An Auditable Human-Centric Architecture for EEG-Triggered Fragrance Selection During Sleep Preparation

Consumer electroencephalography (EEG)-triggered fragrance delivery raises a narrow control problem: a noisy state estimate must not bypass user authority, and each actuator decision should remain reconstructible. We present a domain-specific control architecture that maps versioned Sleep Readiness Index (SRI) records to bounded ranking among three user-authorised cartridge identifiers. Input quality, permission, exposure limits, and an independent stop monitor constrain every proposed pulse. For 105 synthetic records with complete strict-v1 metadata, the validator derived Q=1 for every record, committed a 29-record baseline, completed two simulated acknowledged pulses with one completed cooldown, entered Stop at the fixture cap, issued one DISARM, and verified a 114-event hash chain. A paired legacy OSC fixture used legacy profile and provenance fields and lacked source continuity telemetry; it accepted no quality-eligible record, remained in Calibrate, and emitted no proposal. The replay validates controller mechanics and software consistency only: its acknowledgements, SRI changes, and rewards are synthetic, and no cartridge–SRI relationship, meaningful preference learning, device operation, physiological benefit, or sleep improvement is demonstrated.