The Drone update coordinator needs to observe verified metadata before it advances cache state. Add an awaited, copy-owning metadata observer, a copied finite reference time for recovery replay, and public operational errors that preserve exact causes. Persistence failures abort cache-preferred refresh instead of triggering a metadata fallback.
This maintained source fork preserves the upstream verification algorithm and MIT attribution. The typed remote verification error now names the attempted role and retains the original validation error as its cause. Default cryptographic rules and equal-version timestamp handling remain intact. An observer does not provide transactional cache writes or roll back an updater after failure; failed instances must be discarded.
Validation:
- Native frozen dependency installation, source build, client type checking and focused source/test lint pass after integrating current main.
- Native Jest: all 28 signed-repository observer cases and 13 existing updater cases pass. The unmodified source fails the observer-order test. The original updater assertion now verifies the documented role and retained TypeError cause.
- Independent Spec and Standards reviews are clean on the eight final source hashes.
- Full local suite: 348 tests passed across 29 suites in four projects. Source CI passed all 16 jobs, covering 15 runtime/platform combinations. Conformance and smoke checks passed. One unchanged repo-mock job failed on macOS floating Node24 initially and passed its single bounded rerun without source changes; that first failure is retained.
- Package release and downstream adoption remain pending. This PR does not remove Drone's legacy patch.
Tracked by stacksjs/drone#108.