Does the pool replace the robot's safety system?

No. The pool is never in the path between a robot and its stop. Element 31 draws a hard line on every site: the Czar Grid serves perception and decisions, and the robot keeps stops, speed limits, reflexes, and motion limits on the machine, exactly as its vendor shipped them. The pool makes the robot better informed. It does not make the robot's safety behavior depend on a network.

Where the line is drawn

Think of two kinds of question a robot asks. The first is what is in front of me and what should I do next. That question benefits from a model larger than the robot can carry, and it can tolerate a short round trip to a rack in the same building. The pool answers it.

The second is whether to stop right now. That question cannot wait for anything. It has to be answered on the robot, by the robot, with no dependency on a cable, a switch, or a node in a rack. The robot vendor built and tested that behavior for the machine they sell, and the pool leaves it alone.

The pool can inform the second question. Perception from the Grid might tell a robot that a person has entered a zone, and the robot can slow or hold in response. But the stop itself, the speed ceiling, and the motion envelope are enforced on board, and they are enforced whether or not the pool said anything at all.

What happens when the pool fails

A safety system that lives in a shared rack is a safety system with a single point of failure for the whole floor. Element 31 does not build one. Instead, every robot keeps its own on-board model for reflexes and falls back to it the moment the pool cannot answer within the robot's latency budget.

So if a node is pulled for an update, if a switch dies, or if the pool is simply busy, the robot behaves the way its vendor designed it to behave without outside help. It moves carefully, finishes a simple motion, or stops and waits. The outcome of a pool failure is a robot that stops, not one that guesses.

What this means for the safety officer

The safety officer on the floor keeps a single owner for each robot's stops: the robot vendor. Adding the pool does not add a second party to that conversation. The vendor's behavior for stops, speeds, and motion limits is unchanged, and the vendor can say so to their customer because the Grid never asks for that authority.

Agency Studio adds a layer the safety officer can read. Site tasks are authored with bounds, including zones, speeds, distances, and stops, and are approved by named roles before they run. Those bounds sit above the robot's own limits, never beneath them. A task can ask less of a robot than it is capable of; it cannot ask more than its safety system permits.

That is the whole answer. Perception and decisions come from the pool. Safety stays on the robot. The Czar Grid page describes how the pool is placed in a building, and the technology page covers how Substrate holds each robot's latency budget so that fallback happens on time.