WILDFIRE / BACKFIRE

Program: AGP Autonomous Air System Family — Reusable Autonomous Combat UAS Platform (this doc): WILDFIRE (AGP-1) hero platform; BACKFIRE (AGP-2) defensive CONOPS summary Document role: Defines how WILDFIRE is launched, navigated, survived, employed, recovered, and re-sortied across the mission set. Establishes the operational logic that every subsystem designs to. Status: Concept design. All numbers are design targets/estimates; unverified items carry [TBR] / [TBD].

REV B FRAMING (highest priority — applies to every profile in this doc)

WILDFIRE is RECOVERABLE and REUSABLE. The airframe + seeker + compute always come home to be refueled, rearmed, health-checked, and re-flown. Only the munition (if any) is expended. There is no one-way WILDFIRE mission — a one-way airframe is the "total folly" Palmer rejects [20:22 / 19:38]. Every mission profile in this document therefore ends in recovery + re-sortie, and the reuse cycle (Section 11) is a first-class part of the CONOPS, not an afterthought. Unconstrained by AIGP competition specs. The AIGP vision-autonomy stack is heritage/proof the brain works; production uses best-in-class compute (Thor-class, ~1000–2000 TOPS), sensors, and propulsion (DDR-03/05/06/07). No competition-hardware ceiling.

0. DDR Coverage (traceability)

This document is the primary owner of the CONOPS-class drivers and a consumer of the rest.

Primary drivers consumed (owned by other docs, exercised here): DDR-01 (RF not on critical path), DDR-02 (vision nav + terminal ID), DDR-03 (best-in-class compute), DDR-04 (jam-resistant), DDR-05/06/07 (DFM), DDR-09/10/11/12 (laser+HPM+kinetic survivability — and survive to RTB), DDR-14 (open networking for swarm), DDR-08/20 (mass production, allied second-source).

Governing constraint (DDR-01, [14:36]): "all of these schemes around radio frequency lengths and fiber optics… are probably going to go away because it's going to be cheaper, better, faster, more resilient to just have on-board autonomy do basically everything." Every mission profile in this document completes with all radios OFF. RF (SDR mesh, optional SATCOM) is treated as opportunistic — it improves the mission when present, but is never on the critical path. If the mission cannot be flown radios-dark, it is not a valid WILDFIRE mission.

1. Operational Concept Overview

WILDFIRE is a Group 3, recoverable & reusable, fixed-wing autonomous strike/multirole UAS that executes the full kill chain — navigate, find, identify, decide, act, egress, come home, re-arm, fly again — using onboard vision autonomy, with no required link to GPS, RF datalink, or fiber (DDR-01/02/04). It is the AIGP heritage vision-autonomy brain (proof of concept) wrapped in a mass-manufacturable, reuse-robust airframe (DDR-05/06/07/15) running best-in-class production compute (DDR-03).

The platform's operational identity rests on four pillars from the interview:

1. Runway-independent, link-independent reach. Launch from rail or RATO anywhere; navigate "the way a pilot would — look out the window and drive to the place you need to go until you see the thing you need and go to it" [16:01] (DDR-02). No airfield, no GPS, no operator joystick.
2. The survivability gauntlet — and survive to come home. Carry useful payload to long range and survive laser + HPM + kinetic simultaneously [18:46–19:16] (DDR-12) — and live to fly the return leg (DDR-15). Survivability is now sized for round-trip survival, not just terminal arrival.
3. Reusability as the economic engine (DDR-15). "kinetics need to be reusable… they need to come back so they can be refueled, rearmed, and reused. Now I'm not throwing away my seeker. I'm not throwing away my airframe" [20:06–20:32]. When the airframe, seeker, and computer all come home, cost-per-engagement collapses to fuel + (optional) munition. Every WILDFIRE sortie ends in recovery and re-flight.
4. Cost-imposition by existing — at sortie price, not airframe price. Even when an enemy can shoot WILDFIRE down, defeating a reusable drone that costs ~$3k/sortie to operate forces the enemy's C-UAS into an unwinnable cost ratio [19:16] (DDR-16). WILDFIRE wins by making the other designer's job impossible and by being cheap to keep flying.

1.1 Operational envelope (from locked baseline §3.1, Rev B)

What changed in Rev B vs Rev A. The "one-way strike" framing is deleted. There is no expendable-airframe WILDFIRE. The previous radius-vs-recovery trade (where full radius required a one-way flight) is superseded: the Rev B propulsion/fuel baseline carries an explicit RTB reserve, so the 1,500–2,500 km figure is a round-trip strike radius and every profile returns. The payload envelope grew to 25 kg, MTOW to 175 kg, ceiling to 6,000 m.

1.2 Mission phase model

All profiles decompose into a common eight-phase model, ending in recovery and re-sortie. The DDRs exercised per phase are constant; the emphasis and terminal effect vary by mission. No profile terminates in self-destruction or one-way impact — the airframe always returns (DDR-15).

 [P0 LAUNCH] -> [P1 CLIMB/DEPART] -> [P2 INGRESS/CRUISE] -> [P3 GAUNTLET]
   -> [P4 TERMINAL ID & DECISION] -> [P5 EFFECT/RELEASE] -> [P6 EGRESS]
   -> [P7 RTB + RECOVERY + TURNAROUND + RE-SORTIE]

2. Launch — Runway-Independent (P0)

Driver: Locked baseline mandates rail/RATO launch, no landing gear; runway-independent. Producibility doctrine (DDR-05/06/07) forbids exquisite launch infrastructure. The same site that launches WILDFIRE also recovers and re-sorties it (Section 11), so launch and recovery GSE co-locate.

2.1 Launch modes

2.2 Launch CONOPS notes

• No GPS alignment required. Vision/IMU initialization completes on the rail before release; first scene fix captured at launch heading (DDR-02/04). Launch-site survey is a coarse prior, not a dependency.
• Dispersed launch and recovery by design. Because no airfield is needed, launch/recovery points are cheap, mobile, and many — enabling both the ≥1,000/day production surge (DDR-08) and the high sortie rate that reuse (DDR-15) multiplies on top of unit count.
• Launch is radios-dark capable. No uplink required between load and release; the mission is fully loaded pre-flight (waypoint corridor, target signature set, ROE/geofence, RTB recovery point + alternate). RF, if available, only adds re-tasking headroom (DDR-01).

Assumption: Rail exit speed ~35 m/s at 175 kg MTOW; booster Δv sized to clear stall + obstacle in <2 s. [TBR by 10_airframe / 11_propulsion — increased over Rev A's 30 m/s to reflect heavier MTOW.]

3. Ingress — GPS/RF-Denied Vision Navigation (P1–P2)

Driver — DDR-02 [16:01]: "navigate not off of GPS or any other radio… do it the way that a pilot would. You look out the window and you… drive to the place you need to go until you see the thing you need and go to it." Driver — DDR-04 [15:54]: "completely resistant to all jamming systems, not just on the communications, but also things like navigation."

3.1 Navigation stack (operational view; design owned by 12_autonomy)

WILDFIRE flies the ingress corridor on the AIGP heritage brain, re-hosted on best-in-class production compute (DDR-03):

 cameras (3–6 global-shutter wide-FOV) + EO/IR gimbal
        |
        v
 vision_pipeline.py (heritage)  -> detect/recognize scene & landmarks -> PnP 6-DoF pose
        |
        v   (fused with dual voted MEMS IMU + baro + optical flow + optional star tracker)
 scene/map matching against onboard terrain & landmark priors  ->  position/heading estimate
        |
        v
 drone_mpc_foundation.py / rl_controller.py (heritage)  -> guidance & control  -> MAVLink bridge

• Pilotage, not GPS. WILDFIRE matches what it sees (coastlines, road/river junctions, ridgelines, built structures) to onboard priors, exactly as DDR-02 describes — it "looks out the window" and corrects course. GPS is not consumed; any receiver present is advisory-only and trivially deniable without affecting the mission (DDR-04).
• Drift management both ways. The same vision-inertial fix cadence that bounds outbound drift also navigates the return leg back to the recovery point (DDR-15). Long over-water or feature-poor legs use the optional low-SWaP star tracker and celestial/horizon cues as a coarse heading reference [TBR by autonomy].
• Radios dark throughout (DDR-01). Ingress and egress require no datalink. SDR mesh, if used, passes only opportunistic re-tasking or track-sharing (Section 5.5 swarm) and is jam-tolerant by being optional.

3.2 Ingress + return energy check (first-order, round-trip)

For a representative deep-strike profile using the Rev B baseline, all distances are round-trip with RTB reserve:

• Cruise 120 kt = 222 km/h.
• A 1,000 km round-trip strike (500 km out + 500 km back) ≈ 4.5 h of cruise, well inside the 12–20 h endurance budget — leaving margin for gauntlet maneuvering, terminal loiter, and reserve.
• The 2,000 km round-trip end of the envelope (1,000 km out + 1,000 km back) ≈ 9 h cruise, still inside endurance with reserve.

First-order range sanity (DDR-13/15): Round-trip air-distance = (endurance − reserve − terminal loiter) × cruise speed. At 120 kt and the locked 12–20 h endurance, gross cruise air-distance ≈ 2,600–4,400 km, i.e. a 1,300–2,200 km round-trip radius is consistent with returning home and holding reserve. The Rev B "1,500–2,500 km" radius figure is therefore a round-trip radius supported by the larger fuel fraction (~45 kg incl. RTB reserve). The Rev A radius-vs-recovery conflict is closed: recovery is no longer a radius penalty — it is the design point. Confirm exact reserve sizing with 11_propulsion_power. [TBR]

4. The Survivability Gauntlet (P3 outbound, P6 return) — Laser + HPM + Kinetic, Simultaneously

Driver — DDR-12 [18:46–19:16]: "it is almost impossible to build something that can stop all three of those at the same time… Now I need to make something that flies long ranges, carries a useful payload the whole way, and somehow survives all of these systems at the same time working together. That's really really hard."

The gauntlet is the operational region — typically the last tens of kilometers to the objective and any defended belt en route — where WILDFIRE is simultaneously exposed to directed-energy, HPM, and kinetic interceptors. In Rev B the gauntlet is two-sided: WILDFIRE must survive it on ingress (P3) AND on egress (P6) to come home and be reused (DDR-15). CONOPS here defines behavior; the hardening hardware is owned by 13_survivability.

4.1 Threat-layer responses (operational behaviors)

4.2 Gauntlet behavior logic

• Detect → classify → respond, onboard. Threat cues are processed onboard; responses fire without operator-in-the-loop and without RF (DDR-01/18-compatible: these are survival reflexes, not lethal-release decisions).
• Preserve payload + range + return energy (DDR-13/15). Every gauntlet behavior is constrained to not dump the payload, not exhaust the energy budget, and not burn the RTB reserve: roll/spin is low-rate; divert is a bounded lateral impulse, not continuous evasion. The mission must arrive with its effect intact and retain enough energy to fly home for recovery and reuse. This is the explicit "survive and carry useful payload the whole way" tension of DDR-12, extended in Rev B to "and come home" (DDR-15).
• Egress survivability (P6, new in Rev B). The return leg crosses the same defended belt. The autonomy plans egress to minimize re-exposure (different corridor, terrain masking, time-of-day), and the same skin/spin/divert reflexes protect the airframe on the way out. Survivability mass/cost is now justified twice per sortie and amortized over ≥50 sorties (DDR-15).
• Graceful degradation. Loss of one camera, one IMU (voted pair), or the comms radio does not abort — the autonomy completes on degraded sensing (12_autonomy). A breach of ROE-confidence triggers deterministic abort to a safe-recovery state (Section 6) — abort means return and land, not destroy.

4.3 The "impose cost" coupling (DDR-16) — now a sortie-cost lever

WILDFIRE does not need to be invulnerable. Per DDR-16 [19:16], its survivability transfers the design pain to the enemy: an enemy C-UAS that must defeat our laser-hardened, HPM-hardened, kinetic-dodging, reusable drone is forced to carry costlier effectors. Because WILDFIRE returns and re-flies, each engagement the enemy must win against us is priced at ~fuel + munition (~$3k/sortie), not at airframe price — the cost asymmetry Palmer demands (DDR-15/16). Section 7 develops this.

5. Mission Profiles

Five concrete profiles. Each names its customer/effect (DDR-17), gives a phase timeline through recovery and re-sortie, lists DDRs exercised, and states the reuse posture. Every profile recovers the airframe + seeker + compute; only the munition (if any) is expended (DDR-15). Timelines are design targets [TBR]; speeds/ranges per locked baseline §3.1 Rev B.

Profile A — Deep Strike (recoverable, reusable)

Customer/effect: Theater fires; hold a fixed/relocatable high-value target at extended round-trip radius without airfields, GPS, or a datalink. Releasable precision munition is the only expended item; the airframe, seeker, and compute return for re-sortie.

Reuse posture: Recovered & reused (airframe + seeker + compute). Expended: the munition only. Payload: precision munition (≤25 kg class). Key trade: Rev B fuel fraction (~45 kg incl. reserve) makes a ~1,000 km round-trip strike routine; the 2,000 km round-trip end of the envelope trades terminal loiter for range [TBR by 11_propulsion]. Reuse note (DDR-15): amortizing the ≤$150k airframe over ≥50 sorties drives strike cost to ~$3k/sortie + munition — the Section 7 deterrence lever.

Profile B — ISR / Loiter (recoverable, reusable)

Customer/effect: Persistent stare over a named area of interest; deliver EO/IR track data radios-dark, recover the airframe + payload for reuse. Nothing is expended — the EO/IR gimbal is a recovered, non-consumed sensor.

Reuse posture: Recovered & reused (airframe + EO/IR payload + compute). Expended: nothing. Endurance: 12–20 h favors long on-station time at the chosen radius. Reuse note (DDR-15): ISR is the canonical reuse case — same airframe flies daily; the EO/IR gimbal and compute are never consumed. With the Rev B endurance/fuel baseline there is no radius-vs-recovery penalty — return and reuse is the design point, not a trade.

Profile C — Electronic Warfare (recoverable stand-in jammer)

Customer/effect: Suppress/degrade enemy emitters (radar, C2) from a stand-in position the enemy cannot cost-effectively intercept. WILDFIRE flies radios-dark on its own nav and only then emits, then returns with the (reusable) EW pod.

Reuse posture: Recovered & reused (airframe + EW pod + compute). Expended: nothing (EW pod is a recovered module). Why this matters (DDR-01/04): WILDFIRE's own navigation never depends on RF, so it can fly into the densest EW environment — including its own jamming footprint — and navigate back out to recovery. A conventional RF-nav drone cannot stand in its own jamming; WILDFIRE can, and returns. Producibility: EW pod is a payload module on the common bay — no airframe change.

Profile D — Decoy / Spoof (recoverable, reusable — signature presentation)

Customer/effect: Saturate and exhaust enemy C-UAS — present a credible high-value-target signature to draw laser/HPM/kinetic shots, soak interceptor inventory, and measure enemy defenses for the following strike wave. This is DDR-16's "impose cost" made literal — and in Rev B the decoy itself is reusable, so it soaks shots and comes home to do it again (DDR-15).

Reuse posture: Recovered & reused (airframe + decoy/recorder module + compute). Expended: nothing — a reusable decoy is strictly superior to an expendable one: it can soak interceptors, log the threat picture, and fly the same mission again tomorrow at fuel price (DDR-15). Why WILDFIRE is a good decoy (DDR-16): because the real strike variant is genuinely hard to kill (laser+HPM+kinetic survivability), a decoy that looks identical is indistinguishable to the defender — the enemy must spend a full three-layer engagement on every contact. With reuse, blue can present that dilemma indefinitely; "their bombs are going to have to get smaller, their range is going to have to go down" [19:16] applied in reverse to their interceptor economy.

Profile E — Swarm SEAD (cooperative, open-network, recoverable)

Customer/effect: Cooperative Suppression of Enemy Air Defenses — a group of WILDFIRE (mixed strike/decoy/EW/ISR roles) cooperatively localizes and prosecutes an integrated air-defense node, sharing tracks over the open network when RF is available but completing even if it is not. All members recover and re-sortie; only strike-member munitions are expended (DDR-15).

Reuse posture: All members recovered & reused. Expended: strike-member munitions only. Networking (DDR-14): common track format so "every sensor is a sensor for every effector and vice versa" [17:02–17:45] — but mesh is opportunistic; loss of mesh degrades to pre-briefed role assignment, never aborts (DDR-01). Reuse note (DDR-15): the entire SEAD package returns and re-flies, so blue can re-attack the IADS at sortie price the next cycle — sustaining the pressure DDR-16 demands.

5.6 Profile comparison summary

There is no "one-way" column. Every WILDFIRE mission ends in recovery and re-sortie (DDR-15). The only thing that varies is whether a munition is expended (A, E-strike members) or not (B, C, D).

6. Bounded Autonomy — ROE & Human-on-the-Loop (DDR-18)

Driver — DDR-18 [33:01]: "I'm so much more worried about dumb AI in the hands of evil people than… hostile AI." The design risk is not a runaway superintelligence — it is an unconstrained, unauditable autonomous weapon. WILDFIRE's autonomy is therefore bounded, testable, and auditable, with positive human control over lethal release.

6.1 ROE architecture (operational)

6.2 The human-on-the-loop vs DDR-01 reconciliation

This is the one genuine tension between DDR-18 (human positive control over lethal release) and DDR-01 (no RF on the critical path). It is resolved by fail-safe default, not fail-deadly:

• Comms available: human-on-the-loop receives the vision-confirmed target package and authorizes/withholds release within the engagement window. The preferred mode.
• Comms denied (jammed/dark): WILDFIRE does not autonomously expand its authority. It executes the pre-briefed ROE loaded before launch — for most profiles: prosecute only pre-authorized, geofenced, vision-confirmed targets; otherwise abort and return for recovery. Lethal release in the comms-denied case is permitted only within tightly pre-authorized parameters approved before launch.
• Net effect: the mission completes radios-dark (DDR-01 satisfied) but the autonomy never escalates its own lethality when unsupervised (DDR-18 satisfied). Denying comms can only ever make WILDFIRE more conservative, never less — and because the airframe is reusable, the conservative outcome is simply "bring it home unfired" (DDR-15), the cheapest possible failure mode.

Design rule: Loss of the human-on-the-loop link degrades WILDFIRE toward restraint and recovery, never toward autonomy expansion or self-destruction. "Dumb AI in the hands of evil people" is defended against by making the failure mode boring, conservative, and recoverable.

7. Deterrence, "Impose Cost" & Cost-per-Sortie Logic (DDR-15/16)

Driver — DDR-16 [19:16]: "even if I can't stop them, I'm going to take payload away. Their bombs are going to have to get smaller. Their range is going to have to go down. Now they have to get in closer, which means other weapon systems can deal with them before they even launch." Driver — DDR-15 [19:38 / 20:06–20:32]: "It's a total folly… kinetics need to be reusable… they need to come back so they can be refueled, rearmed, and reused. Now I'm not throwing away my seeker. I'm not throwing away my airframe… If I have a reusable system, I'm only using up whatever fuel or kinetics I use."

WILDFIRE is a strike platform, but its strategic value is deterrence by cost imposition, and in Rev B that imposition is priced at cost-per-sortie, not cost-per-airframe. It works on three coupled fronts:

1. The reuse cost lever (DDR-15) — the core of Rev B. Because the airframe + seeker + compute come home every sortie, the recurring cost of putting an effect on target is fuel + (optional) munition, with the ≤$150k airframe amortized over ≥50 sorties. First-order: cost-per-sortie ≈ $150k / 50 + fuel + munition ≈ $3k airframe-amortized + fuel + munition [TBR]. An expendable competitor pays the whole airframe cost on every shot — Palmer's "total folly." WILDFIRE imposes the same effect at a fraction of the recurring cost, which is the decisive economic asymmetry.

2. Offensively (WILDFIRE attacking): A WILDFIRE that survives laser + HPM + kinetic simultaneously forces the defender's C-UAS to be exquisite — they must mass directed-energy + HPM + kinetic together, "almost impossible to build" [18:46] and ruinously expensive. WILDFIRE wins by making the enemy's counter-design unaffordable while WILDFIRE itself stays cheap to operate (front 1).

3. Defensively (the mirror trap): The same survivability doctrine, when the enemy tries to copy it, runs into our layered defense (including BACKFIRE, Section 10). Even if our defense can't stop every enemy drone, it forces their payload smaller and their range shorter — pushing them into envelopes where cheaper weapons kill them before launch. The cycle is "virtuous" [19:18] precisely because both AGP platforms (WILDFIRE offense + BACKFIRE defense) are reusable, so blue can sustain the volume that makes red's attack uneconomical.

CONOPS consequence: WILDFIRE's survivability features (DDR-09/10/11/12) and its recovery system (DDR-15) are not gold-plating (DDR-17) — they are the mechanism of deterrence. Survivability buys the airframe's return (so it survives to be reused); recovery + reuse drives cost-per-sortie down; low cost-per-sortie is what makes the cost-imposition of DDR-16 credible and sustainable. This chain is the program thesis.

8. "Don't Build the Batmobile" CONOPS Audit (DDR-17)

Driver — DDR-17 [36:54]: "not building the cool thing… makes no sense because there's no customer… focus on things that are actually in cycle, can actually get funded and actually get deployed."

Every capability claimed in this CONOPS is mapped to a named customer/mission. Nothing appears here without one.

Result: the CONOPS adds no capability without a mission, rejects the one-way airframe outright (DDR-15), and explicitly rejects RF-on-critical-path and exquisite features. Producibility (DDR-05/06/07), reusability (DDR-15), and survivability (DDR-12) beat peak performance throughout.

9. Demonstrability / Shoot-Off Readiness (DDR-15/19)

Driver — DDR-19 [21:40]: open competitions where companies "compete… at a shoot-off, and the best one or two companies win."

Each profile is written to be instrumented and demonstrable at a live shoot-off — and the reuse cycle is itself a scored demonstration (DDR-15):

These criteria are the contract between CONOPS and 17_test_verification_validation. The reuse/turnaround line is the DDR-15 demonstration the program owner specifically calls out as "the final thing at the top of my pinnacle" [19:30].

10. BACKFIRE (AGP-2) Defensive CONOPS — Summary

Driver — DDR-15 [19:32–20:46]: "kinetics need to be reusable… scaling down the fighter interceptor model… very very fast… turbine powered… maybe rocket powered… destroy things… then come back so they can be refueled, rearmed, and reused."

BACKFIRE is the blue-side counterpart that closes the deterrence loop of Section 7. Full design is owned by 20_variant_backfire_interceptor; the operational concept:

Why BACKFIRE completes WILDFIRE's logic: WILDFIRE forces the enemy's attack drones to survive a layered defense (DDR-16). BACKFIRE is the affordable, reusable kinetic layer of that defense — "the final thing at the top of my pinnacle" [19:30]. Because both platforms are reusable, blue can sustain the offensive and defensive volume that makes the enemy's attack uneconomical, exactly as DDR-15/16 demand. The two platforms share the autonomy core, the manufacturing doctrine, the open network, and the reusability doctrine.

BACKFIRE per-shot cost target: ≪ $20k (fuel + optional warhead, amortized airframe) (locked baseline §3.2). This — like WILDFIRE's ~$3k/sortie — is the number that makes layered defense affordable and therefore makes the deterrence of Section 7 credible.

11. The Reuse Cycle — Recovery, Turnaround & Re-Sortie (P7, DDR-15)

Driver — DDR-15 [20:25–20:44]: "they need to come back so they can be refueled, rearmed, and reused. Now I'm not throwing away my seeker. I'm not throwing away my airframe… If I have a reusable system, I'm only using up whatever fuel or kinetics I use."

This is the phase that distinguishes WILDFIRE from the "total folly" of expendable airframes. Every profile in Section 5 ends here. The recovery hardware and reuse-life engineering are owned by 18_recovery_reuse_lifecycle; this section defines the operational cycle and its timeline.

11.1 Recovery modes (runway-independent, gear-deleted)

All three are runway-independent and gear-deleted, consistent with the locked baseline, and all return the airframe + seeker + compute intact for reuse.

11.2 Turnaround timeline — target ≤30 min, small team (DDR-15)

First-order turnaround budget for a 2–3 person ground team at a recovery point [TBR by 18_recovery_reuse_lifecycle]:

Reuse cadence: A ≤30 min turnaround means a single airframe can fly multiple sorties per day, and over a ≥50-sortie reuse life delivers the effect of dozens of expendable units from one built airframe. This is how reuse (DDR-15) multiplies the ≥1,000/day production surge (DDR-08): effective fleet sorties = units built × sorties-per-unit.

11.3 Reuse-life & health management (DDR-15/19)

• ≥50-sortie reuse life [TBR]: the airframe is structurally sized (10_airframe) and the propulsion serviced (11_propulsion) for repeated launch-recovery cycles, not a single flight. Robust DFM (rivets/welds/structural adhesive, generous tolerances, DDR-07) is also reuse-robust.
• Health-monitoring for reuse qualification: each sortie writes a structural/thermal/propulsion health record; cumulative-cycle limits gate re-flight. A unit nearing reuse-life limit is rotated to lower-stress profiles (B/C) before retirement/overhaul.
• Seeker + compute are never expended: the EO/IR seeker, vision cameras, and Thor-class compute return every sortie — "I'm not throwing away my seeker" [20:30]. Only the munition (Profiles A and E-strike) is consumed.

11.4 What this does to the economics (ties to Section 7)

cost-per-sortie ≈ (≤$150k airframe ÷ ≥50 sorties) + fuel (~45 kg JP-8) + munition (profile-dependent) ≈ ~$3k airframe-amortized + fuel + munition [TBR]. Versus an expendable airframe that pays the full ~$150k every shot, WILDFIRE imposes the same effect at recurring cost an order of magnitude lower — the decisive lever of DDR-15/16 and the reason there is no one-way WILDFIRE profile.

12. Open Issues / [TBR]

• [TBR-CONOPS-1] Round-trip radius vs endurance/reserve: confirm that 1,500–2,500 km round-trip radius is supported by the Rev B ~45 kg fuel fraction with adequate RTB reserve and terminal loiter. Owned by 11_propulsion_power. (Rev A's radius-vs-recovery conflict is closed by the larger fuel fraction; this TBR now confirms reserve sizing, not feasibility of recovery.)
• [TBR-CONOPS-2] Rail exit speed (~35 m/s at 175 kg MTOW) and RATO Δv are placeholders; confirm with 10_airframe and 11_propulsion.
• [TBR-CONOPS-3] Vision-nav drift bound over feature-poor / over-water legs on both the outbound and return legs (does the optional star tracker earn its SWaP?). Owned by 12_autonomy.
• [TBR-CONOPS-4] Comms-denied lethal-release ROE parameters (which target signatures + geofences are pre-authorizable) require legal/operational sign-off — the DDR-18 crux; must be locked before any shoot-off (DDR-19).
• [TBR-CONOPS-5] Decoy signature-augmentation: how close must the (reusable) decoy's signature match the strike variant to be indistinguishable to a three-layer defender? Owned by 13_survivability + 14_payload.
• [TBR-CONOPS-6] Swarm mesh degradation: validate that loss of mesh degrades gracefully to pre-briefed roles without coordination collapse, including coordinated/staggered recovery. Owned by 15_comms + 12_autonomy.
• [TBR-CONOPS-7] Turnaround timeline (≤30 min, small team) and reuse-life (≥50 sorties) are targets; confirm parallelized step durations, BIT coverage, and cumulative-cycle limits with 18_recovery_reuse_lifecycle and 17_test.
• [TBR-CONOPS-8] Recovery-mode selection per operating site (Skyhook vs parachute+airbag; VTOL trade) and recovery-point survivability (recovery point must not become a targetable single node). Owned by 18_recovery_reuse_lifecycle.

Budget contribution

This is a CONOPS document — it allocates no dedicated hardware, mass, power, or cost of its own. All physical contributions are owned by the subsystem documents the profiles exercise (autonomy, propulsion, survivability, payload, comms, recovery/reuse). Reported as zero/N-A to avoid double-counting in the integration rollup.

• Mass: 0 kg (CONOPS allocates no hardware; all mass owned by subsystem docs). The envelope this CONOPS designs to is the locked Rev B 175 kg MTOW / 25 kg modular payload, owned by 03_system_specification and 14_payload_effects; recovery-system mass is owned by 18_recovery_reuse_lifecycle.
• Power (cruise / peak): 0 W / 0 W (no CONOPS-specific electrical load; autonomy/compute and payload loads are owned by 12_autonomy and 14_payload).
• Unit cost (volume): $0 (no CONOPS-specific BOM; the ≤$150k flyaway target, the ~$3k/sortie + fuel + munition cost-per-sortie target, and the BACKFIRE ≪$20k/shot target are constraints this CONOPS designs to, owned by 16_manufacturing, 18_recovery_reuse_lifecycle, and 20_backfire).
• Reuse impact: This CONOPS is the operational definition of reusability (DDR-15). It establishes that every WILDFIRE mission ends in recovery + re-sortie (only munitions expended), specifies the Skyhook/parachute recovery modes, the ≤30 min turnaround timeline (Section 11.2), and the ≥50-sortie reuse-life management concept (Section 11.3), and ties them to the ~$3k/sortie cost-per-sortie economics (Sections 7 & 11.4). It imposes no reuse-hardware mass/cost itself (owned by 18), but it is the document that requires recovery hardware to exist and bounds its turnaround/lifecycle targets. No one-way airframe is permitted (DDR-15, Section 8 audit).
• Assumptions / [TBR]:
• All distances are round-trip with RTB reserve; mission timelines are design targets at locked-baseline speeds (100–130 kt cruise / 70 kt loiter). [TBR-CONOPS-1] flags reserve sizing for 11_propulsion to confirm.
• Profiles assume the locked Rev B ≤25 kg modular payload and the locked survivability suite (DDR-09/10/11/12) sized for round-trip survival, as designed by their owning subsystems; this doc does not re-derive them.
• The ≤30 min turnaround / ≥50-sortie reuse life are targets pending 18_recovery_reuse_lifecycle and 17_test [TBR-CONOPS-7].
• Human-on-the-loop ROE (DDR-18) assumes a defined engagement window and pre-authorized comms-denied parameters [TBR-CONOPS-4]; no RF capability is assumed on the critical path (DDR-01). Abort defaults to recover, never self-destruct.

Document: 10_airframe_structures.md Platform: WILDFIRE AGP-1 (hero platform) — recoverable & reusable autonomous multirole combat UAS Status: Concept design / engineering study. All numbers are design targets or first-order estimates. Unverified values carry [TBR] (to-be-resolved by analysis) or [TBD]. This is a concept study, not a frozen design. Maps to baseline: §3.1 of 00_seed_design_brief.md (Rev B.1) — MTOW 175 kg (385 lb), empty-equipped ~104.5 kg, structure ~52 kg, mid-wing / V-tail / pusher / no landing gear, rail/RATO launch + Skyhook-cable recovery (parachute+airbag alt), reuse life ≥ 50 sorties [TBR], turnaround ≤ 30 min, < 120 structural parts.

Rev B.1 closure note (supersedes Rev B of this doc; authoritative — overrides all earlier 150 kg numbers in this file): MTOW is re-baselined 150 → 175 kg (385 lb) as signed growth per the integration's own recommendation, which RESOLVES integration finding F-1 / risk R-01 (mass overrun). The reconciled full-up strike config ≈ 174.5 kg, which now CLOSES within the 175 kg MTOW with positive margin, carrying the full 25 kg payload + terminal divert motor restored. Empty-equipped is now ~104.5 kg (not the old ~80 kg target); the structural share owned here remains ~52 kg. All load cases, masses, and margins below are re-stated at 175 kg. This is a CONCEPT STUDY; the reuse and recovery risks (R-03 Skyhook scaling, R-04 ≥50-sortie life) remain managed, not-yet-verified — they are not claimed solved.

Rev B framing note (carried forward): WILDFIRE is NOT a one-way airframe. The airframe, seeker, and compute come home every sortie to be refueled, rearmed, and reused; only the munition is expended. Palmer is explicit that the throwaway model is "the total folly" [19:38–19:39] and that "I'm not throwing away my seeker. I'm not throwing away my airframe." [20:31–20:32]. The structure is therefore sized for fatigue life and recovery loads, not a single use.

0. Design Drivers Satisfied (traceability)

Secondary interfaces: DDR-10 (Faraday/EMI — skin grounding and bay bonding, §9), DDR-11 (divert-motor hardpoint reaction loads, §7.6), DDR-12 (multi-threat survivability while holding range+payload+RTB within MTOW — structural contribution, §9 / §6), DDR-19 (instrumented shoot-off and reuse/turnaround demo readiness — weld/rivet fatigue coupon program, §10).

1. Design Philosophy — "the World-War-II airplane, not the World-War-I airplane"

Palmer's structural thesis is explicit and is the governing constraint for this document:

"Before you had a lot of handcrafting, hand-gluing, laminating, stretching, fitting. Everything after that, heavier planes, less performance, but it was just bam bam bam, rivet rivet rivet, crappy glue, weld over the whole thing." — [10:51–11:06]

We design WILDFIRE as the post-Pearl-Harbor airplane: a steel-intensive, weld-and-rivet semi-monocoque that a Ford, GM, John Deere, or Caterpillar plant can build with the tooling already bolted to its floor. We deliberately give up the ~30–40 % empty-mass saving an autoclave-CFRP/aluminum exquisite design would yield, and we buy it back with cheap heavy fuel and a bigger engine — because the line-throughput KPP (≥ 1,000/day, DDR-08) dominates and because the robust, forgiving steel sections are precisely what a reusable, ≥ 50-sortie airframe wants for fatigue durability. The signed MTOW growth to 175 kg (Rev B.1) is the explicit acceptance of this trade at the system level: rather than mass-optimize the structure away from the producible/durable point, the program bought the extra gross weight (and the propulsion uprate to ~35 hp that flies it) and kept the steel doctrine intact.

Two governing realities for this structure (both elevated in Rev B): 1. Producibility (DDR-05/06/07): the airframe must fall off an automotive/ag line at rate. 2. Reusability (DDR-15): the airframe must survive launch → mission → threat exposure → recovery, and do it ≥ 50 times [TBR] with ≤ 30 min turnaround between sorties. These two pull in the same direction — both reward thick, robust, low-stress, generously-toleranced steel structure — which is why WILDFIRE does not have to choose between them.

Hard exclusions (DDR-17 / brief §6): - No autoclave or out-of-autoclave prepreg CFRP in primary structure. - No titanium, no machined billet primary structure, no investment castings on the critical path. - No multi-stage deep-draw stampings, no chemical milling, no bonded honeycomb sandwich requiring NDI per part. - No retractable landing gear, no actuated leading-edge devices — high part-count, high-tolerance items deleted. (Runway-independent launch & recovery makes gear unnecessary — DDR-15.)

Everything that survives this filter is a commodity manufacturing primitive.

2. Material Selection

2.1 Selection logic

Material is chosen by bill-of-process compatibility first (DDR-06), then by cost, then by the survivability dividend (DDR-09/10), then by fatigue/reuse durability (DDR-15), and only then by specific strength.

Why steel and not aluminum (the counterintuitive call): in a conventional UAV, aluminum wins on specific strength. Here, steel wins on system terms — and the reusability mandate makes the case stronger, not weaker: steel is the material the target factories already stamp by the coil-ton; it welds with the same robotic MIG cells that weld truck frames; it gives a free survivability layer (its own ablative/reflective laser shield and Faraday shell); and a galvanized steel structure running at low stress has a true fatigue endurance limit and shrugs off the bump-and-scuff of repeated Skyhook captures — exactly what a reused airframe needs. This is "$10 will make a drone 100 times more survivable against a laser" [17:55–18:17] folded into the primary structure at zero added part count, on a platform that then comes home to do it again.

2.2 Gauge schedule (first-order, 175 kg MTOW airframe)

Single-stage press-brake / stamping gauges, all from standard coil stock. Gauges re-checked against the heavier 175 kg loads (§7) — the spar-cap section is the sizing-sensitive item and is retained at the up-gauged value (the heavier MTOW consumes the fatigue-margin headroom but the section still closes static with positive MS, see §7.2):

3. Structural Architecture

3.1 Configuration recap (from locked baseline §3.1, Rev B.1)

Mid-wing, V-tail, pusher prop, no landing gear. Runway-independent launch (rail / RATO) and recovery (Skyhook-cable capture; parachute + airbag alternate). The configuration itself is a DFM choice — deleting the gear removes the single highest-tolerance, highest-part-count, highest-actuation subsystem on a conventional UAV (DDR-17) — and a reuse choice: gear is the classic hard-landing damage source; a Skyhook/chute recovery has no gear to bend, fold, or re-rig between the ≥ 50 sorties (DDR-15).

3.2 Major assemblies (6 primary modules)

The airframe is decomposed into field-separable modules joined at a small number of bolted/pinned interfaces. This is what lets distributed/allied lines (DDR-06/20) build modules in parallel, mate them at final assembly — and lets a 2-person turnaround team swap a scuffed wing or a payload module in minutes between sorties (DDR-15).

3.3 Wing

• Planform / box: single full-span main spar (press-braked HSLA C-channel cap + sheet web) passing through a welded carry-through box in the center fuselage; secondary rear spar/auxiliary spar carries the control-surface hinge loads. Baseline wing area ~2.4 m² (AR ≈ 9, span ≈ 4.65 m) [TBR from 11_propulsion_power.md aero — note wing-loading rises to ~73 kg·m⁻² at 175 kg; aero may grow area to hold the loiter/cruise envelope, which feeds back into §6 wing mass].
• Ribs: stamped, flanged, lightening-holed steel — one stamping die produces the rib family with cutouts. Generous bend radii (≥ 2× sheet thickness) per DDR-07.
• Skin: 0.7 mm galvanized steel, stressed (working) skin, seam/spot-welded to ribs and spar flanges, structural adhesive at the skin-to-cap interface for fatigue/fretting and to seal against the elements. This is the "rivet rivet rivet, crappy glue, weld over the whole thing" doctrine [10:59–11:06] applied verbatim — and the bonded faying surface is a deliberate fatigue-life measure for the reused airframe (adhesive reduces rivet-hole stress concentration and fretting).
• Skyhook capture reinforcement (DDR-15): the wing carries a hardened cable-capture/hook point near the wingtip (the Skyhook engagement region). A press-braked steel capture rib + leading-edge doubler distributes the snatch tension (§7.5) inboard along the spar rather than into the skin. Designed for ≥ 50 captures with inspect-only (no replace) intent [TBR — note: Skyhook is scaled ~5× beyond fielded ScanEagle heritage; see risk R-03, recovery method not yet down-selected].
• No high-lift devices. Plain elevon/aileron control surfaces only (low part count). Launch is rail/RATO so no flap-down field-takeoff requirement.

3.4 V-tail

• V-tail (not conventional empennage) chosen for part-count reduction: two identical ruddervator surfaces and two identical fin structures instead of three dissimilar surfaces. Left/right symmetry means one stamping die set serves both sides and both ship-sets — serving DDR-06 line-training simplicity.
• Built as a stamped-rib / press-braked-spar / welded-skin micro-wing, identical process to the main wing.
• Mounted to the aft-fuselage welded structure on a single bolted root fitting per side (field-separable for repair/reuse).

3.5 Fuselage

• Semi-monocoque: press-braked steel keel beam runs the length of the fuselage as the primary bending member; stamped ring frames; 0.9 mm welded steel skin works in shear.
• Center section is a welded steel torque box that simultaneously is the wing carry-through, the fuel-tank surround (now sized for the ~45 kg fuel load incl. the protected ~4 kg RTB reserve), the rail/launch reaction structure, and the primary recovery-load reaction structure (parachute riser hardpoint / Skyhook load feed-in) — one welded assembly doing four jobs (DDR-17: no part exists without a job).
• Pusher engine hangs off the aft-fuselage on a bolted firewall + welded truss backing; this localizes engine vibration/thrust loads, isolates the (hot) engine bay from the composite radome, and keeps the prop clear of the wingtip Skyhook capture path (pusher config is recovery-friendly — no nose prop to foul the cable). Note the engine truss is sized for the uprated ~35 hp (~32–38 hp band) heavy-fuel engine that flies the 175 kg MTOW; the engine itself is ~17 kg dry, charged to propulsion (FIX F-4).

3.6 Modular nose & payload bay

• Glass/basalt RF-/EO-transparent radome for the nose (the reusable EO/IR seeker looks through it, DDR-02) bolted to a stamped-steel ring frame. The seeker is not expended — it is protected behind the radome and returns every sortie (DDR-15).
• Payload bay is a steel box within the forward/center fuselage with a single bolted interface ring + blind-mate connector plate so the expendable munition module, or the non-expended EO-IR ISR / EW / decoy / cargo modules, swap without re-rigging (DDR-13/14). The bay reacts the full 25 kg payload (restored by the 175 kg re-baseline) inertial loads directly into the keel beam. This is also the rearm interface for ≤ 30 min turnaround (DDR-15): the only routinely-expended item, the munition, drops into this bay.

4. Recovery Load Paths & Reuse Architecture (DDR-15 — PRIMARY)

This section is the structural embodiment of the reusability KPP. The airframe must be captured, brought to rest, and returned to flyable state ≥ 50 times [TBR]. The recovery method is not yet down-selected (risk R-03); both Skyhook and parachute+airbag load paths are carried in structure.

4.1 Primary recovery method — Skyhook-style cable capture

Concept. The UAV is recovered with no landing gear and no runway by flying into a vertically-suspended capture cable (extended from a boom on a ground vehicle, ship rail, or trailer). A hardened hook/capture point near the wingtip engages the cable; the cable's elastic give-back plus a boom/bungee arrestor decelerates the aircraft to rest. (This is the same operating principle as the fielded ScanEagle/Skyhook system — but a ~175 kg airframe is ~5× the ~22 kg ScanEagle heritage mass; this scaling is the open risk R-03 and is NOT yet validated [TBR].)

Structural provisions owned here: - Wingtip capture fitting: a welded HSLA capture lug + leading-edge capture rib, tied into the main spar so the cable tension reacts as spar tension/bending, not skin tearing. - Span-distribution doublers: the snatch load is fed inboard along the spar cap to the carry-through box; local skin doublers prevent buckling at the capture region. - Designed for ≥ 50 captures, inspect-only. Capture region is a defined inspection zone (visual + tap-test, no per-event NDI) on the turnaround checklist (DDR-15/19).

Why wingtip capture suits this airframe: pusher prop is clear of the capture path; the V-tail is clear; and the wing spar is already the strongest member, so the recovery load shares the existing primary load path rather than demanding a bespoke structure (DDR-17 — no Batmobile recovery rig).

4.2 Alternate recovery method — parachute + airbag

For sites without a Skyhook rig, or as a contingency abort recovery: - Parachute riser hardpoint on the upper longeron of the center torque box, sized for chute opening-shock + steady descent (§7.5). A single welded HSLA bridle fitting feeds the riser load into the carry-through box. (Note: chute/airbag sizing scales with the heavier 175 kg recovery weight; re-checked in §7.5.) - Airbag / crushable belly pad under the center fuselage absorbs the touchdown stroke; the airbag attach hardpoints are local welded fittings. - Trade vs Skyhook: parachute+airbag is simpler infrastructure (no boom vehicle) but has a larger landing footprint, a wind-drift dispersion, and consumes/repacks a chute each sortie (a small per-sortie consumable, vs the Skyhook's zero-consumable capture). Both are carried; Skyhook is the candidate primary for the ≤ 30 min, zero-footprint, ship/vehicle-compatible turnaround — pending the R-03 down-select. VTOL recovery is noted as a trade in the brief but is rejected here on DDR-17 grounds (lift rotors/tilt mechanisms are exactly the high-part-count, high-mass Batmobile content the program excludes).

4.3 Turnaround & reuse maintainability (≤ 30 min, DDR-15)

The structure is explicitly designed so a small team can return the airframe to flyable state fast: - Quick-swap bolted modules (nose/payload ring, wing roots, tail roots) → field-replace a scuffed surface instead of repairing it. - Munition is the only routinely-expended item; rearm = drop a new munition into the bolted bay (blind-mate connector). - Defined turnaround inspection zones (capture region, belly pad, engine firewall, spar caps) on a checklist — visual/tap-test only, no per-sortie NDI, enabled by the forgiving steel sections. - Fuel: common heavy fuel (JP-8/Jet-A) gravity/pressure fill into the center-box tank surround; the ~4 kg RTB reserve is a fixed hold-back at the fuel-system level (protected regardless of mission fuel state — interface to 11_propulsion_power.md).

4.4 Health monitoring for reuse qualification

Embedded, low-SWaP structural cues (peak-strain witness gauges at the spar root + capture fitting; cycle counter tied to the autonomy log) flag when an airframe approaches its qualified life or exceeds a load threshold, so a unit is retired/depot-inspected on data, not guesswork (DDR-15/18/19). The ≥ 50-sortie life itself is not yet verified — engine/structural life vs engine-hour math is open risk R-04 [TBR]. Detail in 18_recovery_reuse_lifecycle.md.

5. Joining & Bill-of-Process (DDR-06/07)

The entire airframe is joinable with four processes, all present on a truck-frame or combine line:

Spot/seam resistance welding of the thin skins is a fifth, optional primitive (also native to auto body lines) and is the preferred high-rate method for skin-to-rib once the line is at surge rate.

Tolerances: deliberately generous — toleranced to automotive body-in-white class, not aerospace class. Per DDR-07, single-stage press radii (≥ 2t bend radius) are mandated so no part requires a progressive/transfer die or multi-hit forming.

Part-count gate (DDR-06: < 120 structural parts). First-order rollup below; full BOM in 30_bill_of_materials.md. The MTOW growth to 175 kg is absorbed in gauge/section (the spar cap and carry-through welds carry more load) not in added part types — the part roster is unchanged by the re-baseline.

The < 120 count is the structural part roster (excludes consumable rivets, propulsion, avionics, the chute/airbag soft goods). Recovery provisions added ~20 part types vs the one-way Rev A baseline; the V-tail and L/R symmetry remain the count-reduction levers that keep it under the (relaxed-from-100) gate.

6. First-Order Empty-Structural-Mass Breakdown (target ~52 kg)

Scope note: this document owns the empty structural mass (~52 kg), a subset of the ~104.5 kg empty-equipped mass (the balance — propulsion dry ~26 kg, electrical ~7.2 kg, autonomy ~3.4 kg, survivability ~9.3 kg incl. the divert/dodge motor charged ONCE, comms ~0.9 kg, CPI ~3.2 kg, recovery mechanisms/soft-goods ~6.5 kg — is owned by the respective subsystem docs and reconciled by Integration). The reconciled full-up strike config = empty-equipped ~104.5 kg + fuel 45 kg + payload up to 25 kg ≈ 174.5 kg, which closes within the 175 kg MTOW with positive margin (Rev B.1, resolves F-1/R-01).

Method: each module sized from its surface area / member length × gauge × steel density (7850 kg/m³ for steel; ~1900 kg/m³ for glass laminate), with a process/joining mass adder (welds, rivets, adhesive, doublers) applied as a markup. Wing wetted area carried at ~2.4 m² (now ~73 kg·m⁻² wing-loading at 175 kg) [TBR from 11_propulsion_power.md — area may grow to hold the aero envelope; the structural mass below scales with any area growth].

Reconciliation. The line-item point estimate sums to ~59.5 kg. To keep the structural share of the ~104.5 kg empty-equipped mass disciplined at the canonical ~52 kg figure, the delta is treated as detailed-design optimization headroom (gauge trims on lightly-loaded skins, lightening-hole optimization on ribs and frames). The conservative, un-optimized rollup is carried as:

Reconciliation to baseline (Rev B.1). The locked baseline gives ~104.5 kg empty-equipped against a 175 kg MTOW. Structure at ~52 kg is exactly the structural line in the canonical empty-equipped rollup (structure ~52 + propulsion dry ~26 + electrical ~7.2 + autonomy ~3.4 + survivability ~9.3 + comms ~0.9 + CPI ~3.2 + recovery ~6.5 ≈ 104.5 kg). With fuel 45 kg + payload up to 25 kg, the full-up config ≈ 174.5 kg, closing within MTOW with positive margin [TBR by Integration rollup]. Steel content drives ~80 % of structural mass and is the deliberate DDR-07 penalty (§8); the recovery provisions add ~3 kg, the price of reuse (DDR-15) and a bargain against throwing the whole airframe away.

Note on the F-2/F-3/F-4 fixes (mass accounting hygiene): the terminal divert/"dodge" motor is charged once to survivability (~4.1 kg) and is not in this structural line nor in propulsion dry (FIX F-2 removes the old ~3.2 kg phantom from propulsion). Structure here owns only the divert-motor hardpoint fitting (a few-hundred-gram welded plate, in the "Hardpoints… divert-motor fitting" line), not the motor itself. The engine is ~17 kg dry charged to propulsion (FIX F-4), and structure is 52 kg (not the obsolete 40 kg / 7 kg split). These are the owner-doc-consistent numbers.

7. Load Cases & Structural Margin Rationale (at 175 kg MTOW)

All loads referenced to MTOW = 175 kg → W ≈ 1,717 N (g = 9.81 m/s²; 175 × 9.81 = 1,716.75 N). Margins are first-order; full FE + coupon testing in 17_test_verification_validation.md. Margin of Safety MS = (allowable / (limit × FS)) − 1, target MS ≥ 0 at ultimate.

7.1 Design load factors (reusable Group-3)

Load factors are MTOW-independent (they are g-multiples); the absolute forces grow with the 175 kg gross weight. The +9 g ultimate maneuver and +18 g ultimate divert envelopes are unchanged from Rev B, but every absolute load below is re-computed at W ≈ 1,717 N.

Full FS on the divert case (carried from Rev B). A reduced FS on the divert load is void: WILDFIRE is reusable and may divert on every sortie across ≥ 50 sorties, so the divert case carries the standard 1.5 FS and is treated as a fatigue-contributing event, not a one-shot. Direct consequence of DDR-15. The divert motor itself is charged once to survivability (~4.1 kg, FIX F-2); structure owns only its hardpoint.

7.2 Wing root bending — first-order (at 175 kg)

• Per-side lift at ultimate (+9 g): L_side = 0.5 × 9 × 1,717 ≈ 7,727 N.
• Spanwise CP at ~40 % semispan; semispan ~2.32 m → arm ~0.93 m.
• Root bending moment M ≈ 7,727 × 0.93 ≈ 7,186 N·m at ultimate.
• Mean chord ~0.52 m; spar box cap-centroid separation ~15 % chord ≈ 0.077 m → cap force F = M/h ≈ 7,186 / 0.077 ≈ 93.3 kN per cap.
• Required cap area at steel yield σ_y ≈ 350 MPa (HSLA): A = F/σ_y ≈ 93,300 / 350e6 ≈ 267 mm².
• A press-braked cap of 2.5 mm × 120 mm flange = 300 mm² → MS ≈ (300/267) − 1 ≈ +0.12 at ultimate. Positive — the section still closes at 175 kg MTOW. The MTOW growth from 150 → 175 kg consumed most of the prior fatigue-margin headroom (Rev B MS was ≈ +0.32 at 150 kg); at detailed design the cap may be up-gauged to ~2.8–3.0 mm to restore explicit endurance-limit margin for the ≥ 50-sortie reuse intent (small local mass adder, no new part). [TBR by FE.]

The point of showing this: the steel spar carries a +9 g ultimate wing at the heavier 175 kg gross weight at commodity gauge, with positive (if reduced) static margin. We are not mass-optimal (an aluminum/CFRP cap would be a third the mass) — and that is the accepted, intended penalty (§8). The reduced static margin at 175 kg flags the spar cap as the first section to revisit for fatigue substantiation under reuse (§7.7).

7.3 Carry-through torque box

The welded center box reacts both wings' root moments as an internal couple (~7,186 N·m per side ultimate at 175 kg). Steel weld allowables (even at "WWII tank" cosmetic quality) comfortably exceed the static demand; MS is governed by weld-throat fatigue, not static strength → the ≥ 50-sortie life requirement (DDR-15) makes the weld-fatigue coupon program (DDR-19) the binding substantiation here, not static test. The heavier MTOW raises the cyclic stress amplitude in the weld throats, so the coupon spectrum must be run at the 175 kg load set. [TBR]

7.4 Fuselage / payload-bay

Payload (full 25 kg, restored by the re-baseline) at +9 g ultimate = 25 × 9 × 9.81 ≈ 2,207 N reacted into the keel beam over the bay ring frames; fuel ~45 kg sloshing/inertial (45 × 9 × 9.81 ≈ 3,973 N at ultimate) reacted by the welded center box. Both are low compared with wing-root loads; sizing is driven by local crippling and rivet bearing, handled by local doublers. Bay interface ring sized for repeated payload/munition swaps (DDR-15 turnaround).

7.5 Recovery loads (DDR-15) — first-order, at 175 kg

Skyhook capture (driving recovery case). Capture at loiter speed ~70 kt (≈36 m/s); capture kinetic energy at the 175 kg recovery weight KE = 0.5 × 175 × 36² ≈ 113.4 kJ (up from ~97 kJ at 150 kg — a ~17 % energy increase the arrestor must absorb). Arrested over an effective give-back stretch d (cable elasticity + boom/bungee):

Peak cable tension into the wingtip capture fitting ≈ 21–28 kN [TBR] (depends on arrestor compliance; scaled from the 18–24 kN Rev B figure for the heavier capture weight). The capture lug/rib is sized to react this into the spar cap (300 mm² × 350 MPa cap reserve ≈ 105 kN static capacity — still ample headroom over a ~28 kN snatch, though the headroom shrinks at 175 kg). The ~5× scale-up of the Skyhook beyond ScanEagle heritage and the recovery-method down-select remain open (risk R-03, NOT validated). [TBR by recovery-system dynamics in 18_recovery_reuse_lifecycle.md.]

Parachute + airbag (alternate), at 175 kg. Chute opening shock ~3–4 g into the center-box riser hardpoint (absolute riser load scales with the 175 kg weight, so the bridle fitting is re-checked); steady descent ~6 m/s (a larger canopy is required for the heavier weight at the same descent rate — owned by 18_...); airbag stroke ~0.3 m → touchdown decel ≈ 6 g into belly attach hardpoints. Both bounded by the wing-root case in absolute force; sizing is local-fitting + riser-attach bearing. [TBR]

7.6 Divert-motor hardpoint (DDR-11)

The lateral solid-divert/"dodge" motor imparts a short, high lateral impulse on (potentially) every sortie. Its fitting is a 3–5 mm welded steel plate tied directly into the keel beam so the impulse reacts into the strongest member, not the skin. Treated as a fatigue-cycle contributor (DDR-15), not a one-shot. The motor mass (~4.1 kg) is charged once to survivability (FIX F-2); structure owns the hardpoint only. [TBR] thrust/impulse from 13_survivability_ew_hardening.md.

7.7 Fatigue & reuse life (DDR-15) — a PRIMARY load case

WILDFIRE is reusable for ≥ 50 sorties [TBR]; fatigue is a co-primary sizing case alongside static strength.

• Per-sortie damaging cycle set (first-order): 1 launch (RATO axial), ~1–N maneuver/gust cycles, up to 1 divert event, 1 recovery snatch. Over ≥ 50 sorties this is on the order of 10²–10³ significant cycles at the spar root / carry-through welds / capture fitting [TBR].
• Effect of the 175 kg re-baseline: the heavier MTOW raises the cyclic stress amplitude at the spar root (where static MS dropped from ~+0.32 to ~+0.12, §7.2) and at the carry-through welds. The endurance-limit, inspect-only intent is therefore conditional on the detailed-design cap up-gauge restoring the below-endurance-limit working stress; if not restored, the structure shifts toward a damage-tolerant / finite-life inspection regime. This is the binding open item for reuse.
• Why steel still helps: HSLA steel run below its endurance limit has effectively infinite life for the low-cycle count above; adhesive-bonded faying surfaces (§3.3) cut rivet-hole fatigue concentration.
• Substantiation: weld + rivet + capture-fitting fatigue coupon program to ≥ 50-sortie spectrum at the 175 kg load set (DDR-19 reuse-cycle readiness), full-scale fatigue article to ≥ 2× life [TBR in 17_test_verification_validation.md]. The ≥ 50-sortie engine/structural life vs engine-hour math is open risk R-04 — managed, not yet verified.
• Inspection: defined turnaround inspection zones (§4.3) + peak-strain witness/cycle-count health monitoring (§4.4) gate continued reuse.

8. The Accepted Producibility-for-Weight Penalty (DDR-07) — and why reuse makes it a bargain

This is the central trade of the document and we make it explicitly, not by omission.

"heavier planes, less performance, but it was just bam bam bam, rivet rivet rivet, crappy glue, weld over the whole thing." — [10:57–11:06]

Quantified penalty. Carrying ~52 kg of structure instead of a ~32 kg exquisite structure costs ~20 kg. On a 175 kg MTOW that is ~11 % of gross weight (vs ~13 % at the old 150 kg — the signed MTOW growth dilutes the structural-mass fraction). We recover the lost range/payload by: 1. Burning more cheap heavy fuel (JP-8/Jet-A) and flying it with the uprated ~35 hp (~32–38 hp band) commodity heavy-fuel engine (11_propulsion_power.md) — fuel is cheap, and the airframe comes home, so its cost is amortized over ≥ 50 sorties (DDR-15) rather than thrown away. 2. Accepting a modest cruise-speed/endurance trim; note the combined-adverse range worst case (~1,150 km vs the 1,500 km floor) is open risk K5 — the RTB reserve is protected regardless (§4.3).

Why this is the right call (DDR-05/06/08/15/17): the program KPPs are ≥ 1,000 units/day from existing factories and reusability, not best-in-class L/D. A heavier airframe that a Caterpillar line builds at 1,000/day and that survives ≥ 50 sorties beats a featherweight airframe that an aerospace shop builds at "a thousand a decade" [11:32] and that cracks after a few recoveries. The signed 175 kg MTOW is the program choosing producibility + reuse + full payload over mass-optimality, with the budget closing at positive margin. This is the embodiment of "Don't build the Batmobile" — and of "I'm not throwing away my airframe" [20:31].

9. Skin as Survivability Structure (interface to DDR-09 / DDR-10 / DDR-12)

The steel structure does double duty as the first survivability layer; full treatment in 13_survivability_ew_hardening.md, but the structural enablers owned here are — and all must leave the airframe flyable enough to recover (DDR-15):

9.1 Anti-laser (DDR-09)

• The steel skin already provides high thermal mass + high melt point vs a plastic/CFRP drone — precisely why a steel airframe is "100 times more survivable against a laser" almost for free [17:55–18:17].
• Structure owns the commodity ablative/reflective topcoat application surface: the galvanized steel exterior takes a sprayed intumescent/ablative paint and a high-reflectivity white/IR coating — both Home-Depot-class consumables (DDR-09). No structural change required; it is a coat line at the end of body assembly, and re-coatable at depot between reuse intervals if a sortie scorches it (DDR-15 maintainability).
• Optional roll/spin for laser dwell-spreading imposes only a balance/inertia requirement on the structure — met by symmetric L/R build; no new parts.

9.2 Anti-HPM / EMI (DDR-10)

• The welded/riveted steel skin forms a continuous conductive Faraday shell. Structure owns: (a) the avionics Faraday bay (forward fuselage, §3.2 module 2) — which houses the reusable seeker + compute that must survive to come home — built as a fully-welded steel box; (b) electrical bonding straps across every bolted module interface so the shell stays continuous despite the quick-swap modules; and (c) aperture management — RF/EO windows in the glass radome are the only deliberate gaps, gasketed/meshed per the survivability doc.
• The optical internal data bus (DDR-10) reduces the wiring that must penetrate the shell; structure provides shielded feed-throughs at the bay boundary.

9.3 Multi-threat simultaneity (DDR-12) — structural contribution to the closure

DDR-12 / REQ-12b/c require WILDFIRE to survive laser + HPM + kinetic simultaneously while holding range + payload + RTB within MTOW. With the signed 175 kg re-baseline, the structure contributes its share — steel laser/thermal mass (§9.1), Faraday shell (§9.2), divert-motor hardpoint (§7.6), and recovery load paths (§4) — inside the ~52 kg structural budget that closes the ~174.5 kg full-up config within the 175 kg MTOW with positive margin. Per the Rev B.1 directive this is stated as: DDR-12 closes at 175 kg MTOW; verification by detailed mass + performance analysis (analysis-pending) — it is not claimed verified.

Net: the same steel that makes the airframe cheap to build, and durable to reuse, also makes it survivable, at near-zero added part count — the multi-threat "impossible design constraint" Palmer wants imposed on the enemy's C-UAS designer [18:46–19:16] is met partly by the structure itself, on a platform that survives it and returns to do it again (DDR-12/15), now with the mass budget closed at 175 kg.

10. Producibility & Reuse Summary (DDR-05/06/08/15/20)

• Bill-of-process: stamp, roll-form, press-brake, robotic MIG weld, rivet, adhesive bond, bolt. All native to automotive / ag-implement plants. No autoclave, no chem-mill, no NDI-per-part, no exquisite materials.
• Tooling: single-stage press dies and standard robotic weld/rivet cells; commodity and second-sourceable (DDR-20, "Japanese automotive workers" [23:24]).
• Part count: ~116 structural part types (< 120 gate) — unchanged by the 175 kg re-baseline (growth absorbed in gauge/section, not part roster). L/R symmetry + V-tail are the count-reduction levers; recovery provisions added ~20 types.
• Line-training: the four-process, generous-tolerance build is targeted to be trainable in ≤ 1 week (DDR-06) — body-in-white welders and rivet operators transfer directly.
• Rate: structure imposes no rate-limiting step incompatible with ≥ 1,000/day distributed (DDR-08); bottleneck is final mate, addressed by the 6-module parallel build.
• Reuse (DDR-15): robust steel sections run below the endurance limit → inspect-only, ≥ 50-sortie [TBR] intent (conditional on the §7.2 spar-cap up-gauge at 175 kg); bolted quick-swap modules + single munition bay enable ≤ 30 min turnaround; recovery loads share the existing primary load paths (no bespoke recovery airframe). The ≥ 50-sortie life (R-04) and Skyhook ~5× scaling (R-03) are managed, not-yet-verified risks — this is a concept study. Each reused airframe multiplies effective fleet capacity per unit the line builds — reuse and rate compound.

11. Open Issues / [TBR]

Budget contribution

• Mass: ~52 kg (empty structure; this document owns the structural share of the ~104.5 kg empty-equipped budget against the 175 kg (385 lb) MTOW, Rev B.1)
• Wing structure (up-gauged caps, fatigue margin, 175 kg loads): 16.0 kg
• V-tail (both): 4.0 kg
• Forward fuselage + Faraday bay (reusable seeker/compute housing): 8.0 kg
• Center fuselage / wing carry-through torque box (launch + recovery reaction, ~45 kg fuel surround): 9.0 kg
• Aft fuselage + engine mount truss + firewall (uprated ~35 hp engine): 6.5 kg
• Modular nose radome + ring: 2.5 kg
• Payload bay structure (full 25 kg payload): 4.5 kg
• Hardpoints / launch / divert-motor fitting (motor mass charged to survivability, FIX F-2): 2.5 kg
• Recovery: Skyhook hook fitting + wingtip capture reinforcement: 1.8 kg
• Recovery: parachute riser bridle + airbag attach hardpoints: 1.2 kg
• Fasteners + cured adhesive: 3.5 kg
• Conservative line-item sum: ~59.5 kg; detail-design optimization target −7.5 kg → reported ~52 kg nominal [TBR] (±10 % band 47–57 kg)

• (Structure is the ~52 kg line of the ~104.5 kg empty-equipped rollup: structure 52 + propulsion dry 26 + electrical 7.2 + autonomy 3.4 + survivability 9.3 + comms 0.9 + CPI 3.2 + recovery 6.5. Full-up = empty-equipped 104.5 + fuel 45 + payload ≤25 ≈ 174.5 kg, closes within 175 kg MTOW with positive margin.)

• Power (cruise / peak): 0 W / 0 W — passive structure draws no electrical power. (Recovery-mechanism actuation, survivability spin/divert actuation, and health-monitoring sensor power are accounted in 18_... and 13_..., not here.)

• Unit cost (volume): ~$8,500 (contribution to the ≤ $150k flyaway target — flyaway now ~$130k after the engine uprate, still ≤ $150k; at rate)

• Steel coil stock (~52 kg incl. scrap/offal at ~1.5× buy-to-fly): ~$80–120
• Glass/basalt composite nose/fairings (resin + fiber): ~$170
• Stamping/press-brake/roll-form machine time (amortized, high-rate): ~$1,500
• Robotic MIG weld + resistance weld cell time: ~$1,900
• Riveting + adhesive bonding labor/consumables: ~$1,100
• Recovery-fitting fabrication (Skyhook lug/rib, chute bridle, airbag hardpoints): ~$450
• Module mate, fixturing, bolting: ~$900
• Ablative/reflective + EMI bonding coat-line (structure's share of DDR-09/10 surface prep): ~$350
• Tooling amortization per unit at ≥ 1,000/day rate: ~$2,050

• Indicative structure cost ~$8,500/unit at volume [TBR]; raw material is a near-rounding-error, consistent with DFM intent. The 175 kg re-baseline adds negligible structural cost (a little more steel coil + section); the engine uprate is charged to propulsion. Full cost model in 16_manufacturing_dfm_cost.md.

• Reuse impact:

• Enables the family-wide reuse KPP (DDR-15) at the structural level. Robust galvanized-steel sections run below the endurance limit → inspect-only, ≥ 50-sortie [TBR] fatigue-life intent (no per-sortie NDI), conditional at 175 kg on the §7.2 spar-cap up-gauge restoring the below-endurance-limit working stress. Adhesive-bonded faying surfaces cut rivet-hole fatigue concentration.
• Recovery load paths owned here (Skyhook wingtip capture fitting + spar feed-in; parachute riser + airbag belly hardpoints) sized to be reused ≥ 50 times at the heavier 175 kg recovery weight (~113 kJ capture energy), sharing the existing primary structure — no bespoke recovery airframe (DDR-17). Skyhook ~5× heritage scaling (R-03) and ≥ 50-sortie life (R-04) are managed, not-yet-verified risks.
• Turnaround ≤ 30 min (DDR-15): bolted quick-swap modules (nose/payload, wing, tail roots), a single bolted munition bay (the only routinely-expended item), and defined visual/tap-test inspection zones — no rework, no gear to re-rig.
• Cost-per-sortie: structure cost (~$8.5k) amortized over ≥ 50 sorties → ≤ ~$170/sortie structural share — the structural contribution to the program ~$3.1k/sortie target (airframe-amortized + fuel + munition), vs ~$8.5k/use if thrown away — a ~50× reduction, the economic core Palmer demands ("I'm not throwing away my airframe" [20:31]). Health-monitoring (witness gauge / cycle counter) gates continued reuse on data.

• Net mass cost of reuse: ~+3 kg (recovery fittings) plus the fatigue-margin headroom inside the spar — a cheap price against discarding the whole airframe.

• Assumptions / [TBR]:

• MTOW 175 kg (385 lb), W ≈ 1,717 N — Rev B.1 signed growth, resolves F-1/R-01; empty-equipped ~104.5 kg; structural share ~52 kg; wing area ~2.4 m² (AR ≈ 9, span ≈ 4.65 m), wing-loading ~73 kg·m⁻² [TBR from propulsion/aero — area may grow].
• Reconciled full-up strike config ≈ 174.5 kg (empty-equipped 104.5 + fuel 45 incl. ~4 kg RTB reserve + ~2 kg contingency + payload ≤25) → closes within 175 kg MTOW with positive margin [TBR by Integration].
• Steel σ_y ≈ 350 MPa (HSLA), ρ = 7850 kg/m³; glass laminate ρ ≈ 1900 kg/m³.
• Load factors +6 g limit / +9 g ultimate (FS 1.5); +12 g divert limit / +18 g ultimate (FS 1.5 — full FS, reuse correction); Skyhook capture ~12–16 g equiv (peak cable tension ~21–28 kN at 175 kg); chute ~3–4 g; airbag ~6 g — all [TBR].
• Spar cap 2.5 mm × 120 mm = 300 mm² → wing-root MS ≈ +0.12 ult at 175 kg (down from +0.32 at 150 kg; up-gauge to ~2.8–3.0 mm flagged to restore fatigue margin) [TBR].
• Divert/"dodge" motor (~4.1 kg) charged ONCE to survivability (FIX F-2); engine ~17 kg dry charged to propulsion (FIX F-4); structure 52 kg (supersedes obsolete 40 kg / 7 kg split).
• Part count ~116 (< 120 gate), unchanged by re-baseline [TBR at detailed design].
• Mass penalty vs exquisite design ~20 kg (~11 % of 175 kg MTOW), accepted per DDR-07 and recovered via cheap heavy fuel / uprated ~35 hp engine and amortized over ≥ 50 reuses.
• Fatigue/reuse life ≥ 50 sorties is inspect-only / endurance-limit intent, to be substantiated by coupon + full-scale fatigue article at the 175 kg load set (R-04, managed not-yet-verified) [TBR, 17_...].
• DDR-12 multi-threat simultaneity closes at 175 kg MTOW; verification by detailed mass + performance analysis (analysis-pending) — not claimed verified.
• Combined-adverse range K5 (~1,150 km worst case vs 1,500 km floor) is a managed risk; RTB reserve protected regardless.
• Reuse life 50 [TBR]; flyaway ~$130k (≤ $150k); cost-per-sortie ~$3.1k. Costs are volume/at-rate estimates, not quotes; no validated test data is claimed — this is a concept study.

Document owner: Propulsion & Power Systems Parent platform: WILDFIRE AGP-1 (hero, recoverable & reusable), with read-across to BACKFIRE AGP-2 (Doc 20) Baseline: Rev B.1 locked envelope (seed brief §3.1, §4 closure note) — MTOW 175 kg (385 lb) Status: Concept design / engineering study. All numbers are design targets or first-order estimates; unverified physics-dependent items carry [TBR] / [TBD]. No validated test data exists yet.

Rev B.1 closure applied (authoritative). This revision re-baselines every performance number to MTOW 175 kg (signed growth from 150 kg, which resolves finding F-1 / risk R-01, mass overrun). Propulsion uprates to ~35 hp (32–38 hp band). Two mass-accounting fixes are applied: F-2 — the terminal divert/"dodge" motor is charged once to Survivability (Doc 13), and the ~3.2 kg phantom is removed from propulsion dry; F-3 — the propulsion-dry headline is an explicit ~26 kg itemization (dodge motor excluded), matching the BOM. The heavier MTOW costs range: the full-payload strike radius now sits near/below the 1,500 km floor on nominal assumptions and below it in the combined-adverse (K5) case — this is reported honestly as a managed, not-yet-verified risk, not a closure. The RTB fuel reserve is a fixed hold-back, protected in every case.

0. Design Drivers Satisfied (traceability)

This document owns DDR-11 sizing (mass charged to Doc 13 Survivability per F-2) and is a primary contributor to DDR-13 and DDR-15. It traces every choice below to these IDs.

Rev B framing note. WILDFIRE is NOT a one-way airframe. Every range/endurance number below is computed for an out-and-back recoverable sortie with a reserved RTB fuel allowance. A one-way airframe is, in Palmer's words, "a total folly" [20:22]; that framing has been designed out. Only the munition (if carried) is expended.

1. Common-Fuel Mandate (heavy fuel: JP-8 / Jet-A)

1.1 Decision

WILDFIRE burns heavy fuel (JP-8 / Jet-A / diesel-class kerosene) in every powerplant variant. The baseline 2-stroke piston, the optional turboprop/turbojet dash engine, and the BACKFIRE turbine all run on the same NATO F-34/F-24 logistics fuel. No avgas, no gasoline, no methanol/glow fuel anywhere in the family.

1.2 Rationale (CONOPS + DDR)

• Single battlefield logistics chain. A theater already moves JP-8 for trucks, generators, and rotorcraft. A 1,000-a-day surge fleet (DDR-08) that needed a separate gasoline pipeline would break the "you can actually field it" test (DDR-17). One fuel = one bowser, one storage spec, one allied-interoperable supply (DDR-20). With reuse (DDR-15) the only recurring logistics flow per sortie is this fuel (+ optional munition) — so the fuel choice is the dominant sustainment decision.
• Safety / storability. Kerosene flash point (~38 °C for Jet-A, ~38–52 °C for JP-8) vs. gasoline (~−40 °C). Heavy fuel is dramatically safer to bulk-store, ship, and hot-refuel during a ≤ 30 min turnaround at a forward site.
• Energy density. JP-8 LHV ≈ 43 MJ/kg and ~35 MJ/L — within a few percent of gasoline by mass and higher by volume, so no range penalty for choosing it.
• Producibility (DDR-05/06). Heavy-fuel 2-stroke EFI piston cores and small turbines are both sourced from existing UAV/ag/automotive supply chains (see §6). The fuel choice does not drive a bespoke engine.

1.3 Penalty accepted (DDR-07 "accept the penalty")

Heavy-fuel 2-stroke piston engines run richer and hotter than gasoline equivalents, with ~5–10% higher BSFC and harder cold-start (glow-plug / heated-fuel assist required). We accept this penalty for logistics commonality, exactly per the brief's DFM-over-peak-performance doctrine: "heavier planes, less performance, but… rivet rivet rivet, crappy glue, weld over the whole thing" [10:57, DDR-07] applies to propulsion as much as to structure.

2. Baseline Powerplant — Heavy-Fuel 2-Stroke EFI Piston Pusher (~35 hp)

2.1 Specification

Fix F-3 — propulsion-dry headline. The propulsion subsystem charges ~26 kg dry to the mass budget, itemized in the Budget block (§10). The terminal dodge motor is explicitly excluded from this figure (charged to Survivability, Doc 13, per F-2). This headline now matches the BOM (Doc 30).

2.2 Why piston is the baseline (not the turbine)

A piston engine's brake thermal efficiency (~22% here) is 3–5× that of a micro-turbine at this scale. For DDR-13's "flies long ranges, carries a useful payload the whole way" — and for DDR-15's "come back" requirement, which demands an RTB fuel reserve — specific fuel consumption is the single most important number, and the piston wins decisively (see §3 vs §4). This matters more, not less, at 175 kg: the heavier MTOW already erodes range margin (§3.6), so the high-efficiency powerplant is the only way to keep the full-payload radius near the floor. The turbine is a mission-kit dash option, not the endurance powerplant.

2.3 Reuse life & turnaround (DDR-15 — primary KPP)

WILDFIRE's engine is a recovered, reused asset, not a consumable. The powerplant is designed and instrumented for a fielded reuse life of ≥ 50 sorties [TBR] between depot-level attention:

• Sortie-hours basis (R-04 — managed, NOT verified). A representative recoverable sortie (§3.5) runs ~6–10 engine-hours. At ≥ 250 h TBO that is ~25–40 sorties between overhaul on engine-hours alone; the ≥ 50-sortie target is met only by treating short ISR/strike sorties (≤ 5 h) as the design population and by mid-life inspection rather than full overhaul. The ≥50-sortie life vs. the engine-hour math is an open tension (risk R-04): it is a target, not a demonstrated result. Engine-hour metering drives reuse qualification (Doc 17/18).
• Wear-item design for reuse. Fixed-pitch prop (no constant-speed unit to fatigue), forced-air cooling (no coolant pump/loop), EFI (no per-flight carb tuning), and dual-redundant CDI all minimize the parts that age across reuse cycles. Spark plugs / glow assist and air/fuel filters are scheduled turnaround consumables, not per-sortie throwaways.
• Health monitoring. EGT, O₂ (lambda), cylinder-head temp, RPM, vibration, and oil/film-lube metering are logged every sortie and downloaded on recovery to support a go/no-go reuse decision and to retire the engine before, not after, a wear-out failure (interfaces with Doc 18 lifecycle).
• Turnaround (refuel + rearm) ≤ 30 min, small team (DDR-15). Hot-fuel via a single gravity/pressure port into the ~45 kg tank (≈ 56 L) is the pacing item: a 50–100 L/min field bowser fills in < 2 min; the balance of the 30 min budget is rearm (munition + dodge-motor reset, the latter owned by Doc 13), seeker/compute health pull, and walk-around. Heavy fuel is safe to hot-refuel (high flash point, §1.2).

3. First-Order Range & Endurance Validation at 175 kg MTOW (DDR-13 + DDR-15 RTB reserve)

3.1 Method & assumptions

Propeller-form Breguet equations. All values [TBR] pending CFD/wind-tunnel L/D and engine dyno BSFC. Re-baselined to the Rev B.1 locked envelope: 175 kg MTOW, 45 kg fuel including RTB reserve.

3.2 Range — theoretical "all fuel" ceiling (Breguet, propeller form)

R = (η_overall / g) · LHV · (L/D) · ln(W₀/W₁)

With W₀ = 175 kg, W₁ = 175 − 45 = 130 kg (full fuel burned, no reserve — ceiling only):

R = (0.165 / 9.81) · 43e6 · 14 · ln(175/130) ≈ 3,014 km total air distance.

This is the upper bound with no reserve and is ~764 km lower than the 150 kg-baseline ceiling (3,778 km) — the direct, expected penalty of carrying 25 kg more airframe mass on the same fuel. The fielded number must hold back the RTB reserve, so the usable out-and-back radius is computed from the mission ledger in §3.5, not from this ceiling.

3.3 Endurance — theoretical ceiling (Breguet, propeller form)

E = (η_overall / (g·V_loiter)) · LHV · (L/D) · ln(W₀/W₁)

E = (0.165 / (9.81·36.0)) · 43e6 · 16 · ln(175/130) ≈ 26.6 h pure loiter on all fuel (theoretical ceiling, no reserve).

Cross-check by fuel flow at loiter shaft power (§3.4): at ~150–160 kg average mass, P_loiter ≈ 4.4–4.7 kW → ṁ = 0.380 kg/kWh × ~4.5 kW ≈ ~1.7 kg/h → 45 kg ≈ ~26 h ceiling. The headline 12–20 h loiter is still comfortably met after reserving fuel for launch, climb, transit, recovery, and the RTB margin (Case B, §3.5). Loiter endurance is far less sensitive to the mass growth than strike radius because loiter time depends on average power, and the loiter L/D is near max.

3.4 Power required — sanity check on the ~35 hp rating

P_shaft = W·V / ((L/D)·η_prop), evaluated at MTOW = 175 kg → W = 1,716.75 N:

The ~35 hp (32–38) rating is correctly sized for 175 kg MTOW: cruise sits at ~39% power (efficient, low-wear, good for reuse life), with substantial headroom for climb, RATO-launch follow-on acceleration, dodge-event recovery, and hot/high. The uprate from ~28 hp (150 kg baseline) restores cruise power fraction and accel margin at the heavier MTOW and directly supports DDR-15 reuse-life intent.

3.5 Representative recoverable mission ledgers at 175 kg (DDR-13 + DDR-15)

All cases are out-and-back, recoverable and reserve fuel for return + recovery. Fuel ledger from 45 kg total:

Fixed overheads (every sortie): - Launch (RATO) + climb to cruise: ~2.0 kg - RTB / recovery reserve (Skyhook approach, 2 wave-offs, loiter-to-recover): ~4.0 kg held back, never planned-burned (DDR-15) - 5% navigation/contingency reserve: ~2.0 kg - → Overhead = ~8.0 kg → ~37 kg usable for the productive part of the sortie.

Case A — Long-radius strike (recoverable, full 25 kg payload to terminal): - Allocate all 37 kg usable to out-and-back transit at cruise, carrying up to 25 kg payload to the terminal point and recovering the airframe + seeker + compute. - R_total = (0.165/9.81)·43e6·14·ln(W_start/W_end) with W_start = 175 kg, W_end = 175 − 37 = 138 kg → R_total ≈ 2,409 km → ~1,204 km out-and-back recoverable radius (incl. RTB). - → This sits ~300 km BELOW the locked 1,500 km floor at full payload. It is the honest cost of the signed MTOW growth to 175 kg. The locked 1,500–2,500 km envelope is reached only by (a) trading payload down toward the ISR-only mass class, (b) recovering cruise L/D toward ~17 (LD16 → ~1,376 km; LD17 → ~1,462 km), and/or (c) using the +10% fuel band (49.5 kg → ~1,372 km). Logged for Integration as deviation; folds into open risk K5 (§3.6, §9 item 4).

Case B — ISR loiter (recoverable): - Transit out ~600 km radius at cruise (≈ 16 kg there-and-back of the 37 kg), leaving ~21 kg for on-station loiter at ~4.4–4.7 kW, ~150–160 kg avg mass. - On-station endurance ≈ 21 kg ÷ ~1.7 kg/h ≈ ~12 h on station → total sortie ~14–15 h. - → Meets the locked 12–20 h endurance at a 600 km radius, airframe + seeker recovered. (Reducing the transit radius or carrying a lighter ISR payload pushes loiter toward the upper bound.)

Case C — Medium-radius strike + loiter (typical): - ~600–800 km radius transit + ~4–6 h on-station loiter before terminal engagement, then RTB on reserve. Brackets the lower portion of the locked envelope. The heavier MTOW means the combined long-radius-plus-long-loiter corner of the locked envelope is no longer simultaneously achievable at full payload — a real trade documented for CONOPS (Doc 04) and Integration.

3.6 Range honesty note — K5 combined-adverse worst case (FLAGGED RISK, not closed)

The Case-A numbers hinge on three [TBR] assumptions — (L/D)_cruise = 14, η_prop = 0.75, BSFC = 380 g/kWh — and on the 175 kg MTOW. Two things must be stated plainly:

1. Even nominally, the full-payload strike radius (~1,204 km) is below the 1,500 km floor at 175 kg. The mass growth that closed the mass budget (F-1/R-01) opened a range gap at full payload. These are coupled: the asset closes within MTOW with positive mass margin and sits below the range floor at full payload simultaneously — both are true, and the second is not resolved here.
2. Combined-adverse (K5) worst case ≈ 1,150 km. A combined adverse swing of the three levers (e.g., L/D ~12.6 / η_p ~0.70 / BSFC ~420, or a milder simultaneous swing on the +10% fuel band) drives the recoverable Case-A radius down toward the program-authoritative K5 worst case of ~1,150 km vs. the 1,500 km floor (this doc's own three-lever 10% swing computes ~915 km on nominal 45 kg fuel and ~1,043 km on the +10% band — both below floor and both bounded by the ~1,150 km authoritative figure as the managed planning number).

Status: K5 is a MANAGED, NOT-YET-VERIFIED risk — do NOT read these as a closure. The DDR-13 range KPP at full payload is not satisfied at 175 kg on nominal assumptions and is further eroded in the adverse case. Resolution paths (any/combination): trade payload toward ISR mass for long-radius sorties; recover cruise L/D via airframe refinement (Doc 10); use the +10% fuel band; or accept a CONOPS that fields the full-payload strike role at the achievable ~1,150–1,200 km radius (Doc 04 decision). Critically — because the RTB reserve is a fixed hold-back, every adverse swing eats into mission radius, NOT the reserve; the airframe still comes home (DDR-15). Dyno BSFC and wind-tunnel L/D are the two measurements that bound this risk; until measured, the full-payload range KPP is analysis-pending, not verified.

4. Turbine Dash Option (mission kit)

4.1 Specification

4.2 Why it is only a dash option (DDR-13/15 + DDR-17)

At dash power a turbine burns several times the piston's fuel flow, so on the same 45 kg load it delivers far less radius/endurance and a thinner RTB reserve — exactly the wrong trade for a platform that must "come back so [it] can be refueled, rearmed, and reused" [20:27, DDR-15], and an even worse trade at 175 kg where range margin is already negative at full payload (§3.6). The turbine buys speed and a short terminal sprint, paid for in range and reserve. It is therefore offered as a mission kit for time-critical or contested-terminal sorties, never as the endurance baseline. Defaulting the whole fleet to turbines would be a Batmobile move (DDR-17). It shares fuel and the same generator/electrical architecture, so it is a clean module swap.

5. Propulsion Trade Summary

Electric is rejected for the primary mission on energy density alone (Li-ion ~0.25 kWh/kg vs. JP-8 ~12 kWh/kg of usable shaft energy after efficiency) — it cannot meet DDR-13 range or leave a DDR-15 RTB reserve, least of all at 175 kg. Batteries serve only as the electrical buffer (§7).

6. Producibility of Propulsion (DDR-05 / 06 / 07 / 20)

• No bespoke aero engine. Both the HF 2-stroke piston and the turbine are COTS engine cores already produced for UAVs, ag/utility equipment, and recreational/turbine markets. WILDFIRE integrates a core; it does not develop an engine. This is the propulsion expression of "build weapons that we can actually manufacture" [09:34, DDR-05].
• Automotive/ag sourcing. 2-stroke heavy-fuel cylinders, EFI throttle bodies, injectors, fuel pumps, CDI, and O₂/EGT sensors are all automotive/powersports/small-engine commodity parts — the bill-of-process Palmer demands when he asks for something "manufactured in a car factory" [10:06, DDR-06]. A John Deere / GM / Ford / Caterpillar-class line can assemble the powerplant module with ≤ 1-week line training (DDR-06).
• Fixed-pitch prop, air cooling, no gearbox. Direct-drive pusher, fixed-pitch composite prop, forced-air cooling → minimum part count, no constant-speed unit, no liquid cooling loop. Accepts a few % efficiency loss for big DFM/cost wins (DDR-07) — and fewer wear items for reuse (DDR-15).
• Allied second-source (DDR-20). HF UAV engines and micro-turbines have multiple US, EU, and allied-Asian suppliers ("a bunch of Japanese automotive workers" [23:24]) → no single-vendor lock; exportable.
• Modular powerplant pallet (reuse-enabling). Engine + EFI + generator + exhaust + mounts ship as one line-replaceable propulsion module that bolts to the aft fuselage hardpoints. This is also the reuse-maintenance unit: a time-expired or damaged powerplant is swapped at the module level during turnaround/depot, keeping the rest of the recovered airframe in service (DDR-15). Piston ↔ turbine swap is a module-level change, not an airframe redesign.

7. Terminal Lateral Solid-Divert "Dodge" Motor — Engineering Sizing (DDR-11)

Mass-accounting note (Fix F-2 / F-3 — authoritative). The terminal divert ("dodge") motor is charged ONCE, to Survivability (Doc 13), at ~4.1 kg. It is NOT included in this document's propulsion-dry mass or BOM line. The ~3.2 kg "phantom" that previously appeared in propulsion dry is removed. This section retains the engineering sizing only (DDR-11 is jointly owned by Propulsion and Survivability); the mass budget for it lives in Doc 13.

"there are things you can do like solid rocket boosters that shove you out of the way at the last second and bring you out of the probable kill radius." — Palmer Luckey, [18:39] (DDR-11)

7.1 Concept

A pair of small transverse (side-firing) solid-propellant pulse motors, fired on autonomy command in the terminal ~0.3–0.5 s before a predicted kinetic intercept, to translate the airframe laterally out of the lethal radius of an interceptor warhead / proximity fuze or a hit-to-kill body. This is a last-ditch kinetic-evasion layer, complementary to (not a replacement for) laser/HPM hardening (Doc 13, DDR-12). Cueing comes from the onboard threat-warning + autonomy stack (Doc 12); release obeys the bounded-autonomy / positive-control rules (DDR-18).

Reuse interaction (DDR-15): the dodge motor exists precisely so the airframe survives to RTB. It is a one-shot-per-tube consumable (like the munition) that is reset/reloaded during turnaround, not a thrown-away vehicle. A successful jink that saves a recoverable airframe + Thor-class compute + seeker for the cost of ~1 kg of commodity solid propellant is the most favorable reuse-economics trade on the platform.

7.2 Sizing (first order, at 175 kg MTOW)

Vehicle terminal mass m ≈ 130 kg [TBR] — a recoverable WILDFIRE near end-of-mission has burned much of its usable fuel but still carries empty-equipped structure (~104.5 kg) + residual fuel/RTB reserve (~6 kg) + retained ISR payload (munition may or may not have been released). Two opposed/canted side motors give left/right authority; only one fires per event.

7.3 Selected design point

Interpretation: Most fielded small kinetic interceptors and gun/airburst C-UAS rounds rely on a lethal radius of order a few meters and a fuze sized to the expected trajectory. A commanded ~5–7 m lateral jump inside the last fraction of a second moves WILDFIRE outside that radius and breaks the fuzing solution — "bring you out of the probable kill radius" [18:44]. It cannot defeat a perfectly-tracking, fast-reacquiring hit-to-kill with margin to spare, but it imposes the exact "almost impossible" multi-threat design burden on the enemy interceptor designer that DDR-12 describes — and it does so while preserving the recoverable airframe for the next sortie (DDR-15).

7.4 Producibility & integration (DDR-06/07/15/17)

• Small solid motors are commodity (industrial/model-rocket/flare supply chains, multiple allied sources). No exquisite propellant.
• Motors mount in sealed transverse tubes flush to the fuselage with frangible covers; nozzles canted slightly aft so residual thrust adds a small forward/positive component, not drag.
• Reloadable, low cost (<\$1k/pair target). Spent tubes are re-canistered during the ≤ 30 min turnaround (DDR-15); the frangible cover is the only structural item replaced. No gold-plating: a single, cheap, decisive jink — not a continuous reaction-control system (DDR-17).
• Mass (~4.1 kg) is charged to Doc 13 Survivability, counted once (F-2) — a real payload-fraction cost carried the whole mission and accounted for honestly against DDR-12/13. Justified because survivability is co-equal with range/payload in DDR-12 and is what allows the asset to come home (DDR-15).

8. Electrical Power Architecture & Budget (DDR-03 supporting)

8.1 Architecture

Engine-driven generator + battery buffer, a classic series-hybrid-style DC bus optimized for low part count and reuse-friendly maintenance.

 Engine crank ──► Permanent-magnet alternator/generator (~1.0–1.2 kW) ──► Rectifier/regulator
                                                                              │
                                          ┌───────────────────────────────────┤  28 V (or 24 V) main DC bus
                                          │                                    │
                          Li-ion buffer battery (~350 Wh) ◄──charge/discharge──┤
                                          │                                    │
        (start power, peak-load buffering, │   ┌──────────┬───────────┬────────┴────────┬───────────┐
         silent/glide reserve, EMP ride-   │  Compute   EO/IR &     Flight servos/    SDR/comms   Payload
         through to optical bus, Doc 13)   │ (Thor-cl.) cameras     actuators         (when on)   bus

• Generator off the engine accessory drive sized to ~1.0–1.2 kW continuous — comfortably above the ~621 W peak electrical load (below), with margin for battery recharge, the Thor-class compute draw, and hot-day derate.
• Battery buffer (~350 Wh Li-ion) handles: electric engine start, transient/peak loads (servo + dodge-event + compute-burst + comms coincidence), a brief silent/generator-out glide reserve (which also doubles as a get-home-on-battery reserve supporting DDR-15 recovery if the engine quits late), and EMP/HPM ride-through so the avionics never sees a bus dropout (interfaces with Doc 13 Faraday/optical-bus hardening, DDR-10). Buffer cells are a scheduled reuse-life item (cycle-counted, replaced at depot), not a per-sortie throwaway.
• 28 V (or 24 V) DC main bus; point-of-load converters per LRU. Two-fault-tolerant feeds to flight-critical control (FCC + servos) (DDR-18 deterministic control).

8.2 Power budget (first order) — 242 W cruise / 621 W peak

• Generator margin: ~1.0–1.2 kW gen vs. ~621 W peak → ~1.6–1.9× margin, sufficient to power loads and recharge the buffer in flight.
• Compute is non-driving (DDR-03): even at the Thor-class ~60–130 W it is ~25–21% of the bus — its power (and its cost) is a rounding error against the engine, fuel, and airframe, exactly as Palmer argues for the chip in the Barracuda [15:48]. Rev B deliberately picks best-in-class compute, not the cheapest module; the electrical architecture absorbs it with margin.
• Radios-off case (DDR-01/04): dropping the SDR saves ~10–40 W; the vehicle completes its mission on vision autonomy with comms fully powered down, so the electrical architecture never makes RF a critical-path load.

8.3 Producibility (DDR-06)

PM alternator, automotive-grade rectifier/regulator, COTS Li-ion buffer (18650/21700 or pouch), and commodity DC-DC converters. No bespoke power electronics; all from automotive/UAV supply chains. Battery and harness are designed as field-replaceable reuse-life items to keep turnaround fast and depot cost low.

9. Open Issues / [TBR]

Budget contribution

• Mass: ~26.0 kg propulsion dry + 45 kg fuel contribution to the 175 kg MTOW. Dodge motor is NOT included here — charged once to Survivability, Doc 13 (Fix F-2). Propulsion-dry headline = ~26 kg (Fix F-3), itemized:
• Engine core + EFI + exhaust + mounts (HF 2-stroke piston, ~35 hp): ~17.0 kg (Fix F-4: engine dry ~17 kg, not the old 40/7 split)
• Propeller + spinner + hub (up-sized for 175 kg): ~2.4 kg
• Fuel system (tank, lines, EFI pump, filters) dry: ~3.2 kg
• Generator/alternator (~1.0–1.2 kW) + rectifier/regulator: ~3.0 kg
• Power distribution (bus, DC-DC, harness): ~2.0 kg
• (Battery buffer ~350 Wh ≈ 2.2 kg is reported under Electrical in the integration rollup; it is shown in §8 but accounted in the electrical ~7.2 kg line of the empty-equipped ~104.5 kg, not double-counted here.)
• Subtotal propulsion dry ≈ 26.0 kg — matches the BOM (Doc 30) and the seed-brief propulsion-dry ~26 kg.
• Fuel (consumable, JP-8, incl. ~4 kg RTB reserve + ~2 kg contingency): ~45.0 kg (counted separately in the mass rollup).
• Power (cruise / peak): N/A as a net consumer — this subsystem is the electrical source. It generates ~1.0–1.2 kW continuous and supplies the vehicle bus whose total load is ~242 W cruise / ~621 W peak (§8.2). Self-consumption (EFI/pump/ignition/glow): ~20 W cruise / ~40 W peak, included in that total.
• Unit cost (volume): ~\$25,000 contribution to the ≤ \$150k flyaway (~\$130k current estimate) target. Breakdown (high-volume COTS-core estimates [TBR]):
• HF 2-stroke EFI piston core + EFI (~35 hp, uprated): ~\$12,000 (engine uprate adds a little vs. the ~28 hp estimate)
• Propeller/hub: ~\$650
• Fuel system: ~\$900
• Generator (~1.0–1.2 kW) + regulator: ~\$1,200
• Power distribution / converters / harness: ~\$900
• Integration/test/contingency (~35%): ~\$5,500
• (Dodge-motor pair cost is carried in Doc 13 Survivability per F-2, not here.)
• (Battery buffer ~\$500 carried under Electrical.)
• Fuel (per-sortie consumable, ~45 kg JP-8 @ ~\$1–2/kg): ~\$45–90/sortie (not in flyaway; logistics line item)
• (Turbine dash kit is a separate option ~\$25–60k, not in the baseline flyaway.)
• Reuse impact: Propulsion is the dominant reuse-economics subsystem. (1) The mandatory ~4 kg RTB fuel reserve is the physical guarantee the airframe + engine + seeker + compute come home (DDR-15); it is held back, never planned-burned, even under the combined-adverse K5 case — which eats mission radius, not the reserve. (2) Engine TBO ≥ 250 h / ≥ 50 sorties [TBR, risk R-04 — managed, not verified] with health-monitoring (EGT/lambda/CHT/vib) and a fixed-pitch/air-cooled/EFI low-wear architecture targets amortizing the engine over ≥ 50 sorties — collapsing cost-per-sortie toward fuel + munition, supporting the program ~\$3.1k/sortie target (airframe amortized over ≥50 sorties + fuel + munition). (3) The modular powerplant pallet is the reuse-maintenance unit (module swap, not airframe rebuild). (4) Hot-refuel of the ~56 L tank in < 2 min keeps the ≤ 30 min turnaround feasible; the buffer battery is cycle-counted at turnaround. (5) The terminal divert motor (owned by Doc 13) spends ~1.7 kg of commodity propellant to save a recoverable airframe — the best reuse trade on the platform. Per-sortie consumable cost from this subsystem ≈ fuel (~\$45–90) + scheduled wear items.
• Assumptions / [TBR]: MTOW 175 kg (Rev B.1 signed growth, resolves F-1/R-01); fuel 45 kg incl. ~4 kg RTB reserve (fixed hold-back) + ~2 kg contingency; BSFC 380 g/kWh; (L/D) 14/16; η_prop 0.75; LHV 43 MJ/kg; engine ~35 hp (32–38); propulsion dry ~26 kg (dodge motor excluded, F-3); engine dry ~17 kg (F-4); terminal mass ~130 kg; dodge impulse ~3,250 N·s @ ~8 g, mass ~4.1 kg charged to Doc 13 (F-2); generator ~1.0–1.2 kW; buffer ~350 Wh; Thor-class compute ~60–130 W; electrical 242 W cruise / 621 W peak. HONEST KPP STATUS: loiter ≥ 12 h and the RTB reserve are met on baseline assumptions; the full-payload recoverable strike radius is ~1,204 km nominal — below the 1,500 km floor at 175 kg — and the combined-adverse (K5) worst case is ~1,150 km, both OPEN/MANAGED/NOT-YET-VERIFIED (risk K5), to be retired by dyno BSFC + wind-tunnel L/D and/or a CONOPS payload/radius trade. Engine reuse-life ≥50 sorties vs. engine-hour math is risk R-04 (managed, not verified). No validated test data exists yet; all figures are design targets/estimates. This is a concept study, not a frozen design.

Document role: "The Brain." Defines the fully-onboard autonomy that replaces RF/fiber, navigates "like a pilot" with vision and no GPS/radio, executes the autonomous precision recovery that makes the airframe reusable, the best-in-class COTS compute module that hosts it, and the bounded-autonomy software/safety architecture that makes it auditable and lawful to field.

Status: Concept design / engineering study (Rev B). All numbers are design targets or first-order estimates. Unverified items carry [TBR] (to-be-resolved by analysis/test) or [TBD].

REV B FRAMING (overrides any legacy text). 1. WILDFIRE IS RECOVERABLE AND REUSABLE (DDR-15, primary KPP). The airframe + seeker + compute always come home to be refueled, rearmed, and reused; only the munition (if any) is expended. The brain therefore owns one mission phase the racing heritage never needed: autonomous precision recovery (Skyhook-cable capture / spot landing) — a pure vision-autonomy problem the heritage perception→pose→guidance loop is already the right tool for. A one-way airframe is "the total folly" [19:38]; it is designed out here. 2. NOT CONSTRAINED BY AIGP COMPETITION HARDWARE. The AIGP racing stack is flight-/sim-proven heritage that the vision-nav brain works — it is not a hardware ceiling. WILDFIRE flies the best-in-class compute (Thor-class, ~1000–2000 TOPS), sensors, and toolchain consistent with the manufacturing doctrine (DDR-05/06/07). Compute cost is still a rounding error against the airframe (DDR-03).

0. Design Drivers Satisfied (traceability)

Secondary linkage: DDR-10 (Faraday-shielded, EMP-hard compute bay → see §7 and doc 13), DDR-11 (terminal evasion "dodge" maneuver commanded by the agile policy → see §5.5, doc 13), DDR-14 (open track/data format → see doc 15), DDR-17 ("Don't build the Batmobile" — best-in-class is not gold-plating when it buys mission capability at rounding-error cost → §3, §9).

Heritage anchor. The autonomy core is not paper. It is the competitor's flight-/sim-proven AIGP racing stack (/tmp/grandprix, spec VADR-TS-001/002) — vision-only gate navigation, no GPS, no LiDAR, MAVLink — adapted from a 1.5 m racing course to a 1,500–2,500 km strike radius and back to a Skyhook cable. The mapping of each heritage module to a WILDFIRE function (including recovery) is the backbone of this document (§4). The racing stack ran on a ~100-TOPS Jetson Orin NX because that is what the competition mandated — it is the proof the algorithm fits, not the production silicon. WILDFIRE re-hosts the same graphs on a best-in-class Thor-class module (§3) with margin to spare.

1. The thesis in one paragraph

Palmer's claim is that onboard autonomy beats the radio/fiber datalink on cost, latency, and jam-resistance simultaneously, and that the compute to do it is now a rounding error in a weapon's BOM. WILDFIRE is the airframe wrapped around exactly that brain. The same perception → pose → guidance → control loop that flies a quadcopter through eleven 1.5 m gates at 30 m/s using one forward camera and an IMU — with no GPS and no depth sensor — is the loop that flies WILDFIRE down a valley, matches what it sees to an onboard map, recognizes the target, runs the terminal engagement, and then flies the airframe home and threads it onto a Skyhook cable or onto a spot landing. A Skyhook wire or a recovery mat is, to this brain, just another known-geometry visual gate — exactly the problem the heritage PnPEstimator was built to solve. We change the platform model, the sensor suite scale, the map, and the mission state machine; the architecture and most of the algorithms are inherited. Reusability is therefore not a bolt-on — it is the same vision-autonomy capability pointed at one more gate.

2. Autonomy requirements (derived)

Non-requirements (DDR-17 discipline). No SLAM-grade dense 3D reconstruction. No multi-camera stereo depth (PnP + VIO give range without it — heritage proves this). No on-board LLM "reasoning." No exquisite radiation-hard space-grade compute. No GPS receiver on the critical path (a passive, anti-spoof-monitored GPS may ride as an opportunistic, never-trusted-alone fix — see §5.4). DDR-17 note on "best-in-class": choosing a Thor-class module over the heritage Orin is not Batmobile gold-plating — it buys real headroom for recovery + scene-matching + safety partitioning at a cost that is still <1% of flyaway (§3.3). Gold-plating would be a custom ASIC, rad-hard silicon, or a sensor with no CONOPS line item — none of which we do.

3. Compute module — sizing to DDR-03 (best-in-class, rounding-error cost)

3.1 Heritage proof, then lift the ceiling

The AIGP stack was forced onto a Jetson Orin NX (~100 TOPS) by competition rules and still flew YOLOv8n at ~62 FPS (TensorRT FP16) plus a CasADi MPC and an ONNX RL policy — comfortably real-time on a quad. That is the existence proof that the vision-nav brain fits in a small edge budget. WILDFIRE is unconstrained by that rule and carries materially more load: more cameras, higher-resolution detection over cluttered long-range scenes, a continuous VIO front-end, scene/map matching against an onboard reference, the recovery-phase fine pose loop, and a partitioned safety/monitor stack. We therefore select the best-in-class module, not the cheapest that barely fits.

Selected baseline: Thor-class automotive/edge-AI module, ~1000–2000 TOPS (INT8/FP8) class (NVIDIA Jetson Thor-class or equivalent automotive ADAS/AD SoC). This matches the Rev B locked envelope (doc 00 §3.1: "best-in-class COTS edge-AI module, Thor-class, ~1000–2000 TOPS"). The heritage Orin remains the certified-by-flight reference and a fallback/second-source data point; the production graphs are TOPS-agnostic and run on either with a recompile (§3.4).

3.2 Why this is right-sized (first-order budget)

A Thor-class module gives roughly 5–20× the heritage compute. We deliberately spend that margin on capabilities the racer never needed (recovery, scene-matching at strike scale, hardened safety partitioning, sensor count) and on holding a large thermal/timing margin for reliability across ≥ 50 reuse sorties.

Headroom target ≥ 50% at cruise and ≥ 30% in the terminal/recovery phase [TBR by integration benchmark]. The module runs at a thermal/power set-point below max to preserve timing margin and component life across the reuse fleet (§8) — a reliability-for-reuse decision, not just a thermal one.

3.3 Cost — the rounding-error argument made explicit (DDR-03)

"in my \$200,000 Barracuda cruise missile, a \$300 chip is not the thing that is driving that price." [15:48] "it's already kind of a rounding error… we're like two Moore's law 18-month cycles away from it being much cheaper." [15:16–15:53]

WILDFIRE flyaway target is ≤ \$150k (doc 00 §3.1, Rev B). A Thor-class module at volume is on the order of \$1,000–2,000 [TBR — automotive AD volume pricing trend]. Even at the high end that is ~1.3% of flyaway — still a rounding error against the airframe, exactly Palmer's point, and the reusable economics make it even smaller per-sortie: amortized over ≥ 50 sorties the compute contributes ~\$20–40 per sortie to a target cost-per-sortie of ≤ ~\$3k + fuel + munition (DDR-15). We buy the module COTS at volume and refuse to gold-plate around it (no custom ASIC, no rad-hard). Per the Moore's-law point we architect the software to be TOPS-agnostic (ONNX/TensorRT graphs, no hand-tuned silicon dependence) so the same stack drops onto a cheaper/faster module next cycle with a recompile, not a redesign. This is the single most leveraged producibility decision in the brain.

3.4 Producibility & second-source (DDR-06/20)

• Module is a single COTS LRU on a board-edge/SO-DIMM-class connector → snap-in install, no skilled rework. Line training ≤ 1 week (DDR-06).
• Two qualified module families carried as second-source — e.g., a Thor-class primary and an Orin-class fallback (the heritage-proven part) — with the toolchain abstracting the runtime; satisfies allied/distributed-production portability (DDR-20) and de-risks supply.
• No BGA rework, no custom ASIC, no exotic cooling — DDR-17 compliant.
• Reuse note: the module is a recovered, reused asset, not a consumable. It must survive ≥ 50 sorties of vibration, thermal cycling, and divert-g (DDR-11), which is why we run sub-max and stress-screen the carrier board for fatigue (interface to doc 18 reuse-life qualification).

4. Heritage module → WILDFIRE function mapping

The competitor's repo (/tmp/grandprix, README + spec VADR-TS-001/002) is the proven brain. Each module below already runs in simulation; the column on the right is the adaptation for WILDFIRE — including the new recovery role each module plays.

Key heritage insight, load-bearing for DDR-04 and DDR-15: the AIGP MAVLink layer was forced to operate with no position telemetry at all (mavsdk_bridge.py header: "The simulator does NOT publish position/velocity — no GPS… The client must dead-reckon position from HIGHRES_IMU + ATTITUDE. Drift is bounded by vision-based gate corrections"). That is precisely the GPS-/RF-denied regime WILDFIRE must own both outbound and inbound — so the hardest part of the architecture, including flying home and onto a wire without GPS, is already flown in sim, not theorized. A Skyhook wire is just the last gate.

5. Pipeline architecture: Perception → State Estimation → Guidance → Control

                 ┌───────────────────────────────────────────────────────────┐
   CAMERAS ──────▶ PERCEPTION                                                  │
   3–6 global-shutter wide-FOV │  • Detector (YOLO-class, INT8)   [vision_pipeline.py]
   + 1 EO/IR gimbal            │  • Segmentation aimpoint (U-Net) [gate_segmentation.py]
                               │  • PnP 6-DoF on known-geometry   [PnPEstimator]
   IMU ×2 (voted) ─┐           │      targets/landmarks/RECOVERY WIRE → range
   baro / mag      │           └──────────┬─────────────────────┬────────────┘
   optical flow    │                      │ feature tracks       │ landmark/target/
   (opt) startrkr  │                      ▼ + pose obs            ▼ wire obs + class
                   └──▶ STATE ESTIMATION (onboard, GPS/RF-free)               │
                        • VIO EKF: IMU dead-reckon  [InertialIntegrator]      │
                        • Visual map / scene matching → absolute fix          │
                        • Terrain/landmark referencing → bounds drift         │
                        • apply_position_correction()  [mavsdk_bridge.py]     │
                                   │ fused state (pos/vel/att + covariance)   │
                                   ▼                                          │
                        GUIDANCE                                              │
                        • Mission executive (state machine)  [race_pipeline] │
                        • Route MPC → waypoint chain          [AttitudeMPC]   │
                        • Terminal homing / evasion solver                    │
                        • RECOVERY approach solver (wire/spot box)            │
                                   │ setpoints                                │
                                   ▼                                          │
                        CONTROL                                              │
                        • Inner loop: ONNX policy / fallback PID [rl_controller]
                        • MAVLink to FCU (SET_ATTITUDE_TARGET…)  [mavsdk_bridge]
                                   │                                          │
        ┌──────────────────────────┼──────────────────────────────────────────┐
        │ SAFETY KERNEL (independent, deterministic) — geofence • ROE • abort • monitors  │
        │ • health-state monitor → recovery go/no-go (DDR-15)                             │
        └──────────────────────────────────────────────────────────────────────────────┘

5.1 Mission phases (re-skin of the heritage state machine)

INIT → LAUNCH (RATO/rail) → CLIMB → INGRESS(map-following) → SEARCH → CLASSIFY/ID → TERMINAL(home or evade) → EFFECT/ABORT → EGRESS → RECOVER(Skyhook capture / spot landing) with EMERGENCY/ABORT and LOITER fallbacks reachable from every state (§6). This is the AIGP INIT→TAKEOFF→SEEK→APPROACH→TRANSIT→…→FINISHED machine with mission semantics and, critically, RECOVER promoted from a fault fallback to a nominal mission-completing phase (DDR-15) — the flight is not "done" until the airframe is back on the cable. ISR sorties run the same machine with no EFFECT; the airframe (and its non-expended EO/IR seeker) always returns.

5.2 Perception

• Sensors (locked baseline, doc 00 §3.1): 3–6 wide-FOV global-shutter cameras (forward + oblique + at least one aft/down-looking field for the recovery approach) + 1 EO/IR gimbal for terminal ID and night/obscurant. Global shutter is mandatory — rolling-shutter skew corrupts VIO and PnP at WILDFIRE speeds.
• Detector: YOLO-class network, INT8/TensorRT, model-format priority .engine > .onnx > .pt (exact heritage _resolve_model behavior). Classes: mission target types + navigation landmarks (bridges, towers, road junctions, coastline features) + recovery fiducials (Skyhook mast/wire, spot-landing marker).
• Segmentation + PnP: U-Net mask → subpixel corners → cv2.solvePnP(..., SOLVEPNP_IPPE_SQUARE) against known landmark/target/recovery geometry (heritage uses GATE_CORNERS_3D; WILDFIRE substitutes surveyed landmark dimensions, a target template, or the surveyed Skyhook-wire geometry). This is how range is obtained with no depth sensor — the literal mechanism behind "go to it" and behind threading the wire.
• Confidence gating: heritage GateDetection.is_valid (confidence > 0.3 and est_distance < 100 m) generalizes to per-class confidence + range-plausibility gates feeding the estimator, the ROE logic, and the recovery go/no-go (the capture aimpoint must clear a tighter confidence + geometry gate than a normal landmark).

5.3 State estimation (the GPS-/RF-denied core)

Three layers, fused in an EKF; each independently degradable:

1. Inertial dead-reckoning — direct from heritage InertialIntegrator: a_world = R(q)·a_body + g_ned; v += a·dt; p += v·dt + ½a·dt². High-rate (≥200 Hz), zero latency, unbounded drift alone.
2. Visual-inertial odometry (VIO) — feature tracking + IMU in a tight EKF for low-drift relative motion; bounds short-term drift between absolute fixes.
3. Absolute fixing — visual map / scene matching + terrain/landmark referencing. WILDFIRE carries an onboard reference map (satellite/recon imagery + a landmark database + a terrain/elevation model) and the surveyed geometry of the recovery site / Skyhook system. Periodic place-recognition embeddings and PnP on recognized landmarks produce absolute NED fixes injected via the heritage apply_position_correction(pos_ned, alpha) hook (with alpha set by fix confidence — a soft Kalman-style blend, not always a hard snap). Terrain referencing provides altitude and along-track aiding in feature-poor terrain.

This is "navigate not off of GPS or any other radio… the way a pilot would" [16:01] expressed as an estimator: integrate motion, look out the window, recognize where you are, correct — outbound to the target and inbound to the cable. The heritage stack already does items 1 and 3 (PnP fix → apply_position_correction); WILDFIRE adds 2 and the scene/terrain/recovery map.

Drift budget (first-order, target). Tactical-grade MEMS IMU bias → free-inertial drift ~1–3 km over a 1,500–2,500 km ingress without aiding [TBR]. With VIO + a visual/landmark fix on the order of every few minutes (terrain-dependent), target en-route position error ≤ 50–150 m CEP [TBR by analysis/HWIL], collapsing to terminal-sensor-limited accuracy (meters) once the target is in the EO/IR field of view — at which point absolute geodetic accuracy stops mattering because guidance is relative-to-target. The identical logic holds for recovery: the airframe navigates back to within visual range of the recovery site on map fixes, then collapses to the wire-relative PnP/segmentation loop — final placement is capture-fiducial-limited, not GPS-limited. Coarse dead-reckon between gates, sharp PnP at each gate — including the last one.

5.4 The role (and limits) of GPS/RF

Per DDR-01/04, nothing on the critical path may depend on RF — outbound or inbound. Optionally, a passive GNSS receiver and the SDR mesh (doc 15) may supply opportunistic fixes/updates — but they are treated as untrusted, monitored inputs: an innovation-gated, spoof-/jam-monitored aiding source the estimator can reject wholesale. If every RF input vanishes or is hostile, the mission completes and the airframe recovers unchanged on vision + inertial. That is the design's answer to "completely resistant to all jamming systems… also things like navigation" [15:54] — and it is what makes a reusable airframe survivable: a recovery you can jam is not a recovery.

5.5 Guidance

• Route guidance: mission executive emits a waypoint chain (ingress corridors, search box, terminal initial point, egress corridor, recovery initial point); AttitudeMPC (CasADi/IPOPT, re-parameterized for fixed-wing dynamics and longer horizon) tracks it with tilt/rate/airspeed constraints and input-smoothness costs (heritage Q_pos/Q_vel/Q_yaw/R/R_du structure). Replan on map-fix updates, target events, and recovery-site updates.
• Terminal guidance: proportional-navigation-style homing on the EO/IR-tracked, U-Net-segmented aimpoint; range/closure from PnP and VIO. The reactive heritage GatePursuitController (visual servo on bearing error) is the analytic backbone and the degraded fallback.
• Terminal evasion (DDR-11): on interceptor-warning cues, the ONNX agile policy commands a high-g lateral jink / coordinates the solid-divert "dodge" motor (doc 13) to generate miss-distance, then re-acquires. (Survivability exists in service of reuse — you cannot reuse what does not come home, DDR-12/15.)
• Recovery guidance (DDR-15): the RECOVER phase runs a constrained approach solver — MPC tracks a tight terminal box onto the Skyhook capture wire (or spot-landing aimpoint), holding airspeed / sink-rate / lateral-offset limits, with the ONNX inner policy rejecting gusts on the final segment. The capture aimpoint is the U-Net-segmented wire/marker, ranged by PnP (§5.2). The approach is a visual servo on a known-geometry fiducial — i.e., the heritage gate-approach problem with a tighter tolerance box. If the capture confidence/geometry gate is not met, guidance executes a wave-off (deterministic go-around) and re-attempts, or diverts to the parachute+airbag alternate (doc 18) — never a blind closure.

5.6 Control

• Inner loop: the heritage NeuralController ONNX policy (or a deterministic gain-scheduled PID fallback) running at 100–250 Hz, outputting attitude/rate + thrust to the FCU via mavsdk_bridge MAVLink SET_ATTITUDE_TARGET / rate mode. The FCU (PX4/ArduPilot-class, hardened) closes the actuator loop.
• Command authority is bounded by the safety kernel (§6): every setpoint passes through envelope/geofence/ROE checks before dispatch — including the recovery-phase sink-rate/airspeed limits.

6. Bounded-autonomy & software-safety architecture (DDR-18)

"I'm so much more worried about dumb AI in the hands of evil people than… hyper-intelligent, truly sentient, hostile AI." [33:01]

Palmer's stated fear is dumb autonomy doing harmful things, not Skynet. The engineering response is a small, independent, deterministic Safety Kernel that sits below and around the learning-based autonomy and can always override it. The smart stack proposes; the dumb-but-trustworthy kernel disposes.

6.1 Two-domain architecture

The two run in partitioned compute (separate process/core, ideally a separate safety MCU co-located in the Faraday bay) so a hang or fault in the performance domain cannot prevent the kernel from acting. This mirrors heritage discipline: the AIGP state machine already separates normal flight from explicit RECOVERY/EMERGENCY states; we harden that boundary into a privilege boundary. The Thor-class module's headroom (§3.2) makes this partitioning free — we are not fighting for cycles.

6.2 Required safety functions

1. Geofence. Hard 3-D operating volume + keep-out polygons loaded pre-mission. Breach (predicted or actual) → immediate guidance clamp, then abort if uncorrected. Enforced in the safety domain on the fused estimate, independent of mission logic.
2. ROE gates (engagement interlocks). A lethal/terminal action requires an AND of testable conditions: valid target classification ≥ threshold confidence and target geolocated inside an authorized engagement box and positive-ID criteria met and (where link exists) human authorization and no abort asserted. Any single false condition inhibits release. This makes "dumb AI" unable to act on a bad classification.
3. Human-on-the-loop lethal release. When the (opportunistic) link is up, terminal lethal release requires a positive human consent token, with a bounded decision window; fail-safe default is no-release / abort, never auto-release on silence. When the link is down by design (DDR-01 RF-silent ingress), release is permitted only inside the narrowest pre-authorized ROE envelope agreed at mission planning, logged, and still gated by all non-human interlocks above. (Policy parameter, set per CONOPS and rules-of-engagement; doc 04/17.)
4. Deterministic abort / wave-off. A single, well-defined ABORT transition reachable from every state, with bounded execution time, driving to a defined safe end-state (ISR: egress/loiter/recover; strike: safe-disposal/self-neutralize per payload doc 14). In the RECOVER phase the same primitive becomes a deterministic wave-off/go-around — if the capture gate is not met the airframe breaks off on a pre-planned path and re-attempts or diverts to the alternate recovery (parachute+airbag, doc 18). No undefined or "creative" failure behavior, and no reckless closure on the cable that could damage a reusable airframe.
5. Runtime monitors. Continuous, independent checks: estimator innovation/health, attitude/airspeed/sink-rate envelope, perception confidence and temporal consistency, IMU cross-vote, compute watchdog/heartbeat, thermal/power limits, geofence proximity, and action plausibility (does the commanded maneuver match the mission intent?). Any trip → degrade or abort/wave-off per §6.3.
6. Recovery health-state go/no-go (DDR-15). Before committing to capture, an independent health monitor evaluates whether the recovered asset is fit to recover and to re-fly: control-surface/actuator health, remaining-fuel/energy for a wave-off, structural g-history within limits, optics integrity, compute thermal/fault state. A failed health check forces the alternate recovery mode or a controlled set-down away from people — protecting both the cable hardware and the airframe's reuse life. This monitor's output is also the reuse-qualification record (A-9).
7. Immutable audit log. Tamper-evident onboard log of perception decisions, fixes, ROE evaluations, authorizations, commands, and the recovery health/turnaround record — for post-mission accountability, the instrumented shoot-off (DDR-19, doc 17), and the ≥ 50-sortie reuse-life accounting / ≤ 30-min turnaround go/no-go (doc 18). Auditability is a DDR-18 requirement, not a nicety.

6.3 Degraded-mode behavior (every failure has a name)

No path leads to undefined behavior — the core of "dumb AI in the hands of evil people" mitigation is that the dumb parts are deterministic and bounded, including the parts that bring a reusable airframe home.

6.4 Producibility & assurance (DDR-17/DDR-19)

• The Safety Kernel is deliberately small so it can be exhaustively tested and reviewed — best-in-class compute in the performance domain (it is best-effort) does not bloat the safety domain, which stays minimal.
• All ML artifacts (detector, U-Net, ONNX policy) are versioned, signed, and field-updatable without airframe changes (DDR-03 software refresh path); the safety kernel is change-controlled separately.
• Instrumented, replayable logs feed the live shoot-off evidence base and the reuse-cycle / turnaround demonstration (DDR-19, doc 17/18).

7. Compute hosting, data bus & HPM hardening (interface to doc 13)

• The compute module + safety MCU + FCU live in the Faraday-shielded avionics bay (DDR-10, doc 00 §3.1). All internal high-rate data (camera → compute) runs on optical/fiber links inside the shield to defeat HPM coupling; apertures are the only RF/optical penetrations and are filtered/limited.
• Power conditioning includes transient/EMP protection; the watchdog + immutable log support clean recovery from any induced reset (§6.3).
• This document owns the software/monitor side of HPM survivability (watchdog, deterministic recovery, log integrity); doc 13 owns the physical Faraday/optical-bus/filter design. The optical bus is also a reuse asset — no fragile copper harness to fatigue over 50 sorties of divert-g and capture loads (synergy noted in doc 13). Interface item flagged below.

8. Latency / throughput budget & timing

Control-loop budget (cruise/ingress and recovery approach), target one-way sense→act:

Why latency is the whole point (DDR-01). A radio/fiber datalink adds round-trip propagation + relay + operator-reaction latency and a jam surface. The onboard loop above closes in tens of milliseconds with no link in the path — Palmer's "cheaper, better, faster, more resilient" [14:46] is literally a latency + jam-surface argument, and the onboard architecture wins on both. Inner-loop stabilization runs at heritage-proven hundreds of Hz; perception/guidance at ≥30 Hz, ample for a Group-3 fixed-wing whose dynamics are far slower than the 30 m/s racing quad the stack already handles — and the recovery fine-pose loop runs faster in the terminal seconds because the Thor-class headroom (§3.2) lets it.

Thermal/throttling. Module runs at a power set-point below max (§3.2) to hold timing under thermal soak at ceiling/desert conditions and to preserve component life across ≥ 50 reuse sorties; the safety monitor treats sustained thermal throttle as a degrade trigger and a reuse-life data point. [TBR thermal model, doc 13/11 interface.]

9. Key trades & assumptions

Sim-to-real (DDR-19). The ONNX policy and detectors are trained/validated in the heritage 6-DOF sim (sim_drone/DroneRaceEnv) lineage, then domain-randomized and HWIL-tested. We do not present sim performance as flight-validated; all autonomy KPPs — including recovery-CEP and turnaround/reuse metrics — are demonstrated at the instrumented shoot-off and reuse-cycle demo (doc 17/18). No validated flight-test results are claimed here; figures are heritage-stack (sim) measurements and first-order estimates.

Assumptions. (a) Onboard reference map (recon imagery + landmark DB + DEM) and surveyed recovery-site/Skyhook geometry are available for the mission area pre-launch [TBD source/update cadence]. (b) Tactical-grade MEMS IMU available within SWaP/cost. (c) FCU is a hardened PX4/ArduPilot-class autopilot speaking MAVLink v2 (heritage interface). (d) Terminal and recovery accuracy is sensor/fiducial-limited once the target or wire is in FOV, decoupling it from en-route absolute-position error. (e) Recovery system hardware (Skyhook mast + cable + capture mechanism; parachute+airbag alternate) and its capture envelope are owned by doc 18; this doc owns only the autonomy that hits it.

10. Open issues / [TBR]

• [TBR] En-route position-error budget (free-inertial drift + VIO + fix cadence) → CEP vs surveyed truth over the 1,500–2,500 km radius; depends on IMU grade and terrain feature density.
• [TBR] Perception→guidance end-to-end latency on the selected Thor-class module at WILDFIRE input resolution (heritage was 640×360); confirm ≥30 Hz with ≥50% cruise headroom.
• [TBR] Detection P_d / P_fa and geolocation CEP for mission target set across lighting/obscurant; drives EO/IR vs visible balance.
• [TBR / DDR-15] Recovery-CEP (lateral/vertical placement vs the Skyhook wire) and the capture envelope the autonomy must hit — joint with doc 18 (recovery hardware) and doc 17 (capture trials). Wave-off re-attempt count N and alternate-mode trigger logic [TBD].
• [TBR / DDR-15] Recovery health-state monitor coverage and thresholds (what fitness data gates a capture vs forces a divert); its mass/power adder; tie to ≤ 30-min turnaround go/no-go and ≥ 50-sortie reuse-life accounting (doc 18).
• [TBR] Safety-kernel assurance level and partitioning HW (separate safety MCU vs partitioned Thor core) and its mass/power/cost adder.
• [TBR] Scene/map-match robustness to seasonal/lighting/terrain change; map update mechanism and storage size (recovery-site map included).
• [TBR / interface] Faraday bay + internal optical data bus physical design and HPM transient recovery timing — owned by doc 13; software watchdog/recovery owned here.
• [TBD] RF-silent vs link-up human-on-the-loop ROE policy split — owned by CONOPS (doc 04) and T&E (doc 17); autonomy implements whatever ROE is set.
• [TBR] Thor-class module thermal envelope at ceiling/desert and its life under reuse cycling; throttle behavior — interface to doc 11 (power) / doc 13 (thermal) / doc 18 (reuse life).
• [TBR] Thor-class volume unit pricing trend (used \$1,000–2,000 estimate); confirm against automotive AD silicon roadmap (DDR-03 Moore's-law).

Budget contribution

Mass (kg) — ~3.4 kg total (contribution to WILDFIRE 175 kg MTOW; airframe Faraday-bay structure is doc 13/10):

Note: ~3.4 kg is ~1.9% of the 175 kg MTOW, well within envelope. Slightly heavier than the legacy estimate because of the Thor-class module + the extra camera field for recovery; cameras/EO-IR interface split with doc 14 (payload) and doc 13 (survivability) to avoid double-counting. [TBR by mass rollup, doc 03.]

Power (cruise / peak): ~95 W / ~190 W

Peak coincides with the terminal/recovery phase (full detector + segmentation + gimbal tracking + evasion or wire-capture loop). Higher than the legacy ~70/140 W because the Thor-class module draws more — still a small slice of the generator/electrical budget (doc 11). [TBR by integration; interface to doc 11 electrical budget.]

Unit cost (volume): ~\$2,600 (contribution to ≤ \$150k flyaway; compute is the rounding error per DDR-03):

Compute module alone = ~1.0–1.3% of the \$150k flyaway; full autonomy electronics ≈ 1.7%. Best-in-class compute is therefore still a rounding error against the airframe (DDR-03), and architected TOPS-agnostic so next-cycle modules cut this further. EO/IR gimbal hardware costed in doc 14.

Reuse impact (DDR-15): - The autonomy stack is the enabler of reusability, not a consumable: it owns the autonomous precision recovery flight phase (Skyhook capture / spot landing, §5.5) and the recovery health-state go/no-go + reuse-qualification logging (§6.2-6, A-8/A-9) that make "the airframe + seeker + compute come back" (DDR-15 [20:29]) actually happen with no RF/GPS. - Cost-per-sortie: the ~\$2,600 of autonomy electronics is a recovered, reused asset. Amortized over the ≥ 50-sortie reuse-life target, the autonomy/compute contribution to cost-per-sortie is ~\$52/sortie (compute module alone ~\$30/sortie) — negligible against the ≤ ~\$3k/sortie airframe-amortized + fuel + munition target. - Turnaround (≤ 30 min): the immutable health/turnaround log (§6.2-7) feeds an automated go/no-go that supports the fast turnaround; no autonomy task should gate the 30-min turnaround beyond a software self-test + log readout [TBR with doc 18]. - Reuse life (≥ 50 sorties): module runs sub-max for thermal/fatigue life; optical bus (no fragile copper) and snap-in LRU survive divert-g and capture loads; carrier-board fatigue stress-screen flagged to doc 18. The recovery wave-off / health-no-go logic specifically protects the airframe from a damaging capture — preserving reuse life is a safety-kernel function.

Assumptions / [TBR]: Thor-class COTS module pricing at volume per DDR-03 (\$1,000–2,000, used \$1,500) [TBR vs automotive AD roadmap]; dual-source qualified with heritage Orin as fallback (DDR-20). Mass/power/cost interfaces with doc 11 (electrical), doc 13 (Faraday bay/thermal), doc 14 (EO/IR gimbal), and doc 18 (recovery hardware + reuse-life) flagged to avoid double-counting. Recovery-CEP, capture envelope, health-monitor thresholds, and the 50-sortie/30-min reuse metrics are design targets, validated at the instrumented shoot-off + reuse-cycle demo (DDR-19, doc 17/18) — no validated flight-test results are claimed. Items marked [TBR] in §10 gate final budget closure.

Document owner: Sensors / Mission-Systems subsystem Parent baseline: 00_seed_design_brief.md §3.1 (WILDFIRE AGP-1 LOCKED Rev B.1 envelope); 12_autonomy_compute_software.md (autonomy/nav core); 14_payload_effects.md (CPI + 25 kg bay); 02_design_driver_register.md (DDR/REQ traceability). Status: Concept design. All SWaP-C numbers are design targets/vendor-published figures; quote-dependent and physics-dependent items carry [TBR] / [TBD]. No validated WILDFIRE flight-test results are claimed. Date / currency: Selections current as of June 2026 (2025–2026 products and programs).

What this document is. It replaces the AIGP drone-racing camera set — a competition-legal stack of a forward racing camera, a Jetson Orin NX, a dual MEMS IMU, baro, and optical flow chosen to fly through 1.5 m gates under contest rules — with a real, current sensor package — US Air Force-first (Collaborative Combat Aircraft–adjacent) and joint-capable: a fielded EO/IR + laser-designator gimbal, a layered GPS-denied PNT stack, a low-SWaP threat-warning head, and optional SAR/GMTI and SIGINT/EW mission modules that ride the 25 kg payload bay. The organizing rule is DDR-17 — "Don't build the Batmobile": latest-and-greatest at cost, US-origin or close-allied, COTS/fielded or near-fielded, MOSA-compliant, and exportable where possible.

Service posture (Rev B.1): WILDFIRE is Air Force-first (CCA-adjacent) and joint. Several recommended sensors are validated on US Army programs (e.g., FTUAS) — those Army-fielding references appear below strictly as maturity / fielding evidence, not service lock-in. The same MOSA-compliant package serves USAF, Army, USMC, SOCOM, and allied operators.

0. DDR traceability (what this document satisfies)