Plain harness start self-supplies the fleet transport — zero bearer coordination

Priority: HIGH (operator friction→gold, 2026-08-08). First live operator run of the Electron harness, verbatim: "1 command is a never ending process, so i can not add a second command into that terminal... 2 terminals: getting the same token is non-trivial. friction->gold => we can not ask other users to do this manually."

Context

The first Lane-B operator run (#14560 §04 arc) produced the empirical chain now on #16693: shell boots ✓, fleet transport runs ✓, auth enforced ✓ — cockpit offline, because the shell's process env carried no NEO_FLEET_BEARER (hash-verified: empty on the shell side, present on the server side). harness/main.mjs:78 self-generated an ephemeral bearer; every renderer→IPC→main→HTTP request 401'd; the renderer's fail-closed path honestly showed the static roster. The security design worked; the coordination model is the defect. The interim recipe (one shared env export across processes) is a diagnosis artifact, not a product behavior.

The Problem

npm start (UI-only) boots the window and spawns nothing. The fleet transport must be started externally, and the app↔transport handshake requires the SAME NEO_FLEET_BEARER in two independently-launched processes. A human cannot reasonably hand-carry a 43-char one-time secret between terminals — and a foreground dev server occupies its terminal, so the one-terminal flow does not exist either. The §04 PoC bar (@tobiu starts an agent from the UI) is unreachable while the handshake needs a hand-carried env var.

The Architectural Reality

• harness/main.mjs already holds the resolved bearer (main.mjs:78, resolveFleetBearer) and already owns the complete fleet-spawn machinery on the brain path: child spawn with env: {NEO_FLEET_BEARER: fleetBearerToken, NEO_FLEET_PORT} plus awaitFleetReady (readiness = a real listAgents wire round-trip, never PID existence).
• probeExistingFleetServer (fleetLaunchContract) owns the reuse semantics: same-token+same-viewer probe → reuse; anything else is a named refusal.
• The quit path already drains "exactly the child tree this harness owns" — the ownership set exists.
• The packaged product profile already boots its own transport; UI-only checkout start is the ONLY topology demanding manual coordination.

The Fix

In UI-only mode (npm start, no brain leg), the shell self-supplies its transport:

1. Probe :8083 (or NEO_FLEET_PORT) via probeExistingFleetServer with the shell's bearer: same-bearer server → reuse (a dev's own coordinated transport keeps working).
2. Port free → spawn devFleetServer as an owned child with the shell's bearer + port env (the brain path's exact spawn shape), await fleet readiness, register in the owned-children set so the existing quit drain tears it down.
3. Foreign/mismatched listener → do NOT adopt, do NOT exit: the window boots to the current honest offline state with the probe's named refusal logged — a UI must not brick because a foreign process squats the port (contrast: the brain path's fail-closed exit stays correct for organism boot).
4. NEO_HARNESS_SMOKE=1 keeps UI-only legs spawn-free (the smoke's isolation contract — a dev machine may carry a live transport; the fleet leg's evidence lives in smoke:brain and the live run).

Acceptance Criteria

(Restructured 2026-08-08 during PR #16696 review cycle 2, per the reviewer's close-target rule: the pre-merge-provable mechanics moved to the sub-leaf #16708 (the PR's Resolves target, carrying the Contract Ledger for the delivered surfaces); THIS umbrella stays open until its live receipt lands. The cycle-1 AC-split annotation is preserved below in spirit — the amendment history is in the PR thread.)

• → #16708 (sub-leaf, delivered by PR #16696): transport self-supply mechanics — three-outcome composition witnessed, ownership≠observation split witnessed, live spawn receipt, quit drain, smoke spawn-free.
• This umbrella's remaining AC (operator-run class): the renderer-side receipt — the cockpit renders the LIVE roster over the wire in the one-command flow on the operator machine (lands with the operator's run and/or #16699's auto-recheck instrumentation). Close this ticket only on that receipt.

Out of Scope

• The brain legs' plane-aware ATTACH-OR-OWN re-triage — #16693 owns it (this leaf is its UI-only sibling, split per the #16693 scope note).
• Packaged-product profile (already self-supplying).
• Any bearer-prompt UX (credentialProvider surface) — the point is needing none.

Avoided Traps

• Exiting the shell on a foreign listener (the brain path's semantics) — correct for organism boot, wrong for a UI window; the honest-offline fallback is the existing, tested behavior.
• A root npm wrapper script exporting one env for both processes — batches the friction instead of removing it; the packaged app (Finder double-click) could never use it.
• Auto-spawn in smoke mode — violates the smoke isolation contract on dev machines with live transports.

Related

• #16693 (sibling: brain-leg plane-aware attach; carries today's empirical receipt) · #14560 Lane B (the operator run) · #13015 (transport ownership) · #15798 (topology context).

Creation-gate record: live latest-10 sweep 2026-08-08T13:27Z — #16693 is the adjacent sibling, split per its own scope note; no equivalent open ticket. Self-assigning; implementation starts immediately (operator-prioritized).

Origin Session ID: 9b6352cd-0db2-4a10-8254-36e710c67e1d Retrieval Hint: "harness UI-only start self-supplies fleet transport bearer zero coordination"