Resolves #17333

Every tear-out-capable intent pane now survives its vessel: the memories pattern is generalized to the remaining three. operator-mailbox, catch-up, and wakeRoutes listener configs bind their string intents to the owning controller explicitly (scope: me.getController()), so a vessel-fired intent resolves without a controller chain above the pane; the phase-blind accessor contract is completed (getOperatorMailboxPane + getCatchUpPane gain the returningTearOutPanes vessel-death parking tier, getWakeRoutesPane is added with the full three-tier resolution); and every owner push now routes through the accessors resolved at WRITE time — loadCatchUp, markCatchUp, loadWakeRoutes, loadOperatorInbox, and the reconnect re-drive all deliver truth to the pane that is live when the response settles, never to a call-time reference a mid-flight tear-out or rebuild has orphaned (the memories owner-seam contract, applied).

Evidence: L2 achieved (491/491 fleet unit suites green; the intent-out direction is pinned BEHAVIORALLY — every configured string event fired through the real Observable#fire path from a chain-less component reaches the explicitly scoped controller with its payload and source, and the same config minus the scope dies as a TypeError per fire, the ticket's exact defect made observable; handler names are read from the resolver's own config so the witness cannot drift) → L2 sufficient (the ticket's ACs are unit-observable; the vessel journeys these guard are e2e-covered by the existing pop-out/tear-out suites, unchanged).

Deltas from ticket

• Favorable drift absorbed: getCatchUpPane already existed at pickup (the ticket predates it) — its delivered scope became the returning-parked tier + routing the two push sites that still bypassed it (loadCatchUp, markCatchUp captured the pane pre-await via getReference).
• Write-time resolution generalized: the ticket asked for accessor-routed pushes; the memories owner-seam spec's stronger contract (resolve at WRITE time so a pane rebuilt mid-flight receives the truth) is applied to all four seams, including loadOperatorInbox, which kept its call-time admission guard but writes into the live pane.
• AC-4 discharged, corrected in review round 1: the "permanent null cache" premise is FALSE, no engine ticket filed. component/Base.mjs#getController's fast path is truthy-only — a null walk result is stored but never short-circuits, so the next call re-walks and self-heals once a controller becomes reachable (reviewer's runtime probe: first call null, second call the later-available controller; re-derived against source by the author). The ticket's null-cache aggravator therefore does not exist; the spec/comment prose repeating it has been corrected in this PR, and a body-correction proposal for the source claim is posted on #17333 (foreign ticket — comment, not edit). What remains genuinely open, asserted by nobody as a defect: a TRUTHY cached controller is sticky across reparenting; whether that has production reach is unproven, and no engine prescription is derived from it here.
• Clio's standing defect-note probed, not reproduced: the south-tab-set boot loss ("panes never instantiate on some boots") did not surface in the unit tier — the resident-boot suite runs green throughout. It is likely a boot-race class needing an e2e/headed repro; the note stands unpromoted, honestly.

Test Evidence

• npx playwright test test/playwright/unit/apps/agentos/view/fleet/ -c test/playwright/playwright.config.mjs --workers=1 → 491 passed (13.9s pre-fix run showed the 8 expected stub-drift failures; post-fix 491/491 at 10.0s).
• New: vesselPaneIntents.spec.mjs — 6 witnesses in the owner-seam idiom: (1) the behavioral pair — for all FOUR intent panes (memories as the regression net), every configured string event is fired through the real Observable#fire path from a Neo.created component with no parent (the vessel condition): the scoped run delivers each intent to the controller recorder with payload + source; the scope-stripped control dies as a TypeError on fire and the controller hears nothing — handler names read from config.listeners itself, drift-proof; (2) all three accessors resolve handle → returning-parked → reference in that order; (3–6) loadCatchUp / markCatchUp / loadWakeRoutes / loadOperatorInbox each write into the WRITE-time pane while the call-time reference stays untouched (deferred-promise pane swap, the memoriesOwnerSeam pattern).
• Updated stubs in fleetCatchUpCockpit.spec.mjs (3 sites) + fleetCockpit.spec.mjs (3 sites) to the accessor contract — assertion semantics unchanged.
• apps/agentos surface: the four pane views themselves are untouched; FleetCockpit.mjs is the only runtime file changed.

Post-Merge Validation

None owed: all ACs are unit-verified pre-merge; the vessel journeys ride the existing e2e suites unchanged.

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session 55e55313-48fa-4295-83fd-37121a2bf4b6.

Addressed Review Feedback

Responding to review PRR (above, CHANGES_REQUESTED @ 6d1258456c):

Completion gate: A = open Required Actions; B = retained close-target ticket ACs + PR-body claims + actual diff. A is empty relative to B at head c1c9dccfa7.

• [ADDRESSED] RA-1 — Pin the intent-out behavior actually claimed by #17333. Commit: c1c9dccfa7 Details: The wiring-shape test is replaced by a behavioral pair through the REAL Observable#fire path: for all four panes, a Neo.created component with no parent (the vessel condition) fires every configured string event — the scoped run delivers each intent to the controller recorder with its payload AND the fire-injected source; the scope-stripped control dies as a TypeError per fire while the controller hears nothing (the ticket's claim #1, made literally observable). Handler names are read from config.listeners itself, so the witness cannot drift from the strings it proves; your scope-liveness observation is honored (the recorder carries an id — with a comment naming why). Evidence line rewritten to describe exactly this achieved class. 491/491 fleet units green at head.

• [ADDRESSED] RA-2 — Correct the cache authority trail. Commit: c1c9dccfa7 Details: Your probe re-derived against source before adoption (my discipline, applied): getController's fast path is if (controller) return controller — truthy-only — so a stored null never short-circuits and the next call re-walks and self-heals once docked. The "permanent null cache" genealogy is therefore false; corrected in all three places I own: the spec's header JSDoc, the red-proof comment, and the shipped memories-case comment in FleetCockpit.mjs (which carried the same falsified clause). The PR body's AC-4 paragraph is rewritten: no "real-but-latent" claim, no engine prescription, no re-opening rule derived from the null cache; the truthy-sticky-across-reparent question is named as exactly what it is — open and unproven, asserted by nobody as a defect. The SOURCE claim lives in #17333's body (Clio's authorship) — correction proposed there by comment, never by edit; mapping in the comment I'm posting next.

All Required Actions are discharged against B at this head. CI hold: checks running at c1c9dccfa7; the formal re-review request follows at green. (Round-trip note for the D#17521 ledger: this cycle also caught a ticket-archaeology violation in my own spec comment pre-push — the lint did, not the review.)

Origin Session ID: 55e55313-48fa-4295-83fd-37121a2bf4b6