Autonomy: an autonomous system that knows when to stop trusting its link.

A command recorded and sent again, altered or forged commands nothing.

A module whose software was replaced keeps its pairing but gains no power it was not given at the bench.

Since 4 November 2026 a permission can say “only while the platform itself says so”: a release granted for the ground is refused in flight, because the platform’s own software, not the commander, decides whether it is on the ground.

A command with a physical consequence can need a second person: it is handed to the platform only with a signed authorisation for that exact command from a second operator pinned at the bench, used once, and a record naming the command and both people is written before it is handed out. Our library decides who may ask; what the command does stays the maker’s, under its customer’s authority.

An order whose end has passed is never handed to the platform's software, and the platform counts the orders it let go.

A vehicle's crash sensor or a worn device can ask its team for help, or arm a check-in its team keeps; in our test a device's call rang its station and a medic within eight seconds.

Since 4 November 2026 one call of our library gives a platform's own safety monitor what the library knows: its links gone silent past the platform's bound, an order or message let go after its end, something signed or authorised refused, and doubt about the net's positions. The platform decides what each means.