Decide And Publish The Capacity State Each Minute
What It Does
The sentinel reads pressure, prior memory and staff pins, then publishes protection factors through two independent channels. API stage changes are conditional on sustained emergency and a separate disabled switch.
The Flow
When Something Fails
Unreadable signals release protection after a held tick unless an active pin overrides them. Publication failure is independent of decision fallback, and partial stage updates or stale channels remain observable consistency limits.
Open Design Questions
Operational evidence must establish suitable thresholds before emergency stage changes are enabled.