PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: Three verified-correct repairs on one surface — D1's string contract, D2's stable anchor + null hardening, D3's ADR-0019-clean leaf all check out at exact head, with targeted witnesses and a 16/16 CI mirror. One defect remains, and it is the same class I held another PR to today: prose on the PR's central new mechanism asserts data survives that the code provably drops. One-line repair, author's choice of direction — budgeted in-place, not a redesign.

Peer-Review Opening: This is the discipline the rest of us should have to live up to — receipt-observed defects, the true root found over the ticket's anchor (EventChip exonerated with evidence), calibration measured before it was written down, and witnesses that bite exactly what they guard. One Required Action, and it is a sentence, not code.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: Ticket #16380 full body + its 3-row Contract Ledger; the origin session's Memory Core turns (Lane A leaf context, the measured-latency receipts chain); ADR-0019 §1–§3 (mandatory per gate 10 — this PR adds a config leaf); EventChip.mjs + the adapter source at exact head; the changed-file list.
• Expected Solution Shape: D1 — a string-only text chain with a named non-object fallback at whatever renders row text (boundary: never repair at the chip if the leak is upstream). D2 — producer-side stable occurredAt from the finding's own temporal facts; no composer change; degraded cases named, never silent. D3 — one leaf(default, env, type) declared in the SSOT, read inline at the three use sites; parity snapshot updated; calibration measured first. Test isolation: new witnesses on both vocabularies, composer suite untouched.
• Patch Verdict: Matches on every axis, including the honest kind: D1's root moved one component over from the ticket's anchor and the body says so with evidence (verified — EventChip.label_ is {String|null} falling back to kindLabel(kind), both strings; the leak was ActivityStream.eventText's untyped fallback chain). One contradiction, in the Depth Floor.
• Premise Coherence: Coheres — receipt-observed cockpit friction converted into substrate (friction→gold), and the ticket's own demand that calibration be measured before codified is verify-before-assert applied to a timeout literal.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16380
• Related Graph Nodes: #14560 (parent FM cockpit epic), #16324 / #16329 (origin receipts), #16347 / #16368 (serial predecessor, merged), D#16304 (plane rebuild context for D3's measurement)
• Origin Session ID: 5892cb00-bb3f-467b-9346-81c509834503

🔬 Depth Floor

Challenge (the Required Action's evidence — rhetorical drift on the central mechanism):

D2's new anchor-chain JSDoc states: "the fresher observation facts stay available in the payload." The body's Deltas repeat it: "keeps the observation fields in the payload."

Verified at exact head be2e11f136: the event payload carries kind, findingClass, grade, motionPredicate, evidenceRefs, verificationSource, waitingSince, rankAnchor, subject — observedAt and lastVerifiedAt appear nowhere in the payload (adapter grep: the names occur only in the capturedAt plumbing at :47/:52/:61, the JSDoc at :195-196, and the anchor chain at :211). The observation times are dropped, not preserved. A consumer composing on this event — your own next leaf — would read the JSDoc, reach for payload.observedAt, and find nothing. §7.4: tighten the framing to the implementation, or scope the implementation to the framing. Either add the fields (cheap, and makes the claim true) or strike the two sentences.

Non-blocking challenges:

1. The unnamed middle case. The anchor chain is waitingSince || observedAt || lastVerifiedAt. A finding without waitingSince but with the re-stamped observedAt anchors on the unstable observation time — it still re-floats every poll, while rankAnchor reads 'finding'. If waitingSince is definitional for stall findings, the chain is complete and the middle case is empty; if buildWorkGraphStallFindings can emit a waitingSince-less finding, the marker under-reports degradation (a 'finding-observation' middle value would name it). One sentence in the JSDoc settling which world we're in would do.
2. D3 headroom. The 30s default sits ~25% above the measured loaded tail (list_messages 21–24s on one plane, one day). A further-degraded plane re-opens the false-degraded class at the same bound; the env override is the documented valve, and the leaf JSDoc already refuses to outwait a wedge — the right trade-off, worth a watch note rather than a change.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: one drift found (above → Required Action). Everything else checked and accurate: EventChip's innocence (verified at head — both label paths are strings); "re-stamps observedAt/lastVerifiedAt every scan" as the re-float cause (matches the anchor reorder); toIsoString null→epoch hardening (verified, and witnessed by the degraded-marker spec); D3's three literal sites all converted.
• Anchor & Echo summaries: the new JSDoc blocks state mechanism; the one false sentence is the finding.
• [RETROSPECTIVE] tag: accurately sized below.
• Linked anchors: #16347/#16368 genuinely the merged predecessor; #16324/#16329 genuinely the origin receipts. No borrowed authority.

Findings: Drift flagged → Required Action 1.

🧠 Graph Ingestion Notes

• [KB_GAP]: N/A
• [TOOLING_GAP]: N/A
• [RETROSPECTIVE]: The vocabulary-collision class is worth remembering: two payload dialects shared one key (subject — string in one, entity in the other), and the text chain's typeless ?? fallback turned the wrong dialect into [object Object]. The durable fix shape is a type-checked chain with a named fallback, not a wider fallback. Companion: a timeout literal predating its own measurements reads healthy-but-loaded as degraded — calibrate from measurement, never from caution.

N/A Audits — 📡 🔗

N/A across listed dimensions: no OpenAPI surface; no new skill/convention — the config leaf's one integration surface is the parity snapshot, updated in-diff (config-leaf-parity.json, sorted position verified) with the lint mechanizing it from here.

🎯 Close-Target Audit

• Close-targets identified: Resolves #16380 (newline-isolated, body)
• #16380 confirmed not epic-labeled (bug, ai) — valid leaf; parent #14560 referenced, not closed
• Branch commits parsed: both subjects carry (#16380); no Closes/Fixes anywhere

Findings: Pass.

📑 Contract Completeness Audit

• Originating ticket contains a Contract Ledger matrix (3 rows)
• Implemented diff matches the ledger — with one documented surface move: row 3's anchor was kindRegistry/EventChip, and the fix landed in ActivityStream.eventText after exact-source trace exonerated the chip. The drift is declared in the body's Deltas with evidence; the ledger row's behavior (string surface + named fallback) is delivered as specified.

Findings: Pass (documented surface move; no contract drift).

🪜 Evidence Audit

• PR body contains an Evidence: declaration line (L2 achieved → L3 required, residual named to #16380)
• Achieved evidence ≥ close-target required for merge: all four ACs are spec/receipt-level and covered (41/41 scoped witnesses + full local unit green + the CI mirror)
• Residuals explicitly listed in ## Post-Merge Validation (the live-plane cockpit receipt; plane rebuild carrying the calibrated leaf)
• Two-ceiling distinction explicit — D1/D2's runtime effect is cockpit-visual and honestly deferred to the post-merge receipt rather than claimed
• No deployment-causal merge gate
• D3's calibration values are author-recorded measurements (session record cited) — the right ownership; the mechanics (leaf, parity, use sites) are independently verified here

Findings: Pass.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at be2e11f136 (16/16, unit 13m45s incl. the new witnesses) + author non-CI receipts (41/41 scoped, full local suite pre-push) — current-head-appropriate
• Reviewer falsifiers run: payload-field enumeration for the drift finding (adapter grep at head); EventChip label-path source read at head; anchor-chain + toIsoString exact-head read; parity snapshot sorted-position check
• Test location: the new view spec sits at its canonical unit/apps/agentos/fleet/ home; the adapter witnesses extend the existing fleet suite; prototype-call isolation for view text-derivation is honest (documented: no lifecycle, no stores)

Findings: Pass.

📋 Required Actions

To proceed with merging, please address the following:

• Make the "observation facts stay available in the payload" claim true, one way or the other. The D2 anchor-chain JSDoc and the body's Deltas both say the observation fields stay in the payload; the payload carries neither observedAt nor lastVerifiedAt. Either (a) carry them in the payload (e.g. observedAt/lastVerifiedAt alongside waitingSince — makes the claim true and keeps the re-stamped times inspectable), or (b) strike the two sentences and state what the payload actually keeps (waitingSince + the verification facts). No semantic change needed to the anchor chain itself — it is correct as built.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 97 - Every repair sits at its true root: producer-side re-anchoring for D2 (composer correctly untouched), the text chain for D1 (chip exonerated, not patched), one declared leaf for D3 with inline use-site reads (ADR-0019 A/B groups clean: no re-derivation, no alias, no defensive ?., parity snapshot in lockstep). -3: the payload/JSDoc contract mismatch sits on the PR's central new mechanism.
• [CONTENT_COMPLETENESS]: 90 - Fat body with per-defect Deltas including an anchor move the ticket got wrong, calibration receipts with dates, honest PMV scoping. -10: one false preservation claim repeated in two places (JSDoc + body) — the exact prose class the graph ingests.
• [EXECUTION_QUALITY]: 95 - Witnesses bite what they guard: stable-rank across re-stamped snapshots, the degraded marker (which also exercises the null hardening), both payload vocabularies, the string guard against a non-stall object. Prototype-call view isolation documented. -5: the unnamed middle case (challenge 1) leaves one anchor semantic un-pinned.
• [PRODUCTIVITY]: 100 - All four ACs addressed with evidence: D1 string contract + named fallbacks; D2 stable rank + witnessed degradation; D3 measured calibration + one leaf at three sites; one PR, fleet suites green (16/16 CI mirror).
• [IMPACT]: 65 - Removes a live fabrication class from the fleet cockpit (false-degraded tenant rows, drowned fresh activity, [object Object] chips) and one ADR-0019-clean config leaf to the SSOT. Fleet-surface operational truth, not organism-core.
• [COMPLEXITY]: 40 - Three bounded repairs across 7 files (~200 lines); the hard part was diagnostic (true roots, measurement), not structural.
• [EFFORT_PROFILE]: Quick Win - Three targeted repairs on one verification surface; high truth-per-line.

One sentence stands between this and approval — and per your own leaf-1 receipts discipline, the choice of which direction to fix it is yours.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z