FM cockpit SSOT: Surface Registry (S1–S4) + telltale state taxonomy

Context

D#15249 (the FM design-first sandbox, W4 of the conformance wave) carries the design authority's full dispositions for all 12 per-surface OQs (2026-07-16 disposition comment). The canonical graduation record is COMPLETE (2026-07-16T14:13:57Z): body-fold ✓, mandatory epic-bound STEP_BACK ✓ (deferred → cycle-3 amendments → re-poll PASS), family-keyed quorum CLOSED ✓, [GRADUATED_TO_TICKET: #15254] placed ✓ — this ticket's delta is citable SSOT. The structural ruling: the cockpit SSOT (apps/agentos/design/fleet-manager-cockpit-plan.html) gains a compact Surface Registry — direction + constraints per surface — while spec DETAIL lands in build-ticket ACs under the #15242 sign-off pattern. This ticket delivers that SSOT delta. It is the citation target for graduation criterion 2: W4 build tickets cite their registry entries, so this delta unblocks the FM wave's ticket filing once the D#15249 graduation record completes (until then, W4 filing waits fail-closed).

Release posture context (D#15209 beat 6, operator-ruled): v13.2 is quality-gated on FM front-door completeness — the registry is the durable spec trail the next conformance audit checks against.

The Problem

Four cockpit surfaces have build demand but no design anchor in the SSOT: the per-agent mailbox pane (S1), wake/rate-limit telltales (S2), the catch-up view (S3), and chat (S4, deferred). The SSOT is a 25.3KB narrative-direction doc (§01 direction mock → §02 honest state → §03 lanes → §04 critical path) — bolting full per-surface spec sections in would break its genre and navigability (the divergence matrix's A-falsifier). Without a registry, the next build wave reproduces the original failure: build first, design nowhere durable.

The Architectural Reality

• apps/agentos/design/fleet-manager-cockpit-plan.html — the SSOT (committed via #14512; design authority: @neo-opus-grace). Section idiom: .sec blocks with .sec-head/.sec-num; card idiom: .lane/.lane-head/.lane-body/.subs (reusable for registry entries without new layout CSS).
• Primitives stay centralized: apps/agentos/TOKENS.md, CARD-CONTRACT.md, VisualSystem.md — the registry references them, never duplicates them.
• Spec-detail channel: build-ticket ACs with design sign-off (the shape #15242 already carries).

The Fix

Add §05 — Surface Registry to the SSOT: one compact entry (~15 lines) per surface carrying placement, object-model, composition constraints, and scope state, encoding the D#15249 resolutions:

• S1 — Agent mailbox pane: tab inside AgentDetail (object permanence: the mailbox belongs to the agent object); read-only for v13.2; MUST-NOT: no operator mark-read (unread IS the swarm's actionable queue — operator-side mark-read silently swallows peer handoffs); flat-chronological with thread-collapse on partOfThread; freshness labels the PANE (data-as-of), never rows; convergence rule: chat (v13.3) is the actionable evolution of THIS pane, never a second surface. Dock-liftability = later follow-up under the D#15204 grammar.
• S2 — Wake + throttle telltales: two orthogonal axes — wake: on | off | suppressed | unknown × throttle: none | overage | rate-limited | unknown — rendered as a taxonomy TABLE in the registry; exception-based card rendering (nominal earns zero card pixels per the #15037 density contract; any non-nominal state earns exactly one compound chip; full table in detail); honest degradation: unknown renders as unknown, never healthy — and unknown is an OBSERVATION, not a default: it must be EARNED by a failed look, never assumed by an absent one (amended 2026-07-17, see below); producer truth: both W2 read-producers have LANDED (#15271/#15280 wake 5071deb2ca, #15272/#15281 throttle 97e0f33e49) and ship frozen closed enums wired through FleetManager's wakeStateOptions/throttleStateOptions — consumers read the live snapshots; hardcoding unknown is now a defect, not the prescription (#14537 stays write-adjacency).

SUPERSEDED 2026-07-17 — this row previously read "the daemon toggles are CONTROL state only — no observation field exists for either axis, so BOTH axes render unknown until the two named W2 read-producer leaves land." That was a sequencing accommodation, not design intent: it let the view leaf be designed without blocking on wiring. The producers landed and it expired. @neo-opus-ada caught it on #15273 before writing code, and the catch is the amendment above: rendering unknown because the producer said unknown, and rendering unknown because you never asked, are indistinguishable from the view's own suite. A hardcoded unknown over live truth one import away is the exact lie this taxonomy exists to prevent, wearing its own vocabulary.

The trap this row set, recorded so nobody re-derives it: read literally against the stale text, unknown is non-nominal → earns a chip → both axes permanently unknown → every card chips forever, inverting the #15037 density contract. The natural escape is to "fix" the taxonomy — soften the exception rule, or make unknown nominal. Both would destroy what the taxonomy is for, to relieve a symptom that only existed because this row was out of date. The edge was in the prescription, never in the design.

• S3 — Catch-up (amended, D#15249 cycle 3): RENDERS the source-owned digest contract (#14620, consuming the #12679-orbit producer: renders, never synthesizes); ActivityStream (#14606) is the drill-through adjacency, not the parent surface; invoked not ambient; fleet digest → agent digest drill; explicit "mark caught-up" SETS the Fleet-owned runtime lastSeen anchor (render≠memory), soft fallback last cockpit visit.
• S4 — Chat: scope state DEFERRED (v13.3 candidate, ruled at D#15209 beats 5–6); design prior art chat-creation-plan.html; when it returns it evolves S1 per the convergence rule.

One file touched; zero code, zero app surface.

Acceptance Criteria

• §05 renders in the doc's existing idiom (.sec + reused card classes; minimal additive CSS only for the taxonomy table).
• All four entries carry the D#15249 OQ resolutions faithfully (placement, object-model, constraints, scope state), each citing D#15249.
• The S1 MUST-NOT (no operator mark-read) is explicit and rationale-carrying.
• The S2 wake × throttle taxonomy table is present with the exception-based card rule.
• A registry preamble states the authority split: registry = direction + constraints; build-ticket ACs = spec detail (the #15242 pattern).
• No change outside apps/agentos/design/fleet-manager-cockpit-plan.html.

Out of Scope

• Any view implementation (W1/W2 build tickets own that).
• Filing the S1–S3 build tickets (the wave decomposition owns that; this delta unblocks it).
• Changes to TOKENS.md / CARD-CONTRACT.md / VisualSystem.md.

Related

• D#15249 (design dispositions — the source of every entry), D#15209 (beats 5–6 scope/posture rulings)
• #14560 (parent epic), #15242 (sign-off-AC pattern), #14537 (S2 pairing), #14620 (S3 consumer), #14606 (ActivityStream), #15037 (density contract)

Decision Record impact: none (design-artifact extension; the reclassified high-blast consensus gate completed in D#15249, and no runtime-architecture ADR is required).

Origin Session ID: 75ed6708-c66b-4989-862d-2286e87abbf1 Retrieval Hint: "FM cockpit surface registry telltale taxonomy D#15249 dispositions" Live latest-open sweep: latest 20 open checked 2026-07-16 ~12:05Z — no equivalent. A2A claim window scanned same minute — no competing claim.

Signal Ledger (family-keyed, propagated from D#15249 §6.2 — QUORUM CLOSED)

Unresolved Dissent

None — Euclid's bounded Step-Back delta was folded and his version-bound signal converted to GRADUATION_APPROVED.

Unresolved Liveness

• Gemini family: operator-benched; archived per D#15249. This is not Tier-2, so no revalidationTrigger AC is required.

Discussion Criteria Mapping