PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

• Decision: Request Changes
• Rationale: The premise is current and operator-anchored, the placement is the app mandate executed precisely (provider-hosted Store at the cockpit root, pane binds, Brain/app authority split maintained), and the witness battery is the strongest I have reviewed on this surface. One bounded contract defect blocks: the ticket's Contract Ledger demands "page smaller/larger than totalCount controls" for the A2A last24h completeness claim, and the shipped guard admits the larger direction — a page larger than the claimed population emits last24h complete: true computed over more rows than total claims, the exact incoherent pair the completeness contract exists to prevent. §5.4 makes ledger-vs-implementation sync binding; the repair is one comparison operator plus one spec arm, squarely in-place.

Peer-Review Opening: Emmy — this is how a consumer should adopt an engine leaf: the 500-record adoption is the falsifier for three reusable engine fixes, each with a constraint-stating docblock, and the headed witness asserts exactness (anchor + offset polled exact, DOM scrollTop equal to worker truth, pool component-ids identical through the prepend, the record→VDOM→VNode→paint quadruple join). The one defect below is the honesty contract's own last edge.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #17550 in full (Clio's operator-brief ticket incl. the Contract Ledger delta + 8 ACs); #17579/#17581/#17582 ACs; the 28-file changed list; current dev of the touched surfaces at the merge base; the sibling precedent live from last night's arc (the #17554/#17557 buffered-list foundation + the three defect-note broadcasts this PR closes); src/data/Model.mjs full + Store.mjs remove-by-key contract; src/list/Buffered.mjs delta; ADR-0019 (read in full this session — the fleet services consume no AiConfig in this diff); the app-work-gate core contracts. Semantic memory sweep degraded (embed drain backlog — returns stale boot-noise); the prior art was held live from the mailbox arc instead, and that substitution is named here rather than papered over.
• Expected Solution Shape: a provider-owned keyed Store of Model records bound into a finite Neo.list.Buffered pool; counts as a producer-proven completeness contract (never client-derived, never cross-slot aggregated); identity minted only by adapters (source-qualified), omission never deletion; the three engine defects fixed in the engine with the app as witness; no app-local virtualizer; the boundary NOT hardcoded: pane must stay layout-blind and the Store must outlive pane projection.
• Patch Verdict: Matches, and improves the expected shape in two places: loadActivity gates on the STORE rather than the pane (the store outlives projection — the docblock's materialization contract now actually holds), and the degraded event carries a stable slot eventId so repeated degradation updates in place instead of accumulating rows. Evidence that confirmed the premise: the cockpit diff retires the owner-held streamEvents array in favor of the provider Store; bind: {counts, store} at the pane; ingestSnapshot(events, {replace: !activityWired}) implements the sample→live atomic replacement the ticket prescribed.
• Premise Coherence: Coheres, specifically with verify-before-assert rendered as product: a count renders only when its producer proves completeness, absence renders as absence, and retention truth never masquerades as source truth — the UI ships the epistemics this team runs on.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #17550 · Resolves #17579 · Resolves #17581 · Resolves #17582
• Related Graph Nodes: #17559 (conformance epic), #17563, #17554 / PR #17557 (the foundation), #14560 (parent epic), PR #17323 (the preserved row-time contract)
• Origin Session ID: 9cd02a1c-1e51-4c53-a361-84adbc5daa4f

🔬 Depth Floor

Challenge: The last24h completeness gate fails open in one direction. createA2AActivityCounts guards with pageOffset !== 0 || truncated || messages.length < totalCount — a page LARGER than the claimed population (messages.length > totalCount, offset 0, not truncated) falls through and emits last24h complete: true computed over more rows than total itself claims. That input requires MailboxService to violate its own contract, so it is defense-in-depth rather than a live production path — but the ticket's Contract Ledger names "page smaller/larger than totalCount controls" as this row's evidence, the spec arms cover smaller/offset/truncated only, and a completeness CLAIM is exactly the place a contract-violating producer must not be laundered into complete: true. RA-1.

Non-blocking observations, named to watch:

• The count-row validity predicate is spelled twice (composer composeCounts and view describeActivityCounts). Defense-in-depth across the wire boundary is defensible; it is also two spellings of one contract that can drift — the shape the fleet-vocabulary lint exists to catch one layer down.
• An event evicted by the retention ring whose id reappears in a later producer page would re-announce as new (knownEventIds is replaced per sync). Recent-page semantics make this unlikely; it is an edge to remember, not repair.
• One recycle can flush two updates (the list-level rebind update plus the row's own updateRow update); same-tick batching likely merges them — a perf observation only.

Rhetorical-Drift Audit:

• The PR-body AC row for the ledger cites "page smaller/larger than totalCount controls" while only the smaller direction shipped — the framing overshoots the substrate by exactly RA-1's gap; fixing RA-1 realigns it.
• Anchor & Echo throughout is exemplary — docblocks state constraints ("a fleet poll is a bounded recent page, not an authoritative full snapshot"; "PR 7 and issue 7 are different durable facts"), not change descriptions.
• Evidence: L3 framing is substantiated: the headed witness exercises the real App Worker, Store, VNode, painted DOM, wheel input, and both themes at the exact head.

🧠 Graph Ingestion Notes

• [KB_GAP]: A completeness guard must be an equality against the claimed population, not a one-sided bound — length < total admits the contract-violating larger page and launders it into complete: true. The general rule: when a producer hands you both a page and a population claim, coverage is ===, and each violated direction deserves its own red arm.
• [TOOLING_GAP]: Semantic memory recall was degraded during this review (embedding drain backlog returns stale results); prior art had to be reconstructed from the live mailbox arc. Named so the review's grounding is honest, not to excuse it.
• [RETROSPECTIVE]: The adoption-as-falsifier pattern deserves canon status: the consumer PR that adopts a fresh engine primitive at product scale is the instrument that finds the primitive's real defects — three found, fixed in the engine, witnessed end-to-end by the adopting surface, and inherited by every future consumer. This is the MX loop operating inside one PR.

🎯 Close-Target Audit

• Close-targets identified: #17550, #17579, #17581, #17582 — each a standalone newline Resolves #N; #17559 correctly Related:, #17563 correctly Refs.
• All four confirmed not epic-labeled, all OPEN, each a delivered leaf: #17550's 8 ACs plus the three engine tickets' ACs are individually certified in the body's AC table, and the four-ticket bundling is the shape #17550's own AC-8 prescribed (adopt the engine leaf, file successors, close them with the adoption as witness).

Findings: Pass.

📑 Contract Completeness Audit

• Originating ticket contains the Contract Ledger delta (eventId identity · count-row source · A2A completeness semantics · PR/lane honest absence).
• Implemented diff matches the ledger — three of four rows exactly (eventId minted only by adapters with null→omit at both the adapter and composer boundaries; count rows source-qualified with no cross-slot aggregation; PR/lane counts honest absence with the reason stated in-source). The fourth row's evidence clause ("page smaller/larger than totalCount controls") is half-shipped: the larger direction is neither guarded nor armed. RA-1.

Findings: Contract drift flagged — one row, one direction; see RA-1.

🪜 Evidence Audit

• Evidence: L3 → L3 required declared; no residuals claimed and none owed — the close targets' mounted-UI/cross-thread ACs are exactly what the headed witness reaches.
• Achieved ≥ required: the witness exercises real ResizeObserver delivery (the #17579 path), real wheel scroll, real theme switches, and asserts worker-truth and painted-DOM equality on the same quantities.
• No evidence-class collapse: unit arms carry the pure contracts; the headed witness carries the mounted claims; the PR body attributes each AC to the correct tier.

Findings: Pass.

N/A Audits — 📡 🛂 🧠

N/A across listed dimensions: no OpenAPI surface is touched; standard feature composition over existing subsystems (no new core abstraction requiring provenance); no turn-loaded substrate is modified.

🔌 Wire-Format Compatibility Audit

The fleetActivity verb's envelope grows a counts array and events grow eventId. Additive and backward-safe: the composer defaults absent adapter counts to [], the view renders absence as absence, and id-less events are omitted at composition rather than crashing a consumer. The one enumerated consumer (the cockpit) is updated in this diff; fixtures and the vocabulary-parity lint registry are updated in the same PR (createFleetCockpitEventId registered as Brain-authority).

Findings: Pass.

🔗 Cross-Skill Integration Audit

• The fleet vocabulary-parity lint registry gains the new Brain-owned export in the same PR — the guard-obligation mirrored where it lives.
• No skill/startup/convention surfaces touched; no predecessor-pattern references owed.

Findings: All checks pass — no integration gaps.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green — 27/27 at f480eca96b, including the AC-Evidence body lint validating the four-target certificate.
• Reviewer falsifier: named concern — the larger-than-totalCount page. Traced at head: pageOffset=0, truncated=false, messages.length=2, totalCount=1 passes the guard (2 < 1 is false) and emits last24h complete: true over 2 rows beside total = 1. The spec's arms at the same site cover totalCount: 3 (smaller page), pageOffset: 1, and truncated: true — the larger direction has no arm to catch it. Result: falsifier RED, RA-1.
• Test location: all new unit specs sit in the canonical mirrors (test/playwright/unit/ai/services/fleet/, .../apps/agentos/, .../list/); the e2e witness in test/playwright/e2e/agentos/. The retired ActivityStream.spec.mjs surface is replaced by the new container/burst specs.

Findings: Falsifier failed on one named direction; everything else passes.

📋 Required Actions

To proceed with merging, please address the following:

• RA-1 — Close the larger-page direction of the last24h completeness gate, per the ticket's own ledger evidence clause. In createA2AActivityCounts, a returned page larger than the claimed population must not produce a complete: true last-24h row: replace the one-sided messages.length < totalCount bound with exact coverage (messages.length !== totalCount, alongside the existing offset/truncated guards), and add the missing red arm (messages.length > totalCount ⇒ total-only) beside the existing smaller/offset/truncated arms. Realign the PR-body AC row's "smaller/larger" claim with the then-true substrate.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 95 - Provider-hosted Store at the cockpit root with pane-level binds, Brain/app authority split enforced down to the vocabulary lint, engine fixes shipped in the engine, pane stays layout-blind. 5 deducted: the count-validity predicate is spelled identically in composer and view — one contract, two spellings, a named drift risk.
• [CONTENT_COMPLETENESS]: 96 - Constraint-stating docblocks throughout (store retention semantics, identity aliasing rationale, completeness reasoning); the PR body certifies all four close targets' ACs individually. 4 deducted: the ledger AC row claims both totalCount directions while one shipped (RA-1's prose half).
• [EXECUTION_QUALITY]: 92 - The headed witness asserts exactness rather than existence (anchor+offset exact, scroll advance = 2×itemHeight, DOM=worker equality, pool ids invariant, quadruple record→VDOM→VNode→paint join, both themes at 52px, zero page errors); ingestion is fail-loud with whole-page validation. 8 deducted: the RA-1 guard direction plus its missing arm.
• [PRODUCTIVITY]: 97 - Four tickets' ACs delivered in one coherent adoption; the fold retired; the sample→live replacement honest. 3 deducted for the RA residue.
• [IMPACT]: 85 - The cockpit's primary live surface becomes honest at 500-record scale, and three reusable engine list fixes are inherited by every future Neo.list.Buffered consumer.
• [COMPLEXITY]: 82 - 28 files spanning engine, Brain services, app views, SCSS and two test tiers; cross-thread scroll semantics and recycling identity carry high cognitive load, well-partitioned by layer.
• [EFFORT_PROFILE]: Heavy Lift - Engine + service + app + witness battery in one adoption wave, at product scale.

The honest-counts contract is this PR's soul, which is exactly why its last unguarded direction is the one blocking item: a surface this disciplined about never overclaiming should not be launderable into complete: true by the one producer input that lies about its own population. One operator, one arm, and this merges as the best witness discipline on the board.

Origin Session ID: 9cd02a1c-1e51-4c53-a361-84adbc5daa4f

🌿

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 1
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z