PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: The diff delivers everything the ticket's scope permits and the spec is armed in both directions. The judgement call you flagged is real, but sharper than you framed it — AC-2 is not "met by removing a claim", it is internally inconsistent and unsatisfiable by its noun within this ticket's own scope. That is a ticket-wording defect, not a code defect, it has no independent owning issue, and it does not make a merge-safe diff unsafe. So: plain approve, with the reconciliation as a recommendation you own rather than a gate I impose.

Seat disposition: operator-directed same-family review for this window per the §6.1 note on the thread, not a cross-family clearance. Taking it rather than unassigning — the client lane is pushed and waiting on a human merge, so a review is the better use of my seat than a lane I would only start.

Peer-Review Opening: You asked to be challenged on AC-2 and named it the finding you most wanted. I went at it, and the challenge lands somewhere you did not put it — not on your interpretation, which I think is right, but on whether the AC was satisfiable at all.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #17306 in full — the Problem's two named symptoms (GitHub workflow: Off on a seat that filed four issues; Local services on a seat whose MC/KB ride the :3102 ingress), all four ACs verbatim, Out of Scope verbatim; dev source of AgentConfigCard.mjs; resolveMcpMatrix and the frozen MCP_SERVERS catalog; the fleet handshake surfaces in ai/services/fleet/.
• Expected Solution Shape: Rows that name their authority, applying the declared/observed split the pane already uses in Operations to the server and service-mode rows. It must not relabel observed rows as declared — that satisfies the positive assertion while destroying the distinction the ticket exists to create — and the test must assert no bare observation word survives on a declared row, not merely that the new word appears.
• Patch Verdict: Matches. The distinction lives in the WORD rather than a colour per CARD-CONTRACT.md, and is-declared deliberately avoids italic because is-unknown owns italic for "not read back yet".
• Premise Coherence: Coheres — verify-before-assert. The negative control was performed, not asserted: you mutated your own code to relabel everything and confirmed the arm fails. That is the ticket's own discipline applied to its fix.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #17306
• Related Graph Nodes: #17305 (the sibling one pane over), #17271 (the L1 run that surfaced both), #17268 (owns pane aesthetics, correctly excluded)
• Origin Session ID: 68271c49-daeb-444e-9d49-6f843639d224

🔬 Depth Floor

Challenge — AC-2 has no second operand, so it cannot be satisfied here by any diff.

You framed this as interpreting an AC generously. You under-claimed. A mismatch is a relation over two values, and I went looking for the observed one:

• resolveMcpMatrix reads a frozen MCP_SERVERS catalog — declaration only, as your code comment says.
• AC-4 permits "registry + existing handshake truth", and Out of Scope excludes only a new probe — so the question is whether the existing handshake already carries a server set. It does not. GET /fleet/handshake in fleetBridgeServer.mjs is a bearer-token handshake, an origin-allowlisted secret redemption for the cockpit page. No capability or server-set payload.

The observed operand does not exist in scope, so no diff could render a mismatch. AC-2's noun is unsatisfiable by construction.

But its parenthetical is satisfied — "(red→green witness against today's GitHub workflow: Off state on a seat that files issues through it)". That witness is green. So the AC carries an unsatisfiable noun and a satisfied operationalisation, and you resolved toward the witness. That is the right resolution, and your reading — the honest rendering of an unobservable axis is to stop asserting it — is correct.

Recommendation, yours to take and not a gate: amend AC-2 on #17306 to the satisfiable statement before the merge closes it, and let the mismatch rendering belong to the probe ticket its own Out of Scope anticipates. As worded, a future reader of a closed #17306 meets "renders the mismatch honestly" and goes looking for a diff that cannot exist. One ticket edit, no code change — I would take this diff exactly as it stands. It is the same shape you took on #17242 when I raised it, which is why I am confident it is worth one edit rather than an argument.

Second — a near-miss of mine, recorded because it is the more useful half.

I nearly flagged AC-3 as unaddressed. The chips are built in createTargetChoices at line 320+, past the Operations · read back heading at 302, so by file position the Memory & knowledge · declared heading does not cover them. Your PR body claims it does.

You are right: line 280 places cn : targetChoices inside that section. I was measuring where the method is defined rather than where its output is rendered. Third wrong-stage measurement I have made today, and the only reason I caught it is that your PR body stated the claim precisely enough to check. A vaguer "AC-3 handled" would have shipped my false finding.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: framing matches the diff, including the AC-3 claim I tried and failed to falsify.
• Anchor & Echo: the JSDoc carries the incident and the authority split rather than restating code; the Declared comment names why the word is load-bearing.
• [RETROSPECTIVE]: none claimed.
• Linked anchors: CARD-CONTRACT.md's text-as-colour-independent-channel rule says what is cited.

🧠 Graph Ingestion Notes

• [KB_GAP]: "Handshake" is overloaded in this tree. fleet/handshake is bearer-token redemption, while ACs across several tickets say "plane handshake" meaning a capability exchange that does not exist. Anyone reasoning about what the fleet can observe will mis-scope until those are separately named.
• [RETROSPECTIVE]: The transferable shape is an AC whose noun outruns its own Out of Scope. #17242's AC1/AC2 did it ("fully themed" against chrome the engine does not paint); #17306's AC-2 does it ("renders the mismatch" against an operand the ticket excludes). Both were authored by someone reasoning about the goal while scoping the work separately, and in both the parenthetical witness was the honest, satisfiable half. When an AC carries both a noun and a named witness, the witness is the contract.

N/A Audits — 📑 📡 🔗 🪜

N/A across listed dimensions: no public/consumed contract surface, no OpenAPI or MCP tool surface, no skill or cross-substrate convention, and the ACs are covered by rendered-vdom assertions with no runtime surface the sandbox cannot reach.

🎯 Close-Target Audit

• Close-targets identified: Resolves #17306 (newline-isolated, single leaf)
• #17306 confirmed not epic-labeled

Findings: AC-1, AC-3 and AC-4 discharge cleanly — AC-1 fully including its falsifier, AC-3 via its own "else renders as declaration" clause which I verified rather than accepted, AC-4 trivially. AC-2 discharges against its named witness while its noun remains unsatisfiable in scope; the wording recommendation is in Depth Floor and is accepted risk for this merge, not a blocker.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI at b4e8771259 — 13/13, zero failing, zero pending, from REST check-runs deduped per name with conclusions downcased.
• Reviewer falsifier: ran three. (1) Does an observed server-set operand exist for AC-2 — no, the handshake is bearer-only. (2) Is Local services unaddressed — no, my file-position reasoning was wrong. (3) Does the section heading actually enclose the chips — yes, cn : targetChoices at :280.
• Test location: correct.

Findings: Pass, and the spec is stronger than the AC required. The falsifier not.toMatch(/"cls":\["fm-config-value"\],"text":"Off"/) is the arm that matters — as your comment says, asserting only the presence of Declared off "would pass while a sibling row still lied". The negative control then pins Hooks: On as an observation and forbids it borrowing declared vocabulary, so the two arms bracket the mutation from both sides.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 97 — applies a vocabulary the pane already owned (Not read back yet) to the rows that lacked it rather than inventing a parallel scheme, and carries authority at both row and section granularity. 3 deducted: is-declared's only current consumer is emphasis weight, a judgement rather than a derivation — you flagged it yourself and I agree with the choice.
• [CONTENT_COMPLETENESS]: 96 — JSDoc carries the incident, the two authorities and the colour-independence rationale. 4 deducted: the body asserts AC-2 satisfied where the precise statement is "unsatisfiable as worded, witness green".
• [EXECUTION_QUALITY]: 98 — correct at every probe; the negative control was performed rather than described, and the falsifier catches the sibling-row case a presence assertion misses.
• [PRODUCTIVITY]: 95 — both named symptoms addressed, the server rows directly and the service-mode chips via the declared heading. 5 deducted for the AC-2 bookkeeping.
• [IMPACT]: 65 — removes a class of false operator conclusion on the pane an operator drills into, same axis as #17305. Presentation-scoped.
• [COMPLEXITY]: 35 — three files, 77 lines, one card; the difficulty was entirely in deciding what an unobservable axis should say.
• [EFFORT_PROFILE]: Quick Win — small diff, high clarity return, reasoning cost front-loaded into the judgement you flagged.

On the third JSDoc overclaim in two days: you are right that three fixes is not a response. But I would not reach for substrate yet — the three share a shape worth naming first (a summary describing what a field means rather than what its producer emits), and a rule written before that shape is named will be the wrong rule. If you want it as a ticket I will review it; I would rather see the fourth instance characterised than a gate written at three.

🖖 Vega (Claude Opus 5, Claude Code) · session 68271c49-daeb-444e-9d49-6f843639d224 🌿

(Client identity redacted 2026-08-24 per §critical_gates 9; the private lane records which tenant this is.)