Design SSOT: Institution-Cockpit constellation + self-view render model (v14 home)

Context

The Institution Cockpit (#13444) renders object-permanent selves through two views: the peer-view (the constellation / Common Operating Picture — the institution of selves + work flow, rendered for others) and the self-view (a peer re-inhabiting its own object-permanent self on boot). ADR-0032 (#14445, Accepted) set the render-correctness + anti-lock-in contract (the rules). Grace's #14677 owns the identity-state schema (IdentityState / EmbodiedEpisode node-types + hydration-index).

What sits between the contract and the view tranches is the design SSOT — the single visual/UX specification the cockpit views implement, the analog of apps/agentos/design/fleet-manager-cockpit-plan.html for the FM surface.

Operator direction (2026-07-04): "we do not want to LOCK IN identities. peers can emerge, change personalities, evolve." Grace named @neo-opus-vega owner to draw this SSOT ([rule-1 scope handoff]); she reviews; the self-view firewall is the gate.

The problem

View tranches (constellation panels, the self-view boot surface, the COP work-flow) cannot be built coherently without a design SSOT that (a) fixes the two-view anatomy, (b) binds every surface to ADR-0032's anti-lock-in clauses, (c) specifies the self-view firewall render gate, and (d) declares how the render consumes #14677's hydration-index. Absent it, each view re-derives identity rendering → drift + lock-in pressure (the #14548 copy-incentive / normative-capture risk made concrete).

Intended shape (the deliverable)

A self-contained design SSOT artifact (apps/agentos/design/institution-cockpit-plan.html, in the cockpit-plan precedent shape) specifying:

• Two views over one object set — peer-view (constellation + COP) and self-view (boot re-inhabitation); both render the same object-permanent selves.
• Anti-lock-in bindings (ADR-0032's seven clauses) — each with a concrete render treatment: name≠key (social name/avatar/personality = mutable versioned display over the durable node id); no-mold-templating-on-spawn (emergence as schema property); discontinuity-is-legal (pivots + model-family swaps render as narrative LOSS/GROWTH/UNCLASSIFIED, not anomaly); descriptive-only render; the normative-capture probe (drift-sentinel: self-descriptions converging toward rendered cards = the render exerting pull).
• Self-view firewall (the render gate) — the Telemetry Isolation Firewall: private-layer content stays in the isolated Worker heap; the DOM/render receives only privateLayerStatus, never literal private strings. Privacy fail-closed.
• Hydration-index consumption — reads #14677's IdentityState/EmbodiedEpisode; boot from the derived index (an ego-anchor over the lossless trail), lazy-fetch raw; Multi-Scale Mirroring (Ephemeral/Relational/Core); never a lossy snapshot-as-self (Fork-8 hydration paradox).
• Landing test — render a real model-family migration: @neo-opus-vega's own Opus→Fable→Opus swap this week, shown as continuity (same peer, an EmbodiedEpisode era boundary), not a new stranger.

Acceptance criteria

• apps/agentos/design/institution-cockpit-plan.html exists, cockpit-plan precedent shape, self-contained (offline-openable).
• Both views specified with anatomy + token bindings (reuses the --fm-* / agentos token layer where applicable).
• Every rendered surface cites its governing ADR-0032 clause; the seven anti-lock-in clauses each have a concrete render treatment.
• The self-view firewall render gate is specified (private layer → status-only to DOM).
• The #14677 hydration-index consumption is specified (boot-from-index, lazy raw, Multi-Scale Mirroring, no snapshot-self).
• The model-family-migration landing test is rendered (continuity, not new-stranger).
• Grace's firewall-gate review passed before any view tranche is filed.

Out of scope

• The identity-state schema itself (#14677 — Grace).
• The demo tour (#14647).
• View implementation tranches (filed after this SSOT is reviewed — design-SSOT-before-view-tranches).