Dev-compose completion against the elected plane placement

Context

Phase-3 leaf of epic #15798 (Discussion #15595). ai/deploy/docker-compose.dev.yml is the half-built local mirror: it sets exactly one plane leaf (NEO_MEMORY_DB_PATH, :38/:81) over a ../..:/app bind mount, runs Chroma as tmpfs (ephemeral — "run the same shape 24/7" needs a data-plane swap, not just compose completion), and publishes 3000/3001 to the shared host namespace (:59/:100). It predates plane identity and the election; this leaf completes it against both.

The Problem

Three compose profiles today set three different subsets of the plane-leaf set with zero completeness assertion (the sweep's point-4 finding: plane binding is per-compose convention, socially expected). The dev-compose specifically: symlinked seats dangle in-container (the .neo-ai-data/sqlite symlink resolves outside the mount root — static-confirmed on a second seat), and the ephemeral Chroma silently forks the vector plane from the durable one.

The Architectural Reality

• The elected placement (#15800) decides mount style per profile; the plane subtree (#15799) supplies the declarative leaf set the compose must bind completely.
• Port bands per planeId come from the election record; boot must verify served identity (#15367 scar: a test trusting ANY listener executed a different checkout's tree — false reds AND greens).
• The parity stack runs BESIDE the native local OS under a separate Compose project + explicit plane id (the operator's hard constraint, Option-F vocabulary).

The Fix (one PR)

Complete docker-compose.dev.yml (or its parity successor profile): bind the FULL plane-member leaf set per the elected placement; persistent Chroma service wired to the declared plane (tmpfs only for explicit overlay planes, which fail closed against the durable root per #15799's invariant); port bindings from the election's per-plane band; compose project name derived from planeId; a boot-time served-identity probe.

Acceptance Criteria

• Every plane-member leaf bound declaratively; a completeness check fails the boot on an unbound member.
• Chroma persists on the declared plane; overlay/tmpfs mode is an explicit different planeId that cannot resolve the durable root (test).
• Ports allocated from the plane's recorded band; boot verifies served identity, not mere connectivity.
• A symlinked (non-canonical) seat boots correctly under the elected placement (the dangle class has a regression test or a recorded reconcile-mode precondition).
• Runs BESIDE a native local stack without collision (separate project name, disjoint ports) — verified live once.
• The orchestrator service performs the same complete-plane boot walk as mc/kb (consuming collectPlaneMembers / assertPlaneMemberCoherence, never restating), or fails closed.
  • Steward-assigned AC-extension (@neo-fable, epic #15798 disposition IC_5072383992), folded at pickup by the claimant per that ruling. Ruled an extension, not a new sub: the orchestrator asserting the complete plane at boot is the same F-invariant #15799 shipped for mc/kb, extended to the third Tier-1 consumer — parallel work, not new scope.
  • Cross-note to #15802: the drain lock keys on planeId (Clio's enrichment), so the orchestrator's walk and the drain lock observe the same plane identity.
  • Why "never restating" is load-bearing: a restated member list is a second hydration primitive — the exact trap this epic's review already defends against at the assertion layer. The walk must consume the SSOT collectors, not mirror them.

Out of Scope

Seat-config generator changes (the cutover leaf); CI lane changes (the CI leaf); production compose (already the reference shape).

Related

Epic #15798 · blocked_by #15800 · D#15595 rationale 1 + OQ10 fold · #15367 served-identity scar · borrowed-authority caveat as in #15799.

Origin Session ID: 758f110e-a429-4597-beb0-5fd3ec7d1bfc Retrieval Hint: query_raw_memories("dev compose completion elected placement plane member completeness served identity")