Summary
Extend the shared-clock cargo world from six to eleven cases. A receiver GNSS dropout at rail start expires its navigation and brakes the station. A source kill after captured station custody inhibits that vehicle while its peer finishes; a receiver kill after actual intake retains added mass without a custody claim.
captured stage -> later physical fault -> native sensor/mission/authority responseActual body-force fixtures also exercise receiving-pad interlocks and loaded fence-breach supervision. The loaded case uses the existing fixture-IMU position prediction with an explicitly declared 8 N force ramp over two seconds. It retains healthy native navigation at the detected breach, then neutral outputs and attached cargo. Detection/inhibition does not guarantee physical containment against momentum or ongoing force.
The native Buddy command keeps whole-world exit 2 when only the receiver succeeds. The copied qualifier now checks each new ownership, timing and custody outcome. Includes #103; refs #25 without closing its wider fault/recovery and qualification scope.
Evidence
Five actual runtime cases were added through RED/GREEN at the public fleet seam. An abrupt-force experiment produced an estimator rejection; it is retained separately and is not claimed as fence evidence. Copied qualification caught and corrected a namespace mismatch: runtime mission-fence-breach is distinct from supervisor reason fence-breach, and both are asserted.
The targeted regression passed 206 tests, zero failed and 21,775 assertions across 17 files; the added namespace assertion passed separately. All eleven copied standalone fleet cases and 31 older copied cargo cases passed. Original six fleet reports and all 31 older reports remain byte-identical to the qualified Mac baseline. Both independent reviews are clean. Native lint/app/runtime types, CLI/docs builds, roadmap and parity checks passed; generated docs have 7,774 local links without missing targets. Full exact-commit CI is pending; local full-suite execution remains withheld below its 4 GB free-space floor.
Merge Danger
Door: two-way. Adds finite modeled cases and qualifier expectations. No physical endpoint, changed sensor health gate or plant-position policy shortcut.
Blast Radius: cargo simulation. Wider source/receiver phase faults, manual recovery, durable world state, electrical/measured endurance and physical/operational qualification remain open.