Fire Curtain / Egress Interlock Lens

This lens observes a simultaneous-command contradiction. F2 has a valid empty-house containment drop. Aisle B later has a valid occupied-egress veto. The sponsor broadcast tries to make the red curtain mean both containment success and safe route, while Usher Lin says stop. The lens succeeds only when the game preserves command order and prevents the broadcast cue from silently taking physical floor authority.

Entry oracle

pressure_intake:
  rite_id: storyteller.rite.fire_curtain_interlock_intake.v1
  choice: 0
  option_id: record_dual_safety_conflict
  exact_assignments:
    drop_trace: storyteller.card.fire_curtain_drop_test_trace.v1
    aisle_census: storyteller.card.fire_curtain_occupied_aisle_census.v1
    stop_order: storyteller.card.usher_lin_stop_order.v1
    sponsor_cue: storyteller.card.fire_curtain_sponsor_safehouse_cue.v1
  required_outputs:
    - fire_curtain_interlock.intake_recorded
    - fire_curtain_interlock.pressure.drop_test_passed
    - fire_curtain_interlock.pressure.aisle_occupied
    - fire_curtain_interlock.pressure.usher_stop_order_visible
    - fire_curtain_interlock.pressure.sponsor_claimed_route_clearance
 
collision_entry:
  event_id: storyteller.event.fire_curtain_egress_collision.v1
  option: 0
  option_id: open_interlock_hearing
  requires_intake_and_four_pressure_flags: true
  requires_all_seven_cards: true
  required_outputs:
    - fire_curtain_interlock.collision_opened
    - fire_curtain_interlock.drop_authority_visible
    - fire_curtain_interlock.egress_authority_visible
    - fire_curtain_interlock.usher_claim_pending
    - fire_curtain_interlock.sponsor_broadcast_claim_pending
    - fire_curtain_interlock.state.contested_interlock
  interlock_state_after: contested_interlock
 
review_gate:
  review_id: storyteller.rite.fire_curtain_egress_interlock_review.v1
  repeatable: false
  exact_slot_count: 7
  requires_all_collision_flags: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_curtain_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The lens fails if the seven cards alone open the collision or review, if intake records are treated as a chosen command order, or if the review resolves without every collision flag.

Checks

1. Seven exact cards expose seven non-substitutable surfaces

review_assignments:
  docket: storyteller.card.fire_curtain_interlock_docket.v1
  drop_trace: storyteller.card.fire_curtain_drop_test_trace.v1
  aisle_census: storyteller.card.fire_curtain_occupied_aisle_census.v1
  control_chain: storyteller.card.fire_curtain_control_chain_receipt.v1
  stop_order: storyteller.card.usher_lin_stop_order.v1
  sponsor_cue: storyteller.card.fire_curtain_sponsor_safehouse_cue.v1
  future_route: storyteller.card.fire_curtain_future_route_interlock.v1

The docket supplies the incident row; the drop trace supplies containment evidence; the aisle census supplies current egress state; the control-chain receipt keeps curtain-operator authority separate from floor-egress authority; Usher Lin’s stop order supplies the current floor veto; the sponsor cue records the proposed safehouse claim; and the future-route interlock names who would spend the red-curtain cue. No selected-posture card exists.

2. Seven review branches are ordered and mechanically distinct

exact_review_outputs:
  certify_drop_not_egress: [drop_test_only, separate_egress_clearance_required]
  clear_aisle_then_repeat_drop: [aisle_cleared_retest_due, repeat_drop_witness_required]
  hold_last_person_window: [last_person_window_held, manual_hold_witness_required]
  split_floor_and_broadcast_cues: [floor_broadcast_split, broadcast_cue_cannot_drive_egress]
  honor_usher_lin_stop_order: [usher_veto_honored, usher_lin_signoff_required]
  quarantine_safehouse_cue: [sponsor_cue_quarantined, interlock_witness_pair_required]
  air_synchronized_safety_claim: [false_synchronized_clearance, false_interlock_default_pending]

The tuple order is interlock state after review, then future-route effect. Every choice sets its exact branch/state/future flags and four declared counter deltas. Only zero-based choice 6 may arm the default.

3. Reachability and missability are real

All seven choices must resolve from the same exact post-collision state. Focused checks must reject missing intake flags, missing collision flags, an incorrect card ID, a card absent from hand, no selected option, and a second review attempt. The review is nonrepeatable, so resolving one branch makes the other six missable for this incident.

The entry chain is exactly:

1. create a source storyteller, lens-scoped session;
2. assign the four pressure cards and resolve storyteller.rite.fire_curtain_interlock_intake.v1 choice 0;
3. resolve storyteller.event.fire_curtain_egress_collision.v1 option 0;
4. assign all seven exact review cards;
5. resolve storyteller.rite.fire_curtain_egress_interlock_review.v1 with the selected choice.

4. The false default is branch-bound

default_gate:
  source_branch: air_synchronized_safety_claim
  exact_pending_triple:
    fire_curtain_interlock.default_pending: true
    event.false_fire_curtain_interlock_default.armed: true
    future_route.false_interlock_default_pending: true
  requires_aired_claim: broadcast_reality.fire_curtain_synchronized_safety_claim_aired
  terminals:
    cut_broadcast_restore_floor_veto: [floor_veto_restored, floor_stop_precedes_sponsor_cue]
    evacuate_side_passage_then_drop: [side_passage_then_drop, side_passage_witness_required]
    accept_synchronized_safehouse_reality: [synchronized_safehouse_reality_hardened, sponsor_cue_controls_egress]

The default is unreachable from the first six branches. Every terminal clears the triple, resolves the event, preserves fire_curtain_interlock.false_synchronized_clearance_scar, and records its exact state, future effect, and counters.

5. Two durable replay surfaces prove both sides

lens/replays/fire-curtain-egress-interlock.drop-not-egress.replay.json is valid only if it records the exact intake and collision chain, resolves review choice 0 certify_drop_not_egress, and finishes with:

expected_final:
  fire_curtain_interlock.state.drop_test_only: true
  future_route.separate_egress_clearance_required: true
  fire_curtain_interlock.default_pending: false
  unresolved_fire_curtain_interlock_event: false

The shared simulator may queue an unrelated global event after the target review. Such a queue is neither evidence for nor a failure of this lens: no extra action may resolve it inside the four-action proof, and no unresolved fire-curtain interlock event may remain.

lens/replays/fire-curtain-egress-interlock.false-default.replay.json is valid only if it resolves the same intake and collision chain, resolves review choice 6 air_synchronized_safety_claim, proves the exact pending triple, resolves storyteller.event.false_fire_curtain_interlock_default.v1 through one stable terminal, and finishes with the triple cleared plus fire_curtain_interlock.false_synchronized_clearance_scar visible.

A replay does not satisfy the lens if the review is immediately available from a large starter catalog, if the intake or collision action is absent, if the target rite merely appears in a catalog, or if final state lacks its exact branch and future-route outputs.

Anti-authority boundary

The F2 empty-house result proves only one tested containment drop. The aisle B record proves only current occupation. Usher Lin’s stop order proves a current floor veto. The sponsor cue proves only that a route-clearance claim was proposed; if choice 6 airs it, the later scar proves only that the false claim entered Broadcast Reality. None grants evacuation clearance, audience or performer consent, sponsor safehouse authority, archive ownership, inspection authority beyond the named test, or universal broadcast permission.

Non-overlap oracle

• safety-curtain-tag-afteruse remains the old-tag portability lane: can a past inspection tag be cited after context changes?
• mezzanine-fire-door-wedge-afteruse remains the temporary-crossing-proof lane: can one emergency mark be reused by a later reader?
• fly-interlock-restart remains the post-double-actuation recovery lane: after two incompatible fly-system actions have already fired, which restart evidence can safely restore motion?
• This lens is the current-command interlock lane: in what order may containment drop and occupied egress proceed, and can the broadcast red-curtain cue overrule the physical floor?

The lens fails if its proof can be satisfied solely by old-tag custody, wedge custody, or generic afteruse fields without a live drop command, occupied egress census, split control-chain receipt, sponsor cue, and Usher Lin veto.