Context
PR #15290's cycle-1 review falsified the liveness premise the initial-cold spine-banner leaf (#15284) originally leaned on: the cockpit has no ongoing liveness owner. loadRoster / loadActivity run at construction (plus a roster refresh only after successful lifecycle intents), and failure exits preserve the last-known owner states. Once gridAdapterState / streamAdapterState are live, a mid-session transport loss never advances them, so any consumer stays frozen at live.
#15284 is narrowed to its initial-cold render-only slice. This ticket owns the required liveness mechanism under the Fleet Manager cockpit UI epic #14560. The Brain-side fleet service spine and bridge remain under #13015.
Contract
An owning mechanism in the cockpit advances adapter-state truth through the full journey without reload while the routing matrices in loadRoster / loadActivity remain the state-writing seams:
- loss:
live → stale when the transport stops answering, with a retained safe reason on the owner;
- cold loss: complete bridge/transport absence advances owner truth to cold;
- recovery: a later successful poll returns states to
live and clears the reason.
Mechanism choice (interval re-poll of existing read verbs versus a lighter ping) is a Tier-2 implementation decision. Fail-closed data semantics remain binding: a loss never blanks roster or stream data; only the state advances.
Acceptance Criteria
- A liveness mechanism advances
gridAdapterState / streamAdapterState on transport loss and recovery without reload; a safe owner-held reason is retained on degraded/cold transitions and cleared on recovery.
- The spine banner renders the retained reason on
degraded; generic copy is used only when no reason exists.
- Unit evidence witnesses the owner-level transition matrix (
live→stale with reason, stale→live clearing it, no-bridge→cold) and real banner-slot mutation across a transition.
- Neural Link e2e witnesses cockpit live → transport killed → banner names the loss → transport restarted → banner clears, against a real fleet server.
- The liveness mechanism starts and stops with the cockpit; no timers leak across destroy, pop-out, or reattach.
Contract Ledger
| Surface |
Truth source |
Behavior |
Fallback |
Docs |
Evidence |
| Liveness mechanism |
fleet bridge read verbs or a bounded ping |
advances owner adapter states on loss/recovery |
fail-closed: data preserved; only state moves |
JSDoc + running guide |
unit transition matrix |
| Degraded reason |
owner-held field |
banner names the retained safe reason |
generic copy only when absent |
same |
unit + NL |
| Recovery |
next successful probe |
states → live; reason cleared |
n/a |
same |
NL journey |
| Lifecycle |
cockpit construct/destroy |
no leaked timers across destroy/pop-out |
n/a |
JSDoc |
unit teardown witness |
Related
Parent: #14560 · service-spine sibling: #13015 · narrowed initial-cold leaf: #15284 · source review: PR #15290.
Origin Session ID: 5bbd6fb6-07d8-4f7e-b3ba-cccb66eddcf3
Retrieval Hint: "Fleet cockpit liveness owner live loss recovery retained degraded reason"
Context
PR #15290's cycle-1 review falsified the liveness premise the initial-cold spine-banner leaf (#15284) originally leaned on: the cockpit has no ongoing liveness owner.
loadRoster/loadActivityrun at construction (plus a roster refresh only after successful lifecycle intents), and failure exits preserve the last-known owner states. OncegridAdapterState/streamAdapterStatearelive, a mid-session transport loss never advances them, so any consumer stays frozen atlive.#15284 is narrowed to its initial-cold render-only slice. This ticket owns the required liveness mechanism under the Fleet Manager cockpit UI epic #14560. The Brain-side fleet service spine and bridge remain under #13015.
Contract
An owning mechanism in the cockpit advances adapter-state truth through the full journey without reload while the routing matrices in
loadRoster/loadActivityremain the state-writing seams:live → stalewhen the transport stops answering, with a retained safe reason on the owner;liveand clears the reason.Mechanism choice (interval re-poll of existing read verbs versus a lighter ping) is a Tier-2 implementation decision. Fail-closed data semantics remain binding: a loss never blanks roster or stream data; only the state advances.
Acceptance Criteria
gridAdapterState/streamAdapterStateon transport loss and recovery without reload; a safe owner-held reason is retained on degraded/cold transitions and cleared on recovery.degraded; generic copy is used only when no reason exists.live→stalewith reason,stale→liveclearing it, no-bridge→cold) and real banner-slot mutation across a transition.Contract Ledger
live; reason clearedRelated
Parent: #14560 · service-spine sibling: #13015 · narrowed initial-cold leaf: #15284 · source review: PR #15290.
Origin Session ID: 5bbd6fb6-07d8-4f7e-b3ba-cccb66eddcf3 Retrieval Hint: "Fleet cockpit liveness owner live loss recovery retained degraded reason"