The cockpit's default state reads as a warning, in internal vocabulary

Context

Operator verdict, live on the Electron shell 2026-08-10 ~23:55 (verbatim): "header never green, but yellow. cards with 'all sources nominal' => to me, this message has ZERO meaning. as does the weird offline message. UX fail." — delivered minutes after merging the two cockpit-truth PRs of the night (#16912, #16920), i.e. against the CURRENT dev head, on the product-path (Electron) surface. This is a D#14900-class front-door finding: the cockpit's truth model is architecturally honest but speaks maintainer vocabulary at the operator, and its resting state renders as a low-grade alarm.

The Problem — three concrete findings

1. The header can never be green. The fleet health bar counts all 9 seats as benched / offline, which carries attention-weight, so the header reads yellow forever. But un-managed seats are the NORMAL topology on this deployment — Fleet does not own the harness processes (they run in Claude Code / Codex / Kimi harnesses by design, D#16720 FM-as-client). A cockpit whose nominal state looks like a warning trains the operator to ignore the header — which then cannot alert.
2. "all sources nominal" carries zero meaning — and violates the cockpit's own doctrine. spineBanner.mjs:9-10 states the discipline: "nominal earns zero pixels, the same exception-based discipline the cards follow." The cards do NOT follow it: every card permanently renders a source-health line whose content ("which sources? nominal per what?") is unanswerable from the surface. The operator falsified the module's own claim.
3. "benched / offline" is an internal verdict contradicting the card it sits on. The runtime axis stamps agents benched / offline while the same card's presence band says ◉ online and the activity stream shows them merging PRs. Two truth axes, one internal vocabulary, rendered as a contradiction. ("Offline" is the runtime-supervision fact "Fleet does not run this process" — a fact about FLEET, presented as a fact about the AGENT.)

The Architectural Reality

• Runtime axis vocabulary: working/idle/wedged/rate-limited/unobserved/benched — supervision states for Fleet-MANAGED processes; for un-managed seats the honest value is closer to "not managed here" than "offline".
• Source-health marker: apps/agentos/view/fleet/sourceHealthMarker.mjs (+ HealthSwatch/HealthBar) renders unconditionally.
• The presence band (#16787) and the pending capability-envelope chip (#16737 slice, claimed) already carry the LIVENESS truth — the runtime axis need not moonlight as one.
• The exception-based discipline (nominal = zero pixels) is established in-repo doctrine; findings 2-3 are conformance gaps, not new design.

The Fix (design-first; owner may reshape within these constraints)

1. Managed-vs-unmanaged partition on the runtime axis: seats Fleet does not manage drop the benched / offline line entirely (absence discipline) or render neutral operator copy (e.g. external harness); the supervision vocabulary appears only for seats Fleet actually launched/owns.
2. Source-health goes exception-only: nominal renders nothing; a degraded source renders its NAME and reason (a2a mirror degraded · plane list_messages failing), composing with the #16737 presence-capability chip rather than duplicating it.
3. Header semantics: green/calm when zero attention-weight states among OBSERVED axes; un-managed seats carry no attention weight. Yellow/red reserved for states an operator should act on (wedged, rate-limited, degraded capability, daemon fault).
4. Copy review of remaining card strings against the "operator meaning" bar — every permanently-rendered string must answer "what would I do differently after reading this?" or earn zero pixels.

Acceptance Criteria

• A fleet of 9 un-managed seats with nominal sources and live presence renders a GREEN/calm header and cards with no benched / offline line and no all sources nominal line.
• A genuinely degraded source renders its name + reason on the affected card (exception-only), witnessed in the card spec matrix.
• Managed-seat supervision states (working/wedged/…) still render exactly as today for seats Fleet owns (witnessed both ways).
• Header attention-weight matrix spec: un-managed contributes zero; wedged/rate-limited/degraded/daemon-fault contribute; the mapping is a pure derivation with its own spec rows.
• Visual receipt on the Electron shell (the surface the verdict landed on).

Out of Scope

• The presence-capability chip (#16737 slice, already claimed — composes, not duplicated).
• Spine-banner verdicts (#16913 delivered; #16834/#16824 remain Phoebe's).
• Any new truth axis — this ticket only changes how EXISTING truth renders.

Related

#14560 (Lane B design epic — parent) · #16737 (presence render arc) · #16913/PR #16920 + PR #16912 (tonight's truth PRs, merged) · D#16720 (FM-as-client: un-managed is normal) · D#14900 (front-door presentation law) · #14805 (design-conformance epic, adjacent).

Creation-gate record: live latest-12 GitHub sweep 2026-08-10T21:57Z — no equivalent open ticket. A2A in-flight sweep IMPOSSIBLE (Memory Core MCP down, wave 2 of the #16808 degradation — noted as the documented gate deviation; collision risk nil while the mailbox is down fleet-wide). Self-assigning: operator-priority FM surface.

Origin Session ID: ff94e740-acb8-4f25-a94b-b614bdd91ea1

Retrieval Hint: "cockpit default state warning internal vocabulary benched offline nominal zero pixels"