One roll, end to end.

The card is known before it is touched.

A volume mounts. R2-D3 identifies enrolled media by its own identity and tracks it by generation — not by drive letter, and not by whatever the operating system decided to call it this time. A remount is never mistaken for a fresh card.

An identity it cannot resolve is not guessed at. The tile blocks and asks for one tap of classification rather than quietly assuming.

The preset decides, then the plan is locked.

How many verified copies this roll needs, which destinations receive them, the folder shape, and what runs afterwards all come from the show’s preset — not from a judgement call at hour eighteen. The plan is made immutable before a byte moves, so what executes is exactly what was consented to.

plan   A017   locked 02:18:44Z   sha256 4e1b…c7a9

  source        CFexpress · A017 · 342 files · 2.19 TB
  destination   RAID-A        /vol/RAID-A/DAY07/A017
  destination   SHUTTLE-03    /vol/SHUT03/DAY07/A017
  min_copies    2
  after_gate_1  retained copy → Resolve prep → proxies → QC
  preset        deeplink-day · signed · pinned

OffShoot Pro moves the bytes.

R2-D3 hands the locked plan to OffShoot Pro, which performs the copy with source & destination verification and writes the ASC-MHL. R2-D3 is not in the data path. It follows a durable event spool, so a restart, a sleep, or a full overnight does not lose track of what was in flight.

Coverage is proved, not assumed.

Checksums are compared, and the ASC-MHL must cover the exact transfer group with per-destination transfer IDs. Partial coverage is a failure. A mismatched checksum is a failure. A destination that dropped mid-write is a failure — and a failure is loud, specific, and never auto-continued.

Reading the ASC-MHL proves the shape and coverage of the evidence; it is not a second byte-level re-hash. Only an explicit ascmhl verify run produces an independent reverify receipt, and it is recorded as exactly that.

Everything else happens after the boundary, never across it.

Retained copies, Resolve preparation, proxies and dailies, metadata and sound reconciliation, QC, direct Frame.io upload, signed reports. All of it is enrichment and delivery, and all of it begins only once a gate has already passed.

Workflow code cannot issue a safety verdict, alter custody evidence, or reach a permit. That is a structural boundary, not a policy — the custody core sits outside workflow authority, and workflows are content-addressed bundles that must rehearse against faults before they are allowed to run on a show.

The format decision.

Only when the evidence agrees — verified destinations at or above min_copies, complete MHL coverage, the source snapshot, the mount instances, the locked preset, operator consent, and a committed operations transaction — does the verdict turn green.

Formatting itself belongs to the native host. The safety kernel can only hand over a short-lived, one-use signed permit bound to this mount instance. Ambiguity, a stale mount, or a host that does not answer all end the same way: the card is left untouched.