Off by default. Arming lets the engine auto-attach.
While armed, each Sensor-mode IP that already has a saved rollout is watched: it switches from passthrough to enforcing above the threshold, then reverts after recovery. Always-on and Off IPs are left untouched.