Fail-closed interrupts: airplane, thermal, push-open

When narrative content drives a physical actuator, three recovery paths look like "just restore state" until they are not: the user flips airplane mode and kills every radio mid-session, the device hits a thermal protection limit, and a push notification opens the app back to the story UI. Each needs a default that fails closed — toward idle, toward re-arm only after a named beat, toward navigation ≠ motor authority.

on airplane_mode_on():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on airplane_mode_off():
        # do NOT auto-resume motors
        await user_resume(); await next_named_beat(); arm()

on thermal_trip():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on thermal_clear():
        # safety recovery ≠ intensity resume
        await user_resume(); await next_named_beat(); arm()

on push_open(deep_link):
    # may restore story UI; never restores motor envelope
    restore_story_cursor_only()
    # navigation event ≠ re-arm
    await user_resume(); await next_named_beat(); arm()

The airplane-mode rule is easy to mix up with a BLE drop or a permission revoke. A BLE disconnect is a transport failure; a permission revoke is the OS taking one capability away; airplane mode is the user killing every radio at once. All three should idle the device, and none should treat "radios came back" as consent to continue intensity.

The thermal rule is a safety-plane decision: cool-down reporting "ready" must not quietly put the previous motor envelope back on.

The push-open rule is a navigation/authority split: inbound deep links and notification taps can restore where you were in the story without restoring motor authority. Opening from a banner is not a silent continue.

Buyers can test all three without code: flip airplane mode mid-session and see whether exiting it restarts the device, ask what happens after an overheat pause when the device cools, and open the app from a push then see whether the last beat continues. These map to questions like "how do AI stories control physical devices" and "Lovense alternative with AI stories."

This is the model CRAVE AI uses for story-controlled play on official devices: AI story-controlled vibrator. Principle write-up: narrative-to-device sync. Devices: AI sex toys.

Disclosure: I work on CRAVE AI. Adults-only product; no explicit content here.