P6 slice 1 — authoritative incident posture

Replaces the generic critical/high event-burst incident auto-trigger with a pure, tested composition over facts the existing controllers already own, and renders one calm/incident posture model in the Glass shell.

What changed

• New pure module src/glass/incidentPosture.ts — composeIncidentPosture accepts only already-authoritative loaded/unknown facts and returns calm, unknown, or exactly one prioritized incident with plain copy, an authoritative detail line, a stable dedupe causeKey, and one stable-room target. Priority: receipt integrity → runtime-host fault/recovery → delegation recovery → gateway connection failure → open core breakers → faulted plugins → failed/partial work whose projection explicitly needs the owner. No events, no severity copy, no clocks, no invented backend health.
• Pure incident-mode policy in the same module — decideAutomaticIncidentMode + applyOperatorIncidentToggle: the operator toggle stays an explicit presentation override ("off" silences exactly the current causeKey; a new cause re-raises; "on" holds through calm), unknown holds the mode, calm clears it without a click, and one cause never announces twice.
• App.tsx — the 1-second tick interval, ws-degraded timers, high-burst counting, cooldown timestamps, and the critical-event hook in handleGatewayEvent are gone. A useMemo composes posture from useMissionControlController (gateway/jobs status, open core/plugin breakers), the connection controller's health/ws states, and the Office controller's summary/stop-all/integrity facts. One idempotent effect applies the pure decision. incident_auto_trigger keeps its exact meaning: it gates automatic mode switching only.
• useExecassOfficeController — latches execass.v1.receipt.integrity_failed from the one durable stream as integrityFailure (summary + sequence) beside the existing critical notice; the latch is identity-bound and clears when the gateway URL or token-configured boundary changes. No new controller, websocket, event store, or polling loop.
• AppShell — a quiet posture word (Calm / Checking / Incident, never color alone) beside the operator toggle, and one plain-language incident band under the topbar: beacon + "Incident" label, message, authoritative detail, and one "Go to " action resolved against the live elevator registry (an unavailable room renders an honest note, not a dead button). Band is role="status" aria-live="polite", wraps at 390px, and inherits the global reduced-motion kill.
• Dead code removed — the burst helpers in lib/liveFeed.ts and the five burst/cooldown knobs in opsUxConfig safety (their only consumer was the deleted trigger). fail_safe_on_config_error, recovery, and undo knobs are untouched.
• Mock gateway — one new e2e seam POST /api/v1/e2e/execass-event that injects a durable ExecAss event through the same broadcast path production events use.

Explicit non-incidents (each unit-proven)

waiting_external, owner global stop/freeze, intentionally paused runtime (unless the host is actually faulted), scheduler idle or merely-due work, failed/partial delegations with no intervention fact, ordinary confirmation/clarification attention on healthy work, transient connecting/reconnecting states, and unloaded sources (posture unknown, never "healthy").

Validation

• npm run typecheck PASS · npm run lint PASS
• npm run test:unit -- --run PASS: 803/803 tests (82 files) — includes 38 new composer/policy truth-table tests, 2 new office-controller integrity-latch tests, 5 new AppShell band tests
• npm run build PASS
• Full core Playwright suite PASS: 46/46 scenarios including the new @core @p6-incident scenario (Checking→Calm truth, breaker trigger with auto mode + toast, keyboard-activated walk to the exact breaker in the Breakers room, same-cause operator override, authoritative auto-recovery without a click, higher-priority receipt-integrity cause arriving live through the one ExecAss stream from another floor with walk to the Office desk, 390px band/status geometry with non-overlap and no horizontal overflow, reduced-motion fresh sitting, zero console/page/request-failure/HTTP-error tolerance)
• live-feed.spec.ts burst test rewritten to the new truth: event volume and critical severity copy never flip incident mode; a real open-breaker fact still does
• ExecAss generated contract check (generate_execass_contract --check) PASS · independent validator PASS · git diff --check PASS
• Six evidence screenshots captured to runtime/qa/p6-incident-posture/ and visually inspected (calm, breaker incident, recovered, integrity incident, 390px integrity, reduced-motion) at desktop and 390px

🤖 Generated with Claude Code