Split leaf of #16737 (the S3 roster ticket) — the first of its four remaining legs, following the #16787 split-leaf precedent. Parent stays open for the other legs.
Context
#16737's presence-contract half shipped via #16787: the roster carries the plane's who_is_online band with tier-degradation at producer AND render, and fleetPresenceStateAdapter.mjs already exports the GRADED vocabulary (PRESENCE_BANDS) plus gradePresenceBand. The documented deliberate residual (module header, pre-change): the active-turn grade trusted the producer-computed fresh boolean; the full beacon-horizon derivation waited for the plane to vouch freshUntil/expiresAt per row — which #16931 landed (TurnPresenceService.observationFor → vouched verbatim into signals.turnPresence, WakeSubscriptionService.mjs:861).
The Problem
The producer's fresh boolean is stamped at the PRODUCER's clock; the snapshot envelope declares capturedAt as the observation-time bound for every row. Trusting the boolean across that skew lets a finished turn keep rendering active-turn (the inverse of the 70-minute-flap falsifier: instead of a live turn flapping dark, a dead turn stays live). It also makes specs wall-clock-dependent: the prior flap fixture used real new Date() against pinned horizon strings — deterministic only until the calendar caught up with the fixture (it did: the fixture's freshUntil of 2026-08-11 went stale on 2026-08-15).
The Architectural Reality
ai/services/fleet/fleetPresenceStateAdapter.mjs — the presence axis of the truth-preserving presence contract; pure module (no Neo globals), consumed through the bulk readPresence seam shared with the decomposed wake-routes source. The grade DERIVES; it never re-computes liveness — "no second clock authority" means evaluating vouched instants against a vouched bound, never inventing windows adapter-side. Known producer-side limitation, out of scope here: the plane's verdict keys on add_memory recency, not add_message — an actively-messaging seat can read dark (observed live by @neo-opus-ada, 2026-08-15).
The Fix (implemented on feature/16737-beacon-horizon-bands)
- New pure exported helper
beaconFreshAtBound({turnPresence, boundAt}) — the ONE place beacon freshness is decided. Precedence: expired observation (expiresAt ≤ bound) vouches nothing whatever its boolean claims; a present freshUntil governs against the bound; horizons absent/unparseable → the vouched boolean is the only signal (tier degradation: no horizon tier ⇒ no refinement, never a verdict); no usable bound → same fallback. NaN-safe, total.
readFleetPresenceSnapshot resolves ONE capturedAt value used for BOTH the envelope declaration and every horizon evaluation — bound and declaration can never drift by clock skew or a second new Date().- Module header residual paragraph replaced by the landed-derivation contract.
- Spec: flap falsifier re-pinned to explicit bounds (deterministic forever); new pure matrix for
beaconFreshAtBound; the skew falsifier — ONE payload, three bounds (active-turn → fresh → expired) proving horizon-derivation over producer-clock trust.
Acceptance Criteria
Out of Scope
#16737's legs 2–4 (identity-binding third-signal render · wake-route health from subscription state · S5-gated viewer scoping) · producer-side verdict inputs (the add_message gap above) · any C3 render-side change.
Related
#16737 (parent) · #16787 (split-leaf precedent, delivered half) · #16931 (producer horizon vouching) · #16741 (wake-route delivery axis, composes with leg 3) · D#16720 (source discussion).
Live latest-open sweep: latest 20 open checked 2026-08-15T08:31Z (newest #17151); no equivalent. A2A in-flight sweep: last-15 messages same timestamp; no colliding claim (Vega #17139 · Grace #17141/#17151 · Ada #17148/#17150 — disjoint).
Origin Session ID: 1deebbe1-b7e6-4f76-b39d-9cfcbe342596
Retrieval Hint: "beacon horizon band vocabulary snapshot bound skew" · "fleetPresenceStateAdapter active-turn freshUntil"
Split leaf of #16737 (the S3 roster ticket) — the first of its four remaining legs, following the #16787 split-leaf precedent. Parent stays open for the other legs.
Context
#16737's presence-contract half shipped via #16787: the roster carries the plane's
who_is_onlineband with tier-degradation at producer AND render, andfleetPresenceStateAdapter.mjsalready exports the GRADED vocabulary (PRESENCE_BANDS) plusgradePresenceBand. The documented deliberate residual (module header, pre-change): theactive-turngrade trusted the producer-computedfreshboolean; the full beacon-horizon derivation waited for the plane to vouchfreshUntil/expiresAtper row — which #16931 landed (TurnPresenceService.observationFor→ vouched verbatim intosignals.turnPresence,WakeSubscriptionService.mjs:861).The Problem
The producer's
freshboolean is stamped at the PRODUCER's clock; the snapshot envelope declarescapturedAtas the observation-time bound for every row. Trusting the boolean across that skew lets a finished turn keep renderingactive-turn(the inverse of the 70-minute-flap falsifier: instead of a live turn flapping dark, a dead turn stays live). It also makes specs wall-clock-dependent: the prior flap fixture used realnew Date()against pinned horizon strings — deterministic only until the calendar caught up with the fixture (it did: the fixture'sfreshUntilof 2026-08-11 went stale on 2026-08-15).The Architectural Reality
ai/services/fleet/fleetPresenceStateAdapter.mjs— the presence axis of the truth-preserving presence contract; pure module (no Neo globals), consumed through the bulkreadPresenceseam shared with the decomposed wake-routes source. The grade DERIVES; it never re-computes liveness — "no second clock authority" means evaluating vouched instants against a vouched bound, never inventing windows adapter-side. Known producer-side limitation, out of scope here: the plane's verdict keys onadd_memoryrecency, notadd_message— an actively-messaging seat can read dark (observed live by @neo-opus-ada, 2026-08-15).The Fix (implemented on
feature/16737-beacon-horizon-bands)beaconFreshAtBound({turnPresence, boundAt})— the ONE place beacon freshness is decided. Precedence: expired observation (expiresAt≤ bound) vouches nothing whatever its boolean claims; a presentfreshUntilgoverns against the bound; horizons absent/unparseable → the vouched boolean is the only signal (tier degradation: no horizon tier ⇒ no refinement, never a verdict); no usable bound → same fallback. NaN-safe, total.readFleetPresenceSnapshotresolves ONEcapturedAtvalue used for BOTH the envelope declaration and every horizon evaluation — bound and declaration can never drift by clock skew or a secondnew Date().beaconFreshAtBound; the skew falsifier — ONE payload, three bounds (active-turn→fresh→ expired) proving horizon-derivation over producer-clock trust.Acceptance Criteria
beaconFreshAtBoundexported, pure, total; matrix spec covers: absent observation, horizon-over-boolean both directions, expired-observation veto, boolean fallback (absent + unparseable horizons), absent bound.capturedAt(skew-impossible by construction).freshUntiland afterexpiresAtyieldactive-turn/ verdict-grade / verdict-grade.npm run test-unit -- test/playwright/unit/ai/services/fleet/fleetPresenceStateAdapter.spec.mjs— 18/18 passed (2026-08-15, pre-PR).Out of Scope
#16737's legs 2–4 (identity-binding third-signal render · wake-route health from subscription state · S5-gated viewer scoping) · producer-side verdict inputs (the add_message gap above) · any C3 render-side change.
Related
#16737 (parent) · #16787 (split-leaf precedent, delivered half) · #16931 (producer horizon vouching) · #16741 (wake-route delivery axis, composes with leg 3) · D#16720 (source discussion).
Live latest-open sweep: latest 20 open checked 2026-08-15T08:31Z (newest #17151); no equivalent. A2A in-flight sweep: last-15 messages same timestamp; no colliding claim (Vega #17139 · Grace #17141/#17151 · Ada #17148/#17150 — disjoint).
Origin Session ID: 1deebbe1-b7e6-4f76-b39d-9cfcbe342596
Retrieval Hint: "beacon horizon band vocabulary snapshot bound skew" · "fleetPresenceStateAdapter active-turn freshUntil"