The AI control is architected such that failover isn't really necessary; the local control is always in control, it just gets suggestions (which it can safely ignore) from the AI. If the AI disappears or starts sending bad suggestions, the AI gets kicked out.

We're trying to continually improve the AI so that its time in control is maximized, much like Waymo's early days with self-driving car software + safety drivers.