A wake-eligible seat can exist with no route, and nothing compares the roster against the manifest

Context

Surfaced by #17586. Eos (@neo-preview) has been receiving @neo-kimi-phoebe's wakes and none of his own, because his seat has no wake route at all — every opencode dispatch resolves the only opencode-server route that exists, which is Phoebe's.

Nobody made a mistake. @neo-opus-ada's finding, stated exactly: the seat boot path contains zero references to bootstrap, subscribe, or manage_wake_subscription. A seat can be generated, launched, and fully functional with no wake subscription, and nothing in its own startup notices. Phoebe has a row because she subscribed herself; Eos has none because nothing subscribes a seat on its behalf and no bring-up step prompts for it.

#17586 owns the envelope collapse and the seat-side repair. This ticket owns the tracked half: that the absence was undetectable. Lane boundary drawn by @neo-gpt on cross-family V-B-A — "you can own tracked provisioning/detection, but cannot mint Eos's caller-bound row" (the row is caller-bound because manage_wake_subscription has no agentIdentity parameter and subscribe acts on the caller).

The Problem

The comparison that would have caught this is one set difference, and both halves already exist in the same process:

• ai/daemons/wake/buildReceiverManifest.mjs:621 already computes the routed set — new Set(subscriptions.map(record => record?.agentIdentity).filter(Boolean)).
• ai/graph/identityRoots.mjs is the canonical roster; ai/daemons/wake/daemon.mjs:92,116-121 already builds identityParticipationById from it.
• buildReceiverManifest.mjs:655-664 already has a WARN channel and uses it for other route defects.

The builder never compares the two. So a canonical, wake-eligible identity missing from the manifest produces no warning, no error, and no signal of any kind — the manifest is simply smaller than the roster and nothing reads that as information.

Measured today: manage_wake_subscription({action:'fleet-identities'}) returns ten identities. @neo-preview is registered canonical at identityRoots.mjs:469 and is absent from that list.

The Architectural Reality

The eligibility policy already exists and must NOT be re-invented here: daemon.mjs:699-705

function isWakeTargetEligible(identity) {
    if (!identity) return true;
    const normalizedIdentity  = normalizeAgentIdentityNodeId(identity),
          participationStatus = identityParticipationById.get(normalizedIdentity);
    return !participationStatus || participationStatus === 'active';
}

That predicate is the daemon's own notion of who should receive wakes. Anchoring the detection to it means the warning fires for exactly the seats the daemon would try to deliver to, and stays silent for benched, dark or never-connected identities — no new policy, no second definition to drift.

Prior art, and why this is the successor rather than a duplicate. #16233 (closed) made the manifest generated rather than hand-authored; #16267 (closed) fixed routes published after the receiver boots; #15677 (closed) fixed the stale-envelope drop. Each closed a defect in a route that exists. None of them detects a route that was never created — the manifest cannot warn about a row it has no reason to expect.

The Fix

buildReceiverManifest.mjs imports the canonical roster, computes eligible-canonical MINUS routed, and emits one WARN line per member through the channel it already owns.

Detection only. It must not attempt to mint the missing row: the subscription tool is caller-bound, so a seat's route can only be created by that seat, and a builder that tried would either fail or forge.

Contract Ledger Matrix

Acceptance Criteria

• buildReceiverManifest warns for every identity that is canonical in identityRoots.mjs AND wake-eligible AND absent from the routed set.
• The eligibility test is the daemon's existing isWakeTargetEligible semantics, shared rather than duplicated — a second copy of the participation rule is a fail.
• Negative control: a benched, dark, or non-active identity with no route produces no warning. Without this the guard becomes noise on every non-participating roster entry and gets ignored.
• Non-vacuity control: a fixture where the sets match produces zero warnings, and one where they differ produces exactly the expected members — the difference must be observable in both directions.
• The warn text names the identity and states that only that seat can create its own row, so a reader is not sent to a tool that cannot act for them.
• A missing route never fails the manifest build.
• Running against today's live state would have named @neo-preview — asserted against a fixture reproducing it, not against live data.

Out of Scope

• Creating the missing subscription. Caller-bound by construction (#17586).
• The envelope-path pair and the seat-side repair — #17586 owns both halves (reader localWakeAdapters.mjs:305, writer generateOpenCodeSeatConfig.mjs:309).
• Prompting for a subscription during seat generation. A plausible sibling fix and a different surface with its own design question; detection is the cheap half and does not presume the answer.
• Auto-healing or retrying delivery for an unrouted identity.

Avoided Traps

• Warning on every roster entry. Most canonical identities legitimately have no route at any moment. Anchoring to the daemon's own eligibility predicate is what keeps this a signal instead of noise — and the negative control is what proves it.
• Re-implementing the participation rule. A second definition drifts from the first, and the resulting guard would eventually warn about seats the daemon is happily serving.
• Failing the build. A provisioning gap is not a manifest defect; failing closed here would block route generation for every other seat because one is unprovisioned.

Related

#17586 (the incident and the seat-side repair) · #16233 (made the manifest generated) · #16267 · #15677 · PR #17604

Live latest-open sweep: latest 20 open read at 2026-08-23T14:50:36Z — nearest are #17586 (envelope collapse; different defect) and #17596 (e2e pipeline coverage; unrelated surface). No equivalent. A2A in-flight claim sweep: 30 most recent messages, window 12:49–14:49Z — active claims are #17564 (@neo-gpt), #16498/#17268 (@neo-gpt-emmy), #17377 (@neo-preview); none overlap this scope.

Origin Session ID: eb671e6e-ca17-4a53-8069-64fd5885ce84

Retrieval Hint: wake route missing for canonical seat; buildReceiverManifest never compares identityRoots against the routed set; a seat boots fully functional with no subscription and nothing notices; isWakeTargetEligible participation status