+ frames)
 **Scenario**: Flying over area with outdated/changed satellite imagery. Satellite matching fails for 80 consecutive frames (~8km).
 **Expected with Draft03 fixes**:
 1. Frames 1-10: normal VO, satellite matching fails. Cumulative drift increases.
 2. Frame ~10 (1km drift): warning SSE event emitted. Satellite search radius expanded.
 3. Frame ~20 (2km drift): user_input_needed SSE event. If user provides GPS → anchor + backward correction.
 4. If user doesn't respond within timeout: continue with LOW confidence.
 5. Frame ~50 (5km drift): positions marked as very low confidence.
 6. Confidence score per position decays exponentially from last anchor.
 7. If satellite finally matches at frame 80: massive backward correction. Refined events emitted.
 **Validation result**: Consistent. Explicit drift thresholds are more predictable than the custom GTSAM factor approach.
 ## Validation Scenario 5: Google Maps session token management
 **Scenario**: Processing a 3000-image flight. Need ~2000 satellite tiles.
 **Expected with Draft03 fixes**:
 1. On job start: create Google Maps session with POST /v1/createSession (returns session token).
 2. Use session token in all tile requests for this session.
 3. Daily limit: 15,000 tiles → sufficient for single flight.
 4. Monthly limit: 100,000 → ~50 flights.
 5. At 80% daily limit (12,000): switch to Mapbox.
 6. Mapbox: 200,000/month → additional ~100 flights capacity.
 **Validation result**: Consistent. Session management addressed correctly.
 ## Review Checklist
 - [x] Draft conclusions consistent with fact cards
 - [x] No important dimensions missed
 - [x] No over-extrapolation
 - [x] Conclusions actionable/verifiable
 - [x] GPSFactor API mismatch verified against GTSAM docs
 - [x] VRAM budget calculated with specific model variants
 - [x] Rotation handling addresses segment start edge case
 - [x] Drift management has concrete thresholds
 ## Counterexamples
 - **Very low-texture terrain** (uniform sand/snow): XFeat VO might fail even on consecutive frames. Mitigation: track texture score per image, warn when low.
 - **Satellite imagery completely missing for region**: Both Google and Mapbox might have no data. Mitigation: user-provided tiles are highest priority.
 - **Multiple concurrent GPU processes**: Another process using the GPU could reduce available VRAM. Mitigation: document exclusive GPU access requirement.
 ## Conclusions Requiring No Revision
 All conclusions validated. Key improvements are well-supported:
 1. Correct GTSAM factor types (PriorFactorPose2 instead of GPSFactor)
 2. DINOv2 ViT-S/14 for VRAM efficiency
 3. Three-tier rotation handling
 4. Explicit drift thresholds in Segment Manager
 5. asyncio.Queue-based SSE publisher
 6. CPU-based faiss
 7. Session token management for Google Maps
@@ -0,0 +1,74 @@
 # Acceptance Criteria Assessment
 ## Acceptance Criteria
 | Criterion | Our Values | Researched Values | Cost/Timeline Impact | Status |
 |-----------|-----------|-------------------|---------------------|--------|
 | Position accuracy (80% of photos) | ≤50m error | 15-150m achievable depending on method. SatLoc (2025): <15m with adaptive fusion. Mateos-Ramirez (2024): 142m mean at 1000m+ altitude. At 400m altitude with better GSD (~6cm/px) and satellite correction, ≤50m for 80% is realistic | Moderate — requires high-quality satellite imagery and robust feature matching pipeline | **Modified** — see notes on satellite imagery quality dependency |
 | Position accuracy (60% of photos) | ≤20m error | Achievable only with satellite-anchored corrections, not with VO alone. SatLoc reports <15m with satellite anchoring + VO fusion. Requires 0.3-0.5 m/px satellite imagery and good terrain texture | High — requires premium satellite imagery, robust cross-view matching, and careful calibration | **Modified** — add dependency on satellite correction frequency |
 | Outlier tolerance | 350m displacement between consecutive photos | At 400m altitude, image footprint is ~375x250m. A 350m displacement means near-zero overlap. VO will fail; system must rely on IMU dead-reckoning or satellite re-localization | Low — standard outlier detection can handle this | Modified — specify fallback strategy (IMU dead-reckoning + satellite re-matching) |
 | Sharp turn handling (partial overlap) | <200m drift, <70° angle, <5% overlap | Standard VO fails below ~20-30% overlap. With <5% overlap, feature matching between consecutive frames is unreliable. Requires satellite-based re-localization or IMU bridging | High — requires separate re-localization module | Modified — clarify: "70%" should likely be "70 degrees"; add IMU-bridge requirement |
 | Disconnected route segments | System should reconnect disconnected chunks | This is essentially a place recognition / re-localization problem. Solvable via satellite image matching for each new segment independently | High — core architectural requirement affecting system design | Modified — add: each segment should independently localize via satellite matching |
 | User fallback input | Ask user after 3 consecutive failures | Reasonable fallback. Needs UI/API integration for interactive input | Low | No change |
 | Processing time per image | <5 seconds | On Jetson Orin Nano Super (8GB shared memory): feasible with optimized pipeline. CUDA feature extraction ~50ms, matching ~100-500ms, satellite crop+match ~1-3s. Full pipeline 2-4s is achievable with image downsampling and TensorRT optimization | Moderate — requires TensorRT optimization and image downsampling strategy | **Modified** — specify this is for Jetson Orin Nano Super, not RTX 2060 |
 | Real-time streaming | SSE for immediate results + refinement | Standard pattern, well-supported | Low | No change |
 | Image Registration Rate | >95% | For consecutive frames with nadir camera in good conditions: 90-98% achievable. Drops significantly during sharp turns and over low-texture terrain (water, uniform fields). The 95% target conflicts with sharp-turn handling requirement | Moderate — requires learning-based matchers (SuperPoint/LightGlue) | **Modified** — clarify: 95% applies to "normal flight" segments only; sharp-turn frames are expected failures handled by re-localization |
 | Mean Reprojection Error | <1.0 pixels | Achievable with modern methods (LightGlue, SuperGlue). Traditional methods typically 1-3 px. Deep learning matchers routinely achieve 0.3-0.8 px with proper calibration | Moderate — requires deep learning feature matchers | No change — achievable |
 | REST API + SSE architecture | Background service | Standard architecture, well-supported in Python (FastAPI + SSE) | Low | No change |
 | Satellite imagery resolution | ≥0.5 m/px, ideally 0.3 m/px | Google Maps for eastern Ukraine: variable, typically 0.5-1.0 m/px in rural areas. 0.3 m/px unlikely from Google Maps. Commercial providers (Maxar, Planet) offer 0.3-0.5 m/px but at significant cost | **High** — Google Maps may not meet 0.5 m/px in all areas of the operational region. 0.3 m/px requires commercial satellite providers | **Modified** — current Google Maps limitation may make this unachievable for all areas; consider fallback for degraded satellite quality |
 | Confidence scoring | Per-position estimate (high=satellite, low=VO) | Standard practice in sensor fusion. Easy to implement | Low | No change |
 | Output format | WGS84, GeoJSON or CSV | Standard, trivial to implement | Negligible | No change |
 | Satellite imagery age | <2 years where possible | Google Maps imagery for conflict zones (eastern Ukraine) may be significantly outdated or intentionally degraded. Recency is hard to guarantee | Medium — may need multiple satellite sources | **Modified** — flag: conflict zone imagery may be intentionally limited |
 | Max VO cumulative drift | <100m between satellite corrections | VIO drift typically 0.8-1% of distance. Between corrections at 1km intervals: ~10m drift. 100m budget allows corrections every ~10km — very generous | Low — easily achievable if corrections happen at reasonable intervals | No change — generous threshold |
 | Memory usage | <8GB shared memory (Jetson Orin Nano Super) | Binding constraint. 8GB LPDDR5 shared between CPU and GPU. ~6-7GB usable after OS. 26MP images need downsampling | **Critical** — all processing must fit within 8GB shared memory | **Updated** — changed to Jetson Orin Nano Super constraint |
 | Object center coordinates | Accuracy consistent with frame-center accuracy | New criterion — derives from problem statement requirement | Low — once frame position is known, object position follows from pixel offset + GSD | **Added** |
 | Sharp turn handling | <200m drift, <70 degrees, <5% overlap. 95% registration rate applies to normal flight only | Clarified from original "70%" to "70 degrees". Split registration rate expectation | Low — clarification only | **Updated** |
 | Offline preprocessing time | Not time-critical (minutes/hours before flight) | New criterion — no constraint existed | Low | **Added** |
 ## Restrictions Assessment
 | Restriction | Our Values | Researched Values | Cost/Timeline Impact | Status |
 |-------------|-----------|-------------------|---------------------|--------|
 | Aircraft type | Fixed-wing only | Appropriate — fixed-wing has predictable motion model, mostly forward flight. Simplifies VO assumptions | N/A | No change |
 | Camera mount | Downward-pointing, fixed, not autostabilized | Implies roll/pitch affect image. At 400m altitude, moderate roll/pitch causes manageable image shift. IMU data can compensate. Non-stabilized means more variable image overlap and orientation | Medium — must use IMU data for image dewarping or accept orientation-dependent accuracy | **Modified** — add: IMU-based image orientation correction should be considered |
 | Operational region | Eastern/southern Ukraine (left of Dnipro) | Conflict zone — satellite imagery may be degraded, outdated, or restricted. Terrain: mix of agricultural, urban, forest. Agricultural areas have seasonal texture changes | **High** — satellite imagery availability and quality is a significant risk | **Modified** — flag operational risk: imagery access in conflict zones |
 | Image resolution | FullHD to 6252x4168, known camera parameters | 26MP at max is large for edge processing. Must downsample for feature extraction. Known camera intrinsics enable proper projective geometry | Medium — pipeline must handle variable resolutions | No change |
 | Altitude | Predefined, ≤1km, terrain height negligible | At 400m: GSD ~6cm/px, footprint ~375x250m. Terrain "negligible" is an approximation — even 50m terrain variation at 400m altitude causes ~12% scale error. The referenced paper (Mateos-Ramirez 2024) shows terrain elevation is a primary error source | **Medium** — "terrain height negligible" needs qualification. At 400m, terrain variations >50m become significant | **Modified** — add: terrain height can be neglected only if variations <50m within image footprint |
 | IMU data availability | "A lot of data from IMU" | IMU provides: accelerometer, gyroscope, magnetometer. Crucial for: dead-reckoning during feature-less frames, image orientation compensation, scale estimation, motion prediction. Standard tactical IMUs provide 100-400Hz data | Low — standard IMU integration | **Modified** — specify: IMU data includes gyroscope + accelerometer at ≥100Hz; will be used for orientation compensation and dead-reckoning fallback |
 | Weather | Mostly sunny | Favorable for visual methods. Shadows can actually help feature matching. Reduces image quality variability | Low — favorable condition | No change |
 | Satellite provider | Google Maps (potentially outdated) | **Critical limitation**: Google Maps satellite API has usage limits, unknown update frequency for eastern Ukraine, potential conflict-zone restrictions. Resolution may not meet 0.5 m/px in rural areas. No guarantee of recency | **High** — single-provider dependency is a significant risk | **Modified** — consider: (1) downloading tiles ahead of time for the operational area, (2) having a fallback provider strategy |
 | Photo count | Up to 3000, typically 500-1500 | At 3fps and 500-1500 photos: 3-8 minutes of flight. At ~100m spacing: 50-150km route. Memory for 3000 pre-extracted satellite feature maps needs careful management on 8GB | Medium — batch processing and memory management needed | **Modified** — add: pipeline must manage memory for up to 3000 frames on 8GB device |
 | Sharp turns | Next photo may have no common objects with previous | This is the hardest edge case. Complete visual discontinuity requires satellite-based re-localization. IMU provides heading/velocity for bridging. System must be architected around this possibility | High — drives core architecture decision | No change — already captured as a defining constraint |
 | Processing hardware | Jetson Orin Nano Super, 67 TOPS | 8GB shared LPDDR5, 1024 CUDA cores, 32 Tensor Cores, 102 GB/s bandwidth. TensorRT for inference optimization. Power: 7-25W. Significantly less capable than desktop GPU | **Critical** — all processing must fit within 8GB shared memory, pipeline must be optimized for TensorRT | **Modified** — CONTRADICTS AC's RTX 2060 reference. Must be the binding constraint |
 ## Key Findings
 1. **CRITICAL CONTRADICTION**: The AC mentions "RTX 2060 compatibility" (16GB RAM + 6GB VRAM) but the restriction specifies Jetson Orin Nano Super (8GB shared memory). These are fundamentally different platforms. **The Jetson must be the binding constraint.** All processing, including model weights, image buffers, and intermediate results, must fit within ~6-7GB usable memory (OS takes ~1-1.5GB).
 2. **Satellite Imagery Risk**: Google Maps as the sole satellite provider for a conflict zone in eastern Ukraine presents significant quality, resolution, and recency risks. The 0.3 m/px "ideal" resolution is unlikely available from Google Maps for this region. The system design must be robust to degraded satellite reference quality (0.5-1.0 m/px).
 3. **Accuracy is Achievable but Conditional**: The 50m/80% and 20m/60% accuracy targets are achievable based on recent research (SatLoc 2025: <15m with adaptive fusion), but **only when satellite corrections are successful**. VO-only segments will drift ~1% of distance traveled. The system must maximize satellite correction frequency.
 4. **Sharp Turn Handling Drives Architecture**: The requirement to handle disconnected route segments with no visual overlap between consecutive frames means the system cannot rely solely on sequential VO. It must have an independent satellite-based geo-localization capability for each frame or segment — this is a core architectural requirement.
 5. **Processing Time is Feasible**: <5s per image on Jetson Orin Nano Super is achievable with: (a) image downsampling (e.g., to 2000x1300), (b) TensorRT-optimized models, (c) efficient satellite region cropping. GPU-accelerated feature extraction takes ~50ms, matching ~100-500ms, satellite matching ~1-3s.
 6. **Missing AC: Object Center Coordinates**: The problem statement mentions "coordinates of the center of any object in these photos" but no acceptance criterion specifies the accuracy requirement for this. Need to add.
 7. **Missing AC: DEM/Elevation Data**: Research shows terrain elevation is a primary error source for pixel-to-meter conversion at these altitudes. If terrain variations are >50m, a DEM is needed. No current restriction mentions DEM availability.
 8. **Missing AC: Offline Preprocessing Time**: No constraint on how long satellite image preprocessing can take before the flight.
 9. **"70%" in Sharp Turn AC is Ambiguous**: "at an angle of less than 70%" — this likely means 70 degrees, not 70%.
 ## Sources
 - SatLoc: Hierarchical Adaptive Fusion Framework for GNSS-denied UAV Localization (2025) — <15m error, >90% coverage, 2+ Hz on edge hardware
 - Mateos-Ramirez et al. "Visual Odometry in GPS-Denied Zones for Fixed-Wing UAV" (2024) — 142.88m mean error over 17km at 1000m+ altitude, 0.83% error rate with satellite correction
 - NVIDIA Jetson Orin Nano Super specs: 8GB LPDDR5, 67 TOPS, 1024 CUDA cores, 102 GB/s bandwidth
 - cuda-efficient-features: Feature extraction benchmarks — 4K in ~12ms on Jetson Xavier
 - SIFT+LightGlue for UAV image mosaicking (ISPRS 2025) — superior performance across diverse scenarios
 - SuperPoint+LightGlue comparative analysis (2024) — best balance of robustness, accuracy, efficiency
 - Google Maps satellite resolution: 0.15m-30m depending on location and source imagery
 - VIO drift benchmarks: 0.82-1% of distance traveled (EuRoC, outdoor flights)
 - UAVSAR cross-modality matching: 1.83-2.86m RMSE with deep learning approach (Springer 2026)
@@ -0,0 +1,88 @@
 # Question Decomposition
 ## Original Question
 Research the GPS-denied onboard navigation problem for a fixed-wing UAV and find the best solution architecture. The system must determine frame-center GPS coordinates using visual odometry, satellite image matching, and IMU fusion — all running on a Jetson Orin Nano Super (8GB shared memory, 67 TOPS).
 ## Active Mode
 Mode A Phase 2 — Initial Research (Problem & Solution)
 ## Rationale
 No existing solution drafts. Full problem decomposition and solution research needed.
 ## Problem Context Summary (from INPUT_DIR)
 - **Platform**: Fixed-wing UAV, camera pointing down (not stabilized), 400m altitude max 1km
 - **Camera**: ADTi Surveyor Lite 26S v2, 26MP (6252x4168), focal length 25mm, sensor width 23.5mm
 - **GSD at 400m**: ~6cm/pixel, footprint ~375x250m
 - **Frame rate**: 3 fps (interval ~333ms, real-world could be 400-500ms)
 - **Photo count**: 500-3000 per flight
 - **IMU**: Available at high rate
 - **Initial GPS**: Known; GPS may be denied/spoofed during flight
 - **Satellite reference**: Pre-uploaded Google Maps tiles
 - **Hardware**: Jetson Orin Nano Super, 8GB shared memory, 67 TOPS
 - **Region**: Eastern/southern Ukraine (conflict zone)
 - **Key challenge**: Reconnecting disconnected route segments after sharp turns
 ## Question Type Classification
 **Decision Support** — we need to evaluate and select the best architectural approach and component technologies for each part of the pipeline.
 ## Research Subject Boundary Definition
 | Dimension | Boundary |
 |-----------|----------|
 | Population | Fixed-wing UAVs with nadir cameras at 200-1000m altitude |
 | Geography | Rural/semi-urban terrain in eastern Ukraine |
 | Timeframe | Current state-of-the-art (2023-2026) |
 | Level | Edge computing (Jetson-class, 8GB memory), real-time processing |
 ## Decomposed Sub-Questions
 ### A. Existing/Competitor Solutions
 1. What existing systems solve GPS-denied UAV visual navigation?
 2. What open-source implementations exist for VO + satellite matching?
 3. What commercial/military solutions address this problem?
 ### B. Architecture Components
 4. What is the optimal pipeline architecture (sequential vs parallel, streaming)?
 5. How should VO, satellite matching, and IMU fusion be combined (loosely vs tightly coupled)?
 6. How to handle disconnected route segments (the core architectural challenge)?
 ### C. Visual Odometry Component
 7. What VO algorithms work best for aerial nadir imagery on edge hardware?
 8. What feature extractors/matchers are optimal for Jetson (SuperPoint, ORB, XFeat)?
 9. How to handle scale estimation with known altitude and camera parameters?
 10. What is the optimal image downsampling strategy for 26MP on 8GB memory?
 ### D. Satellite Image Matching Component
 11. How to efficiently match UAV frames against pre-loaded satellite tiles?
 12. What cross-view matching methods work for aerial-to-satellite registration?
 13. How to preprocess and index satellite tiles for fast retrieval?
 14. How to handle resolution mismatch (6cm UAV vs 50cm+ satellite)?
 ### E. IMU Fusion Component
 15. How to fuse IMU data with visual estimates (EKF, UKF, factor graph)?
 16. How to use IMU for dead-reckoning during feature-less frames?
 17. How to use IMU for image orientation compensation (non-stabilized camera)?
 ### F. Edge Optimization
 18. How to fit the full pipeline in 8GB shared memory?
 19. What TensorRT optimizations are available for feature extractors?
 20. How to achieve <5s per frame on Jetson Orin Nano Super?
 ### G. API & Streaming
 21. What is the best approach for REST API + SSE on Python/Jetson?
 22. How to implement progressive result refinement?
 ## Timeliness Sensitivity Assessment
 - **Research Topic**: GPS-denied UAV visual navigation with edge processing
 - **Sensitivity Level**: 🟠 High
 - **Rationale**: Deep learning feature matchers (SuperPoint, LightGlue, XFeat) and edge inference frameworks (TensorRT) evolve rapidly. Jetson Orin Nano Super is a recent (Dec 2024) product. Cross-view geo-localization is an active research area.
 - **Source Time Window**: 12 months (prioritize 2025-2026)
 - **Priority official sources to consult**:
  1. NVIDIA Jetson documentation and benchmarks
  2. OpenCV / kornia / hloc official docs
  3. Recent papers on cross-view geo-localization (CVPR, ECCV, ICCV 2024-2025)
 - **Key version information to verify**:
  - JetPack SDK: Current version ____
  - SuperPoint/LightGlue: Latest available for TensorRT ____
  - XFeat: Version and Jetson compatibility ____
@@ -0,0 +1,151 @@
 # Source Registry
 ## Source #1
 - **Title**: Visual Odometry in GPS-Denied Zones for Fixed-Wing UAV with Reduced Accumulative Error Based on Satellite Imagery
 - **Link**: https://www.mdpi.com/2076-3417/14/16/7420
 - **Tier**: L1
 - **Publication Date**: 2024-08-22
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Fixed-wing UAV GPS-denied navigation
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: VO + satellite correction pipeline for fixed-wing UAV at 1000m+ altitude. Mean error 142.88m over 17km (0.83%). Uses ORB features, centroid-based displacement, Kalman filter smoothing, quadtree for satellite keypoint indexing.
 - **Related Sub-question**: A1, B5, C7, D11
 ## Source #2
 - **Title**: SatLoc: Hierarchical Adaptive Fusion Framework for GNSS-denied UAV Localization
 - **Link**: https://www.scilit.com/publications/e5cafaf875a49297a62b298a89d5572f
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: UAV localization in GNSS-denied environments
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Three-layer fusion: DinoV2 for satellite geo-localization, XFeat for VO, optical flow for velocity. Adaptive confidence-based weighting. <15m error, >90% coverage, 2+ Hz on edge hardware.
 - **Related Sub-question**: B4, B5, C8, D12
 ## Source #3
 - **Title**: XFeat: Accelerated Features for Lightweight Image Matching (CVPR 2024)
 - **Link**: https://arxiv.org/abs/2404.19174
 - **Tier**: L1
 - **Publication Date**: 2024-04
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Edge device feature matching
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: 5x faster than SuperPoint, runs on CPU at VGA resolution. Sparse and semi-dense matching. TensorRT deployment available for Jetson. Comparable accuracy to SuperPoint.
 - **Related Sub-question**: C8, F18, F20
 ## Source #4
 - **Title**: XFeat TensorRT Implementation
 - **Link**: https://github.com/PranavNedunghat/XFeatTensorRT
 - **Tier**: L2
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: C++ TensorRT implementation of XFeat, tested on Jetson Orin NX 16GB with JetPack 6.0, CUDA 12.2, TensorRT 8.6.
 - **Related Sub-question**: C8, F18, F19
 ## Source #5
 - **Title**: SuperPoint+LightGlue TensorRT Deployment
 - **Link**: https://github.com/fettahyildizz/superpoint_lightglue_tensorrt
 - **Tier**: L2
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: C++ TensorRT implementation of SuperPoint+LightGlue. Production-ready deployment for Jetson platforms.
 - **Related Sub-question**: C8, F19
 ## Source #6
 - **Title**: FP8 Quantized LightGlue in TensorRT
 - **Link**: https://fabio-sim.github.io/blog/fp8-quantized-lightglue-tensorrt-nvidia-model-optimizer/
 - **Tier**: L2
 - **Publication Date**: 2026
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: Up to ~6x speedup with FP8 quantization. Requires Hopper/Ada Lovelace GPUs (not available on Jetson Orin Nano Ampere). FP16 is the best available precision for Orin Nano.
 - **Related Sub-question**: F19
 ## Source #7
 - **Title**: NVIDIA JetPack 6.2 Release Notes
 - **Link**: https://docs.nvidia.com/jetson/archives/jetpack-archived/jetpack-62/release-notes/index.html
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: CUDA 12.6.10, TensorRT 10.3.0, cuDNN 9.3. Super Mode for Orin Nano: up to 2x inference performance, 50% memory bandwidth boost. Power modes: 15W, 25W, MAXN SUPER.
 - **Related Sub-question**: F18, F19, F20
 ## Source #8
 - **Title**: cuda-efficient-features (GPU feature detection benchmarks)
 - **Link**: https://github.com/fixstars/cuda-efficient-features
 - **Tier**: L2
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: 4K detection: 12ms on Jetson Xavier. 8K: 27.5ms. 40K keypoints extraction: 20-25ms on Xavier. Orin Nano Super should be comparable or better.
 - **Related Sub-question**: F20
 ## Source #9
 - **Title**: Adaptive Covariance Hybrid EKF/UKF for Visual-Inertial Odometry
 - **Link**: https://arxiv.org/abs/2512.17505
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: Hybrid EKF/UKF achieves 49% better position accuracy, 57% better rotation accuracy than ESKF alone, at 48% lower computational cost than full UKF. Includes adaptive sensor confidence scoring.
 - **Related Sub-question**: E15
 ## Source #10
 - **Title**: SIFT+LightGlue for UAV Image Mosaicking (ISPRS 2025)
 - **Link**: https://isprs-archives.copernicus.org/articles/XLVIII-2-W11-2025/169/2025/
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: SIFT+LightGlue outperforms SuperPoint+LightGlue for UAV mosaicking across diverse scenarios. Superior in both low-texture and high-texture environments.
 - **Related Sub-question**: C8, D12
 ## Source #11
 - **Title**: UAVision - GNSS-Denied UAV Visual Localization System
 - **Link**: https://github.com/ArboriseRS/UAVision
 - **Tier**: L4
 - **Publication Date**: 2024-2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: Open-source system using LightGlue for map matching. Includes image processing modules and visualization.
 - **Related Sub-question**: A2
 ## Source #12
 - **Title**: TerboucheHacene/visual_localization
 - **Link**: https://github.com/TerboucheHacene/visual_localization
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: Vision-based GNSS-free localization with SuperPoint/SuperGlue/GIM matching. Optimized VO + satellite image matching hybrid pipeline. Learning-based matchers for natural environments.
 - **Related Sub-question**: A2, D12
 ## Source #13
 - **Title**: GNSS-Denied Geolocalization with Terrain Constraints
 - **Link**: https://github.com/yfs90/gnss-denied-uav-geolocalization
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: No altimeters/IMU required, uses image matching + terrain constraints. GPS-comparable accuracy for day/night across varied terrain.
 - **Related Sub-question**: A2
 ## Source #14
 - **Title**: Google Maps Tile API Documentation
 - **Link**: https://developers.google.com/maps/documentation/tile/satellite
 - **Tier**: L1
 - **Publication Date**: Current
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: Zoom levels 0-22. Satellite tiles via HTTPS. Session tokens required. Bulk download possible but subject to usage policies.
 - **Related Sub-question**: D13
 ## Source #15
 - **Title**: NaviLoc: Trajectory-Level Visual Localization for GNSS-Denied UAV Navigation
 - **Link**: https://www.mdpi.com/2504-446X/10/2/97
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: Trajectory-level optimization rather than per-frame matching. Optimizes entire trajectory against satellite reference for improved accuracy.
 - **Related Sub-question**: B4, D11
 ## Source #16
 - **Title**: GSD Estimation for UAV Photogrammetry
 - **Link**: https://blog.truegeometry.com/calculators/UAV_photogrammetry_workflows_calculation.html
 - **Tier**: L3
 - **Publication Date**: Current
 - **Timeliness Status**: ✅ Currently valid
 - **Summary**: GSD = (sensor_width × altitude) / (focal_length × image_width). For our case: (23.5mm × 400m) / (25mm × 6252) = 0.06 m/pixel.
 - **Related Sub-question**: C9
@@ -0,0 +1,121 @@
 # Fact Cards
 ## Fact #1
 - **Statement**: XFeat achieves up to 5x faster inference than SuperPoint while maintaining comparable accuracy for pose estimation. It runs in real-time on CPU at VGA resolution.
 - **Source**: Source #3 (CVPR 2024 paper)
 - **Phase**: Phase 2
 - **Target Audience**: Edge device deployments
 - **Confidence**: ✅ High
 - **Related Dimension**: Feature Extraction
 ## Fact #2
 - **Statement**: XFeat TensorRT implementation exists and is tested on Jetson Orin NX 16GB with JetPack 6.0, CUDA 12.2, TensorRT 8.6.
 - **Source**: Source #4
 - **Phase**: Phase 2
 - **Target Audience**: Jetson platform deployment
 - **Confidence**: ✅ High
 - **Related Dimension**: Feature Extraction, Edge Optimization
 ## Fact #3
 - **Statement**: SatLoc framework achieves <15m absolute localization error with >90% trajectory coverage at 2+ Hz on edge hardware, using DinoV2 for satellite matching, XFeat for VO, and optical flow for velocity.
 - **Source**: Source #2
 - **Phase**: Phase 2
 - **Target Audience**: GNSS-denied UAV localization
 - **Confidence**: ⚠️ Medium (paper details not fully accessible)
 - **Related Dimension**: Overall Architecture, Accuracy
 ## Fact #4
 - **Statement**: Mateos-Ramirez et al. achieved 142.88m mean error over 17km (0.83% error rate) with VO + satellite correction on a fixed-wing UAV at 1000m+ altitude. Without satellite correction, error accumulated to 850m+ over 17km.
 - **Source**: Source #1
 - **Phase**: Phase 2
 - **Target Audience**: Fixed-wing UAV at high altitude
 - **Confidence**: ✅ High
 - **Related Dimension**: Accuracy, Architecture
 ## Fact #5
 - **Statement**: VIO systems typically drift 0.8-1% of distance traveled. Between satellite corrections at 1km intervals, expected drift is ~10m.
 - **Source**: Multiple sources (arxiv VIO benchmarks)
 - **Phase**: Phase 2
 - **Target Audience**: Aerial VIO systems
 - **Confidence**: ✅ High
 - **Related Dimension**: VO Drift
 ## Fact #6
 - **Statement**: Jetson Orin Nano Super: 8GB LPDDR5 shared memory, 1024 CUDA cores, 32 Tensor Cores, 102 GB/s bandwidth, 67 TOPS INT8. JetPack 6.2: CUDA 12.6.10, TensorRT 10.3.0.
 - **Source**: Source #7
 - **Phase**: Phase 2
 - **Target Audience**: Hardware specification
 - **Confidence**: ✅ High
 - **Related Dimension**: Edge Optimization
 ## Fact #7
 - **Statement**: CUDA-accelerated feature detection at 4K (3840x2160): ~12ms on Jetson Xavier. At 8K: ~27.5ms. Descriptor extraction for 40K keypoints: ~20-25ms on Xavier. Orin Nano Super has comparable or slightly better compute.
 - **Source**: Source #8
 - **Phase**: Phase 2
 - **Target Audience**: Jetson GPU performance
 - **Confidence**: ✅ High
 - **Related Dimension**: Processing Time
 ## Fact #8
 - **Statement**: Hybrid EKF/UKF achieves 49% better position accuracy than ESKF alone at 48% lower computational cost than full UKF. Includes adaptive sensor confidence scoring based on image entropy and motion blur.
 - **Source**: Source #9
 - **Phase**: Phase 2
 - **Target Audience**: VIO fusion
 - **Confidence**: ✅ High
 - **Related Dimension**: Sensor Fusion
 ## Fact #9
 - **Statement**: SIFT+LightGlue outperforms SuperPoint+LightGlue for UAV mosaicking across diverse scenarios (low-texture agricultural and high-texture urban).
 - **Source**: Source #10
 - **Phase**: Phase 2
 - **Target Audience**: UAV image matching
 - **Confidence**: ✅ High
 - **Related Dimension**: Feature Matching
 ## Fact #10
 - **Statement**: GSD for our system at 400m: (23.5mm × 400m) / (25mm × 6252px) = 0.060 m/pixel. Image footprint: 6252 × 0.06 = 375m width, 4168 × 0.06 = 250m height.
 - **Source**: Source #16 + camera parameters
 - **Phase**: Phase 2
 - **Target Audience**: Our specific system
 - **Confidence**: ✅ High
 - **Related Dimension**: Scale Estimation
 ## Fact #11
 - **Statement**: Google Maps satellite tiles available via Tile API at zoom levels 0-22. Max zoom varies by region. For eastern Ukraine, zoom 18 (~0.6 m/px) is typically available; zoom 19 (~0.3 m/px) may not be.
 - **Source**: Source #14
 - **Phase**: Phase 2
 - **Target Audience**: Satellite imagery
 - **Confidence**: ⚠️ Medium (exact zoom availability for eastern Ukraine unverified)
 - **Related Dimension**: Satellite Reference
 ## Fact #12
 - **Statement**: FP8 quantization for LightGlue requires Hopper/Ada GPUs. Jetson Orin Nano uses Ampere architecture — limited to FP16 as best TensorRT precision.
 - **Source**: Source #6, Source #7
 - **Phase**: Phase 2
 - **Target Audience**: Jetson optimization
 - **Confidence**: ✅ High
 - **Related Dimension**: Edge Optimization
 ## Fact #13
 - **Statement**: SuperPoint+LightGlue TensorRT C++ deployment is available and production-tested. ONNX Runtime path achieves 2-4x speedup over compiled PyTorch.
 - **Source**: Source #5, Source #6
 - **Phase**: Phase 2
 - **Target Audience**: Production deployment
 - **Confidence**: ✅ High
 - **Related Dimension**: Feature Matching, Edge Optimization
 ## Fact #14
 - **Statement**: Cross-view matching (UAV-to-satellite) is fundamentally harder than same-view matching due to extreme viewpoint differences. Deep learning embeddings (DinoV2, CLIP-based) are the state-of-the-art for coarse retrieval. Local features are used for fine alignment.
 - **Source**: Multiple (Sources #2, #12, #15)
 - **Phase**: Phase 2
 - **Target Audience**: Cross-view geo-localization
 - **Confidence**: ✅ High
 - **Related Dimension**: Satellite Matching
 ## Fact #15
 - **Statement**: Quadtree spatial indexing enables O(log n) nearest-neighbor lookup for satellite keypoints. Combined with GeoHash for fast region encoding, this is the standard approach for tile management.
 - **Source**: Sources #1, #14
 - **Phase**: Phase 2
 - **Target Audience**: Spatial indexing
 - **Confidence**: ✅ High
 - **Related Dimension**: Satellite Tile Management
@@ -0,0 +1,71 @@
 # Comparison Framework
 ## Selected Framework Type
 Decision Support — evaluating solution options per component
 ## Architecture Components to Evaluate
 1. Feature Extraction & Matching (VO frame-to-frame)
 2. Satellite Image Matching (cross-view geo-registration)
 3. Sensor Fusion (VO + satellite + IMU)
 4. Satellite Tile Preprocessing & Indexing
 5. Image Downsampling Strategy
 6. Re-localization (disconnected segments)
 7. API & Streaming Layer
 ## Component 1: Feature Extraction & Matching (VO)
 | Dimension | XFeat | SuperPoint + LightGlue | ORB (OpenCV) |
 |-----------|-------|----------------------|--------------|
 | Speed (Jetson) | ~2-5ms per frame (VGA), 5x faster than SuperPoint | ~15-50ms per frame (VGA, TensorRT FP16) | ~5-10ms per frame (CUDA) |
 | Accuracy | Comparable to SuperPoint on pose estimation | State-of-the-art for local features | Lower accuracy, not scale-invariant |
 | Memory | <100MB model | ~200-400MB model+inference | Negligible |
 | TensorRT support | Yes (C++ impl available for Jetson Orin NX) | Yes (C++ impl available) | N/A (native CUDA) |
 | Cross-view capability | Limited (same-view designed) | Better with LightGlue attention | Poor for cross-view |
 | Rotation invariance | Moderate | Good with LightGlue | Good (by design) |
 | Jetson validation | Tested on Orin NX (JetPack 6.0) | Tested on multiple Jetson platforms | Native OpenCV CUDA |
 | **Fit for VO** | ✅ Best — fast, accurate, Jetson-proven | ⚠️ Good but heavier | ⚠️ Fast but less accurate |
 | **Fit for satellite matching** | ⚠️ Moderate | ✅ Better for cross-view with attention | ❌ Poor for cross-view |
 ## Component 2: Satellite Image Matching (Cross-View)
 | Dimension | Local Feature Matching (SIFT/SuperPoint + LightGlue) | Global Descriptor Retrieval (DinoV2/CLIP) | Template Matching (NCC) |
 |-----------|-----------------------------------------------------|------------------------------------------|------------------------|
 | Approach | Extract keypoints in both UAV and satellite images, match descriptors | Encode both images into global vectors, compare by distance | Slide UAV image over satellite tile, compute correlation |
 | Accuracy | Sub-pixel when matches found (best for fine alignment) | Tile-level (~50-200m depending on tile size) | Pixel-level but sensitive to appearance changes |
 | Speed | ~100-500ms for match+geometric verification | ~50-100ms for descriptor comparison | ~500ms-2s for large search area |
 | Robustness to viewpoint | Good with LightGlue attention | Excellent (trained for cross-view) | Poor (requires similar viewpoint) |
 | Memory | ~300-500MB (model + keypoints) | ~200-500MB (model) | Low |
 | Failure rate | High in low-texture, seasonal changes | Lower — semantic understanding | High in changed scenes |
 | **Recommended role** | Fine alignment (after coarse retrieval) | Coarse retrieval (select candidate tile) | Not recommended |
 ## Component 3: Sensor Fusion
 | Dimension | EKF (Extended Kalman Filter) | Error-State EKF (ESKF) | Hybrid ESKF/UKF | Factor Graph (GTSAM) |
 |-----------|-------------------------------|------------------------|------------------|---------------------|
 | Accuracy | Baseline | Better for rotation | 49% better than ESKF | Best overall |
 | Compute cost | Lowest | Low | 48% less than full UKF | Highest |
 | Implementation complexity | Low | Medium | Medium-High | High |
 | Handles non-linearity | Linearization errors | Better for small errors | Best among KF variants | Full non-linear |
 | Real-time on Jetson | ✅ | ✅ | ✅ | ⚠️ Depends on graph size |
 | Multi-rate sensor support | Manual | Manual | Manual | Native |
 | **Fit** | ⚠️ Baseline option | ✅ Good starting point | ✅ Best KF option | ⚠️ Overkill for this system |
 ## Component 4: Satellite Tile Management
 | Dimension | GeoHash + In-Memory | Quadtree + Memory-Mapped Files | Pre-extracted Feature DB |
 |-----------|--------------------|-----------------------------|------------------------|
 | Lookup speed | O(1) hash | O(log n) tree traversal | O(1) hash + feature load |
 | Memory usage | All tiles in RAM | On-demand loading | Features only (smaller) |
 | Preprocessing | Fast | Moderate | Slow (extract all features offline) |
 | Flexibility | Fixed grid | Adaptive resolution | Fixed per-tile |
 | **Fit for 8GB** | ❌ Too much RAM for large areas | ✅ Memory-efficient | ✅ Best — smallest footprint |
 ## Component 5: Image Downsampling Strategy
 | Dimension | Fixed Resize (e.g., 1600x1066) | Pyramid (multi-scale) | ROI-based (center crop + full) |
 |-----------|-------------------------------|----------------------|-------------------------------|
 | Speed | Fast, single scale | Slower, multiple passes | Medium |
 | Accuracy | Good if GSD ratio maintained | Best for multi-scale features | Good for center, loses edges |
 | Memory | ~5MB per frame | ~7-8MB per frame | ~6MB per frame |
 | **Fit** | ✅ Best tradeoff | ⚠️ Unnecessary complexity | ⚠️ Loses coverage |
@@ -0,0 +1,129 @@
 # Reasoning Chain
 ## Dimension 1: Feature Extraction for Visual Odometry
 ### Fact Confirmation
 XFeat is 5x faster than SuperPoint (Fact #1), has TensorRT deployment on Jetson (Fact #2), and comparable accuracy for pose estimation. SatLoc (the most relevant state-of-the-art system) uses XFeat for its VO component (Fact #3).
 ### Reference Comparison
 SuperPoint+LightGlue is more accurate for cross-view matching but heavier. ORB is fast but less accurate and not robust to appearance changes. SIFT+LightGlue is best for mosaicking (Fact #9) but slower.
 ### Conclusion
 **XFeat for VO (frame-to-frame)** — it's the fastest learned feature, Jetson-proven, and used by the closest state-of-the-art system (SatLoc). For satellite matching, a different approach is needed because cross-view matching requires viewpoint-invariant features.
 ### Confidence
 ✅ High — supported by SatLoc architecture and CVPR 2024 benchmarks.
 ---
 ## Dimension 2: Satellite Image Matching Strategy
 ### Fact Confirmation
 Cross-view matching is fundamentally harder than same-view (Fact #14). Deep learning embeddings (DinoV2) are state-of-the-art for coarse retrieval (Fact #3). Local features are better for fine alignment. SatLoc uses DinoV2 for satellite matching specifically.
 ### Reference Comparison
 A two-stage coarse-to-fine approach is the dominant pattern in literature: (1) global descriptor retrieves candidate region, (2) local feature matching refines position. Pure local-feature matching has high failure rate for cross-view due to extreme viewpoint differences.
 ### Conclusion
 **Two-stage approach**: (1) Coarse — use a lightweight global descriptor to find the best-matching satellite tile within the search area (VO-predicted position ± uncertainty radius). (2) Fine — use local feature matching (SuperPoint+LightGlue or XFeat) between UAV frame and the matched satellite tile to get precise position. The coarse stage can also serve as the re-localization mechanism for disconnected segments.
 ### Confidence
 ✅ High — consensus across multiple recent papers and the SatLoc system.
 ---
 ## Dimension 3: Sensor Fusion Approach
 ### Fact Confirmation
 Hybrid ESKF/UKF achieves 49% better accuracy than ESKF alone at 48% lower cost than full UKF (Fact #8). Factor graphs (GTSAM) offer the best accuracy but are computationally expensive.
 ### Reference Comparison
 For our system: IMU runs at 100-400Hz, VO at ~3Hz (frame rate), satellite corrections at variable rate (whenever matching succeeds). We need multi-rate fusion that handles intermittent satellite corrections and continuous IMU.
 ### Conclusion
 **Error-State EKF (ESKF)** as the baseline fusion approach — it's well-understood, lightweight, handles multi-rate sensors naturally, and is proven for VIO on edge hardware. Upgrade to hybrid ESKF/UKF if ESKF accuracy is insufficient. Factor graphs are overkill for this real-time edge system.
 The filter state: position (lat/lon), velocity, orientation (quaternion), IMU biases. Measurements: VO-derived displacement (high rate), satellite-derived absolute position (variable rate), IMU (highest rate for prediction).
 ### Confidence
 ✅ High — ESKF is the standard choice for embedded VIO systems.
 ---
 ## Dimension 4: Satellite Tile Preprocessing & Indexing
 ### Fact Confirmation
 Quadtree enables O(log n) lookups (Fact #15). Pre-extracting features offline saves runtime compute. 8GB memory limits in-memory tile storage.
 ### Reference Comparison
 Full tiles in memory is infeasible for large areas. Memory-mapped files allow on-demand loading. Pre-extracted feature databases have the smallest runtime footprint.
 ### Conclusion
 **Offline preprocessing pipeline**:
 1. Download Google Maps satellite tiles at max zoom (18-19) for the operational area
 2. Extract features (XFeat or SuperPoint) from each tile
 3. Compute global descriptors (lightweight, e.g., NetVLAD or cosine-pooled XFeat descriptors) per tile
 4. Store: tile metadata (GPS bounds, zoom level), features + descriptors in a GeoHash-indexed database
 5. Build spatial index (GeoHash) for fast lookup by GPS region
 **Runtime**: Given VO-estimated position, query GeoHash to find nearby tiles, compare global descriptors for coarse match, then local feature matching for fine alignment.
 ### Confidence
 ✅ High — standard approach used by all relevant systems.
 ---
 ## Dimension 5: Image Downsampling Strategy
 ### Fact Confirmation
 26MP images need downsampling for 8GB device (Fact #6). Feature extraction at 4K takes ~12ms on Jetson Xavier (Fact #7). UAV GSD at 400m is ~6cm/px (Fact #10). Satellite GSD is ~60cm/px at zoom 18.
 ### Reference Comparison
 For VO (frame-to-frame): features at full resolution are wasteful — consecutive frames at 6cm GSD overlap ~80%, and features at lower resolution are sufficient for displacement estimation. For satellite matching: we need to match at satellite resolution (~60cm/px), so downsampling to match satellite GSD is natural.
 ### Conclusion
 **Downsample to ~1600x1066** (factor ~4x each dimension). This yields ~24cm/px GSD — still 2.5x finer than satellite, sufficient for feature matching. Image size: ~5MB (RGB). Feature extraction at this resolution: <10ms. This is the single resolution for both VO and satellite matching.
 ### Confidence
 ✅ High — standard practice for edge processing of high-res imagery.
 ---
 ## Dimension 6: Disconnected Segment Handling
 ### Fact Confirmation
 SatLoc uses satellite matching as an independent localization source that works regardless of VO state (Fact #3). The AC requires reconnecting disconnected segments as a core capability.
 ### Reference Comparison
 Pure VO cannot handle zero-overlap transitions. IMU dead-reckoning bridges short gaps (seconds). Satellite-based re-localization provides absolute position regardless of VO state.
 ### Conclusion
 **Independent satellite localization per frame** — every frame attempts satellite matching regardless of VO state. This naturally handles disconnected segments:
 1. When VO succeeds: satellite matching refines position (high confidence)
 2. When VO fails (sharp turn): satellite matching provides absolute position (sole source)
 3. When both fail: IMU dead-reckoning with low confidence score
 4. After 3 consecutive total failures: request user input
 Segment reconnection is automatic: all positions are in the same global (WGS84) frame via satellite matching. No explicit "reconnection" needed — segments share the satellite reference.
 ### Confidence
 ✅ High — this is the key architectural insight.
 ---
 ## Dimension 7: Processing Pipeline Architecture
 ### Fact Confirmation
 <5s per frame required (AC). Feature extraction ~10ms, VO matching ~20-50ms, satellite coarse retrieval ~50-100ms, satellite fine matching ~200-500ms, fusion ~1ms. Total: ~300-700ms per frame.
 ### Conclusion
 **Pipelined parallel architecture**:
 - Thread 1 (Camera): Capture frame, downsample, extract features → push to queue
 - Thread 2 (VO): Match with previous frame, compute displacement → push to fusion
 - Thread 3 (Satellite): Search nearby tiles, coarse retrieval, fine matching → push to fusion
 - Thread 4 (Fusion): ESKF prediction (IMU), update (VO), update (satellite) → emit result via SSE
 VO and satellite matching can run in parallel for each frame. Fusion integrates results as they arrive. This enables <1s per frame total latency.
 ### Confidence
 ✅ High — standard producer-consumer pipeline.
@@ -0,0 +1,98 @@
 # Validation Log
 ## Validation Scenario 1: Normal Flight (80% of time)
 UAV flies straight, consecutive frames overlap ~70-80%. Terrain has moderate texture (agricultural + urban mix).
 ### Expected Based on Conclusions
 - XFeat extracts features in ~5ms, VO matching in ~20ms
 - Satellite matching succeeds: coarse retrieval ~50ms, fine matching ~300ms
 - ESKF fuses both: position accuracy ~10-20m (satellite-anchored)
 - Total processing: <500ms per frame
 - Confidence: HIGH
 ### Actual Validation (against literature)
 SatLoc reports <15m error with >90% coverage under similar conditions. Mateos-Ramirez reports 0.83% drift with satellite correction. Both align with our expected performance.
 ### Result: ✅ PASS
 ---
 ## Validation Scenario 2: Sharp Turn (5-10% of time)
 UAV makes a 60-degree turn. Next frame has <5% overlap with previous. Heading changes rapidly.
 ### Expected Based on Conclusions
 - VO fails (insufficient feature overlap) — detected by low match count
 - IMU provides heading and approximate displacement for ~1-2 frames
 - Satellite matching attempts independent localization of the new frame
 - If satellite match succeeds: position recovered, segment continues
 - If satellite match fails: IMU dead-reckoning with LOW confidence
 ### Potential Issues
 - Satellite matching may also fail if the frame is heavily tilted (non-nadir view during turn)
 - IMU drift during turn: at 100m/s for 1s, displacement ~100m. IMU drift over 1s: ~1-5m — acceptable
 ### Result: ⚠️ CONDITIONAL PASS — depends on satellite matching success during turn. Non-stabilized camera may produce tilted images that are harder to match. IMU provides reasonable bridge.
 ---
 ## Validation Scenario 3: Disconnected Route (rare, <5%)
 UAV completes segment A, makes a 90+ degree turn, flies a new heading. Segment B has no overlap with segment A. Multiple such segments possible.
 ### Expected Based on Conclusions
 - Each segment independently localizes via satellite matching
 - No explicit reconnection needed — all in WGS84 frame
 - Per-segment accuracy depends on satellite matching success rate
 - Low-confidence gaps between segments until satellite match succeeds
 ### Result: ✅ PASS — architecture handles this natively via independent per-frame satellite matching.
 ---
 ## Validation Scenario 4: Memory-Constrained Operation (always)
 3000 frames, 8GB shared memory. Full pipeline running.
 ### Expected Based on Conclusions
 - Downsampled frame: ~5MB per frame. Keep 2 in memory (current + previous): ~10MB
 - XFeat model (TensorRT): ~50-100MB
 - Satellite tile features (loaded tiles): ~200-500MB for tiles near current position
 - ESKF state: <1MB
 - OS + runtime: ~1.5GB
 - Total: ~2-3GB active, well within 8GB
 ### Potential Issues
 - Satellite feature DB for large operational areas could be large on disk (not memory — loaded on demand)
 - Need careful management of tile loading/unloading
 ### Result: ✅ PASS — 8GB is sufficient with proper memory management.
 ---
 ## Validation Scenario 5: Degraded Satellite Imagery
 Google Maps tiles at 0.5-1.0 m/px resolution. Some areas have outdated imagery. Seasonal appearance changes.
 ### Expected Based on Conclusions
 - Coarse retrieval (global descriptors) should handle moderate appearance changes
 - Fine matching may fail on outdated/seasonal tiles — confidence drops to LOW
 - System falls back to VO + IMU in degraded areas
 - Multiple consecutive failures → user input request
 ### Potential Issues
 - If large areas have degraded satellite imagery, the system may operate mostly in VO+IMU mode with significant drift
 - 50m accuracy target may not be achievable in these areas
 ### Result: ⚠️ CONDITIONAL PASS — system degrades gracefully, but accuracy targets depend on satellite quality. This is a known risk per Phase 1 assessment.
 ---
 ## Review Checklist
 - [x] Draft conclusions consistent with fact cards
 - [x] No important dimensions missed
 - [x] No over-extrapolation
 - [x] Conclusions actionable/verifiable
 - [x] Sharp turn handling addressed
 - [x] Memory constraints validated
 - [ ] Issue: Satellite imagery quality in eastern Ukraine remains a risk
 - [ ] Issue: Non-stabilized camera during turns may degrade satellite matching
 ## Conclusions Requiring No Revision
 All major architectural decisions validated. Two known risks (satellite quality, non-stabilized camera during turns) are acknowledged and handled by the fallback hierarchy.
@@ -0,0 +1,80 @@
 # Question Decomposition — Solution Assessment (Mode B)
 ## Original Question
 Assess the existing solution draft (solution_draft01.md) for weak points, security vulnerabilities, and performance bottlenecks, then produce a revised solution draft.
 ## Active Mode
 Mode B: Solution Assessment — `solution_draft01.md` exists and is the highest-numbered draft.
 ## Question Type Classification
 - **Primary**: Problem Diagnosis — identify weak points, vulnerabilities, bottlenecks in existing solution
 - **Secondary**: Decision Support — evaluate alternatives for identified issues
 ## Research Subject Boundary Definition
 | Dimension | Boundary |
 |-----------|----------|
 | **Domain** | GPS-denied UAV visual navigation, aerial geo-referencing |
 | **Geography** | Eastern/southern Ukraine (left of Dnipro River) — steppe terrain, potential conflict-related satellite imagery degradation |
 | **Hardware** | Desktop/laptop with NVIDIA RTX 2060+, 16GB RAM, 6GB VRAM |
 | **Software** | Python ecosystem, GPU-accelerated CV/ML |
 | **Timeframe** | Current state-of-the-art (2024-2026), production-ready tools |
 | **Scale** | 500-3000 images per flight, up to 6252×4168 resolution |
 ## Problem Context Summary
 - UAV aerial photos taken consecutively ~100m apart, camera pointing down (not autostabilized)
 - Only starting GPS known — must determine GPS for all subsequent images
 - Must handle: sharp turns, outlier photos (up to 350m gap), disconnected route segments
 - Processing <5s/image, real-time SSE streaming, REST API service
 - No IMU data available
 ## Decomposed Sub-Questions
 ### A: Cross-View Matching Viability
 "Is SuperPoint+LightGlue with perspective warping reliable for UAV-to-satellite cross-view matching, or are there specialized cross-view methods that would perform better?"
 ### B: Homography-Based VO Robustness
 "Is homography-based VO (flat terrain assumption) robust enough for non-stabilized camera with potential roll/pitch variations and non-flat objects?"
 ### C: Satellite Imagery Reliability
 "What are the risks of relying solely on Google Maps satellite imagery for eastern Ukraine, and what fallback strategies exist?"
 ### D: Processing Time Feasibility
 "Are the processing time estimates (<5s per image) realistic on RTX 2060 with SuperPoint+LightGlue+satellite matching pipeline?"
 ### E: Optimizer Specification
 "Is the sliding window optimizer well-specified, and are there more proven alternatives like factor graph optimization?"
 ### F: Camera Rotation Handling
 "How should the system handle arbitrary image rotation from non-stabilized camera mount?"
 ### G: Security Assessment
 "What are the security vulnerabilities in the REST API + SSE architecture with image processing pipeline?"
 ### H: Newer Tools & Libraries
 "Are there newer (2025-2026) tools, models, or approaches that outperform the current selections (SuperPoint, LightGlue, etc.)?"
 ### I: Segment Management Robustness
 "Is the segment management strategy robust enough for multiple disconnected segments, especially when satellite anchoring fails for a segment?"
 ### J: Memory & Resource Management
 "Can the pipeline stay within 16GB RAM / 6GB VRAM while processing 3000 images at 6252×4168 resolution?"
 ---
 ## Timeliness Sensitivity Assessment
 - **Research Topic**: GPS-denied UAV visual navigation using learned feature matching and satellite geo-referencing
 - **Sensitivity Level**: 🟠 High
 - **Rationale**: Computer vision feature matching models (SuperPoint, LightGlue, etc.) are actively evolving with new versions and competitors. However, the core algorithms (homography, VO, optimization) are stable. The tool ecosystem changes frequently.
 - **Source Time Window**: 12 months (2025-2026)
 - **Priority official sources to consult**:
  1. LightGlue / SuperPoint GitHub repos (releases, issues)
  2. OpenCV documentation (current version)
  3. Google Maps Tiles API documentation
  4. Recent aerial geo-referencing papers (2024-2026)
 - **Key version information to verify**:
  - LightGlue: current version and ONNX/TensorRT support status
  - SuperPoint: current version and alternatives
  - FastAPI: SSE support status
  - Google Maps Tiles API: pricing, coverage, rate limits
@@ -0,0 +1,201 @@
 # Source Registry — Solution Assessment (Mode B)
 ## Source #1
 - **Title**: GLEAM: Learning to Match and Explain in Cross-View Geo-Localization
 - **Link**: https://arxiv.org/abs/2509.07450
 - **Tier**: L1
 - **Publication Date**: 2025-09
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Cross-view geo-localization researchers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Framework for cross-view geo-localization with explainable matching across modalities. Demonstrates that specialized cross-view methods outperform generic feature matchers.
 ## Source #2
 - **Title**: Robust UAV Image Mosaicking Using SIFT and LightGlue (ISPRS 2025)
 - **Link**: https://isprs-archives.copernicus.org/articles/XLVIII-2-W11-2025/169/2025/
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: UAV photogrammetry and aerial image processing
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: SIFT+LightGlue achieves superior spatial consistency and reliability for UAV image mosaicking, including low-texture and high-rotation conditions. SIFT outperforms SuperPoint for rotation-heavy scenarios.
 ## Source #3
 - **Title**: Precise GPS-Denied UAV Self-Positioning via Context-Enhanced Cross-View Geo-Localization (CEUSP)
 - **Link**: https://arxiv.org/abs/2502.11408 / https://github.com/eksnew/ceusp
 - **Tier**: L1
 - **Publication Date**: 2025-02
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: GPS-denied UAV navigation
 - **Research Boundary Match**: ⚠️ Partial overlap (urban, not steppe)
 - **Summary**: DINOv2-based cross-view matching for UAV self-positioning. State-of-the-art on DenseUAV benchmark. Uses retrieval-based (not feature-matching) approach.
 ## Source #4
 - **Title**: SatLoc Dataset and Hierarchical Adaptive Fusion Framework
 - **Link**: https://www.mdpi.com/2072-4292/17/17/3048
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: GNSS-denied UAV navigation
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Three-layer architecture: DINOv2 for absolute geo-localization, XFeat for VO, optical flow for velocity. Adaptive fusion with confidence weighting. <15m absolute error on edge hardware.
 ## Source #5
 - **Title**: LightGlue ONNX/TensorRT acceleration blog
 - **Link**: https://fabio-sim.github.io/blog/accelerating-lightglue-inference-onnx-runtime-tensorrt/
 - **Tier**: L2
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: LightGlue users optimizing inference
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: LightGlue ONNX achieves 2-4x speedup over PyTorch. FP8 quantization (Ada/Hopper GPUs only) adds 6x more. RTX 2060 does NOT support FP8.
 ## Source #6
 - **Title**: LightGlue-ONNX GitHub repository
 - **Link**: https://github.com/fabio-sim/LightGlue-ONNX
 - **Tier**: L2
 - **Publication Date**: 2024-2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: LightGlue deployment engineers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: ONNX export for LightGlue with FlashAttention-2 support. TopK-trick for ~30% speedup. Pre-exported models available.
 ## Source #7
 - **Title**: LightGlue GitHub Issue #64 — Rotation sensitivity
 - **Link**: https://github.com/cvg/LightGlue/issues/64
 - **Tier**: L4
 - **Publication Date**: 2023-2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: LightGlue users
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: LightGlue (with SuperPoint/DISK) is NOT rotation-invariant. 90° or 180° rotation causes matching failure. Manual rectification needed.
 ## Source #8
 - **Title**: LightGlue GitHub Issue #13 — No-match handling
 - **Link**: https://github.com/cvg/LightGlue/issues/13
 - **Tier**: L4
 - **Publication Date**: 2023
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: LightGlue users
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: LightGlue lacks explicit training on unmatchable pairs. May produce geometrically meaningless matches instead of rejecting non-overlapping views.
 ## Source #9
 - **Title**: YFS90/GNSS-Denied-UAV-Geolocalization GitHub
 - **Link**: https://github.com/yfs90/gnss-denied-uav-geolocalization
 - **Tier**: L1
 - **Publication Date**: 2024-2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: GPS-denied UAV navigation
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: <7m MAE using terrain-weighted constraint optimization + 2D-3D geo-registration. Uses DEM data. Validated across 20 complex scenarios. Works with publicly available satellite maps.
 ## Source #10
 - **Title**: Efficient image matching for UAV visual navigation via DALGlue (Scientific Reports 2025)
 - **Link**: https://www.nature.com/articles/s41598-025-21602-5
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: UAV visual navigation
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: 11.8% MMA improvement over LightGlue. Uses dual-tree complex wavelet transform + adaptive spatial feature fusion + linear attention. Designed for UAV dynamic flight.
 ## Source #11
 - **Title**: XFeat: Accelerated Features for Lightweight Image Matching (CVPR 2024)
 - **Link**: https://arxiv.org/html/2404.19174v1 / https://github.com/verlab/accelerated_features
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Real-time feature matching applications
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: 5x faster than SuperPoint. Runs real-time on CPU. Sparse + semi-dense matching. Used by SatLoc-Fusion for VO. 1500+ GitHub stars.
 ## Source #12
 - **Title**: An Oblique-Robust Absolute Visual Localization Method (IEEE TGRS 2024)
 - **Link**: https://ieeexplore.ieee.org/iel7/36/10354519/10356107.pdf
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: GPS-denied UAV localization
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: SE(2)-steerable network for rotation-equivariant features. Handles drastic perspective changes, non-perpendicular camera angles. No additional training for new scenes.
 ## Source #13
 - **Title**: Google Maps Tiles API Usage and Billing
 - **Link**: https://developers.google.com/maps/documentation/tile/usage-and-billing
 - **Tier**: L1
 - **Publication Date**: 2025-2026 (continuously updated)
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Google Maps API users
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: 100,000 free tile requests/month. Rate limit: 6,000/min, 15,000/day for 2D tiles. $200/month free credit expired Feb 2025. Now pay-as-you-go only.
 ## Source #14
 - **Title**: GTSAM Python API and Factor Graph examples
 - **Link**: https://github.com/borglab/gtsam / https://pypi.org/project/gtsam-develop/
 - **Tier**: L1
 - **Publication Date**: 2025-2026 (v4.2 stable, v4.3a1 dev)
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Robot navigation, SLAM
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Python bindings for factor graph optimization. GPSFactor for absolute position constraints. iSAM2 for incremental optimization. Stable v4.2 for production use.
 ## Source #15
 - **Title**: Copernicus DEM documentation
 - **Link**: https://documentation.dataspace.copernicus.eu/APIs/SentinelHub/Data/DEM.html
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: DEM data users
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Free 30m DEM (GLO-30) covering Ukraine. API access via Sentinel Hub Process API. Registration required.
 ## Source #16
 - **Title**: Homography Decomposition Revisited (IJCV 2025)
 - **Link**: https://link.springer.com/article/10.1007/s11263-025-02680-4
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Computer vision researchers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Existing homography decomposition methods can be unstable in certain configurations. Proposes hybrid framework for improved stability.
 ## Source #17
 - **Title**: Sliding window factor graph optimization for visual/inertial navigation (Cambridge 2020)
 - **Link**: https://www.cambridge.org/core/services/aop-cambridge-core/content/view/523C7C41D18A8D7C159C59235DF502D0/
 - **Tier**: L1
 - **Publication Date**: 2020
 - **Timeliness Status**: ✅ Currently valid (foundational method)
 - **Target Audience**: Navigation system designers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Sliding-window factor graph optimization combines accuracy of graph optimization with efficiency of windowed approach. Superior to separate filtering or full batch optimization.
 ## Source #18
 - **Title**: SuperPoint feature extraction and matching benchmarks
 - **Link**: https://preview-www.nature.com/articles/s41598-024-59626-y/tables/3
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Feature matching benchmarking
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: SuperPoint+LightGlue: ~0.36±0.06s per image pair for extraction+matching on GPU. Competitive accuracy for satellite stereo scenarios.
 ## Source #19
 - **Title**: DINOv2-Based UAV Visual Self-Localization in Low-Altitude Urban Environments
 - **Link**: https://ui.adsabs.harvard.edu/abs/2025IRAL...10.2080Y/
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: UAV visual localization researchers
 - **Research Boundary Match**: ⚠️ Partial overlap (urban, not steppe)
 - **Summary**: DINOv2-based method achieves 86.27 R@1 on DenseUAV benchmark for cross-view matching. Integrates global-local feature enhancement.
 ## Source #20
 - **Title**: Mapbox Satellite Tiles and Pricing
 - **Link**: https://docs.mapbox.com/data/tilesets/reference/mapbox-satellite/ / https://mapbox.com/pricing
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Map tile consumers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Mapbox offers satellite tiles up to 0.3m resolution (zoom 16+). 200,000 free vector tile requests/month. Unlimited offline downloads on pay-as-you-go. Multi-provider imagery (Maxar, Landsat, Sentinel).
@@ -0,0 +1,161 @@
 # Fact Cards — Solution Assessment (Mode B)
 ## Fact #1
 - **Statement**: LightGlue (with SuperPoint/DISK descriptors) is NOT rotation-invariant. Image pairs with 90° or 180° rotation produce very few or zero matches. Manual image rectification is required before matching.
 - **Source**: Source #7 (LightGlue GitHub Issue #64)
 - **Phase**: Assessment
 - **Target Audience**: UAV systems with non-stabilized cameras
 - **Confidence**: ✅ High (confirmed by LightGlue maintainers)
 - **Related Dimension**: Cross-view matching robustness, camera rotation handling
 ## Fact #2
 - **Statement**: LightGlue lacks explicit training on unmatchable image pairs. When given non-overlapping views (e.g., after sharp turn), it may return semantically correct but geometrically meaningless matches instead of correctly rejecting the pair.
 - **Source**: Source #8 (LightGlue GitHub Issue #13)
 - **Phase**: Assessment
 - **Target Audience**: Systems requiring segment detection (VO failure detection)
 - **Confidence**: ✅ High (confirmed by LightGlue maintainers)
 - **Related Dimension**: Segment management, VO failure detection
 ## Fact #3
 - **Statement**: SatLoc-Fusion achieves <15m absolute localization error using a three-layer hierarchical approach: DINOv2 for coarse absolute geo-localization, XFeat for high-frequency VO, optical flow for velocity estimation. Runs real-time on 6 TFLOPS edge hardware.
 - **Source**: Source #4 (SatLoc-Fusion, Remote Sensing 2025)
 - **Phase**: Assessment
 - **Target Audience**: GPS-denied UAV systems
 - **Confidence**: ✅ High (peer-reviewed, with dataset)
 - **Related Dimension**: Architecture, localization accuracy, hierarchical matching
 ## Fact #4
 - **Statement**: XFeat is 5x faster than SuperPoint with comparable accuracy. Runs real-time on CPU. Supports both sparse and semi-dense matching. 1500+ GitHub stars, actively maintained.
 - **Source**: Source #11 (CVPR 2024)
 - **Phase**: Assessment
 - **Target Audience**: Real-time feature extraction
 - **Confidence**: ✅ High (peer-reviewed, CVPR 2024)
 - **Related Dimension**: Processing speed, feature extraction
 ## Fact #5
 - **Statement**: SIFT+LightGlue achieves superior spatial consistency and reliability for UAV image mosaicking, including in low-texture and high-rotation conditions. SIFT is rotation-invariant unlike SuperPoint.
 - **Source**: Source #2 (ISPRS 2025)
 - **Phase**: Assessment
 - **Target Audience**: UAV image matching
 - **Confidence**: ✅ High (peer-reviewed)
 - **Related Dimension**: Feature extraction, rotation handling
 ## Fact #6
 - **Statement**: SuperPoint+LightGlue extraction+matching takes ~0.36±0.06s per image pair on GPU (unspecified GPU model). This is for standard resolution images, not 6000+ pixel width.
 - **Source**: Source #18
 - **Phase**: Assessment
 - **Target Audience**: Performance planning
 - **Confidence**: ⚠️ Medium (GPU model not specified, may not be RTX 2060)
 - **Related Dimension**: Processing time
 ## Fact #7
 - **Statement**: LightGlue ONNX/TensorRT achieves 2-4x speedup over compiled PyTorch. FP8 quantization adds 6x more but requires Ada Lovelace or newer GPUs. RTX 2060 (Turing) does NOT support FP8 — limited to FP16/INT8 acceleration.
 - **Source**: Source #5, #6 (LightGlue-ONNX blog and repo)
 - **Phase**: Assessment
 - **Target Audience**: RTX 2060 deployment
 - **Confidence**: ✅ High (benchmarked by repo maintainer)
 - **Related Dimension**: Processing time, hardware constraints
 ## Fact #8
 - **Statement**: YFS90 achieves <7m MAE using terrain-weighted constraint optimization + 2D-3D geo-registration with DEM data. Validated across 20 complex scenarios including plains, hilly terrain, urban/rural. Works with publicly available satellite maps and DEM data. Re-localization capability after failures.
 - **Source**: Source #9 (YFS90 GitHub)
 - **Phase**: Assessment
 - **Target Audience**: GPS-denied UAV navigation
 - **Confidence**: ✅ High (peer-reviewed, open source, 69★)
 - **Related Dimension**: Optimization approach, DEM integration, accuracy
 ## Fact #9
 - **Statement**: Google Maps $200/month free credit expired February 28, 2025. Current free tier is 100,000 tile requests/month. Rate limits: 6,000 requests/min, 15,000 requests/day for 2D tiles.
 - **Source**: Source #13 (Google Maps official docs)
 - **Phase**: Assessment
 - **Target Audience**: Cost planning
 - **Confidence**: ✅ High (official documentation)
 - **Related Dimension**: Cost, satellite imagery access
 ## Fact #10
 - **Statement**: Google Maps satellite imagery for eastern Ukraine is likely updated only every 3-5+ years due to: conflict zone (lower priority), geopolitical challenges, limited user demand. This may not meet the AC requirement of "less than 2 years old."
 - **Source**: Multiple web sources on Google Maps update frequency
 - **Phase**: Assessment
 - **Target Audience**: Satellite imagery reliability
 - **Confidence**: ⚠️ Medium (general guidelines, not Ukraine-specific confirmation)
 - **Related Dimension**: Satellite imagery reliability
 ## Fact #11
 - **Statement**: Mapbox Satellite offers imagery up to 0.3m resolution at zoom 16+, sourced from Maxar, Landsat, Sentinel. 200,000 free vector tile requests/month. Unlimited offline downloads on pay-as-you-go. Potentially more diverse and recent imagery for Ukraine than Google Maps alone.
 - **Source**: Source #20 (Mapbox docs)
 - **Phase**: Assessment
 - **Target Audience**: Alternative satellite providers
 - **Confidence**: ✅ High (official documentation)
 - **Related Dimension**: Satellite imagery reliability, cost
 ## Fact #12
 - **Statement**: Copernicus DEM GLO-30 provides free 30m resolution global elevation data including Ukraine. Accessible via Sentinel Hub API. Can be used for terrain-weighted optimization like YFS90.
 - **Source**: Source #15 (Copernicus docs)
 - **Phase**: Assessment
 - **Target Audience**: DEM integration
 - **Confidence**: ✅ High (official documentation)
 - **Related Dimension**: Position optimizer, terrain constraints
 ## Fact #13
 - **Statement**: GTSAM v4.2 (stable) provides Python bindings with GPSFactor for absolute position constraints and iSAM2 for incremental optimization. Can model VO constraints, satellite anchor constraints, and drift limits in a unified factor graph.
 - **Source**: Source #14 (GTSAM docs)
 - **Phase**: Assessment
 - **Target Audience**: Optimizer design
 - **Confidence**: ✅ High (widely used in robotics)
 - **Related Dimension**: Position optimizer
 ## Fact #14
 - **Statement**: DALGlue achieves 11.8% MMA improvement over LightGlue on MegaDepth benchmark. Specifically designed for UAV visual navigation with wavelet transform preprocessing for handling dynamic flight blur.
 - **Source**: Source #10 (Scientific Reports 2025)
 - **Phase**: Assessment
 - **Target Audience**: Feature matching selection
 - **Confidence**: ✅ High (peer-reviewed)
 - **Related Dimension**: Feature matching
 ## Fact #15
 - **Statement**: The oblique-robust AVL method (IEEE TGRS 2024) uses SE(2)-steerable networks for rotation-equivariant features. Handles drastic perspective changes and non-perpendicular camera angles for UAV-to-satellite matching. No retraining needed for new scenes.
 - **Source**: Source #12 (IEEE TGRS 2024)
 - **Phase**: Assessment
 - **Target Audience**: Cross-view matching
 - **Confidence**: ✅ High (peer-reviewed, IEEE)
 - **Related Dimension**: Cross-view matching, rotation handling
 ## Fact #16
 - **Statement**: Homography decomposition can be unstable in certain configurations (2025 IJCV study). Non-planar objects (buildings, trees) violate planar assumption. For aerial images, dominant ground plane exists but RANSAC inlier ratio drops with non-planar content.
 - **Source**: Source #16 (IJCV 2025)
 - **Phase**: Assessment
 - **Target Audience**: VO design
 - **Confidence**: ✅ High (peer-reviewed)
 - **Related Dimension**: VO robustness
 ## Fact #17
 - **Statement**: Sliding-window factor graph optimization combines the accuracy of full graph optimization with the efficiency of windowed processing. Superior to either pure filtering or full batch optimization for real-time navigation.
 - **Source**: Source #17 (Cambridge 2020)
 - **Phase**: Assessment
 - **Target Audience**: Optimizer design
 - **Confidence**: ✅ High (peer-reviewed)
 - **Related Dimension**: Position optimizer
 ## Fact #18
 - **Statement**: SuperPoint is a fully-convolutional model — GPU memory scales linearly with image resolution. 6252×4168 input would require significant VRAM. Standard practice is to downscale to 1024-2048 long edge for feature extraction.
 - **Source**: Source #18, SuperPoint docs
 - **Phase**: Assessment
 - **Target Audience**: Memory management
 - **Confidence**: ✅ High (architectural fact)
 - **Related Dimension**: Memory management, processing pipeline
 ## Fact #19
 - **Statement**: For GPS-denied UAV localization, hierarchical coarse-to-fine approaches (image retrieval → local feature matching) are state-of-the-art. Direct local feature matching alone fails when the search area is too large or viewpoint difference is too high.
 - **Source**: Source #3, #4, #12 (CEUSP, SatLoc, Oblique-robust AVL)
 - **Phase**: Assessment
 - **Target Audience**: Architecture design
 - **Confidence**: ✅ High (consensus across multiple papers)
 - **Related Dimension**: Architecture, satellite matching
 ## Fact #20
 - **Statement**: Google Maps Tiles API daily rate limit of 15,000 requests would be hit when processing a 3000-image flight requiring ~2000 satellite tiles plus expansion tiles. Need to either pre-cache or use the per-minute limit (6,000/min) strategically across multiple days.
 - **Source**: Source #13 (Google Maps docs)
 - **Phase**: Assessment
 - **Target Audience**: System design
 - **Confidence**: ✅ High (official rate limits)
 - **Related Dimension**: Satellite tile management, rate limiting
@@ -0,0 +1,79 @@
 # Comparison Framework — Solution Assessment (Mode B)
 ## Selected Framework Type
 Problem Diagnosis + Decision Support
 ## Identified Weak Points and Assessment Dimensions
 ### Dimension 1: Cross-View Matching Strategy (UAV→Satellite)
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | Strategy | Direct SuperPoint+LightGlue matching with perspective warping | No coarse localization stage. Fails when VO drift is large. LightGlue not rotation-invariant. | Hierarchical: DINOv2/global retrieval → SuperPoint+LightGlue refinement | Fact #1, #2, #15, #19 |
 | Rotation handling | Not addressed | Non-stabilized camera = rotated images. SuperPoint/LightGlue fail at 90°/180° | Image rectification via VO-estimated heading, or rotation-invariant features (SIFT for fallback) | Fact #1, #5 |
 | Domain gap | Perspective warping only | Insufficient for seasonal/illumination/resolution differences | Multi-scale matching, DINOv2 for semantic retrieval, warping + matched features | Fact #3, #15 |
 ### Dimension 2: Feature Extraction & Matching
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | VO features | SuperPoint (~80ms) | Adequate but not optimized for speed | XFeat (5x faster, CPU-capable) for VO; keep SuperPoint for satellite matching | Fact #4 |
 | Matching | LightGlue | Good baseline. DALGlue 11.8% better MMA. | LightGlue with ONNX optimization as primary. DALGlue for evaluation. | Fact #7, #14 |
 | Non-match detection | Not addressed | LightGlue returns false matches on non-overlapping pairs | Inlier ratio + match count threshold + geometric consistency check | Fact #2 |
 ### Dimension 3: Visual Odometry Robustness
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | Geometric model | Homography (planar assumption) | Unstable for non-planar objects. Decomposition instability in certain configs. | Homography with RANSAC + high inlier ratio requirement. Essential matrix as fallback. | Fact #16 |
 | Scale estimation | GSD from altitude | Valid if altitude is constant. Terrain elevation changes not accounted for. | Integrate Copernicus DEM for terrain-corrected GSD | Fact #12 |
 | Camera rotation | Not addressed | Non-stabilized camera introduces roll/pitch | Estimate rotation from VO, apply rectification before satellite matching | Fact #1, #5 |
 ### Dimension 4: Position Optimizer
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | Algorithm | scipy.optimize sliding window | Generic optimizer, no proper uncertainty modeling, no factor types | GTSAM factor graph with iSAM2 incremental optimization | Fact #13, #17 |
 | Terrain constraints | Not used | YFS90 achieves <7m with terrain weighting | Integrate DEM-based terrain constraints via Copernicus DEM | Fact #8, #12 |
 | Drift modeling | Max 100m between anchors | Single hard constraint, no probabilistic modeling | Per-VO-step uncertainty based on inlier ratio, propagated through factor graph | Fact #17 |
 ### Dimension 5: Satellite Imagery Reliability
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | Provider | Google Maps only | Eastern Ukraine: 3-5 year update cycle. $200 credit expired. 15K/day rate limit. | Multi-provider: Google Maps primary + Mapbox fallback + pre-cached tiles | Fact #9, #10, #11, #20 |
 | Freshness | Assumed adequate | May not meet AC "< 2 years old" for conflict zone | Provider selection per-area. User can provide custom imagery. | Fact #10 |
 | Rate limiting | Not addressed | 15,000/day cap could block large flights | Progressive download with request budgeting. Pre-cache for known areas. | Fact #20 |
 ### Dimension 6: Processing Time Budget
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | Target | <5s (claim <2s) | Per-frame pipeline: VO match + satellite match + optimization. Total could exceed budget. | XFeat for VO (~20ms). LightGlue ONNX for satellite (~100ms). Async satellite matching. | Fact #4, #6, #7 |
 | Image downscaling | Not specified | 6252×4168 cannot be processed at full resolution | Downscale to 1600 long edge for features. Keep full resolution for GSD calculation. | Fact #18 |
 | Parallelism | Not specified | Sequential pipeline wastes GPU idle time | Async: extract features while satellite tile downloads. Pipeline overlap. | — |
 ### Dimension 7: Memory Management
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | Image loading | Not specified | 6252×4168 × 3ch = 78MB per raw image. 3000 images = 234GB. | Stream images one at a time. Keep only current + previous features in memory. | Fact #18 |
 | VRAM budget | Not specified | SuperPoint on full resolution could exceed 6GB VRAM | Downscale images. Batch size 1. Clear GPU cache between frames. | Fact #18 |
 | Feature storage | Not specified | 3000 images × features = significant RAM | Store only features needed for sliding window. Disk-backed for older frames. | — |
 ### Dimension 8: Security
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | Authentication | API key mentioned | No implementation details. API key in query params = insecure. | JWT tokens for session auth. Short-lived tokens for SSE connections. | SSE security research |
 | Path traversal | Mentioned in testing | image_folder parameter could be exploited | Whitelist base directories. Validate path doesn't escape allowed root. | — |
 | DoS protection | Not addressed | Large image uploads, SSE connection exhaustion | Max file size limits. Connection pool limits. Request rate limiting. | — |
 | API key storage | env var mentioned | Adequate baseline | .env file + secrets manager in production. Never log API keys. | — |
 ### Dimension 9: Segment Management
 | Aspect | Draft01 Approach | Identified Problem | Alternative | Factual Basis |
 |--------|-----------------|-------------------|------------|---------------|
 | Re-connection | Via satellite anchoring only | If satellite matching fails, segment stays floating | Attempt cross-segment matching when new anchors arrive. DEM-based constraint stitching. | Fact #8 |
 | Multi-segment handling | Described conceptually | No detail on how >2 segments are managed | Explicit segment graph with pending connections. Priority queue for unresolved segments. | — |
 | User input fallback | POST /jobs/{id}/anchor | Good design. Needs timeout/escalation for when user doesn't respond. | Add configurable timeout before continuing with VO-only estimate. | — |
@@ -0,0 +1,145 @@
 # Reasoning Chain — Solution Assessment (Mode B)
 ## Dimension 1: Cross-View Matching Strategy
 ### Fact Confirmation
 According to Fact #1, LightGlue is not rotation-invariant and fails on rotated images. According to Fact #2, it returns false matches on non-overlapping pairs. According to Fact #19, state-of-the-art GPS-denied localization uses hierarchical coarse-to-fine approaches. SatLoc-Fusion (Fact #3) achieves <15m with DINOv2 + XFeat + optical flow.
 ### Reference Comparison
 Draft01 uses direct SuperPoint+LightGlue matching with perspective warping. This is a single-stage approach — it assumes the VO-estimated position is close enough to fetch the right satellite tile, then matches directly. But: (a) when VO drift accumulates between satellite anchors, the estimated position may be wrong enough to fetch the wrong tile; (b) the domain gap between UAV oblique images and satellite nadir is significant; (c) rotation from non-stabilized camera is not handled.
 State-of-the-art approaches add a coarse localization stage (DINOv2 image retrieval over a wider area) before fine matching. This makes satellite matching robust to larger VO drift.
 ### Conclusion
 **Replace single-stage with two-stage satellite matching**: (1) DINOv2-based coarse retrieval over a search area (e.g., 500m radius around VO estimate) to find the best-matching satellite tile, (2) SuperPoint+LightGlue for precise alignment on the selected tile. Add image rotation normalization before matching. This is the most critical improvement.
 ### Confidence
 ✅ High — multiple independent sources confirm hierarchical approach superiority.
 ---
 ## Dimension 2: Feature Extraction & Matching
 ### Fact Confirmation
 According to Fact #4, XFeat is 5x faster than SuperPoint with comparable accuracy and is used in SatLoc-Fusion for real-time VO. According to Fact #5, SIFT+LightGlue is more robust for high-rotation conditions. According to Fact #14, DALGlue improves LightGlue MMA by 11.8% for UAV scenarios.
 ### Reference Comparison
 Draft01 uses SuperPoint for all feature extraction (both VO and satellite matching). This is simpler (unified pipeline) but suboptimal: VO needs speed (processed every frame), while satellite matching needs accuracy (processed periodically).
 ### Conclusion
 **Dual-extractor strategy**: XFeat for VO (fast, adequate accuracy for frame-to-frame), SuperPoint for satellite matching (higher accuracy needed for cross-view). LightGlue with ONNX/TensorRT optimization as matcher. SIFT as fallback for rotation-heavy scenarios. DALGlue is promising but too new for production — monitor.
 ### Confidence
 ✅ High — XFeat benchmarks are from CVPR 2024, well-established.
 ---
 ## Dimension 3: Visual Odometry Robustness
 ### Fact Confirmation
 According to Fact #16, homography decomposition can be unstable and non-planar objects degrade results. According to Fact #12, Copernicus DEM provides free 30m elevation data for terrain-corrected GSD.
 ### Reference Comparison
 Draft01's homography-based VO is valid for flat terrain but doesn't account for: (a) terrain elevation changes affecting GSD calculation, (b) non-planar objects in the scene, (c) camera roll/pitch from non-stabilized mount. The terrain in eastern Ukraine is mostly steppe but has settlements, forests, and infrastructure.
 ### Conclusion
 **Keep homography VO as primary** (valid for dominant ground plane), but: (1) add RANSAC inlier ratio check — if below threshold, fall back to essential matrix estimation; (2) integrate Copernicus DEM for terrain-corrected altitude in GSD calculation; (3) estimate and track camera rotation (roll/pitch/yaw) from consecutive VO estimates and use it for image rectification before satellite matching.
 ### Confidence
 ✅ High — homography with RANSAC and fallback is well-established.
 ---
 ## Dimension 4: Position Optimizer
 ### Fact Confirmation
 According to Fact #13, GTSAM provides Python bindings with GPSFactor and iSAM2 incremental optimization. According to Fact #17, sliding-window factor graph optimization is superior to either pure filtering or full batch optimization. According to Fact #8, YFS90 achieves <7m MAE with terrain-weighted constraints + DEM.
 ### Reference Comparison
 Draft01 proposes scipy.optimize with a custom sliding window. While functional, this is reinventing the wheel — GTSAM's iSAM2 already implements incremental smoothing with proper uncertainty propagation. GTSAM's factor graph naturally supports: BetweenFactor for VO constraints (with uncertainty), GPSFactor for satellite anchors, custom factors for terrain constraints, drift limit constraints.
 ### Conclusion
 **Replace scipy.optimize with GTSAM iSAM2 factor graph**. Use BetweenFactor for VO relative motion, GPSFactor for satellite anchors (with uncertainty based on match quality), and a custom terrain factor using Copernicus DEM. This provides: proper uncertainty propagation, incremental updates (fits SSE streaming), backwards smoothing when new anchors arrive.
 ### Confidence
 ✅ High — GTSAM is production-proven, stable v4.2 available via pip.
 ---
 ## Dimension 5: Satellite Imagery Reliability
 ### Fact Confirmation
 According to Fact #9, Google Maps $200/month free credit expired Feb 2025. Current free tier is 100K tiles/month. According to Fact #10, eastern Ukraine imagery may be 3-5+ years old. According to Fact #20, 15,000/day rate limit could be hit on large flights. According to Fact #11, Mapbox offers alternative satellite tiles at comparable resolution.
 ### Reference Comparison
 Draft01 relies solely on Google Maps. Single-provider dependency creates multiple risk points: outdated imagery, rate limits, cost, API changes.
 ### Conclusion
 **Multi-provider satellite tile manager**: Google Maps as primary, Mapbox as secondary, user-provided tiles as override. Implement: provider fallback when matching confidence is low, request budgeting to stay within rate limits, tile freshness metadata logging, pre-caching mode for known operational areas.
 ### Confidence
 ✅ High — multi-provider is standard practice for production systems.
 ---
 ## Dimension 6: Processing Time Budget
 ### Fact Confirmation
 According to Fact #6, SuperPoint+LightGlue takes ~0.36s per pair on GPU. According to Fact #7, ONNX optimization adds 2-4x speedup (on RTX 2060, limited to FP16). According to Fact #4, XFeat is 5x faster than SuperPoint for VO.
 ### Reference Comparison
 Draft01's per-frame pipeline: (1) feature extraction, (2) VO matching, (3) satellite tile fetch, (4) satellite matching, (5) optimization, (6) SSE emit. Total estimated without optimization: ~1-2s for VO + ~0.5-1s for satellite + overhead = 2-4s. With ONNX optimization for matching and XFeat for VO, this drops to ~0.5-1.5s.
 ### Conclusion
 **Budget is achievable with optimizations**: XFeat for VO (~20ms extraction + ~50ms matching), LightGlue ONNX for satellite (~100ms extraction + ~100ms matching), async satellite tile download (overlapped with VO), GTSAM incremental update (~10ms). Total: ~0.5-1s per frame. Satellite matching can be async — not every frame needs satellite match. Image downscaling to 1600 long edge is essential.
 ### Confidence
 ⚠️ Medium — depends on actual RTX 2060 benchmarks, which are extrapolated from general numbers.
 ---
 ## Dimension 7: Memory Management
 ### Fact Confirmation
 According to Fact #18, SuperPoint is fully-convolutional and VRAM scales with resolution. 6252×4168 images would require significant VRAM and RAM.
 ### Reference Comparison
 Draft01 doesn't specify memory management. With 3000 images at max resolution, naive processing would exceed 16GB RAM.
 ### Conclusion
 **Strict memory management**: (1) Downscale all images to max 1600 long edge before feature extraction; (2) stream images one at a time — only keep current + previous frame features in GPU memory; (3) store features for sliding window in CPU RAM, older features to disk; (4) limit satellite tile cache to 500MB in RAM, overflow to disk; (5) batch size 1 for all GPU operations; (6) explicit torch.cuda.empty_cache() between frames if VRAM pressure detected.
 ### Confidence
 ✅ High — standard memory management patterns.
 ---
 ## Dimension 8: Security
 ### Fact Confirmation
 JWT tokens are recommended for SSE endpoint security. API keys in query parameters are insecure (persist in logs, browser history).
 ### Reference Comparison
 Draft01 mentions API key auth but no implementation details. SSE connections need proper authentication and resource limits.
 ### Conclusion
 **Security improvements**: (1) JWT-based authentication for all endpoints; (2) short-lived tokens for SSE connections; (3) image folder whitelist (not just path traversal prevention — explicit whitelist of allowed base directories); (4) max concurrent SSE connections per client; (5) request rate limiting; (6) max image size validation; (7) all API keys in environment variables, never logged.
 ### Confidence
 ✅ High — standard security practices.
 ---
 ## Dimension 9: Segment Management
 ### Fact Confirmation
 According to Fact #8, YFS90 has re-localization capability after positioning failures. According to Fact #2, LightGlue may return false matches on non-overlapping pairs.
 ### Reference Comparison
 Draft01's segment management relies on satellite matching to anchor each segment independently. If satellite matching fails, the segment stays "floating." No mechanism for cross-segment matching or delayed resolution.
 ### Conclusion
 **Enhanced segment management**: (1) Explicit VO failure detection using match count + inlier ratio + geometric consistency (not just match count); (2) when a new segment gets satellite-anchored, attempt to connect to nearby floating segments using satellite-based position proximity; (3) DEM-based constraint: position must be consistent with terrain elevation; (4) configurable timeout for user input request — if no response within N frames, continue with best estimate and flag.
 ### Confidence
 ⚠️ Medium — cross-segment connection is logical but needs careful implementation to avoid false connections.
@@ -0,0 +1,93 @@
 # Validation Log — Solution Assessment (Mode B)
 ## Validation Scenario 1: Normal flight over steppe with gradual turns
 **Scenario**: 1000-image flight over flat agricultural steppe. FullHD resolution. Starting GPS known. Gradual turns every 200 frames. Satellite imagery 2 years old.
 **Expected with Draft02 improvements**:
 1. XFeat VO processes frames at ~70ms each → well under 5s budget
 2. DINOv2 coarse retrieval finds correct satellite area despite 50-100m VO drift
 3. SuperPoint+LightGlue ONNX refines position to ~10-20m accuracy
 4. GTSAM iSAM2 smooths trajectory, reduces drift between anchors
 5. At gradual turns, VO continues working (overlap >30%)
 6. Processing stays under 1GB VRAM with 1600px downscale
 **Actual validation result**: Consistent with expectations. This is the "happy path" — both draft01 and draft02 would work. Draft02 advantage: faster processing, better optimizer.
 ## Validation Scenario 2: Sharp turn with no overlap
 **Scenario**: After 500 normal frames, UAV makes a 90° sharp turn. Next 3 images have zero overlap with previous route. Then normal flight continues.
 **Expected with Draft02 improvements**:
 1. VO detects failure: match count drops below threshold → segment break
 2. LightGlue false-match protection: geometric consistency check rejects bad matches
 3. New segment starts. DINOv2 coarse retrieval searches wider area for satellite match
 4. If satellite match succeeds: new segment anchored, connected to previous via shared coordinate frame
 5. If satellite match fails: segment marked floating, user input requested (with timeout)
 6. After turn, if UAV returns near previous route, cross-segment connection attempted
 **Draft01 comparison**: Draft01 would also detect VO failure and create new segment, but lacks coarse retrieval → satellite matching depends entirely on VO estimate which may be wrong after turn. Higher risk of satellite match failure.
 ## Validation Scenario 3: High-resolution images (6252×4168)
 **Scenario**: 500 images at full 6252×4168 resolution. RTX 2060 (6GB VRAM).
 **Expected with Draft02 improvements**:
 1. Images downscaled to 1600×1066 for feature extraction
 2. Full resolution preserved for GSD calculation only
 3. Per-frame VRAM: ~1.5GB for XFeat/SuperPoint + LightGlue
 4. RAM per frame: ~78MB raw + ~5MB features → manageable with streaming
 5. Total peak RAM: sliding window (50 frames × 5MB features) + satellite cache (500MB) + overhead ≈ 1.5GB pipeline
 6. Well within 16GB RAM budget
 **Actual validation result**: Consistent. Downscaling strategy is essential and was missing from draft01.
 ## Validation Scenario 4: Outdated satellite imagery
 **Scenario**: Flight over area where Google Maps imagery is 4 years old. Significant changes: new buildings, removed forests, changed roads.
 **Expected with Draft02 improvements**:
 1. DINOv2 coarse retrieval: partial success (terrain structure still recognizable)
 2. SuperPoint+LightGlue fine matching: lower match count on changed areas
 3. Confidence score drops for affected frames → flagged in output
 4. Multi-provider fallback: try Mapbox tiles if Google matches are poor
 5. System falls back to VO-only for sections with no good satellite match
 6. User can provide custom satellite imagery for specific areas
 **Draft01 comparison**: Draft01 would also fail on changed areas but has no alternative provider and no coarse retrieval to help.
 ## Validation Scenario 5: 3000-image flight hitting API rate limits
 **Scenario**: First flight in a new area. No cached tiles. 3000 images need ~2000 satellite tiles.
 **Expected with Draft02 improvements**:
 1. Initial download: 300 tiles around starting GPS (within rate limits)
 2. Progressive download as route extends: 5-20 tiles per frame
 3. Daily limit (15,000): sufficient for tiles but tight if multiple flights
 4. Request budgeting: prioritize tiles around current position, defer expansion
 5. Per-minute limit (6,000): no issue
 6. Monthly limit (100,000): covers ~50 flights at 2000 tiles each
 7. Mapbox fallback if Google budget exhausted
 **Draft01 comparison**: Draft01 assumed $200 free credit (expired). Rate limit analysis was incorrect.
 ## Review Checklist
 - [x] Draft conclusions consistent with fact cards
 - [x] No important dimensions missed
 - [x] No over-extrapolation
 - [x] Conclusions actionable/verifiable
 - [x] All scenarios plausible for the operational context
 ## Counterexamples
 - **Night flight**: Not addressed (out of scope — restriction says "mostly sunny weather")
 - **Very low altitude (<100m)**: Satellite matching would have poor GSD match — not addressed but within restrictions (altitude ≤1km)
 - **Urban area with tall buildings**: Homography VO degradation — mitigated by essential matrix fallback but not fully addressed
 ## Conclusions Requiring No Revision
 All conclusions validated against scenarios. Key improvements are well-supported:
 1. Hierarchical satellite matching (coarse + fine)
 2. GTSAM factor graph optimization
 3. Multi-provider satellite tiles
 4. XFeat for VO speed
 5. Image downscaling for memory
 6. Proper security (JWT, rate limiting)
@@ -0,0 +1,56 @@
 # Question Decomposition
 ## Original Question
 Assess current solution draft. Additionally:
 1. Try SuperPoint + LightGlue for visual odometry
 2. Can LiteSAM be SO SLOW because of big images? If we reduce size to 1280p, would that work faster?
 ## Active Mode
 Mode B: Solution Assessment — `solution_draft01.md` exists in OUTPUT_DIR.
 ## Question Type
 Problem Diagnosis + Decision Support
 ## Research Subject Boundary
 - **Population**: GPS-denied UAV navigation systems on edge hardware
 - **Geography**: Eastern Ukraine conflict zone
 - **Timeframe**: Current (2025-2026), using latest available tools
 - **Level**: Jetson Orin Nano Super (8GB, 67 TOPS) — edge deployment
 ## Decomposed Sub-Questions
 ### Q1: SuperPoint + LightGlue for Visual Odometry
 - What is SP+LG inference speed on Jetson-class hardware?
 - How does it compare to cuVSLAM (116fps on Orin Nano)?
 - Is SP+LG suitable for frame-to-frame VO at 3fps?
 - What is SP+LG accuracy vs cuVSLAM for VO?
 ### Q2: LiteSAM Speed vs Image Resolution
 - What resolution was LiteSAM benchmarked at? (1184px on AGX Orin)
 - How does LiteSAM speed scale with resolution?
 - What would 1280px achieve on Orin Nano Super vs AGX Orin?
 - Is the bottleneck image size or compute power gap?
 ### Q3: General Weak Points in solution_draft01
 - Are there functional weak points?
 - Are there performance bottlenecks?
 - Are there security gaps?
 ### Q4: SP+LG for Satellite Matching (alternative to LiteSAM/XFeat)
 - How does SP+LG perform on cross-view satellite-aerial matching?
 - What does the LiteSAM paper say about SP+LG accuracy?
 ## Timeliness Sensitivity Assessment
 - **Research Topic**: Edge-deployed visual odometry and satellite-aerial matching
 - **Sensitivity Level**: 🟠 High
 - **Rationale**: cuVSLAM v15.0.0 released March 2026; LiteSAM published October 2025; LightGlue TensorRT optimizations actively evolving
 - **Source Time Window**: 12 months
 - **Priority official sources**:
  1. LiteSAM paper (MDPI Remote Sensing, October 2025)
  2. cuVSLAM / PyCuVSLAM v15.0.0 (March 2026)
  3. LightGlue-ONNX / TensorRT benchmarks (2024-2026)
  4. Intermodalics cuVSLAM benchmark (2025)
 - **Key version information**:
  - cuVSLAM: v15.0.0 (March 2026)
  - LightGlue: ICCV 2023, TensorRT via fabio-sim/LightGlue-ONNX
  - LiteSAM: Published October 2025, code at boyagesmile/LiteSAM
@@ -0,0 +1,121 @@
 # Source Registry
 ## Source #1
 - **Title**: LiteSAM: Lightweight and Robust Feature Matching for Satellite and Aerial Imagery
 - **Link**: https://www.mdpi.com/2072-4292/17/19/3349
 - **Tier**: L1
 - **Publication Date**: 2025-10-01
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: LiteSAM v1.0; benchmarked on Jetson AGX Orin (JetPack 5.x era)
 - **Target Audience**: UAV visual localization researchers and edge deployers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: LiteSAM (opt) achieves 497.49ms on Jetson AGX Orin at 1184px input. 6.31M params. RMSE@30 = 17.86m on UAV-VisLoc. Paper directly compares with SP+LG, stating "SP+LG achieves the fastest inference speed but at the expense of accuracy." Section 4.9 shows resolution vs speed tradeoff on RTX 3090Ti.
 - **Related Sub-question**: Q2 (LiteSAM speed), Q4 (SP+LG for satellite matching)
 ## Source #2
 - **Title**: cuVSLAM: CUDA accelerated visual odometry and mapping
 - **Link**: https://arxiv.org/abs/2506.04359
 - **Tier**: L1
 - **Publication Date**: 2025-06 (paper), v15.0.0 released 2026-03-10
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: cuVSLAM v15.0.0 / PyCuVSLAM v15.0.0
 - **Target Audience**: Robotics/UAV visual odometry on NVIDIA Jetson
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: CUDA-accelerated VO+SLAM, supports mono+IMU. 116fps on Jetson Orin Nano 8GB at 720p. <1% trajectory error on KITTI. <5cm on EuRoC.
 - **Related Sub-question**: Q1 (SP+LG vs cuVSLAM)
 ## Source #3
 - **Title**: Intermodalics — NVIDIA Isaac ROS In-Depth: cuVSLAM and the DP3.1 Release
 - **Link**: https://www.intermodalics.ai/blog/nvidia-isaac-ros-in-depth-cuvslam-and-the-dp3-1-release
 - **Tier**: L2
 - **Publication Date**: 2025 (DP3.1 release)
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: cuVSLAM v11 (DP3.1), benchmark data applicable to later versions
 - **Target Audience**: Robotics developers using Isaac ROS
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: 116fps on Orin Nano 8GB, 232fps on AGX Orin, 386fps on RTX 4060 Ti. Outperforms ORB-SLAM2 on KITTI.
 - **Related Sub-question**: Q1
 ## Source #4
 - **Title**: Accelerating LightGlue Inference with ONNX Runtime and TensorRT
 - **Link**: https://fabio-sim.github.io/blog/accelerating-lightglue-inference-onnx-runtime-tensorrt/
 - **Tier**: L2
 - **Publication Date**: 2024-07-17
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: torch 2.4.0, TensorRT 10.2.0, RTX 4080 benchmarks
 - **Target Audience**: ML engineers deploying LightGlue
 - **Research Boundary Match**: ⚠️ Partial (desktop GPU, not Jetson)
 - **Summary**: TensorRT achieves 2-4x speedup over compiled PyTorch for SuperPoint+LightGlue. Full pipeline benchmarks on RTX 4080. TensorRT has 3840 keypoint limit. No Jetson-specific benchmarks provided.
 - **Related Sub-question**: Q1
 ## Source #5
 - **Title**: LightGlue-with-FlashAttentionV2-TensorRT (Jetson Orin NX 8GB)
 - **Link**: https://github.com/qdLMF/LightGlue-with-FlashAttentionV2-TensorRT
 - **Tier**: L4
 - **Publication Date**: 2025-02
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: TensorRT 8.5.2, Jetson Orin NX 8GB
 - **Target Audience**: Edge ML deployers
 - **Research Boundary Match**: ✅ Full match (similar hardware)
 - **Summary**: CUTLASS-based FlashAttention V2 TensorRT plugin for LightGlue, tested on Jetson Orin NX 8GB. No published latency numbers, but confirms LightGlue TensorRT deployment on Orin-class hardware is feasible.
 - **Related Sub-question**: Q1
 ## Source #6
 - **Title**: vo_lightglue — Visual Odometry with LightGlue
 - **Link**: https://github.com/himadrir/vo_lightglue
 - **Tier**: L4
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: N/A
 - **Target Audience**: VO researchers
 - **Research Boundary Match**: ⚠️ Partial (desktop, KITTI dataset)
 - **Summary**: SP+LG achieves 10fps on KITTI dataset (desktop GPU). Odometric error ~1% vs 3.5-4.1% for FLANN-based matching. Much slower than cuVSLAM.
 - **Related Sub-question**: Q1
 ## Source #7
 - **Title**: ForestVO: Enhancing Visual Odometry in Forest Environments through ForestGlue
 - **Link**: https://arxiv.org/html/2504.01261v1
 - **Tier**: L1
 - **Publication Date**: 2025-04
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: N/A
 - **Target Audience**: VO researchers
 - **Research Boundary Match**: ⚠️ Partial (forest environment, not nadir UAV)
 - **Summary**: SP+LG VO pipeline achieves 1.09m avg relative pose error, KITTI score 2.33%. Uses 512 keypoints (reduced from 2048) to cut compute. Outperforms DSO by 40%.
 - **Related Sub-question**: Q1
 ## Source #8
 - **Title**: SuperPoint-SuperGlue-TensorRT (C++ deployment)
 - **Link**: https://github.com/yuefanhao/SuperPoint-SuperGlue-TensorRT
 - **Tier**: L4
 - **Publication Date**: 2023-2024
 - **Timeliness Status**: ⚠️ Needs verification (SuperGlue, not LightGlue)
 - **Version Info**: TensorRT 8.x
 - **Target Audience**: Edge deployers
 - **Research Boundary Match**: ⚠️ Partial
 - **Summary**: SuperPoint TensorRT extraction ~40ms on Jetson for 200 keypoints. C++ implementation.
 - **Related Sub-question**: Q1
 ## Source #9
 - **Title**: Comparative Analysis of Advanced Feature Matching Algorithms in HSR Satellite Stereo
 - **Link**: https://arxiv.org/abs/2405.06246
 - **Tier**: L1
 - **Publication Date**: 2024-05
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: N/A
 - **Target Audience**: Remote sensing researchers
 - **Research Boundary Match**: ⚠️ Partial (satellite stereo, not UAV-satellite cross-view)
 - **Summary**: SP+LG shows "overall superior performance in balancing robustness, accuracy, distribution, and efficiency" for satellite stereo matching. But this is same-view satellite-satellite, not cross-view UAV-satellite.
 - **Related Sub-question**: Q4
 ## Source #10
 - **Title**: PyCuVSLAM with reComputer (Seeed Studio)
 - **Link**: https://wiki.seeedstudio.com/pycuvslam_recomputer_robotics/
 - **Tier**: L3
 - **Publication Date**: 2026
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: PyCuVSLAM v15.0.0, JetPack 6.2
 - **Target Audience**: Robotics developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Tutorial for deploying PyCuVSLAM on Jetson Orin NX. Confirms mono+IMU mode, pip install from aarch64 wheel, EuRoC dataset examples.
 - **Related Sub-question**: Q1
@@ -0,0 +1,122 @@
 # Fact Cards
 ## Fact #1
 - **Statement**: cuVSLAM achieves 116fps on Jetson Orin Nano 8GB at 720p resolution (~8.6ms/frame). 232fps on AGX Orin. 386fps on RTX 4060 Ti.
 - **Source**: [Source #3] Intermodalics benchmark
 - **Phase**: Assessment
 - **Confidence**: ✅ High
 - **Related Dimension**: VO speed comparison
 ## Fact #2
 - **Statement**: SuperPoint+LightGlue VO achieves ~10fps on KITTI dataset on desktop GPU (~100ms/frame). With 274 keypoints on RTX 2080Ti, LightGlue matching alone takes 33.9ms.
 - **Source**: vo_lightglue, LG issue #36
 - **Confidence**: ⚠️ Medium (desktop GPU, not Jetson)
 - **Related Dimension**: VO speed comparison
 ## Fact #3
 - **Statement**: SuperPoint feature extraction takes ~40ms on Jetson (TensorRT, 200 keypoints).
 - **Source**: SuperPoint-SuperGlue-TensorRT
 - **Confidence**: ⚠️ Medium (older Jetson)
 - **Related Dimension**: VO speed comparison
 ## Fact #4
 - **Statement**: LightGlue TensorRT with FlashAttention V2 has been deployed on Jetson Orin NX 8GB. No published latency numbers.
 - **Source**: qdLMF/LightGlue-with-FlashAttentionV2-TensorRT
 - **Confidence**: ⚠️ Medium
 - **Related Dimension**: VO speed comparison
 ## Fact #5
 - **Statement**: LiteSAM (opt) inference: 61.98ms on RTX 3090, 497.49ms on Jetson AGX Orin at 1184px input. 6.31M params.
 - **Source**: LiteSAM paper, abstract + Section 4.10
 - **Confidence**: ✅ High
 - **Related Dimension**: Satellite matcher speed
 ## Fact #6
 - **Statement**: Jetson AGX Orin has 275 TOPS INT8, 2048 CUDA cores. Orin Nano Super has 67 TOPS INT8, 1024 CUDA cores. AGX Orin is ~3-4x more powerful.
 - **Source**: NVIDIA official specs
 - **Confidence**: ✅ High
 - **Related Dimension**: Hardware scaling
 ## Fact #7
 - **Statement**: LiteSAM processes at 1/8 scale internally. Coarse matching is O(N²) where N = (H/8 × W/8). For 1184px: ~21,904 tokens. For 1280px: ~25,600. For 480px: ~3,600.
 - **Source**: LiteSAM paper, Sections 3.1-3.3
 - **Confidence**: ✅ High
 - **Related Dimension**: LiteSAM speed vs resolution
 ## Fact #8
 - **Statement**: LiteSAM paper Figure 1 states: "SP+LG achieves the fastest inference speed but at the expense of accuracy" vs LiteSAM on satellite-aerial benchmarks.
 - **Source**: LiteSAM paper
 - **Confidence**: ✅ High
 - **Related Dimension**: SP+LG vs LiteSAM
 ## Fact #9
 - **Statement**: LiteSAM achieves RMSE@30 = 17.86m on UAV-VisLoc. SP+LG is worse on same benchmark.
 - **Source**: LiteSAM paper
 - **Confidence**: ✅ High
 - **Related Dimension**: Satellite matcher accuracy
 ## Fact #10
 - **Statement**: cuVSLAM uses Shi-Tomasi corners ("Good Features to Track") for keypoint detection, divided into NxM grid patches. Uses Lucas-Kanade optical flow for tracking. When tracked keypoints fall below threshold, creates new keyframe.
 - **Source**: cuVSLAM paper (arXiv:2506.04359), Section 2.1
 - **Confidence**: ✅ High
 - **Related Dimension**: cuVSLAM on difficult terrain
 ## Fact #11
 - **Statement**: cuVSLAM automatically switches to IMU when visual tracking fails (dark lighting, long solid surfaces). IMU integrator provides ~1 second of acceptable tracking. After IMU, constant-velocity integrator provides ~0.5 seconds more.
 - **Source**: Isaac ROS cuVSLAM docs
 - **Confidence**: ✅ High
 - **Related Dimension**: cuVSLAM on difficult terrain
 ## Fact #12
 - **Statement**: cuVSLAM does NOT guarantee correct pose recovery after losing track. External algorithms required for global re-localization after tracking loss. Cannot fuse GNSS, wheel odometry, or LiDAR.
 - **Source**: Intermodalics blog
 - **Confidence**: ✅ High
 - **Related Dimension**: cuVSLAM on difficult terrain
 ## Fact #13
 - **Statement**: cuVSLAM benchmarked on KITTI (mostly urban/suburban driving) and EuRoC (indoor drone). Neither benchmark includes nadir agricultural terrain, flat fields, or uniform vegetation. No published results for these conditions.
 - **Source**: cuVSLAM paper Section 3
 - **Confidence**: ✅ High
 - **Related Dimension**: cuVSLAM on difficult terrain
 ## Fact #14
 - **Statement**: cuVSLAM multi-stereo mode "significantly improves accuracy and robustness on challenging sequences compared to single stereo cameras", designed for featureless surfaces (narrow corridors, elevators). But our system uses monocular camera only.
 - **Source**: cuVSLAM paper Section 2.2.2
 - **Confidence**: ✅ High
 - **Related Dimension**: cuVSLAM on difficult terrain
 ## Fact #15
 - **Statement**: PFED achieves 97.15% Recall@1 on University-1652 at 251.5 FPS on AGX Orin with only 4.45G FLOPs. But this is image RETRIEVAL (which satellite tile matches), NOT pixel-level correspondence matching.
 - **Source**: PFED paper (arXiv:2510.22582)
 - **Confidence**: ✅ High
 - **Related Dimension**: Satellite matching alternatives
 ## Fact #16
 - **Statement**: EfficientLoFTR is ~2.5x faster than LoFTR with higher accuracy. Semi-dense matcher, 15.05M params. Has TensorRT adaptation (LoFTR_TRT). Performs well on weak-texture areas where traditional methods fail. Designed for aerial imagery.
 - **Source**: EfficientLoFTR paper (CVPR 2024), HuggingFace docs
 - **Confidence**: ✅ High
 - **Related Dimension**: Satellite matching alternatives
 ## Fact #17
 - **Statement**: Hierarchical AVL system (2025) uses two-stage approach: DINOv2 for coarse retrieval + SuperPoint for fine matching. 64.5-95% success rate on real-world drone trajectories. Includes IMU-based prior correction and sliding-window map updates.
 - **Source**: MDPI Remote Sensing 2025
 - **Confidence**: ✅ High
 - **Related Dimension**: Satellite matching alternatives
 ## Fact #18
 - **Statement**: STHN uses deep homography estimation for UAV geo-localization: directly estimates homography transform (no feature detection/matching/RANSAC). Achieves 4.24m MACE at 50m range. Designed for thermal but architecture is modality-agnostic.
 - **Source**: STHN paper (IEEE RA-L 2024)
 - **Confidence**: ✅ High
 - **Related Dimension**: Satellite matching alternatives
 ## Fact #19
 - **Statement**: For our nadir UAV → satellite matching, the cross-view gap is SMALL compared to typical cross-view problems (ground-to-satellite). Both views are approximately top-down. Main challenges: season/lighting, resolution mismatch, temporal changes. This means general-purpose matchers may work better than expected.
 - **Source**: Analytical observation
 - **Confidence**: ⚠️ Medium
 - **Related Dimension**: Satellite matching alternatives
 ## Fact #20
 - **Statement**: LiteSAM paper benchmarked EfficientLoFTR (opt) on satellite-aerial: 19.8% slower than LiteSAM (opt) on AGX Orin but with 2.4x more parameters. EfficientLoFTR achieves competitive accuracy. LiteSAM paper Table 3/4 provides direct comparison.
 - **Source**: LiteSAM paper, Section 4.5
 - **Confidence**: ✅ High
 - **Related Dimension**: EfficientLoFTR vs LiteSAM
@@ -0,0 +1,45 @@
 # Comparison Framework
 ## Selected Framework Type
 Decision Support + Problem Diagnosis
 ## Selected Dimensions
 1. Inference speed on Orin Nano Super
 2. Accuracy for the target task
 3. Cross-view robustness (satellite-aerial gap)
 4. Implementation complexity / ecosystem maturity
 5. Memory footprint
 6. TensorRT optimization readiness
 ## Comparison 1: Visual Odometry — cuVSLAM vs SuperPoint+LightGlue
 | Dimension | cuVSLAM v15.0.0 | SuperPoint + LightGlue (TRT) | Factual Basis |
 |-----------|-----------------|-------------------------------|---------------|
 | Speed on Orin Nano | ~8.6ms/frame (116fps @ 720p) | Est. ~150-300ms/frame (SP ~40-60ms + LG ~100-200ms) | Fact #1, #2, #3 |
 | VO accuracy (KITTI) | <1% trajectory error | ~1% odometric error (desktop) | Fact #1, #2 |
 | VO accuracy (EuRoC) | <5cm position error | Not benchmarked | Fact #1 |
 | IMU integration | Native mono+IMU mode, auto-fallback | None — must add custom IMU fusion | Fact #1 |
 | Loop closure | Built-in | Not available | Fact #1 |
 | TensorRT ready | Native CUDA (not TensorRT, raw CUDA) | Requires ONNX export + TRT build | Fact #4 |
 | Memory | ~200-300MB | SP ~50MB + LG ~50-100MB = ~100-150MB | Fact #1 |
 | Implementation | pip install aarch64 wheel | Custom pipeline: SP export + LG export + matching + pose estimation | Fact #1, #4 |
 | Maturity on Jetson | NVIDIA-maintained, production-ready | Community TRT plugins, limited Jetson benchmarks | Fact #4, #5 |
 ## Comparison 2: LiteSAM Speed at Different Resolutions
 | Dimension | 1184px (paper default) | 1280px (user proposal) | 640px | 480px | Factual Basis |
 |-----------|------------------------|------------------------|-------|-------|---------------|
 | Tokens at 1/8 scale | ~21,904 | ~25,600 | ~6,400 | ~3,600 | Fact #7 |
 | AGX Orin time | 497ms | Est. ~580ms (1.17x tokens) | Est. ~150ms | Est. ~90ms | Fact #5, #7 |
 | Orin Nano Super time (est.) | ~1.5-2.0s | ~1.7-2.3s | ~450-600ms | ~270-360ms | Fact #5, #6 |
 | Accuracy (RMSE@30) | 17.86m | Similar (slightly less) | Degraded | Significantly degraded | Fact #8, #10 |
 ## Comparison 3: Satellite Matching — LiteSAM vs SP+LG vs XFeat
 | Dimension | LiteSAM (opt) | SuperPoint+LightGlue | XFeat semi-dense | Factual Basis |
 |-----------|--------------|---------------------|------------------|---------------|
 | Cross-view accuracy | RMSE@30 = 17.86m (UAV-VisLoc) | Worse than LiteSAM (paper confirms) | Not benchmarked on UAV-VisLoc | Fact #9, #10 |
 | Speed on Orin Nano (est.) | ~1.5-2s @ 1184px, ~270-360ms @ 480px | Est. ~100-200ms total | ~50-100ms | Fact #5, #2, existing draft |
 | Cross-view robustness | Designed for satellite-aerial gap | Sparse matcher, "lacks sufficient accuracy" for cross-view | General-purpose, less robust | Fact #9, #13 |
 | Parameters | 6.31M | SP ~1.3M + LG ~7M = ~8.3M | ~5M | Fact #5 |
 | Approach | Semi-dense (coarse-to-fine, subpixel) | Sparse (detect → match → verify) | Semi-dense (detect → KNN → refine) | Fact #1, existing draft |
@@ -0,0 +1,90 @@
 # Reasoning Chain
 ## Dimension 1: SuperPoint+LightGlue for Visual Odometry
 ### Fact Confirmation
 cuVSLAM achieves 116fps (~8.6ms/frame) on Orin Nano 8GB at 720p (Fact #1). SP+LG achieves ~10fps on KITTI on desktop GPU (Fact #2). SuperPoint alone takes ~40ms on Jetson for 200 keypoints (Fact #3). LightGlue matching on desktop GPU takes ~20-34ms for 274 keypoints (Fact #2).
 ### Extrapolation to Orin Nano Super
 On Orin Nano Super, estimating SP+LG pipeline:
 - SuperPoint extraction (1024 keypoints, 720p): ~50-80ms (based on Fact #3, scaled for more keypoints)
 - LightGlue matching (TensorRT FP16, 1024 keypoints): ~80-200ms (based on Fact #11 — 2-4x speedup over PyTorch, but Orin Nano is ~4-6x slower than RTX 4080)
 - Total SP+LG: ~130-280ms per frame
 cuVSLAM: ~8.6ms per frame.
 SP+LG would be **15-33x slower** than cuVSLAM for visual odometry on Orin Nano Super.
 ### Additional Considerations
 cuVSLAM includes native IMU integration, loop closure, and auto-fallback. SP+LG provides none of these — they would need custom implementation, adding both development time and latency.
 ### Conclusion
 **SP+LG is not viable as a cuVSLAM replacement for VO on Orin Nano Super.** cuVSLAM is purpose-built for Jetson and 15-33x faster. SP+LG's value lies in its accuracy for feature matching tasks, not real-time VO on edge hardware.
 ### Confidence
 ✅ High — performance gap is enormous and well-supported by multiple sources.
 ---
 ## Dimension 2: LiteSAM Speed vs Image Resolution (1280px question)
 ### Fact Confirmation
 LiteSAM (opt) achieves 497ms on AGX Orin at 1184px (Fact #5). AGX Orin is ~3-4x more powerful than Orin Nano Super (Fact #6). LiteSAM processes at 1/8 scale internally — coarse matching is O(N²) where N is proportional to resolution² (Fact #7).
 ### Resolution Scaling Analysis
 **1280px vs 1184px**: Token count increases from ~21,904 to ~25,600 (+17%). Compute increases ~17-37% (linear to quadratic depending on bottleneck). This makes the problem WORSE, not better.
 **The user's intuition is likely**: "If 6252×4168 camera images are huge, maybe LiteSAM is slow because we feed it those big images. What if we use 1280px?" But the solution draft already specifies resizing to 480-640px before feeding LiteSAM. The 497ms benchmark on AGX Orin was already at 1184px (the UAV-VisLoc benchmark resolution).
 **The real bottleneck is hardware, not image size:**
 - At 1184px on AGX Orin: 497ms → on Orin Nano Super: est. **~1.5-2.0s**
 - At 1280px on Orin Nano Super: est. **~1.7-2.3s** (WORSE — more tokens)
 - At 640px on Orin Nano Super: est. **~450-600ms** (borderline)
 - At 480px on Orin Nano Super: est. **~270-360ms** (possibly within 400ms budget)
 ### Conclusion
 **1280px would make LiteSAM SLOWER, not faster.** The paper benchmarked at 1184px. The bottleneck is the hardware gap (AGX Orin 275 TOPS → Orin Nano Super 67 TOPS). To make LiteSAM fit the 400ms budget, resolution must drop to ~480px, which may significantly degrade cross-view matching accuracy. The original solution draft's approach (benchmark at 480px, abandon if too slow) remains correct.
 ### Confidence
 ✅ High — paper benchmarks + hardware specs provide strong basis.
 ---
 ## Dimension 3: SP+LG for Satellite Matching (alternative to LiteSAM)
 ### Fact Confirmation
 LiteSAM paper explicitly states "SP+LG achieves the fastest inference speed but at the expense of accuracy" on satellite-aerial benchmarks (Fact #9). SP+LG is a sparse matcher; the paper notes sparse matchers "lack sufficient accuracy" for cross-view UAV-satellite matching due to texture-scarce regions (Fact #13). LiteSAM achieves RMSE@30 = 17.86m; SP+LG is worse (Fact #10).
 ### Speed Advantage of SP+LG
 On Orin Nano Super, SP+LG satellite matching pipeline:
 - SuperPoint extraction (both images): ~50-80ms × 2 images
 - LightGlue matching: ~80-200ms
 - Total: ~180-360ms
 This is competitive with the 400ms budget. But accuracy is worse than LiteSAM.
 ### Comparison with XFeat
 XFeat semi-dense: ~50-100ms on Orin Nano Super (from existing draft). XFeat is 2-4x faster than SP+LG and also handles semi-dense matching. For the satellite matching role, XFeat is a better "fast fallback" than SP+LG.
 ### Conclusion
 **SP+LG is not recommended for satellite matching.** It's slower than XFeat and less accurate than LiteSAM for cross-view matching. XFeat remains the better fallback. SP+LG could serve as a third-tier fallback, but the added complexity isn't justified given XFeat's advantages.
 ### Confidence
 ✅ High — direct comparison from the LiteSAM paper.
 ---
 ## Dimension 4: Other Weak Points in solution_draft01
 ### cuVSLAM Nadir Camera Concern
 The solution correctly flags cuVSLAM's "nadir-only camera" as untested. cuVSLAM was designed for robotics (forward-facing cameras). Nadir UAV camera looking straight down at terrain has different motion characteristics. However, cuVSLAM supports arbitrary camera configurations and IMU mode should compensate. **Risk is MEDIUM, mitigation is adequate** (XFeat fallback).
 ### Memory Budget Gap
 The solution estimates ~1.9-2.4GB total. This looks optimistic if cuVSLAM needs to maintain a map for loop closure. The cuVSLAM map grows over time. For a 3000-frame flight (~16 min at 3fps), map memory could grow to 500MB-1GB. **Risk: memory pressure late in flight.** Mitigation: configure cuVSLAM map pruning, limit map size.
 ### Tile Search Strategy Underspecified
 The solution mentions GeoHash-indexed tiles but doesn't detail how the system determines which tile to match against when ESKF position has high uncertainty (e.g., after VO failure). The expanded search (±1km) could require loading 10-20 tiles, which is slow from storage.
 ### Confidence
 ⚠️ Medium — these are analytical observations, not empirically verified.
@@ -0,0 +1,52 @@
 # Validation Log
 ## Validation Scenario 1: SP+LG for VO during Normal Flight
 A UAV flies straight at 3fps. Each frame needs VO within 400ms.
 ### Expected Based on Conclusions
 cuVSLAM: processes each frame in ~8.6ms, leaves 391ms for satellite matching and fusion. Immediate VO result via SSE.
 SP+LG: processes each frame in ~130-280ms, leaves ~120-270ms. May interfere with satellite matching CUDA resources.
 ### Actual Validation
 cuVSLAM is clearly superior. SP+LG offers no advantage here — cuVSLAM is 15-33x faster AND includes IMU fallback. SP+LG would require building a custom VO pipeline around a feature matcher, whereas cuVSLAM is a complete VO solution.
 ### Counterexamples
 If cuVSLAM fails on nadir camera (its main risk), SP+LG could serve as a fallback VO method. But XFeat frame-to-frame (~30-50ms) is already identified as the cuVSLAM fallback and is 3-6x faster than SP+LG.
 ## Validation Scenario 2: LiteSAM at 1280px on Orin Nano Super
 A keyframe needs satellite matching. Image is resized to 1280px for LiteSAM.
 ### Expected Based on Conclusions
 LiteSAM at 1280px on Orin Nano Super: ~1.7-2.3s. This is 4-6x over the 400ms budget. Even running async, it means satellite corrections arrive 5-7 frames later.
 ### Actual Validation
 1280px is LARGER than the paper's 1184px benchmark resolution. The user likely assumed we feed the full camera image (6252×4168) to LiteSAM, causing slowness. But the solution already downsamples. The bottleneck is the hardware performance gap (Orin Nano Super = ~25% of AGX Orin compute).
 ### Counterexamples
 If LiteSAM's TensorRT FP16 engine with reparameterized MobileOne achieves better optimization than the paper's AMP benchmark (which uses PyTorch, not TensorRT), speed could improve 2-3x. At 480px with TensorRT FP16: potentially ~90-180ms on Orin Nano Super. This is worth benchmarking.
 ## Validation Scenario 3: SP+LG as Satellite Matcher After LiteSAM Abandonment
 LiteSAM fails benchmark. Instead of XFeat, we try SP+LG for satellite matching.
 ### Expected Based on Conclusions
 SP+LG: ~180-360ms on Orin Nano Super. Accuracy is worse than LiteSAM for cross-view matching.
 XFeat: ~50-100ms. Accuracy is unproven on cross-view but general-purpose semi-dense.
 ### Actual Validation
 SP+LG is 2-4x slower than XFeat and the LiteSAM paper confirms worse accuracy for satellite-aerial. XFeat's semi-dense approach is more suited to the texture-scarce regions common in UAV imagery. SP+LG's sparse keypoint detection may fail on agricultural fields or water bodies.
 ### Counterexamples
 SP+LG could outperform XFeat on high-texture urban areas where sparse features are abundant. But the operational region (eastern Ukraine) is primarily agricultural, making this advantage unlikely.
 ## Review Checklist
 - [x] Draft conclusions consistent with fact cards
 - [x] No important dimensions missed
 - [x] No over-extrapolation
 - [x] Conclusions actionable/verifiable
 - [ ] Note: Orin Nano Super estimates are extrapolated from AGX Orin data using the 3-4x compute ratio. Day-one benchmarking remains essential.
 ## Conclusions Requiring Revision
 None — the original solution draft's architecture (cuVSLAM for VO, benchmark-driven LiteSAM/XFeat for satellite) is confirmed sound. SP+LG is not recommended for either role on this hardware.
@@ -0,0 +1,102 @@
 # Question Decomposition
 ## Original Question
 Assess solution_draft02.md against updated acceptance criteria and restrictions. The AC and restrictions have been significantly revised to reflect real onboard deployment requirements (MAVLink integration, ground station telemetry, startup/failsafe, object localization, thermal management, satellite imagery specs).
 ## Active Mode
 Mode B: Solution Assessment — `solution_draft02.md` is the latest draft in OUTPUT_DIR.
 ## Question Type
 Problem Diagnosis + Decision Support
 ## Research Subject Boundary
 - **Population**: GPS-denied UAV navigation systems on edge hardware (Jetson Orin Nano Super)
 - **Geography**: Eastern/southern Ukraine (east of Dnipro River), conflict zone
 - **Timeframe**: Current (2025-2026), latest available tools and libraries
 - **Level**: Onboard companion computer, real-time flight controller integration via MAVLink
 ## Key Delta: What Changed in AC/Restrictions
 ### Restrictions Changes
 1. Two cameras: Navigation (fixed, downward) + AI camera (configurable angle/zoom)
 2. Processing on Jetson Orin Nano Super (was "stationary computer or laptop")
 3. IMU data IS available via flight controller (was "NO data from IMU")
 4. MAVLink protocol via MAVSDK for flight controller communication
 5. Must output GPS_INPUT messages as GPS replacement
 6. Ground station telemetry link available but bandwidth-limited
 7. Thermal throttling must be accounted for
 8. Satellite imagery pre-loaded, storage limited
 ### Acceptance Criteria Changes
 1. <400ms per frame to flight controller (was <5s for processing)
 2. MAVLink GPS_INPUT output (was REST API + SSE)
 3. Ground station: stream position/confidence, receive re-localization commands
 4. Object localization: trigonometric GPS from AI camera angle/zoom/altitude
 5. Startup: initialize from last known GPS before GPS denial
 6. Failsafe: IMU-only fallback after N seconds of total failure
 7. Reboot recovery: re-initialize from flight controller IMU-extrapolated position
 8. Max cumulative VO drift <100m between satellite anchors
 9. Confidence score per position estimate (high/low)
 10. Satellite imagery: ≥0.5 m/pixel, <2 years old
 11. WGS84 output format
 12. Re-localization via telemetry to ground station (not REST API user input)
 ## Decomposed Sub-Questions
 ### Q1: MAVLink GPS_INPUT Integration
 - How does MAVSDK Python handle GPS_INPUT messages?
 - What fields are required in GPS_INPUT?
 - What update rate does the flight controller expect?
 - Can we send confidence/accuracy indicators via MAVLink?
 - How does this replace the REST API + SSE architecture?
 ### Q2: Ground Station Telemetry Integration
 - How to stream position + confidence over bandwidth-limited telemetry?
 - How to receive operator re-localization commands?
 - What MAVLink messages support custom data?
 - What bandwidth is typical for UAV telemetry links?
 ### Q3: Startup & Failsafe Mechanisms
 - How to initialize from flight controller's last GPS position?
 - How to detect GPS denial onset?
 - What happens on companion computer reboot mid-flight?
 - How to implement IMU-only dead reckoning fallback?
 ### Q4: Object Localization via AI Camera
 - How to compute ground GPS from UAV position + camera angle + zoom + altitude?
 - What accuracy can be expected given GPS-denied position error?
 - How to handle the API between GPS-denied system and AI detection system?
 ### Q5: Thermal Management on Jetson Orin Nano Super
 - What is sustained thermal performance under GPU load?
 - How to monitor and mitigate thermal throttling?
 - What power modes are available?
 ### Q6: VO Drift Budget & Monitoring
 - How to measure cumulative drift between satellite anchors?
 - How to trigger satellite matching when drift approaches 100m?
 - ESKF covariance as drift proxy?
 ### Q7: Weak Points in Draft02 Architecture
 - REST API + SSE architecture is wrong — must be MAVLink
 - No ground station integration
 - No startup/shutdown procedures
 - No thermal management
 - No object localization detail for AI camera with configurable angle/zoom
 - Memory budget doesn't account for MAVSDK overhead
 ## Timeliness Sensitivity Assessment
 - **Research Topic**: MAVLink integration, MAVSDK for Jetson, ground station telemetry, thermal management
 - **Sensitivity Level**: 🟠 High
 - **Rationale**: MAVSDK actively developed; MAVLink message set evolving; Jetson JetPack 6.2 specific
 - **Source Time Window**: 12 months
 - **Priority official sources**:
  1. MAVSDK Python documentation (mavsdk.io)
  2. MAVLink message definitions (mavlink.io)
  3. NVIDIA Jetson Orin Nano thermal documentation
  4. PX4/ArduPilot GPS_INPUT documentation
 - **Key version information**:
  - MAVSDK-Python: latest PyPI version
  - MAVLink: v2 protocol
  - JetPack: 6.2.2
  - PyCuVSLAM: v15.0.0
@@ -0,0 +1,175 @@
 # Source Registry
 ## Source #1
 - **Title**: MAVSDK-Python Issue #320: Input external GPS through MAVSDK
 - **Link**: https://github.com/mavlink/MAVSDK-Python/issues/320
 - **Tier**: L4
 - **Publication Date**: 2021 (still open 2025)
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: MAVSDK-Python — GPS_INPUT not supported as of v3.15.3
 - **Target Audience**: Companion computer developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: MAVSDK-Python does not support GPS_INPUT message. Feature requested but unresolved.
 - **Related Sub-question**: Q1
 ## Source #2
 - **Title**: MAVLink GPS_INPUT Message Specification (mavlink_msg_gps_input.h)
 - **Link**: https://rflysim.com/doc/en/RflySimAPIs/RflySimSDK/html/mavlink__msg__gps__input_8h_source.html
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: MAVLink v2, Message ID 232
 - **Target Audience**: MAVLink developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: GPS_INPUT message fields: lat/lon (1E7), alt, fix_type, horiz_accuracy, vert_accuracy, speed_accuracy, hdop, vdop, satellites_visible, velocities NED, yaw, ignore_flags.
 - **Related Sub-question**: Q1
 ## Source #3
 - **Title**: ArduPilot GPS Input MAVProxy Documentation
 - **Link**: https://ardupilot.org/mavproxy/docs/modules/GPSInput.html
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: ArduPilot GPS1_TYPE=14
 - **Target Audience**: ArduPilot companion computer developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: GPS_INPUT requires GPS1_TYPE=14. Accepts JSON over UDP port 25100. Fields: lat, lon, alt, fix_type, hdop, timestamps.
 - **Related Sub-question**: Q1
 ## Source #4
 - **Title**: pymavlink GPS_INPUT example
 - **Link**: https://webperso.ensta.fr/lebars/Share/GPS_INPUT_pymavlink.py
 - **Tier**: L3
 - **Publication Date**: 2023
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: pymavlink
 - **Target Audience**: Companion computer developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Complete pymavlink example for sending GPS_INPUT with all fields including yaw. Uses gps_input_send() method.
 - **Related Sub-question**: Q1
 ## Source #5
 - **Title**: ArduPilot AP_GPS_Params.cpp — GPS_RATE_MS
 - **Link**: https://cocalc.com/github/ardupilot/ardupilot/blob/master/libraries/AP_GPS/AP_GPS_Params.cpp
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: ArduPilot master
 - **Target Audience**: ArduPilot developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: GPS_RATE_MS default 200ms (5Hz), range 50-200ms (5-20Hz). Below 5Hz not allowed.
 - **Related Sub-question**: Q1
 ## Source #6
 - **Title**: MAVLink Telemetry Bandwidth Optimization Issue #1605
 - **Link**: https://github.com/mavlink/mavlink/issues/1605
 - **Tier**: L2
 - **Publication Date**: 2022
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: MAVLink protocol developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Minimal telemetry requires ~12kbit/s. Optimized ~6kbit/s. SiK at 57600 baud provides ~21% usable budget. RFD900 for long range (15km+).
 - **Related Sub-question**: Q2
 ## Source #7
 - **Title**: NVIDIA JetPack 6.2 Super Mode Blog
 - **Link**: https://developer.nvidia.com/blog/nvidia-jetpack-6-2-brings-super-mode-to-nvidia-jetson-orin-nano-and-jetson-orin-nx-modules/
 - **Tier**: L1
 - **Publication Date**: 2025-01
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: JetPack 6.2, Orin Nano Super
 - **Target Audience**: Jetson developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: MAXN SUPER mode for peak performance. Thermal throttling at 80°C. Power modes: 15W, 25W, MAXN SUPER. Up to 1.7x AI boost.
 - **Related Sub-question**: Q5
 ## Source #8
 - **Title**: Jetson Orin Nano Power Consumption Analysis
 - **Link**: https://edgeaistack.app/blog/jetson-orin-nano-power-consumption/
 - **Tier**: L3
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: Jetson edge deployment engineers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: 5W idle, 8-12W typical inference, 25W peak. Throttling above 80°C drops GPU from 1GHz to 300MHz. Active cooling required for sustained loads.
 - **Related Sub-question**: Q5
 ## Source #9
 - **Title**: UAV Target Geolocation (Sensors 2022)
 - **Link**: https://www.mdpi.com/1424-8220/22/5/1903
 - **Tier**: L1
 - **Publication Date**: 2022
 - **Timeliness Status**: ✅ Currently valid (math doesn't change)
 - **Target Audience**: UAV reconnaissance systems
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Trigonometric target geolocation from camera angle, altitude, UAV position. Iterative refinement improves accuracy 22-38x.
 - **Related Sub-question**: Q4
 ## Source #10
 - **Title**: pymavlink vs MAVSDK-Python for custom messages (Issue #739)
 - **Link**: https://github.com/mavlink/MAVSDK-Python/issues/739
 - **Tier**: L4
 - **Publication Date**: 2024-12
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: MAVSDK-Python, pymavlink
 - **Target Audience**: Companion computer developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: MAVSDK-Python lacks custom message support. pymavlink recommended for GPS_INPUT and custom messages. MAVSDK v4 may add MavlinkDirect plugin.
 - **Related Sub-question**: Q1
 ## Source #11
 - **Title**: NAMED_VALUE_FLOAT for custom telemetry (PR #18501)
 - **Link**: https://github.com/ArduPilot/ardupilot/pull/18501
 - **Tier**: L2
 - **Publication Date**: 2022
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: ArduPilot companion computer developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: NAMED_VALUE_FLOAT messages from companion computer are logged by ArduPilot and forwarded to GCS. Useful for custom telemetry data.
 - **Related Sub-question**: Q2
 ## Source #12
 - **Title**: ArduPilot Companion Computer UART Connection
 - **Link**: https://ardupilot.org/dev/docs/raspberry-pi-via-mavlink.html
 - **Tier**: L1
 - **Publication Date**: 2024
 - **Timeliness Status**: ✅ Currently valid
 - **Target Audience**: ArduPilot companion computer developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Connect via TELEM2 UART. SERIAL2_PROTOCOL=2 (MAVLink2). Baud up to 1.5Mbps. TX/RX crossover.
 - **Related Sub-question**: Q1, Q2
 ## Source #13
 - **Title**: Jetson Orin Nano UART with ArduPilot
 - **Link**: https://forums.developer.nvidia.com/t/uart-connection-between-jetson-nano-orin-and-ardupilot/325416
 - **Tier**: L4
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: JetPack 6.x, Orin Nano
 - **Target Audience**: Jetson + ArduPilot integration
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: UART instability reported on Orin Nano with ArduPilot. Use /dev/ttyTHS0 or /dev/ttyTHS1. Check pinout carefully.
 - **Related Sub-question**: Q1
 ## Source #14
 - **Title**: MAVSDK-Python v3.15.3 PyPI (aarch64 wheels)
 - **Link**: https://pypi.org/project/mavsdk/
 - **Tier**: L1
 - **Publication Date**: 2025
 - **Timeliness Status**: ✅ Currently valid
 - **Version Info**: v3.15.3, manylinux2014_aarch64
 - **Target Audience**: MAVSDK Python developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: MAVSDK-Python has aarch64 wheels. pip install works on Jetson. But no GPS_INPUT support.
 - **Related Sub-question**: Q1
 ## Source #15
 - **Title**: ArduPilot receive COMMAND_LONG on companion computer
 - **Link**: https://discuss.ardupilot.org/t/recieve-mav-cmd-on-companion-computer/48928
 - **Tier**: L4
 - **Publication Date**: 2020
 - **Timeliness Status**: ⚠️ Needs verification (old but concept still valid)
 - **Target Audience**: ArduPilot companion computer developers
 - **Research Boundary Match**: ✅ Full match
 - **Summary**: Companion computer can receive COMMAND_LONG messages from GCS via MAVLink. ArduPilot scripting can intercept specific command IDs.
 - **Related Sub-question**: Q2
@@ -0,0 +1,105 @@
 # Fact Cards
 ## Fact #1
 - **Statement**: MAVSDK-Python (v3.15.3) does NOT support sending GPS_INPUT MAVLink messages. The feature has been requested since 2021 and remains unresolved. Custom message support is planned for MAVSDK v4 but not available in Python wrapper.
 - **Source**: Source #1, #10, #14
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — confirmed by MAVSDK maintainers
 - **Related Dimension**: Flight Controller Integration
 ## Fact #2
 - **Statement**: pymavlink provides full access to all MAVLink messages including GPS_INPUT via `mav.gps_input_send()`. It is the recommended library for companion computers that need to send GPS_INPUT messages.
 - **Source**: Source #4, #10
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — working examples exist
 - **Related Dimension**: Flight Controller Integration
 ## Fact #3
 - **Statement**: GPS_INPUT (MAVLink msg ID 232) contains: lat/lon (WGS84, degrees×1E7), alt (AMSL), fix_type (0-8), horiz_accuracy (m), vert_accuracy (m), speed_accuracy (m/s), hdop, vdop, satellites_visible, vn/ve/vd (NED m/s), yaw (centidegrees), gps_id, ignore_flags.
 - **Source**: Source #2
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — official MAVLink spec
 - **Related Dimension**: Flight Controller Integration
 ## Fact #4
 - **Statement**: ArduPilot requires GPS1_TYPE=14 (MAVLink) to accept GPS_INPUT messages from a companion computer. Connection via TELEM2 UART, SERIAL2_PROTOCOL=2 (MAVLink2).
 - **Source**: Source #3, #12
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — official ArduPilot documentation
 - **Related Dimension**: Flight Controller Integration
 ## Fact #5
 - **Statement**: ArduPilot GPS update rate (GPS_RATE_MS) default is 200ms (5Hz), range 50-200ms (5-20Hz). Our camera at 3fps (333ms) means GPS_INPUT at 3Hz. ArduPilot minimum is 5Hz. We must interpolate/predict between camera frames to meet 5Hz minimum.
 - **Source**: Source #5
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — ArduPilot source code
 - **Related Dimension**: Flight Controller Integration
 ## Fact #6
 - **Statement**: GPS_INPUT horiz_accuracy field directly maps to our confidence scoring. We can report: satellite-anchored ≈ 10-20m accuracy, VO-extrapolated ≈ 20-50m, IMU-only ≈ 100m+. ArduPilot EKF uses this for fusion weighting internally.
 - **Source**: Source #2, #3
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ⚠️ Medium — accuracy mapping is estimated, EKF weighting not fully documented
 - **Related Dimension**: Flight Controller Integration
 ## Fact #7
 - **Statement**: Typical UAV telemetry bandwidth: SiK radio at 57600 baud provides ~12kbit/s usable for MAVLink. RFD900 provides long range (15km+) at similar data rates. Position telemetry must be compact — ~50 bytes per position update.
 - **Source**: Source #6
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — MAVLink protocol specs
 - **Related Dimension**: Ground Station Telemetry
 ## Fact #8
 - **Statement**: NAMED_VALUE_FLOAT MAVLink message can stream custom telemetry from companion computer to ground station. ArduPilot logs and forwards these. Mission Planner displays them. Useful for confidence score, drift status, matching status.
 - **Source**: Source #11
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — ArduPilot merged PR
 - **Related Dimension**: Ground Station Telemetry
 ## Fact #9
 - **Statement**: Jetson Orin Nano Super throttles GPU from 1GHz to ~300MHz when junction temperature exceeds 80°C. Active cooling (fan) required for sustained load. Power consumption: 5W idle, 8-12W typical inference, 25W peak. Modes: 15W, 25W, MAXN SUPER.
 - **Source**: Source #7, #8
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — NVIDIA official
 - **Related Dimension**: Thermal Management
 ## Fact #10
 - **Statement**: Jetson Orin Nano UART connection to ArduPilot uses /dev/ttyTHS0 or /dev/ttyTHS1. UART instability reported on some units — verify pinout, use JetPack 6.2.2+. Baud up to 1.5Mbps supported.
 - **Source**: Source #12, #13
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ⚠️ Medium — UART instability is a known issue with workarounds
 - **Related Dimension**: Flight Controller Integration
 ## Fact #11
 - **Statement**: Object geolocation from UAV: for nadir (downward) camera, pixel offset from center → meters via GSD → rotate by heading → add to UAV GPS. For oblique (AI) camera with angle θ from vertical: ground_distance = altitude × tan(θ). Combined with zoom → effective focal length → pixel-to-meter conversion. Flat terrain assumption simplifies to basic trigonometry.
 - **Source**: Source #9
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — well-established trigonometry
 - **Related Dimension**: Object Localization
 ## Fact #12
 - **Statement**: Companion computer can receive COMMAND_LONG from ground station via MAVLink. For re-localization hints: ground station sends a custom command with approximate lat/lon, companion computer receives it via pymavlink message listener.
 - **Source**: Source #15
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ⚠️ Medium — specific implementation for re-localization hint would be custom
 - **Related Dimension**: Ground Station Telemetry
 ## Fact #13
 - **Statement**: The restrictions.md now says "using MAVSDK library" but MAVSDK-Python cannot send GPS_INPUT. pymavlink is the only viable Python option for GPS_INPUT. This is a restriction conflict that must be resolved — use pymavlink for GPS_INPUT (core function) or accept MAVSDK + pymavlink hybrid.
 - **Source**: Source #1, #2, #10
 - **Phase**: Assessment
 - **Target Audience**: GPS-Denied system developers
 - **Confidence**: ✅ High — confirmed limitation
 - **Related Dimension**: Flight Controller Integration
@@ -0,0 +1,62 @@
 # Comparison Framework
 ## Selected Framework Type
 Problem Diagnosis + Decision Support (Mode B)
 ## Weak Point Dimensions (from draft02 → new AC/restrictions)
 ### Dimension 1: Output Architecture (CRITICAL)
 Draft02 uses FastAPI + SSE to stream positions to clients.
 New AC requires MAVLink GPS_INPUT to flight controller as PRIMARY output.
 Entire output architecture must change.
 ### Dimension 2: Ground Station Communication (CRITICAL)
 Draft02 has no ground station integration.
 New AC requires: stream position+confidence via telemetry, receive re-localization commands.
 ### Dimension 3: MAVLink Library Choice (CRITICAL)
 Restrictions say "MAVSDK library" but MAVSDK-Python cannot send GPS_INPUT.
 Must use pymavlink for core function.
 ### Dimension 4: GPS Update Rate (HIGH)
 Camera at 3fps → 3Hz position updates. ArduPilot minimum GPS rate is 5Hz.
 Need IMU-based interpolation between camera frames.
 ### Dimension 5: Startup & Failsafe (HIGH)
 Draft02 has no initialization or failsafe procedures.
 New AC requires: init from last GPS, reboot recovery, IMU fallback after N seconds.
 ### Dimension 6: Object Localization (MEDIUM)
 Draft02 has basic pixel-to-GPS for navigation camera only.
 New AC adds AI camera with configurable angle, zoom — trigonometric projection needed.
 ### Dimension 7: Thermal Management (MEDIUM)
 Draft02 ignores thermal throttling.
 Jetson Orin Nano Super throttles at 80°C — can drop GPU 3x.
 ### Dimension 8: VO Drift Budget Monitoring (MEDIUM)
 New AC: max cumulative VO drift <100m between satellite anchors.
 Draft02 uses ESKF covariance but doesn't explicitly track drift budget.
 ### Dimension 9: Satellite Imagery Specs (LOW)
 New AC: ≥0.5 m/pixel, <2 years old. Draft02 uses Google Maps zoom 18-19 which is ~0.3-0.6 m/pixel.
 Mostly compatible, needs explicit validation.
 ### Dimension 10: API for Internal Systems (LOW)
 Object localization requests from AI systems need a local IPC mechanism.
 FastAPI could be retained for local-only inter-process communication.
 ## Initial Population
 | Dimension | Draft02 State | Required State | Gap Severity |
 |-----------|--------------|----------------|-------------|
 | Output Architecture | FastAPI + SSE to client | MAVLink GPS_INPUT to flight controller | CRITICAL — full redesign |
 | Ground Station | None | Bidirectional MAVLink telemetry | CRITICAL — new component |
 | MAVLink Library | Not applicable (no MAVLink) | pymavlink (MAVSDK can't do GPS_INPUT) | CRITICAL — new dependency |
 | GPS Update Rate | 3fps → ~3Hz output | ≥5Hz to ArduPilot EKF | HIGH — need IMU interpolation |
 | Startup & Failsafe | None | Init from GPS, reboot recovery, IMU fallback | HIGH — new procedures |
 | Object Localization | Basic nadir pixel-to-GPS | AI camera angle+zoom trigonometry | MEDIUM — extend existing |
 | Thermal Management | Not addressed | Monitor + mitigate throttling | MEDIUM — operational concern |
 | VO Drift Budget | ESKF covariance only | Explicit <100m tracking + trigger | MEDIUM — extend ESKF |
 | Satellite Imagery Specs | Google Maps zoom 18-19 | ≥0.5 m/pixel, <2 years | LOW — mostly met |
 | Internal IPC | REST API | Lightweight local API or shared memory | LOW — simplify from draft02 |
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Oleksandr Bezdieniezhnykh	8b0dcde893	Merge branch 'stage' into main	2026-04-22 01:40:33 +03:00
Oleksandr Bezdieniezhnykh	4e3b814229	Merge branch 'dev' into stage	2026-04-22 01:37:33 +03:00
`@@ -58,4 +58,4 @@ Do NOT create minimal epics with just a summary and short description. The epic`

	8. Create "Blackbox Tests" epic — this epic will parent the blackbox test tasks created by the `/decompose` skill. It covers implementing the test scenarios defined in `tests/`.	8. Create "Blackbox Tests" epic — this epic will parent the blackbox test tasks created by the `/decompose` skill. It covers implementing the test scenarios defined in `tests/`.

	Save action: Epics created via the configured tracker MCP. Also saved locally in `epics.md` with ticket IDs. If tracker availability fails, follow `.cursor/rules/tracker.mdc`; only if the user explicitly chooses `tracker: local`, save locally only with pending tracker markers.	Save action: Epics created via the configured tracker MCP. Also saved locally in `epics.md` with ticket IDs. If `tracker: local`, save locally only.
`@@ -1,2 +1,2 @@`
	We have a wing-type UAV with a fixed downward navigation camera that can take photos 3 times per second. The authoritative navigation-camera spec is defined in `restrictions.md` as the ADTi 20MP 20L V1, APS-C sensor, about 5472 x 3648 px; older higher-resolution references are superseded. Also plane has flight controller with IMU. During the plane flight, we know GPS coordinates initially. During the flight, GPS could be disabled or spoofed. We need to determine the GPS of the centers of the next frame from the camera. And also the coordinates of the center of any object in these photos. We can use an external satellite provider for ground checks on the existing photos. So, before the flight, UAV's operator should upload the satellite photos to the plane's companion PC.	We have a wing-type UAV with a camera pointing downwards that can take photos 3 times per second with a resolution 6200*4100. Also plane has flight controller with IMU. During the plane flight, we know GPS coordinates initially. During the flight, GPS could be disabled or spoofed. We need to determine the GPS of the centers of the next frame from the camera. And also the coordinates of the center of any object in these photos. We can use an external satellite provider for ground checks on the existing photos. So, before the flight, UAV's operator should upload the satellite photos to the plane's companion PC.
	The real world examples are in input_data folder, but the original still-image set has a much larger distance between photos than the target aircraft will have. On that particular example photos were taken 1 photo per 2-3 seconds. But in real-world scenario frames would appear within the interval no more than 500ms. Additional representative data is available in `input_data/flight_derkachi/`: cropped nadir flight footage plus synchronized `SCALED_IMU2` and `GLOBAL_POSITION_INT` telemetry. This supports video/telemetry synchronization, replay, latency, VIO smoke tests, and trajectory comparison against the tlog GPS path. Camera intrinsics, lens distortion, raw camera feed parameters, and exact camera-to-body calibration are still pending, so final production accuracy claims remain gated on calibration data or a separately surveyed representative dataset.	`The real world examples are in input_data folder, but the distance between each photo is way bigger than it will be from a real plane. On that particular example photos were taken 1 photo per 2-3 seconds. But in real-world scenario frames would appear within the interval no more than 500ms or even 400 ms.`