KB: remote control channel + the interest-teardown audio crash (multiplayer.md)

context/multiplayer.md

@@ -657,6 +657,29 @@ abort + hold + tag-reclaim + no cascade.  OPEN: the host-7 derivation (a 4-seat
 yield 7 = template position of tag .6) — not reproducible synthetically; the first-breath +
 append forensics will capture it live if it recurs.
 
+## Remote operator control channel (2026-07-24) [T2 protocol-tested]
+The relay listens on console_port+7 for operator control: `AUTH <secret>` (auto-generated
+`content/operator_secret.txt`) then `launch` / `stop` / `ping` / `get mission` /
+`set key=value;...` (whitelisted mission keys via eggmodel).  The stamped log stream tees to
+the authenticated operator (bounded per-conn outbufs -- overflow drops the conn, the relay
+NEVER blocks on a slow operator) with a 400-line history replay on connect (mid-session
+operators rebuild roster state from parsed lines).  One operator at a time (new AUTH
+displaces).  stdin commands unchanged (rigs + GUI local mode).  GUI: `Relay host` blank =
+local flow byte-identical (child relay dies with the window -- deliberate); hostname = remote
+drive (launch/stop/apply over the wire; local-instance joins point at the remote relay).
+Only the relay host needs port forwarding.  Verified: scripted protocol suite incl. a full
+2-node mission launched + stopped purely over the socket.
+
+## The interest-teardown audio crash (2026-07-24) [T2 stack-captured + fixed]
+THE layout-shifting release-only crash (weeks of field flakes, #35's prime suspect) finally
+hit a crash-filter build: `InterestManager::OrphanInterestOrigin → RemoveUninterestingEntity
+→ DestroyEntityAudioObjects → {Static,Dynamic}3DPatchSource::IsAudioSourceClipped` — AV
+reading NULL+0x38: the authentic burning-mech death-silence check dereferences
+`GetMissionPlayer()->GetPlayerVehicle()->GetSimulationState()` UNGUARDED, and MP
+join/teardown/respawn windows leave the vehicle briefly NULL.  Both sites now null-guard
+(burning semantics preserved).  ALSO: live proof that interest teardown of entities RUNS in
+MP — the #38 paint-loss mechanism's first half is confirmed fact.
+
 ## Remaining (P6 phase 4 / Phase 7)
 Pod-LAN config: **real-IP path VALIDATED (2026-07-15)** — an egg with the machine's real LAN IP in
 `[pilots]` (not `127.0.0.1`) connected + replicated + moved end-to-end (`Connected to