Fail closed on PiP overlays, Personal Hotspot flips, and OS restart prompts

When narrative content drives a physical actuator, three interrupt paths look like "just restore state" until they are not: a Picture-in-Picture / floating video from another app mid-session, a Personal Hotspot / Instant Hotspot / USB tethering start or stop, and an OS software-update / Restart Required prompt. Each needs a default that fails closed — toward idle, toward re-arm only after a named beat, toward interrupt-clear ≠ motor authority.

on picture_in_picture_or_floating_video_opened():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on pip_dismissed():
        # floating video plane gone ≠ motor envelope restored
        await user_resume(); await next_named_beat(); arm()

on personal_hotspot_or_usb_tethering_changed():
    ramp_to(IDLE, at=next_beat_boundary)
    armed = false
    on hotspot_or_tether_ended():
        # gateway role cleared ≠ motor authority
        await user_resume(); await next_named_beat(); arm()

on os_update_or_restart_required_prompt():
    ramp_to(IDLE, at=before_or_at_prompt_boundary)
    armed = false
    on postpone_or_later():
        # prompt deferred ≠ previous intensity restored
        await user_resume(); await next_named_beat(); arm()

The PiP rule is easy to mix up with same-phone multi-window focus, external-display / Sidecar attaches, CarPlay / Android Auto projection, and screen-record / cast starts. Multi-window is visibility without exclusive focus on one phone. External display / Sidecar attaches a non-automotive second screen. CarPlay / Android Auto moves the session to an automotive projection endpoint. Screen-record / cast captures or mirrors this session. PiP is a foreign floating-video plane from another app. Dismissing it clears the overlay; it must not restore motor authority.

The Personal Hotspot / tethering rule sits next to — but is not — a VPN / Private Relay / network-path change, airplane mode, or a toy BLE drop. VPN / Private Relay changes the traffic path without making this phone a shared gateway. Airplane mode cuts onboard RF. BLE drop is the toy radio. Personal Hotspot, Instant Hotspot, or USB tethering changes whether this phone is a shared gateway. Ending the hotspot clears that role; it must not restore motor authority.

The OS-restart-prompt rule is a system reboot boundary, not a controlling-app App Store / TestFlight process replace, not a user force-quit, and not toy firmware idle. Controlling-app update replaces the phone process that owns the story clock. Force-quit is the user killing that process. Firmware idle is on the toy side. An OS "Restart Required" prompt is a reboot boundary for the whole device. Postpone / Later only hides the sheet; it must not restore motor authority.

Buyers can test all three without code: open a PiP video mid-session and see whether dismissing it restarts intensity, flip Personal Hotspot on then off and watch whether ending the hotspot re-arms motors, and trigger an OS restart prompt then tap Later. These map to questions like "how do AI stories control physical devices" and "Lovense alternative with AI stories."

This is the model CRAVE AI uses for story-controlled play on official devices: AI story-controlled vibrator. Principle write-up: narrative-to-device sync. Devices: AI sex toys.

Disclosure: I work on CRAVE AI. Adults-only product; no explicit content here.

---