Trident

Write the limits with their units. Oil temperature is a measure, a value that carries its unit and family (85degC:temperature), and the hold time is a duration. If a gateway sends a reading in millimetres, the comparison faults with a dimension error instead of treating it as the number 85.

const measure oilLimit = 85degC:temperature
const duration holdFor = 90s

enum Severity { Watch = 1, Alarm = 2, Trip = 3 }

Severity classify(measure oil, duration over) {
    if (oil > oilLimit && over >= holdFor) {
        return Severity.Alarm
    }
    return Severity.Watch
}

Admit each reading with expect. A gateway document is a chest, so its fields are only claims until something checks them. expect checks every named field and its complete type before it binds any of them. A reading that fails takes the else arm, and that arm must leave. The when names all three severities, so adding a fourth stops the build at every when that does not handle it.

text admit(chest reading) {
    expect { text station, measure oil, duration over } = reading else {
        t.log.warn("reading refused: station, oil or over is missing")
        return "refused"
    }
    Severity level = classify(oil, over)
    return when (level) {
        is Severity.Watch { use "log" }
        is Severity.Alarm { use "page" }
        is Severity.Trip { use "page and shed load" }
    }
}

Scan the replay with a stated bound. After a 90-second link drop, a gateway replays up to 600 buffered readings. repeat fixes its pass count before the first pass, and Trident has no while, so the scan ends when the buffer does.

i32 firstHot(measure[] backlog) {
    i32 found = -1
    repeat (backlog.count(), i32 i = 0) {
        measure reading = backlog[i]
        if (reading > oilLimit) {
            found = i
            break
        }
    }
    return found
}

Page once per substation, under a deadline. The host delivers each alarm to the on event handler as one bounded call. lock? holds the key page:SS-07 under an exclusive policy, so the second gateway's alarm takes the else arm instead of paging again. The page itself runs in a task with a 2-second deadline; a timeout or a refused request runs the task's own else arm, and the handler carries on.

void pageCrew(text station) {
    chest policy = t.sync.policy.exclusive(0ms, 10m, false)
    lock? ("page:" + station, policy) {
        task (duration = 2s) {
            buffer body = t.buffer.fromText(`station={station} reason=oil`)
            chest reply = t.net.http.post("https://pager.ridgeline.example", "/v1/pages", [], body)
        } else (e) {
            text why = e.message
            t.log.error(`page for {station} failed: {why}`)
        }
    } else {
        t.log.info("page already open for " + station)
    }
}

on event("OilAlarm", chest alarm) {
    expect { text station, measure oil, duration over } = alarm else {
        return
    }
    if (classify(oil, over) == Severity.Alarm) {
        pageCrew(station)
    }
}

Run it under a grant. Every library call goes through the grant the host builds at launch, and the application's _grant/grant.draft can only narrow it. The compiler derives every library the program calls, so a grant that revokes outbound HTTP stops the alarm service before main runs and names the call that needed it. The real service revokes only process launch.

$ cat oilalarms/_grant/grant.draft
u16 schemaVersion = 1
text[] revoke = ["t.net.http", "t.proc"]

$ tricli oilalarms
tricli: lend: revoked: t.net.http
tricli: a/ reaches t.net.http.post, and _grant/grant.draft revokes t.net.http
tricli: falseStart: grant