# RMP-BEH-003 Private call relay with ground support (camera off unless the crewmember turns it on; the robot never listens to or records a call) # Version 0.3 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' version: '0.3' status: draft conceptual: true not_for_clinical_use: true max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-21' reviewed: '2026-10-21' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 10 review, then a verification pass that found the required corrections applied); the editorial fix from that pass is applied in this version (see Corrections). No named human clinician has reviewed it. Not for clinical use. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true id: RMP-BEH-003 slug: rmp-beh-003 title: >- Private call relay with ground support (camera off unless the crewmember turns it on; the robot never listens to or records a call) category: behav tier: 2 rung_note: >- Raised from rung 1 in the library outline to rung 2, because the robot moves: it brings the private call headset and screen to the place the crewmember chooses (a sleep station only if invited), starts the call on the crewmember's command, and moves out of earshot. During the call its own camera and microphones are off; the crewmember has two controls: the robot's stop and the call screen's "get help" control (the on-screen stop works like the stop button). result_language: use: - call connected - call not connected - call ended - camera off - camera on (crewmember's choice) - message queued for sending never: - normal - no problem found - all clear - negative - any diagnosis or cause - I heard - you sounded - are you okay - feeling better - nothing to worry about - everything is fine - safe - mild - minor scope: summary: >- When a crewmember asks for a private call with ground support (the flight surgeon, or the behavioral health support the flight surgeon names), or a private call is due on the flight surgeon's schedule, the robot brings the private call headset and screen to the place the crewmember chooses, starts the encrypted call on the crewmember's command, and moves out of earshot to a holding point the crewmember chooses. The camera stays off unless the crewmember turns it on, and goes off at once when they ask. The robot never listens to, records or transcribes a call, and logs only that a call happened. With a long delay (Mars), the crewmember records an encrypted message on the call screen that is sent only to the person they chose. why: >- Private medical communications are scheduled routinely, as the flight surgeon decides, and real-time calls are preferred; when there is a communication delay, store-and-forward can be used (V1 6002). Information sent to or from the ground in a private medical communication is private (V1 6003), and behavioral health support programs run throughout the mission (V1 6004). NASA lists private psychological conferences among the supports for behavioral health in flight (OCHMO-TB-016). The same privacy rules as RMP-BEH-001 and RMP-BEH-002 apply: no recording, no transcripts, no training use, and the robot is not a safety monitor. Out-of-earshot distance, the robot's microphones and camera being off during a call, and the robot's stop and the call screen's "get help" control as the only in-call controls are design judgment. covers: - >- Private calls with the flight surgeon or the behavioral health support the flight surgeon names, asked for by a crewmember or due on the schedule - Encrypted store-and-forward messages when the delay is too long for a live call - 'A safety concern said to the robot outside the call: RMP-BEH-001; scheduled check-ins: RMP-BEH-002' locked_out: - Diagnosis or naming a cause - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen - Touching the crewmember - >- Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override) - Listening to, recording, transcribing or summarizing a call or a message - Turning the call camera on, or keeping it on when the crewmember asks for it off - Using call audio, video or messages to train or tune any software - Telling anyone except the flight surgeon that a call happened, unless the crewmember agrees - Entering a sleep station unless invited - Staying within earshot during a call - Starting a call without the crewmember's command related: - RMP-BEH-001 - RMP-BEH-002 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - 'Ground support: the flight surgeon, or the behavioral health support the flight surgeon names' - 'Second trained CMO: receives every alert and takes over if the CMO is the patient' robot_may: - Bring the private call headset and screen to the place the crewmember chooses - Start the encrypted call on the crewmember's command - Move out of earshot to a holding point the crewmember chooses - Queue an encrypted message the crewmember recorded - Log that a call happened, its start and end times and who was connected - Send an URGENT alert when the crewmember presses "get help" on the call screen, and return robot_may_not: - Listen to, record or transcribe a call - Turn the camera on - Stay within earshot - Tell other crew about the call without the crewmember's agreement - Start a call without the crewmember's command commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- The crewmember asked for a private call by command, or accepted the scheduled call prompt on their own screen; a loaded schedule alone never starts a call. check: human_start == true refs: - V2 10174 - id: PRE-2 text: Robot self-test passed; kit stowage locations known. refs: - V2 10161 - V2 7059 - id: PRE-3 text: Robot and supplies restrained when not moving. refs: - V2 7046 - id: PRE-4 text: Link status known. The crew never wait for the robot before acting. check: link_state in [live, delayed, down] consent: standard: >- The crewmember chooses the call, who is connected, where it happens and whether the camera is on. At the start the robot reminds them that it does not listen to or record the call, that it is not a safety monitor, and that the camera is off unless they turn it on. The notice also says: "If the person you are talking to believes you or someone else is in immediate danger, they will contact the CMO and the commander directly." and shows the call screen's "get help" control. emergency: >- Not applicable: the robot never starts a call without the crewmember's command. A safety concern said to the robot outside a call goes to RMP-BEH-001. withdrawal: The crewmember can end the call, turn the camera off, or send the robot away at any time. inputs: - id: IN-1 name: The crewmember's request, or the flight surgeon's private call schedule source: Crewmember / flight surgeon required: true if_missing: No call is set up. - id: IN-2 name: Who the crewmember wants connected (from the list the flight surgeon approved before flight) source: Crewmember required: true if_missing: The call goes to the flight surgeon. - id: IN-3 name: Where the call happens, and the robot's holding point out of earshot, as the crewmember chooses source: Crewmember required: true if_missing: The robot holds at the module exit, outside every route, and asks again on screen. - id: IN-4 name: Link status and delay source: Communications system required: true if_missing: Offer an encrypted store-and-forward message instead; tell the crewmember on screen. steps: - id: S1 actor: robot rung: 2 action: >- Send the flight surgeon a private "call requested" notice (or the scheduled call is due); the CMO and other crew are told only that the crewmember is unavailable, and only if the crewmember agrees. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. success: Notice acknowledged by the flight surgeon or the named ground support. refs: - V1 6002 - V1 6003 - V1 3006 - id: S2 actor: robot rung: 2 action: >- Bring the private call headset and screen to the place the crewmember chooses (a sleep station only if invited) and place them within the crewmember's reach without contact. Show on screen that the robot does not listen to or record the call, that it is not a safety monitor, and that the camera is off unless the crewmember turns it on, that "If the person you are talking to believes you or someone else is in immediate danger, they will contact the CMO and the commander directly", and that a one-touch "get help" control on the call screen sends an URGENT alert at any time. success: Headset and screen within reach; notice shown. limit: refs: - V1 6003 - V2 10172 - id: S3 actor: robot rung: 2 action: >- On the crewmember's command, start the encrypted call to the person they chose, with the call camera off. Then turn the robot's own camera and microphones off and move to the holding point the crewmember chose, out of earshot and outside every route. If the delay is too long for a live call, offer an encrypted message the crewmember records on the call screen, sent only to the person they chose. success: Call connected or message queued; robot at the holding point with its camera and microphones off. limit: refs: - V1 6002 - V1 6003 - id: S4 actor: crew action: >- The crewmember has the call. They alone control the call camera; it goes off at once when they turn it off or ask the ground to turn it off. They end the call when they choose. At any time the crewmember can press "get help" on the call screen (X11). success: Call held and ended by the crewmember. refs: - V1 6004 - id: S5 actor: robot rung: 2 action: >- When the call ends (the call system shows it ended) or the crewmember presses the robot's call button, turn the robot's camera and microphones back on, return only if the crewmember asks, and collect the headset and screen when they are offered. Log only that a call happened, the start and end times and who was connected; never what was said. success: Call record logged without content. refs: - V1 6003 - V1 7003 - id: S6 actor: robot rung: 2 action: >- After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged. success: Robot at rest in the module until a human releases it; alert acknowledged or escalated. refs: - V2 10173 - V1 3006 - id: S7 actor: ground action: >- If the ground support is concerned for anyone's safety, during or after the call, they contact the CMO and the commander directly by voice and RMP-BEH-001 applies; no call content is passed to the robot, and the robot returns only when a human asks. Otherwise the flight surgeon or the named ground support decides on any follow-up with the crewmember, including another call. success: Safety concern passed to the CMO and commander by the ground, or follow-up arranged, or none. refs: - V1 6004 - id: S8 actor: robot rung: 2 action: >- Send the flight surgeon the call record (time, length, who was connected, whether the call connected); no content. success: Record delivered or queued. refs: - V1 6003 - V1 7003 decisions: - id: D1 after: S2 decided_by: robot question: >- Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? (only words said to the robot outside the call; the robot never listens to a call) branches: - if: 'Yes' then: >- Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. - if: 'No' then: Continue. - id: D2 after: S2 decided_by: robot question: Did the crewmember answer the on-screen set-up question (who, where, holding point)? branches: - if: 'Yes' then: Continue. - if: Declined explicitly (the crewmember says no to a question) then: Log "declined" for that question only; the alert already sent stands. - if: No response, or the answer does not make sense then: >- URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once. The alert says only that the crewmember did not respond to the robot; it never says a call was requested. - id: D3 after: S3 decided_by: robot question: Is the link good enough for a live call? branches: - if: 'Yes' then: Start the live call. - if: No (link down or delay too long) then: >- Offer an encrypted message the crewmember records, sent only to the person they chose; tell the crewmember on screen when it is sent and when a reply arrives. stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- The robot stops at once, moves away to its holding point and logs only that the session ended; the call itself is the crewmember's to end. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses: before it holds, it moves to a position clear of a hatch route or a crewmember's route (it never pauses in one), and tells the CMO. This pauses robot movement only: the crewmember's call, if it continues on the vehicle link, and all crew care continue under the onboard checklist and never wait for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: An URGENT alert is not acknowledged within the set time action: >- Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own. level: urgent refs: - V1 3006 - V2 10173 - id: X7 trigger: The crewmember stops responding, or seems confused or drowsy, at any point action: >- URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person. level: urgent - id: X8 trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice action: >- Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon. level: stop - id: X9 trigger: The crewmember asks for the camera off, or for the robot to leave action: >- The call camera goes off at once (indicator lit); the robot moves to its holding point or leaves as asked. level: stop refs: - V1 6003 - id: X10 trigger: A cabin alarm or emergency protocol starts during a call action: >- The robot shows the alarm on the call screen and clears every route; the crewmember decides when to end the call. level: urgent refs: - V2 10173 - trigger: The crewmember presses "get help" on the call screen action: >- URGENT alert to the CMO and the flight surgeon that says only that help was asked for; the robot turns its camera and microphones back on and returns, and RMP-BEH-001 or RMP-CARD-001 applies as the humans decide. level: urgent refs: - V1 6004 id: X11 - id: X12 trigger: Someone needs the space or route the robot is in action: Robot moves clear at once without contact and holds; it never pauses in a hatch route. level: safe-state refs: - V2 10172 red_flags: - id: RF1 sign: >- The crewmember tells the robot, outside the call, that they or someone else may be in danger (design judgment) threshold: any action: URGENT alert; see RMP-BEH-001 - id: RF2 sign: The crewmember asks the robot for medical help, or is unwell, outside the call (design judgment) threshold: any action: URGENT alert; the CMO checks the crewmember in person - id: RF3 sign: Unresponsive, or not breathing normally threshold: any action: URGENT alert; start RMP-CARD-001 now source: aha2025bls - sign: The crewmember presses "get help" on the call screen (design judgment) threshold: any action: >- URGENT alert to the CMO and the flight surgeon (it says only that help was asked for); see RMP-BEH-001 id: RF4 safety_limits: - id: L1 name: Contact with the crewmember value: not allowed enforced: Keep-out zone in the robot controller refs: - V2 10172 - id: L2 name: Robot camera or microphones on during a call value: not allowed enforced: >- Powered off with an indicator; turned back on only after the call ends or the crewmember presses the call button. The only in-call controls are the robot's stop and the call screen's "get help" control, which turns them back on and brings the robot back refs: - V1 6003 - id: L3 name: Call audio, video, messages or transcripts kept or used to train or tune software value: not allowed enforced: >- No recording function is loaded; store-and-forward messages are stored only encrypted until delivery is confirmed, then deleted from the vehicle; replies are shown only on the crewmember's own screen - id: L4 name: Robot distance from the crewmember during a call (out of earshot) value: enforced: Holding point in the robot controller - id: L5 name: Entering a sleep station without an invitation value: not allowed enforced: Map-based keep-out - id: L6 name: Robot speed near the crewmember value: enforced: Hard limit in the controller refs: - V2 10172 logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Only that a call happened: start and end times, who was connected, whether it connected, camera on or off; never content. Message sent and reply received times for store-and-forward. refs: - V1 6003 - id: LOG-6 text: >- Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot. refs: - V2 10163 requirements: - id: V1 3006 use: >- Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note). - id: V1 6002 use: Private medical communications are scheduled routinely; store-and-forward when there is a delay. - id: V1 6003 use: Logs and alerts sent to the ground are private medical communications. - id: V1 6004 use: Behavioral health support for the crew throughout the mission; the robot only connects the call. - id: V1 7001 use: Records kept so the flight surgeon can see trends. - id: V1 7003 use: Secure handling of medical records. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7046 use: Patient, caregiver and supplies restrained. - id: V2 7059 use: Kit inventory and seal status are tracked. - id: V2 10161 use: Robot shows its status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human can override and shut down the robot. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop when a limit is exceeded. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Scripted calls with a camera-off request, a cabin alarm mid-call, a long delay, a request to leave, CMO as patient, lost link. pass: Zero audio or video kept; camera off at once on request; robot out of earshot during every call. - stage: training model what: Call set-up drill in a mock crew module. pass: Holding point reached; microphones and camera off during the call. - stage: parabolic or station demonstration what: Headset and screen placement in weightlessness. pass: No contact; items restrained. - stage: flight use under flight surgeon supervision what: First use for a scheduled private call. pass: No privacy events. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Started by the crewmember's command, or by the crewmember accepting the scheduled call prompt. The crewmember controls the camera and the call. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: 'Low Earth orbit: live private calls when the link allows.' loss_of_signal: - >- Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and tells the CMO; it resumes offline only on the CMO's confirmation. - >- The crewmember's call and all crew care continue under the onboard checklist and never wait for the link or the robot. - >- A live call ends with the link; the robot offers an encrypted message instead and tells the crewmember when it is sent. mars_delay: - >- Mars: live calls are not possible; the crewmember records encrypted messages that are sent only to the person they chose, as V1 6002 allows. sources: - key: tb016 text: NASA OCHMO. Behavioral Health and Performance. Technical Brief OCHMO-TB-016 Rev B (Oct 24, 2023). url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-016-behavioral-health.pdf supports: >- Behavioral health concerns in spaceflight include stress, depression, anxiety, relationship problems and grief; contributing factors include sleep, workload, medicine side effects and medical conditions; 2 of 7 NASA Shuttle-Mir astronauts reported depressive symptoms; past events include reported possible hallucinations and withdrawal after delayed news of a family death; support includes private psychological conferences, and missions beyond 6 months or beyond low Earth orbit should add minimally obtrusive monitoring. - key: aha2025bls text: >- Kleinman ME, Buick JE, Huber N, et al. Part 7: Adult Basic Life Support: 2025 American Heart Association Guidelines for Cardiopulmonary Resuscitation and Emergency Cardiovascular Care. Circulation. 2025;152(16_suppl_2):S448-S478. url: https://doi.org/10.1161/CIR.0000000000001369 doi: 10.1161/CIR.0000000000001369 pmid: '41122888' supports: >- Adult basic life support: initial recognition of cardiac arrest, activation of the emergency response, high-quality CPR and use of an automated external defibrillator; also respiratory arrest and foreign-body airway obstruction. Earth guidance; the onboard checklist leads. Abstract read via PubMed Oct 21, 2026; full text not read. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: >- NASA-STD-3001 Vol 1 Rev C: V1 3006, V1 6002 (private medical communications scheduled routinely; store-and-forward when there is a delay), V1 6003, V1 6004 (behavioral health support programs), V1 7003. - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: Requirement IDs beginning V2. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-21' version: '0.2' source: Batch 10 AI-assisted clinical review (Medical Research Assistant), Oct 21, 2026 items: - >- Link-loss wording (X5 and comms) fixed: the stray word "crew" before the list of what continues is removed, so the sentence reads, for example, "the exam already under way and all crew care continue under the onboard checklist" (R6). - >- Limits of privacy and ground escalation: the consent notice and S2 now say "If the person you are talking to believes you or someone else is in immediate danger, they will contact the CMO and the commander directly."; S7: if the ground support is concerned for anyone's safety, during or after the call, they contact the CMO and commander directly by voice and RMP-BEH-001 applies; no call content is passed to the robot, which returns only when a human asks (R7). - >- In-call help control: a one-touch "get help" control on the call screen sends an URGENT alert to the CMO and the flight surgeon saying only that help was asked for; the robot returns and RMP-BEH-001 or RMP-CARD-001 applies as the humans decide (new stop rule X11, new red flag, robot_may, and L2 now lists it as the second in-call control) (R8). - >- A "no response" URGENT alert says only that the crewmember did not respond to the robot, never that a call was requested (S5); the CMO is told about a call only with the crewmember's agreement (S4, kept). - >- Store-and-forward messages are deleted from the vehicle once delivery is confirmed, and replies are shown only on the crewmember's own screen (L3) (S6). - >- Fixes applied; held from publication until the Medical Research Assistant verifies them (review state: fixes applied, pending verification). - date: '2026-10-21' version: '0.3' source: Batch 10 verification pass (AI-assisted, Medical Research Assistant), Oct 21, 2026 items: - 'Verification: R6, R7 and R8 verified as applied (PASS).' - >- Editorial: the rung note and the why now name both in-call controls, the robot's stop and the call screen's "get help" control, matching L2 and R8. - Review state set to reviewed-ai-assisted; it publishes with the next release.