Methods

Zero collisions is not a pass: three tiny actuator-acceleration excesses remain physical-audit failures, and frontier progress/cost gates fail. The primary baseline is old projected, not repulsion. Hardening v2 rechecked saved finite commands; it did not rerun these episodes or measure new runtime. Descriptive Student-t intervals within this condition/policy; no multiplicity correction or optimality proof.

The uncertainty-aware controller is not safe: collisions remain, packet-drop outcomes worsen, and latency/combined progress stalls. This independent Euler toy simulator does not validate the frozen field planner. No promotion or Gaussian strict certification. Packet loss can worsen outcomes. Bounds assume declared bounded uniform support; Gaussian calibration is not an episode safety study.

Recovery reduces completions in corridor and thin-wall layouts. The hardened 240 jobs duplicate the original schedule: do not add them to the original 240 or their replays. True-state, known-geometry oracle; bounded braking does not guarantee avoidance in adversarial states. Fixed motion geometry repeats across mapping seeds; no independent geometric-trial CI. Null completion time is not zero.

The development-only choice guarded_early fails all six lawnmower RMSE promotion bounds; limited-time mean RMSE is worse at all three test locations. Nine fresh USGS patches are split 3 train / 3 validation / 3 test, not a nationwide geography sample. Infrastructure hardening did not rerun episodes. Paired Student-t intervals are descriptive within each location/horizon; only lawnmower uses the six-cell Bonferroni promotion rule. Adaptive Lloyd bandit uses oracle evaluation reward. Per-patch normalization is not terrain sampling accuracy; DEMs are not obstacle or ecological maps.

Actual native arm64 PX4 v1.17.0, pinned and locally adapted—not the point simulator. One single prerequisite then three concurrent independent SIH worlds, NOT shared-world swarm physics. No hardware, external ground truth, real-flight fault injection, or deployment readiness is established. Older flights remain historical and are not pooled.

Elevation in metres is reconstructed as offset + normalized value × scale. Relative relief uses normalized value × scale. DEM-sensing RMSE describes synthetic observations of that field, not physical sensor calibration. DEMs are not obstacle, ecological or risk maps.

Observed area is a sampled footprint fraction. Squared-speed energy is a proxy, not joules. Pair-steps and agent-steps are exposure counts, not independent trials. Missing values remain null; unfinished completion times are not zero. Study-specific tables retain sample sizes and interval bounds.

Imperfect-state calibration uses 100,000 uniform and Gaussian draws plus 4,096 age-propagation probes, separate from the 288 mission episodes. A finite calibration sample cannot certify an unbounded distribution.

Frozen protocols, source snapshots and artifact hashes support reproducibility. A local freeze is not external preregistration, and hashes detect corruption rather than malicious re-signing. Historical executions, replays and unit tests are not additional independent study episodes.

Hosted page-view analytics are separate from the research controls. Hosting and analytics providers may process page paths and request metadata; locally rendered data does not imply that a hosted visit is anonymous.

Analytics is disabled for local visits and browsers signaling Do Not Track or Global Privacy Control. Query strings and fragments are removed from page-view URLs.