1. Fail-Closed by Default (0.0V Safe State)
If an action violates bounds, provides an invalid MAC tag, or exceeds the anomaly
threshold, the system does not just throw an exception: it enters an absorbing KILL
latch and de-energizes the actuator register to a safe state (0.0V / 0.0 kW).
### 2. Crash-Consistency via Two-Phase WAL







