Burner Plug-Stability Reflex Supervisor

The burner's end-plug confinement rests on operating conditions far beyond any built device; the reflex supervisor treats every plug excursion as a hard limit, not a setpoint to chase.

Supervising a regime we cannot yet post-dict

The burner (Aegis / MetroVolt) is a D-3He tandem-mirror generator whose confinement depends on the end plugs holding an ambipolar potential. In design-and-simulation studies the plug operating regime sits 166–830× beyond any device ever built, so its behavior cannot be post-dicted from experiment today. The plug-stability supervisor is written for that reality: it does not assume the plug is well-behaved, and it trips conservatively on any departure from the narrow modeled envelope.

Conservative by mandate

• Every plug parameter has a hard envelope; the supervisor trips on exit, it does not optimize inside.
• Model uncertainty is treated as part of the limit, so envelopes are set with wide margin.
• Loss of a plug diagnostic reads as out-of-envelope, because an un-monitored plug cannot be trusted.

def plug_supervisor(potential, density, coil_stress, env, model_conf):
    # low model confidence -> shrink the trusted envelope
    m = 1.0 if model_conf > 0.5 else 0.6
    inside = (env.pot.lo*(1/m) <= potential <= env.pot.hi*m and
              env.den.lo <= density <= env.den.hi and
              coil_stress <= env.stress_max)
    return 'run' if inside else 'TRIP -> safe hold'

This candor is deliberate. The supervisor's job is not to prove the plug works — that is what the machine is being built to test — but to guarantee that if the plug behaves outside the modeled regime, the reflex tier notices and trips before anything is damaged. It is inseparable from plug-coil overstress protection and the ambipolar potential envelope.

None of this asserts the plug will work; the machine is being built to find that out. The supervisor's mandate is narrower and honest: guarantee that if the plug leaves the modeled regime, the reflex tier detects it and trips before damage, so the physics question can be answered safely. This framing keeps the burner's four open gates — coil stress, operating regime, He-3 supply, and availability — visible in the control design rather than buried under an optimistic assumption.

No net-power claim is made for the burner today; the four honest gates — plug-coil stress, operating regime, He-3 supply, and availability — are documented plainly across this category, and the reflex tier is designed to respect every one.