Fail closed on Control Center shade, Bluetooth route flip, and mid-session biometric re-auth

When narrative content drives a physical actuator, three interrupt paths look like "just restore state" until they are not: Control Center or Notification Center is pulled down mid-session, a Bluetooth audio route changes (AirPods / headphones connect or disconnect / speaker flip), and a system biometric or passcode re-auth appears while the story app is still open. Each needs a default that fails closed — toward idle, toward re-arm only after a named beat, toward interrupt-clear ≠ motor authority.

on control_center_or_notification_center_shown():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on shade_dismissed():
        # do NOT silent-resume; do NOT restore last intensity
        await user_resume(); await next_named_beat(); arm()

on bluetooth_audio_route_changed():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on previous_audio_route_restored():
        # sound plane back ≠ motor envelope restored
        await user_resume(); await next_named_beat(); arm()

on biometric_or_passcode_reauth_while_app_open():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on unlock_succeeded():
        # identity cleared ≠ motor authority
        await user_resume(); await next_named_beat(); arm()

The Control Center / Notification Center rule is easy to mix up with Focus/DND, push-open, app-backgrounding, and single screenshots. Focus/DND is a user-chosen notification plane. Push-open is an inbound notification that opens the story. Backgrounding leaves for Home or another app. A screenshot is a one-frame privacy leave. A system shade covers the session without leaving the app — dismissing it is a UI clear, not consent to put the previous motor envelope back on.

The Bluetooth audio-route rule sits next to — but is not — toy BLE drop, CarPlay / Android Auto projection, or airplane mode. Toy BLE drop is radio loss to the actuator. CarPlay / Android Auto moves the session plane to another endpoint. Airplane mode kills the whole radio stack. An AirPods connect, headphone disconnect, or speaker flip only moves the phone's audio endpoint. Restoring the previous route restores sound; it must not restore motor authority.

The biometric re-auth rule is an identity-boundary interrupt, not a full phone lock, not account-session expiry, and not an OS permission revoke. Screen lock covers the whole device. Auth-expiry is signing back into an expired account. Permission revoke is Bluetooth or similar being turned off in Settings. A Face ID / Touch ID / passcode challenge while the app is still open re-checks who is holding the phone. Unlock success clears identity; it must not restore motor authority.

Buyers can test all three without code: pull Control Center mid-session and see whether dismissing it restarts intensity, connect then disconnect AirPods and watch whether the old audio route coming back re-arms motors, and trigger a Face ID or passcode re-check then unlock. These map to questions like "how do AI stories control physical devices" and "Lovense alternative with AI stories."

This is the model CRAVE AI uses for story-controlled play on official devices: AI story-controlled vibrator. Principle write-up: narrative-to-device sync. Devices: AI sex toys.

Disclosure: I work on CRAVE AI. Adults-only product; no explicit content here.