39. Control authority, command fencing, handover, and safety-runtime isolation

Monotonic, reboot-safe control ownership v1.4
AuthorityClockRef {
  arbiterId, clockId, arbiterBootId, tickRate,
  authorityEpoch, antiRollbackStateDigest
}

AuthorityLease {
  leaseId, assetId, configurationDigest, functionId,
  controllerPrincipalId, controllerWorkloadIdentity,
  authorityClockRef, priorityClass, mode, allowedCommandKinds[],
  operatingEnvelopeRef, safetyConstraintRef,
  validFromTick, expiresAtTick, maxCommandRate,
  heartbeatPeriodTicks, missedHeartbeatLimit,
  predecessorLeaseId?, handoverTransactionId?, revocationChannel,
  issuerDecisionRef, leaseDigest, issuerProofRef
}

Arbiter reboot changes arbiterBootId and increments persisted authorityEpoch
before arming. Anti-rollback failure latches SAFE and invalidates old leases.
AuthorityLease {
  leaseId, assetId, configurationDigest, functionId,
  controllerPrincipalId, controllerWorkloadIdentity,
  authorityEpoch, priorityClass, mode, allowedCommandKinds[],
  operatingEnvelopeRef, safetyConstraintRef,
  validFromMonotonic, expiresAtMonotonic,
  maxCommandRate, heartbeatPeriod, missedHeartbeatLimit,
  predecessorLeaseId?, handoverTransactionId?, revocationChannel,
  issuerDecisionRef, leaseDigest, issuerProofRef
}

The arbiter stores current authorityEpoch per function in safety-grade local
state. A command under an older or future epoch is rejected before it reaches
an actuator. Wall-clock timestamps do not fence controllers.

Fenced, framed, expiring control command v1.4
ControlCommand {
  profile, commandId, controllerId, controllerBootId,
  authorityClockRef, leaseId, authorityEpoch,
  commandSequence, sequencePolicy, functionId, targetSelector,
  setpointOrAction, frameRef, envelopeRef,
  issuedTick, expiresTick, commandDigest, controllerProofRef
}

CommandDisposition {
  commandId, commandDigest, admissionResult, admissionReasonCodes[],
  admittedAtTick?, executionState, executionEvidenceRefs[],
  finalAtTick?, dispositionDigest, arbiterProofRef
}

Exact duplicate ID/sequence/digest returns the original disposition without
actuator re-entry. Same ID or sequence with different digest is equivocation and
fences the controller. Admission and physical execution outcomes remain distinct.
ControlCommand {
  commandId, assetId, functionId, controllerId,
  leaseId, authorityEpoch, sequence,
  configurationDigest, controlMode,
  setpoint: QuantityValue | Pose | Trajectory | DiscreteCommand,
  setpointFrameRef?, issuedAtMonotonic, validFromMonotonic,
  expiresAtMonotonic, rateLimits?, safetyConstraintRef,
  expectedAckDeadline, commandDigest, controllerProof
}

CommandDisposition {
  commandId, outcome: accepted|rejected|superseded|expired|partiallyApplied,
  reasonCode, receivedAtMonotonic, appliedAtMonotonic?,
  appliedSetpoint?, actuatorFeedbackRefs[], supervisorInterventionRef?
}

Reference safety-runtime transitions
DISABLED -> SAFE -> STANDBY -> ARMED -> ACTIVE
ACTIVE -> DEGRADED -> FALLBACK -> SAFE
ACTIVE -> SAFE (normal disarm only under permitted transition)

ANY OPERATIONAL STATE -> EMERGENCY_STOP
EMERGENCY_STOP -> RECOVERY_CHECK -> SAFE
FAULT_LATCHED -> RECOVERY_CHECK -> SAFE

Forbidden:
  EMERGENCY_STOP -> ACTIVE
  FAULT_LATCHED -> ARMED/ACTIVE
  DEGRADED -> ACTIVE without recovery predicates
  SAFE -> ACTIVE without STANDBY and ARMED gates

Every transition binds source condition, configuration, authority epoch,
monitor snapshot, action taken, deadline, feedback and receipt.

Minimum risk is domain-specific
Loss of link does not universally mean stop. A road vehicle may pull over; a boat may hold, anchor or surface; an aircraft may loiter, return or land; a blimp may preserve altitude and navigate to recovery; a spacecraft may enter safe pointing; a robot may hold load or release energy. The fallback is an installed, verified and locally executable capability.

Illustrative constrained safety filter - not universal certification
u_safe = argmin_u ||u - u_requested||_W^2
subject to:
  actuator position/rate/effort/thermal constraints
  operating-envelope constraints
  collision/separation/structural/stability constraints
  control-barrier condition: dh/dt + alpha(h(x)) >= 0

SafetyFilterDefinition binds:
  state estimate inputs; model/constraint digests; solver/profile;
  validated operating domain; maximum solve time; infeasibility response;
  numerical tolerance; fallback command; verification/validation evidence.

Independent supervisor checks command freshness, lease epoch, watchdog,
critical sensors, actuator agreement, envelope and heartbeat. It can veto or
transition safe state without relying on the primary controller or cloud.