HITL Daemon Releases

Fixed

• **Restoring a flight controller's original settings could not work at all.**

The WebSocket server capped incoming messages at 1 KB, and a restore carries

the whole parameter snapshot — 21 entries of name, value and type, about

1.2 KB. The daemon rejected a message it had asked the browser to send, at

the WebSocket layer, before any handler could log it, and closed the

connection. The interface sat on "Writing your original settings" forever,

over a board nothing had written to.

The limit is now 64 KB: room for a snapshot several times larger than any

board's parameter set, still bounded against a local client making the daemon

buffer without limit. A test builds the real payload and fails if it no

longer fits.

Fixed

• **Ground impact/sliding-friction desync** — the accelerometer impact impulse assumed the whole velocity vector was arrested in 100ms, which stopped being true once slopes could slide (tangential speed decays only ~4% in that window at the sliding damping rate). The slide decision is now made before the impulse, and on sliding ground only the into-surface component is arrested.
• **Surface normal coverage gap at tile-block edges** — central-difference normal sampling needs all four probes, so a 5m shell along the tile-block boundary had a resolvable height but no normal and silently defaulted to level. Boundary probes now fall back to one-sided differences, matching the height field's coverage exactly.
• **`ground_rest_accel_body` seeded from wrong config** — was read from `SimulationConfig::default()` instead of the constructor's config. Not exploitable today (gravity is identical in both paths and the field is refreshed before first sample), but correctness depended on an unenforced cross-crate invariant.

Added

• **Sensor profile logging** — `ConfigureBuild` now logs resolved sensor noise values and match type (exact/mcu_family/average/default) for diagnostics.
• **Sensor match type passthrough** — accepts optional `sensor_match_type` field in WebSocket config to track how the profile was resolved.

Changed

• **Origin terrain elevation as vertical reference** — `sample_ground_ned()` now returns NED-down relative to terrain at origin, not the absolute reference_alt. At (north=0, east=0), ground_z=0 — matching the frontend 3D mesh where Y=0 at origin. Origin elevation stored at load time for consistent vertical datum.

Fixed

• **TERRAIN_ORIGIN altitude now uses simulation reference_alt** — the alt field in TERRAIN_ORIGIN message now contains the simulation's MSL ground level (1655m for Boulder CO) instead of the GPS_GLOBAL_ORIGIN altitude (often 0 due to ellipsoid datum). Terrain in the 3D viewer now renders at the correct height relative to the drone.

Fixed

• **kt KV-floor clamp** — large low-KV builds (8"+, 500 KV) no longer inflate kt quadratically via unclamped `(2300/kv)²`. Effective KV floored at 1500 (matching TS physics-model `KT_KV_FLOOR`). Eliminates phantom ~20:1 TWR on big-prop configs.
• **Two-sided PID authority scaling** — `compute_pids()` now attenuates for both braking (down) and boost (up) headroom. Overloaded builds (high hover_cmd) previously got full P/D despite limited upward authority, causing oscillation.
• **Actuator-bandwidth PID derating** — P/D scaled by `REF_TAU_MOTOR / tau_motor` so slow large-prop / low-KV actuators don't outrun their motor pole. Prevents phase-lag limit cycles on 8"+ builds.

Changed

• **Breaking: WebSocket handshake protocol now includes version_patch byte.** HandshakeAck binary format is now `[0x02, major, minor, patch, fc_connected, ...serial_port, 0x00]`. The web UI can now display and enforce full semver (e.g., `0.9.0` instead of `0.8`). Older web clients will misinterpret the patch byte as `fc_connected` — update the web frontend alongside this daemon release.

Fixed

• **MPC_THR_HOVER now matches actual sim hover** (sess113 bug: position mode couldn't take off after landing). The old code computed hover from `(1/TWR) / 0.7225` — a sag correction calibrated for the legacy inflated-thrust model. With the recalibrated physics (TWR~2 instead of ~8), this pushed 62.5% while actual sim hover was 44%. PX4's position controller couldn't generate enough thrust to lift off. Now uses `physics.hover_throttle_percent()` directly — guaranteed to match the sim.
• **Battery weight estimated from capacity** when no `battery_slug` is provided in `ConfigureBuild`. Previously defaulted to 180g regardless of actual capacity — a 4S 4500mAh pack weighing ~630g was modeled as 180g, making the sim 40% too light and hover feedforward 21pp too high. Estimate: `capacity_mah × cell_count × 0.035` (overridden by exact API weight when `battery_slug` is present).

Changed

• Rebuild against `hitl-physics` 0.10.0 (torque-balance loaded-RPM model, physical-CT recalibration).

Fixed

• Drone trembling / rate-controller oscillation on light builds: the Phase 6 PARAM_SET push to PX4 was commented out, so PX4 ran stock PIDs tuned for I_ref ≈ 0.005 against actual inertia of ~0.0037 — a ~34% over-gain that no manual tuning could stabilize.

Added

• Two-stage `ConfigResult` lifecycle (`configuring` → `ready` | `error`). The simulation loop is no longer reconfigured until PX4 confirms every PID parameter.
• Per-build PID PARAM_SET push with `PARAM_VALUE` ack verification. Per-parameter 800 ms timeout, 3 retries, value-match within 1e-4 epsilon.
• `AppliedConfig.verified_params` and `AppliedConfig.applied_pids` surface what was actually written to PX4.
• Frontend banner on `/simulator/run` shows "Verifying PX4 PIDs…", then a green "Continue to simulator" CTA on ready, or red error + retry on ack failure.

Changed

• `BuildConfigHandler::push_pids_and_verify` replaces the fire-and-forget `push_pids_if_changed`. Fingerprint cache only updates on full verification — partial pushes retry the whole sequence on the next `ConfigureBuild`.
• MAVLink receiver task taps `PARAM_VALUE` and broadcasts on a 256-deep tokio channel for the handler to subscribe to.

Fixed

• Motor RPM oscillation / drone trembling on lightweight builds (<500g): added Ixx/Iyy inertia floor of 0.012 kg·m² so PX4's rate PIDs don't overshoot
• Izz/Ixx ratio now always >= 1.7 to prevent unphysical gyroscopic coupling
• Battery depletion no longer allows infinite hover: motor commands zeroed when SoC < 5%
• Max speed unrealistically low (~4 m/s): drag coefficients now derived from frontal area (0.5×ρ×Cd×A) instead of hardcoded 0.25

Changed

• Drag model uses physically-derived coefficients based on prop diameter (~0.016 for 5" lateral, ~0.022 vertical)
• `hitl-physics` bumped to 0.5.0 (breaking: drag and inertia behavior changes for all `from_build_specs` configs)

Added

• Battery voltage parameter in ConfigureBuild command
• Battery voltage affects max motor RPM (KV × voltage × π/30)
• Propeller selection support (slug or diameter)
• Electrical parameters in AppliedConfig response (motor_kv, battery_voltage, max_motor_rpm)

Changed

• Physics config now uses voltage-limited max motor speed instead of fixed constant

Added

• EKF2 auto-restart on config change to clear stale estimator state
• Flight mode telemetry from HEARTBEAT custom_mode bits

Fixed

• Serial write timeouts to prevent stalls on port issues
• Parse buffer size limit with frame scanning to prevent OOM on corrupt streams
• Read timeouts so shutdown flag is checked periodically
• TUI always restores terminal on panic/error
• TUI auto-scroll logs to show latest output

Added

• Heartbeat watchdog: disconnects FC if no heartbeat received within 5 seconds (detects bootloader mode)
• Serial read timeout (1s): reader task no longer blocks forever on silent ports
• Serial write timeout (2s): writer task detects stalled USB/hub without hanging
• Parse buffer corruption recovery: scans forward to next MAVLink frame start (0xFD) on parse failure
• Parse buffer size cap (8KB): prevents OOM from sustained corrupt serial data
• Connection manager cooldown between disconnect and reconnect
• Retry count increments on all disconnect paths (including watchdog-triggered)
• TUI log auto-scroll: always shows most recent log lines
• TUI status panel shows real serial port path and reconnection state
• TUI panic hook restores terminal raw mode on crash
• Sensor message drop tracking with periodic warnings
• NSH queue backpressure: immediate rejection when queue is full ("NSH busy")
• WebSocket max incoming message size (1KB) to prevent memory abuse

Changed

• Writer task poll interval increased from 100µs to 1ms (reduced CPU usage)
• Receiver task poll interval increased from 500µs to 2ms (reduced CPU usage)
• NSH command channel reduced from 32 to 4 slots (prevents pile-up)
• Connection manager awaits aborted task handles before reopening port (prevents FD race)

Fixed

• Terminal stuck in raw mode after Ctrl+C (TUI restore moved to wrapper with error/panic coverage)
• Logs not visible after initial burst (Paragraph widget now scrolls to bottom)
• Status panel showing stale "Streaming" state after FC disconnect
• Serial port "none" in status panel (now reads from connection status broadcast)
• FC model not cleared on disconnect (stale model no longer shown during reconnect)

Added

• Rich terminal UI (ratatui) with status panel and scrolling logs
• TTY-aware output: TUI when interactive, plain logs when piped
• Packets/sec telemetry display
• FC model extraction and display (PX4/ArduPilot)
• Browser shutdown command (graceful Ctrl+C equivalent)

Changed

• StateUpdate protocol extended to 86 bytes (backward compatible)
• ConnectionStatus now includes FC model string
• Version bump to 0.3.0

Added

• Initial release through the automated release system

Fixed

• Motor mapping correction for X-frame configurations
• Serial port reconnection on macOS sleep/wake