Fail closed on Focus/DND, CarPlay projection, and inbound AirDrop receives

When narrative content drives a physical actuator, three interrupt paths look like "just restore state" until they are not: Focus mode or Do Not Disturb turns ON mid-session, a CarPlay / Android Auto / desktop-continuity projection starts, and an inbound AirDrop or share-sheet receive pops up. Each needs a default that fails closed — toward idle, toward re-arm only after a named beat, toward interrupt-clear ≠ motor authority.

on focus_or_dnd_turned_on():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on focus_or_dnd_turned_off():
        # do NOT silent-resume; do NOT restore last intensity
        await user_resume(); await next_named_beat(); arm()

on carplay_android_auto_or_desktop_projection_start():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on projection_ended_phone_only():
        # endpoint restored ≠ motor envelope restored
        await user_resume(); await next_named_beat(); arm()

on airdrop_or_sharesheet_receive_incoming():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on share_ui_accepted_or_dismissed():
        # receive plane closed ≠ motor authority
        await user_resume(); await next_named_beat(); arm()

The Focus/DND rule is easy to mix up with Low Power Mode, calendar alarms, and push-open. LPM is a power-plane event; alarms are scheduled local interrupts; push-open is an inbound notification that opens the story. Turning Focus or DND ON is a user-chosen notification plane: the session is still running, but the interrupt surface changed. Turning it OFF is a setting flip, not consent to put the previous motor envelope back on.

The projection rule sits next to — but is not — screen recording, cast, AirPlay, multi-window focus, or app-backgrounding. Recording and casting are sustained privacy leaves of the frame. Multi-window keeps the story visible in a pane. Backgrounding leaves for Home or another app. CarPlay / Android Auto / desktop continuity moves the session plane to another endpoint. Ending the projection restores phone-only; it must not restore motor authority.

The AirDrop / share-receive rule is a privacy-boundary inbound, not a share deep-link open, not a single screenshot, and not a push-open. Accepting OR dismissing the share UI both close the receive plane; neither must restore motor authority.

Buyers can test all three without code: turn Focus or DND on mid-session and see whether turning it off restarts intensity, start then end a CarPlay or Android Auto session and watch whether phone-only return re-arms motors, and trigger then accept or dismiss an AirDrop. These map to questions like "how do AI stories control physical devices" and "Lovense alternative with AI stories."

This is the model CRAVE AI uses for story-controlled play on official devices: AI story-controlled vibrator. Principle write-up: narrative-to-device sync. Devices: AI sex toys.

Disclosure: I work on CRAVE AI. Adults-only product; no explicit content here.