Cockpit banner gains the typed remote-connection states

The delivered slice of #16744 — split per the one-PR-resolvable rule: this ticket carries exactly the ACs PR #16825 delivers (the connection-axis render contract + matrix), while #16744's AC-2 (scoped-empty-with-reason) lives in #16824, gated on a wire projection that does not exist yet. Graduated scope of D#16720 (body v12); the connection-axis half of the cockpit's remote-connection vocabulary.

Context

The cockpit's per-SPINE honesty line (apps/agentos/view/fleet/spineBanner.mjs) spoke only sample/stale/live. A cockpit is a CLIENT of its fleet truth, and the connection itself has states the generic ladder could not name — the operator action differs per state, and "degraded" alone cannot carry "wait" apart from "investigate".

The Fix (as shipped in PR #16825)

• Cold branch, consulted before any topology guess: connecting (a read in flight — never "server offline"), refused (the plane NAMED a refusal — never a generic offline), unreachable (no route — investigate the plane, not the cockpit).
• Stale branch: slow (a wait, not an incident — "safe to wait"), unreachable, failed-upstream (the plane's own surface is failing — investigate plane-side).
• Wire-named per FLEET_WIRE_RESPONSE_STATES (apps/agentos/config/fleetWireMethods.mjs:59-67): the ticket-prose names auth-refused / plane-unreachable map to the wire names refused / unreachable; connected-empty is PR #16721's already-shipped answered-empty discipline.
• Contract-first per the module's own discipline: the render row and its discipline land here; the refusal producer arrives with the S2 admission layer (same contract-before-producer shape as the throttle axis). No caller change — syncSpineBanner deliberately unmodified.
• Truth model extended, not forked: a retained producer reason outranks every connection state; the connection fact never reaches daemon/live verdicts.

Acceptance Criteria

• Cold branch: connecting / refused / unreachable lines, consulted before the topology fallback; a retained surface reason still outranks them.
• Stale branch: slow / unreachable / failed-upstream prefixes; the deciding surface's retained reason always rides the line.
• Absent or unknown connection facts fall through to the shipped fallbacks, byte-identical.
• Daemon and live verdicts provably never consult the connection fact.
• Unit coverage in the spineBanner matrix idiom (9-row connection-axis block; full unit suite green).

Out of Scope

• Scoped-empty-with-reason (the OQ8 empty-state trap) → #16824 — needs the S3 operator-count projection.
• The refused producer (S2 admission layer) and any caller wiring.
• The getMainThreadConfigs → getRegistrationRootId() nicety (named non-blocking on PR #16797).

Related

• #16744 (parent scope; this ticket + #16824 cover it)
• #16824 (the split-off AC-2)
• PR #16721 (shipped sibling, same substrate pair)
• D#16720 (graduated source)

Live latest-open sweep: checked the latest 20 open issues at 2026-08-09T19:4xZ — no equivalent; #16744 is the parent source, #16824 the sibling successor. A2A in-flight sweep: session mailbox scans 17:38Z–19:4xZ — no competing claim on this scope.

Origin Session ID: d71abd86-5eec-4912-abdc-217268a39dc0

Retrieval Hint: "connection axis banner connecting refused slow unreachable failed-upstream deriveSpineBanner coldLineFor degradedLineFor"