LearnNewsExamplesServices
Frontmatter
id15563
titlePreserve bundled Fleet sample on cold empty roster
stateClosed
labels
enhancementai
assigneesneo-gpt-emmy
createdAtJul 19, 2026, 8:42 AM
updatedAtJul 19, 2026, 10:31 AM
githubUrlhttps://github.com/neomjs/neo/issues/15563
authorneo-gpt-emmy
commentsCount0
parentIssue15524
subIssues[]
subIssuesCompleted0
subIssuesTotal0
contentTrust
projected
quarantined0
signals[]
blockedBy[]
blocking[]
closedAtJul 19, 2026, 10:31 AM

Preserve bundled Fleet sample on cold empty roster

Closed Backlog/active-chunk-8 enhancementai
neo-gpt-emmy
neo-gpt-emmy commented on Jul 19, 2026, 8:42 AM

Context

#15524 establishes the Fleet Manager zero-setup contract: the bundled deterministic roster is the zero-call default, while selected live sources may replace it. All named substrate dependencies are now on dev, but the first well-formed private-bridge answer can still be rows: [] on a fresh install.

Live latest-open sweep: checked the latest 20 open issues plus the last 30 A2A messages at 2026-07-19T06:41Z; no equivalent cold-empty admission leaf or competing claim was found. The semantic ticket sweep reinforced the operable-cold / honestly-labelled-seed precedent in #15254 and #15283.

The Problem

FleetCockpit.loadRoster() currently treats every array answer, including the first empty array, as selected live truth. It clears the bundled roster, sets the grid live, and leaves a flawless cold start presenting an empty flagship even though no working live fleet has ever been established.

The opposite blanket rule is also wrong: an empty snapshot must remain authoritative after a live source is selected, because a genuinely drained fleet must remove departed agents rather than resurrect sample cards.

The Architectural Reality

  • apps/agentos/store/FleetRoster.mjs owns the bundled roster seed.
  • apps/agentos/view/fleet/FleetCockpit.mjs#loadRoster owns private-bridge roster admission and the sample-to-live transition.
  • rosterWired distinguishes pre-admission from later reconciliations.
  • Grid and activity surfaces already label sample data honestly; this leaf does not add another sample store, fixture vocabulary, or control plane.
  • The product/demo separation from #15545 remains binding: no Play Tour or autoplay control belongs in the real Fleet Manager.

The Fix

Add an explicit, overridable roster-source admission mode to FleetCockpit:

  1. default sample: a cold first empty roster preserves the bundled sample and remains unwired;
  2. selected: an explicitly selected source makes even the first empty roster authoritative;
  3. any populated snapshot promotes the mode to selected;
  4. after rosterWired, every later empty snapshot remains authoritative and reconciles the real fleet to zero.

Cover all four transition edges in the focused Fleet cockpit unit shard.

Contract Ledger

Target surface Source of authority Proposed behavior Fallback Docs Evidence
FleetCockpit.rosterSourceMode #15524 + D#15498 zero-setup disposition sample until explicit selection or first populated admission; selected admits empty truth instance config / Neo.overwrites may select without a hidden constant config JSDoc config-default + transition tests
FleetCockpit.loadRoster() existing bridge/reconciliation owner cold empty preserves sample; selected/live empty clears malformed/failed reads keep last-known roster method JSDoc focused fleetCockpit.spec.mjs
Fleet grid roster existing FleetRoster seed + adapter state never claim empty live truth before source admission honestly labelled bundled sample existing sample labels 79/79 focused unit pass

Decision Record impact

Aligned with ADR 0037 and the graduated D#15498/#15524 source-mode contract. No ADR amendment is required.

Acceptance Criteria

  • A well-formed empty first roster answer preserves the bundled sample, its sample adapter state, and the pre-wired state.
  • Explicit selected mode makes an empty first roster authoritative and transitions the grid live.
  • A populated first roster replaces the seed, promotes source mode to selected, and transitions live.
  • A later empty roster after live admission remains authoritative and clears departed residents.
  • Focused Fleet cockpit unit coverage passes with the transition matrix pinned.

Out of Scope

  • The token-present public-fleet opt-in and its acquisition path.
  • The final packaged cold-first-run witness.
  • New sample data, new stores, credentials in the Body, anonymous REST-only impersonation, or demo controls in the product.
  • Closing #15524; this leaf only makes the cold-empty admission beat merge-addressable.

Avoided Traps

  • “Any reachable bridge is live truth.” Reachability does not prove a working fleet was selected.
  • “Empty always means sample.” That resurrects fake residents after a real fleet drains.
  • A hidden magic number or hardware threshold. Source admission is an overridable semantic config, not a machine-capacity guess.
  • A second store/control plane. The existing Fleet cockpit remains the single owner.

Related

#15524 · #15519 · #15545 · #15546 · #15254 · #15283

Implementation commit prepared under the already claimed parent lane: c59a42d36f.

Origin Session ID: ad71d4c3-3e37-4a17-8df7-8415509def84

Retrieval Hint: "Fleet cold empty roster sample selected rosterSourceMode c59a42d36f"