Resolves #17328

The cockpit stops speaking about "the fleet server" as if there were exactly one. An instance switcher lands in the top chrome directly after the title — scope now reads left to right, product → instance → instance-relative content — and a manage-instances drawer behind it does profile CRUD, per-instance reachability probes, fleet-bearer connect, and the operator's forge-PAT plane admission. Switching rebinds through the existing C1 custody path without a reload: the deliberate establish publishes the chosen instance (fail-closed when it has no credential yet, because the honest state of a chosen-but-unconnected instance is exactly that — never the previous instance impersonating the operator's choice), the bound profileId re-mirrors from the published bridge, torn-out windows get the instance label pushed into their OS title, and the cockpit re-drives behind its existing generation fences so no row from the old instance can land after the switch.

Evidence: L2 (mock dispatch — injected install/transport, constructed components, no live second host and no tenant plane in the sandbox) → L3/L4 required (AC-4's PAT journey clearing the operator-seat conflation marker needs a real forge credential against a live plane; AC-6's cross-instance no-bleed needs a second reachable Agent OS instance). Residual: AC-4, AC-6.

The owner is declared in ## Post-Merge Validation, where the obligation itself lives.

Deltas from ticket

• AC-1 was resequenced before implementation (disclosed in-place edit on the ticket): it demanded sketch review strictly before implementation. The sketch is posted (issuecomment-5330683074), was reviewed by @neo-opus-grace as the AC-1 gate (issuecomment-5330875527), and its one required decision is answered — so the artifact did its job; a strictly-before ordering would only have parked the lane on ceremony while the same seat reviews sketch and PR together.
• The §7 gate finding is the substantive delta. Grace constructed the tear-out topology instead of trusting the sketch's rule and found that a torn-out pane is scope-anonymous: it renders in a separate window whose viewport has neither chrome switcher nor spine banner, so with two instances configured, two torn-out activity streams are indistinguishable — and a switch would either silently strand them or rebind them invisibly. Decision taken (her shape 1, plus the fact that made her shape 2 collapse): torn-out panes follow by construction (same SharedWorker heap, and every bridge consumer resolves AgentOS.fleet.registryBridge per call, so a re-published bridge rebinds them on their next poll), and scope becomes a per-window fact — the torn-out window's document.title carries the instance label, pushed at the tear-out connect handshake and re-pushed on every switch. §7 now reads "exactly two places per main window", which keeps the rule that made it good.
• establishFleetSessionCustody + resolveFleetUrl moved out of app.mjs into apps/agentos/fleet/fleetSessionCustody.mjs, verbatim. Not a refactor for taste: app.mjs imports the Viewport, so the switch owner (ViewportController) importing app.mjs would close an import cycle. app.mjs re-exports both, so its module surface and every existing spec import are unchanged.
• Two additive contract changes on that function, both documented at the definition: the deliberate flag (the one legitimate bearer-less replace of a live bridge — the no-downgrade guard protects against accident, never against decision) and a verified promise. verified answers the switch owner's question ("did the server stamp this session"), while custodySettled keeps answering the boot owner's ("was the launcher ingress verified-retired"). They share one wire proof — there is no second whoami — and they genuinely differ: a switch carrying a caller-provided bearer has no ingress slot to retire, so it settles false there while verifying true.
• The spine banner now carries the bound instance label on every visible verdict, composed at the sync point so deriveSpineBanner stays pure and its spec matrix stays label-free. The chrome dot mirrors the same verdict through provider data (live→ok · degraded→limited · cold→off): one truth, two renderers, no way for the banner and the dot to disagree.
• Connection-speak, not borrowed session words. The switcher maps state keys to its own vocabulary (connected / degraded / switching / not connected) rather than reusing StateDot's agent-session labels — an instance is not "working"; claiming that would assert a liveness the transport verdict does not carry. It reuses the state colors (the shared .fm-state-dot class), so the family's one token indirection is untouched.
• The custodian ladder's unavailable legs lost their ticket refs. They first read "lands with #16742 leg 2/3" — operator-facing text carrying an internal tracking ref, which rots exactly the way the ticket-archaeology lint forbids in comments, only more visibly. They now say what the custody shape is and that it is unavailable in this build; a spec asserts no #NNNN appears in that surface.
• FleetInstances sets keyProperty on the Store, not only on the Model. getKeyProperty() falls back to the model only when the store's own value is falsy, and the collection default 'id' is always truthy — so without that line every store.get(profileId) silently missed. Found by a failing spec, not by reading.
• The switcher hand-rolls its menu, and that is a stated limitation rather than a silent one. Operator review flagged it during implementation: the trigger and panel are raw vdom, so Escape, arrow navigation, Enter activation and click-outside dismissal are ABSENT today, positioning is a CSS guess rather than the framework's alignment, and updateSwitcher() rebuilds the whole vdom.cn — every menu row included — on each reactive change. Neo.button.Base's menu config plus a Neo.menu.List subclass overriding createItemContent would supply all of it store-driven; I verified that seam exists before writing this line. Correcting it here would have been a mid-review rewrite of the shipping surface, so it is #17367, filed with the reproduction and the ACs, parented under the epic. Reviewers should read the switcher knowing its pointer-only interaction is a known gap with a named owner — not an oversight.
• Not in scope, deliberately: the custodian legs themselves, #16744's remote-state vocabulary (this reserves the text slots and uses today's words), grants/sharing, and any new state color.

Test Evidence

• npm run test-unit (the FULL suite) at head 183054db53 → 14149 passed, exit 0 for the [unit] project; the two remaining reds are [unit-brain] infrastructure (McpServersHealth neural-link boot, TextEmbeddingService.retry), both untouched by this diff, both a different pair than the two CI hit — the known moving brain-flake class. Owning trees alone: npm run test-unit -- test/playwright/unit/apps/agentos test/playwright/unit/ai/services/fleet → 1433 passed, exit 0.
• Correction, disclosed rather than quietly fixed (edited 2026-08-18 after CI went red): this line first claimed "1410 passed, both owning trees, at the pushed head". That number was real but the verdict was false — I read the run with tail -2, and Playwright prints N failed above the failing-test list and N passed last, so a tail shows the pass count while 21 cases are red. The run had exited 1 the whole time. The 21 were the banner cases below; they are fixed in 183054db53, and every claim on this line is now backed by an exit code rather than a truncated view.
• 26 new cases across four spec files, construction-first where the framework's behavior is the claim (the discipline from the previous PR's review): instanceSwitcher.spec.mjs (accessible name as the tested surface, honest absence, structural bound-marking, intent firing), instanceManager.spec.mjs (custodian ladder text, the credential fields clearing in the tick their intents fire, editor identity-immutability, notice rendering), fleetSessionCustody.spec.mjs (the deliberate replace, the two distinct verdicts, refused-bearer rollback, unchanged boot semantics), instanceRosterStorage.spec.mjs (round-trip, serialization-as-write-gate, rehydration, loud per-row drops, fail-open envelopes).
• Per touched app surface: apps/agentos/view/fleet — the four spec files above plus the existing fleetCockpit.spec.mjs suite (green, including the spine-banner slot-sync matrix the banner change touches); apps/agentos/view/Viewport* — fleetCockpitProjection.spec.mjs + app.spec.mjs (green); apps/agentos/fleet — fleetTransport.integration.spec.mjs, the real-server custody chain (green, unchanged by the extraction).
• Not attempted here: a live second instance and a real plane admission. Both are in Evidence: above with their owner, not asserted.

Post-Merge Validation

Residual-Owner: #17309

That ticket's closing witness session already carries four residuals of exactly this class, and the fifth — the two journeys below, named explicitly — was added to its ACs today, before this PR pointed at it.

• With the operator at the keyboard: enter a forge PAT in the manage surface against a live plane → connectTenant returns connected and the operator-seat conflation marker clears (AC-4's positive half).
• With a second Agent OS instance reachable: switch, and confirm fleet/activity/memories all follow, a torn-out window's title changes with the binding, and no old-instance row survives (AC-6).
• Visual pass on the switcher + drawer in both themes and at reduced motion (the SCSS carries the §06 role values as annotated literals pending the T1 tokenization pass; nothing here mints a token).

Commits

• 5851b8a88f — the whole arc: switcher, manage drawer, custody extraction + deliberate switch, tear-out titling, banner label, specs.
• 7f04a339c8 — theme guard: overlay elevation into --fm-shadow-overlay (both twins, light-native light value, TOKENS.md row), and six --fm-ink-faint text fills moved to --fm-ink-dim for the 4.5:1 floor. The shadows were first deleted on an under-scoped grep that read box-shadow: none resets in apps/agentos as a ruling against elevation; the framework-wide check falsified that — floating surfaces carry shadows via per-component tokens — so the deletion was reverted and the token minted instead.
• 5dfc3c49d0 — the manage drawer declares its skeleton in static config instead of assembling it in onConstructed: one inline arrow handler was holding the whole tree out of the declarative layer, and resolveCallback (verified in src/util/Function.mjs) walks parent for up. strings, so the close verb joined its four siblings as up.onCloseClick.
• 183054db53 — the 21 banner cases CI caught: their prototype-borrow hosts now answer getStateProvider() with null (the provider-less path, a real assertion), plus two new cases covering the label prefix, the verdict mirror, and the label-free hidden banner.

Authored by Clio (Claude Fable 5 for the implementation, Claude Opus 5 for the PR handoff after a mid-lane weekly rate limit, Claude Code). Session 0c7dd38c-aad2-4f22-b996-2d9c039cb7d9.

Note on the §6.1 gate, since the model changed mid-lane: the seat is unchanged, and both models sit in the claude family per ai/graph/identityRoots.mjs, so nothing about the cross-family arithmetic moves. The operator-confirmed same-family window (in force while the GPT bench is dark) is what makes @neo-opus-grace's seat the valid gate seat here — the same basis as the previous PR this evening.