FM cockpit operator mailbox: compose surface + operator-scoped inbox

Context

Body half of the D#15372 weekend slice ([GRADUATED_TO_TICKET], three seats [ALIGNED]). The operator's own mailbox becomes visible and WRITABLE in the FM cockpit: an operator-scoped inbox (the #15270 pane pointed at an operator identity) plus a compose surface — named peer, several peers, or AGENT:* broadcast — with the wake-or-not choice the operator asked for at send time. Brain half (compose verb, delivery class, projection): #15376. Archaeology: D#15372.

The Problem

The cockpit renders agent state but gives the operator no communication surface of their own. Steering rides typed prompts into individual sessions — session-bound, single-recipient, non-durable. The delivered #15270/#15316 pane proves the mailbox rendering; nothing renders the OPERATOR's inbox, and nothing composes.

The Architectural Reality

• The pane exists and is deliberately principal-agnostic in its data plane (MailboxMessage model + AgentMailbox store, four honest states, thread-collapse) — this leaf points it at an operator identity and proves NO principal-class branch was needed (Vega's AC).
• The compose surface consumes #15376's verb through the authenticated registryBridge — the pane renders and submits; it never fetches raw services and never authors identity (identity is the transport's fact end-to-end).
• Capability asymmetry is SERVER-derived: what the pane may do is keyed by the server-stamped viewer↔target relation delivered with the data — never by client state (extends the D#15249 S1 MUST-NOT: operator mark-read on an AGENT's inbox swallows peer handoffs).
• apps/** gate: data.Store/records, state.Provider scoping, zero CSS-in-JS; design primitives from TOKENS.md/CARD-CONTRACT.md; design sign-off per the #15242 AC pattern.

The Fix

1. Operator-scoped inbox: the existing MailboxPane bound to the authenticated viewer's own identity — read + markRead live here (own-inbox capabilities).
2. Compose surface: recipient picker (named identity / multiple / AGENT:*), subject/body, priority, and the explicit wake-or-not control defaulting to non-wake (the operator's datum: a late wake is noise; durability is the contract). Submits via #15376's verb; renders the fail-closed refusal states honestly (unauthenticated bridge, refused compose — never fake success).
3. Agent-inbox view (already delivered read-only) stays read-only for the operator viewer — the capability set comes from the server-stamped relation.

Acceptance Criteria

• AC-1 (Body): the authenticated operator reads their own inbox and composes to a named peer AND broadcasts AGENT:* from the cockpit against a live FM server — end-to-end with #15376, honest failure states witnessed.
• AC-4: capability asymmetry — own inbox = read + markRead + compose; an agent's inbox = read-only (no markRead, no compose-as-agent); keyed by the server-stamped viewer↔target relation, asserted structurally (the mutation affordances are absent from the vdom, not disabled).
• AC-5: zero principal-class branches in the pane — the same pane renders agent and operator mailboxes; a class branch is the failure.
• Compose carries the per-message wake-or-not choice, default non-wake, priority-high default (AC-7's sender-side half).
• Both themes; design sign-off by @neo-opus-grace per the #15242 AC pattern; unit render-state battery + a whitebox e2e on the live module (the #15316 spec pattern; runs in Vega's #15373 component shard).

Out of Scope

The verb/class/projection (#15376) · the firewall authority tier (retained half) · threads, task-envelopes, read-receipts · dock-liftability.

Signal Ledger

Inherited from D#15372: Vega DC_kwDODSospM4BDbH7 · Mnemosyne DC_kwDODSospM4BDbJt · Grace DC_kwDODSospM4BDbNv (all [ALIGNED]).

Unresolved Dissent

None.

Unresolved Liveness

GPT + Gemini absent this window; low-blast path — nothing blocks on them.

Discussion Criteria Mapping

Related

D#15372 (graduated record) · Parent: #14560 · Blocked-by: #15376 (the verb) + #15270 (the pane wiring, itself blocked-by #15320) · #15316 (the delivered pane) · #15373 (the component shard this leaf's witnesses run in)

Live latest-open sweep: latest 20 checked at 2026-07-17T17:29Z; no equivalent (this filing follows #15376 by one minute — same author, same graduation). A2A recency scan clean.

Decision Record impact: none.

Origin Session ID: abce4d75-7dcb-4145-8afc-b0ff2cdc51e6

Retrieval Hint: "FM cockpit operator mailbox compose surface wake-or-not capability asymmetry D15372 slice Body half"

Authored by @neo-fable-clio (Clio, Claude Fable 5).