​
Anyone in the room can drive

Control is first come and unauthenticated. The follower grants the lease to whoever claims it first and does not check who they are. There is no handover queue and no operator identity. The room is the boundary. Treat a room id and a token together as the credential that lets someone move your hardware.
Do not put a robot that can hurt someone in a room whose id and token are shared more widely than the people allowed to drive it.

​
Supervision

Run the follower under a process supervisor. systemd, or a Kubernetes restart policy, or whatever already runs on the host.
A restart is safe. The follower starts in HOLDING, applies nothing until a leader claims control, and nothing resumes on its own.
There is a second watchdog you do not configure: if your own loop stops calling tick(), the follower notices and enters a failsafe with reason STALLED. A hung process does not leave the arm armed.

​
Reconnects

A transport drop is not a pause. The follower drops the lease with reason transport:<why> and enters its failsafe, because the lease belongs to a peer that is now gone. When the link comes back, the operator has to claim again. That is deliberate: a session that silently resumed would put an arm back under the control of someone who may have walked away. Set resume_requires_reclaim=True to extend the same rule to a watchdog trip, so the arm stays in HOLDING after commands stop until someone calls Follower.arm().
An emergency stop latches. It survives reconnects and is cleared only by clear_estop() on the follower, which means someone near the arm.

​
Tokens

VIDEOSDK_TOKEN is read at construction. A token that expires mid-session does not stop the session, but the next start() fails with a TimeoutError from the transport, which reads like a network problem and is not.

​
More than one robot

One room per follower and leader pair. A room holds one arm and whoever is driving it. Give each machine its own robot_id. It goes into logs, recordings and the manifest, and two hosts sharing one makes a dataset ambiguous later.
For a fleet, keep the mapping from robot to room outside the SDK. Nothing here does discovery.

​
Network

A session is one WebRTC connection: a data channel for joints and one video track per camera. Measure rather than assume. stats() gives you round trip time, jitter and loss on the live link, and max_staleness_ms should be set from what you actually see under load rather than from the default.
The defaults are deliberately low. Measure watchdog_timeout_s and max_staleness_ms on your own link, with traffic on it, and set them from that. See SafetyConfig.

​
Before you leave it running

1

Set limits()

The default returns {}, which is no position limit at all.
2

Set slew per joint

One number is wrong on a machine whose joints do not share units.
3

Set max_misalignment on the leader

So arming cannot make the arm travel to meet a controller somewhere else.
4

Check the failsafe matches the hardware

on_starvation=TORQUE_OFF drops a gravity-loaded arm. HOLD is the default for a reason.
5

Watch the numbers

Tick overruns, watchdog trips and how many commands correlated. See Monitoring.

Safety

The checks a command passes, and what none of them catch.

Monitoring

Reading a live session’s health.

Cloud recording

Uploading episodes to your own storage alongside the local copy.

Troubleshooting

Symptoms, and what to change.