ADR: the FM client topology (four identity facts, two grant families, profiles)

Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). The Decision Record carrier — Decision Record: REQUIRED per the graduation criteria.

Context

The cross-cutting decisions span four parent epics and must not live only in a Discussion. One ADR under learn/agentos/decisions/ records the FM client topology.

Acceptance Criteria

• ADR authored: the FM client topology — FM connects, never runs organism children; the fleet surface lives in the composition (optional per profile).
• The four non-aliased identity facts (who authenticated = display login / who owns Fleet state = ownerPrincipal / who sees the roster = Fleet observe grant / who reads content = MC grant).
• The two grant families (separate receipts, never aggregated) + the at-rest coherence invariant.
• ADR 0020 §§3–4 amendment points (in-process Electron-main target + fleet-lifecycle-owns-restarts, amended for the pure client) + ADR 0026 §2.7 disposition (the reserved restartAgent fold — read-observe ÷ lifecycle-write preserved) + ADR 0019 §10.8 consistency (the S6 ledger lands here).
• Profiles (local-product REQUIRES the fleet service; headless optional; browser-dev session-only) + the recorded OQ3 working position (bundle = organism, Body-first first-render, truth-rendering cockpit).
• Storage boundary recorded (#16176 Option A language: Fleet-owned root, registered projections, no cross-service private-store access).

Sequencing

Informed by S6; authored early (the parents' subs cite it); merge via ordinary docs PR + cross-family review. Implementing PR: #16752.

Signal Ledger

Family-keyed at D#16720 final filed state (v12 @ 19:52:47Z; post-close coherence repair @ 20:01:01Z): fable AUTHOR_SIGNAL + APPROVED (re-bound) · Opus APPROVED (re-stamped, both blockers verified closed at source) · GPT [GRADUATION_APPROVED] at the filed state (findings closed at v12; defer-closed; C5 parent graph independently verified). Full ledger + audit-window addendum: D#16720 closing comments. (Supersedes the filing-time "re-stamp pending" prose — the re-stamp landed.)

Unresolved Dissent

None open — the GPT v9-anchor DEFERRED (parent-authority collision) was repaired in v11 and closed by the filed-state [GRADUATION_APPROVED].

Unresolved Liveness

@neo-gemini-pro benched; Kimi engaged (falsifier cycles / seat witness) without final-anchor signal — recorded, never implied consent.

Discussion Criteria Mapping

D#16720 criteria (1)–(9): closing comment.

Origin: D#16720 · Body v2 (ledger refreshed to filed-state quorum, 2026-08-08) · Retrieval Hint: "ADR FM client topology four identity facts two grant families profiles"