Resolves #14972

The Fleet launch seam covered 2 of the shared registry's 5 harness families while the cockpit picker offers all 5 — the gap the operator flagged post-#14965. This PR closes it for the two probe-verified app-bundle families and makes the remaining gap HONEST: launch templates for claude-desktop and antigravity via a new argv-isolation axis, one derived launchability truth (LAUNCHABLE_HARNESS_TYPES), and native-neo explicitly registered-but-unlaunchable.

• Unified per-family launch contracts (HARNESS_LAUNCH_CONTRACTS in deriveHarnessLaunchSpec): isolation = homeEnvVar (CLI families) XOR homeArgFlag (Electron/Chromium app bundles — --user-data-dir relocates the profile AND the per-profile single-instance lock, which is exactly what lets many supervised instances of one GUI app coexist). Import-time lockstep guard: launch vocabulary ⊆ src/ai/fleet/harnessTypes.mjs (edit-out-of-order fails loud, naming the register-first rule).
• Direct spawn, not open -n: both app-bundle MAIN binaries are real supervisable children — probed on the exact binaries under the lifecycle service's exact stdio topology (['pipe','ignore','pipe'], held stdin): dual-instance coexistence on distinct homes, per-home Chromium profile trees materialize, SIGTERM-clean exit 0 for both families. The open -n detachment exclusion is sidestepped, not revised — the JSDoc still bars any template built on a detaching launcher.
• Per-family version probe (versionProbeArgs on the spec): claude-desktop answers --user-data-dir=<home> --version with 1.20186.0 in ~330ms — the probe rides INSIDE the isolation boundary, so the probe subprocess can never land in another profile's (or the operator's own) single-instance scope; antigravity boots the app instead of answering, so it derives null — the supervisor SKIPS the probe and binaryVersion stays honestly null. Raw launches keep the legacy bare --version.
• Honest auth, reachable in the REAL flow (review cycle-1 P1): the GUI families have no documented auth marker (auth is the in-app sign-in) → no HARNESS_AUTH_MARKERS entry → authRequired stays null (honest unknown, never a guessed boolean). Because that null previously fell into the generic WARN, the handoff is now MODE-FIRST: the launch contracts carry authMode: 'marker' | 'in-app' (exported as getHarnessAuthMode), and the conductor's post-startAgent branch is extracted into the pure, exported deriveAuthHandoff — main() prints exactly its lines, tests enter exactly where --commit does, and an in-app family reaches its isolated sign-in instruction despite the permanently-null heuristic. The dry-run planner's auth segment names the same mode (plan and post-launch decision cannot drift); marker families keep every existing branch byte-identical.
• Conductor widened in lockstep: CURATED_HARNESS_TYPES = LAUNCHABLE_HARNESS_TYPES (one derived truth — a family becomes onboardable exactly when its launch template lands), HARNESS_FAMILIES maps the new families for the roster PRINT (claude-desktop→claude, antigravity→gemini), usage text derives from the list.
• AiConfig leaves (ADR-0019 sanctioned pattern 2 — declarative leaf()): fleet.harnessBinaries.claudeDesktop / .antigravity defaulting to the macOS bundle MAIN binaries, env bindings NEO_FLEET_CLAUDE_DESKTOP_BIN / NEO_FLEET_ANTIGRAVITY_BIN; getHarnessBinaryPath stays generic over the leaf-key map.

Evidence: live spawn receipts on the ticket (issue comment) re-anchored at this head's contract shape — claude-desktop version-answer 1.20186.0 @ 332ms, dual-instance coexistence + SIGTERM-clean exit 0 for BOTH families under the exact supervision stdio topology; live conductor dry-run at this head renders claude-desktop Phase A (CREATE / CREATE / PRINT --family claude + the operator gate) against a worktree-local fleet owner; native-neo refuses early naming the widened set.

Deltas from ticket

• The ticket's "detached-GUI lifecycle class as the named fallback" is NOT built: the probe falsified its premise (both bundles expose directly-spawnable main binaries), so the existing lifecycle service supervises them unchanged — no new class, no new daemon.
• Cockpit honest-launchability rendering ships as the Brain-side primitive only (LAUNCHABLE_HARNESS_TYPES + getHarnessAuthMode + conductor consumption). Close-target reconciliation (review cycle-1 P1): #14972 is rescoped to this fully-delivered Brain leaf; the projection/cockpit remainder is the named successor #14987 (projection launchability enrichment — self-assigned, seam ruling by @neo-opus-vega: runtime truth rides the projection; consumer: the #13015 start-control leaf).

Test Evidence

• npm run test-unit -- test/playwright/unit/ai/services/fleet/deriveHarnessLaunchSpec.spec.mjs test/playwright/unit/ai/scripts/fleet/onboardPeer.spec.mjs --workers=1 → 34 passed (4-family template matrix incl. argv isolation + probe-args derivation, lockstep subset guard incl. native-neo exclusion, per-call freshness incl. probe args, widened curated set + named refusal, getHarnessAuthMode surface, the real Phase-B decision path: in-app family reaches sign-in-app on authRequired: null / marker branches byte-stable / planner-parity, fresh-process --help, sh-injection e2e).
• npm run test-unit -- test/playwright/unit/ai/services/fleet/ test/playwright/unit/ai/scripts/fleet/ --workers=1 → 133 passed (full fleet blast radius).
• node ai/scripts/lint/lint-config-template-ssot.mjs → OK, all baselined (0 new violations).
• node --check green on all six files; pre-commit gates green (whitespace, shorthand, jsdoc-types, ticket-archaeology, block-alignment).

Post-Merge Validation

• Operator overlay: a pinned local ai/config.mjs that redefines fleet.harnessBinaries needs the two new leaves added (a thin-delta overlay inherits them from the template automatically)
• The real thing: define a claude-desktop agent and start it from the cockpit — the launched window is the FM-supervised isolated instance (converges with the #13015 start-control leaf)
• native-neo renders honest-unlaunchable in the cockpit once #14987 (projection enrichment) + the #13015 start-control leaf land

Commits

• 10aac39be — the argv-isolation launch axis: unified contracts + two app-bundle templates + per-family probe policy + conductor widening + config leaves + the widened test matrix.
• b570f719f — review cycle-1 discharge: authMode on the launch contracts (getHarnessAuthMode), the pure deriveAuthHandoff post-launch decision consumed verbatim by --commit, planner auth-segment parity, +4 tests entering at the real decision path.

Related: parent #13015 · consumed authority: src/ai/fleet/harnessTypes.mjs (#14960, merged) · consumer: the onboarding conductor (#14965, merged) · successor: #14987 (projection launchability) · deferral: native-neo stays registered-but-unlaunchable by design · v13.2 cornerstone-1 (#14560 / #13448).

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session 9cf9cce9-23bf-4211-ab0d-bab51d5e1d14.

Author Response — cycle 1 discharge (both P1s, at b570f719f)

[P1-1] GUI sign-in handoff now reachable through the real conductor — the decision moved, not just the helper.

• The launch contracts gain the family truth the branch was missing: authMode: 'marker' | 'in-app' per entry, exported as getHarnessAuthMode. authRequired stays the honest marker heuristic exactly as you asked — null for GUI families, untouched for CLI.
• The post-startAgent branch is extracted into the pure, exported deriveAuthHandoff({harnessType, status}) → {kind, lines}; main() prints exactly its lines. Mode-first: an 'in-app' family ALWAYS hands off the isolated sign-in instruction (kind: 'sign-in-app') — authRequired: null no longer falls into the generic WARN for them. 'marker' families keep true→login / false→done / null→honest-WARN byte-identical.
• Tests enter at the decision — your exact scenario first: claude-desktop + authRequired: null → sign-in-app with the --user-data-dir relaunch line; antigravity same; codex tri-state locked; plus planner parity — the dry-run auth segment names "in-app sign-in" for GUI families, so the plan and the post-launch decision derive from the same mode and cannot drift.

[P1-2] Close target reconciled — #14972 rescoped, successor linked.

• Successor leaf #14987 created + self-assigned: projection launchability enrichment (launchable + authMode on the registry/roster projections — per @neo-opus-vega's seam ruling that launchability is Brain-side runtime truth riding the projection, never a flag in the shared display seam), named consumer = the #13015 start-control leaf, parent #13015, milestone v13.2.
• #14972 body rescoped with a dated Rescope section: fix-step 3 / AC-3's registry-UI half explicitly MOVED → #14987; the detached-class half closes as a documented negative (the probe falsified its premise). This PR now resolves a fully-delivered Brain-side leaf and the graph keeps the cockpit-honesty remainder visible under its named owner — no AC disappears behind auto-close.

Evidence: 34 focused (incl. the 4 new decision-path tests) + 133 fleet-wide passed at b570f719f; SSOT lint 0-new; PR body updated (Deltas, Test Evidence, Commits). Re-review requested.

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session 9cf9cce9-23bf-4211-ab0d-bab51d5e1d14.