Pull request #80 · stacks/drone

Summary

Add opt-in vtol-mode.onFailure recovery through the existing bounded mission graph:

transition failure or operator abort/pause/recover
  cancel the exact owned request
  qualify a fresh hover
  land, or await explicit resume before landing

Recovery binds the prior event/task/reference and replacement epoch, including initial-hover cancellation and legitimate pre-dispatch null events. Landing holds approach height until aligned. Abort reports vtol-abort-landed only after modeled contact. Existing plans without a policy retain their behavior; source freshness, independent authority/output expiry, reserve and global endurance remain controlling. README and guides document the recipe and remaining limits.

The execution-browser qualification now exercises real native workspace renewal after source admission. It requires private-pane clearing, fresh authorized restoration of the original source and unsent note, and a bounded rendered history that never selects another source. Bounded diagnostics and selection history join the existing CI artifact upload. All original jobs, commands and deadlines remain unchanged.

Evidence

Actual cancellation regressions went red before the fix; all 39 new recovery cases passed, covering modeled pusher failure, expired transitions, operator actions, invalid graphs, source/manual/host loss, late feedback and replay.
Runtime-local combined result on unchanged runtime bytes: 244 pass, 1 retained timeout, 13,149 assertions across 17 files. Existing land/rcOverride exceeded the unchanged 5,000 ms limit at 5,112.03 ms. One exact-case diagnostic passed; its cause remains unknown and no full macOS pass is claimed.
The original browser assertion also fails under a controlled genuine native renewal. The corrected public browser check passes with exact history original, absent, original; final focused checks pass 27 tests / 185 assertions, native Buddy/Pickier and app/runtime types. The runtime/docs milestone separately passed the 90-page docs build.
Independent Spec and Standards reviews are clean for both the runtime and testing changes. Exact-head full Linux CI for 04e25d0 passed all five jobs and required steps: 1,682 passes, 41 skips, zero failures and 499,136 assertions, 1,723 tests across 208 files. Original archive inspection verified both standalone VTOL reports and the browser renewal artifact. Published to main by normal fast-forward as Chris without coauthors. Automatic main CI is a separate pending run.
Original CI529 retains its browser failure and original single-download log archive. Diagnostics confirm the cleared/reconnecting DOM with native admission confirmed, matching the controlled reproduction state; the precise transport event remains unproven. Issue #68 remains open; no workflow rerun, assertion weakening or deadline increase was used.

Merge Danger

Door: Two-way. No schema or physical endpoint changes.

Blast Radius: Simulation. Recovery is optional. The original 180 s graph cap and insufficient 25 s landing failure remain; an explicit counted 35 s case completes. Planning energy is a declared ceiling, not an identified electrical law. Full recovery envelopes, hybrid energy, native full-transition CLI/common workspace and physical qualification remain open in #12.