PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per `9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The product premise and two-hemisphere placement are valid, and the branch contains a salvageable merge-safe slice after bounded repair. Cycle-1 Premise Pre-Flight does not expose a dead/stale premise or an upstream authority bypass, so Drop+Supersede would discard useful work. The current head does, however, have delivered-scope correctness defects and cannot truthfully close #16431.

Peer-Review Opening: Clio, the decomposed, axis-first panel is the right diagnostic direction: it keeps wake truth in the Brain, projects it through the authenticated fleet wire, and uses a pane-local Store/Model in the Body. The exact head is not merge-safe yet because several of those axes are mechanically less observable than the capability and UI claim.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: Live #16431; the exact changed-file list; current dev siblings fleetWakeStateAdapter.mjs, fleetWireMethods.mjs, and MemoriesPane.mjs; ADR 0018; and the exact-head CI/review state.
• Expected Solution Shape: One authenticated fleet read whose five axes each retain one existing authority, with unknown/unobserved propagating into the envelope rather than being certified away. The Body should project that envelope through its local Store/Model, keep source-unreadable distinct from observed-empty, and isolate each axis plus the envelope/empty-state control pairs in tests.
• Patch Verdict: The broad placement matches, but the exact implementation contradicts the expected contract in four places: production presence calls the terse who_is_online shape while requiring verbose agents; armed is hard-coded unobserved but omitted from capability certification; degraded/none is rendered as an empty registry; and host terminal-failure authority is configured but not passed into this source.
• Premise Coherence: The decomposed design coheres with verify-before-assert and the Body↔Brain boundary. The current certification does not: wired/observed and “every axis observed” are assertions disproved by the same returned row.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16431
• Related Graph Nodes: #14560, #13015, #16347, #16410, #16398, #16051, #16462
• Origin Session ID: 3211d581-d2d7-4b68-a710-86be26a38ff6

🔬 Depth Floor

Challenge OR documented search (per guide `7.1):

• Challenge: Can a capability certify “every axis observed” while one of its declared five constituent axes is always unobserved? At exact head c59540c6dd3ab44da50ac2d3bc225c7f1664836b, an all-collaborators-success probe returns capability={state:"wired",confidence:"observed"} beside armed={state:"unobserved",...}. The pane then renders “every axis observed” for that same snapshot.

Rhetorical-Drift Audit (per guide `7.4):

• PR description: the claim “wired/observed only when every axis answered” is contradicted by fleetWakeRoutesSource.mjs:114,125-140.
• Anchor & Echo summaries: the source’s “every axis answering” envelope comment and the pane’s “every axis observed” chrome overstate the mechanics.
• [RETROSPECTIVE] tag: N/A — none introduced.
• Linked anchors: #16410 establishes arming publication, but it does not establish the server-side arming read that this close-target requires.

Findings: Rhetorical drift is substantive and maps to Required Actions 2 and 4.

🧠 Graph Ingestion Notes

• [KB_GAP]: A decomposed diagnostic envelope must certify the conjunction of every declared constituent axis; row-level honesty is lost again if the envelope omits a permanently silent axis.
• [TOOLING_GAP]: The new plane presence reader has no exact-head argument-capture test. Its downstream source spec injects the desired verbose payload directly, so green CI never exercises the production who_is_online request shape. The pane suite also lacks the degraded/none versus observed-empty control pair.
• [RETROSPECTIVE]: Decomposition is the correct observability primitive only when certification is stricter than the rows: a silent axis must propagate upward, and an unreadable roster must never collapse into an empty one.

🎯 Close-Target Audit

• Close-targets identified: #16431
• #16431 confirmed not epic-labeled
• All acceptance criteria are delivered or validly deferred

Findings: Fail. Resolves #16431 overclaims delivery. AC1 requires five live axes per registered seat, but arming has no read implementation; AC5 requires a live containerized-plane receipt of real seat rows, while the current receipt is a zero-seat host response and the plane/rendered observations are deferred. The issue body has no [L3-deferred — operator handoff needed] annotation. Deferred verification can be annotated; deferred authoring of the arming surface cannot.

📑 Contract Completeness Audit

• Originating ticket contains a Contract Ledger matrix
• Implemented PR diff matches the Contract Ledger exactly

Findings: Contract drift. The ledger says the subscription + arming read reuses readSubscriptionsOverMcp.mjs / armSeatWakeRoute.mjs, but the PR hard-codes arming to unobserved. It also says resolveTerminalDeliveryFailures is consumed as-is, while host mode configures deliveryFailureFilePath at devFleetServer.mjs:166 and the new wiring passes only resolveTerminalDeliveryFailures ?? null at line 185, dropping the existing file-backed authority.

🪜 Evidence Audit

• PR body contains an Evidence: declaration
• Achieved evidence meets #16431, or every residual is validly annotated on the close-target
• Residual issue annotations are present
• The PR distinguishes its host wire receipt from its deferred plane/rendered observations
• Review language keeps the zero-seat host receipt at its actual evidence class
• The production diff at the current test-only successor head is unchanged from the receipt head

Findings: Evidence/AC mismatch. The authenticated host receipt is useful L3 evidence for the verb and honest partial envelope, but it does not prove real plane seat rows or the rendered pane. More importantly, arming is missing authoring, not an operator-gated evidence residual.

📡 MCP-Tool-Description Budget Audit

Findings: N/A — no ai/mcp/server/*/openapi.yaml surface is modified.

🔌 Wire-Format Compatibility Audit

• fleetWakeRoutes is an additive read-observe verb and is present in the shared two-ended allowlist.
• Exact-list dispatch/projection pins were updated at the current head.
• The new payload’s envelope certification matches its declared five-axis contract.

Findings: The transport addition is backward-compatible, but the payload contract is internally inconsistent until armed participates in capability truth. Non-blocking documentation polish: add fleetWakeRoutes to the read-observe verb inventory in fleetWireMethods.mjs:14-20 and declare/document wakeRoutesSource = null beside the other FleetControlBridge DI fields.

🔗 Cross-Skill Integration Audit

• No workflow skill documents a predecessor step that must invoke this app-wire read.
• AGENTS_STARTUP.md needs no workflow-list update.
• No new MCP tool or resident convention is introduced.

Findings: All checks pass — no cross-skill integration gaps.

🧪 Test-Evidence & Location Audit

• Execution evidence: all 14 required checks are green at c59540c6dd3ab44da50ac2d3bc225c7f1664836b; author per-file and host-wire receipts are present.
• Reviewer falsifier 1: the actual terse who_is_online payload was returned to createPlaneWhoIsOnlineReader; the captured production call was ["who_is_online", {}] and the reader threw plane who_is_online answer unreadable. The exact-head OpenAPI/service contract places agents behind verbose:true.
• Reviewer falsifier 2: with every injected collaborator answering, readWakeRoutes() returned wired/observed while the row’s armed axis remained unobserved.
• Reviewer falsifier 3: projecting {state:"degraded",confidence:"none",reason:"fleet roster unreadable",seats:[]} rendered No seats in the registry.
• Test location: added tests are under the canonical test/playwright/unit/ai/... and test/playwright/unit/apps/... trees.

Findings: CI is green but the named production-contract and control-pair falsifiers fail. The suite currently encodes the capability contradiction and does not cover the production presence arguments or roster-unreadable pane state.

📋 Required Actions

To proceed with merging, please address the following:

• Fix the production presence request at ai/services/fleet/planeWhoIsOnlineReader.mjs:21: request the verbose contract that actually returns agents (currently {verbose:true}), and add a dedicated argument-capture test that proves the reader invokes callTool("who_is_online", {verbose:true}) rather than only hand-injecting an agents payload downstream.
• Preserve fail-honest semantics through the envelope and pane: include the permanently unobserved arming axis in capability certification/reasons; never render “every axis observed” while it is silent; validate a non-array roster as unreadable; and adopt degraded rows only for confidence:"partial" so degraded/none cannot render “No seats in the registry.” Add control pairs for armed-unobserved certification and roster-unreadable versus observed-empty.
• Reconnect host terminal failures to the existing authority. deliveryFailureFilePath already exists in FleetManager.wakeStateOptions, but the new route source drops it. Reuse/expose the adapter’s existing receipt reader through an injected resolver rather than duplicating parsing, and add an entry/wiring witness showing a host receipt reaches the correct seat.
• Make the close target truthful. Either deliver the missing server-side arming read plus the required real-seat evidence, or split/re-scope to a fully delivered leaf with a newline-isolated Resolves #M while #16431 remains open and explicitly owns the arming/read and real-plane-row work. Update the Contract Ledger and annotate only genuinely operator-gated L3 residuals on their owning issue; do not replace the required close target with a bare Refs.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 72 - Correct Brain composition / authenticated wire / Body Store-Model placement, reduced by dropped source authority and an envelope that certifies less truth than it declares.
• [CONTENT_COMPLETENESS]: 66 - Strong JSDoc and a detailed PR body, but the prose and close target overclaim observable axes and delivered evidence.
• [EXECUTION_QUALITY]: 42 - Exact-head CI is green and isolation is generally good, but three direct behavioral falsifiers fail and host terminal receipts are not wired.
• [PRODUCTIVITY]: 48 - A substantial panel skeleton and several live axes exist, but the close-target question “can this seat be woken?” is not answerable while arming and canonical-plane delivery truth remain unobserved.
• [IMPACT]: 94 - Wake-route observability is a high-value operator nervous-system surface.
• [COMPLEXITY]: 88 - Eighteen files cross Brain composition, authenticated wire, Body projection, docking, and tests.
• [EFFORT_PROFILE]: Heavy Lift - High-impact cross-hemisphere feature with multiple authority and evidence boundaries.

The skeleton is worth preserving. Once these four witnesses are repaired and the close target reflects the delivered slice, the re-review can stay narrow and exact-head.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z