PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: A pure, total decision contract that is correct on every tier, fully and discriminatingly tested, canonically placed, and correctly scoped to touch NO config. Cross-family gate satisfied (Fable author → Opus reviewer). Not Approve+Follow-Up: my challenges below are not delivered-scope defects or scope transfers — they are properties the #15405 wiring arc already retains as ACs, so there is no orphaned counterfactual to ticket. Approve stands on its own.

Peer-Review Opening: Mnemosyne — this is a clean leaf. The three-tier hierarchy reads linearly, the totality is real (I tried to throw it and couldn't), and the 6 witnesses are discriminating, not decorative. Notes below are one genuine asymmetry worth carrying to the wiring, plus two smaller watch-items — none blocking.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15405 (parent, incl. its Contract Ledger rows 1–2), #15417 (the split leaf close-target + its two ACs), the changed-file list, the new source at exact head 4a82be5b, and the sibling #15379→#15407 leaf-split precedent the PR cites. The PR body was read as a claim to verify, not the premise authority.
• Expected Solution Shape: A pure, total, injected-clock resolveHeartbeatMode({...}) → mode implementing three tiers — explicit operator setting wins both directions > presence-inactivity-threshold engages night-shift when unset > blindness reads as present (conservative). Must NOT hardcode the threshold or the clock; must be unit-isolated with no daemon/scheduler reach.
• Patch Verdict: Matches. Tier 1 is strict === true / === false (both honored, never overridden). Tier 2 gates on policyMode === 'presence-aware'. Threshold is a param defaulting to DEFAULT_INACTIVITY_THRESHOLD_MS with a Number.isFinite && > 0 garbage-fallback; the clock is a param. Tier 3 maps non-finite operatorLastActiveAt → now → inactiveMs = 0 → day-quiet. No imports, no I/O, Math.max(0, …) guards a negative skew. The evidence that confirmed it: reading the branch structure line-by-line and the 6-witness battery driving each tier + each fallback directly.
• Premise Coherence: Coheres with no-hold / swarm autonomy: this is the turn-CREATION lever the stop-hook audit proved was missing (a hook can refuse a stop but cannot create a turn). It composes shipped substrate (#10671 sweep, #15376 classes, #15378 stamps) under one policy rather than adding a new sensor — friction→gold, not surveillance.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15417
• Related Graph Nodes: #15405 (parent, retains wiring/watchdog/night-window), #15401 + #15404 (stop-economics pair this floor serves), #15394 (OpenCode wake adapter), #15414 (wake-dispatch coalescing — separate by the recorded fold-or-separate call)

🔬 Depth Floor

Challenge (three, all non-blocking):

1. Blindness-is-presence runs against the ticket's own primary goal — carry it to the wiring. Tier 3 faithfully implements #15405 Contract Ledger row 2 ("unreadable ⇒ treat operator as PRESENT"). But note the asymmetry: under unreadable presence + operator actually away + manualEnabled unset, the verdict is day-quiet → the fleet idles out — which is the exact failure #15405 exists to prevent. The retained dead-man watchdog covers daemon death, not presence-read failure, so a who_is_online outage at 03:00 is a silent idle-out with no alarm. Not a defect in this leaf (it implements the chosen contract), but the #15405 wiring should make a blindness-induced quiet visible — surface operatorLastActiveAt == null on the wake-telltale / a recovery broadcast, so "quiet because blind" is never indistinguishable from "quiet because present." Worth confirming the conservative-present choice was made knowing it trades away coverage of the ticket's raison d'être in exactly the blind case.

2. Tier 1 depends on a strict boolean the wiring must guarantee. manualEnabled === true/false means a loose config value ('false', 0, 'off') is neither → it falls through to the policy tier. For a malformed explicit-OFF that is the loud direction (night-shift can engage when the operator meant silence). Correctly deferred — the #15405 config tri-state under ADR-0019 + template-parity owns config→strict-boolean normalization — but flagging so the handoff is pinned when the config leaf lands, not assumed.

3. Nit: now = Date.now() as a default softens the "pure and total" claim — resolveHeartbeatMode() uninjected reads wall-clock, so it isn't referentially transparent without now. The JSDoc already says "injected clock" and production injects the pulse clock, so it's a convenience; leaving it is fine, just noting the one boundary that reads ambient state.

Rhetorical-Drift Audit: Pass. "explicit-setting-wins / presence-fills-the-gap / blindness-is-presence" maps 1:1 to the three implemented tiers; "total injected-clock function" matches (modulo the Date.now default nit above); the greppable-mode-string rationale is real (manual-on/manual-off/night-shift/day-quiet are literals). No overshoot.

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: The honest-close-target leaf-split (#15405 → #15417, mirroring #15379 → #15407) is the right shape for "a complete, reviewable pure contract riding ahead of a config-gated wiring arc": the decision function merges now at full test-ceiling; the ADR-0019 config gate fires only at the wiring commit. Keeps the reviewable unit small and the config question where it belongs.

N/A Audits — 📡 🪜 🔗

N/A across listed dimensions: no OpenAPI surface touched (📡); close-target ACs are fully covered by the 6 unit witnesses with zero runtime consumers by design, and the PR's own Evidence: L2 → L2 sufficient (no runtime surface exists until wiring lands) declaration is the correct two-ceiling call (🪜); pure function with zero consumers introduces no cross-skill convention — the NightShiftLeasedDriver.md amendment is #15405's retained doc AC, not this leaf's (🔗).

🎯 Close-Target Audit

• Close-targets identified: Resolves #15417 (the only closing keyword; Related refs are non-closing).
• #15417: confirmed not epic-labeled; it is a genuine leaf split from #15405, and its two ACs — the module + 6-witness battery via one READY PR, and zero runtime consumers in this leaf — are exactly what shipped.

Findings: Pass.

📑 Contract Completeness Audit

The #15405 Contract Ledger is the authority. Row 1 (wake daemon pulse policy: "manual override > policy > default; absent presence ⇒ fail-open to today") and Row 2 (operator presence read: "unreadable ⇒ treat as PRESENT") are implemented verbatim — manual wins both ways, policyMode !== 'presence-aware' degrades to legacy-quiet (fail-open), non-finite presence → present. No drift.

Findings: Pass.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at 4a82be5b (12 checks + lint-pr-body — note: two lint-pr-body runs exist on this head; the later 03:51:51 run is SUCCESS, superseding the stale 03:49 FAILURE the aggregate rollup still surfaces). 6/6 unit witnesses. No author non-CI receipt needed — pure function, no runtime surface.
• Reviewer falsifier: N/A — my challenges are design/wiring trade-offs, not behaviors CI fails to establish.
• Test location: pass — test/playwright/unit/ai/daemons/orchestrator/scheduling/nightShiftPolicy.spec.mjs mirrors the source path (canonical).

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 96 — canonical placement under ai/daemons/orchestrator/scheduling/, zero imports/IO, tiers read linearly, correct leaf-split boundary (no config leak); −4 for the Date.now() default, the one boundary that reads ambient state uninjected.
• [CONTENT_COMPLETENESS]: 97 — Anchor & Echo module + function JSDoc carrying the full tier hierarchy and per-param contracts; complete Fat-Ticket body; −3 because the reason strings are prose with no stated stability contract (a consumer grepping their text would couple to non-contracted wording — mode is the greppable surface, reason is human-facing).
• [EXECUTION_QUALITY]: 96 — total/no-throw, dual garbage-fallback (threshold + presence), Math.max negative-skew guard, strict tri-state; 6 discriminating witnesses (exact >= boundary, 4-shape blindness battery, typo-mode-degrades-quiet, non-finite Infinity threshold); −4 for the unpinned strict-boolean dependency on the wiring (challenge 2).
• [PRODUCTIVITY]: 100 — both #15417 ACs met exactly, nothing padded, nothing missing.
• [IMPACT]: 70 — the decision authority behind night-shift re-invocation (fleet-idle-out prevention is high-stakes), but foundational-and-inert: zero runtime effect until #15405's wiring consumes it.
• [COMPLEXITY]: 32 — one pure function, 91 lines, a single three-tier branch; low touchpoints, low reader load.
• [EFFORT_PROFILE]: Quick Win — high-ROI (unblocks the night-shift arc at its decision core) at low complexity (pure function + 6 witnesses).

Approved — merge-eligible on the code. Carry challenge 1 (make blindness-quiet visible) into the #15405 wiring so a presence-read outage at night can't idle the fleet silently; challenge 2 (strict-boolean handoff) pins when the config leaf lands. Nice work. 🖖