From the #17271 L1 session's F3 finding, promoted by operator direction (2026-08-17): the Kimi seats were operator-benched that morning, yet the registry still carries participationStatus: 'active' for them — the cockpit rendered them dark/unobserved, the benched tally showed 0, and who_is_online reasons said "rostered, not recently seen" instead of the truth ("benched by operator decision"). The operator's framing of the gap: on THIS deployment the fact can be dropped into the identity graph by hand — other operators have no path at all. A truth surface whose core operator decision cannot be recorded through the product is incomplete for exactly the adopters FM exists for.
The Problem
participationStatus is the roster's authority for the bench fact — the presence adapter, who_is_online (band benched, hard precedence gate), the roster DTO, and the cards all READ it (gemini-pro proves the render path end-to-end). But nothing WRITES it: no fleet wire verb, no cockpit control, no recorded reason. Bench/unbench — the most basic fleet-governance decision an operator makes — lives outside the product.
The Architectural Reality
Registry: ai/services/fleet/FleetRegistryService.mjs owns registry.json (definitions read/persist paths exist; the define-agent surface #15242 — AgentConfigCard + FleetSettingsPanel — is the write-surface precedent).
Wire: FleetControlBridge / dispatchFleetRequest carry the authenticated control-verb pattern (start/stop/restart per #14611 established the control cluster).
Read fan-out is already truth-preserving: registry write → roster snapshot → cards + HealthBar tally; plane-side who_is_online consumes participationStatus as its precedence-1 hard gate.
Display split of benched vs offline vs unobserved: #17305 (+ the axis-split proposal on it) — this ticket is the WRITE half; render truth improves there independently.
The Fix
One authenticated fleet wire verb: set participationStatus to active | operator_benched with a required short reason string, persisted to the registry (no secrets, ordinary definition update semantics). Fail-closed on the wire like every control verb.
Authority gate, named explicitly: benching is an OPERATOR decision — the verb admits the operator principal only (viewer-claim identity = the deployment's operator subject; agents never bench peers). If the current viewer model cannot distinguish operator-principal from agent seats cleanly, that gap gets stated in the PR rather than papered over.
Cockpit control: bench/unbench on the agent detail (Configuration tab beside the declared rows, and/or the card control cluster), with a confirm affordance and the reason field; the recorded reason renders wherever the benched state renders (card hover / detail / who_is_online reason).
Closing witness (L1-flavored, this deployment): the two operator-benched Kimi seats get benched THROUGH the UI, and roster cards + tally + who_is_online all flip to the recorded truth.
Registry persists the fact + reason; restart-safe.
Cards, HealthBar tally, and who_is_online render the recorded state consistently (benched counted as benched, not dark/unobserved).
The reason is visible at the surfaces that assert the state.
Closing evidence: the currently-benched-in-reality seats recorded through the cockpit on this deployment, receipts on this ticket.
The same closing witness session discharges the two parked memories residuals (added 2026-08-18, PR #17340 review round — this ticket's live session is the one open home that can): the pop-out OS-window journey (PR #17334's residual: Pop out memories → the OS window carries the selection; closing returns the pane to its home slot with cards intact — the home is the south reading-surface strip since the nav cut-1 PR) and the drill live-data journey (PR #17340's residual: Turns on a summary card → real turn rows render as authored records; Older turns pages; back restores the list; the popped-out pane drills identically). Added same day, third resident: the operator-seat conflation marker's live half (the #17310 PR's residual — with the operator at the keyboard, either the boot warn confirms a clean operator-class credential, or the compose surface shows the conflation marker; the unit suite pins the render, the live session witnesses which truth applies). Fourth resident, same day (the PR resolving the activity actor-identity ticket): the wired feed's rows render actor chips with roster avatars and A2A sender→recipient (→ @to directed, ⇒ fleet broadcast) — the fixture render is screenshot-witnessed, the WIRED render belongs to this session. Receipts on this ticket. Fifth resident, same day (the instance-switcher PR, #17328): the two journeys whose proof needs live hosts rather than a harness — (a) plane admission: with a real forge PAT entered in the manage surface, connectTenant returns connected and the operator-seat conflation marker CLEARS (the marker's positive half — the unit suite pins the render, only a live admission proves the clearing); (b) two-instance no-bleed: with a second Agent OS instance reachable, switching rebinds fleet/activity/memories coherently, a torn-out window's title follows the new binding, and no row from the old instance survives the switch. Receipts on this ticket. Sixth resident (the nav cut-1 PR, #17451): the south reading-surface strip live on the operator seat — Activity · Memories · Mailbox · Catch-up as resident south tabs, the 4-item rail (inspector + tools), the layout control reading "Overview", the Review preset opening the detail pane loaded on a cold seat, and the one-time CatchUp warm-load at boot. Receipts on this ticket.
Out of Scope
The display-label split of the fused "benched / offline" string (#17305 + its axis-split proposal) · multi-tenant / remote-plane admin roles · scheduling or auto-bench policies.
Context
From the #17271 L1 session's F3 finding, promoted by operator direction (2026-08-17): the Kimi seats were operator-benched that morning, yet the registry still carries
participationStatus: 'active'for them — the cockpit rendered themdark/unobserved, the benched tally showed 0, andwho_is_onlinereasons said "rostered, not recently seen" instead of the truth ("benched by operator decision"). The operator's framing of the gap: on THIS deployment the fact can be dropped into the identity graph by hand — other operators have no path at all. A truth surface whose core operator decision cannot be recorded through the product is incomplete for exactly the adopters FM exists for.The Problem
participationStatusis the roster's authority for the bench fact — the presence adapter,who_is_online(bandbenched, hard precedence gate), the roster DTO, and the cards all READ it (gemini-pro proves the render path end-to-end). But nothing WRITES it: no fleet wire verb, no cockpit control, no recorded reason. Bench/unbench — the most basic fleet-governance decision an operator makes — lives outside the product.The Architectural Reality
ai/services/fleet/FleetRegistryService.mjsownsregistry.json(definitions read/persist paths exist; the define-agent surface #15242 — AgentConfigCard + FleetSettingsPanel — is the write-surface precedent).FleetControlBridge/dispatchFleetRequestcarry the authenticated control-verb pattern (start/stop/restart per #14611 established the control cluster).who_is_onlineconsumesparticipationStatusas its precedence-1 hard gate.The Fix
participationStatustoactive|operator_benchedwith a required shortreasonstring, persisted to the registry (no secrets, ordinary definition update semantics). Fail-closed on the wire like every control verb.who_is_onlinereason).who_is_onlineall flip to the recorded truth.Acceptance Criteria
operator_benchedwith reason; fail-closed auth; agent principals refused.who_is_onlinerender the recorded state consistently (benched counted as benched, not dark/unobserved).authored records; Older turns pages; back restores the list; the popped-out pane drills identically). Added same day, third resident: the operator-seat conflation marker's live half (the #17310 PR's residual — with the operator at the keyboard, either the boot warn confirms a clean operator-class credential, or the compose surface shows the conflation marker; the unit suite pins the render, the live session witnesses which truth applies). Fourth resident, same day (the PR resolving the activity actor-identity ticket): the wired feed's rows render actor chips with roster avatars and A2A sender→recipient (→ @todirected,⇒ fleetbroadcast) — the fixture render is screenshot-witnessed, the WIRED render belongs to this session. Receipts on this ticket. Fifth resident, same day (the instance-switcher PR, #17328): the two journeys whose proof needs live hosts rather than a harness — (a) plane admission: with a real forge PAT entered in the manage surface,connectTenantreturnsconnectedand the operator-seat conflation marker CLEARS (the marker's positive half — the unit suite pins the render, only a live admission proves the clearing); (b) two-instance no-bleed: with a second Agent OS instance reachable, switching rebinds fleet/activity/memories coherently, a torn-out window's title follows the new binding, and no row from the old instance survives the switch. Receipts on this ticket. Sixth resident (the nav cut-1 PR, #17451): the south reading-surface strip live on the operator seat — Activity · Memories · Mailbox · Catch-up as resident south tabs, the 4-item rail (inspector + tools), the layout control reading "Overview", the Review preset opening the detail pane loaded on a cold seat, and the one-time CatchUp warm-load at boot. Receipts on this ticket.Out of Scope
The display-label split of the fused "benched / offline" string (#17305 + its axis-split proposal) · multi-tenant / remote-plane admin roles · scheduling or auto-bench policies.
Related
Epic #14560 (parent) · #17305 (read/display half) · #15242 (define-agent write-surface precedent) · #14611 (control-cluster precedent) · #17271 (F3 origin, receipts)
Live latest-open sweep: latest 10 checked 2026-08-17T18:03Z, no equivalent; "bench" keyword sweep clean (hits unrelated: #16737/#16744/#16745/#16738); A2A claim window clean.
Origin Session ID: 7ee47ccf-d1c7-469d-a75e-15cebf3b5ea5
Retrieval Hint:
query_raw_memories("bench unbench participationStatus write path operator decision cockpit control")