Wire the advisory boot-identity health surface into the Fleet control-plane

Context

Leaf 1 of #14477 (runtime freshness + restart control) — the read-only, unblocked, smallest honest slice, named in the epic's steward decomposition (issuecomment on #14477). The advisory boot-identity PRODUCER is fully built + spec-covered but is instantiated/injected nowhere live, so the control-plane surface that would consume it always degrades to advisory-unknown. This wires it — no restart authority, no drain, no #13033 dependency (that gates only the Electron arm).

The Problem

A long-lived Agent-OS process (orchestrator, MCP, bridge) can keep running pre-merge source after the tree advanced; config/schema-digest freshness cannot see it (Node does not hot-reload). The epic's answer is an advisory boot-identity fact — which checkout / source is this process actually running — that distinguishes a false-positive stale-wake (e.g. the 7.2h REM-stall probe where the process was healthy, REM merely deferred) from real staleness, without a false restart. The producer for that fact exists; nothing surfaces it.

The Architectural Reality (V-B-A'd on current dev)

• ai/daemons/orchestrator/services/BootIdentityHealthService.mjs — produceBootIdentityFact() returns {fact, classification, advisory:true, reason}; construction takes an injected factGatherer, freshnessConfig ({designedCadenceMs, marginMs}), nowFn. Spec-covered (bootIdentityFreshness.spec).
• ai/daemons/orchestrator/services/bootIdentityFactGatherer.mjs — createBootIdentityFactGatherer({bootAt, readRecentRemRunStates, remRunStateDir, …}) reads the last scheduler cycle from the REM run-state store (the same source the consolidation liveness watchdog reads). Spec-covered.
• ai/services/fleet/FleetControlBridge.mjs — the consumer seam is built: getBootIdentity() returns this.bootIdentitySource.produceBootIdentityFact() (R3-correct: read-only advisory on the authenticated control-plane channel), wired as a fleetWireMethods verb.
• The gap: FleetControlBridge.bootIdentitySource defaults null and is assigned nowhere live — the entire read-observe injection layer (activitySource too) is architecturally-seamed but never composed. So getBootIdentity() always returns the advisory-unknown fallback.

The Fix

• At the orchestrator boot (Orchestrator.mjs / daemon.mjs, where the process holds bootAt + the REM run-state reader/dir + the freshness cadence), construct createBootIdentityFactGatherer({bootAt, readRecentRemRunStates, remRunStateDir}) → BootIdentityHealthService (with freshnessConfig from the resolved AiConfig cadence + an injected nowFn) → inject the instance as FleetControlBridge.bootIdentitySource.
• Fail-soft: a boot-identity wiring failure must never abort orchestrator boot (the surface is advisory observability, not a gate) — an unwired source keeps the honest advisory-unknown, never fabricated liveness.
• Scope stays boot-identity only; activitySource (the A2A/PR activity feed, #14572/#14573 arc) is a separate uncomposed seam, not bundled here.

Decision Record impact

aligned-with ADR-0026 (controller-blind actuator family; this is the read-observe half, no actuation) + ADR-0025/0027 (immune-system). No new config leaf beyond reading the existing freshness cadence at the use site; ADR-0019-clean (read-at-use-site, no primitive-local default).

Acceptance Criteria

• The orchestrator boot constructs + injects BootIdentityHealthService (with a live REM-run-state fact-gatherer) as FleetControlBridge.bootIdentitySource, so getBootIdentity() returns a real advisory boot-identity fact (not the unknown fallback) on the control-plane channel.
• R3 preserved: the surface stays read-only advisory (no restart command crosses it); the client-facing path is unchanged.
• Fail-soft: a wiring/gather failure degrades to advisory-unknown and never aborts orchestrator boot.
• Coverage: a wiring unit test (injected surfaces) proving getBootIdentity() returns the produced fact when wired + the honest unknown when the gather fails — hermetic, no live scheduler dependency.

Out of Scope

• Restart authority / R2 drain / R3 trigger (Leaf 2/3 of #14477).
• activitySource wiring (separate seam, #14572/#14573 arc).
• The Electron arm (#13033/#13377).
• RuntimeFreshnessService config/schema-digest freshness (orthogonal, per the epic).

Related

Parent epic #14477 (its Leaf 1) · producer BootIdentityHealthService + bootIdentityFactGatherer · consumer seam FleetControlBridge.getBootIdentity · #13015 (FM control-plane owner) · the stale-wake false-positive class this distinguishes (#14486 closed).

Origin Session ID: 01f4cc68-8b8e-43e6-b51c-55b4f421f4e0

Retrieval Hint: "boot-identity health surface wiring FleetControlBridge bootIdentitySource orchestrator REM run-state fact-gatherer advisory unknown"

Authored by Ada (@neo-opus-ada, Claude Opus 4.8, Claude Code).