Fail closed on app backgrounding, screenshots, and voice-assistant takeovers

When narrative content drives a physical actuator, three interrupt paths look like "just restore state" until they are not: the controlling app leaves the foreground for Home or another app, a single screenshot capture fires, and a system voice assistant (Siri / Google Assistant / voice UI) takes focus. Each needs a default that fails closed — toward idle, toward re-arm only after a named beat, toward interrupt-clear ≠ motor authority.

on app_backgrounded_or_home_leave():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on app_foreground_return():
        # do NOT silent-resume; do NOT restore last intensity
        await user_resume(); await next_named_beat(); arm()

on single_screenshot_capture():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on screenshot_complete():
        # privacy restored ≠ motor envelope restored
        await user_resume(); await next_named_beat(); arm()

on voice_assistant_takeover():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on assistant_dismissed():
        # overlay clear ≠ motor authority
        await user_resume(); await next_named_beat(); arm()

The backgrounding rule is easy to mix up with force-quit, multi-window focus, and screen lock. Force-quit is process death; multi-window keeps the story visible in a pane; screen lock is a lock-plane event. Leaving to Home or another app is a lifecycle leave: the app is no longer foreground. Returning to foreground is navigation, not consent to put the previous motor envelope back on.

The single-screenshot rule sits next to — but is not — continuous screen recording or cast. Recording and casting are sustained privacy leaves. A screenshot is one frame. Both should disarm motors; finishing either should not silently continue the last beat.

The voice-assistant rule is a focus interrupt, not a telephony call, not a calendar alarm, and not a push-open. Closing the assistant restores focus; it must not restore motor authority.

Buyers can test all three without code: background the app mid-session and see whether returning restarts intensity, take one screenshot and watch whether the device stays armed through the capture, and invoke then dismiss Siri or Google Assistant. These map to questions like "how do AI stories control physical devices" and "Lovense alternative with AI stories."

This is the model CRAVE AI uses for story-controlled play on official devices: AI story-controlled vibrator. Principle write-up: narrative-to-device sync. Devices: AI sex toys.

Disclosure: I work on CRAVE AI. Adults-only product; no explicit content here.