hudsonaikins · Nov 13, 2026 · Nov 13, 2026 · Nov 13, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,16 @@ A running server reports its version at `/health`.
 
 ## [Unreleased]
 
+### Documentation
+
+- New roadmap: the agent grows from a dispatcher into a crew scheduler, the dispatcher and a
+  local flight engineer that reads Infinite Flight's Connect API v2. Release order v0.5.2
+  through v0.11.0, with no language model in the real-time control loop. The product goal
+  records the November 13 amendment.
+- Align the README, backlog, agent guide, technical design and aircraft coverage with
+  production v0.5.1: `trip_progress` and `cancel_trip` are documented as shipped, the v0.5.1
+  live acceptance replaces the v0.4.6 figures, and stale status lines and links are corrected.
+
 ## [0.5.1] - 2026-11-13
 
 ### Fixed

diff --git a/README.md b/README.md
@@ -46,6 +46,10 @@ where to spawn and what thrust to set.
 - **Know your takeoff thrust.** N1 targets come from SimBrief's own takeoff solution and the
   lapse shape of FlyByWire's open A32NX thrust model, each with a range. Aircraft it can't
   model get a clear "unavailable" instead of a guess.
+- **Track or stop a trip.** Ask where a trip stands at any time, even after a server restart:
+  every leg's stage, the pending approval and anything uncertain. Cancel stops the work at the
+  next safe point and withdraws approvals not yet generated, while keeping finished plans; a
+  Generate click already made is never undone or repeated.
 - **Plan whole trips.** Each leg of a multi-leg trip is dispatched and kept separately, and
   must leave at least 45 minutes after the previous leg lands.
 - **Use it where you already chat.** Use the terminal chat, or connect an MCP client such as
@@ -108,7 +112,7 @@ setting, resuming conversations, and MCP client setup.
 | Local SimBrief tools (stdio) | Retrieving, reading and estimating from existing SimBrief plans; no generation | [SimBrief tools](docs/implementation/simbrief-usage.md) |
 
 The remote MCP server exposes `plan_flight`, `approve_dispatch`, `turn_status`,
-`conversation_status`, `list_saved_trips` and `browser_status`
+`conversation_status`, `trip_progress`, `cancel_trip`, `list_saved_trips` and `browser_status`
 ([tool reference](docs/implementation/agent-usage.md#deployed-mode-self-hosted-single-user)).
 It is built for ChatGPT, Claude and Codex as MCP clients; each client's own end-to-end journey
 has not yet passed acceptance, so treat client compatibility as unverified until it does.
@@ -146,10 +150,15 @@ lands. See the [agent guide](docs/implementation/agent-usage.md) and the
 
 - **Workflow evaluations.** 28 whole-conversation scenarios drive the production MCP tools
   over local HTTP with controlled FlightAware, SimBrief and browser services: planning,
-  routing, provider failures, approved revisions and recovery after a restart. The original
-  eight regression cases stay unchanged alongside them. Controlled-service results, matched
-  replays on the configured model and live-provider runs are reported separately
-  ([evaluation guide](evals/README.md), [v0.4.6 release record](docs/evidence/v046-release.md)).
+  routing, provider failures, approved revisions and recovery after a restart. Five more cover
+  trip control: cancelling at an approval, before or after a Generate click, and a turn
+  deadline. The original eight regression cases stay unchanged alongside them.
+  Controlled-service results, matched replays on the configured model and live-provider runs
+  are reported separately ([evaluation guide](evals/README.md),
+  [v0.5.1 release record](docs/evidence/v051-release.md)).
+- **The release image is tested, not just the code.** CI builds the container image and starts
+  the browser driver inside it, after v0.5.0 shipped a driver that could not run in the
+  deployed image ([incident and fix](docs/evidence/v051-release.md)).
 - **Fixes come from traces.** For example, WF-025 found that numbered revisions were treated
   as alternatives; v0.4.6 completes them in order, each separately approved
   ([fix report](docs/evidence/wf025-revision-sequence.md)).
@@ -160,12 +169,13 @@ lands. See the [agent guide](docs/implementation/agent-usage.md) and the
 - **No FlightAware fees for routine runs.** Evaluations replay synthetic or recorded FlightAware
   responses. Live provider checks are opt-in and capped at $1 per batch by default
   ([how to run them](evals/README.md)).
-- **Live acceptance per release.** Each release candidate's exact image runs a two-leg trip
-  (KIAD→KEWR, then KEWR→KIAD) on a temporary staging Worker, with a separate approval per leg,
-  before production approval. For v0.4.6 each leg generated once, the two browser sessions
-  used 151 seconds in total, and no browser was left running
-  ([release record](docs/evidence/v046-release.md), [acceptance data](docs/evidence/live-acceptance.json)).
-  These are single runs, not performance statistics.
+- **Live acceptance per release.** Each release runs a real multi-leg trip with a separate
+  approval per leg. For v0.5.1, on the promoted production server: KIAD→KEWR and KEWR→KIAD
+  each generated once (39 and 38 browser seconds), a third leg's pending approval was
+  cancelled and then refused, both finished briefings were kept, and no browser was left
+  running ([release record](docs/evidence/v051-release.md),
+  [acceptance data](docs/evidence/live-acceptance.json)). These are single runs, not
+  performance statistics.
 
 ## Releases
 
@@ -191,8 +201,11 @@ Worker version with the same name. A running server reports its version at `/hea
   large FLEX reductions there may be flagged as suspect.
 - **FlightAware only sees about two days ahead.** Flights further out have no live schedule or
   gate.
-- **It does not control the simulator.** It never claims your plan was imported, your aircraft
-  spawned, or your thrust was set.
+- **It does not connect to the simulator.** It never claims your plan was imported, your
+  aircraft spawned, or your thrust was set. A local companion that reads Infinite Flight
+  through its Connect API is planned, not built.
+- **Cancellation has limits.** Cancelling while a browser session is open, and the 600-second
+  turn deadline, are covered by controlled tests but have not been exercised live.
 
 ## Contributing
 
@@ -209,9 +222,17 @@ Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
 
 ## What's next
 
-v0.5.0 adds durable trip progress and safe cancellation, more dispatch inputs such as cruise
-altitude and alternates, sourced private-flight configurations, and measured aircraft expansion.
-The [roadmap](docs/roadmap.md) and [backlog](docs/backlog.md) track it.
+The agent is growing from a dispatcher into a small virtual crew:
+
+- **v0.5.2:** complete multi-airport departure searches and handle FlightAware rate limits.
+- **v0.6 — Crew scheduler:** ask "I have 4 hours" and get one real flight from your home hubs
+  and preferred airlines, with a one-line reason to fly it.
+- **v0.7 — Read-only bridge:** a local companion reads Infinite Flight's Connect API to log
+  flights automatically and record engine data, the evidence needed to verify thrust.
+- **v0.8 onward:** a full performance card, arrival gates and taxi routes, then opt-in assisted
+  autothrust. No language model ever sits in the real-time control loop.
+
+The [roadmap](docs/roadmap.md) has the full plan and its reasoning.
 
 ## License
 

diff --git a/docs/aircraft-coverage.md b/docs/aircraft-coverage.md
@@ -1,6 +1,6 @@
 # Aircraft coverage
 
-Status: planning; **zero aircraft have verified thrust-translation support in this project**. This describes available evidence, not a change to launch scope. The support definition is owned by [goal.md](goal.md#what-counts-as-aircraft-support).
+Status November 13, 2026 (v0.5.1): labeled simulation-grade estimates ship for the A320neo, A321neo and 737 MAX 8; **zero aircraft have verified thrust-translation support in this project**. The [roadmap](roadmap.md) plans simulator evidence from a read-only Connect API bridge (v0.7) and the first verified aircraft with the performance card (v0.8). This describes available evidence, not a change to launch scope. The support definition is owned by [goal.md](goal.md#what-counts-as-aircraft-support).
 
 ## Current fleet baseline
 

diff --git a/docs/backlog.md b/docs/backlog.md
@@ -1,7 +1,8 @@
 # Backlog
 
-Status updated November 12, 2026 UTC. Current release work is tracked in the
-[Infinite Flight Agent Linear project](https://linear.app/intelip/project/infinite-flight-agent-a2f7101e32e9).
+Status updated November 13, 2026 UTC. Current release work is tracked in Linear as the
+`IFA ·` projects under the "Infinite Flight Agent" project label
+([roadmap document](https://linear.app/intelip/document/infinite-flight-agent-roadmap-0dcea64227b8)).
 This file indexes that work and preserves earlier research. [goal.md](goal.md) owns the
 accepted product requirements and aircraft-support definition; the
 [roadmap](roadmap.md) maps release outcomes. Linear owns current task acceptance,
@@ -10,29 +11,38 @@ the current implementation and evidence summarized here supersede those dated bl
 
 ## Current delivery baseline
 
-Production is [v0.4.6](implementation/deployment.md#current-release-v046). The exact release
-image passed a deployed two-leg staging trip before promotion. The production rollout,
-transport limitations, provider usage and cleanup are recorded in the deployment runbook.
+Production is [v0.5.1](implementation/deployment.md#current-release-v051). It passed live
+acceptance on the promoted production Worker: two generated legs, a cancelled third-leg
+approval and a separate cancel-before-approval trip. v0.5.0 was rolled back after a browser
+driver failure; the [release report](evidence/v051-release.md) records the incident, fix,
+identities and usage.
 This proves the exercised dispatch integration, not simulator import or aircraft accuracy.
 
 | Surface | Current capability | Remaining work |
 | --- | --- | --- |
-| Foundation — SETUP-01, BUILD-01/02 | Locked Python application, Deep Agent, MCP, transactional storage/checkpoints, CI and product-validation manifest are installed; deployed generation is observed | Whole-operation progress, cancellation/deadlines and intended-client acceptance remain separate tasks |
+| Foundation — SETUP-01, BUILD-01/02 | Locked Python application, Deep Agent, MCP, transactional storage/checkpoints, CI (including a release-image browser-driver check) and product-validation manifest are installed; deployed generation is observed | Intended-client acceptance (INT-426) |
 | SimBrief — DISC-03/06, BUILD-04 | Browser generation (SimBrief-chosen route when none is agreed), exact-input approval/readback, retained route/navlog correlation and two retained legs are observed | More dispatch inputs and broader live-provider coverage; controlled recovery scenarios do not prove every provider option |
 | Flight research — BUILD-03 | Dated FlightAware research, connection checks, reported gates and explicitly unverified spawn suggestions are implemented | Verified simulator stand mapping, private configuration evidence and import behavior |
 | Thrust — BUILD-05, VERIFY-01 | Labeled A20N/A21N/B38M estimates and condition-specific observed N1 calibration are implemented | Zero aircraft have verified support under the accepted definition; engine/build applicability and simulator evidence remain open |
-| Trip management and evaluation | Saved legs/briefings, approved revisions, recoverable validation/provider guidance and a matched 28-case whole-conversation MCP/recovery suite are shipped | Durable progress/cancellation and more dispatch/configuration inputs remain planned |
+| Trip management and evaluation | Saved legs/briefings, approved revisions, recoverable validation/provider guidance, durable `trip_progress`, `cancel_trip` with turn deadlines, the 28-case whole-conversation suite and the WF-029–033 trip-control suite are shipped | Live evidence for cancelling during an open browser session and for the turn deadline; cruise level and alternate inputs (INT-418) |
 | Expansion — EXPAND-01 | Official v26 matrix is frozen: 51 current aircraft, 11 legacy records and explicit engine/native-system/profile gaps | Establish references, resolve applicability and verify simulator profiles before counting support |
 
-## Active release work
+## Release work
 
 | Version | Linear work | Outcome |
 | --- | --- | --- |
 | v0.4.3 — shipped | INT-402–406; [release evidence](evidence/v043-release.md) | Recoverable revision validation and provider failure guidance, planning reconciliation and measured evaluation baseline |
 | v0.4.4 — shipped | INT-407–411; [release evidence](evidence/v044-release.md) | Predictable existing conversations/routing, current catalog assessment and broader end-to-end scenarios |
 | v0.4.5 — shipped | [INT-415](https://linear.app/intelip/issue/INT-415); INT-412–414 verification remains open | Existing-profile software corrections shipped; independent reference/simulator applicability remains unverified |
 | v0.4.6 — shipped | [PR #24](https://github.com/IntelIP/InfiniteFlightAgent/pull/24); [release evidence](evidence/v046-release.md) | Ordered revisions complete generation/finalization with retained earlier results and exact approvals |
-| v0.5.0 | INT-416–428; [release task](https://linear.app/intelip/issue/INT-428) | Durable trip control, expanded dispatch inputs, private-flight configurations and measured aircraft expansion |
+| v0.4.7 — shipped | [Changelog](../CHANGELOG.md#047---2026-11-12) | Generate is clicked directly after the form is filled; Route Finder no longer hangs generation |
+| v0.5.0/v0.5.1 — shipped | INT-416/417; [release report](evidence/v051-release.md) | Durable trip progress, cancellation and turn deadlines; v0.5.1 restored generation after the v0.5.0 rollback |
+| v0.5.2 onward — planned | `IFA ·` projects in Linear | Departure search fix, crew scheduler, Connect API bridge, performance card, arrival ops and assisted power; see the [roadmap](roadmap.md) |
+
+The unshipped remainder of the original v0.5.0 scope (INT-418–427) was re-sequenced on
+November 13, 2026: cruise level, alternates and thrust verification moved to the v0.8.0
+performance card, client and import verification to the v0.7.0 bridge, and private-flight and
+broad fleet work to the unscheduled Fleet Expansion project. INT-428 was cancelled as superseded.
 
 The first implementation wave shipped through PR #21 and v0.4.3: INT-404 covers revision
 validation, INT-405 provider failure handling, INT-403 workflow evaluations, INT-402 planning
@@ -97,7 +107,7 @@ admission, server lifetime and idle cleanup, no replacement after timeout, no sc
 usage, and honest release/billing telemetry. Check queuing and cleanup with controlled provider
 responses. Live generation acceptance passed on isolated Cloudflare staging for candidate
 `9363cd1`; [the acceptance report](evidence/pr20-live-acceptance.md) records results and limits.
-Merged in PR #20 and deployed in [v0.4.2](implementation/deployment.md#current-release-v042),
+Merged in PR #20 and deployed in [v0.4.2](implementation/deployment.md#previous-release-v042),
 with fresh acceptance of the exact release image before promotion.
 
 ## Research and decisions

diff --git a/docs/goal.md b/docs/goal.md
@@ -1,6 +1,6 @@
 # Goal
 
-Status: accepted product direction from Hudson's planning conversation, October 30, 2026. Implementation and verification have not begun.
+Status: accepted product direction from Hudson's planning conversation, October 30, 2026, amended November 13, 2026. Implementation began November 1; production is v0.5.1, and the [roadmap](roadmap.md) records what has shipped against these criteria.
 
 ## User and problem
 
@@ -55,4 +55,6 @@ Prioritize free/open-source technologies, openly licensed data, existing access,
 
 The user operates Infinite Flight, selects spawn, imports the plan, and manually sets thrust. Automatic spawning, thrust control, climb management, LNAV/VNAV assistance, and telemetry-driven control are later possibilities, not launch requirements.
 
+**Amended November 13, 2026 (Hudson):** the product grows into three roles: a crew scheduler that chooses what to fly and why, the existing dispatcher, and a local flight engineer that uses Infinite Flight Connect API v2. Read-only telemetry, then opt-in assisted autothrust, predictive power and arrival ops are now planned work. The LLM never sits in the real-time control loop, and any manual throttle movement hands control back. The [roadmap](roadmap.md) owns the sequence.
+
 No public-product launch, paid provider, hosting platform, model provider, spending limit, or deployment is selected. Research can identify options; consequential choices remain with Hudson. See the [open decisions](backlog.md#open-decisions).
diff --git a/docs/implementation/agent-usage.md b/docs/implementation/agent-usage.md
@@ -1,6 +1,6 @@
 # Dispatcher agent: setup, use, and evaluation
 
-Status November 12, 2026 (v0.4.6): the Deep Agent runs on GPT-6 Luna through Sign in with ChatGPT, locally (`ifd-chat`) and as a self-hosted remote MCP server on Cloudflare behind Cloudflare Access ([deployed mode](#deployed-mode-self-hosted-single-user), [deployment](deployment.md)). SimBrief plans are generated by filling the dispatch form in a logged-in Browserbase cloud browser after exact dispatch approval. Sections below are dated; the evaluation tables record the October 2026 runs, and current release evidence is in [`docs/evidence/`](../evidence/). Per-client ChatGPT, Claude and Codex journeys are not yet acceptance-verified.
+Status November 13, 2026 (v0.5.1): the Deep Agent runs on GPT-6 Luna through Sign in with ChatGPT, locally (`ifd-chat`) and as a self-hosted remote MCP server on Cloudflare behind Cloudflare Access ([deployed mode](#deployed-mode-self-hosted-single-user), [deployment](deployment.md)). SimBrief plans are generated by filling the dispatch form in a logged-in Browserbase cloud browser after exact dispatch approval. Sections below are dated; the evaluation tables record the October 2026 runs, and current release evidence is in [`docs/evidence/`](../evidence/). Per-client ChatGPT, Claude and Codex journeys are not yet acceptance-verified.
 
 ## Shape
 
@@ -116,9 +116,10 @@ The review queue scores whole conversations. Automatic workflow feedback is sepa
 owner acceptance. Provider usage reports FlightAware list-price estimates and Browserbase
 elapsed time; unknown invoice costs stay unknown.
 
-## v0.5.0 trip control (unreleased)
+## Trip control (v0.5.0, fixed in v0.5.1)
 
-Remote MCP tools added for INT-416/417. Neither invokes the model or a provider.
+Remote MCP tools added for INT-416/417 and accepted live in production on v0.5.1
+([release record](../evidence/v051-release.md)). Neither invokes the model or a provider.
 
 | Tool | Use |
 | --- | --- |
@@ -136,7 +137,7 @@ unchanged: one active workflow, two waiters, 30-second queue wait, 180-second se
 
 ## Bounded browser management
 
-Deployed in [v0.4.2](deployment.md#current-release-v042) after exact-image staging acceptance
+Deployed in [v0.4.2](deployment.md#previous-release-v042) after exact-image staging acceptance
 on November 10 UTC (November 9 in New York). The [original PR acceptance](../evidence/pr20-live-acceptance.md)
 is retained separately from the release validation.
 Browserbase's project now reports concurrency 25. The dispatcher deliberately admits just