| State | Entry condition | Allowed transition | Safety invariant | Fault response |
|---|---|---|---|---|
| Docked capture | Charging isolated from wet/occupied transport interfaces | Occupied → validate mission | Propellers disarmed; trap containment mechanical | Stay docked and indicate local attention |
| Validate mission | Human-supervised enable, reviewed route/site, energy and weather valid | All checks true → deploy | No route or release permission assumed | Abort while trap remains accessible |
| Deploy and couple | Clear-zone sensing and guarded carriage | Both retention paths verified → arm | No rotor spin before clearance/retention confirmed | Stop carriage, disarm, request human recovery |
| Outbound | Reviewed flight clearance and independent containment supervisor active | At destination → land | Trap stays closed; energy reserve monitored | Use prevalidated safe landing/return contingency |
| Ground release | Stationary contact, motors stopped, approved destination | Confirmed empty → close/return | Release cannot actuate aloft or while motors run | Keep contained; no blind retry; supervised recovery |
| Return and dock | Capsule closed and aircraft energy sufficient | Verified dock → charge | One failed dock attempt then safe landing | Disarm and request recovery; never loop near wall |
Sample — fictitious company. All numbers and people are invented scenario assumptions. This is draft concept paperwork; no physical testing, customer evidence, certification, filing or sign-off has occurred.