F-27 Interlock Restart Barrier / F-27 联锁复位门

Premise

Recovery cycle R6 has already made its mistake. A flattened CS-09 import sent a second F-27 pulse after the line set had completed one legitimate movement. The primary interlock caught that second actuation after 280 mm, leaving the batten displaced, the brake re-applied, the counterweight live, and two physical receipts inside one consumed execution epoch.

The control room wants the recovery pickup back on air. Management points at the reset lamp as if clearing the latch were the same thing as making the line safe. It is not.

This storyline begins only when storyteller.event.false_cue_sheet_initials_afteruse_default.v1 resolves trip_after_partial_travel and writes both:

• cue_execution_idempotency.default.trip_after_partial_travel;
• future_route.manual_reset_and_dual_receipt_required.

The player must decide whether F-27 stays latched, returns home under maintenance control, is isolated from a narrowed show, is fully re-pinned and rebalanced into a new epoch, runs in degraded dead-man mode, is aborted into a black slot, or is falsely reset under live load.

Distinct seam boundary

CS-09 Initial-Collision Double-Fire decides whether a physical cue may execute more than once. This line starts after prevention failed and a latched partial motion physically exists. It does not reopen the RN initials collision or ask who called the cue.

Nearby artifact lanes remain inputs, not substitutes:

• fly-rail lock-pin records can prove what a prior pin state said, but not the current position, live energy, or body-zone state;
• counterweight load sheets can preserve old load provenance, but cannot certify that the present 18 kg imbalance has been re-pinned and rebalanced;
• safety-curtain tags cannot prove the F-27 work zone is clear after recovery crew have entered it;
• Emergency Power Priority chooses powered loads; it does not clear an interlock;
• Live Floor Crew Load chooses staffing and fatigue limits; it does not issue a new execution epoch.

If one old artifact, a reset lamp, or a sponsor deadline can independently clear the gate, the storyline has failed.

State-triggered entry

entry_state:
  trigger_kind: state_pressure
  source_event: storyteller.event.false_cue_sheet_initials_afteruse_default.v1
  source_outcome: trip_after_partial_travel
  cue_instance: F-27 / R6
  primary_trip_latched: true
  partial_second_travel_mm: 280
  dual_actuation_receipts_visible: true
  old_execution_epoch_consumed: true
  manual_reset_and_dual_receipt_required: true
  exact_eight_source_cards_in_hand: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true

The complete-second-travel outcome does not enter this line. It owns a version-fork correction obligation, not a latched restart problem.

Bound content pack

• Fly Interlock Restart Gate defines the conjunction and legal state transitions.
• F-27 Interlock Restart Docket binds eight non-substitutable physical surfaces.
• F-27 Interlock Restart Review resolves seven operational postures.
• F-27 False Reset Hardening turns a bypass into one of two measurable physical scars.
• F-27 Interlock Restart Lens observes entry consumption, branch reachability, exact-card enforcement, event closure, and authority denial.

Story spine

Beat 1 — The latch is evidence

The trip lamp does not mean “nothing happened.” The second current edge released the brake and moved F-27 another 280 mm before IL-F27-A opened. The partial movement has direction, displacement, load, and a physical receipt. The interlock preserves a fault state that broadcast scheduling would rather flatten into a temporary pause.

Beat 2 — Recovery crew change the zone

After the trip, a rail surveyor, reset operator, and spotter enter the work zone. Any pre-trip clear call expires. The body-zone card must be current at the next brake release, not merely present somewhere in an old safety packet.

Beat 3 — A consumed epoch cannot be reset

F27-A1 records the legitimate full movement. F27-A2 records the partial duplicate actuation. Both belong to R6-F27-E1, so the old epoch is consumed. A reset button can clear a latch bit; it cannot turn either receipt back into an unexecuted command.

Beat 4 — The player chooses a restart posture

Run F-27 Interlock Restart Review. Six branches preserve the gate by holding, returning, isolating, fully rearming, degrading, or aborting. Only one branch may issue R7-F27-E2 for automated motion, and it pays every conjunctive proof cost.

Beat 5 — A false reset becomes broadcast fact

If management bypasses the gate, live stored energy produces another measurable movement. The secondary interlock may catch 160 additional millimetres, or stale zone clearance may let the batten enter the work zone and injure the spotter. Once the recovery feed airs the discontinuity or blackout, later route readers can inherit the false reset as normal stage history.

Restart conjunction

legal_new_automated_epoch:
  dual_actuation_receipts_attached: true
  physical_position_verified_or_line_isolated: true
  load_pin_and_stored_energy_verified: true
  body_zone_currently_clear: true
  named_reset_operator_and_independent_spotter: true
  new_execution_epoch_issued: true

Every term is joined by AND. The repin_rebalance_and_issue_new_epoch branch is the only branch that satisfies the complete automated-rearm conjunction. Controlled home return and dead-man motion are bounded maintenance states, not show-ready automation.

Branch map

Branch	Relief	Cost / scar	Restart state after	Future effect
hold_latch_and_complete_survey	no further motion; trip becomes legible	restart blocked; delay and operator burden	trip_latched_survey_complete	trip_latch_remains_until_repair_review
controlled_return_to_verified_home	known physical baseline	operator/spotter exposure; no new show epoch	home_verified_epoch_unissued	new_epoch_and_load_recertification_required
isolate_line_and_narrow_show	other systems resume safely	F-27 scenery removed; continuity scar	f27_isolated_show_narrowed	f27_disabled_route_variant_required
repin_rebalance_and_issue_new_epoch	full automated F-27 operation returns	recertification, crew claim heat, and delay	load_rebalanced_new_epoch_issued	new_epoch_checksum_required_for_every_f27_pulse
degraded_deadman_manual_run	limited essential motion remains	continuous two-person labor and harm exposure	deadman_manual_limited_range	named_operator_and_spotter_required_each_motion
abort_motion_and_fold_slot	bodies and equipment maximally protected	black recovery slot and public correction	rail_motion_aborted_slot_folded	blackout_recovery_and_public_correction_required
bypass_latch_and_false_reset	attempted immediate restart	physical default armed under live energy	false_reset_retrigger_pending	interlock_false_reset_default_pending

Missability and recovery

The safe-rearm opportunity becomes missable if anyone clears the primary latch before photographing the trip state, separates the two actuation receipts, commands a brake release after the body-zone clearance expires, moves counterweight or pins without a new register, or reuses R6-F27-E1 as the next epoch.

A later survey can locate the batten, but it cannot erase an unrecorded movement. A later injury waiver cannot make an uncleared body zone clear. A new checksum cannot convert the old duplicate receipts into one execution. Recovery must preserve every physical scar and issue a genuinely new epoch.

This is not a recruitment storyline. Tomas Rei, Ari Venn, and Mei Tor are named operational witnesses; the outcome neither recruits them nor grants them authority outside the named F-27 reset.

Broadcast-reality consequence

In this world, the recovery feed can make a false restart look like the canonical blocking of the show. A partial re-trip may become the expected scenery position in later reruns. An injury blackout may be edited into a dramatic beat and then treated as planned. Branch-specific future effects prevent those surfaces from silently normalizing the fault.

Authority boundary

The packet may prove restart readiness for the named F-27 load and the named execution epoch only. It does not grant caller authority, universal rigging clearance, performer consent, sponsor clearance, edit reuse permission, archive ownership, blame, or universal broadcast permission.

Replay expectation

A lens-scoped durable session begins from the exact trip_after_partial_travel carryover fixture, with both predecessor flags explicitly present. It must assign all eight exact cards and select repin_rebalance_and_issue_new_epoch, consuming manual_reset_and_dual_receipt_required and emitting load_rebalanced_new_epoch_issued plus new_epoch_checksum_required_for_every_f27_pulse.

Focused runtime evidence must also execute all seven branches, reject absent predecessor flags, wrong, duplicate, missing, catalog-only, out-of-hand, omitted-choice, invalid-choice, and option-mismatch attempts, prove only one branch issues the new automated epoch, exercise both false-reset outcomes, and prove one-shot closure.