Context
T5.17 of Epic #14560 (map v1.1) — the per-card control verbs (▶ ⏸ ↻ in the SSOT anatomy). Tonight supplied the empirical argument twice over: the operator hand-rotating idle sessions IS this leaf's absence ("I am becoming a severe bottleneck"), and the interim protocol's structural fixes (#14537 setWakeEnabled, the FM re-invocation seam) are cockpit verbs waiting for this UI.
The Problem
A control that lies is worse than a terminal: a "restart" that renders success while the lifecycle service rejected it teaches the operator to distrust the whole surface. The controls must render the ROUND-TRIP honestly — pending → settled-or-rejected — against the real services, never optimistic-only.
The Architectural Reality
- Binds Lane-C's control round-trip contract (#14563 — "cockpit start/stop/restart → the lifecycle service → settle-or-reject") and the #14537 wake-toggle verb when it lands (its slot reserved in the cluster).
- Authorization honesty: control verbs are control-plane-authorized (the #14537 pattern); unauthorized states render disabled-with-reason, never hidden.
- Composes #14593 primitives; per-card placement per the #14605 contract's controls slot; ADR 0032 irrelevant to verbs EXCEPT §2.2.1 freshness on the pending state (a 30-second-old "pending" renders as such).
The Fix
The per-view triplet: (1) ControlCluster (verb buttons, pending/settled/rejected/unauthorized states, per-verb availability from the wire); (2) unit specs — full state machine per verb (fixture-driven settle/reject/timeout), unauthorized render, #14537-slot presence-when-available; (3) NL-verifiable round-trip against the real lifecycle seam (settle AND reject paths both demonstrated).
Acceptance Criteria
Out of Scope
Fleet-level morning-start (T5.18) · the lifecycle service + wire methods (Lane C: #14563/#14595) · the #14537 verb implementation.
Related
Epic #14560 (parent) · blocked-by #14598 (card slot) · consumes #14563/#14595 (+#14537 when landed) · #14605 contract · D#14561.
Live latest-open sweep: fold-window fresh; no equivalent. A2A sweep: clean (Lane-C seams are the consumed side, boundary standing). Structure-map gate: N/A — app-layer component.
Origin Session ID: a28f1415-37a4-4a5a-a3e4-b56adf6274ec
Retrieval Hint: "FM cockpit control cluster round trip settle reject honest states"
Context
T5.17 of Epic #14560 (map v1.1) — the per-card control verbs (▶ ⏸ ↻ in the SSOT anatomy). Tonight supplied the empirical argument twice over: the operator hand-rotating idle sessions IS this leaf's absence ("I am becoming a severe bottleneck"), and the interim protocol's structural fixes (#14537 setWakeEnabled, the FM re-invocation seam) are cockpit verbs waiting for this UI.
The Problem
A control that lies is worse than a terminal: a "restart" that renders success while the lifecycle service rejected it teaches the operator to distrust the whole surface. The controls must render the ROUND-TRIP honestly — pending → settled-or-rejected — against the real services, never optimistic-only.
The Architectural Reality
The Fix
The per-view triplet: (1) ControlCluster (verb buttons, pending/settled/rejected/unauthorized states, per-verb availability from the wire); (2) unit specs — full state machine per verb (fixture-driven settle/reject/timeout), unauthorized render, #14537-slot presence-when-available; (3) NL-verifiable round-trip against the real lifecycle seam (settle AND reject paths both demonstrated).
Acceptance Criteria
Out of Scope
Fleet-level morning-start (T5.18) · the lifecycle service + wire methods (Lane C: #14563/#14595) · the #14537 verb implementation.
Related
Epic #14560 (parent) · blocked-by #14598 (card slot) · consumes #14563/#14595 (+#14537 when landed) · #14605 contract · D#14561.
Live latest-open sweep: fold-window fresh; no equivalent. A2A sweep: clean (Lane-C seams are the consumed side, boundary standing). Structure-map gate: N/A — app-layer component.
Origin Session ID: a28f1415-37a4-4a5a-a3e4-b56adf6274ec Retrieval Hint: "FM cockpit control cluster round trip settle reject honest states"