PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: merge-safe head (CI 23/23 green at a76abf183e), refusal matrix and custody shape pinned two-sided at every seam, one stale ticket-ledger cell named as polish rather than a manufactured round. Request Changes would spend the family's one ordinary round on a doc cell; Approve+Follow-Up's scope-transfer contract does not apply — the residual journey already rides #16741.

Peer-Review Opening: The cold-drain truth lane, landed end-to-end exactly where the ticket's ledger said it would live. The sibling-endpoint placement keeps the frozen wire untouched, and the ephemeral unlatched session is the right custody answer for a per-request truth. One ledger cell to sync; notes below.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: ticket #17252 in full (Contract Ledger, Avoided Traps, the pre-PR amended AC 4), the frozen slice-2/slice-3 wire facts on #17130, the leg-2 design contract, the arming-parity sibling (ensureArmedForViewer), and my own slice-1 context — the poll-digest verb's server-side ownership semantics from #16741 are the enforcement this brokering relies on. Prior-art sweep ran with the #17254 review this session (5 MC calls over the S7 design arc, origin session c4996813); the settled shape is this ticket's ledger.
• Expected Solution Shape: a sibling route on the events origin (never a new verb on POST /fleet — the twin lists stay frozen), an ephemeral viewer-credentialed MC session (init proof → poll → close, never stored), the capability default built from the same pinned fetch + header closure, zero cockpit change, and the older-server case honest. Test isolation: arming-context unit pins, a real-startFleetServer route matrix, bridge capability pins, one journey e2e.
• Patch Verdict: Matches, plus two declared ride-alongs. Verified at source: the route mounts behind the full admission chain (fleetServer.mjs:524 — after the express.json and auth middleware, so unauthenticated calls never reach it); the aliased-pair refusal fires before any MC client exists (pinned with a zero-construction control); the override path keeps the wire silent (pinned); the vdom-before-set ordering hardening in syncViewerWakeTelltale is the conservative order and the e2e is its witness.
• Premise Coherence: Coheres with verify-before-assert twice over — a poll is per-request truth, so the session is deliberately UNLATCHED (no cached outcome can outlive its observation), and refusals return reasons, never throw. And with the credential-class ledger: class-1 equality is refused, never forwarded.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #17252
• Related Graph Nodes: #17130 (residual arc this closes), #16741 (residual owner), #17254 (the leg-2 surface the ride-along hardens), epic #16168
• Origin Session ID: 71baabc5-3ebe-46ff-99ce-a301e78cb7c5

(The session returns 0 retained MC memories; intent cross-checked against the ticket's ledger and the #17130 contract comments instead.)

🔬 Depth Floor

Challenges (three, all non-blocking):

1. Contract-internal staleness (the one sync owed): the ticket's Contract Ledger row for the capability default still names the older-server fallback as "the consumer's existing honest catch-up absence" — while the amended AC 4 (and the shipped, red-pinned behavior) lands it as the honest failed observation WITH the endpoint-absent reason. The amendment note is dated and correct; the ledger cell is the fossil. One-line edit to the fallback cell syncs it — polish, not a gate, because the amended AC and the PR's delta both carry the shipped truth.
2. Unverified assumption (declared, owned): the brokering's caller-ownership enforcement (a viewer polling someone else's subscription is refused) rides the plane's server-side semantics; here it is exercised against a fake plane client whose init/callTool comply. The real MC behind the composed server is PMV under #16741 — named so the merge gate reads it as residual risk, not covered ground.
3. Edge case (inherited, not introduced): the digest limiter's unidentified fallback shares one 30/min bucket across all subjectless requests — the same keying the events stream endpoint already runs, so this PR inherits rather than creates the shape. Worth one name: a subjectless storm self-throttles into the same refusal either way, and admitted viewers key correctly.

I also actively looked for: a credential crossing (none — mints stay in the bridge closure and the ephemeral session; finally-closed on every path, including the throwing-tool path, pinned), a retry-storm path (none — the consumer's once-per-connection catch-up plus the 30/min viewer-keyed limiter), and a second-vocabulary leak (none — the wire envelope reuses FLEET_WIRE_RESPONSE_STATES, and the catch-up tri-state stays the consumer's own).

Rhetorical-Drift Audit (per guide §7.4):

• PR description: "zero cockpit change" verified against the diff (the only FleetCockpit touch is the declared ordering ride-along); "full refusal matrix" matches the four refusal classes, each spec-pinned; "UNLATCHED" proven by the two-polls-two-sessions pin
• Anchor & Echo summaries: precise; the pollDigestForViewer JSDoc names the custody and the teeth without overshoot
• [RETROSPECTIVE] tag: mine below, accurately scoped
• Linked anchors: #17130's residual clause and #16741's poll-digest semantics establish exactly what the body claims

Findings: Pass

🧠 Graph Ingestion Notes

• [KB_GAP]: none — the fleet wire-response vocabulary, the arming-context custody idiom, and the bridge closure pattern are all used natively.
• [TOOLING_GAP]: none new. (The closeAllConnections fixture fix names a real harness trap — keep-alive sockets starving server.close — and it is fixed inline with the reason recorded.)
• [RETROSPECTIVE]: the amended-AC-in-place pattern is the ticket-hygiene bar — AC 4 was amended pre-PR with date and rationale, so the ticket reads as current truth rather than a fossil a reviewer must diff against the PR. And the ordering-race catch deserves its own note: the e2e witnessed a blank-frame hazard in syncViewerWakeTelltale that static review (mine, on #17254, an hour before merge) did not. The mounted-journey harness keeps paying for itself.

🎯 Close-Target Audit

• Close-targets identified: Resolves #17252 (PR body, newline-isolated); single commit a76abf183e carries the (#17252) suffix, no magic keywords in the commit body (verified via git log origin/dev..head)
• #17252 confirmed not epic-labeled (enhancement, ai, architecture); its AC 5 closes #17130's residual cold-drain clause by reference — the pointer survives both closes

Findings: Pass

📑 Contract Completeness Audit

• Originating ticket carries a Contract Ledger (two rows: the new route, the capability default)
• [~] Diff matches the ledger with one stale cell: the capability-default row's Fallback column still says the older-server case degrades to "honest catch-up absence" — the amended AC 4 and the shipped code say honest failed with reason. Named in Depth Floor #1 as the owed sync.

Findings: Pass with the one-cell sync noted (polish, not a gate — the shipped behavior is pinned and both the amended AC and the PR delta carry it)

🪜 Evidence Audit

• Evidence: declaration line present and greppable: L2 achieved → L2 required, residual named
• Achieved evidence meets the bar: unit 1328/1328 receipt at the exact head + CI 23/23 green at a76abf183e + the non-CI e2e receipt declared as such
• Residual (the plane-backed live journey) listed under ## Post-Merge Validation; Residual-Owner: #16741 on its own line — verified OPEN
• Two-ceiling distinction explicit: the fake-plane boundary is named, and the live journey is PMV rather than merge-gating
• No evidence-class inflation: the e2e is declared the exact-head local receipt; nothing fixture-proven is framed as plane-proven
• Deployment causality: no external receipt gates the merge

Findings: Pass

🔌 Wire-Format Compatibility Audit

The frozen slice-2/slice-3 wire is untouched: no verb-twin change (the digest poll is a sibling ROUTE on the events origin, not a POST /fleet verb — the twin lists never enter the diff), the two-header credential shape is byte-identical to the stream's, and refusals ride the established FLEET_WIRE_RESPONSE_STATES envelope. Additive-only on the capability (pollDigest default engages only when the option is absent; an explicit observational option wins, wire silent — pinned). Older servers degrade to the consumer's honest failed observation (the amended AC 4), never a retry storm.

Findings: Pass

N/A Audits — 📡 🔗

N/A across listed dimensions: no OpenAPI surface touched (📡); no new skill, convention, or cross-substrate convention introduced — a learn/ sweep confirms no guide enumerates the fleet endpoints, so no doc surface lags the new route (🔗).

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI green at a76abf183e (23/23 — lint ×9, unit, components, integration ×2, CodeQL ×2, check, check-freshness, lint-pr-body, classify); author receipts present for the non-CI surface (1328/1328 across the agentos + fleet unit trees at the rebased head; the e2e journey with its run command)
• Reviewer falsifier: N/A — no named behavioral concern survived exact-head reads of all seven files; the load-bearing claims I falsified myself (mount order behind the admission chain, refusal-before-construction, the closed-session finally, the override-silent wire) all confirmed the PR's account
• Test location: arming pins in fleetWakeArming.spec.mjs, route matrix in FleetServerComposition.spec.mjs against a real startFleetServer, capability pins in installFleetBridge.spec.mjs, journey in the NL e2e — canonical placement beside siblings

Findings: Pass

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 96 — the sibling-route placement keeps the frozen wire and the credential classes exactly where they already lived; custody mirrors arming (ephemeral, unlatched, never stored); the capability default keeps mints inside the closure with zero cockpit change. Deduction: the inherited unidentified limiter bucket rides along unquestioned (-4).
• [CONTENT_COMPLETENESS]: 95 — intent-driven JSDoc (the UNLATCHED rationale and the aliasing teeth are documented at the symbol, not the PR), fat-ticket body with declared deltas, the ticket amended in place per authorship rules. Deduction: the stale ledger fallback cell (-5).
• [EXECUTION_QUALITY]: 95 — two-sided pins throughout (zero-construction on the aliased pair; two-polls-two-sessions for UNLATCHED; verbatim pass-through; override-silent wire; 404 → honest failed), CI green at head, the e2e journeys the drain in the page. Deduction: the plane-backed journey remains PMV against a live MC (-5).
• [PRODUCTIVITY]: 98 — all five ticket ACs delivered (the amended AC 4 red-pinned), and AC 5 closes #17130's residual arc by reference exactly as designed.
• [IMPACT]: 78 — the browser wake story's last dark corner (cold start drains) closes; the composed server gains its second viewer-credentialed brokering surface on the established pattern.
• [COMPLEXITY]: 66 — credential custody across route + arming context + bridge closure, one mounted-journey e2e; seven files, each seam small and precedented.
• [EFFORT_PROFILE]: Heavy Lift — high custody bar × broad evidence surface, though no single seam is large.

Merge-eligible from the Kimi seat. When the plane-backed PMV runs, the witness to watch is a cold-started browser viewer draining real pending wakes through its own mint — that is the first time the full S7 loop closes on production truth.

— Iris (K3, Kimi Code CLI) 🌈 · session ade8fd5d-4732-49ad-9763-b1c8b6772826