# RMP-PHARM-004 Controlled-medicine count with a crewmember: a blind two-person count, comparison with the inventory record and a private discrepancy flag (no hand-over) # Version 0.3 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' version: '0.3' status: draft conceptual: true not_for_clinical_use: true max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-21' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant (batch 12 review, Oct 21, 2026, then verification passes). The verification pass (Oct 21, 2026) found the v0.3 text clinically clean and R1 to R5 applied; publication of this exact content (contentSha cc3ce1c9…7ea6c) was decided by the foundation owner (Oct 21, 2026) under PHARM change control. No named human clinician has reviewed it. Not for clinical use. reviewed: '2026-10-21' verified_version: '0.3' verified: '2026-10-21' fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true id: RMP-PHARM-004 slug: rmp-pharm-004 title: >- Controlled-medicine count with a crewmember: a blind two-person count, comparison with the inventory record and a private discrepancy flag (no hand-over) category: pharm tier: 3 rung_note: >- Max rung 2: on the CMO's command or an accepted schedule prompt, the robot logs a count that two humans make (the CMO and a second crewmember as witness), scans labels without touching any pack, compares the counts with the RMP-PHARM-001 inventory record and flags any discrepancy privately. The robot is never the second counter, never opens the controlled store and never holds, takes or hands over any medicine. The RMP-PHARM-001 rules apply unchanged. result_language: use: - >- COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review. - 'MISMATCH: . NOT VERIFIED. Quarantined.' - 'CANNOT VERIFY: . NOT VERIFIED. Quarantined.' - count as stated by - 'printed expiry: ' - record correction logged never: - normal - no problem found - all clear - negative - any diagnosis or cause - verified safe - safe to take - OK to give - MATCH (on its own, without "to the inventory record") - missing - stolen - taken by - diverted - in date - usable - fine to use - safe - mild - minor scope: summary: >- On the CMO's command, or when the CMO accepts the on-screen prompt at the count times the pharmacy lead and flight surgeon set (for example each crew handover), the CMO opens the controlled-medicine store with a second crewmember present as witness. Each of them counts each item without seeing the record count (a blind count) and states it; the robot scans each label as it is shown, logs both counts word for word, and only then compares them with each other and with the RMP-PHARM-001 inventory record field by field. Anything that does not match is quarantined by default exactly as in RMP-PHARM-001 and flagged privately to the flight surgeon and the pharmacy lead. The robot never names or suggests who might be responsible. why: >- Hospital guidance has two authorized health care workers count controlled substances held outside automated cabinets at each shift change, and identifies and investigates discrepancies promptly (ASHP 2022, used by analogy). NASA tracks the location and quantity of medicines (V2 7059), and long missions make inventory control more important (OCHMO-MTB-012). The robot is not a second counter: two humans count, and the robot logs, compares and flags. The RMP-PHARM-001 rule applies unchanged: a mismatch is quarantined by default, handed over only on the CMO's explicit two-step request inside RMP-PHARM-001, logged as an override and flagged to the flight surgeon. The blind count, the count times and the private flag are design judgment. Open question for review: whether the count needs a second trained CMO as witness, or any crewmember. covers: - Scheduled and on-command two-person counts of the controlled-medicine store - >- Comparison with the RMP-PHARM-001 inventory record (medicine, strength, form, quantity, lot, location, printed expiry) - Quarantine of anything that does not match, as in RMP-PHARM-001 - 'Other medicine inventory: RMP-PHARM-002; logging a dose given: RMP-PHARM-003' locked_out: - Diagnosis or naming a cause - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen - Touching the crewmember - >- Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override) - Acting as the second counter or witness - Opening the controlled store, or holding its key or code - Holding, taking, moving or handing over any medicine (the CMO moves items into quarantine) - Showing the record count, or either count, before both counts are entered - Saying or suggesting who took an item, or that anything was stolen or diverted - Changing an RMP-PHARM-001 order (never) - >- Changing the inventory record outside the two-step record correction the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact); a correction is never decided by the CMO alone or by the robot, fixes the record only, and never takes an item out of quarantine - Saying a medicine is in date, usable or fine to use - Dose-interval cues of any kind (the robot never says when a medicine is due) related: - RMP-PHARM-001 - RMP-PHARM-002 - RMP-PHARM-003 - RMP-BEH-002 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - 'Second trained CMO: receives every alert and flag and takes over if the CMO is unavailable' - 'Witness: a second crewmember who counts independently' - 'Pharmacy lead (ground): investigates discrepancies and decides record corrections' robot_may: - Prompt the CMO at the count times set - Scan labels as they are shown, without touching any pack - Log both counts word for word - Compare the counts with the inventory record - Flag discrepancies privately to the flight surgeon and pharmacy lead robot_may_not: - Count as the second person or witness - Open the store or hold its key or code - Hold, take or hand over any medicine - Say who might be responsible for a discrepancy - Say when a medicine is due - Change an RMP-PHARM-001 order (never) - Start without a human command or an accepted schedule prompt commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- The CMO started the count by command or accepted the scheduled prompt on screen, and a second crewmember is present as witness; no URGENT alert, emergency protocol or cabin alarm is active. check: human_start == true refs: - V2 10174 - id: PRE-2 text: Robot self-test passed; kit stowage locations known. refs: - V2 10161 - V2 7059 - id: PRE-3 text: Robot and supplies restrained when not moving. refs: - V2 7046 - id: PRE-4 text: Link status known. The crew never wait for the robot before acting. check: link_state in [live, delayed, down] consent: standard: >- The count involves no crewmember's body; the CMO and the witness agree to their names and counts being logged. emergency: A count stops at once for any emergency; the store stays open to the crew for emergency use. withdrawal: The CMO can stop a count at any time; items not counted are listed as "not counted". inputs: - id: IN-1 name: >- Inventory record for the controlled store (medicine, strength, form, quantity, lot, printed expiry, location) source: RMP-PHARM-001 inventory record (local copy when the link is down) required: true if_missing: CANNOT VERIFY for the store; the count is logged as stated only. - id: IN-2 name: Count of each item as stated by the CMO, and by the witness source: CMO and witness required: true if_missing: 'CANNOT VERIFY: count not stated; quarantined.' - id: IN-3 name: Barcode and label of each pack, as shown source: Robot scanner required: true if_missing: 'CANNOT VERIFY: unreadable label; quarantined.' - id: IN-4 name: Count times, set by the pharmacy lead and flight surgeon source: Pharmacy lead required: false if_missing: Counts on command only. - id: IN-5 name: Link status and delay source: Communications system required: true if_missing: Treat as link down; work from the local record copy. steps: - id: S1 actor: robot rung: 2 action: >- Tell the flight surgeon, the CMO and the pharmacy lead that a controlled-medicine count has started, with who is counting (logged and sent with the next package; URGENT only if a red flag is stated). Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. success: Notice logged. refs: - V1 3006 - V2 10174 action_type: alert - id: S2 actor: crew action: >- The CMO opens the controlled store with the witness present. The CMO and the witness each count each item without seeing the record count, and enter their count privately on their own screen; no count is spoken, and neither count nor the record count is shown until both are entered; the CMO holds up each pack label to the scanner. success: Both counts stated for each item. refs: - V2 7059 - id: S3 actor: robot rung: 2 action: >- Scan each label as the CMO shows it, without touching any pack, and log each count as entered, with who entered it. Show no count and no record count for an item until both counts for it are entered. success: Labels scanned; both counts logged. refs: - V2 7059 action_type: scan-compare - id: S4 actor: robot rung: 2 action: >- Compare the two counts with each other and with the inventory record field by field (medicine, strength, form, quantity, lot, printed expiry, location). Show "COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review." only when both counts and every field match; otherwise show MISMATCH or CANNOT VERIFY with the fields named. Show the date as "printed expiry: ". success: Each item shown with its result. refs: - V2 7059 action_type: scan-compare - id: S5 actor: crew action: >- For each MISMATCH or CANNOT VERIFY, the CMO, with the witness present, seals the item in a labelled NOT VERIFIED bag in the quarantine section of the controlled store, then closes and reseals the store and states the new seal number. success: Items quarantined; store resealed. refs: - V2 7059 - id: S6 actor: robot rung: 2 action: >- Record each quarantine and the new seal number as stated, and update the inventory record status to NOT VERIFIED for those items. The robot never holds, takes or hands over anything. success: Record updated. refs: - V2 7059 action_type: log - id: S7 actor: robot rung: 2 action: >- After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged. success: Robot at rest in the module until a human releases it; alert acknowledged or escalated. refs: - V2 10173 - V1 3006 action_type: stay - id: S8 actor: ground action: >- The pharmacy lead and flight surgeon investigate each discrepancy, and the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact) any record correction. A correction is never decided by the CMO alone or by the robot. success: Decisions logged. refs: - V1 3004 - id: S9 actor: robot rung: 2 action: >- Send one private report to the flight surgeon and the pharmacy lead (and the CMO): items counted, both counts, each result, quarantined items and the seal number; it names only the counters, never anyone as responsible. success: Report delivered or queued; acknowledged. refs: - V1 6003 - V1 7003 action_type: send decisions: - id: D1 after: S1 decided_by: robot question: Is a second crewmember present to count as witness? branches: - if: 'Yes' then: Continue. - if: 'No' then: >- The count does not start: log "CANNOT VERIFY: no witness" and tell the CMO; the robot is never the second counter. No hand-over. handoff: none - id: D2 after: S3 decided_by: robot question: >- Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? branches: - if: 'Yes' then: >- Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. - if: 'No' then: Continue. - id: D3 after: S4 decided_by: robot question: Did both counts and every inventory field match the record for this item? branches: - if: 'Yes' then: >- Record "COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review." and continue to the next item. - if: No, or a check could not be done then: >- HARD STOP for that item. Show MISMATCH or CANNOT VERIFY with the fields named (for example the two counts differ, a count differs from the record, the lot or location differs, a tamper seal is broken, or a label is unreadable). The item is quarantined by default, as in RMP-PHARM-001: the CMO, with the witness present, seals it in a labelled NOT VERIFIED bag in the quarantine section of the controlled store, and the robot records it. No hand-over. An item leaves quarantine only inside RMP-PHARM-001, on a real order, through its unchanged two-step CMO override (logged as an override and flagged to the flight surgeon). A record correction fixes the record only and never takes an item out of quarantine. handoff: none - if: >- A record correction that the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact), never the CMO alone and never the robot, entered in two steps: by the pharmacy lead from the ground, or, with the link down, by the CMO and the witness together (two people, neither stating for the other), flagged, and reviewed by the pharmacy lead at the next contact then: >- Record correction only. No hand-over: the robot reads back the fields to change, updates the record when the second step confirms it, flags the correction to the flight surgeon at once (queued if the link is down), and logs a recount by the CMO and the witness against the corrected record. Any use of the item goes only through RMP-PHARM-001 on a real order. The correction fixes the record only: the item stays quarantined. handoff: none - if: Anyone asks the robot for a quarantined item then: >- No hand-over in this protocol. The robot says that a quarantined item leaves quarantine only inside RMP-PHARM-001, on a real order, through its two-step CMO override, and logs the request. handoff: none - id: D4 after: S9 decided_by: robot question: Did the flight surgeon or the CMO acknowledge the report within minutes? branches: - if: 'Yes' then: Log the acknowledgement. - if: No response then: >- URGENT: log "no response" (never "declined"); the report goes to the second trained CMO, or the next named crewmember, who checks on the CMO in person. - id: D5 after: S8 decided_by: ground question: What happens to each quarantined item, and is a record correction needed? branches: - if: Link live then: Flight surgeon decides; robot logs. - if: Link down or delay too long then: >- The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact. verification: kind: controlled-count fields: - medicine - strength - dose_form - quantity - lot - location - expiry - record_flags recipient_check: >- No hand-over in this protocol. Any use of a medicine runs through RMP-PHARM-001, which confirms the recipient. match_label: >- COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review. on_mismatch: hard_stop: true default: >- Sealed by the CMO, with the witness present, in a labeled NOT VERIFIED bag in the quarantine section of the controlled store; the robot records it. No hand-over in this protocol. unprompted_handoff: false handoff_to_anyone_but_cmo: false logged_as: record-correction cmo_override: allowed: false who: CMO request: >- Two-step record correction only, never a hand-over and never a release from quarantine: the record error the pharmacy lead decided is stated, then confirmed in a separate step; the correction fixes the record only. steps: - >- The pharmacy lead states the correction from the ground (with the link down, the CMO and the witness state it together, neither stating for the other); the robot reads back the fields to change. - >- The correction is confirmed in a separate, deliberate step; the robot updates the record and rescans the item. log: - timestamp - cmo_identity - reason - mismatched_fields - item_barcode - pharmacy_lead_decision - witness_identity - link_state notify_flight_surgeon: >- Every record correction is flagged to the flight surgeon and the pharmacy lead at once; a correction entered with the link down is queued, flagged and reviewed by the pharmacy lead at the next contact. statement: 'NOT VERIFIED - MISMATCH: . Record correction only; no override.' decided: >- Same rule as RMP-PHARM-001 and RMP-PHARM-002, applied unchanged: no hand-over in a count protocol; the RMP-PHARM-001 mismatch rule (quarantine by default, hand-over only on the CMO's explicit two-step request inside RMP-PHARM-001, logged as an override and flagged to the flight surgeon) stays as it is. A record correction never takes an item out of quarantine (batch 12 review R2). scan_failure: >- No match; the item is quarantined. The item leaves quarantine only inside RMP-PHARM-001 on a real order; a record correction fixes the record only. The robot never scans a substitute label or another package (proxy scan). stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses: before it holds, it moves to a position clear of a hatch route or a crewmember's route (it never pauses in one), and tells the CMO. This pauses robot movement only: crew access to medicine stores and all crew care continue under the onboard checklist and never wait for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: An URGENT alert is not acknowledged within the set time action: >- Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own. level: urgent refs: - V1 3006 - V2 10173 - id: X7 trigger: The crewmember stops responding, or seems confused or drowsy, at any point action: >- URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person. level: urgent - id: X8 trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice action: >- Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon. level: stop - id: X9 trigger: Any URGENT alert, emergency protocol or cabin alarm action: >- The count ends at once; the store stays open to the crew for emergency use and is resealed as the CMO directs. level: urgent refs: - V2 10173 - id: X10 trigger: Someone needs the space or route the robot is in action: Robot moves clear at once without contact and holds; it never pauses in a hatch route. level: safe-state refs: - V2 10172 red_flags: - id: RF1 sign: A crewmember needs care during the count (design judgment) threshold: any action: URGENT alert; the count stops and the store stays within the crew's reach - id: RF2 sign: The two counts differ, or a count is lower than the record threshold: any action: Flag privately to the flight surgeon and pharmacy lead at once; the robot never says who took it source: ashp2022 - id: RF3 sign: >- A broken or missing tamper seal on the store or a pack, as seen on the label scan or stated (design judgment) threshold: any action: Flag privately to the flight surgeon and pharmacy lead at once - id: RF4 sign: >- An emergency controlled medicine (for example in the trauma or pain kit) missing or past its printed expiry threshold: any action: >- Flag at once to the CMO, flight surgeon and pharmacy lead; the robot names the item, never a substitute source: tb006 - id: RF5 sign: >- A crewmember says they took a controlled medicine that was not ordered, or more than ordered (design judgment) threshold: any action: >- URGENT alert to the CMO and flight surgeon with the words as stated; the CMO checks in person; the robot does not comment on the amount - id: RF6 sign: Talk of self-harm or suicide, or of not wanting to be alive threshold: any (if not sure, treat as yes) action: >- URGENT private alert to the flight surgeon now; the CMO if the link is down or delayed (the second CMO if the CMO is the person concerned); the pre-flight plan for securing medicines is followed. See RMP-BEH-002 and RMP-BEH-001. source: ng225 safety_limits: - id: L1 name: Contact with the crewmember value: not allowed enforced: Keep-out zone in the robot controller refs: - V2 10172 - id: L2 name: Holding, taking or handing over a medicine, or opening the controlled store value: not allowed enforced: No such task is loaded; the gripper is locked during a count - id: L3 name: Showing the record count, or either count, before both counts are entered value: not allowed enforced: No count and no record count is sent to any display until both counts for the item are entered - id: L4 name: Robot speed near the crewmember value: enforced: Hard limit in the controller refs: - V2 10172 - id: L5 name: Robot in a crewmember's route or blocking a medicine store during care value: not allowed enforced: Keep-out map in the robot controller logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Each item counted: both counts with who stated them, the label scan, the result, any quarantine and time; the store seal number before and after; every record correction (timestamp, CMO identity, reason, mismatched fields, item barcode, pharmacy lead decision) and its flight-surgeon flag. Reports name only the counters. refs: - V2 7059 - id: LOG-6 text: >- Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot. refs: - V2 10163 requirements: - id: V1 3004 use: >- Medical care and pharmaceuticals are planned for the mission; the pharmacy lead and flight surgeon investigate discrepancies. - id: V1 3006 use: >- Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note). - id: V1 6003 use: Logs and alerts sent to the ground are private medical communications. - id: V1 7001 use: Records kept so the flight surgeon can see trends. - id: V1 7003 use: Secure handling of medical records. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7046 use: Patient, caregiver and supplies restrained. - id: V2 7055 use: Medicine stores stay accessible to the crew during a count. - id: V2 7059 use: >- The inventory system tracks the location and quantity of each medicine pack; two humans count and the robot logs and compares. - id: V2 10161 use: Robot shows its status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human can override and shut down the robot. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop when a limit is exceeded. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Seeded counts with the two counts differing, a count lower than the record, a broken seal, no witness, a request for a quarantined item, an alarm mid-count. pass: >- Every discrepancy quarantined and flagged privately; zero hand-overs; zero counts without a witness; zero record counts shown before both counts. - stage: training model what: Count of a mock controlled store. pass: Count completed without the robot touching a pack. - stage: parabolic or station demonstration what: Label scanning in weightlessness. pass: Every pack scanned or listed. - stage: flight use under flight surgeon supervision what: First counts alongside the crew's paper count. pass: Agreement with the paper count; no unflagged discrepancy. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Started by the CMO or an accepted schedule prompt, with a witness present. Two humans count; the pharmacy lead and flight surgeon decide every discrepancy. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: 'Low Earth orbit: the pharmacy lead and flight surgeon receive the report when the link allows.' loss_of_signal: - >- Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and tells the CMO; it resumes offline only on the CMO's confirmation. - >- Crew access to medicine stores and all crew care continue under the onboard checklist and never wait for the link or the robot. - The robot works from the local record copy; quarantine stands without the ground. mars_delay: - Count times are set before flight; the CMO decides on quarantined items under the onboard checklist. sources: - key: ashp2022 text: >- American Society of Health-System Pharmacists. ASHP Guidelines on Preventing Diversion of Controlled Substances. Am J Health-Syst Pharm. 2022;79(24):2279-2306. url: https://doi.org/10.1093/ajhp/zxac246 doi: 10.1093/ajhp/zxac246 supports: >- Controlled-substance storage areas outside automated cabinets are inventoried at each shift change by two authorized health care workers; discrepancies are identified, resolved and investigated in a timely way, with discrepancy reports reviewed. Hospital context, used by analogy for a two-person count on board. Read Oct 21, 2026 (saved copy in src/b12). - key: tb006 text: NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026). url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmaceuticals.pdf supports: >- Exploration missions of 1-5 years will outlast typical medication expiration dates of 1-2 years; medication storage and inventory tracking are linked to NASA-STD-3001 [V2 7059]. - key: ng225 text: >- National Institute for Health and Care Excellence. Self-harm: assessment, management and preventing recurrence. NICE guideline NG225 (2022). url: https://www.nice.org.uk/guidance/ng225/chapter/Recommendations supports: >- Do not use risk assessment tools and scales, or global low/medium/high risk stratification, to predict future suicide or repetition of self-harm, or to decide who is offered treatment. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: 'NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 7003.' - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: 'NASA-STD-3001 Vol 2 Rev F: V2 7055, V2 7059, and Section 10.6 automated and robotic systems.' - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-21' version: '0.2' source: Batch 12 AI-assisted clinical review (Medical Research Assistant), Oct 21, 2026 items: - >- R1: the count has its own verification kind, controlled-count, with the administration log's build-check guardrails: every hand-over rule is "none", robot steps declare action_type (alert, scan-compare, log, stay, send), the R5b every-field checks and the R5c layers run on it, and these lockouts are required: opening the store or holding its key or code, being the second counter or witness, holding, taking or handing over any medicine, showing the record count before both counts, naming a suspect, dose-interval cues and changing an RMP-PHARM-001 order. The reviewer's K1 to K10 run as negative tests. - >- R2: a record correction fixes the record only and never takes an item out of quarantine; any use goes only through RMP-PHARM-001 on a real order. A correction is entered by the pharmacy lead from the ground, or with the link down by the CMO and the witness together (neither stating for the other), flagged and reviewed at the next contact. Source: ASHP 2022 (a pharmacist oversees discrepancy investigation); the rest is design judgment. - >- R3: the mismatch statement is "NOT VERIFIED - MISMATCH: . Record correction only; no override.", logged as a record correction (it read "Override by CMO logged" while no override was allowed). - >- R4: each counter enters their count privately on their own screen; no count is spoken, and neither count nor the record count is shown until both are entered (new L3). The keep-out limit is now L5. - >- R5: source title corrected to NASA OCHMO, Pharmaceutical Care, Medical Technical Brief OCHMO-MTB-012 Rev B (2026), as in RMP-PHARM-003. - >- Batch 12 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026); no named human clinician. - date: '2026-10-21' version: '0.3' source: Held batch 12 verification (AI-assisted), Oct 21, 2026 items: - >- Who decides a record correction, made consistent: S8, the record-change lockout and the D3 correction branch all say the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact); a correction is never decided by the CMO alone or by the robot (verification suggestion).