Day 30 — Collaborative workspace zoning / safeguarded-space attestation: ZoneGeometryAttestor / SafeguardedSpaceMap / CrowdDensityEstimator vs MeasuredOccupancyCount / HandoffCorridorGate / CrossSiteZoneConfigGate / CollaborativeWorkspaceAdmissionGate as measured constraints under supervisor + logging + canary + HIL + fleet + fleet-canary + incident + forensics/reopen + change-management + maintenance + thermal + energy + proximity gates

Day 29 owned ProximityStateEstimator / StoppingDistanceForecaster / ContactForceLimiter / HumanSafetyAdmissionGate: MEASURED separation vs ESTIMATED human motion, a stop-distance twin that shrinks with Day 27 thermal and Day 28 power, SSM envelopes, and HARD ISO/TS 15066-style PFL body-region ceilings. Day 25 owned ConfigAttestation / CrossSiteConfigGate: content-addressed ChangeSets with attested read-back so site A config does not silently become site B’s truth. Day 17 owns the kill-chain, ESTOP, and stage transitions forever. Day 05 owns torque_scale, contactor, UVLO, and STO forever.

Day 29 made proximity honest per cycle. What it did not own — and what every multi-site collaborative cell eventually needs — is the place those cycles happen in: which polygons are collaborative, which volumes are exclusion, which corridors may host a handoff, how many humans are already in the cell, and whether the zone file on this robot actually belongs to this site. “Stay in the green zone” is not a map layer painted once at commissioning. It is attested geometry with a measured read-back, density that feeds SSM, handoff under PFL, and a Day 25 honesty check on every zone ChangeSet.

Today owns ZoneGeometryAttestor / SafeguardedSpaceMap / CrowdDensityEstimator vs MeasuredOccupancyCount / HandoffCorridorGate / CrossSiteZoneConfigGate / CollaborativeWorkspaceAdmissionGate. The question is: what space is this robot allowed to treat as collaborative, how many humans are actually in it, can a handoff stay under Day 29 ceilings with a funded retreat, and how do you refuse a zone map that belongs to another building — without ever writing Day 17’s ESTOP or Day 05’s torque_scale?

Zone geometry is measured read-back. Density forecast is soft. Handoff is Day 29 under a corridor contract.

A surveyed polygon on a commissioning tablet is not yet a zone. Vertices from a total station or a carefully walked LIDAR survey, frozen into a content-addressed ChangeSet, signed as HARD_SAFETY, soaked through Day 25 rings, and read back from the robot’s attested config store — that is a zone. A weekly vision/LIDAR re-attestation that the physical landmarks still match the polygon hash is MEASURED evidence the geometry has not silently moved (rack relocated, temporary fence, new tote wall). A planner “preferred corridor” polyline the motion stack likes is SOFT paint: useful for routing, never a substitute for the attested safeguarded-space boundary.

Occupancy splits the same way Day 28 split energy and power. How many confirmed human tracks are in this cell right now is MEASURED (MeasuredOccupancyCount). How crowded the aisle will be in four minutes is ESTIMATED / SOFT (CrowdDensityEstimator). The soft forecast may refuse to send another robot; the gate still checks the measured count and every Day 29 track. Density does not replace SSM — it keeps you from needing SSM for eight people at once.

So the honest labels are:

The first rule of today: admit collaborative work only inside attested geometry, on measured occupancy, under Day 29 SSM/PFL that already know Day 27/28 headroom, with a zone config whose site_id matches the robot’s site. Soft density and soft corridors may only shrink or refuse — they never author HARD space.

Core thesis: a collaborative humanoid does not “know the floor plan.” It carries an attested safeguarded-space map whose geometry is MEASURED at survey and re-attested at runtime, an occupancy count that is MEASURED while density forecasts stay soft, a handoff corridor that is Day 29 PFL+SSM under a typed contract, and a cross-site gate that fails closed when the map’s site_id is not this building. Zones shrink what Day 29 must handle; they never replace it. Soft never writes Day 17, Day 05, or Day 25 HARD_SAFETY ChangeSets.

Attested geometry, not planner paint

A safeguarded space in the ISO collaborative sense is a typed region with an allowed interaction mode. For today, each polygon or volume in SafeguardedSpaceMap carries at least:

• site_id, map_version, changeset_hash (Day 25 content address)
• kind: COLLABORATIVE | EXCLUSION | HANDOFF_CORRIDOR | TRANSIT | …
• mode_bit: collaborative SSM/PFL allowed or not (HARD, attested)
• density_limit_hard / density_limit_warn (humans per m² or absolute $N$)
• vertex[] or mesh reference in a surveyed frame, with survey residual and date

Read-back is the point. On boot and on every zone ChangeSet apply, ZoneGeometryAttestor requires:

to equal the signed ChangeSet hash, and site_id to equal the robot’s attested site identity (badge, garage config, Day 25 site binding — same honesty as pack_id on Day 28). A file that verifies cryptographically but carries SITE_A while the robot is bound to SITE_B is RED, not “close enough.”

Runtime re-attestation is MEASURED, not ceremonial. Pick stable landmarks (column bases, dock fiducials, surveyed reflectors). LIDAR/vision reports a residual. If the residual leaves the validated band — rack moved, temporary fence, construction — the map is YELLOW/RED until a new HARD_SAFETY ChangeSet is surveyed and soaked. Soft SLAM “the floor moved a bit” does not rewrite HARD vertices.

Density feeds Day 29 SSM — it does not replace it

Day 29 already said: every confirmed track enters the envelope; unknown occupancy fails closed; crowd density is a soft forecast feeding the same gate. Today makes that concrete.

Let $N$ be MeasuredOccupancyCount in the cell (valid tracks only). Let $A$ be the attested free area of the collaborative polygon. Then

is MEASURED density now. The soft estimator publishes $\hat\rho(t{+}H)$ for the scheduler. The gate’s hard checks:

1. If $N$ or $\rho$ exceeds density_limit_hard → RED for new admits; robots already inside slow/hold under Day 29.
2. Day 29’s $d^{+}_{human}$ and association risk grow with $\rho$ (less room to dodge; more ID-swap chance). Validated coverage must include dense-aisle bags.
3. Soft $\hat\rho$ may only cause the scheduler to refuse or retime; it never raises density_limit_hard, never labels itself MEASURED, never bypasses track-level SSM.

Illustrative teaching numbers (your risk assessment wins):

The dashboard that says “zone clear” while three tracks are valid and one corridor is occluded is lying the same way Day 28’s SOC UI lied under load.

Handoff corridors: Day 29 PFL under a typed contract

Tool and object handoffs are where collaborative cells earn their keep — and where face-adjacent mistakes happen when the human leans in. A handoff corridor is not “the space between robot and person.” It is an attested HANDOFF_CORRIDOR polygon (or volume) plus a corridor contract HandoffCorridorGate consumes:

• Expected contact region (usually HAND/ARM) — gate applies the most restrictive plausible region under uncertainty (Day 29 rule)
• Expected wrench / pressure / energy band below HARD PFL tables
• Timeout and abort → drop to SSM_STOP
• Retreat trajectory whose $d^{+}_{stop}$ is fundable under current Day 27 thermal and Day 28 $P^{-}_{cap}$
• Second-human rule: any new valid track entering the corridor or cell drops contact and re-enters SSM

During the transfer, Day 29 PFL ceilings are armed and MEASURED F/T (and pressure if present) close the loop. SSM’s separation inequality is mode-relaxed for the planned contact, but the retreat must still be fundable, and Day 17 still owns ESTOP on force overshoot, pressure spike, or track loss.

Soft may time the handoff. Soft may prefer a corridor. Soft may not raise a face ceiling, disable pressure because the pad is broken, or skip the retreat fund check because “the human is ready.” Broken pressure in a handoff is RED for PFL_CONTACT — leave contact, SSM_STOP, fix sensing.

Cross-site zone-config honesty

Day 25 taught the pattern; today applies it to floors.

A zone map is a HARD_SAFETY ChangeSet. It climbs the same rings (twin → … → cross-site) with exposure-based soak. CrossSiteZoneConfigGate fails closed when any of:

• desired_hash ≠ attested_readback on the robot
• site_id on the map ≠ robot’s bound site
• ChangeSet unsigned, wrong class (SOFT_POLICY path used for geometry), or mixed-class bundle that sneaks geometry beside a soft policy bump
• Landmark re-attestation residual out of band after apply
• Days 17–29 (and prior fleet gates) RED on the unit

Silent copy is an incident, not a deploy. Copying SITE_A’s beautiful collaborative polygon onto SITE_B because “the aisles look similar” is how a robot treats a pedestrian cut-through as a handoff corridor. The gate does not care that the mesh is pretty. It cares that the hash and site_id match this building’s surveyed truth.

Illustrative failure: SITE_A dock fiducials at (12.0, 4.0); SITE_B dock at (12.0, 4.0) in a different frame origin. Same numbers, different world. Without site_id binding, attestation of the file contents can pass while the robot is wrong by a building. Bind site identity the way Day 28 binds pack_id after a swap — read it back, do not trust the filename.

A worked zoning + density + handoff example

Collaborative cell area $A = 12\,\mathrm{m}^{2}$, with density_limit_warn at $0.25\,\mathrm{m}^{-2}$ ($N=3$) and density_limit_hard at $0.42\,\mathrm{m}^{-2}$ ($N=5$). Robot enters attested COLLABORATIVE polygon; map hash matches; site_id = SITE_A.

Same honesty as Day 29’s aisle table: the UI can say “in zone, handoff ready” while thermal headroom, density, or site binding say no.

Ownership conflicts

Shared API

Same wire discipline as Days 02/04: everything carries BusHeader. Zoning and attestation run on the host; nothing here enters the cyclic current loop. Day 29 monitors and Day 17 remain independent.

BusHeader:
  t_mono
  seq
  clock_domain         # SENSOR for landmarks/tracks; HOST for gates
  age_ms
  producer_id

ZoneVertexSurvey ⊇ BusHeader:            # MEASURED at survey
  site_id
  frame_id               # surveyed world frame
  xyz[]
  survey_residual_m
  survey_time
  bag_ref

LandmarkReattest ⊇ BusHeader:            # MEASURED runtime
  landmark_id
  residual_m
  map_version
  validity

SafeguardedSpaceMap ⊇ BusHeader:         # HARD attested
  site_id
  map_version
  changeset_hash
  polygon[]:
    id
    kind                 # COLLABORATIVE | EXCLUSION | HANDOFF_CORRIDOR | TRANSIT
    mode_bit             # collab SSM/PFL allowed
    density_limit_warn
    density_limit_hard
    vertices_ref
  change_class: HARD_SAFETY
  attestation_hash

ZoneGeometryAttestor ⊇ BusHeader:
  desired_hash
  attested_readback
  site_id_match: bool
  landmark_band_green: bool
  status                 # RED | YELLOW | GREEN

MeasuredOccupancyCount ⊇ BusHeader:      # MEASURED
  cell_id
  n_humans               # validity-green tracks only
  rho
  unknown_occupancy: bool
  label: MEASURED

CrowdDensityForecast ⊇ BusHeader:        # SOFT
  cell_id
  rho_hat
  horizon_s
  label: SOFT
  forbid:
    label_measured: true
    raise_density_limit: true
    write_ssm_tables: true

HandoffCorridorContract ⊇ BusHeader:
  corridor_id
  expected_region        # HAND | ARM | ...
  wrench_band
  timeout_ms
  retreat_trajectory_ref
  require_pfl_armed: true
  require_retreat_funded: true   # Day 29 twin + Day 27/28

HandoffCorridorGate ⊇ BusHeader:
  status
  require:
    in_handoff_polygon: true
    pfl_tables_attested: true
    contact_sensing_green: true
    retreat_funded: true
    second_human_clear: true
  refuse_on[]:
    pressure_failed
    region_uncertainty_uses_loose_ceiling
    retreat_unfunded_thermal_or_power
    timeout

CrossSiteZoneConfigGate ⊇ BusHeader:
  fail_closed: true
  require:
    site_id_match: true
    hash_match: true
    change_class_hard_safety: true
    signed_changeset: true
    landmark_reattest_green: true
  refuse_on[]:
    site_a_map_on_site_b
    soft_policy_path_for_geometry
    unsigned_map
    mixed_class_sneak

CollaborativeWorkspaceAdmissionGate ⊇ BusHeader:
  fail_closed: true
  soft_admit_blocker_only: true
  status               # RED | YELLOW | GREEN
  require:
    zone_geometry_attested: true
    cross_site_zone_config_green: true
    occupancy_fresh: true
    density_under_hard_limit: true
    unknown_occupancy_clear: true
    human_safety_admission_green: true  # Day 29
    handoff_gate_green_if_handoff: true
    energy_admission_gate_green: true   # Day 28
    thermal_admission_gate_green: true  # Day 27
    supervisor_armed: true              # Day 17
    hygiene_honest: true                # Day 18
    offline_shadow_canary_green: true   # Day 19
    regression_gate_green_for_unit: true # Day 20
    fleet_admit_gate_green: true        # Day 21
    fleet_canary_gate_green: true       # Day 22
    no_open_incident_on_unit: true      # Day 23
    canary_reopen_gate_green: true      # Day 24
    cross_site_config_gate_green: true  # Day 25 (general)
    recalibration_gate_green: true      # Day 26
    estop_pairing: true
    day05_binding: true
  refuse_on[]:
    planner_paint_as_zone
    density_forecast_labeled_measured
    site_id_mismatch
    unsigned_zone_changeset
    handoff_without_retreat_fund
    pfl_ceiling_raised_by_soft
    dual_write_torque_scale
    soft_stop_replacing_estop
  forbid:
    joint_command: true
    dual_write_torque_scale: true
    clear_supervisor_stage: true
    write_estop: true
    force_flag: true
    write_hard_safety_changeset: true

# Unchanged owners
SupervisorState (Day 17): ESTOP · kill-chain · stage · monitors
BmsState / PowerState (Day 05): torque_scale · contactor · UVLO · STO
  accepts_requests_from_soft_layer: false
HumanSafetyAdmissionGate (Day 29): SSM · PFL · stop twin
ConfigAttestation / CrossSiteConfigGate (Day 25): ChangeSet honesty

Physical ↔ digital pairing

If the twin cannot replay a near-miss with map_version, measured $N$, Day 29 $d^{-}_{sep}$ / $d^{+}_{stop}$, and whether the handoff retreat was fundable, it cannot set the next zone admit.

Bring-up sequence (before trusting workspace admission)

1. Days 05 and 17–29 green. Day 25 promotion path exists; proximity admission already honest.
2. Survey the site. Vertices in a surveyed frame; residuals recorded; landmarks chosen for re-attestation.
3. Author the zone ChangeSet. HARD_SAFETY: site_id, polygon kinds, mode bits, density limits — not a soft config bump.
4. Soak and attest. Rings as Day 25; every robot read-back must match before collaborative mode arms.
5. Validate landmark bands. Move a rack on purpose; residual must trip YELLOW/RED; silent accept is a failed test.
6. Dry-run cross-site refusal. SITE_A map on SITE_B, unsigned file, geometry via SOFT_POLICY path — every one RED.
7. Couple density to Day 29. Fill the cell to warn/hard; confirm $v^{-}_{max}$ shrinks and admits stop; occlude a volume and confirm fail-closed.
8. Handoff rig. Instrumented hand/arm analogues; retreat under Day 27 hot + Day 28 cold; second-human interrupt.
9. Negative cross-site. Identical numeric vertices, wrong site_id — must RED (frame coincidence trap).
10. Then run a collaborative shift; every zoning incident is a Day 18 bag + Day 24 forensic + twin regression.

Failure gallery

What to freeze this week

Extend frames and your safety config with:

• ZoneGeometryAttestor / SafeguardedSpaceMap: surveyed polygons/volumes as HARD attested geometry with MEASURED landmark re-attestation; never planner paint alone.
• MeasuredOccupancyCount (MEASURED) vs CrowdDensityEstimator (SOFT): density forecast may only shrink scheduler admits; the gate counts valid tracks and fails closed on unknown occupancy.
• Density-scaled Day 29 SSM: $\rho$ widens human bounds and association risk; density_limit_hard is HARD.
• HandoffCorridorGate: typed corridor contract under Day 29 PFL + SSM-funded retreat (Day 27/28 in $d^{+}_{stop}$); second human or sensing loss aborts to SSM_STOP.
• CrossSiteZoneConfigGate: Day 25 ConfigAttestation pattern on zone maps — site_id + hash + HARD_SAFETY ChangeSet; silent cross-site copy is RED.
• CollaborativeWorkspaceAdmissionGate fail-closed on zone attest, occupancy honesty, handoff contract when needed, Days 17–29 green; no dual-write of ESTOP or torque_scale.
• Every zoning/handoff incident in a Day 18 bag, replayed as a workspace-forecaster regression (Day 20/24).

The lesson isn’t “paint a green zone on the floor plan.” It’s that collaborative space is attested geometry plus measured occupancy plus Day 29 ceilings under a corridor contract, with cross-site hash honesty so one building’s map cannot silently become another’s. Soft density and soft corridors may refuse work; they never author HARD space; Day 17 still owns the kill-chain; Day 05 still owns torque.

Next

Day 31 — Shared-control / teleop arbitration under attested zones — ZoneAwareSharedControlArbiter / AuthorityTransferGate / OperatorIntentAdmissionGate / SharedControlAdmissionGate: Day 16 shared autonomy deepened under Day 30 CWAG and Day 29 SSM/PFL; zone- and proximity-aware TELEOP↔POLICY↔BLEND transfers; gesture/intent soft-only (cannot raise PFL or bypass CrossSiteZoneConfigGate); composed fail-closed under the full prior gate chain plus zone attestation.