“Flown over” does not mean “safe forever”
A binary searched/unsearched map is too coarse. Each region should retain observation confidence, time of last valid observation, occlusion and sensor quality, residual probability from unresolved tracks, and the chance that a target can re-enter from a road, shoreline or corridor.
A freshly scanned area may carry high confidence, but that confidence ages. Space behind a building can remain uncertain even when nearby terrain has been overflown. A single pass must never become a permanent guarantee.
The reserve should follow expected demand, not chase the newest point
The public overlay first moves a staging marker toward the weighted position of the belief distribution. A complete implementation still needs to bring movement energy, terrain, communications, visibility and redeployment cost into the native planner. As the reconnaissance frontier expands, unresolved uncertainty may concentrate on one side of the map and the staging point can shift gradually with it.
The deadband and bounded movement step prevent small probability fluctuations from wasting energy through constant repositioning.
A clue should not pull every available asset away
The Python reference planner can propose one or two verification units while retaining at least one reserve. The public replay currently displays this policy and the dynamic staging marker; it does not execute or validate dispatch. In a native-kernel integration, only a credible clue should trigger the minimum feasible verification task, and any reserve-floor violation should be written to the ledger.
If a scout disappears, local risk rises because sensing capacity and future coverage both fall. That does not automatically prove hostile action: weather, link, navigation, power and sensor failure remain competing explanations. The hotspot must be labeled cause unknown, time-decaying and requiring verification.
Reconnaissance paths, handoff and staging form one planning problem
The route already flown changes the belief map. The belief map changes the best staging point. The staging point then changes whether the next handoff and verification can arrive in time. Optimizing the three separately can make them work against each other.
ALAYA places them in one replayable synthetic view: a fixed-wing planning overlay sustains coverage; the system proposes a second-sensor handoff after dual-FOV, turn-time and obstacle checks; and a dynamic staging marker follows unresolved belief. The private simulator's abstract last-resort event uses a server-side, one-use authorization receipt bound to user, role, scenario fingerprint, reason, expiry and a SHA-256 predecessor hash. Any configuration change requires renewed approval and `SafetySupervisor` remains non-bypassable. Reserve dispatch itself remains a human decision advisory.
Four policies belong in the same benchmark
- Keep the reserve at its initial point.
- Hold the reserve at the geometric center.
- Pull every available asset toward the newest clue.
- Use belief-weighted dynamic staging while protecting a reserve floor.
Evaluation should include median and P95 confirmation time, coverage gaps, uncertainty reduction per unit of modeled energy, false dispatches, reserve-floor violations, redeployment cost, and recovery time after sensor, link or vehicle loss.