Converge control-authority mutation admission on interlock eligibility predicates #10

Summary

components/jj_authority/jj_authority.c (introduced in #7) contains two admission helpers that duplicate part of jj_interlock's eligibility predicates:

• sensors_valid(): all three sensors JJ_SENSOR_OK and finite, which duplicates jj_interlock's sensors_ok() (without its fault latching).
• base_heat_eligible(): commissioned, sensors_valid(), no overtemperature, no latched fault.

jj_authority_mutate() also inlines fan-proof PROVEN, the MANUAL 30–50 °C finite-target check, and AUTOMATIC printer online/printing checks.

Scope: admission only, not a heater-safety bypass

These predicates only decide whether a MANUAL/AUTOMATIC mutation request is accepted. A successful mutation writes authority-owned state only (mode, configured target, demand authorization, active authority). It does not write safety inputs.

Heater authorization is unaffected: every control step re-runs the full Stage-1 eligibility predicates in jj_interlock against live inputs, and Stage 2 performs final authorization (see #9). The authority layer can only remove authorization, never grant it. This is not a heater-safety bypass.

Failure mode: availability / UX drift

If the authority-side copy and the interlock-side copy diverge:

• authority may accept a request that the interlock immediately inhibits (operator sees "accepted" followed by an inhibit), or
• authority may reject a request (control_request_ineligible) that the interlock would permit.

Why this is not a blocker for #9

The approved control architecture makes jj_interlock the sole owner of heat eligibility and authorization, and that holds. The duplication affects API admission semantics only.

Desired direction

Mutation admission should consume shared, authoritative, side-effect-free interlock eligibility semantics (for example, a pure interlock query over the same predicates) rather than independently reproducing them, so admission cannot disagree with Stage 1.

Ideally resolve this before real sensing and actuation make divergence operator-visible.