Cockpit wake-route panel: per-seat arming, liveness, last failure

Context

FM-week Lane C (observability) under the #14560 lane map — the operator's original idea list names "Agent OS logs views (orchestrator container, wake delivery)" explicitly. Wake delivery is the fleet's nervous system, and every fault in it today is diagnosed by an agent running hand-forensics: the 2026-08-02 busy-hang diagnosis (#16386 era), Ada's cold-boot forensics filed this morning (#16429, #16430), and the recurring [daemon-health] staleness broadcasts (D#16304 arc). The operator — whom the FM exists to serve — sees none of it.

Live latest-open sweep: checked latest 20 open issues at 2026-08-03T10:22Z (re-checked latest 10 at 10:26Z); no equivalent found. A2A 30-message claim sweep at 10:22Z: no overlapping [lane-claim]/[lane-intent].

The Problem

The wake substrate is now three shipped layers deep, and none of them has an operator surface:

1. Subscription state lives in the MC graph (WAKE_SUBSCRIPTION nodes) and is readable over authenticated MCP (#16347 shipped the fleet-side read path).
2. Seat-side route arming shipped in #16410 (63149823e2): a seat arms its own wake route at session start via ai/daemons/wake/armSeatWakeRoute.mjs + readSubscriptionsOverMcp.mjs.
3. Delivery liveness + terminal failures shipped in #16347: ai/services/fleet/fleetWakeStateAdapter.mjs carries injectable axis-level resolvers (resolveDeliveryLiveness, resolveTerminalDeliveryFailures) bound to the containerized plane at the devFleetServer entry.

The cockpit can render an agent's memories (#16398) but cannot answer the operator's most basic fleet question: "can this seat be woken right now, and if not, where does the route break?"

The Architectural Reality

• Pane vocabulary: apps/agentos/view/fleet/ already speaks vital-signs — spineBanner.mjs (the single honesty line), telltale.mjs, HealthSwatch.mjs, StateDot.mjs. MemoriesPane.mjs (#16398 → d9677cecf2) is the freshest sibling precedent for a plane-fed pane.
• Wire seam: the cockpit consumes Brain-side truth via src/ai/fleet/fleetWireMethods.mjs / fleetCockpitStatus.mjs over the existing authenticated fleet request path — the #13015-owned bridge. No new transport.
• Data path mandate: data-carrying cockpit UI binds a data.Store of data.Model records (operator directive 2026-07-08; the memories view is the shipped precedent). No hand-mapped arrays; state.Provider stays at the view root.
• Status-idiom entity trap (Ada, 2026-08-02): the COALESCE status idiom spans THREE node labels — WAKE_SUBSCRIPTION, HARNESS_PRESENCE, AGENT_TURN_PRESENCE. Every status read in this leaf must be label-classified, never grep-and-converted.

The Fix

One PR, sibling-lifted from the memories-view shape:

1. Brain-side read composition — extend the existing fleet cockpit wire surface (sibling method beside the fleetCockpitStatus.mjs pattern) that composes, per registered seat: subscription status, route-armed state, delivery liveness, last terminal delivery failure, and turn-presence freshness — all from the shipped sources above, read live from the plane (no mirror files, no second truth).
2. WakeRoutePane — a MemoriesPane sibling under apps/agentos/view/fleet/, Store/Model-bound, one row per seat with the five axes; degraded axes render their typed reason.

Contract Ledger

Acceptance Criteria

• Each registered seat renders one row with the five axes (subscription, armed, delivery liveness, last terminal failure, presence freshness) from live plane truth over the existing authenticated fleet request path.
• Absence claims nothing: an unqueried or unreachable axis renders its typed degrade reason — never default-healthy (the #16051 null-claims-nothing law, asserted with a control pair).
• Data path is data.Store of data.Model records end-to-end; no hand-mapped arrays.
• Unit specs green via the custom Playwright unit config (never default npx playwright test).
• PR carries a live receipt against the running containerized plane (screenshot or read_page transcript of real seat rows).

Out of Scope

• Per-event historical wake ledger (armed→attempt→receipt timeline) — requires service-side event accretion that does not exist yet; future #13015-side leaf.
• Container log surfaces and the orchestrator scheduling view (separate Lane C leaves, claimant-authored).
• Any daemon-internal behavior change — @neo-opus-vega's starvation-diagnosis arc (#16382, PR #16416) is untouched.
• Tray/native-shell surfaces (#14793 territory).

Avoided Traps

• Second-truth cache: the pane binds plane reads; it never mirrors wake state into files or duplicated stores (Diamond-1-B trap from the lane map).
• Absence-as-health: defaulting any axis to healthy asserts fitness on the strength of never having asked — the same unearned-certification shape #16051/#16037 rejected.
• Status-idiom grep-and-convert: three node labels share the status idiom; every read is label-classified (entity trap above).
• New MCP tool: none added; tool-bloat discipline (#16217) — existing wire + existing MCP reads only.

Decision Record impact

None — aligned-with ADR 0018 (two-hemisphere split: Brain-side composition on the #13015 bridge, Body-side pane under #14560). Consumes shipped contracts; supersedes nothing.

Related

• Parent epic: #14560 (cockpit UI/UX; native-linked on creation)
• Service spine + bridge: #13015
• Shipped substrate consumed: #16347, #16410
• Motivating forensics: #16429, #16430, D#16304
• Sibling vitals leaf: #16051 (daemonState wiring into spineBanner)

Origin Session ID: 65e414e1-48a4-49a0-a430-70a81911f9fc Retrieval Hint: "fleet wake plane migration injectable resolvers" · "wake-route panel Lane C" · commit range 63149823e2..d9677cecf2