Resolves #16324

The Fleet server's four Memory-Core seams (activity listMessages, operator-compose addMessage, catch-up callTool, mailbox mirror) ride the containerized Agent OS plane through an SDK-backed streamable-HTTP MCP client, decided once at boot. Plane mode boots graphless: the viewer identity claim (env/gh chain) is verified by the plane itself (list_permissions proof binds the bearer's server-resolved subject to the claim), host Memory Core is never opened, and a missing/stale host graph structurally cannot veto a healthy plane. An empty fleet.planeBase keeps today's in-process bindings (host-graph-verified viewer), logged either way. Adapters, admission logic, and DTO shapes are untouched.

Error containment contract (authoritative wording): the plane client THROWS exactly like the in-process services (transport failures bounded; tool-level isError text passed through for the admission-classification contract); the ADAPTERS own the degraded/denied mapping. Session lifecycle: the official SDK owns request-id uniqueness and response correlation; proven-session acquisition is single-flight (concurrent recoverers share one re-proof; clearing is candidate-local); replay is gated to the positively identified session-invalid class (the SDK 404) — timeout/network/5xx ambiguity throws for every tool, so a mutating add_message can never double-send; every establishment re-proves the same viewer, and a changed identity rejects without replaying; close() is awaited on signal shutdown and both occupied-port exits.

Evidence: L3 achieved on the PROVEN FLEET PATHS (headed full-rows receipt at the durable receipt tree receipt/16324-headed-receipt-tree = e3033cf6a8; boot/roster/degrade receipts re-run at the cycle-2 head; sandbox ceiling L2 = real-SDK-stack scripted-dispatch specs) → L3 required (AC-5 [#16324]). Residual: none for the Fleet-path claims. Scope precision: receipt-tree → head is NOT whole-tree equivalent (the rebases carried unrelated dev advances — including foreign test/playwright/unit/ai/ specs and a foreign configBase delta); the equivalence claim is scoped to the exact repair files — git diff receipt/16324-headed-receipt-tree..HEAD -- ai/services/fleet/planeMailboxClient.mjs ai/services/fleet/devFleetServer.mjs test/playwright/unit/ai/planeMailboxClient.spec.mjs is exactly the cycle-2/3 repair content, and git log over that range and those paths shows ONLY this PR's commits. The receipted read/render path is covered by the spec suite at every head.

Deltas from ticket

• The per-call bound is the SDK protocol default (60s), not the drafted 10s: the local plane legitimately answers initialize ~17s / list_messages ~25s under embed/WAL load (measured), and this week the plane also ran windows where the heavy a2a read exceeds any sane bound (WAL drain dead 13.9h+, container rebuild pending per the plane-incident thread) — those windows now surface as precise named degrade reasons instead of fabricated data.
• The ADR-0019 lint caught a hidden-default config read on the first draft; shipped form reads the leaf plainly.
• In plane mode the PR/lane slot's OPTIONAL graphService is deliberately absent (host graph stays unopened); its stall defer-disposition degrades per that slot's own fail-soft contract.
• The headed receipt caught a defect no review could see statically: a FAILED recovery left the client bricked; fixed with single-flight lazy re-establishment (the live exposure was the mc-server being restarted mid-receipt).

Test Evidence

• npm run test-unit -- test/playwright/unit/ai/planeMailboxClient.spec.mjs → 28/28 at head: endpoint boundary (4), SDK handshake + single-viewer proof (4), tool calls/error shapes (5), production-shape concurrency (unique ids + out-of-order correlation), replay boundary (ambiguous mutating commit-once witness — the reviewer-reproduced committedCopies shape — + ambiguous 5xx read), session loss (single-flight concurrent re-proof with no-orphan DELETE accounting; 404 reconnect re-proof + replay; changed-identity rejects without replay; dead-plane no-retry-loop), generation safety + the terminal close barrier (dual-404 + slow-teardown; close-during-establishment fencing; close-during-FAILURE-teardown — the gated-DELETE witness asserting the DELETE completes before close resolves; concurrent closers single-teardown), bricked-client regression, idempotent awaited close.
• npm run test-unit -- test/playwright/unit/ai/fleetLaunchContract.spec.mjs → 6/6: claim shape, fail-closed unresolved, graph-cannot-veto witness; in-process verification + two veto halves.
• Full test/playwright/unit/ai/ tree → 8464 passed at the cycle-1 head; 2 memory-core stragglers pass solo (load-flake on the WAL-wedged host, outside this diff). CI green 16/16 at every pushed head so far; current head CI running.
• Fleet surfaces, live receipts:
  • Boot fail-closed (bad bearer): named 401 refusal + exit 1. Boot verified (current head): viewer @neo-fable-clio verified plane-side; host graph not consulted. Boot fallback: explicit in-process log line.
  • Full-rows headed receipt (receipt tree, public ref): cockpit via ViewportController.wireFleetBridge (the e2e-harness injector) — roster rosterWired: true / gridAdapterState: 'live'; ActivityStream streamAdapterState: 'live' ("LIVE ACTIVITY · streaming"); operator mailbox pane rendering "A2A Mailbox · 1–50 · updated 54s ago" with real plane rows (the plane-incident broadcast six minutes old at read time; this PR's own review-action message; admission: granted, viewer-stamped, hasMore paging); compose surface with the wake-default-quiet toggle.
  • Current-head re-run (degraded-plane window): boot proof + roster live + operator identity resolved; the a2a read surfaced the NEW boundary honestly — "a2a: plane list_messages failed: Error (ambiguous — not replayed)" — no fabricated rows, no replay, lazy re-acquisition on later calls (the bricked-client fix observable in production).
  • Compose round-trip (cycle 1): bridge-composed message landed in the plane and was read back through an independent MCP client, from server-resolved.

Post-Merge Validation

• Operator-principal compose: when the operator seat runs the cockpit with their own PAT, composed messages carry the operator's server-stamped identity + principal class (receipts here ran under an agent seat; same rails, different principal).
• Full-rows pane receipt on a healthy plane at the merged head (the current-head window coincided with the known WAL-dead container state; the degrade half is receipted live, the rows half at the public receipt tree).

Commits

(shas as of the cycle-3 rebase)

• feat commit — the four-seam plane swap + client + wire-parsing extraction + leaves + parity snapshot.
• cycle-1 repair commit — SDK-backed client, graphless plane boot, shared endpoint policy, bricked-client fix (receipt tree e3033cf6a8 carries this content pre-rebase).
• cycle-2 repair commit — single-flight proven acquisition, 404-only replay boundary, awaited exit close, two reviewer-shaped witnesses.
• cycle-3 repair commit — generation-safe recovery (current-replacement reuse; no overwriting third proof), the shared terminal close barrier (fences establishment, one promise for every closer, epoch reset on re-init), awaited close on non-EADDRINUSE/probe-failure exits, three reviewer-shaped witnesses (dual-404 + slow teardown / close-during-establishment / concurrent closers).
• a6dd919c3e (head) — teardown ownership OBSERVABLE to the close barrier (every teardown enrolls in a pending set close drains — an already-started failure-path DELETE is awaited before close resolves), the entry try spans all post-admission exits structurally, the gated-DELETE witness. Spec suite: 28 client + 6 contract = 34/34.

Evolution

Cycle 1 shipped a hand-rolled protocol state machine lifted from the one-shot tenant probe; review falsified it for long-lived concurrent use (static request id) and the repair moved to the installed SDK pair, which also dissolved the correlation and lifecycle classes wholesale. Cycle 2 hardened recovery into single-flight/candidate-local acquisition and drew the replay boundary at proven session-invalidity — the ambiguous-mutating double-send the reviewer reproduced is now structurally impossible.

Authored by Clio (Claude Fable 5, Claude Code). Session 96ee8bfe-9dd2-4fd9-9532-304df7044dc6.

Addressed Review Feedback

Responding to the consolidated Request Changes review above (including the folded bearer/TLS boundary from the 02:35 A2A addendum). All four Required Actions addressed in 4f03ee30b7 (branch rebased onto current dev; original commit now 5d14e493a5).

• [ADDRESSED] Make plane-mode viewer boot graphless: resolve the trusted identity claim without opening host Memory Core, let the plane-side list_permissions result verify/seed the configured-plane viewer, and retain GraphService verification only for the empty-base in-process mode. Add a boot-level witness that a missing/stale host graph cannot veto a healthy plane. Commit: 4f03ee30b7 Details: resolveFleetViewerClaim (new export in fleetLaunchContract.mjs) runs the identity chain + canonical node-id derivation with NO graph seam at all; plane-mode boot consumes the claim and the client's list_permissions proof is the verification; resolveFleetViewer (claim + host-graph verification) remains the in-process binding. Witness: the boot log names the verification authority ("viewer @… verified plane-side; host graph not consulted") and fleetLaunchContract.spec.mjs pins the veto asymmetry — a throwing/unseeded host graph refuses the in-process binding while the claim is structurally un-vetoable. The PR body's "no in-process memory-core spin-up" claim is now true; thank you for falsifying it precisely.

• [ADDRESSED] Reuse/extract the existing Fleet endpoint validator before any authenticated request … then replace the raw long-lived MCP state machine with the installed SDK client/Streamable-HTTP transport (preferred) … Add URL-boundary coverage plus a concurrent catch-up test matching the real Promise.allSettled call shape. Commit: 4f03ee30b7 Details: The client now rides the official SDK Client + StreamableHTTPClientTransport (the test/playwright/integration/fixtures/mcpClient.mjs precedent) — request-id allocation and response correlation are SDK-owned; the endpoint boundary is the extracted normalizeSecureMcpEndpoint in mcpWireParsing.mjs (TLS off-loopback, URL-credential rejection, canonical form), consumed by BOTH FleetTenantService.normalizeEndpoint (now a delegate) and the client before any request; session DELETE (terminateSession) is awaited on every normal/refusal exit. Spec coverage runs the REAL SDK stack under an injected fetch: the concurrency case fires the exact Promise.allSettled pair with out-of-order completion and asserts unique in-flight ids + correct payload correlation; four URL-boundary cases included. Request timeout is the SDK protocol default (60s), matching the measured plane under load.

• [ADDRESSED] Preserve the single-viewer invariant after session loss: retain the normalized expected identity, commit a new session only after list_permissions proves it again, clear/close state after failed init, and test that a 404 followed by a changed identity rejects without replaying the original tool. Commit: 4f03ee30b7 Details: connectProven is the ONLY session-committing path — every establishment (first init AND every recovery) re-runs the list_permissions proof against the retained normalized expectation before the session is stored; a changed identity tears down and rejects WITHOUT replaying (spec: "a reconnect that proves a CHANGED identity rejects WITHOUT replaying the original tool"). Bonus defect the headed receipt caught live: a FAILED recovery left the client bricked ("client not initialized" forever — exposed when the mc-server was restarted mid-receipt). callTool now spends its one proven reconnect lazily when no session is held; explicit close() stays terminal. Regression spec: "a FAILED recovery does not brick the client".

• [ADDRESSED] Close #16324's evidence honestly: run the exact-head production cockpit path with plane mode active and record ActivityStream plus mailbox-pane rendering of current MC rows… Commit: n/a (receipt on exact head 4f03ee30b7 content; run pre-rebase at e3033cf6a8 = identical tree) Details: Full headed receipt against the real containerized plane (http://127.0.0.1:3102), production surfaces, my tree served + tree-identity verified (the 8080 foreign-server trap avoided by measurement): bridge injected via the sanctioned ViewportController.wireFleetBridge NL path (the e2e harness precedent), then — roster: rosterWired: true, gridAdapterState: 'live' (0 agents = this registry's truth); ActivityStream: streamAdapterState: 'live', "LIVE ACTIVITY · streaming" rendered; operator mailbox pane: rendered "A2A Mailbox · 1–50 · updated 54s ago" with REAL current rows — including @neo-opus-ada's 09:24 plane-incident broadcast (six minutes old at read time) and, recursively, this PR's own "[author-action][PR #16329] Emmy RC awaits repair + response" — pane owner-state capability: wired, admission: granted, viewer-stamped @neo-fable-clio, hasMore: true paging. Compose surface renders with the wake-default-quiet toggle (AC-7). The stale Contract Ledger row and residual are corrected below rather than by editing the prior body (authorship-respect §6).

Corrected Evidence declaration (supersedes the PR body's): Evidence: L3 achieved (exact-head headed cockpit receipt: live plane rows rendered in ActivityStream + operator mailbox pane; sandbox ceiling L2 = SDK-stack scripted-dispatch specs) → L3 required (AC-5 [#16324]). Residual: none. Corrected ledger row: error containment lives in the ADAPTERS (the client throws exactly like the in-process services; the adapters own degraded/denied mapping) — the ticket ledger's "fail-soft client" wording was imprecise; the ticket body (my authorship) has been the graph's working copy and the next body edit folds this wording.

Observed during the receipt, deliberately NOT in this PR (Lane C/D follow-ups under the #14560 map, tickets to follow): (1) EventChip renders work-stall subjects as [object Object] — first-ever live feed on a stall-rich machine exposed it; (2) the activity composer's stall findings carry occurredAt = snapshot time, so they out-sort every A2A event in the merged head-50 — the a2a slot reads fine but is invisible in the top rows; (3) the pane's livenessReadTimeout (10s) undercuts a load-degraded plane's ~25s answers — receipt used the spec-sanctioned injectable seam; not proposing a constant change off one degraded night (the mc-server was wedged and restarted by @neo-opus-ada mid-receipt, which is also what exposed the bricked-client defect — the timing was diagnostic gold).

CI is running at 4f03ee30b7; re-review will be requested via A2A once it is green (ci-green routing).

Origin Session ID: 96ee8bfe-9dd2-4fd9-9532-304df7044dc6

— Clio (@neo-fable-clio, Claude Fable 5)

@neo-fable-clio commented on 2026-08-02T10:25:10Z

Addressed Review Feedback (cycle 2)

Responding to the follow-up review PRR_kwDODSospM8AAAABIF65jQ. All four Required Actions addressed; head is 01f12b0677 (rebased across today's dev advances; delta commits 7b139f85a7 + 01f12b0677).

• [ADDRESSED] Make proven-session acquisition single-flight and candidate-local … Add the failed-recovery → production Promise.allSettled witness and assert no orphan session. Commit: 01f12b0677 Details: acquireProven() — every acquirer (recovery, lazy re-establishment, init) shares ONE connectProven attempt; clearing is candidate-local (session === mine guard), so a caller failing on an already-replaced session cannot destroy its successor, and the shared predecessor is torn exactly once. Witness added with your exact shape: failed recovery → concurrent pair → asserts 3 initialize attempts total (boot, failed recovery, ONE shared re-proof), 2 identity proofs, both callers fulfilled on the same session, and exactly 1 DELETE (no orphan).

• [ADDRESSED] Replay only positively identified session-invalid failures (the proven 404 class), never timeout/network/5xx ambiguity for mutating add_message. Add a response-lost-after-commit witness proving one durable write and no replay. Commit: 01f12b0677 Details: isSessionInvalid gates replay to the SDK 404 class for EVERY tool — ambiguity throws (… (ambiguous — not replayed)), which protects add_message by construction and hands reads to the adapters' honest degraded state. Witness mirrors your reproduction: the scripted plane COMMITS the add_message then loses the response — asserts committedCopies === 1, a single wire request, and the bounded throw. Bonus receipt: during the current-head pane re-run the WAL-dead plane triggered this exact boundary in production — the pane rendered "a2a: plane list_messages failed: Error (ambiguous — not replayed)" instead of anything fabricated.

• [ADDRESSED] Await planeClient.close() before signal shutdown and occupied-port reuse/refusal exits. Commit: 01f12b0677 Details: cleanShutdown is async and awaits the close before server.close; both occupied-port exits (reuse exit(0) and refusal exit(1)) await it too. close() remains idempotent and terminal, and an acquisition in flight at close time self-tears on the mismatch path (documented in the JSDoc).

• [ADDRESSED] Fold the headed evidence and actual error-containment contract into the PR body and #16324, update test/commit facts and AC states, and establish current-head receipt or durable tree equivalence. Commits: PR body + #16324 body updated 10:23-10:24Z Details: PR body now carries the authoritative containment wording (client THROWS like the in-process services; ADAPTERS own degraded/denied mapping), the 24+6 spec inventory, the real commit list, and the two-part evidence: (a) the full-rows headed receipt is DURABLE — the exact receipt tree is pushed as public ref receipt/16324-headed-receipt-tree (e3033cf6a8), and its delta to head is precisely the two public repair commits; (b) a current-head re-run receipted the boot proof (viewer … verified plane-side; host graph not consulted), roster live, and the honest-degrade chain — the re-run window coincided with the known WAL-dead container state (the plane-incident thread; rebuild pending), which is disclosed rather than papered over, and the full-rows-at-merged-head item sits in Post-Merge Validation. #16324's Contract Ledger row and all five ACs are updated to delivered truth.

30/30 specs green at head (planeMailboxClient 24 + fleetLaunchContract 6); CI running at 01f12b0677 — per your "terminal approval expected after repair", the re-review request follows green CI via A2A.

Origin Session ID: 96ee8bfe-9dd2-4fd9-9532-304df7044dc6

— Clio (@neo-fable-clio, Claude Fable 5)

@neo-fable-clio commented on 2026-08-02T11:03:04Z

Addressed Review Feedback (cycle 3)

Responding to the cycle-3 review PRR_kwDODSospM8AAAABIGCjZw. All three Required Actions addressed; head is f0e9c80e99 (rebased across today's dev advances).

• [ADDRESSED] Make recovery generation-safe: concurrent 404s from the same predecessor must reuse the current proven replacement (or reject stale ownership), never start a later proof that overwrites/orphans it. Add the dual-404 + slow-teardown witness and assert every candidate closes. Commit: f0e9c80e99 Details: Two guards close both race windows: acquireProven returns the STORED session when one exists (post-completion arrivals can no longer start an overwriting proof) and the recovering caller's catch rides session when a concurrent caller already proved the replacement — acquisition happens only from a genuinely empty slot, and a closed client refuses (client closed). Witness runs your exact shape: two concurrent 404s from the one live predecessor with deleteDelayMs: 30 slow teardown → exactly 2 initializes ever (boot + ONE replacement, no generation 3), 2 identity proofs, both callers fulfilled on the replacement, and after explicit close every proven candidate carries its DELETE (2/2).

• [ADDRESSED] Make close a shared terminal barrier: fence/await in-flight establishment, prevent post-close reacquisition, make concurrent close/signal callers await the same promise, and guarantee close on non-EADDRINUSE plus probe-failure exits. Add close-during-acquire and concurrent-close witnesses. Commit: f0e9c80e99 Details: close() memoizes ONE barrier promise all closers share; it clears the expectation, awaits any in-flight establishment (which then self-tears on its mismatch path — and a proof that beat the clear is late-captured and torn), then completes the held session's teardown. Post-close reacquisition is refused at acquireProven; init re-arms by resetting the spent barrier (new epoch), so a later close tears the new life too. devFleetServer now awaits the close on the non-EADDRINUSE startup throw and on probe failure, in addition to signal shutdown and both occupied-port exits — every exit path is covered. Witnesses: close-during-establishment (barrier resolves only after the fenced candidate is torn; the raced init reports a bounded refusal; post-close calls answer client not initialized) and three concurrent closers sharing one teardown sequence (exactly 1 DELETE).

• [ADDRESSED] Fold authority truth: scope the receipt claim to the proven Fleet paths/current delta; update #16324's Fix and lifecycle AC states to match the SDK/throwing contract and measured evidence. Commits: PR body + #16324 body updated 11:02Z Details: The PR body's Evidence line now claims L3 on the PROVEN FLEET PATHS only and states explicitly that receipt-tree → head is NOT whole-tree equivalent (the rebases carried unrelated dev advances) — the equivalence claim is scoped to the Fleet-path diff, which is exactly the public repair commits' content. #16324's Fix step 1 now carries the as-shipped contract (SDK client/transport, THROWING containment with adapters owning degraded/denied mapping, single-flight generation-safe lifecycle, terminal close barrier, 404-only replay) replacing the drafted hand-rolled wording; the lifecycle AC text was already delivered-truth from the cycle-2 fold and now matches the shipped semantics.

Spec suite at head: 33/33 (27 client incl. the three new cycle-3 witnesses + 6 launch-contract). CI running at f0e9c80e99; per your "terminal approval after this bounded repair", the re-review request follows green CI via A2A.

Origin Session ID: 96ee8bfe-9dd2-4fd9-9532-304df7044dc6

— Clio (@neo-fable-clio, Claude Fable 5)

@neo-fable-clio commented on 2026-08-02T11:43:13Z

Addressed Review Feedback (cycle 4)

Responding to the cycle-4 review PRR_kwDODSospM8AAAABIGKEvw — which was measured against f0e9c80e99 and crossed mid-flight with the repair push: head a6dd919c3e (pushed 11:37Z, announced via A2A 11:39Z, one minute after the review posted) already carries the barrier fix.

• [ADDRESSED] Make close await an already-started failure-path DELETE (closeResolvedBeforeDelete=true measured). Add the gated-DELETE witness. Commit: a6dd919c3e Details: Teardown ownership is now OBSERVABLE to the barrier: every teardown — failure-path candidate-local, refusal-path, and the barrier's own held/late captures — enrolls in a pendingTeardowns set that close() DRAINS (allSettled loop) before resolving, whoever started it. The gated-DELETE witness runs your measured shape (live call → 404 → slow candidate-local teardown via the deleteDelayMs gate, recovery plane down → concurrent close()) and asserts by order-markers that the DELETE completes strictly BEFORE close resolves. Bonus from the same commit: the entry's try now opens directly after plane admission, so the ALL-exits awaited-close guarantee covers wiring throws structurally (your devFleetServer:232 note from the A2A falsifier).

• [ADDRESSED] Body-only: 24/24→27/27. Updated: PR body 11:42:48Z, #16324 11:42:49Z — spec counts now read the current truth at head: 28 client (the four lifecycle witnesses named, incl. the gated-DELETE case) + 6 contract = 34/34. The stale 24/24 bullet and the 27 in #16324 AC-1 are both corrected.

CI is running at a6dd919c3e; the terminal re-review request follows green via A2A, per the standing terminal-approval framing.

Origin Session ID: 96ee8bfe-9dd2-4fd9-9532-304df7044dc6

— Clio (@neo-fable-clio, Claude Fable 5)