Arming Fields for Contingency Protocols: What a Future Rung-4 Envelope Must Declare

Why this article exists

Part 5 added contingency rungs 4–5 to the series ladder: certified clinical autonomy inside a pre-certified envelope, and last-resort broader judgment, that arm only when human support is unavailable or insufficient. Its “what comes next” asked for two things that do not contradict each other:

1. Keep library walks and validation on rungs 1–3 as the near-term path.
2. Treat rung 4/5 envelopes as research questions for certification design — not silent edits to today’s RENAL or PHARM defaults.

Part 6 does the second without pretending the first is done. It walks the fields a future contingency protocol would have to declare before anyone could honestly say it is armable. The protocol library stays on supervised logistics, imaging assist, barcode checks and human-led emergencies. Research-only entries (robot compressions, suturing, airlock rescue assist) stay research-only.

What “arming fields” means

A library protocol today already carries scope, lockouts, steps, red flags, stop rules, logs and NASA-STD-3001 requirement IDs (see the schema and Part 1 skeleton). Contingency adds a second layer that is off by default:

These names are design labels for this series, not a claim that NASA or a regulator has adopted them. A real program would map them into its own configuration-control and change-control process (Part 3’s validation ladder still applies).

Walking one envelope end to end (still speculative)

Reuse Part 5’s speculative vignette shape, now tagged to fields:

1. Trigger evidence (arm_triggers + evidence_required): Mars-class delay; private medical link past timeout; CMO incapacitated; no other capable authority for that acuity. Evidence logged — not assumed.
2. Arm (max_rung: 4): mode announced ship-wide and queued to Earth. Status display shows “armed — envelope X” ([V2 10161], [V2 10162]).
3. Act inside allow-list: assess only listed findings; select only listed formulary/actions; physical medicine items still match order fields or quarantine (Part 4). Anything outside allow_list or on deny_list → hold / safest listed actions.
4. De-arm (de_arm): link returns or a capable human takes authority → automatic drop to rung ≤3; full log available ([V2 10163]).

If the envelope had not matched, the robot would not invent a path. Rung 5 appears only if the matrix listed it for that trigger class and no narrower envelope applied — still with announce, log and human override.

What stays locked for the published library

• Rungs 1–3 remain the scannable capabilities board columns. Contingency is a note and a Part 5–6 article track, not a fourth board column pretending it is cleared.
• “Never diagnoses / no drug or fluid advice” remains the default for every current library draft.
• RMP-PHARM-001 mismatch → quarantine → no “verified” language → logged two-step CMO override stays the pharmacy path. Default mismatch_policy = Part 4 / RMP-PHARM-001. Contingency prescribe does not silently delete barcode checks; a rung-5 override class applies only if pre-authorized and logged.
• Research-only library rows (for example robot chest compressions, suturing a marked line, airlock rescue assist) are not promoted by this article.
• Human start / override / e-stop restart ([V2 10174], [V2 10165]) remain today’s NASA-STD-3001-shaped defaults. Auto-arm would need standards evolution, as Part 5 said — and Part 5’s arming preference still applies: prefer human-declared arming whenever any capable human exists (Part 5 · Contingency arming triggers).

Relationship to co-certification gates (Part 5)

Part 5 listed gates that are not asserted as complete today: co-certification of model + robot + kit against an exploration condition list; blinded trials with pre-set pass/fail; formulary allow-lists with expiry; independent safety board + flight surgeon program approval; open liability and consent questions. Arming fields do not replace those gates — they are the machine-readable place a future certified envelope would record what was approved (including consent_basis and liability_record as program/legal pointers, not invented legal answers). Empty or stub fields mean not armable — see the hard rule under the field table.

FAQ

Is there a rung-4 protocol in the library now?
No. Part 6 describes fields; it does not add an operational contingency protocol. The library continues on rungs 1–3 drafts.

Can I take today’s RMP-RENAL-001 or RMP-PHARM-001 and flip contingency.eligible?
Not honestly. Eligibility requires a certified envelope, matrix triggers, allow-lists and program sign-off (Parts 3 and 5). A frontmatter flag without that work would be fiction.

Does contingency delete the CMO?
No. When a capable human is available, contingency de-arms. The flight surgeon remains medical authority under delegated-care framing (OCHMO-TB-044; [V1 3006]).

Where do everyday ops live?
Protocol library, shared safety rules, Parts 2 and 4, and the ground console.

Where this sits on the site

• Series hub: Robotic and autonomous medical care
• Part 1 · Part 2 · Part 3 · Part 4 · Part 5
• Capabilities board · Protocol schema · Disclaimer

What comes next

• Continue rung 1–3 library expansion where clinical gaps remain (new drafts still go through Medical Research Assistant review before any claim of reviewed status).
• Keep Part 5–6 framing honest: contingency is fallback, not default.
• Library YAML must keep contingency.eligible absent or false until the Part 3–5 gates and the arming fields above are complete — do not invent eligibility.
• Any future protocol that claims contingency prescribe or operate must carry the arming fields above (or an equivalent controlled schema) plus the Part 3–5 gates — or stay research-only.

Part 6 makes the contingency half of the ladder auditable on paper. It does not clear any robot to diagnose, prescribe, treat or operate today.