Fail closed on clipboard paste banners, keyboards, and watch companion remotes

When narrative content drives a physical actuator, three interrupt paths look like "just restore state" until they are not: an Allow Paste / clipboard-permission banner mid-session, a software keyboard / QuickType / dictation / emoji-sticker picker, and a watch companion / Wear OS remote or complication tap. Each needs a default that fails closed — toward idle, toward re-arm only after a named beat, toward interrupt-clear ≠ motor authority.

on clipboard_paste_permission_banner_opened(): ramp_to(IDLE, at=next_beat_boundary) armed = false on banner_dismissed(): # permission UI gone ≠ motor envelope restored await user_resume(); await next_named_beat(); arm() on software_keyboard_dictation_or_emoji_picker_opened(): ramp_to(IDLE, at=next_beat_boundary) armed = false on input_ui_dismissed(): # keyboard/dictation/emoji UI cleared ≠ motor authority await user_resume(); await next_named_beat(); arm() on watch_companion_remote_or_complication_opened(): ramp_to(IDLE, at=next_beat_boundary) armed = false on remote_ended(): # companion UI gone ≠ previous intensity restored await user_resume(); await next_named_beat(); arm() 

The clipboard paste-permission rule is easy to mix up with Autofill / Passkeys, outbound Share Sheet, Photos / Files picker, and Contacts / Calendar picker. Autofill is credentials. Share Sheet is outbound sharing. Photos / Files is a media-or-docs chooser. Contacts / Calendar is a people-or-event chooser. An Allow Paste banner is a paste-consent prompt. Dismissing it clears that prompt; it must not restore motor authority.

The keyboard / dictation / emoji rule sits next to — but is not — Translate / Look Up / Live Text, Spotlight / system search, a voice-assistant takeover, or Autofill / Passkeys. Translate / Look Up is text understanding. Spotlight is search. A voice assistant takes over the session. Autofill is credentials. A software keyboard is an input surface. Dismiss only clears that surface; it must not restore motor authority.

The watch-companion rule is a wearable remote control surface, not CarPlay / Android Auto, not Handoff / Continuity, not a Live Activity / Dynamic Island, and not an AirDrop receive. CarPlay is projection. Handoff is Continuity. Live Activity is a phone-side glance. AirDrop is a receive path. A watch remote is a companion control. Ending it only clears that control; it must not restore motor authority.

Buyers can test all three without code: trigger an Allow Paste banner mid-session and see whether dismissing it restarts intensity, open the software keyboard or an emoji picker then dismiss, and fire a watch complication / Wear OS tile remote then end it. These map to questions like "how do AI stories control physical devices" and "Lovense alternative with AI stories."

This is the model CRAVE AI uses for story-controlled play on official devices: AI story-controlled vibrator. Principle write-up: narrative-to-device sync. Devices: AI sex toys.

Disclosure: I work on CRAVE AI. Adults-only product; no explicit content here.