Day 32 — Multi-operator / fleet shared-control coordination: MultiOperatorSessionRegistrar / OperatorSessionLease / FleetSharedControlPriorityArbiter / ConcurrentAuthorityConflictGate / IntentEpisodeBagSchema / FleetSharedControlAdmissionGate under SharedControlAdmissionGate + CollaborativeWorkspaceAdmissionGate + proximity + zone attestation + supervisor + logging + canary + HIL + fleet + fleet-canary + incident + forensics/reopen + change-management + maintenance + thermal + energy gates

Day 16 made teleop and policy co-equal soft writers under SharedAutonomyArbiter. Day 21 through Day 24 made the fleet honest: ticket-log sync, fleet canaries, coordinated incident kill, and forensic reopen. Day 29 owns SSM envelopes and HARD ISO/TS 15066-style PFL body-region ceilings. Day 30 owns CollaborativeWorkspaceAdmissionGate (CWAG) and CrossSiteZoneConfigGate. Day 31 owns ZoneAwareSharedControlArbiter, AuthorityTransferGate, OperatorIntentAdmissionGate, and SharedControlAdmissionGate (SCAG). Day 17 owns the kill-chain, ESTOP, and stage transitions forever. Day 05 owns torque_scale, contactor, UVLO, and STO forever.

Day 31 quietly assumed one operator. Real cells do not cooperate: an on-site technician holds a teach pendant, a remote ops-center operator has a VR rig on the same unit, a shift supervisor watches four robots on a wall, and the policy is still running. Two people press “take control” in the same 200 ms. A VR headset drops Wi-Fi and its last stick deflection is still in a buffer. Someone re-uses a session token from H-04 on H-07. A remote operator at SITE_B renders the cell with SITE_B’s zone file. None of those are new safety ceilings — they are new ways to launder authority around the ones you already have.

Today owns MultiOperatorSessionRegistrar / OperatorSessionLease / FleetSharedControlPriorityArbiter / ConcurrentAuthorityConflictGate / IntentEpisodeBagSchema / FleetSharedControlAdmissionGate. The question is: when several humans and the policy all want to co-write one unit’s soft refs, who holds the pen, how are collisions resolved fail-closed, and how does every episode leave a bag that Day 22 canaries and Day 24 forensics can regress — without a second operator ever outranking Day 29, Day 30, Day 31, Day 17, or Day 05?

Rank orders soft writes. It never orders HARD ceilings.

Day 31’s rule stands: modes, blend weights, intent, and transfer requests are SOFT. Today adds three honesty layers:

1. Sessions are leases, not logins. An operator is a writer only while a fresh, unit-bound, site-bound OperatorSessionLease says so. Lease age is MEASURED on the host monotonic clock; rank is SOFT priority.
2. Asymmetric arbitration. Requests that move authority toward HOLD (YIELD, ABORT, HOLD) are cheap and admitted from any valid lease holder or the policy. Requests that promote authority (TAKE_CONTROL, BLEND up, resume) are expensive and must win priority, pass the conflict gate, and pass Day 31 SCAG.
3. Episodes are evidence. Every interval of constant (unit, writer lease, mode, map_version) is an episode with a schema-complete bag. An unbagged episode is an unadmitted episode.

So the honest labels are:

The first rule of today: any human may stop the robot through Day 17; only one admitted lease may steer its soft refs; nobody’s rank moves a HARD ceiling. The red mushroom is never lease-gated.

Core thesis: multi-operator shared control is not “Day 31 with a user list.” It is a lease registrar that keeps at most one human pen per unit, an asymmetric priority arbiter where anyone may demote but promotion must be earned, a conflict gate that refuses races instead of resolving them by latency, and an episode bag schema that makes every transfer replayable by fleet canaries and forensics — all composed under a FleetSharedControlAdmissionGate that sits under Day 31 SCAG and Days 17–31. A second operator is another soft voice, never a privilege. Day 29 PFL and Day 30 zone attestation stay HARD; Day 17 and Day 05 stay sole owners.

MultiOperatorSessionRegistrar / OperatorSessionLease: the pen is a lease

MultiOperatorSessionRegistrar runs on the unit’s host (not in the cloud — a WAN partition must not leave a phantom writer). It grants, renews, and revokes OperatorSessionLeases and enforces one invariant every tick:

A lease is fresh only while its last heartbeat age on the host monotonic clock is within TTL: $t_{mono} - t_{hb} \le \mathrm{TTL}$. Heartbeat age is MEASURED; the operator’s own clock is not consulted.

Rules that hold for every rank:

• No lease resurrection. Day 17 ESTOP, a Day 23 fleet kill, a supervisor stage drop, or a CWAG re-attestation revokes all WRITER leases. Recovery re-grants from scratch; a lease never “comes back” with its old authority.
• Remote is not a site. OpB in the SITE_B ops center operating H-07 at SITE_A gets a lease with site_id = SITE_A and must render SITE_A’s attested geometry. A lease whose site_id differs from the unit’s is a CrossSiteZoneConfigGate failure, not a convenience.
• Fan-out cap. One operator may hold WRITER on at most one contact-capable unit at a time; supervisory multi-unit views are SUPERVISOR_SOFT + READ_ONLY / ADVISORY.
• ESTOP is outside the registrar. Any pendant, mushroom, or OBSERVER’s hardwired stop goes to Day 17 with no lease lookup on the path.

FleetSharedControlPriorityArbiter: demote is cheap, promote is earned

FleetSharedControlPriorityArbiter sits in front of Day 31’s ZoneAwareSharedControlArbiter. It does not compute blend weights; it decides which single human channel (if any) the Day 31 arbiter sees as teleop this tick, and which pending transfer request is forwarded to AuthorityTransferGate.

Two rules dominate everything else:

1. Most-restrictive-wins for demotion. A fresh YIELD / ABORT / HOLD from any lease holder (including ADVISORY) or from the policy is forwarded immediately. Nobody’s rank can veto a demotion toward HOLD.
2. Never blend two humans. Day 16 BLEND mixes one teleop channel with policy. Averaging OpA’s and OpB’s sticks produces a command neither intended, with no owner to blame in forensics. SECONDARY input is ADVISORY (waypoint suggestions, soft “look here”), never a second teleop term.

Priority for promotion requests (only considered after HARD layers and after any demotion this tick):

A higher rank never shortcuts the gates below it. SUPERVISOR_SOFT reassigning the pen to itself still passes the conflict gate, Day 31 AuthorityTransferGate, CWAG, and Day 29 — exactly like PRIMARY would. Rank changes who asks first, not what is allowed.

Handover passes through HOLD. Writer-to-writer handover is two-phase: holder YIELD (or supervisor reassign) → arbiter HOLD for at least one tick with soft refs frozen → registrar flips the WRITER slot → new writer’s TakeControlIntent goes through Day 31 AuthorityTransferGate. No hot swap between two human channels while soft refs are moving. If PFL is armed in a HANDOFF_CORRIDOR, handover is refused until the handoff completes or aborts to HOLD.

ConcurrentAuthorityConflictGate: refuse races, do not resolve them

Last-writer-wins is a latency lottery: the operator on the better network wins. ConcurrentAuthorityConflictGate is fail-closed — on any of the following it refuses the promotion, demotes toward HOLD if a writer was moving, and bags the conflict.

The collision window is a refusal window, not a tie-break window. Two people grabbing the same robot is information — the cell’s social protocol failed — and the honest response is HOLD plus a human decision, not a coin flip by packet arrival.

IntentEpisodeBagSchema: every episode is replayable evidence

Day 18 taught dataset hygiene; Day 31 tagged single-operator transfers. With multiple sessions, the tag set must name who held the pen, who lost, and why — otherwise Day 22 canaries cannot attribute regressions and Day 24 forensics cannot reconstruct the race.

An episode opens and closes on any change of: writer lease, mode, map_version, zone id, or gate status color. Required fields:

Two hard rules:

• Schema completeness is a gate input. If the bag writer is backpressured or a required field is missing, FleetSharedControlAdmissionGate goes RED for new promotions on that unit. Demotions still flow — you never block a HOLD on logging.
• Bags are append-only. Forensics annotates in a side table; nobody edits transfer_reason after the fact.

Fleet canary use (Day 22): rank policy versions on per-1000-episode rates of TAKE_COLLISION, STALE_LEASE writes dropped, illegal promotion attempts refused, and operator takeover from POLICY_ONLY. A policy that makes operators grab control more often is a soft regression signal, never a reason to raise anything HARD. Forensics use (Day 24): every illegal-transfer episode becomes a HIL/twin regression; reopen canary requires the replay to refuse the same race.

FleetSharedControlAdmissionGate: composition under SCAG

FleetSharedControlAdmissionGate (FSCAG) is today’s composition root. It fails closed unless:

• Day 31 SharedControlAdmissionGate GREEN (which itself requires CWAG + Day 29 + Days 17–28)
• MultiOperatorSessionRegistrar consistent: ≤ 1 fresh WRITER, all leases site_id = unit site, no stolen session ids
• ConcurrentAuthorityConflictGate GREEN for any pending promotion
• Writer lease bound_map_version = current CWAG map_version
• IntentEpisodeBagSchema writer healthy and last episode schema-complete
• Day 22 fleet canary GREEN for this policy × unit; Day 23 no open incident (including session-steal security incidents); Day 24 reopen GREEN

Soft admit blocker only — it does not publish JointCommand, does not clear ESTOP, does not write Day 05, does not touch Day 25 HARD_SAFETY ChangeSets.

A worked multi-operator example

SITE_A, unit H-07, COLLABORATIVE polygon, map_version = 41, warn $N = 3$, hard $N = 5$. Policy runs POLICY_ONLY tote picking. OpA (PRIMARY, on-site pendant) holds ADVISORY. OpB (SECONDARY, VR from the SITE_B ops center) holds ADVISORY. Supervisor (SUPERVISOR_SOFT) watches four units.

Every row is a bag. Day 22 ranks the policy version on whether its handoff BLEND drew more operator takes; Day 24 replays the 120 ms collision and the stale-pendant episode as regressions.

Ownership conflicts

Shared API

Same wire discipline as Days 02/04: everything carries BusHeader. The registrar, arbiter, and gates run on the unit host; nothing here enters the cyclic current loop. Day 29 monitors and Day 17 remain independent.

BusHeader:
  t_mono
  seq
  clock_domain         # HOST for leases and gates; SENSOR for proximity/zone inputs
  age_ms
  producer_id

OperatorSessionLease ⊇ BusHeader:          # SOFT priority, HARD bindings
  session_id             # minted on this unit; non-portable
  operator_id            # ATTESTED identity; pseudonymized in fleet aggregates
  rank                   # SUPERVISOR_SOFT | PRIMARY | SECONDARY | OBSERVER
  role                   # WRITER | ADVISORY | READ_ONLY
  unit_id                # HARD binding
  site_id                # HARD binding = unit's attested site (Day 30)
  operator_location?     # metadata only
  bound_map_version      # acked at grant / re-ack
  zone_scope[]           # ⊆ CWAG-attested; never EXCLUSION
  lease_ttl_ms
  t_last_hb              # host t_mono — MEASURED age
  hb_rtt_ms              # MEASURED
  label: SOFT
  forbid:
    raise_pfl_ceiling: true
    bypass_cross_site_zone: true
    write_estop: true
    write_torque_scale: true
    gate_estop_path: true          # ESTOP never requires a lease
    resurrect_after_revoke: true

MultiOperatorSessionRegistrar ⊇ BusHeader:
  unit_id
  leases[]
  writer_session_id?
  invariant: fresh_writer_count <= 1
  revoke_on[]: [hb_stale, seq_replay, site_mismatch, map_drift, estop, fleet_kill, stage_drop, cwag_reattest]
  fanout_cap_contact_units_per_operator: 1

TakeControlIntent ⊇ OperatorIntent:        # Day 31 OperatorIntent, session-scoped
  session_id
  intent_kind            # TAKE_CONTROL | YIELD | ABORT | HOLD | REASSIGN
  target_operator_id?    # REASSIGN only (SUPERVISOR_SOFT)
  confidence             # NOT MEASURED

FleetSharedControlPriorityArbiter ⊇ BusHeader:
  writer_session_id?
  policy_rank
  forwarded_request?     # to Day 31 AuthorityTransferGate
  rules:
    demotion_most_restrictive_wins: true
    max_human_teleop_channels: 1
    handover_via_hold_ticks: 1
    policy_preempts_human_writer: false
    rank_shortcuts_gates: false
  never_hard: true
  feeds: ZoneAwareSharedControlArbiter    # Day 31

ConcurrentAuthorityConflictGate ⊇ BusHeader:
  status                 # RED | YELLOW | GREEN
  fail_closed: true
  collision_window_ms    # W, host time
  refuse_on[]:
    take_collision
    take_without_handover
    stale_lease_write
    cross_robot_session_steal
    site_id_mismatch
    map_version_drift
    seq_replay
    writer_cardinality_violation
    take_during_pfl_armed_contact
    rank_based_pfl_or_zone_ask
  on_refuse: demote_toward_hold

IntentEpisodeBag ⊇ BusHeader:              # IntentEpisodeBagSchema, append-only
  episode_id
  unit_id
  site_id
  map_version
  changeset_hash
  zone_id
  zone_kind
  mode
  from_mode
  to_mode
  transfer_reason
  operator_id
  session_id
  rank
  role
  loser_operator_id?
  loser_session_id?
  policy_id
  policy_rank
  policy_version
  conflict_verdict
  scag_status
  cwag_status
  ssm_status
  fscag_status
  lease_age_ms
  hb_rtt_ms
  d_sep_lo
  d_stop_hi
  occupancy_n
  intent_confidence      # SOFT — never MEASURED
  schema_complete: bool

FleetSharedControlAdmissionGate ⊇ BusHeader:
  fail_closed: true
  soft_admit_blocker_only: true
  status                 # RED | YELLOW | GREEN
  require:
    shared_control_admission_green: true          # Day 31 SCAG
    collaborative_workspace_admission_green: true # Day 30 CWAG
    cross_site_zone_config_green: true            # Day 30
    human_safety_admission_green: true            # Day 29
    registrar_consistent: true
    conflict_gate_green_if_promotion: true
    writer_map_version_current: true
    episode_bag_schema_healthy: true
    fleet_canary_gate_green: true                 # Day 22
    no_open_incident_on_unit: true                # Day 23
    canary_reopen_gate_green: true                # Day 24
    energy_admission_gate_green: true             # Day 28
    thermal_admission_gate_green: true            # Day 27
    supervisor_armed: true                        # Day 17
    estop_pairing: true
    day05_binding: true
  blocks: promotions_only        # demotions toward HOLD always flow
  forbid:
    joint_command: true
    dual_write_torque_scale: true
    clear_supervisor_stage: true
    write_estop: true
    force_flag: true
    write_hard_safety_changeset: true

# Unchanged owners
SharedControlAdmissionGate (Day 31): single-writer zone-aware transfer admit
CollaborativeWorkspaceAdmissionGate (Day 30): zone · occupancy · handoff · cross-site
HumanSafetyAdmissionGate (Day 29): SSM · PFL · stop twin
SupervisorState (Day 17): ESTOP · kill-chain · stage · monitors
BmsState / PowerState (Day 05): torque_scale · contactor · UVLO · STO
  accepts_requests_from_soft_layer: false

Physical ↔ digital pairing

If the twin cannot replay a two-operator race with both session_ids, the loser, the collision window, lease ages, map_version, and every gate color, it cannot set the next multi-operator admit.

Bring-up sequence (before trusting multiple operators on one unit)

1. Days 05 and 16–31 green. Single-operator SCAG already honest; do not debug two operators on a broken one-operator stack.
2. Registrar alone. Fuzz grant/renew/revoke; prove the writer-cardinality invariant under reordered and duplicated packets.
3. Lease bindings. Wrong site_id, wrong unit_id, old map_version — each refuses promotion.
4. Priority arbiter replay. Feed recorded multi-session streams; confirm YIELD from ADVISORY beats PRIMARY take, and SECONDARY never becomes a second teleop term.
5. Conflict gate negatives. Two takes inside $W$, take without handover, stale buffer flush, stolen session, seq replay — every one RED → HOLD.
6. Handover via HOLD. Measure soft-ref freeze for ≥ 1 tick; prove handover refused while PFL is armed in a handoff corridor.
7. ESTOP from a leaseless pendant. Kill-chain fires with zero registrar involvement; all WRITER leases revoked; re-grant required.
8. Episode bag schema. Kill the bag writer; promotions go RED, demotions still flow. Validate every required field on every episode boundary.
9. Canary + forensics. Day 22 ranks policies on take/collision/stale rates; Day 24 replays recorded races and reopen requires refusal of the same race.
10. Then run a live two-operator shift; every illegal transfer is a Day 18 bag + Day 24 forensic + twin regression.

Failure gallery

What to freeze this week

Extend frames and your safety config with:

• MultiOperatorSessionRegistrar + OperatorSessionLease: unit-minted, unit-bound, site-bound (unit’s site), map-version-acked leases; MEASURED heartbeat age against host TTL; ≤ 1 fresh WRITER per unit; no resurrection after ESTOP / fleet kill / CWAG re-attest.
• FleetSharedControlPriorityArbiter: demotion most-restrictive-wins from any lease holder or policy; promotion by rank only into the gates; never blend two humans; handover passes through HOLD.
• ConcurrentAuthorityConflictGate: fail-closed on take collisions, take-without-handover, stale writes, session steal, site_id mismatch, map_version drift, seq replay, writer-cardinality violation, take during PFL-armed contact, and rank-based PFL / zone asks.
• IntentEpisodeBagSchema: append-only episodes with map_version · mode · transfer_reason · operator_id · session_id · loser_operator_id · policy_rank · gate colors; schema completeness gates promotions, never demotions.
• FleetSharedControlAdmissionGate fail-closed under Day 31 SCAG + CWAG + Days 17–31; soft admit blocker only; no dual-write of ESTOP or torque_scale.
• ESTOP is never lease-gated. Rank is never a HARD privilege.

The lesson isn’t “add a user list to teleop.” It’s that multi-operator shared control is a single soft pen per unit, passed through HOLD, refused on races, bound to the unit’s attested site and map, and bagged so fleet canaries and forensics can regress every illegal transfer. A second operator is another soft voice; Day 29 and Day 30 stay HARD; Day 17 still owns the kill-chain; Day 05 still owns torque.

Next

Day 33+ — Remote / multi-site teleop under latency: delayed-operator honesty (MEASURED round-trip and jitter vs soft predicted operator intent), latency-aware lease TTL and authority demotion, operator-side zone-view staleness vs attested map_version, and WAN-loss failover to POLICY or HOLD — without raising PFL ceilings or bypassing CrossSiteZoneConfigGate, under the same gates (supervisor + logging + canary + HIL + fleet + fleet-canary + incident + forensics/reopen + change-management + maintenance + thermal + energy + proximity + zone attestation + shared-control + multi-operator admission).