SENTINEL : Flight Deck

What you are watching, and the honest result. The red dot is the pilot flying's sidestick. It goes aft and stays there — for most of four minutes — while the altitude tape unwinds from 38,000 feet. The grey ghost dot is the other pilot's stick: the two never move together, because Airbus sidesticks are not mechanically coupled and give no feedback of the other pilot's input. That is the fact that was missing from the cockpit, and it is legible here in one glance.

The mind, however, mostly missed it — and that is the finding. At a disclosed call budget of 6 (a flight-deck watch gets a handful of calls, so the dial admits the top 6 margins → t +0.61), it speaks 5 times — useful things, mostly about angle of attack and unreliable airspeed — but only 0 of those 7 calls is one of the operator-critical moments, and it misses 7 of them, including the held nose-up input. Running the same 46 percepts, the held-input calls score -1.38, -1.05, -0.76, -0.63 while the highest-scoring hold in the whole run is +1.55 — an angle-of-attack reading. It ranks a dramatic number above a held control input. This is the same failure this estate measured before (novelty is not relevance), now on real telemetry. Adding the floor's deterministic absence-fact — no one has spoken about the sidestick since the input began — lifts the held-input calls by +0.41 nats on average, which is a real effect and still not enough. The instrument works; the judgment needs an aviation-domain tune, and that is now a measured claim rather than a hope.

Where this could go next — the live simulator. Everything above replays a reconstruction: a table of numbers rebuilt from the public report. The obvious next step is to stop reconstructing and plug the same watch into a running aircraft. That is unusually practical here, because a genuinely open-source airliner exists: FlyByWire's A32NX, a community-built Airbus A320neo for Microsoft Flight Simulator, published under an open licence on GitHub, together with its companion bridge SimBridge. The simulator already exposes flight data through SimConnect, and because the aircraft's own systems code is open, the lanes this page uses — stick position, flight law, air data and its validity, angle of attack, energy, warnings — are readable rather than guessed at.

That would change the exercise in three ways. The telemetry becomes live instead of interpolated, at whatever rate the sim runs, so the four-hertz stream here becomes a real one. The scenario becomes repeatable and variable — ice the pitots at a different weight, altitude or moment, fly it well or badly, and see whether the watch still says the right thing, which is the only way to move past a single authored case. And the failure measured on this page becomes trainable: a live sim generates the domain-shaped data an aviation tune needs, with mechanically-labelled ground truth, which is exactly what the untuned model was missing when it ranked a dramatic angle-of-attack reading above a control input held for four minutes.

Beyond this one accident, the same rig would open a much broader range of experiments — unreliable airspeed, engine failures, energy mismanagement, mode confusion — none of which need a real aircraft, a certification programme, or anyone's proprietary data. This is stated as an exploration, not a plan: nothing here has been built, and the honest result on this page is still a negative.

The same intervention, pointed at a real defect. Boeing's 737 MAX carried a system called MCAS that, in the two accidents that grounded the fleet, trimmed the nose down off a single angle-of-attack sensor — repeatedly, and against the crews trying to pull out of it. That is the mirror image of AF447: not a missing input this time, but a false automatic one that fought the humans and would not let go. A resident watch does not fly the aeroplane and would change nothing about how it flies — but a nose-down command that no corroborating sensor supports is exactly the class of forming action it is built to cut. And here is the part that matters: cutting a spurious override is not the machine seizing control — it is the machine handing control back to the pilot. The same reflex that says wait before a bad word reaches the air says stop before a lying actuator does, and in both cases the human is left holding the authority. Stated as doctrine, not as a counterfactual: this is the abort-never-author principle generalized, and no claim is made that it would have altered any specific flight.

The boldest version of this watch does not just speak — it arbitrates. Both stick positions are already in the lane, and Airbus sidesticks are not linked, so neither pilot can feel the other fighting him — but the tape sees both at 4 Hz. So the resident could do automatically what the red priority-takeover button on every Airbus stick already does by hand: when two pilots command opposite things in a stall, deactivate the wrong input and give the aeroplane to the other human. It is subtractive — it commands nothing, it only removes one input — and it acts on the one fact neither pilot has: that they are fighting each other. Same abort primitive, one layer down: kill a control lane before it becomes airframe motion. But the danger is exact, and this page is its own warning — a system that overrides pilots on air data can override them on bad air data (MCAS's shape), and the model here ranked an angle-of-attack reading above a control input held for four minutes. So the rule is strict: the deterministic floor decides; the mind only explains. It may suppress a nose-up input in a stall and never a nose-down one, so its worst case leaves the wing less stalled; it acts only on sensors independent of the failure — pitch, angle of attack, vertical speed, not the dead pitots; it is time-limited, framed as priority handed to the other seat, and a physical override always wins. The one falsifier: never suppress the pilot who is right, proven as an ROC curve of saves against harmful interventions, not an anecdote. This is exploration, not a plan — but it turns the announcer into an authority arbiter, a new tier between fly-by-wire and autopilot, defensible only while the mind stays out of the decision and on the explanation.

One honest note on scale. Everything measured on this page ran on a 9-billion-parameter model that was never fine-tuned for aviation — a small, general reader on one consumer card, chosen to prove the mechanism, not to fly anything. A real airliner would not use that. It would run a far larger model, tuned on real flight data with mechanically-labelled ground truth — and here the usual constraint simply is not there. Self-driving in a car fights a brutal weight, power, and cost budget for every watt and every chip; an airliner does not. Against a 250-tonne jet burning thousands of kilograms of fuel an hour, a rack of H200- or B300-class accelerators is trivial weight, trivial power, trivial cost — the onboard compute that would be extravagant in a Tesla is a rounding error in an A330. And the frontier is already small enough to carry: Qwen3.8-27B, a dense 27-billion-parameter model released days ago and reported — on third-party benchmarks and in hands-on use alike — at rough parity with Opus 4.6, the frontier standard earlier this year, runs on a single prosumer GPU. So the hardware is never the question here; the only question is whether the method can be made to work — and if it can, the aeroplane can carry whatever mind it needs.

Guardrails. This is a reconstruction from the public BEA final report and published FDR chronology — values between documented anchors are interpolated; it is not the recorder file. The SENTINEL is advisory only: the reasoning successor to the stall-warning / EGPWS / TCAS announcer, never a flight-control authority. It is not certified (real avionics is DO-178C). And it makes no claim that it would have saved AF447 — as the run above shows plainly, an untuned model of this size would not have. 228 people died on this flight; the framing is only what the record shows was knowable, and what a resident watch would still have to learn to say.