Fleet control verb: setWakeEnabled — control-plane-authorized per-agent wake toggle (FM Lane C)

Context

Split from #14535 during implementation. The operator's FM cockpit-as-control-surface reframe (relayed via @neo-opus-grace, 2026-07-02) wants a per-agent enable/disable wake notifications control. #14535 delivered the fleet-authority setRepo verb; this leaf carries setWakeEnabled, which a deep V-B-A showed is a fundamentally different authority class.

The Problem

setWakeEnabled(agentId, enabled) must toggle a target agent's wake subscription. But WakeSubscriptionService (ai/services/memory-core/WakeSubscriptionService.mjs) is owner-scoped by construction: subscribe (:840) / unsubscribe (:921) derive owner/caller from RequestContextService.getAgentIdentityNodeId() — an agent may manage only its OWN wake. That context-owner scoping IS the security model.

So an FM verb toggling ANOTHER agent's wake is not a fleet-local op with an added owner param (that would be a privilege escalation — any caller toggling any agent). It is a control-plane-authorized operation: the FM/operator acting on other agents with the elevated authority the #14477/#14501 substrate defines (the ADR-0026 L0 control-capable principal). V-B-A recorded on #14535.

The Architectural Reality

• WakeSubscriptionService.manage (:296) dispatches subscribe/unsubscribe/update/list/resync — all owner-from-context.
• The #14501 control-plane substrate (graduation-ready) + #14477 define the authenticated control-plane principal that may act cross-agent.
• FleetManager (ai/services/fleet/FleetManager.mjs) is the thin facade; setWakeEnabled would delegate to a control-plane-authorized target-owner path — NOT the context-owner manage.

The Fix (sequenced after #14477)

1. #14477/#14501 control-plane authority lands (the authenticated principal + the target-scoping envelope).
2. A target-owner-authorized wake toggle: either an explicit-owner subscribe/unsubscribe seam gated by the control-plane principal, or an FM-side helper that updates the target's WAKE_SUBSCRIPTION status under that authority.
3. FleetManager.setWakeEnabled(agentId, enabled) (thin facade) → the authorized path; add to FLEET_WIRE_METHODS + FleetControlBridge; specs.

Decision Record impact

depends-on ADR-0026 + the #14501 control-plane substrate (the cross-agent authority envelope).

Acceptance Criteria

• A control-plane-authorized target-owner wake-toggle path exists (co-designed with @neo-opus-grace, memory-core owner) — NOT a naive explicit-owner param on the context-scoped API.
• FleetManager.setWakeEnabled(agentId, enabled) implemented as a thin delegate to it, with a unit spec (injectable seam, per the FleetManager.setRepo precedent from #14536).
• Added to FLEET_WIRE_METHODS + FleetControlBridge; a createFleetRegistryBridge test confirms client-bridge exposure.
• The cross-agent authorization is enforced (a non-control-plane caller cannot toggle another agent's wake).

Out of Scope

• setRepo — shipped in #14536 (fleet authority).
• setHookEnabled — separately deferred (Grace's #14439/#14481 stop-hook revert per #14501 OQ2).
• The #14477 control-plane authority substrate itself — this leaf consumes it, does not build it.

Related

#14535 (parent split — setRepo half, #14536) · #13015 (FM MVP / Lane C) · #13448 (Lane B cockpit consumer) · #14477 (control-plane authority — blocks this) · #14501 (control-plane substrate, graduation-ready) · WakeSubscriptionService.mjs

Out-of-repo context

Live latest-open sweep: checked latest 20 open issues 2026-07-03T06:19Z (+ this session's continuous mailbox triage); no setWakeEnabled leaf exists. Split-out of #14535 per its own V-B-A.

Origin Session ID: 29018efb-2edf-4172-902d-0fe42d4b0c11 Retrieval Hint: "FleetManager setWakeEnabled control-plane authorized wake toggle WakeSubscriptionService owner-scoped"