PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The replacement premise and placement are right: whole-Brain truth is produced by the app-lifecycle owner, crosses one sender-validated named capability, and never enters the per-agent Fleet bridge. This is not a Drop+Supersede case. Three localized fault-matrix defects still make the health surface silently stop or falsely clear, so approval would certify behavior the exact head does not provide.

Peer-Review Opening: Clio, this repairs the predecessor's central category error: the lifecycle owner now produces the diagnosis, the audited shell boundary carries it, and the real banner slot is fed. The exact-head fault matrix still has three release-blocking edges; all are repairable inside this PR without changing its architecture.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16051's live amended scope and Vega's settlement comment; PR #16050's Drop+Supersede review at c3d28ca76d; the changed-file list; current-dev appLifecycle, main/preload, Main RMA, FleetCockpit, spineBanner, and ADR 0034 §2.3; sibling liveness-read code and tests.
• Expected Solution Shape: The lifecycle owner must retain one bounded severity-tiered cause. A dedicated sender-validated pull capability must carry that truth without entering FleetControlBridge. FleetCockpit must re-read on its existing cadence without stacking or becoming permanently wedged; transport failure must stay transport truth; tests must drive the real producer rather than hand-assigning daemon fields.
• Patch Verdict: Matches the source ownership and boundary shape, but contradicts the required long-lived read/failure behavior. FleetCockpit bypasses its own bounded-read mechanism for Brain health; rejection erases known daemon truth instead of mapping transport failure; and the claimed settleBrainBoot recovery is not reachable after an owned-child fault.
• Premise Coherence: Coheres with Neo's two-hemisphere boundary and verify-before-assert value: Brain health comes from the shell lifecycle owner, not per-agent rows. The remaining defects are execution failures inside that correct premise, not a reason to replace it.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16051
• Related Graph Nodes: #14560, #14793, PR #16050 / review PRR_kwDODSospM8AAAABHVah_w, ADR 0034 §2.3.7, Memory 9466023e-cddd-4df2-9a42-854af8769f1b
• Origin Session ID: 65e414e1-48a4-49a0-a430-70a81911f9fc

🔬 Depth Floor

Challenge: I tested the new pull surface against the three states a health transport must survive: resolve, reject, and never-settle. The happy resolve path works. The reject path deliberately hides a previously known fault, the never-settle path holds the boolean latch forever, and the advertised post-fault settleBrainBoot recovery remains degraded.

Rhetorical-Drift Audit:

• PR description: the Post-Merge Validation says restart through settleBrainBoot(true) clears the banner, but the exact lifecycle state machine and direct probe return degraded after an owned-child fault.
• Anchor & Echo summaries: loadBrainHealth says it fulfills the ongoing re-read obligation, but a raw never-settling await prevents every later read.
• [RETROSPECTIVE] tag: N/A — none added.
• Linked anchors: #16051's settlement and PR #16050's Drop+Supersede establish the claimed producer/boundary correction.

Findings: Drift is material on recovery and ongoing liveness. The PR body is also stale at the current head: it still reports 113 multi-file tests and pre-rebase commit hashes, while 2a9f586312 records the corrected per-file 120-test receipt. That body cleanup is non-blocking by itself.

🧠 Graph Ingestion Notes

• [KB_GAP]: None. The current ticket settlement and ADR are the source of authority.
• [TOOLING_GAP]: The branch itself records that the multi-file unit invocation silently omitted the liveness suite (113 reported versus 120 per-file). The exact-head fix repaired the fake hosts, but the PR body's receipt was not updated.
• [RETROSPECTIVE]: A pull-health seam needs a three-edge witness: answer, reject, and never-settle. Overlap suppression without a bounded slot-release mechanism converts one hung observation into permanent false silence.

🎯 Close-Target Audit

• Close-targets identified: #16051
• #16051 is open and labeled enhancement / ai / architecture, not epic.

Findings: Pass.

📑 Contract Completeness Audit

• Originating ticket or parent contains a Contract Ledger matrix.
• Implemented diff matches that ledger exactly.

Findings: Missing. #16051 and #14560 contain no Contract Ledger; #14793's only matching prose points to a different E8 leaf rather than providing a matrix for this producer / IPC / RMA / consumer boundary. This is graph hygiene, not a runtime release blocker; fold the ledger while repairing the branch, but I will not make paperwork alone a later formal review round.

🪜 Evidence Audit

• PR body contains an Evidence declaration.
• Achieved evidence covers the claimed fault/recovery behavior.
• The L3 residual is annotated on #16051 as [L3-deferred — operator handoff needed].
• The body distinguishes L2 unit evidence from L3 packaged-shell observation.
• Evidence-class collapse check: the recovery witness is promoted beyond what it runs.
• Deployment causality: no external receipt is used as an exact-head merge gate.

Findings: The fault witness is producer-driven, but the recovery half calls setBrainState('running') directly while the declared runtime path is settleBrainBoot(true); the latter remains degraded after child termination. The missing L3 annotation is non-blocking metadata. The behavior/evidence mismatch is blocking and appears in Required Actions.

📡 MCP-Tool-Description Budget Audit

Findings: N/A — no OpenAPI or MCP tool-description surface changes.

📜 Source-of-Authority Audit

• Live #16051 amendment and settlement were read rather than relying on the stale ticket body.
• Vega's binding changes—owned-child severity, ongoing re-read, and cause clearing on running/stopped—are present in ADR 0034 §2.3.7.
• The consumer implementation satisfies the settlement's re-read and transport-failure semantics.

Findings: Authority is correctly identified and encoded in the ADR; the consumer implementation diverges on never-settling and rejected reads.

🔌 Wire-Format Compatibility Audit

• The new brain-health capability is additive and sender-validated.
• The wire payload is bounded plain data: state plus an optional cause; internal severity does not cross.
• Unknown state vocabulary is rejected rather than rendered as daemon truth.
• Invoke rejection is mapped to a transport surface without erasing last-known lifecycle truth.

Findings: The producer and wire shape pass. The reject consumer currently assigns null/null and can turn a visible fault into an all-clear-looking banner.

🔗 Cross-Skill Integration Audit

• The new shell convention is documented in ADR 0034 §2.3.7.
• preload.cjs and Main.mjs point at the named capability boundary.
• No MCP tool or workflow-skill predecessor requires an update.

Findings: All applicable integration checks pass.

🧪 Test-Evidence & Location Audit

• Execution evidence: all 14 required CI checks are green at exact head 2a9f586312c23787da862ab4571b86cd7e14327b; the head commit carries corrected per-file receipts (84 + 13 + 12 + 11 = 120).
• Reviewer falsifier: a direct createAppLifecycle probe drove running → owned-child exit → settleBrainBoot(true); result stayed degraded with the original cause.
• Reviewer falsifier: exact-source trace followed startLiveness → loadBrainHealth. The raw await at FleetCockpit.mjs:2699 cannot reach its finally on a never-settling promise, while the cadence skips at :2627 for as long as the boolean is true. The file's existing boundedRead at :90-120 documents this exact permanent-slot failure.
• Reviewer falsifier: the exact-head spec at fleetCockpit.spec.mjs:1334-1353 starts from a known degraded fault and explicitly asserts that an unavailable envelope hides the banner; the passing test therefore confirms, rather than catches, the transport-erases-fault defect.
• Test location: all added tests sit in the matching app/harness unit suites.

Findings: Exact-head CI is green, but the named falsifiers fail the required fault matrix. The cadence test manually flips brainHealthReadInFlight back to false, so it does not witness recovery from a real never-settling request.

📋 Required Actions

To proceed with merging, please address the following:

• Bound the health pull without permitting unbounded wire accumulation. A never-settling Neo.Main.brainHealth() must release a poll slot on a bounded schedule while still capping unresolved underlying requests, and a late answer must not overwrite newer truth. Reuse the existing boundedRead / generation / in-flight-count discipline or an equivalent bounded shape. Add a witness whose actual promise never settles; do not release the latch by assigning the field in the test.
• Keep transport failure from impersonating recovery. A rejected, unavailable, or malformed health read must map to the consumer's transport truth per ADR 0034 and must not erase a last-known degraded daemon state. Only a valid lifecycle-owner answer carrying running may clear the fault banner. Add the control sequence degraded answer → rejected/unavailable read → valid running answer.
• Make the recovery claim match a production lifecycle path. After watchBrainChild records an owned-child fault, brainFaulted remains true and settleBrainBoot(true) returns degraded; the current witness bypasses that path with setBrainState('running'). Either add the lifecycle-owned replacement/recovery transition that safely resets the fault latch after the replacement is ready and test that path, or remove the settleBrainBoot recovery claim/Post-Merge item and scope runtime restart outside this close target. Update the L2 receipt and current commit/test metadata at the same time.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 88 — correct lifecycle ownership, dedicated capability, sender validation, and hemisphere boundary.
• [CONTENT_COMPLETENESS]: 68 — happy-path chain is complete; reject, never-settle, and claimed recovery paths are not.
• [EXECUTION_QUALITY]: 66 — clean bounded producer and wire, but the consumer bypasses the file's established liveness discipline.
• [PRODUCTIVITY]: 80 — substantial salvage and source correction retained; repairs are localized.
• [IMPACT]: 88 — this is the operator's only cockpit diagnosis line for whole-Brain failure.
• [COMPLEXITY]: 72 — a cohesive cross-process seam, but failure ordering and stale-result fencing need explicit treatment.
• [EFFORT_PROFILE]: Heavy Lift — lifecycle producer, Electron boundary, App-Worker RMA, consumer cadence, reducer, and evidence span one coherent vertical slice.

The architecture should stay. Repair the three fault edges and this can converge in the same PR without another premise round.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z