Browser-direct cockpit wake consumer over the C1 broker (C2 cutover)

Context

The browser-direct half of the S7 wake story, transferred out of #17101 at its truth-fold (cycle-2 review on PR #17116: the shipped slice-3 v1 is the RELAY-side fetch-streaming consumer, because the transitional cockpit holds only the process bearer and cannot present fleet-surface admission; the browser-direct consumer rides the C2 cutover). This ticket carries the transferred acceptance criteria so #17101 can close truthfully against what its PR delivers.

Six-stage record: premise = the deferred half of a deliberately-scoped v1 (recorded on #17101 at claim time, 2026-08-14, before building); prescription/substrate = apps/agentos client work over the FROZEN slice-2 wire (sibling precedent: apps/agentos/fleet/installFleetBridge.mjs is the App-Worker consumer home); consumer = cockpit viewers; service boundary = clean (consumes, never redefines, the fleet surface); decision-record impact = aligned-with the FM client topology ADR (remote-only journey §2.8, custodian shapes §2.1).

Frozen contract facts (build against these — the slice-2/slice-3 wire, review-hardened)

• Fetch-streaming, not bare EventSource: credentials ride headers, so the browser consumer is a fetch + ReadableStream text/event-stream reader.
• Two credentials, two headers, never aliased: class-1 Fleet admission on Authorization; the viewer's class-3 MC credential on x-neo-mc-authorization arms the per-viewer relay subscription. Byte-identical pairs are refused server-side; omitting the class-3 header is honest not-armed.
• Credential custody is the C1 broker's (#16742): the browser page never holds durable credentials itself — the three custodian shapes decide how the two mints reach the connection.
• The state handshake carries {armed, reason, lastPushAt, connectedIdentities, armedForViewer, subscriptionId?} — subscriptionId is ADDITIVE, present when the lane is armed for the viewer, and is the cold catch-up authority: poll-digest {subscriptionId, sinceLogId} fires once per connection the moment the id is known, no live wake required.
• Wake frames: event: wake, data: {subscriptionId, envelope} (signed digest envelope, schemaVersion '1.0').
• Caps are real: 30 connect attempts/min/viewer, 8 streams/viewer, 64 total; retry: hint is the floor; refusals are wire envelopes — render, never retry-storm.
• Watermark is client-held and echoed, never server-persisted.

The Fix

1. Browser fetch-streaming consumer in apps/agentos connecting to the ingress /fleet/events with broker-supplied credentials (both headers), parsing the frame grammar, adopting the vouched subscriptionId, and running poll-digest catch-up per connection with the client-held watermark.
2. Store-bound rendering of the per-viewer wake state through the existing cockpit pipeline (data.Store records, state.Provider at the view root, zero CSS-in-JS).
3. Honest-degraded rendering: a dead stream renders "wake push unavailable — reason" (absence-of-signal vocabulary, never a verdict); a failed poll is DISTINCT from an empty digest.

Acceptance Criteria (transferred verbatim from #17101's superseded browser scope)

• Remote-only journey: a no-checkout cockpit has a working browser wake story — SSE receipt live in the page, reconnect catch-up via poll-digest proven, cold start drains pending wakes from the vouched handshake id alone.
• Two-credential arming proven wire-level from the browser path: distinct mints arm the per-viewer subscription; a byte-identical pair renders the server's refusal honestly.
• App-gate discipline: store-bound data path, state.Provider at the view root, zero CSS-in-JS; whitebox-e2e for the consumer journey.
• Watermark client-held and echoed, never server-persisted (slice-1 contract preserved from the browser side).

Sequencing

Blocked by C1 #16742 (the connection broker owns credential custody — the browser page must never hold the mints). Follows the S2 admission subject (PR #17127) and consumes the frozen slice-2/slice-3 wire (PRs #17103 / #17116). Related rendering: C3 states (#16744).

Out of Scope

Relay-side consumption (#17101, shipped), server push composition (#17100, merged), MC telemetry (#17102).

Related

Parent #16741 (S7 umbrella) · #17101 (the relay v1 whose browser ACs this carries) · #16742 (C1, blocker) · epic #16168.

Live latest-open sweep: latest 20 open checked at 2026-08-14T17:07Z, no equivalent; A2A claim sweep (last hour, all read-states) clean.

Origin Session ID: c4996813-01b9-4234-8bdd-ed3bf22c0970

Retrieval Hint: query_raw_memories("browser-direct wake consumer C2 cutover two credentials fetch-streaming cockpit")