Finish airborne extraction after 30 seconds and hold rescue aircraft; record Workshop 0.0.134

docs/extraction.md

@@ -25,21 +25,25 @@ In the protected native Everon test, the two Hueys became boardable about 70 and
 
 The FIA Mi-8 also became boardable in about 80 wall-clock seconds (79.19 simulation seconds) in the revised-profile test. Both aircraft types retained native ground contact and the original stationary/upright checks before wounded loading.
 
-The transports land near the mark, verify physical ground support and wait for every living roster participant. Players may board either assigned transport. Unconscious and reserved disconnected bodies also need boarding; casualty loading selects a nearby registered transport with a suitable bench and keeps the loading transaction bound to that aircraft. Mi-8 and Huey cargo benches are supported; pilot and gunner seats are excluded. Eight uninterrupted seconds with all survivors aboard and all transports landed starts departure. A passenger leaving during that interval resets it. When every living prisoner is aboard an outbound rescue, unconsciousness alone does not start the no-rescuer defeat timer; actual deaths and transport loss still apply. Passengers do not release the autopilot; taking a crew seat or changing the aircraft faction does. The flight ends after all assigned transports cross the existing escape boundary and are at least one kilometre away from the pickup. Only living registered participants aboard those transports receive the escape result. No player pilot is required.
+The transports land near the mark, verify physical ground support and wait for every living roster participant. Players may board either assigned transport. Unconscious and reserved disconnected bodies also need boarding; casualty loading selects a nearby registered transport with a suitable bench and keeps the loading transaction bound to that aircraft. Mi-8 and Huey cargo benches are supported; pilot and gunner seats are excluded. Eight uninterrupted seconds with all survivors aboard and all transports landed starts departure. A passenger leaving during that interval resets it. When every living prisoner is aboard an outbound rescue, unconsciousness alone does not start the no-rescuer defeat timer; actual deaths and transport loss still apply. Passengers do not release the autopilot; taking a crew seat or changing the aircraft faction does. The flight ends after every assigned transport has remained airborne for 30 continuous seconds after pickup. Each must have no ground contact and at least three metres of terrain/water clearance; touching down resets the shared timer. Prison distance and pickup distance no longer determine victory. Only living registered participants aboard those transports receive the escape result. No player pilot is required.
 
 After boarding, the helicopters retain the flight controller's ten-second takeoff hold before climbing. The rescue controller keeps them awake throughout that hold, as the base flight controller does, so a parked transport cannot return to physics sleep before the climb begins.
 
+On victory, the registered transports and surviving escorts hold their current position with physics motion and damage disabled before flight-controller cleanup. Engines are not deliberately shut off. The same occupied airframes remain until reload, preventing a crash behind the statistics screen. The hold flag replicates to clients; ordinary losses and aborted flights retain normal cleanup.
+
 Results belong to backend account identities. `ConnectedWinners` maps those identities to their current authenticated connection records and rejects recycled IDs. It is an adapter for the native game-end API, whose transient ID array is not a durable result store. Successor UI delivery uses a replicated controller result derived from the server identity snapshot and tagged with the current mission replication ID. Audit/binding resets and republishes it; the end screen ignores stale native winner IDs and refreshes after delayed result updates. The actual local-controller/native-widget fixture passes; real reconnect/replication acceptance remains separate.
 
 ## Validation
 
+The [2026-10-31 native checks](evidence/extraction-finish-2026-10-31/native-checks.log) compile the updated scripts, verify airborne classification and the exact 30-second rule, then enter actual native POSTGAME with a cargo passenger aboard a descending Huey. After twelve seconds, displacement and speed were both zero; the aircraft and retained passenger were alive. The isolated fixture seeds the resolved extraction phase, so it does not assert a complete rescue flight or remote multiplayer replication. Its [runner record](evidence/extraction-finish-2026-10-31/runner.json) confirms unchanged source inputs and cleanup. The strict runner exits 1 for 13 existing localization/world errors, with no script errors; all feature assertions completed.
+
 `ERR_NativeRescueProbe` is an opt-in WORKBENCH-only fixture (`-errRescueProbe 1`). It uses the real mission, original player, radio countdown, native smoke grenade trigger, transport physics, native crew and passenger compartments. It checks old on-site, off-target and unlit smoke rejection, dispatch, physical landing, boarding and evacuation. The fixture disables player/rescue damage to isolate the route from random mission combat. Collision, ground support and compartment checks remain active. Fixture teleportation only moves the test player between objectives; it does not teleport the aircraft. This does not establish multiplayer replication, combat effectiveness, audible TTS or manual grenade throwing on every terrain.
 
 Use `-errRescueSignalOnly 1` alongside the probe flag for just the countdown/smoke/dispatch checks.
 
-`tests/test_rescue_capacity.py` executes the production seat collector against duplicate parent/child compartments and unavailable seats. `tests/test_rescue_boarding.py` executes the production boarding timer against missing passengers, disembark/reboard and clock rollback.
+`tests/test_rescue_capacity.py` executes the production seat collector against duplicate parent/child compartments and unavailable seats. `tests/test_rescue_boarding.py` executes the production boarding timer against missing passengers, disembark/reboard and clock rollback, plus the 30-second airborne boundary and landing reset.
 
-`tests/test_rescue_factions.py` checks faction-specific aircraft and crew selection. `tests/test_rescue_landing.py` checks preparation-time fleet space and dispatch recovery from a blocked secondary pad. `tests/test_rescue_recovery.py` covers passengers split between transports, fleet loss and the requirement that both transports cross the escape boundaries. `tests/test_casualty_fleet.py` covers transport selection, existing casualty reservations and exact aircraft identity during loading.
+`tests/test_rescue_factions.py` checks faction-specific aircraft and crew selection. `tests/test_rescue_landing.py` checks preparation-time fleet space and dispatch recovery from a blocked secondary pad. `tests/test_rescue_recovery.py` covers passengers split between transports, fleet loss and the requirement that both transports remain airborne for 30 continuous seconds, including an empty second transport and loss during evacuation. `tests/test_casualty_fleet.py` covers transport selection, existing casualty reservations and exact aircraft identity during loading.
 
 `tests/test_rescue_descent.py` executes the actual landing-velocity methods and verifies the faster pickup profile, continuous braking, unchanged near-ground commands, alignment gate and original behavior for escorts and outbound aircraft. It also checks settling across several simulation rates; its policy-only timings are not native flight measurements.