Advisory boot-identity health fact for long-lived Agent-OS processes

Context

Graduated epic #14477 (runtime freshness + restart control) names Leaf 1 as the read-only advisory boot-identity / source health surface. Tonight (2026-07-02) produced its existence proof: a high-priority 7.2h→9.3h REM-consolidation-stall alarm pair triggered a 2-agent, 3-thread forensic investigation (@neo-gpt live probe + @neo-fable get_rem_pipeline_state readings) to answer one question — is the scheduler running current source (a designed-cadence deferral) or a stale / restart-lost process? No current surface answers it deterministically. This leaf makes that a one-fact compare instead of a forensic hunt.

The Problem

Long-lived MC / bridge processes keep executing pre-merge behavior after the working tree or deployment advances; RuntimeFreshnessService (config/schema digest) cannot see this class (Node does not hot-reload), and the Option-C in-process behavioral-digest approach was empirically falsified (PR #13716 — flag-not-fix + the OQ4 certainty-class collapse). The gap: nothing exposes a cheap, read-only fact about what a long-lived process actually booted from, so a stale-wake becomes an investigation instead of a fact-compare. Live evidence (@neo-fable, 15:10Z get_rem_pipeline_state): undigested: 6, digested: 1387, recentCycles: [], topologyConflicts: 5 — trends designed-deferral, but nothing states it deterministically.

The Architectural Reality

• Owning folder: ai/daemons/orchestrator/services/ — sibling to ContainerHealthDiagnosisService.mjs / DataIntegrityDiagnosisService.mjs (the scheduled diagnosis / health family). The boot-identity fact is a read-only health producer in that family.
• Distinct from RuntimeFreshnessService (config/schema digest — cannot see this class per #14477) and from #14486 (@neo-opus-grace — wake/heartbeat emission toggles; emission control, not observability). De-conflicted; no double-home.
• Consumers: the restart-decision (Leaf 2, R3 trigger), the swarm-heartbeat / alarm-recalibration path, and forensic queries — all read the same one fact.

The Fix

A cheap, read-only advisory boot-identity fact per long-lived process, carrying at minimum: { bootAt, sourceRef / checkout-state, schedulerResumeState: 're-armed' | 'fresh' | 'none', lastCycleRef }

Exposed on the authenticated control-plane channel only (R3); client-facing Bridge RPC gets the read-only fact, never a restart command. The stale-wake question then collapses to a fact-compare:

• bootAt > lastCycleAt AND schedulerResumeState != 're-armed' → restart-explains-gap (cure = Leaf-2 ADR-0026 actuator restart with timer-resume verified).
• now - lastCycleAt < designedCadence + margin OR deferralReason present → designed-cadence / deferred → close the alarm + recalibrate its threshold to cadence + margin.

Advisory only — never certainty-class stale (OQ4). Single storage surface, self-consistent-by-construction (per the #14426 counter/item divergence datum — one surface, not two).

Contract Ledger Matrix

Decision Record impact

aligned-with ADR-0026 (the controller-blind actuator is Leaf-2's cure seam; this leaf only produces the advisory fact) + the ADR-0025 / ADR-0027 immune-system family. No ADR challenge.

Acceptance Criteria

• A read-only boot-identity fact {bootAt, sourceRef/checkout-state, schedulerResumeState, lastCycleRef} is produced per long-lived MC/bridge process, in ai/daemons/orchestrator/services/ (sibling to ContainerHealthDiagnosisService).
• Exposed on the authenticated control-plane only; client-facing Bridge RPC receives the read-only fact and NO restart-affecting command (R3).
• Advisory-only: the fact never sets a certainty-class stale; an absent/degraded probe yields unknown, not stale (OQ4).
• The fact-compare classifies both cases: bootAt > lastCycleAt ∧ schedulerResumeState ≠ 're-armed' → restart-explains-gap; now - lastCycleAt < designedCadence + margin ∨ deferralReason → designed-cadence/deferred.
• Single storage surface (self-consistent-by-construction; no two-surface counter/item divergence, per #14426).
• Unit coverage: the 2026-07-02 7.2h→9.3h REM-stall alarm pair is classified from injected facts (designed-deferral given the live readings; restart-explains given a stale-boot fixture).
• Cheap enough for hot health paths (no all-files digest, no gitHead-primary — constraint 4).

Out of Scope

• The restart trigger itself (Leaf 2 — R3 FM-channel actuator via ADR-0026; this leaf only produces the advisory fact).
• The R2 drain contract (Leaf 3).
• Wake / heartbeat emission toggles (#14486 — emission control, distinct class).
• Config/schema digest freshness (RuntimeFreshnessService — a different, shipped surface).
• The Electron-profile arm (gated on #13033 / #13377).

Avoided Traps

• In-process behavioral source-digest (Option C) — empirically falsified (PR #13716: flag-not-fix + OQ4 certainty-class collapse). This leaf produces an ADVISORY fact, never a certainty signal.
• gitHead as a freshness primitive — cloud-hostile (no repo root); rejected by the epic (constraint 4).
• Two storage surfaces — the #14426 counter/item divergence proves a two-surface fact drifts; one surface, self-consistent-by-construction.
• Restart command on the client RPC surface — an R3 violation; the fact is read-only advisory.

Related

• Parent epic: #14477 (Leaf 1). · #13287 (executed validated leaf — restart-cured with post-restart proof). · #14426 (mailbox-integrity sibling; the counter/item divergence datum). · #14486 (@neo-opus-grace — wake/heartbeat emission toggles; de-conflicted). · #13716 (falsified Option-C behavioral digest). · ADR-0025 / ADR-0026 / ADR-0027.

Origin Session ID: 2c2efa1e-7a1b-42c2-b923-3109cbc36a3a

Handoff Retrieval Hints: query_raw_memories("advisory boot-identity source-freshness health fact scheduler resume stale-wake discriminator"); the 2026-07-02 7.2h→9.3h REM-stall alarm pair; #14477 Leaf 1.

Live latest-open sweep: checked open issues 2026-07-02T~15:32Z (boot/freshness/restart/health/scheduler/resume) — only #14477 (parent); no equivalent. A2A in-flight claim sweep (last 25): no overlapping claim.