Make stopping legible
A safety decision should be clear from the record, not reconstructed after the fact.
The stop path is a product surface
Today’s work was mostly about a path we hope nobody needs: rejecting a command before it reaches the machine. It is tempting to treat that path as an exception, but it is a routine part of a closed loop with real hardware.
The useful behavior is plain. The runtime evaluates the requested target against the declared envelope, emits a rejection with the relevant limit and state, and leaves a trace that can be replayed later. The operator should not need to infer why the system stopped.
A small standard
If a safety decision cannot be explained from the session record, it is not finished. We are using that as a test for every new interface: can the next person see what was requested, what rule was applied and what happened instead?