Summary

T2.10 of the harness pillar (Epic #13349): the accept path — carries an accepted blueprint into a live component through the childapp's ONE create path, and keeps the created-instance registry truthful over the create → mutate → dispose lifecycle. This is the leaf that joins the two now-merged spines (#14655 route + validator, #14656 registry) into a working create flow.

Resolves #14689 Refs #13349

Both dependencies are on dev: #14678 (#14655 route + validateBlueprint/validateMutation) and #14682 (#14656 CreatedInstances). This PR is a clean single-commit diff against them.

Deltas

• NEW apps/agentos/view/create/util/acceptPath.mjs — join, never fork:
  • acceptBlueprint({blueprint, instanceId, stage}) — runs the same imported validateBlueprint the emit side runs (the fail-closed-both-sides contract as two call sites of ONE validator), materializes a wire-safe config (ntype, never a module ref — Neural-Link parity), and routes it through the injected stage's add() — the childapp's ONE-create-path invariant (ViewportController's add → insert seam a create_component also drives), joined not forked.
  • SCHEMA_MATERIALIZERS — the render half of the schema registry, keyed by the SAME schema ids the validator uses (grid@1: materialize → stage-insertable config with a provenance blueprintMeta stamp; apply → writes a merged blueprint onto the live component). A coverage-contract test asserts every validator schema has a materializer.
  • createInsertRegistrar({registry}) — writes registerCreated on the stage insert event via the provenance stamp; external create_component inserts (no stamp) are ignored, so the registry records only what the accept path materialized.
  • mutateInstance(...) — pulls the current snapshot FROM the registry, runs merge-then-validate, applies the merged blueprint via the schema applier, records markMutated. No surface hand-merges.
  • disposeInstance(...) — destroys the live component when resolvable, always flips the registry (a half-dead instance still leaves truthful state).
  • Every failure returns the pipeline's bounded {accepted, reason, stage} — nothing throws into a render path.
• NEW test/playwright/unit/apps/agentos/create/acceptPath.spec.mjs — 5 tests against the real CreatedInstances singleton + real validator (the first true integration proof of the whole T1 stack: route → validator → stage seam → registry): materializer coverage · accept→stage→insert→registry round-trip · accept refusals (bad blueprint via the shared validator, dead stage, missing id, unstamped external inserts) · mutation pulls-snapshot/applies-merged/records + refuses what creation can't reach + registry-stage-disagreement fail-closed · dispose destroys + flips + refuses double-dispose.

Deliberately NOT in this PR: pane chrome / chat surface (SSOT-gated views, #14692) · live NL wiring (the injected generate leaf) · T4 persistence · retiring the childapp's v1 parseEditRequest/validateRequest (a follow-up once this path is proven).

Test Evidence

UNIT_TEST_MODE=true npx playwright test -c test/playwright/playwright.config.unit.mjs acceptPath → 5 passed (14.8s) against the merged-to-dev deps.

Evidence: L2 (unit-pinned, exercised against the real registry + real validator — this is the integration proof, not an isolated leaf).

Post-Merge Validation

• The first VIEW leaf (chat-creation state-machine binding, SSOT #14692) consumes acceptBlueprint + createInsertRegistrar + mutateInstance — no parallel create path anywhere in the module is the check.
• Registering a second widget schema touches ONLY BLUEPRINT_SCHEMAS (validator) + SCHEMA_MATERIALIZERS (render) — if it needs any other change, the plugin seam failed.

Related

Epic #13349 (T2.10) · #14655 / #14678 (route + validator, merged) · #14656 / #14682 (registry, merged) · #14644 (safety contract, two-sided) · #14642 (module convention) · #14692 (the SSOT the view leaf implements) · apps/agentos/childapps/widget/view/ViewportController.mjs (the ONE-create-path invariant this generalizes).

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session b9b95ac6-42f5-47a3-b58f-6071f79657e8.

Author response — both RAs closed at 306307ab4 (cycle 1)

Both were real bugs my test doubles were too well-shaped to catch — thank you, these are the truthfulness edges the whole accept path exists to guarantee.

RA-1 (wrong-shaped component throws instead of failing closed). mutateInstance now wraps the schema applier in a guard: a component that can't take the mutation (e.g. grid@1 with no .store) is the SAME registry/stage-disagreement class as a missing one — it returns a bounded {accepted:false, reason, stage: MUTATION} and does NOT call markMutated, so a thrown applier can never leave the registry claiming a change the component never took. Regression: resolveComponent: () => ({}) → bounded refusal + asserts the registry still holds the last GOOD mutation (height 500), never the failed width.

RA-2 (create/registry truth gap on duplicate id). acceptBlueprint now takes the registry and pre-checks the id before touching the stage: if resolveTarget({instanceId}) finds an existing record, it refuses at accept-stage BEFORE stage.add — so the only insert that ever happens is one the registrar can register. The post-insert-registration-refusal gap cannot open. Regression uses the real CreatedInstances duplicate path: second accept with the same id → accept-stage refusal, stage.added stays length 1 (no orphaned insert), registry unperturbed. (This also correctly refuses reusing a disposed id — the registry keeps disposed records, one record per instance ever, and the pre-check matches that.)

UNIT_TEST_MODE=true npx playwright test -c test/playwright/playwright.config.unit.mjs acceptPath → 6 passed at 306307ab4. Both falsifiers are now regressions. Narrow re-review when CI confirms.

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session b9b95ac6-42f5-47a3-b58f-6071f79657e8.

@neo-fable commented on 2026-07-04T08:05:58Z

Author addendum — core-idiom alignment at d31876ecb (operator-challenged, self-corrected)

@tobiu challenged whether this leaf follows neo core best practices and pointed at src/core/Base.mjs + src/Neo.mjs. Reading both end-to-end surfaced two genuine idiom violations in my cycle-1 shape — worth stating openly because it reframes part of the earlier review:

1. The applier now uses the batched mutation path. apply() was a chain of direct property writes (component.title = …; component.height = …), each firing its own reactive cascade. It is now ONE component.set({title, height?, width?}) — the EffectManager pauses, every beforeSet/afterSet hook sees the complete value set, bindings cascade once (Base.mjs set() exists precisely for this) — plus a single store-level data assignment.

2. Component resolution now defaults to the core instance manager. The materializer stamps id: instanceId (alongside reference — the shipped first-widget parity), and mutateInstance/disposeInstance default resolveComponent to Neo.get — where instance shape is a core-contract guarantee (afterSetId auto-registration + the enhanced Symbol.hasInstance). Injection remains a TEST seam only. Honest note on RA-1: the "wrong-shaped component" class we hardened against in cycle-1 largely cannot occur on this default path — it was an artifact of my bespoke injection seam. The try/catch guard stays (belt-and-suspenders for hook throws and injected doubles), but its rationale is now stated correctly.

Root cause, named: these are apps/ (Body-hemisphere) files and I wrote their instance-touching half in ai/ (Brain) style — plain modules + injected seams — because my prior-art reads were graph-service siblings, not src/ core. The pure data-plane half (validator/route/transition tables) is childapp-precedented and stands. A friction→gold substrate item follows: neo-core reads become a mandatory gate for Body-side work (also relieves the reviewer of being the only line of defense on core idioms).

6/6 green at d31876ecb (the happy-path double is now neo core-shaped — a bare property bag correctly refuses through the guard).

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session b9b95ac6-42f5-47a3-b58f-6071f79657e8.

(edited: vocabulary corrected per the binding naming rule — neo is not a framework; wording is now "neo core / the class system". No substantive change.)