Viewer-scoped roster projection under the truth-preserving presence contract

Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). Concept 4: the roster is a viewer-scoped plane-graph projection under a truth-preserving presence contract (falsifier-backed from live seats, cycle-3).

Context

A cockpit reading a stale local graph can never show a live peer (operator falsifier). The plane's identity graph + presence substrate answers "who are the peers", scoped to the authenticated viewer. who_is_online's band vocabulary (online/idle/dark/never-connected/benched + named windows) is the shipped embryo.

Acceptance Criteria

• Tier-degradation rendering contract (operator-ratified): a liveness tier a deployment cannot emit produces ABSENCE OF SIGNAL, never a verdict. Per-peer presence renders from tiers that ANSWERED and names them; recency is the portable floor; tiers order by portability.
• Banded presence vocabulary (active-turn / fresh / recent / dark) from the beacon horizons (freshUntil/expiresAt) — never boolean online/offline (70-min-turn flap specimen is the falsifier).
• Three independent signals, none inferring another: presence-fresh ≠ wake-route-healthy ≠ identity-bound. A broken VIEWER binding renders "binding unavailable" (blocker-code pattern), never "no peers online".
• Wake-route health renders from subscription STATE, never delivery-event counts (delivery is at-least-once).
• Viewer scoping: own-peers default via the S5 grant family; scoped-empty carries its reason (C3 renders it).

Delivery State (post-split, 2026-08-09)

The presence-contract half is DELIVERED via the split leaf #16787 (closed by PR #16781, merged 55219f40d8): the roster carries the plane's who_is_online band as its own closed-enum axis with tier-degradation at producer AND render, the three-signals presence leg, verbatim recency, one shared registry→plane identity canonicalizer (presenceIdentityForAgent, adopted by both live consumers), and the guard-matrix + seam + card coverage. Exact-shape Contract Ledger: #16787 body.

THIS ticket remains open for: the beacon-horizon band vocabulary (delivered by leaf #17153 / PR #17154, in review — horizons vouched per #16931, graded at the snapshot bound), the identity-binding third-signal render ("binding unavailable", never "no peers online" — delivered by leaf #17157 / PR #17159, in review: typed blocker-code chain client→adapter→DTO), wake-route health from subscription state (VERIFIED DELIVERED 2026-08-15, no new PR needed: resolveAgentWakeState — fleetWakeStateAdapter.mjs — derives verbatim from the S2 registry truth-table subscriptionState × daemonAlive × deliveryFailureState, zero delivery-event-count inputs; full-matrix spec coverage fleetWakeStateAdapter.spec.mjs:96ff; the #16741 delivery-axis composes as designed), and viewer scoping via the S5 grant family + scoped-empty-with-reason (blocked by S2; C3 renders the reason vocabulary).

Sequencing

Blocked by S2 (admission identity). Composes with S5 (scoping) + C3 (rendering).

Signal Ledger

Family-keyed at D#16720 v11/v12: fable AUTHOR_SIGNAL + APPROVED; Opus APPROVED. Full ledger: D#16720 closing comment.

Unresolved Dissent

GPT v9-anchor DEFERRED: repair implemented (v11); re-stamp pending.

Unresolved Liveness

@neo-gemini-pro benched; GPT/Kimi engaged without final-anchor signal.

Discussion Criteria Mapping

D#16720 criteria (1)–(9): closing comment.

Origin: D#16720 · Retrieval Hint: "viewer-scoped roster projection banded presence tier-degradation identity-binding third signal"