Wire production aircraft callbacks and diagnose native prison action selection

docs/aircraft-route.md

@@ -75,3 +75,12 @@ The [machine-readable comparison](evidence/route-comparison-2026-09-19-192238/co
 The measured translation duration decreased by 55.4% (86.072 seconds), while cruise progress increased by 2.46 times. Landing duration remained approximately unchanged. The candidate's recorded translation height stayed 7.996–8.024 metres; maximum sampled cross-track distance was 3.044 metres, including the initial post-hover offset. No endpoint crossing appears in the two-second telemetry: the largest logged along-route position during translation/landing was 19.912 metres for the nominal 20 metre endpoint. This is sampled evidence, not proof of zero inter-sample oscillation. Both native runs completed on the original aircraft/pilot with actual contact, engine off and finite fuel consumption.
 
 These are one run per gain, not a matched-load performance/FPS benchmark. Initial requested distances differed slightly (20.2214 m versus 20.2311 m), and the complete source snapshots contain 192 versus 195 files with nine differing paths recorded in the comparison. The baseline used gain 0.05 and the candidate route uses 0.10; the unchanged shared flight controller hash is retained in both source manifests. The result supports this isolated candidate mechanism only. It does not establish repeatability, longer terrain routes, operational HQ dispatch, multiplayer/remote ownership or cancellation under the new gain. No qualification, deadline or arrival requirement was widened for this comparison.
+
+
+## Production control callback bridge candidate
+
+`ERR_AircraftControlBridge.c` connects the native character callback before `super` and the helicopter callback after `super` to `ERR_AircraftFlight`'s existing exact-airframe registry. A callback does not create, register or choose a flight. Dispatch rechecks the original lease, token, qualification and current mode/world/aircraft/pilot ownership before the controller performs its existing capability/deadline/envelope checks. Captured ownership is relinquished without actuator writes. An actor's physical vehicle and a controller's owner provide bounded direct registry lookups; unrelated gameplay remains inert.
+
+The two Workbench probes retain their native callback counters solely as observations. They no longer call `PrepareActions` or `PrepareHelicopter`, so the production bridge owns the single actuator path independent of inherited modded-class order. Successful fixture completion still requires the controller's internal callback/readback gates and physical flight/landing outcome. The new actual-method regression and existing flight/route policy checks pass; the [194527 native route](evidence/native-2026-09-19-194527-aircraft-bridge/report.json) now passes38assertions through physical target hold/contact landing/engine off. The [195446 airborne cancellation](evidence/native-2026-09-19-195446-aircraft-bridge-cancel/report.json) passes39assertions through retained control, original lease and real contact landing. Both have zero captured engine/script errors and unchanged196-file source provenance. The ordinary194928 launch compiles the bridge outsideWorkbench with no captured engine errors; it creates no autonomous flights.
+
+This supplies only the control bridge. Ordinary mission preparation still does not allocate or dispatch an enemy aircraft; an HQ-owned finite-aircraft service, radio-authorized assignment, retained flight ticking through empty-server conditions and useful terrain-qualified routing remain unfinished.