PASS: 33 zero-output invariants plus replay, deadline, budget, mode, sensor, rollover and config checks.
PASS: lamp program timer policy (44 checks)
PASS: independent IR absence/removal blocks AI and manual light; late ticket rejected; reentry needs fresh vision; timers preserved incl rollover; omitted input dark.
PASS: guard ticket becomes AI_REQUEST; matching result accepted; TX failure revokes ticket and output.
PASS: lamp_ui_dispatch integrated 55 assertions
PASS: lamp_ui_wire_service 110 assertions
PASS: wire-to-guard path, session/ticket/calibration checks, image-sequence anti-replay and malformed-packet fail-dark.
PASS: LED output is blanked during updates, written atomically across 61/122-channel banks, and fails off on bus, rail, and guard faults.
PASS: 128 GPIO combinations; PA12 vs PA10 alias isolation; read-only sampler; unbound IR/ADC/driver stays false; active AI output cancelled by real sampler/policy path. MMIO model only.
