R2-D3 is smart so the operator doesn’t have to be — at 2am, on hour eighteen.

The hard parts of on-set data management already have good tools. What a DIT does not have is one thing that runs them in the right order, against the right destinations, the same way on every card, and then proves it.

R2-D3 is that conductor. The preset — not the operator at hour eighteen — decides how many verified copies a roll needs and where they go. R2-D3 sequences the tools, reads back what they actually did, and holds the record.

R2-D3 never writes to a camera card, and it holds no copy engine of its own. If OffShoot did not verify it, R2-D3 will not call it verified.

A roll is marked safe to format only when at least min_copies verified destinations exist in the ASC-MHL, with matching checksums, correlated to the exact transfer group and per-destination transfer IDs. The source snapshot, destination mount instances, locked preset, operator consent and the durable operations record all have to agree.

There is no operator override for this. Any ambiguity — a stale mount, a partial MHL, a host that did not answer — fails closed and leaves the card untouched.

gate-1   roll A017

  transfer_group    tg_2026-07-14T02.18.44Z_A017
  min_copies        2
  verified_dests    2      RAID-A · SHUTTLE-03
  mhl_coverage      342 / 342 files
  checksum_method   xxh64
  consent           recorded — DIT, unit B
  operations_txn    committed

  verdict           SAFE_TO_FORMAT

<hash>
  <path size="4294967296">A017/A017C003_260714_R1AB.mxf</path>
  <xxh64 action="verified" hashdate="2026-07-14T02:41:07Z">9f3c1d7a4b2e8c60</xxh64>
</hash>

Stated precisely, because it matters: parsing the ASC-MHL proves the shape and coverage of the evidence. It is not a second byte-level re-hash. Only an explicit ascmhl verify run produces an independent reverify receipt, and R2-D3 records it as exactly that.

Alarm is a scarce resource. A healthy transfer and a signed-in operator are the normal state, so the board says nothing about them. Colour appears when a roll’s state demands attention, and nowhere else. Success is stated, never celebrated.

When R2-D3 refuses an action, it names what failed — which roll, which destination, which check, what evidence exists, and what would make it safe. There is no generic error state, and nothing auto-continues past a failed verify.

Every new knob is a chance for a mistake at 2am. The defaults are the safe, correct choice for a real show, and the interface is designed to be read across a cart in the dark: dark-first, high contrast, all machine data in fixed-width type so a wrong digit is obvious.