# Simulation safety contract

This repository arms PX4 SITL. It must not be treated as a real-aircraft tuning
or safety reference.

Before any armed simulation, the same cold-start run verifies: no previous run
or MAVLink port is active; geometry/controller tests pass; camera, IMU, pressure,
magnetometer, PX4 and MAVROS are healthy; GPS, external vision, optical flow and
range fusion are disabled; image and attitude timestamps can be paired; and the
controller has no truth/global-position subscription.

Armed runs use an 8° horizontal tilt limit, bounded thrust, at least 30 Hz
attitude setpoints, a height envelope, a wall-clock watchdog, and a controlled
descent path. Loss of heartbeat, attitude freshness, OFFBOARD state, height
safety, or setpoint timing requests descent/abort. Process exit is never used as
a substitute for landing.

Required end state: vehicle on the ground, `armed=false`, no active run marker,
no project Gazebo/ROS/PX4 process, and no project MAVLink port remaining.

The included sequence takes off beside the cart and lands on the ground. Landing
on the moving cart is intentionally out of scope: the single tag can overfill or
leave the downward camera's valid range near the roof, and the x500 landing gear
can collide with the cart. Treat precision cart landing as a separate feature
requiring new perception, collision, and near-ground validation.