Device control needs two kinds of truth: what the last recorded state says, and whether the device is still live enough for that state to be trusted. ROOK keeps those signals separate.
[Visual 5.2 - A four-position traffic light labelled live, stale, draining and stopped. Beside it, three controls are separated by vertical lines: pause new work, drain current work, and stop all. A heartbeat line feeds the live position and fades into stale when its lease expires.]
The traffic light
A recent heartbeat can show a device as live. If the heartbeat becomes too old, the surface marks the device stale rather than repeating an old healthy state forever. Draining means no new work should begin while current work reaches a boundary. Stopped means work is not running.
The traffic light is therefore a view of recorded state plus liveness. It is useful because it can become honest-down when contact is lost. It is not proof that every process inside the device is healthy.
Controls have different reach
Pausing new work, draining a device and stopping all work are different actions. A drain leaves room for the current unit to finish and record its boundary. Stop-all is the broad emergency boundary. Keeping the controls distinct prevents a quiet pause from being mistaken for an immediate stop.
Limit
The surface derives status from the latest record and heartbeat lease. Delayed messages, a lost connection or an origin failure can make the view stale. ROOK's design is to show that uncertainty, not to promise that a traffic light can never be wrong.
Next
Continue to status and limits.