F-27 Interlock Restart Lens / F-27 联锁复位 Lens

Lens question

Can the implementation prove that F-27’s primary interlock stopped a real second actuation after 280 mm, consume the resulting manual-reset obligation, reject a reset-lamp shortcut, and issue a new automated epoch only when all six physical gates are simultaneously true?

The lens fails if it turns this into another initials, authority, old-artifact, generic rigging-clearance, staffing, or recovery-only story.

1. Source continuity is real

Passing evidence must read the existing producer event storyteller.event.false_cue_sheet_initials_afteruse_default.v1 and prove that outcome trip_after_partial_travel sets:

• cue_execution_idempotency.default.trip_after_partial_travel;
• future_route.manual_reset_and_dual_receipt_required;
• a 280 mm partial second travel with dual actuation receipts.

The restart rite must require both flags, consume manual_reset_and_dual_receipt_required, and remain unavailable from the producer’s complete_second_travel outcome.

2. Exact physical tuple

The packet exposes eight starter-reachable, lens-bound, local-authority-only cards:

1. restart docket;
2. primary trip trace;
3. dual actuation receipts;
4. position and brake survey;
5. load, pin, and stored-energy register;
6. current body-zone clearance;
7. reset operator and independent witness;
8. new-epoch request.

The cards must retain the exact facts: F-27/R6, primary trip after 280 mm, old epoch consumed, 2120 mm surveyed position, 18 kg live imbalance, post-trip crew entry, named operator and spotter, and requested R7-F27-E2.

3. Exact runtime reachability

The rite must enforce:

• both predecessor flags;
• eight have.card conditions;
• eight required slots;
• exactly one accepted card ID per slot;
• assigned cards present in the current hand;
• explicit valid option selection;
• selected-option exact card and flag requirements;
• repeatable: false.

Wrong card, duplicate assignment, missing slot, catalog-only card, out-of-hand card, virtual placeholder, absent predecessor flag, omitted choice, invalid choice, and selected-option mismatch must fail without setting completion or branch flags. After one successful resolution the rite must close.

4. The full-rearm rule is conjunctive

full_rearm_conjunction:
  dual_actuation_receipts_attached: true
  physical_position_verified_or_line_isolated: true
  load_pin_and_stored_energy_verified: true
  body_zone_currently_clear: true
  named_reset_operator_and_independent_spotter: true
  new_execution_epoch_issued: true

Only repin_rebalance_and_issue_new_epoch may set fly_interlock_restart.epoch.R7_F27_E2_issued. Every other branch must leave automated show motion unavailable, bounded, isolated, or defaulted.

5. Seven branches diverge

Branch	Required state after	Required future effect	Automated epoch?
hold_latch_and_complete_survey	trip_latched_survey_complete	trip_latch_remains_until_repair_review	no
controlled_return_to_verified_home	home_verified_epoch_unissued	new_epoch_and_load_recertification_required	no
isolate_line_and_narrow_show	f27_isolated_show_narrowed	f27_disabled_route_variant_required	no
repin_rebalance_and_issue_new_epoch	load_rebalanced_new_epoch_issued	new_epoch_checksum_required_for_every_f27_pulse	yes
degraded_deadman_manual_run	deadman_manual_limited_range	named_operator_and_spotter_required_each_motion	no
abort_motion_and_fold_slot	rail_motion_aborted_slot_folded	blackout_recovery_and_public_correction_required	no
bypass_latch_and_false_reset	false_reset_retrigger_pending	interlock_false_reset_default_pending	no

Each branch must carry a non-empty relief list, non-empty cost list, exactly five declared counter deltas with matching executable effects, and a unique state/future pair.

6. Bounded alternatives do not smuggle rearm

• Controlled return ends at verified home with the new epoch unissued.
• Isolation resumes only a route variant that excludes F-27.
• Dead-man mode keeps automation disconnected and names an operator plus spotter for every motion.
• Abort protects bodies by folding the recovery slot and owing correction.

The evaluator and runtime test must explicitly prove these branches do not set the new-epoch flag.

7. False reset has two physical outcomes

The default event must be core-compatible, priority 96, trigger only from fly_interlock_restart.false_reset_pending, offer exactly two stable options, unset the pending flags, and close once.

Outcome	Physical consequence	State after	Future effect
retrip_under_live_counterweight	another 160 mm, secondary trip at 440 mm total, new F27-A3 edge	secondary_trip_at_440mm	mechanical_isolation_and_full_resurvey_required
drive_into_uncleared_body_zone	720 mm into work zone, torn curtain guide, spotter injury, blackout	uncleared_zone_impact_blackout	line_set_removed_and_injury_investigation_required

Neither outcome may write only a generic recovery state.

8. Durable replay oracle

The durable session and replay are a transparent carryover fixture for the already implemented trip_after_partial_travel producer outcome. Before the target action, the session state must contain both predecessor flags; the manifest must name the source event and source option.

The first target end_turn action must:

• assign all eight exact cards with no duplicates or virtual cards;
• select repin_rebalance_and_issue_new_epoch;
• unset future_route.manual_reset_and_dual_receipt_required;
• set fly_interlock_restart.state.load_rebalanced_new_epoch_issued;
• set fly_interlock_restart.epoch.R7_F27_E2_issued;
• set future_route.new_epoch_checksum_required_for_every_f27_pulse.

The exported replay is lens/replays/fly-interlock-restart.safe-rearm.replay.json and must have game-cli provenance, integrity, session action history, state snapshot evidence, seed, lens ID, assignment catalog, and latest state.

9. Authority boundary

The docket, rite, and event must all state local authority. The implementation may prove restart readiness or failure for F-27 and the named epoch only. It must deny caller authority, universal rigging clearance, performer consent, sponsor clearance, edit reuse permission, archive ownership, and universal broadcast permission.

10. Canon boundary

All focused runtime and Wiki surfaces must remain inside source: storyteller: the corporate broadcast-reality world of artists, crews, sponsors, inspectors, editors, routes, and physical performance infrastructure. No non-Storyteller source may enter this packet.