Retain aircraft through native landing and qualify bounded input diagnostics

docs/current-status.md

@@ -1,8 +1,12 @@
 # Current development status
 
-Updated **19 September 2026**. The prior195-file checkpoint passes [two Core escape/restart rounds](evidence/native-2026-09-19-193223-core-current/report.json), **614 assertions**, with zero captured errors, unchanged source and verified cleanup. This includes the consistent native body-position observer and route-only aircraft gain. The current196-file source additionally passes [bridge-backed route flight](evidence/native-2026-09-19-194527-aircraft-bridge/report.json),38assertions, and [airborne cancellation](evidence/native-2026-09-19-195446-aircraft-bridge-cancel/report.json),39assertions. Both complete with zero captured errors and verified cleanup. [Native choice diagnostics](evidence/gate-choice-review-2026-09-19-194928/review.json) confirm disabled Open selected before the available prison lock; ordinary alignment remains failed until real input selects the lock. **All seventeen first-release acceptance cases remain pending.** Actual held lock-picking, complete ordinary escape, multiplayer and FPS remain unqualified. The earlier [inventory adapter checkpoint](inventory-layout.md) retains its clear first-open screenshot; reopen, storage refresh and item transfers still need native testing.
+Updated **19 September 2026, 20:27**. The new [finite aircraft retention service](aircraft-service.md) now passes its [first native route](evidence/native-2026-09-19-202253-retained-aircraft-route/report.json):40assertions, actual destination hold/contact landing/engine shutdown, zero captured errors, unchanged197-file source and verified cleanup. The first compiler failure remains archived; four status getters were corrected. The default-inert [command maintenance hook](aircraft-hq-integration-plan.md) compiles in this checkpoint and has offline lifecycle coverage; the [airborne service Stop](evidence/native-2026-09-19-202706-retained-aircraft-stop/report.json) also passes42native assertions through retained control, frozen-point landing and engine shutdown. Actual empty-server maintenance and operational HQ aircraft remain separate qualification.
 
-The [route gain comparison](evidence/route-comparison-2026-09-19-192238/comparison.json) measures one native20m route per gain: translation through arrival hold improved155.365→69.293seconds, and final target error improved0.130→0.099m. The candidate passed38assertions, physical contact landing and engine shutdown. This is an isolated flight-controller result, not an FPS comparison or operational HQ air support; production callback/service integration and longer routes remain pending.
+The explicit one-wheel prison selection path and independent raw-log validators are implemented and pass offline checks. Two native attempts remain failed before reaching selection: [201104](evidence/game-2026-09-19-201104-selection-look-timeout/runner.json.txt) exceeded the unchanged0.35-degree camera-return threshold; [201352](evidence/game-2026-09-19-201352-selection-owner-refusal/runner.json.txt) refused changed private window/process identity. Neither sent a wheel or F. The [documented exit-after-init packaging control](evidence/package-control-2026-09-19-201532-exit-after-init/review.json) reproduced the same25shutdown errors with an empty addon. Its original cleanup failure remains recorded alongside separate exact-prefix cleanup; packaging now uses the shared narrow cleanup adapter.
+
+**All seventeen first-release acceptance cases remain pending.** The ordinary held lock action/full escape, real multiplayer, improved FPS and clean native packaging remain unqualified. Aircraft HQ activation also needs authored enemy aircraft/destinations and a useful field-length controller; the proven route remains approximately20m.
+
+The [route gain comparison](evidence/route-comparison-2026-09-19-192238/comparison.json) measures one native20m route per gain: translation through arrival hold improved155.365→69.293seconds, and final target error improved0.130→0.099m. The candidate passed38assertions, physical contact landing and engine shutdown. This is an isolated flight-controller result, not an FPS comparison or operational HQ air support; the production callback bridge has separate native evidence, while retained-service qualification and longer routes remain pending.
 
 [Ordinary prison approach191750](evidence/game-2026-09-19-191750-prison-approach/runner.json.txt) now passes end to end using actual private mouse/W input:14turns,9walking pulses,4.741m path,27.199s native interval, stationary0.490m from the interior waypoint. A disposable2560x720 viewport provides pointer travel while retaining every containment/ownership check. No gate action was sent; the exact lock/context remains unselected from the final view. Earlier pointer-edge, cross-position-API, calibration-return and legacy-summary failures remain archived. The first physically completed route191342 has a separate hashed raw-log review, not a rewritten runner verdict. The later [194128 alignment attempt](evidence/alignment-review-2026-09-19-194128/review.json) acquires the native gate context with the lock available, but does not select the lock; it remains failed. Read-only selected-action diagnostics precede any action cycling or heldF proof.
 
@@ -29,7 +33,7 @@ The primary deliverable is an independently authored replacement for the abandon
 ## Immediate work
 
 1. **Prove the ordinary player route.** The inventory first-open path is now visibly demonstrated without its former slot errors. Next implement the [bounded normal-input gate exercise](prison-input-proof-plan.md), verify reopen/refresh/item transfer, and use normal document/map, radio and medical interactions; travel the authored route, board and pilot the actual extraction helicopter, and verify partial escape. Keep finite supplies, vanilla recovery and explicit round abandonment intact. Direct-completion fixtures cannot settle these usability questions.
-2. **Extend the proven bounded flight mechanism.** Signed actor-local collective and native autohover now pass vertical takeoff, hover, landing and engine-off checks. A bounded four-metre translation and one fixed 20 m route now pass too. Longer routes and operational HQ support still need implementation and native qualification. The reusable controller now passes a native vertical operation; airborne cancellation also passes; optional fixed-target movement now passes too. Operational allocation and useful field-length paths remain next; the 20 m route has only 4.64 s margin in its 160 s translation stage. Keep unqualified flight modes out of operational HQ support, retain failed observations, and re-run applicable integration checks after source changes.
+2. **Extend the proven bounded flight mechanism.** Signed actor-local collective and native autohover now pass vertical takeoff, hover, landing and engine-off checks. A bounded four-metre translation and one fixed 20 m route now pass too. Longer routes and operational HQ support still need implementation and native qualification. The reusable controller now passes a native vertical operation; airborne cancellation also passes; optional fixed-target movement now passes too. Operational allocation and useful field-length paths remain next; the later gain experiment shortened the sampled translation/hold interval to69.293s within the existing160s stage. Keep unqualified flight modes out of operational HQ support, retain failed observations, and re-run applicable integration checks after source changes.
 3. **Establish real multiplayer behavior.** Test accepted client identities, simultaneous/late joins, preload cancellation, reserved-body reconnect/expiry, spent lives, spectator streaming, remote task/map/radio/result updates and seat contention. Local controller injections and helper actors are not substitutes for connected clients.
 4. **Broaden support-loss and observer checks.** Refreshed full salvo, current expiry and late crew registration now have source-bound native evidence; wider support-loss regressions remain. Spectator reason messages and survivor-cycling guidance have been added and compiled; visible behavior and real-client streaming remain unverified. Exercise actual interrupted reports, captured/dead couriers, pending inventory callbacks and support losses. Preserve stock and original patrols; retain historical failures alongside source-bound successful regressions.