PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The pure reducer and shell slot are a useful, correctly placed initial-cold slice, so Drop+Supersede would discard good work. The current close claim still depends on a falsified liveness premise: the existing loaders do not continuously re-poll, and failures preserve prior live owner state.

Peer-Review Opening: The exception-only banner shape is right: one shell line, pure derivation, zero nominal pixels. The remaining gap is not visual polish; it is ownership of the transition that makes the banner honest after first paint.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15284 and parent #13015; exact changed-file list; current FleetCockpit/FleetCockpitController load and refresh paths; existing load-routing tests; #15288 command provider state; #15242 design-signoff precedent; Contract Ledger and Evidence Ladder contracts; exact-head CI.
• Expected Solution Shape: One shell-level consumer may derive display from owner-held source truth, but some existing or newly named owner must actually transition that truth on loss/recovery and retain the reason. The ticket requires initial cold, live loss/recovery without reload, both-theme/design signoff, and an NL touch.
• Patch Verdict: The reducer/slot matches the initial-render shape. The live transition does not: loadActivity/loadRoster run at construction, with a roster re-poll only after successful lifecycle actions; later no-bridge/throw paths preserve live owner states and no reason.
• Premise Coherence: The render-only intent coheres with fail-closed ownership and Neo's exception-based chrome discipline. The current claim conflicts with verify-before-assert because “the adapter states already re-poll” and “always knew why” are not true of the exact source.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15284
• Related Graph Nodes: #13015; #15283; #15288; #15242; operable-cold; Fleet adapter truth; live transition ownership

🔬 Depth Floor

Challenge: A correct reducer cannot create truth its owner never updates. Once both adapter states are live, a server loss either triggers no load at all or reaches a catch/no-bridge path that preserves live. syncSpineBanner therefore remains hidden, and the generic degraded copy has no source reason to render.

Rhetorical-Drift Audit:

• PR description: “the loads re-poll” is contradicted by FleetCockpit construction plus the controller's lifecycle-success-only refresh path.
• Anchor & Echo summaries: “every load exit drives this” describes a call, not a truth transition; failure exits preserve prior live states.
• Test framing: “slot-sync seam unit-pinned” overshoots because every modified fake returns null for the banner reference, making syncSpineBanner a guarded no-op.
• Linked anchors: #15242 does establish Grace's pre-merge design-signoff pattern; that receipt is not present yet.

Findings: Liveness, reason ownership, and consumer evidence drift are merge-gating.

🧠 Graph Ingestion Notes

• [KB_GAP]: The ticket's “existing states already re-poll” premise was stale; current source has no ongoing liveness owner.
• [TOOLING_GAP]: N/A.
• [RETROSPECTIVE]: A display reducer over adapter state is only as live as the mechanism that advances the owning state on failure and recovery.

N/A Audits — 📡 🔗

N/A across listed dimensions: no OpenAPI description or skill/convention substrate is changed.

🎯 Close-Target Audit

• Close-targets identified: #15284.
• #15284 is confirmed not epic-labeled.

Findings: Target type passes; close semantics do not. The live loss/recovery, degraded-reason, Grace signoff, and NL-touch ACs remain unproven or mechanically unreachable.

📑 Contract Completeness Audit

• Originating ticket (or parent epic) contains a Contract Ledger matrix.
• Implemented PR diff matches the Contract Ledger exactly.

Findings: Missing ledger flagged. #15284 has no formal matrix; #13015 says each leaf carries its own ledger but does not provide one covering this banner's truth source, fallback, remedy, docs, and evidence.

🪜 Evidence Audit

• PR body contains an Evidence declaration.
• Achieved evidence meets the close target: L2 is declared sufficient, while #15284 explicitly requires a live no-reload loss/recovery transition and an NL e2e touch.
• Residuals are annotated on the close target: the required transition is deferred only in the PR's Post-Merge Validation while Resolves #15284 would close the ticket.
• Two-ceiling distinction is established: no sandbox ceiling is shown; the live transition owner and direct consumer witness are absent.
• Evidence-class collapse check passes: the 3×3 pure matrix and null-banner fake paths are promoted to “slot-sync” and live-transition delivery.

Findings: Evidence-AC mismatch flagged. Exact-head CI is green, but it proves the pure mapper, not the owner-to-slot transition.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI is 9/9 green at 5768e58edcd7ce7de2507add87d1d990bcb08544; author reports 180/180 focused unit and the existing pop-out e2e.
• Reviewer falsifier: exact-head source trace shows loads at construction, roster refresh only after successful lifecycle intents, failure paths preserving live, and every new fake returning null for fleet-spine-banner. The named transition and consumer concerns reproduced.
• Test location: the pure reducer spec and FleetCockpit unit suite are canonical.
• Required surface evidence: no real banner-slot mutation witness and no ticket-required NL live→loss→recovery touch.

Findings: Existing suites pass; coverage does not exercise the behavior that closes #15284.

📋 Required Actions

To proceed with merging, please address the following:

• RA-1 — establish or truth-fold liveness/reason ownership before approval. Make live→offline/degraded→recovery mechanically update the owner truth and retain a safe reason, then prove the real banner slot mutation plus the required NL transition. If that materially exceeds this leaf because “no new probes” is binding, narrow #15284/this PR to the initial-cold slice and file/link a non-optional liveness successor carrying the original transition/reason/NL ACs before merge. In either shape, backfill #15284's Contract Ledger and align Evidence/Residual claims.
• RA-2 — advertise an operable command at the landed base. npm run cockpit is supplied only by #15288, which is currently Changes Requested and absent from dev. Use the shipped npm run ai:fleet-server remedy for this head, or establish an explicit merge-order/rebase gate once #15288 lands.
• RA-3 — close the explicit design gate. Obtain Grace's required both-theme design signoff on the live banner shape and record the receipt on the PR; zero new literal styling is useful evidence, but it is not the ticket's named signoff.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 72 - Correct pure placement and shell owner; no mechanism currently owns the required liveness transition.
• [CONTENT_COMPLETENESS]: 55 - Strong JSDoc and reducer matrix; close authority, ledger, reason, NL evidence, and design receipt remain incomplete.
• [EXECUTION_QUALITY]: 58 - Green CI and clean mapper; transition is unreachable and the consumer seam is untested.
• [PRODUCTIVITY]: 65 - The initial-cold slice is valuable; truth-folding prevents it from overclaiming the larger liveness contract.
• [IMPACT]: 82 - Honest cold/degraded chrome materially changes the operator's understanding of Fleet state.
• [COMPLEXITY]: 58 - The render diff is small, but liveness ownership crosses transport, owner state, and UI evidence.
• [EFFORT_PROFILE]: Quick Win - preserve the mapper/slot and repair or explicitly split the liveness contract.

The visual primitive is salvageable as-is; the truth source and close boundary need to become equally explicit.