Day 18 — Teleop+policy logging / replay / dataset hygiene

Day 17 owned RuntimeSafetySupervisor above teleop / policy / arbiter — kill-chain WARN → INHIBIT_SOFT → DEMOTE_CONTACTS → TORQUE_SCALE_CLAMP → ESTOP, soft inhibit / demote / freeze, hard clamp / ESTOP only through Day 05 BMS / torque_scale / FOC. Day 16 owned SharedAutonomyArbiter with TeleopCommand / OperatorIntent + LearnedPolicy as co-equal soft writers. Day 15 owned closed-loop LearnedPolicy under measured ceilings. Day 14–Day 13 owned soft residuals / scene graphs / affordance CLAIM candidates. Day 12–Day 11 owned schedules and measured hand support. Day 09–Day 08 owned recovery abort and gait vs measured contact_set. Day 07 owned the feasible program. Day 06 owned the estimate. Day 05 owned sag honesty and torque_scale.

Today owns EpisodeLogger / ReplayHarness / DatasetHygiene: what you may log from soft writers vs measured contact vs power under a supervisor-armed kill-chain; how replay must preserve age_ms / stage / SimToRealGate honesty and still feed only soft writers; and how dataset labels refuse to treat teleop score / policy reward / supervisor WARN as MEASURED — still no logging plant that writes cones on playback. The twin must inject logging / replay races before free teleop+policy dataset harvest with the supervisor armed.

The logger is not a plant

A “dataset” box that strips age_ms, relabels WARN as MEASURED, plays back teleop as friction cones, dual-writes torque_scale on export, or trains on OPERATOR_OVERRIDE as ground truth is detector-as-constraint-truth wearing a bagfile. Logging ticks at mid / host rate with clock_domain and age_ms — not µs / EtherCAT cyclic until jitter is measured and budgeted. Soft channels stay soft forever. Measured channels stay measured forever. Replay is soft. Day 08 gait and Day 09 recovery still outrank soft holds. Day 05 still owns ceilings. Day 17 kill-chain still arms. Days 14–17 never_hard still binds.

Core thesis: an EpisodeLogger captures soft teleop / policy / arbiter / supervisor channels and measured EstimatorState / ContactState / PowerState / BusHeader / torque_scale under one schema shared by physical and twin. A ReplayHarness plays soft channels back into soft writers only — never attaching friction cones, never writing JointCommand as if measured, never dual-writing torque_scale. DatasetHygiene refuses label promotion: teleop score / policy reward / blend score / supervisor stage $\neq$ MEASURED. Replay must preserve age_ms, kill-chain stage, SimToRealGate, POWER_GATED, and residual disagree — never “clean” them away for prettier training. Episodes that reward-hacked past WARN, used OVERRIDE to fight inhibit, missed POWER_GATED, promoted without measure, dual-wrote torque_scale, or had false-green SimToRealGate are quarantined; late-kill / demote / ESTOP episodes are kept as valuable negatives. There is still one QP face and one hard torque ceiling owner. The twin must inject logging / replay races (stale age stripped on export, WARN relabeled MEASURED, replay writing cones, clock skew dropping stage, training on OVERRIDE-as-ground-truth, honesty cleaned for pretty bags) before free teleop+policy dataset harvest with the supervisor armed.

Ownership rule: one writer for logger schema + label taxonomy, one writer for replay soft feeds, one writer for hygiene quarantine decisions, one writer for supervisor stage + soft inhibit, one writer for Day 05 torque ceilings / hard kill latch, one writer for teleop soft commands, one writer for policy soft actions, one writer for arbiter soft blend, one writer for schedule intent, one writer for measured contact_set. When they disagree on constraints, measured contact wins for cones. When they disagree on torque ceilings or ESTOP, Day 05 / supervisor hard path wins — replayed OPERATOR_OVERRIDE included. Intent aborts, softens, retimes, or waits — it does not promote OBJECT because a bag said the stick was confident. Day 08 gait and Day 09 recovery still outrank a stuck replayed hold; document freeze-vs-recovery preempt so the twin cannot invent a deadlock on playback.

How today fits the Days 05–17 stack

Do not bolt a “logging plant” that writes JointCommand or attaches cones beside the QP when a bag plays back. That is Day 10’s second-plant anti-pattern wearing a rosbag sticker.

Label taxonomy (refuse soft→MEASURED promotion)

Every logged sample carries an explicit label class. Soft scores never promote into measured membership by rename.

Promotion refusal rules (all required):

1. Teleop confidence / policy reward $r$ / blend weight $\alpha$ / supervisor stage score $s$ satisfy soft score $\neq$ MEASURED, and stage $s$ (WARN … ESTOP) $\neq$ contact_set membership.
2. Relabeling WARN → MEASURED (or reward → cones) is a hygiene fault, not a preprocessing option.
3. OPERATOR_OVERRIDE bags remain LABEL_SOFT_INTENT; OVERRIDE-as-ground-truth is quarantined.
4. never_hard: true on soft logged channels — API and runtime refuse soft→hard promotion in export and in replay.
5. Logger / replay / hygiene tick at mid / host rate with age_ms — never inside the current loop or EtherCAT cyclic write path until jitter is measured and budgeted; no nets in µs loops reconstructing cones from bags.

Quarantine and keep-negatives are success paths when the operator hallucinated, the blend lied, the policy hacked past WARN, the pack sagged, the twin showed a late kill, or someone tried to pretty-print honesty out of the bag. A dataset that always looks green after export is ignoring Day 05–17 with prettier parquet.

Ownership conflict: logger vs replay vs hygiene vs soft vs measure vs gait vs recovery vs power

Logging under shared autonomy is where teams accidentally create a ninth writer on support constraints and a second writer on torque_scale “for training fidelity.” Freeze the split:

Hard vs soft: support constraints on measured FOOT / HAND / OBJECT stay hard. Soft EE and arbiter refs live only on FREE limbs. Logged soft intents and replayed soft intents are softer still — they propose and freeze, they do not feed cones. Hard kill / clamp is owned only by Day 05. If the QP goes infeasible under an expanded set during replay, demote / abort / soften — do not silently drop an object cone so the bag “makes it safe.”

What you may log (channel map)

Log both soft and measured. Tag everything. Do not invent a parallel “training bus” that erases Day 05–17 contracts.

Physical ↔ digital pairing for logging / replay

If the twin always exports green bags with full packs while hardware sees late trips, false greens, OVERRIDE spam, stripped age, and dual-writers, you will train forever on theater and never ship a CLAIM that survives a tired bus or a race you only passed in slides.

Mid-event logging / replay honesty

Shared-autonomy mid-rate paths are where teams “clean the bag just until the trainer finishes the epoch.” Do not.

Abort, demote, clamp, ESTOP, quarantine, and keep-negatives are success paths when the operator, the policy, the blend, the pack, the exporter, or the race lied mid-CLAIM.

Shared API: EpisodeLogger / ReplayHarness / DatasetHygiene above Day 17 shapes

Keep Day 02 / 04 wire honesty. Cyclic commands still carry BusHeader. Extend Day 17 supervisor / Day 16 arbiter / Day 15 policy / Day 14 residual / Day 13 AffordanceProposal / Day 12 ContactSchedule / Day 05 power — do not invent a parallel “training bus” or second plant:

BusHeader:
  node_id, seq
  t_sample, clock_domain, age_budget_ms
  faults

# Upstream (read-only for logger; does not replace owners)
EstimatorState, PowerState  ⊇ BusHeader
ContactState ⊇ BusHeader:
  contact_set[]        # feet, hands, AND objects when measured
  SupportContact:
    link_id / frame
    kind               # FOOT | HAND | OBJECT
    mu, normal, wrench_est?
    confidence, age_ms
    flags              # settling / flicker / gated / grasp_lost
    parent_grasp_id?

# Soft teleop / policy / arbiter — Day 16 unchanged; inhibitable; loggable
TeleopCommand / OperatorIntent  ⊇ BusHeader
  # still never_hard; still age_ms; OVERRIDE still soft only

LearnedPolicy / PolicyAction / PolicyCommand  ⊇ BusHeader
  # still never_hard; still closed_loop + age_ms

SharedAutonomyArbiter ⊇ BusHeader:
  mode                 # … | SAFE | ABORT
  # still never_hard; still yield_to GAIT | RECOVERY | POWER
  supervisor_ref?

RuntimeSafetySupervisor ⊇ BusHeader:
  stage                # GREEN | WARN | INHIBIT_SOFT | DEMOTE_CONTACTS
                       # | TORQUE_SCALE_CLAMP | ESTOP
  monitors[]
  soft_intent / hard_kill_request
  # still never_hard_soft_intents; hard kill via Day 05 only

# Optional Day 14 soft feeds — still never_hard; loggable honesty
LearnedResidual / SoftSceneGraph  ⊇ BusHeader

# Episode logging (host / mid-rate)
EpisodeLogger ⊇ BusHeader:
  episode_id
  schema_version
  channels[]:
    name               # teleop | policy | arbiter | supervisor |
                       # estimate | contact | power | gate | residual | …
    label              # LABEL_SOFT_INTENT | LABEL_SUPERVISOR_STAGE |
                       # LABEL_MEASURED_CONTACT | LABEL_POWER |
                       # LABEL_ESTIMATE | LABEL_GATE | LABEL_NEGATIVE_KILL
    payload_ref
    age_ms_preserved: true
    stage_preserved: true
    gate_preserved: true
    power_gated_preserved: true
    residual_disagree_preserved: true
  strip_honesty: false           # API refuses true on free-export path
  same_schema_phys_twin: true
  tick_rate_hint_hz              # mid / host — not µs cyclic
  age_ms
  never_promote_soft_to_measured: true
  block_free_harvest_until_hygiene_green: true

ReplayHarness ⊇ BusHeader:
  episode_id
  mode                 # SOFT_ONLY   # hard plant modes forbidden
  feeds                # TELEOP | POLICY | ARBITER   # soft writers only
  reinject:
    age_ms: true
    supervisor_stage: true
    sim_to_real_gate: true
    power_gated: true
    residual_disagree: true
  forbid:
    attach_cones: true
    write_joint_command_as_measured: true
    dual_write_torque_scale: true
    write_contact_state_membership: true
  never_hard: true
  yield_to             # GAIT | RECOVERY | POWER
  age_ms
  block_if_honesty_stripped: true

DatasetHygiene ⊇ BusHeader:
  decision             # ADMIT | QUARANTINE | KEEP_NEGATIVE
  reasons[]:
    reward_hack_past_WARN
    override_fought_inhibit
    missed_POWER_GATED
    promote_without_measure
    dual_write_torque_scale
    false_green_SimToRealGate
    soft_relabeled_MEASURED
    age_or_stage_stripped
    replay_plant_attempt
    clock_skew_dropped_stage
    override_as_ground_truth
  keep_negatives:
    late_kill: true
    demote: true
    ESTOP: true
    honest_WARN_trips: true
  refuse_soft_to_measured: true
  age_ms
  block_free_harvest_until_green: true

# Day 05 hard path — ONE owner (logger records; replay never dual-writes)
PowerState / BmsCommand ⊇ BusHeader:
  torque_scale
  POWER_GATED
  clamp_request_src?   # SUPERVISOR | BMS | ...
  estop_latch
  clear_requires_human: true

# Soft perception / schedule — Day 13–17 + hygiene demote / quarantine
AffordanceProposal ⊇ BusHeader
ContactSchedule ⊇ BusHeader

SimToRealGate ⊇ BusHeader:
  status               # RED | YELLOW | GREEN
  checks[]:
    # … Day 14–17 checks …
    stale_age_stripped_on_export
    WARN_relabeled_MEASURED
    replay_writing_cones
    clock_skew_dropped_stage
    OVERRIDE_as_ground_truth
    honesty_cleaned_for_pretty_bags
    missed_POWER_GATED_in_training_path
    dual_writer_torque_scale_on_playback
  age_ms
  block_free_dataset_harvest_until_green: true

ManipulationCommand / WbcTaskSet / JointCommand
  # Day 16–17 shapes unchanged — logger/replay never write JointCommand
  # as-if-measured or attach cones; CEIL comes from Day 05 only

Higher layers publish teleop commands, policy actions, arbiter blends, residual corrections, affordance candidates, schedule intent, supervisor soft intents, and logged / replayed soft feeds. Measured ContactState owns support membership. Day 05 owns torque ceilings and ESTOP latch. Gait and recovery keep their writers. Nobody re-implements FOC, AHRS, or friction cones inside the logger, the replay harness, or the hygiene quarantine path.

Bring-up sequence (before free teleop+policy dataset harvest with supervisor armed)

Days 07–17 green (stance, step, recovery, FREE-hand reach, measured hand SUPPORT / loco-manip, scripted multi-contact / OBJECT handoffs, gated affordance CLAIM, residual / scene soft feeds, closed-loop policy with SimToRealGate green, teleop / blend / OVERRIDE mid-arbitration honesty, supervisor race gallery green with kill-chain armed). Then:

1. Days 07–17 green — teleop / policy / arbiter / residual / affordance admit / supervisor paths still behave; never_hard still enforced; OVERRIDE still cannot attach cones or skip MEASURE; hard kill still only through Day 05.
2. Logger dry-run (label taxonomy) — arm EpisodeLogger with all channels tagged; confirm soft vs measured vs power vs supervisor labels; confirm age_ms / stage / gate / POWER_GATED / residual disagree preserved; confirm strip-honesty API refuses; confirm no accidental cone invent on export.
3. Replay soft-only + honesty reinject — play bags into teleop / policy / arbiter soft writers only; confirm cones / JointCommand-as-measured / dual-write torque_scale rejected; confirm age / stage / gate / power honesty reinjected; confirm OVERRIDE replay still soft; confirm MEASURE still required before PROMOTE.
4. Hygiene quarantine + keep negatives — inject reward-hack past WARN, OVERRIDE fight, missed POWER_GATED, promote-without-measure, dual-write, false-green gate, soft-relabeled-MEASURED; confirm quarantine; confirm late-kill / demote / ESTOP / honest WARN kept as LABEL_NEGATIVE_KILL.
5. Twin race gallery + SimToRealGate — twin injects stale age stripped on export, WARN relabeled MEASURED, replay writing cones, clock skew dropping stage, OVERRIDE-as-GT, honesty cleaned for pretty bags, missed POWER_GATED in training path, dual-writer on playback; confirm escalate / reject / quarantine; SimToRealGate must go GREEN before free harvest.
6. Then run free teleop+policy dataset harvest with supervisor armed and logger / hygiene gates green — never replace cones, FOC, torque_scale ownership, gait, recovery, measured ContactState, or Day 17 kill-chain. Offline evaluation / shadow mode / canary deploy under supervisor + logging gates waits for Day 19+.

Skip to “dump every stick demo into the trainer with a cleaned bag” and hardware’s first operator-ranked rail grasp becomes an unplanned tip / brownout experiment with better wandb curves.

Failure gallery

What to freeze this week

Extend frames and your control / logging config with:

• EpisodeLogger fields: episode_id, schema_version, channels[] with explicit label taxonomy (LABEL_SOFT_INTENT | LABEL_SUPERVISOR_STAGE | LABEL_MEASURED_CONTACT | LABEL_POWER | LABEL_ESTIMATE | LABEL_GATE | LABEL_NEGATIVE_KILL), age_ms_preserved / stage_preserved / gate_preserved / power_gated_preserved / residual_disagree_preserved: true, strip_honesty: false, same_schema_phys_twin: true, never_promote_soft_to_measured: true
• ReplayHarness fields: mode: SOFT_ONLY, soft feeds only (TELEOP | POLICY | ARBITER), reinject age / stage / gate / power / residual, forbid cones / JointCommand-as-measured / dual-write torque_scale / ContactState membership writes, never_hard: true, yield_to GAIT | RECOVERY | POWER
• DatasetHygiene decisions: ADMIT | QUARANTINE | KEEP_NEGATIVE; quarantine reasons (reward-hack past WARN, OVERRIDE fight, missed POWER_GATED, promote-without-measure, dual-write, false-green gate, soft-relabeled-MEASURED, age/stage stripped, replay-plant attempt, clock skew, OVERRIDE-as-GT); keep late-kill / demote / ESTOP / honest WARN as negatives
• Explicit rule: teleop score / policy reward / blend score / supervisor stage $\neq$ MEASURED; soft channels never write JointCommand, friction cones, FOC $i_q$, or ContactState on log or replay
• Explicit rule: Day 17 supervisor stays armed during log / replay / harvest; hard kill still only through Day 05; OPERATOR_OVERRIDE cannot bypass kill-chain hard stages, BMS, gait, or recovery — including on playback
• Who owns logger schema + labels vs replay soft feeds vs hygiene quarantine vs supervisor stage + soft inhibit vs Day 05 hard kill latch vs teleop soft vs policy soft vs arbiter soft blend vs schedule intent vs measured contact_set vs gait vs recovery (disagree on cones → measured wins; disagree on ceilings / ESTOP → Day 05 / supervisor hard path wins)
• Documented recovery preempt vs replayed freeze ordering
• Rate / jitter budget: logger / replay / hygiene at mid / host rates with age_ms; forbidden inside µs / EtherCAT cyclic until jitter measured; no nets reconstructing cones in µs loops
• Twin hooks: stale age stripped on export, WARN relabeled MEASURED, replay writing cones, clock skew dropping stage, OVERRIDE-as-GT, honesty cleaned for pretty bags, missed POWER_GATED in training path, dual-writer on playback — same as hardware; SimToRealGate blocks free harvest until GREEN
• Bring-up gate: no free teleop+policy dataset harvest with supervisor armed until steps 1–5 above are green

The lesson is not “log everything until the trainer looks busy.” It is make teleop+policy logging the same contact-rich program in silicon and in the twin: an EpisodeLogger that tags soft vs measured vs power vs supervisor without promoting scores to MEASURED, a ReplayHarness that feeds soft writers only and reinjects age / stage / gate honesty, DatasetHygiene that quarantines dishonest episodes and keeps late-kill / demote / ESTOP as valuable negatives, measured FOOT/HAND/OBJECT still owning the hard support set, one estimate, honest power ceilings, Day 17 kill-chain still armed, schedules that wait for measurement and yield to gait/recovery, soft tasks only where soft belongs, logger / replay ticks outside µs loops until jitter is honest, Days 14–17 never_hard still binding, and quarantine / keep-negative / SimToRealGate paths that stay honest when the operator, the policy, the blend, the exporter, the race, or the sim lies mid-CLAIM.

Next

Day 19+ — Offline evaluation / shadow mode / canary deploy of policies under supervisor + logging gates: score policies against quarantined-vs-admitted bags without writing cones, run shadow inference beside live soft writers with Day 17 kill-chain armed, and canary promote only when DatasetHygiene + SimToRealGate stay green — still no deploy plant that bypasses MEASURE or Day 05 ceilings.