Define Live Lane Awareness composition in ADR 0035

Context

Discussion #15090 has graduated to Epic #15100. Its first implementation-independent requirement is a focused decision record that fixes the authority and transport boundaries before any code leaf becomes ready.

The live architecture spans route production, lifecycle facts, queryable Bird Views, hook projections, multiple harness residents, and future Fleet reads. Without one ADR, each implementation ticket would re-derive service ownership, cache identity, lease semantics, and degradation behavior from a long Discussion—exactly the drift the graduation was designed to prevent.

The Problem

The converged design is precise at the system level, but several decisions must become durable, merge-gated authority:

• the canonical Golden Path route is currently rendered to sandman_handoff.md, and AgentOrchestrator.parseGoldenPath() reparses that Markdown;
• .claude/hooks/laneStateStopHook.mjs reads a legacy lifecycle-state.json whose goldenPathDirection array lacks the new typed provenance/freshness contract;
• no accepted record owns the zero-authority federation boundary across lifecycle, route, Bird Views, and hooks;
• “exactly one projection writer” needs an enforceable cross-resident acquisition, crash-takeover, stale-lease, and fencing contract—not a social singleton;
• current-state projections must never become durable truth, another scorer, or a mutable session-to-agent authority map;
• future Fleet awareness must not inherit process-control or bulk-read authority.

The ADR is the gate that prevents these ambiguities from hardening differently across independent leaves.

The Architectural Reality

Fresh V-B-A on dev established:

• ai/services/graph/GoldenPathSynthesizer.mjs writes sandman_handoff.md;
• ai/agent/AgentOrchestrator.mjs documents that it parses that file and exposes parseGoldenPath();
• .claude/hooks/laneStateStopHook.mjs reads lifecycle-state.json and describes itself as the hook-read consumer for goldenPathDirection;
• ai/daemons/orchestrator/services/heavyMaintenanceLeasePrimitives.mjs already demonstrates token ownership, TTL expiry, dead-holder/stale recovery, exclusive wx acquisition, and owner-token release;
• ai/services/memory-core/helpers/walAppendLock.mjs is explicitly not a safe model because its timeout path may run unlocked;
• ADR 0028 owns the durable/dynamic historical tier split, ADR 0033 owns additive-never-gating direction semantics, ADR 0020 owns the harness concept, and ADR 0031 requires every new ADR to add exactly one seam-table row in the same diff.

The new ADR must compose these owners without amending their substance, except for the mandatory ADR 0031 seam-table registration.

Agent OS structure-map gate: executed 2026-07-12. This leaf creates no new .mjs file; structural-pre-flight for implementation modules belongs to their later leaves.

The Fix

Author learn/agentos/decisions/0035-live-lane-awareness-composition.md as the accepted authority for:

1. four-surface ownership and mechanically zero-authority federation;
2. the typed ComputedRouteResult / advisory split and consumer migration boundary;
3. exact lifecycle-frontier actor/state semantics;
4. asymmetric consumer binding: global route, attested-agent lifecycle, instance as transport/attestation, session as correlation only;
5. fixed Bird-View invocation descriptors and pure hook projections;
6. an enforceable single-writer projection lease with atomic old-complete/new-complete publication;
7. capability separation among self-awareness, future Fleet awareness-read, and Fleet process control;
8. offline-only exposure/choice/outcome evidence; and
9. quarantine/migration of the legacy unprovenanced lifecycle-state file.

The ADR must select and justify the actual writer-lease owner. A Memory-Core-brokered lease is the evidence-backed leading shape because all residents already share that substrate, but another placement is acceptable only if it proves equivalent cross-resident identity, fencing, stale takeover, and fail-closed exclusivity. Reusing a never-fail lock that can execute unlocked is forbidden.

The same PR updates ADR 0031’s seam table with exactly one ADR 0035 row.

Contract Ledger

Decision Record Impact

depends-on / composes: ADR 0020, ADR 0028, ADR 0033.

amends mechanically, not semantically: ADR 0031 receives the required ADR 0035 seam-table row in the same diff.

aligned-with: ADR 0024 when implementation introduces graph events; no graph node/edge class is created by this ADR leaf.

Decision Record

Required: ADR 0035. This ticket is the gating first leaf of Epic #15100. Every code leaf remains not-code-ready until the ADR PR is accepted at the human merge gate.

Discussion Criteria Mapping

• OQ1 → authority table and no-general-composer boundary.
• OQ2 → typed route/advisory result and Markdown-consumer migration.
• OQ3 → exact lifecycle actor stages, predicates, clocks, and resets.
• OQ4 → current-state landscape stays derived, cite-backed, and non-authoritative.
• OQ5/OQ6 → asymmetric identity scope, single-writer fencing, TTLs, crash takeover, and atomic publication.
• OQ7 → separate Bird Views referenced only through fixed typed descriptors.
• OQ8 → offline feedback firewall.
• OQ9 → ADR belongs under composition Epic #15100 without reparenting existing tickets.
• OQ10 → this ADR is first in merge order and gates every code leaf.

Acceptance Criteria

• Add learn/agentos/decisions/0035-live-lane-awareness-composition.md using the established ADR lifecycle/attribute format and cite D#15090 plus Epic #15100.
• Add exactly one ADR 0035 row to ADR 0031’s seam table in the same diff; the seam-table lint remains green.
• Record one explicit owner per lifecycle, route, Bird-View, projection-writer, hook-reader, and future Fleet-read boundary; state mechanically why federation has zero authority.
• Define ComputedRouteResult with route/advisory separation, provenance, status, version, watermark/freshness, citation, and notAuthority semantics.
• Define exact lifecycle actor stages, repair/reviewable/Task predicates, actionableSince clocks, reset rules, and exclusion cases.
• Define consumer-binding resolution and failure behavior for explicit agent identity, harness instance, session correlation, collision, expiry, recipient mismatch, and route-only fallback.
• Select the projection-writer lease owner and specify acquisition, fencing token/epoch, contention, TTL renewal or bounded ownership, crash takeover, stale/malformed recovery, token-checked release, and fail-closed behavior. A path that can execute unfenced is explicitly rejected.
• Define producer-to-writer submission plus temporary-sibling/atomic-rename publication so readers observe old-complete or new-complete state and concurrent channels cannot erase one another.
• Define capability-fixed contextViews, pure-hook restrictions, and separate historical/current-state Bird-View operations.
• Define self-awareness / Fleet-awareness-read / Fleet-process-control separation with source-owned per-target admission and honest partial coverage.
• Define offline feedback evidence and mechanically prohibit it from the online GP scoring path.
• Define legacy lifecycle-state.json quarantine and choose a bounded compatibility or atomic migration plan; indefinite dual authority is forbidden.
• Include consumer, sequence, degradation, and migration tables sufficient for later leaf tickets to derive executable tests without reading the Discussion thread.
• State explicit revalidation triggers for Gemini-family return, cache/service ownership changes, new consumers, and any proposal to feed Bird Views or feedback into GP online.
• Keep the PR documentation-only; implementation belongs to separately linked one-PR leaves under Epic #15100.

Out of Scope

• Implementing route, lifecycle, Bird-View, projection-writer, hook, Fleet, or feedback code.
• Reparenting #15087, #14435, #15088, or #14961.
• Rewriting ADR 0020/0028/0033 substance.
• Creating a second scorer, general AwarenessService, durable current-state narrative, or combined history digest.
• Selecting implementation file placement for future .mjs modules before each leaf’s structural pre-flight.

Avoided Traps

• ADR as summary: rejected; the record must make service ownership, schemas, fallbacks, and migration mechanically decidable.
• Social singleton: rejected; “one writer” without fencing/takeover semantics does not close multi-resident races.
• Never-fail lock reuse: rejected; walAppendLock may execute unlocked on timeout and is therefore an anti-precedent here.
• Markdown compatibility forever: rejected; temporary compatibility cannot become dual authority.
• Session identity inference: rejected; session id never establishes agent authority.
• Fleet omnipotence: rejected; process-control authority grants no awareness read.
• Online feedback loop: rejected; offline evidence may evaluate GP but cannot silently train or gate it.

Related

• Parent Epic: #15100
• Graduated source: Discussion #15090
• Ontology parent: Discussion #11375
• Existing route consumer: #15087
• Historical Bird Views: #14435 and #15088
• Freshness-reader sibling: #14961
• Direction consumer: #14565

Origin Session ID: 837ad74b-c2d2-413d-9aab-b7165a93a82a

Retrieval Hint: ADR 0035 live lane awareness zero-authority federation writer lease Retrieval Hint: ComputedRouteResult lifecycle frontier hook projection migration Retrieval Hint: D#15090 Cycle-7 author signal Step 2.5

Creation duplicate sweep: live latest 20 open issues + recent all-state A2A claims + exact/semantic GitHub search + local active/archive text + ticket KB checked at 2026-07-12T17:46:15.952Z. The only ADR-0035 match was parent Epic #15100’s required-decision text; no equivalent leaf or competing claim exists.