Check bounded retention after event processing before source-expiry handling mutates authority. Preserve only the original unexpired proof for one normal tick; track all intent drains in the step so a later empty drain cannot conceal an intermediate deny.
Preserve fd14 fresh-owner continuity semantics and reconcile five legacy test expectations. Add early handoff and engagement/deny recovery regressions. 239 distinct focused tests and 277 platform tests passed; Ruff, type checks and exact-source import/inventory audits passed.
No native artifacts or lease extensions. This does not establish a fix for the separate measured Card production stall.
Keep an existing unexpired axis proof for one normal iteration when the selected source expires at publication, without renewing the proof or re-running stateful owners. Preserve physical overrides, restrictive intents, original deadlines and alerts; reject stale construction-time publication.
Add 79 owner-chain cases and refresh the protected source inventory. 183 focused tests, lint and type checks pass. Longer Card producer stalls remain outside this fix.
Persist preview visibility separately for comma and Android Auto, hide the stopped timer by default, and format the editor code. Include the matching prebuilt receipt.
Add preview-only widget eye toggles, unify discard and leave confirmation bars with a purple glow, and add bullets to setup troubleshooting. Include the matching prebuilt receipt.
Render the stopped timer in projected driving views and preview scenes, with layout migration and runtime coverage. Include the matching prebuilt receipt.
Add an opt-in Bookmark widget that dispatches through the native drive-bookmark action. Support independent opacity and background controls for Home, Work, Bookmark, and Exit widgets, and default the map overlay to 50% opacity.
Add saved preferences to avoid tolls, highways, and ferries, recalculating routes when preferences change. Include layout migrations, validation, rendering, transport, and routing tests.
Validate newly received intent against a post-drain clock while retaining the original absolute wait cap and output lease. Add full-owner regression and restrictive boundary coverage. Refresh the protected source inventory without changing native artifacts.
An unchanged pause on an inactive, unrequested axis must not veto the
other axis's existing bounded input wait. Preserve new-pause vetoes,
requested/active-axis pauses, and every existing unpause admission.
The original absolute output deadline and all source/native/fault gates
remain unchanged. Add full-owner tests for LONG-only continuity, late
arrival and processing, missing/invalid input, faults, pause transitions,
and the unresolved source-cutoff-after-final-refresh boundary.
Validated 31 targeted regressions, affected production suites, lint and
independent review. Device-level dropout resolution remains unverified.
Retain all live freshness, session, permission and original lease checks.
Reuse only successful structural validation for exact payload, timestamp
and complete CP inputs within each owner. Unsupported profiles fall back
to full validation. Add 50 invalidation and fallback regressions.
Validated affected AOL, SelfdriveD and Controls suites, unchanged Card
fixture failures, full lint/type checks and deterministic owner outputs.
Vehicle-level dropout resolution remains unverified.
Dispatch the exact Ioniq 6 fingerprint directly to its existing full qualifier instead of evaluating unrelated Hyundai profile owners first. Revalidate the Ioniq contract on every call; do not cache qualification or live authority.
When transport health obtains current_native itself, avoid immediately repeating the same structural inventory validation on that result. Explicitly supplied native observations still receive the structural check. Preserve all source/session/deadline, latest Panda configuration/health, controlsAllowed and vehicle-health vetoes.
Historical full-module comparisons identified added per-cycle feedback work after df38093f and further expansion in 1279c092. Later changes removed part of that expansion; this patch targets redundant work remaining on the current path. A matched 200-cycle Card fixture drops duplicate inventory validations from 424 to 222 with unchanged native reads and control outputs. No claim that a single introducing commit or all on-road dropouts has been causally resolved.
Validation: 694 affected AOL/Hyundai cases, 43 SelfdriveD and 47 Controls cases passed. Card had 85 passes, six skips and four separately established baseline LKAS fixture failures. Final test-only lint correction passed its 51-case suite; all 11 lint/type checks passed. Independent profile-equivalence and live-fault/deadline review completed. Broader compatibility and hosted CI are separate follow-up gates; no device or road qualification.
Only two Python runtime files and two regression test files change. No diagnostic instrumentation, arming/rearming, alert suppression, deadline changes, native artifacts, models or dependency changes. Build receipt remains unchanged; use the normal update path rather than manual Fast Update.
Skip repeated neutral media settings audits only while every gesture tracker is idle. Preserve edge, held-input, epoch, periodic and command-time qualification.
For qualified Ioniq 6 output continuity, reconcile sources arriving during car-event work before selected-source decisions. Retain earlier exact intent restrictions and queued cancellation/fault events, process samples once within the existing bound, and preserve the original absolute output deadline.
Add production-module regression coverage for late arrivals, source restrictions, GM ordering and wheel remaps. No arming/rearming, alert, freshness-threshold, native, model or dependency changes.
Validation: 101 focused cases passed; affected authority, controller, conditional, SelfdriveD/Controls and cross-brand functional checks completed. Baseline fixture/order and timing failures were separately reproduced; full aggregate, interrupted compatibility runs and native-process qualification are not claimed green. No device or road qualification. This is a scoped partial timing repair, not proof that genuine Card producer stalls are eliminated.
Build receipt and native artifacts remain unchanged. Manual Fast Update rejects the stale protected-source receipt; the normal updater path is required.
Dom