Merge disposition (2026-07-10): Exact head d66f04a1a8e9424758a0dd7b816c8f2414c43db0 is merge-ready. The explicit-ID same-key replacement edge moved to #14939, assigned to @neo-gpt; it is no longer an author action on this PR. This note supersedes the earlier “no residuals” / “flagged for direction” wording below.

Resolves #14909

Related: #13015 (parent epic) · PR #14905 / PR #14910 (the Store-backed cockpit this completes) · #14807 (account/config arc, consumer of this topology)

Implements the operator's two post-#14905 directives as the established house pattern (Portal.store.*): no store is a singleton — the state.Provider is the sharing scope ("if used inside a state provider, we get it anyway"), and seed data is a fetched JSON file, not inline rows. FleetRoster and AgentDefinitions become plain Store classes; FleetCockpit hosts stores.fleetRoster (autoLoaded from apps/agentos/resources/data/fleetRoster.json via the Store's native url pipeline) with the grid binding bind: {store: 'stores.fleetRoster'}; the Viewport hosts stores.agentDefinitions for its two consumers — FleetSettingsPanel's grid binds it, Accounts binds it onto an agentDefinitionsStore_ config (declarative, resolved once at construct; pop-outs swap render targets only, never the owning component/provider tree — ADR 0029). Consumer migration is atomic: zero singleton: true under apps/agentos/store/**, zero store-class imports under view/** outside the two provider hosts.

Cycle-2 (RC discharge, head 402127635) — the review's three exact-head probes each convicted a real lifecycle gap; all three are fixed WITH the missing chain link the fixes exposed:

1. Provider-owned lifetime (probe 1): state.Provider now tracks instances it creates from stores descriptors (#ownedStores; passed-in instances are shared, never owned) and destroys them in destroy(). Correction from cycle-2's claim (reviewer-caught): the component chain never lacked an outer release — component.Abstract.destroy() already releases the provider at the established post-plugin point; the missing behavior was ONLY the provider-owned store teardown. A duplicated release briefly added to component.Base.destroy() in cycle 2 (which silently reordered provider release AHEAD of plugin teardown) is removed in cycle 4, with a plugin-order regression pinning the inherited release point.
2. Source precedence (probe 2): FleetCockpit now remembers lastLiveRows and guards the roster store's load event (onRosterStoreLoad, attached at construct, detached in destroy): a sample seed landing AFTER live truth re-applies the last authoritative snapshot — idempotent, fail-closed toward live; a seed before live truth passes through (the normal boot path).
3. Destroy-symmetric listeners (probe 3): VerticalScrollbar.afterSetStore now unbinds the old store. The fix surfaced a deeper latent defect: Observable.addListener AND removeListener both mutate the passed listeners object (delete name.scope), so the shared-object value?.on(listeners); oldValue?.un(listeners) idiom — including grid.Container.afterSetStore's pre-existing use — silently never unbinds (on consumes scope, un then can't match). Both call sites now pass per-call copies with an explanatory comment; the Observable API wart itself is flagged below as follow-up material.
4. Stale terminology (rhetorical-drift findings): FleetGrid's "singleton" JSDoc → "provider-hosted instance"; the Accounts "child-window tree after reparenting" rationale corrected to the ADR 0029 model (render targets swap, ownership trees don't).

Evidence: L2 (fresh-browser e2e incl. Neural-Link lifecycle whitebox + local unit runs; sandbox ceiling = local runtime) → L2 required (boot/mount + cross-view sharing are app behavior; contract ACs covered at L1). No residuals.

Deltas from ticket

• Two-line framework enabler (src/grid): provider-bound stores resolve AFTER construction, and grid.Container could not boot storeless — VerticalScrollbar.updateScrollHeight read me.store.count during construct (via afterSetRowHeight, boot crash), and grid.Container.afterSetStore's dynamic-store propagation covered body/bodies/footer but missed the scrollbar. Fixed: a null-guard (me.store?.count ?? 0 — a storeless scrollbar has zero rows) and the missing verticalScrollbar.store = value line, completing the contract the method's own comment already claims ("in case we dynamically change the store…"). This is what makes bind: {store: 'stores.*'} viable on grid.Container at all — the full grid unit tree passes.

• module: StateProvider is load-bearing in component-level provider configs: a stateProvider: {stores: {...}} object without it constructs a broken provider ("Class created with object configuration missing className or module") whose stores never exist and whose binds silently never resolve — the app boots to nothing with no surfaced error. Both hosts declare it explicitly (the AgentCard precedent had it; the portal uses a Provider subclass, which is why its declarations don't show the field).

• Accounts write-path shape: the ticket sketched getStateProvider().getStore(...) at call time; implemented as a construct-time bound config instead because both consumer panels are pop-out capable (popupUrl dashboards) — a call-time tree walk would re-resolve against the child-window tree after reparenting, while a bound instance reference survives it.

• AgentDefinitions' bridge-pending placeholder row stays inline (the ticket left it to the implementer): it is a bridge-state indicator, not sample data.

• Verification-environment incident (not a code issue, documented for the next agent): mid-verification the in-app preview browser stopped booting ANY version of the app — including clean dev (stash-baseline test) — with silent worker-side mount death (Neo.main.DomAccess.applyBodyCls is not a function signature: a stale-cached main-thread framework build mismatching fresh worker code after the night's dev pulls). Falsified as environmental via the stash test + the e2e suite's fresh Chrome, which boots and passes everything. The preview pane needs a profile/cache reset.

• Follow-up candidate surfaced (not fixed here, scope discipline): the Observable on/un caller-object mutation (delete name.delay/once/order/scope) makes the natural shared-object idiom a silent trap framework-wide. A non-mutating rewrite (or an internal copy at the API boundary) is one small PR; flagged for the reviewer/operator to direct.

Test Evidence

• Fresh-browser e2e (the mount authority): 3/3 passed — Cockpit.spec.mjs ("boots to the Fleet cockpit default; Control + Accounts reachable via the rail") + both FleetCockpitLifecycleNL.spec.mjs Neural-Link whitebox tests (UI-driven Start with App-Worker state + minimal bridge payload verification; rejected bridge call renders an error without credentials) — all against this head's provider-hosted topology, JSON seed fetch, and grid binds, in the e2e config's own clean Chrome.
• Local unit runs (no-Chroma canonical shape, --workers=1): grid/ + apps/agentos/ trees together: 186 passed; only the 3 known dev-reproduced boundary transients (eventChip:27 / fleetGrid:103 / healthSwatch:42) remain, unchanged. Changed specs: the roster contract now pins the CLASS shape + url + the JSON seed content (read from the file, engineTag truth map intact) + record hydration via an isolated instance; FleetSettingsPanel/Accounts specs assert the provider-bound topology and the absence of singleton imports; boot-shape probes (provider-hosted settings grid + cockpit) were used during development and removed.
• Construct-time probes: provider-hosted AgentDefinitions + bound settings grid constructs and resolves (grid.store.className === 'AgentOS.store.AgentDefinitions'); cockpit provider + bound fleet grid resolves AgentOS.store.FleetRoster.
• node --check green on all touched files; check-block-alignment green (incl. pre-existing drift in src/grid/Container.mjs + trailing-whitespace in VerticalScrollbar.mjs surfaced by the whole-file gates); check-ticket-archaeology 11 files / 0 violations; grep-proof: rg 'singleton: true' apps/agentos/store/ → zero; store-class imports under apps/agentos/view/** → only the two provider hosts.

Post-Merge Validation

• Fresh-profile browser session: the cockpit renders the seven-agent JSON sample with the sample roster label; the Control grid renders the bridge-pending row from the Viewport provider store; Accounts "Use sample" upserts into the same grid reactively.
• Pop-out regression: detach the Control panel to a child window — the grid keeps rendering its bound store (construct-time instance reference).

Cycles 3+4 (heads a7f4add9a → cca7ba774) — the cycle-2 review's residual edges + the evidence addendum, all discharged:

• Listener re-entry (addendum): Store fires load for its own mutations (mutate → onCollectionMutate → load), so the cycle-2 guard re-entered itself through reconcileRoster's adds/removes — a real stack overflow (~524 frames on a 5k snapshot). Fixed two-layer: a reconcilingRoster latch (try/finally) + batched joiner adds (one load fan-out instead of N). The spec mock-hole is closed: makeLiveCockpit carries an Observable-suitable id and attaches the REAL load listener; both race tests run through the live event path, plus a 1,000-row latch regression.
• Reactive stores replacement (probe 1): replacing/nulling provider.stores now destroys + deregisters owned instances the provider no longer hosts, immediately — passed-in instances survive replacement. Pinned with StoreManager assertions (replacement + null-removal).
• Teardown order (probe 2): the duplicated component.Base.destroy() provider release is removed — component.Abstract.destroy() keeps its established post-plugin release point; a probe-plugin regression asserts plugins observe a LIVE provider during their own destroy.
• Cycle-3/4 local runs: state + component + grid + cockpit trees 165/165 at cca7ba774.

Cycle-5 (head d66f04a1a) — the same-key blocker, root-caused and fixed:

• The mechanism (three probes deep): on same-key replacement, beforeSetStores correctly destroyed the old owned instance and returned a fresh one — but the CONFIG SYSTEM dropped the update: Neo.isEqual compares instances by their serialized (id-based) form, so a fresh store under the SAME predictable id looks "equal" to the destroyed old one → the setter no-ops → stores.roster keeps the destroyed instance while the fresh one orphans live in StoreManager. (Two earlier probes chased phantom leads because core.Base.destroy deletes own properties — probe tags on the old instance vanished mid-investigation.)
• The fix: #storesGeneration — bumped on every reactive stores replacement and suffixed into the predictable ids (${provider.id}__${key}__${gen}), so replacements are never id-colliding no-ops. The public contract is unchanged: consumers bind by KEY (stores.roster); ids are internal.
• Regression: same-key replacement → old destroyed + deregistered, replacement LIVE, distinct, key-resolvable, registered under its own id; provider destroy still tears it down. Trees at head: 166/166.
• Flagged for direction (not fixed here): the underlying wart is Neo.isEqual treating two DIFFERENT live instances as equal because instance serialization is id-based — reference equality for NeoInstance values is arguably the correct config-equality semantic. That is core Config surgery with its own blast radius; happy to file/fix as a follow-up on direction.

Cycle-2 evidence (head 402127635): new regressions mirror the review's probes exactly — state/Provider.spec.mjs +3 (descriptor-created store destroyed+deregistered with the provider · passed-in instance survives · the FULL component→provider→store chain), grid/VerticalScrollbarStoreSwap.spec.mjs NEW (the 64px→3232px probe as a regression: old store inert after swap, new store takes over · null-detach stays inert), fleetCockpit.spec.mjs +2 against a REAL isolated FleetRoster (sample-after-live evicted + live residents restored · seed-before-live passes through). Local no-Chroma runs at head: the 3 touched spec files 41/41; the full grid + state + component + apps/agentos trees 278 passed with only the 3 known dev-reproduced batch-bleed transients (eventChip:27 / fleetGrid:103 / healthSwatch:42 — the review itself attributed them off-PR), each re-verified green solo. node --check + check-block-alignment green on all 10 touched files (whole-file gates pulled 28 pre-existing alignment lines in state/Provider.spec.mjs + 1 in component/Base.mjs, same class of inherited cleanup as grid/Container.mjs at cycle 1).

Commits

• 7dfa531af — the full topology change: both stores de-singletoned, JSON seed + url fetch, cockpit + Viewport provider hosts (module: StateProvider explicit), grid/Accounts binds, the two-line src/grid late-store enabler, spec reshaping.
• 402127635 — cycle-2 RC discharge: provider-owned store teardown, the roster source-precedence guard, symmetric scrollbar/Container store listeners (incl. the Observable shared-object mutation trap), stale-terminology fixes, 6 new regression tests.
• a7f4add9a — cycle-3 (addendum): re-entrancy latch + batched joiner adds; race specs re-wired through the REAL attached listener + 1,000-row latch regression.
• cca7ba774 — cycle-4: owned-store destruction on reactive stores replacement/null (immediate, StoreManager-pinned); duplicated component.Base.destroy provider release REMOVED (inherited post-plugin point preserved, probe-plugin regression); PR-body claim corrected.
• d66f04a1a — cycle-5: #storesGeneration id-suffixing — same-key replacement survives the config equality no-op (Neo.isEqual id-based instance comparison, root-caused); same-key StoreManager regression.

Authored by Vega (Claude Fable 5, Claude Code). Session d2fbbdb4-404b-47e1-bbb3-1b9e0330894b.