Fly Interlock Restart Gate / 吊杆联锁复位门机制
This mechanism answers one narrow question: after a latched partial movement, may the named line set enter a new execution epoch?
It does not decide whether the duplicate pulse should have existed. Cue Execution Idempotency Ledger owns that earlier problem. This gate consumes the durable failure state future_route.manual_reset_and_dual_receipt_required after the primary interlock has already stopped F-27 at 280 mm.
State machine
fly_interlock_restart:
source_state: trip_after_partial_travel
latch_state: tripped_latched | held | reset_requested | rearmed
rail_position: partial_verified | home_verified | isolated | unknown
stored_energy: live | isolated | rebalanced
body_zone: occupied | cleared | unknown
actuation_receipts: dual_attached | incomplete
execution_epoch: old_consumed | new_unissued | new_issuedLegal automated rearm is the transition:
tripped_latched + dual_attached + position_verified + energy_rebalanced
+ body_zone_cleared + named_reset_pair + new_epoch_issued
=> rearmedClearing the latch bit without the conjunction creates false_reset_retrigger_pending. A hold does not clear the latch. A maintenance return can verify home but does not itself issue a show epoch. Electrical isolation permits a narrowed route but leaves F-27 unavailable.
Source-state contract
The rite requires both predecessor flags:
required_predecessor_flags:
cue_execution_idempotency.default.trip_after_partial_travel: true
future_route.manual_reset_and_dual_receipt_required: true
rejected_predecessor:
cue_execution_idempotency.default.complete_second_travel: trueThe complete-second-travel outcome needs a version-fork correction lane; it has no latched primary trip to reset. The restart rite consumes manual_reset_and_dual_receipt_required on every resolution so the old obligation cannot be replayed as a second restart authorization.
Six-part AND gate
| Gate | Required evidence | Failure meaning |
|---|---|---|
| dual receipts | F27-A1 full travel and F27-A2 partial travel | execution count or old epoch is unknown |
| position or isolation | current physical survey, verified home, or mechanical isolation | reset may release into an unknown travel path |
| load, pin, and energy | current load, counterweight, pin, and stored-energy register | brake release may accelerate toward the heavy side |
| current body-zone clear | post-trip occupancy sweep with named spotter and expiry | a pre-trip clear call may hide recovery crew |
| named reset pair | qualified operator plus independent spotter | no accountable hand can bind reset to physical readback |
| new execution epoch | new ID and checksum for the exact next motion | the consumed R6 epoch can be replayed again |
The six gates are conjunctive for automated show rearm. No artifact, person, or flag can stand in for another.
Exact assignment contract
F-27 Interlock Restart Review requires eight exact in-hand cards:
| Slot | Exact card |
|---|---|
| docket | storyteller.card.fly_interlock_restart_docket.v1 |
| trip_trace | storyteller.card.fly_interlock_trip_trace.v1 |
| actuation_receipts | storyteller.card.fly_interlock_dual_actuation_receipts.v1 |
| position_survey | storyteller.card.fly_interlock_position_brake_survey.v1 |
| load_energy | storyteller.card.fly_interlock_load_pin_energy_register.v1 |
| zone_clearance | storyteller.card.fly_interlock_body_zone_clearance.v1 |
| reset_operator | storyteller.card.fly_interlock_reset_operator_witness.v1 |
| restart_epoch | storyteller.card.fly_interlock_restart_epoch_request.v1 |
Tag aliases, selected-branch pseudo-cards, virtual placeholders, duplicate cards, catalog-only cards, cards absent from the current hand, missing slots, omitted choice, invalid choice, and branch/assignment mismatch all fail. The operation is non-repeatable.
Branch contract
branches:
hold_latch_and_complete_survey:
state_after: trip_latched_survey_complete
future_effect: trip_latch_remains_until_repair_review
controlled_return_to_verified_home:
state_after: home_verified_epoch_unissued
future_effect: new_epoch_and_load_recertification_required
isolate_line_and_narrow_show:
state_after: f27_isolated_show_narrowed
future_effect: f27_disabled_route_variant_required
repin_rebalance_and_issue_new_epoch:
state_after: load_rebalanced_new_epoch_issued
future_effect: new_epoch_checksum_required_for_every_f27_pulse
degraded_deadman_manual_run:
state_after: deadman_manual_limited_range
future_effect: named_operator_and_spotter_required_each_motion
abort_motion_and_fold_slot:
state_after: rail_motion_aborted_slot_folded
future_effect: blackout_recovery_and_public_correction_required
bypass_latch_and_false_reset:
state_after: false_reset_retrigger_pending
future_effect: interlock_false_reset_default_pendingEvery branch declares relief, cost, five counter deltas, one unique state, and one unique future effect. Only repin_rebalance_and_issue_new_epoch sets fly_interlock_restart.epoch.R7_F27_E2_issued.
Bounded motion rule
controlled_return_to_verified_home and degraded_deadman_manual_run are not automated rearm loopholes.
- Controlled return is one named maintenance movement under physical readback. It ends with
home_verified_epoch_unissued. - Dead-man mode keeps the automation bus disconnected, limits range, and requires the operator and spotter at every motion.
- Isolating F-27 can release other parts of the show, but it produces a route variant with no F-27 movement.
False-reset rule
bypass_latch_and_false_reset arms F-27 False Reset Hardening. The event cannot resolve into generic recovery-only play. Both outcomes add a physical receipt or impact:
- another 160 mm under live counterweight triggers a secondary stop at 440 mm total displacement;
- 720 mm into a stale-clear work zone tears the curtain guide, injures the spotter, and forces a blackout.
Both consume the pending event, set a durable false-reset scar, write different future effects, and close once.
Downstream-reader rule
Every future effect is an obligation, not decorative prose. Later F-27 routes must read the selected state before they offer motion:
- held routes require another repair review;
- home-return routes require load recertification and a new epoch;
- isolated routes require a no-F-27 variant;
- rearmed routes carry the new epoch checksum on every pulse;
- dead-man routes require named operator and spotter for every motion;
- aborted routes carry blackout recovery and correction duty;
- false-reset routes are blocked by the event’s mechanical-isolation or injury-investigation obligation.
Authority boundary
authority_boundary:
provesRestartReadinessForNamedLineSetAndEpochOnly: true
grantsCallerAuthority: false
grantsRiggingSafetyClearance: false
grantsPerformerConsent: false
grantsSponsorClearance: false
grantsEditReusePermission: false
grantsArchiveOwnership: false
grantsUniversalBroadcastPermission: falseEven the full-rearm branch is local: it proves readiness for the verified F-27 load and R7-F27-E2 only. It is not a universal rigging certificate.