feat: give the operator a control for each interlock, in the interface - #119

_{P1 Badge} Keep Start available after disabling an interlock

When a disable command sent here succeeds, the production SafetyManager adds a software_interlock_disabled readiness blocker; the next typed OperatorSnapshot makes MainWindowV2 call KeithleyPanel.set_safety_ready(False), which disables every per-channel Start button and Start A+B. test_toggle_does_not_disable_any_control misses this because its command stub never delivers the resulting typed snapshot, so the exact operator scenario called out in the review still greys out Start.

AGENTS.md reference: AGENTS.md:L380-L386

Useful? React with 👍 / 👎.

_{P1 Badge} Populate the panel from a production state source

On a normal launch this always passes None: production SafetyManager._publish_state() publishes only disabled_interlocks, while the complete rows are available only from the interlock_status command, which neither this panel nor the window requests. Consequently _last_interlocks is never populated, _rows stays empty, and the operator sees no controls after startup or Engine reconnect; the tests hide this by manually adding engine.get_operator_state() to synthetic safety telemetry, a condition production never supplies.

AGENTS.md reference: AGENTS.md:L380-L386

Useful? React with 👍 / 👎.

_{P1 Badge} Reconcile replies that report a committed transition

When interlock_set_enabled persists and applies the transition but later experiment-provenance settlement fails, the engine deliberately returns ok: false, committed: true with interlock_toggle_reconciliation_failed. This branch treats that as an ordinary rejection and neither updates nor re-queries state, so a successfully disabled interlock can remain displayed as enabled and the operator may retry under a false premise; committed/unknown outcomes need reconciliation against engine-owned state instead of retaining the old row.

AGENTS.md reference: AGENTS.md:L490-L491

Useful? React with 👍 / 👎.

_{P1 Badge} Make repeated Disable clicks idempotent

During ordinary command latency the row keeps its old enabled state, so a double-click starts two workers with different request IDs and both request enabled=False. With an active experiment the first transition creates the open provenance interval, but the second same-state transition replaces the engine's persisted disable_receipt while record_interlock_operator_state() leaves the existing interval bound to the first receipt; on restart, sync_interlock_operator_provenance() cannot find an interval for the second receipt and Engine startup fails. Coalesce an in-flight same-row action or make the command/state owner reject same-state transitions without creating a new receipt.

AGENTS.md reference: AGENTS.md:L20-L22

Useful? React with 👍 / 👎.

_{P1 Badge} Show the exact trigger condition before allowing Disable

The engine state already includes comparison and threshold, but canonicalization drops both, so the panel shows channels and eventual action without the boundary whose enforcement is being suppressed. The shipped descriptions do not supply those values—for example the operator cannot see that detector_warmup is the 10 K guard or distinguish the 320 K and 350 K overheat guards—yet Disable executes in one click; displaying these fields read-only would preserve the intended non-editable scope while making the reduction in protection understandable.

AGENTS.md reference: AGENTS.md:L529-L536

Useful? React with 👍 / 👎.

_{P1 Badge} Bind toggles to the displayed engine policy

After an Engine disconnect the window deliberately retains these rows as stale and leaves their buttons actionable, but this command binds only the interlock name and desired boolean. If the reconnected Engine reuses that name with changed channels, threshold, or protective action, clicking the retained row applies the new policy while the operator is still looking at the old consequence; transport mutation compatibility does not bind the displayed policy. Include the displayed policy fingerprint and Engine generation in the request and reject a mismatch without greying out the control.

AGENTS.md reference: AGENTS.md:L533-L536

Useful? React with 👍 / 👎.

_{P1 Badge} Reject telemetry older than an accepted toggle receipt

This applies the command reply without advancing any state revision or timestamp high-water mark. Because command replies and analytics/safety_state arrive over independent ZMQ paths, a fresh-but-pre-command telemetry packet can be processed afterward; _dispatch_safety_evidence() compares it only with the last telemetry timestamp and will overwrite the newly disabled row with its older enabled snapshot. Preserve changed_at or a monotonic state revision from the accepted reply and reject older snapshots so a confirmed OFF state cannot transiently render as ON.

AGENTS.md reference: AGENTS.md:L490-L491

Useful? React with 👍 / 👎.