# PX4 flight-stack hardening — current-code campaign

**Current-code flight pass: True.** Campaign: `hardening-v1-single-plus-three`; single prerequisite then three concurrent independent SIH worlds.

Historical flights and original provenance are preserved in [historical-pre-hardening](historical-pre-hardening/reports/summary.json); they are not evidence for these changes.

Mission: 5 m takeoff → 8 m north waypoint → 3 s hover → return → land → normal disarm. Dwell requires ≤0.5 s gaps, advancing boot stamps, ≥25 samples for hover, ≤1.5 m error and ≤1 m/s speed.

| Vehicle | Seconds | Samples | Max altitude m | Max radius m | ACKs | Cleanup |
|---|---:|---:|---:|---:|---:|---|
| fleet-0 | 57.83 | 497 | 4.506 | 8.367 | 7 | landed_disarmed |
| fleet-1 | 56.61 | 489 | 5.064 | 8.394 | 7 | landed_disarmed |
| fleet-2 | 56.62 | 489 | 5.063 | 8.396 | 7 | landed_disarmed |
| single | 52.85 | 452 | 5.833 | 8.106 | 7 | landed_disarmed |

Approval: `approval-hardening-v1/launch-approval.json`, SHA-256 `c807bfb934979564d7dac0bd03748d57b801463a1c56a2808b0e05b6582c0584`. Acceptance was approved at Unix `1788653487.0132182`, before campaign start `1788653505.7696362`.

External supervisor: wall limit 210 s; elapsed 115.68 s; remaining owned groups `{}`. See [supervisor evidence](hardening-v1-single-plus-three/supervisor.json) and port checks.

Each vehicle retains PX4 output, raw MAVLink events, command/state acceptance timestamps, dwell metrics, trajectory, cleanup result and completion ULog hashes. [Campaign artifact manifest](hardening-v1-single-plus-three/artifact_hashes.json).

- Independent SIH worlds; NOT shared-world swarm/collision physics
- PX4-estimated positions, not external ground truth; one short mission per vehicle
- Delayed stale MAVLink ACK remains ambiguous: no transaction ID; fresh phase observations required
- Fault tests use mock transports and real ordinary OS processes, not real-flight fault injection
- Pinned locally adapted native arm64 binary; no rebuild or network access in hardening campaign

## Hardening and validation

All seven reviewed areas were addressed: pre-transmission cancellation/deadline gates; fresh post-phase heartbeat/landed observations; fail-closed port/PID ownership and exclusive campaign lock; external runner/group supervision with failure-safe finalization; bounded unread-UDP draining and explicit ACK ambiguity; advancing boot timestamps and gap/sample-count dwell; approved launch material and completion ULog hashes.

**52/52 tests passed before the frozen approval and flight** (20 original + 32 hardening regressions). The earlier 46/46 test run is also retained. No flight-runtime/support code was edited after this successful flight; post-flight verification matched the approved snapshot.

- [Final unit/fault log](hardening-tests-final.log) and [exact bounded test command/result](hardening-tests-final.json)
- [Actually blocked mock-transport fault](blocked-worker-fault-1788653462909076000.json): 1.2 s limit, 1.485 s total, runner killed with return code -9, no remaining live groups. The retained second-kill Darwin EPERM occurred after runner-group termination; it did not skip the other group or become a false flight success.
- Kill-failure continuation, exited-leader descendant teardown, occupied-port rejection, cleanup freshness, duplicate/gap dwell, and approval tampering were tested separately. These tests are **not real-flight fault injection**.
- [Independent final process/port/approval check](hardening-v1-single-plus-three/final-stop-check.json)
- [Exact commands](hardening-commands.json), [complete artifact inventory](artifact_hashes.json), [historical inventory](historical-manifest.json)
- [Detailed safety gates and reproduction](../../docs/FLIGHT_STACK_STUDY.md)

### Provenance

PX4 v1.17.0 commit `d6f12ad1c4f70ad3230afd7d86e971421e02fef4`; binary SHA-256 `f94df8c5b42f532a6b7267bfa93bc2788ae2b43186db050ee7031f974b740938` (unchanged, no rebuild). Current acceptance SHA-256 `7e5cd2ed9ce1db8436d7ae0ed0953168cc02f6f363f148ab3464e95f53fc8982`; original acceptance and provenance remain separately archived. The approved support/test snapshot includes resolved `boardconfig`, source isolation patch digest, build/runtime ROMFS hashes and verified dependency versions. `requirements.lock` was not regenerated.

One new campaign was attempted and passed; all previous failed attempts remain historical evidence. All four new PX4 processes exited with code 0, seven commands were accepted per vehicle, all cleanups freshly confirmed landed/disarmed, and no finalization errors occurred. Hover durations were 3.016–3.097 s with 32–45 samples and maximum gaps 0.112–0.127 s. Metrics are estimator observations relative to first receipt; acceptance uses preflight origin.

Post-flight cache was 1,246,331,901 bytes with 15,972,352,000 bytes free. No network, API key, hardware/serial/public endpoint, shared-source edit, commit or push. Only authorized study/test/doc/report/cache paths were written.