Resolves #14769

The integration half of ADR 0029 §2.3 over exclusively landed machinery: a dock workspace can now participate in cross-window drags — as target AND as source — with foreign drops committing through the atomic transferItem executor. Three surfaces, no new pipeline, the coordinator stays dock-blind.

• DockCrossWindowParticipation (new, adapter tier) — owns the target registration lifecycle (create on workspace mount, destroy on unmount) and binds the five owner seams of the landed CrossWindowDragTarget (#14757) to the workspace's landed pipeline (hitTest / previewFor / clearPreview / previewToOperation / commit). It adds exactly ONE new decision: foreign-vs-local drop discrimination at commit, keyed on workspace IDENTITY — a payload whose dockSourceWorkspaceId IS this workspace rides the owner's landed single-document commit seam (the identical in-window pipeline; two windows may project the same document); any other source workspace composes ONE transferItem descriptor (the converted addTab/splitNode nested as its target) and executes the landed atomic two-document executor (#14768): commit-or-neither, record verbatim, live instances move and never re-instantiate (§2.6). Item-id presence in the target catalog is never ownership evidence — an id collision across workspaces reaches the executor's fail-closed collision rejection instead of silently committing the local record (review cycle 1, RA2). The durable placement hints update in the same commit (§2.1/§2.3 mandatory): owningWorkspaceId flips to the receiving workspace and fallbackTarget becomes the semantic node the item entered ({workspaceId, nodeId} — never geometry). Every unprovable input — unstamped payload, unresolvable source workspace, executor rejection — fails closed: nothing commits, both documents stay untouched.
• DockTabSortZone (source side) — implements the §2.3 mandatory source hooks per the OQ2 constraint (dock surfaces implement the CONTRACT; they do not inherit the dashboard sort zone): suspendWindowDrag/resumeWindowDrag hide/unhide the in-window drag proxy (the dock's embodiment — no popup path, enableProxyToPopup stays false; OS-window spawning remains the #13028 boundary), and onRemoteDropOut arms a one-shot suppression consumed by processDragEnd so a remotely-committed transfer can never double-commit through the in-window cross-zone event. Drag-start now stamps the cross-window payload identity onto the dragged tab button (dockItemId + dockSourceWorkspaceId) — what the receiving window needs to discriminate and compose transferItem, with zero dock knowledge entering the coordinator. The source feeds the coordinator EXPLICITLY (review cycle 1, RA1 — the base tab-header chain carries no DragCoordinator delegation; that lives only in the dashboard sort zone, which the dock must not inherit per OQ2): onDragMove reports every move in screen space (screenX/screenY/offsetX/offsetY/proxyRect all ride the wire payload since the base chain sets alwaysFireDragMove) and processDragEnd closes the gesture through DragCoordinator.onDragEnd() BEFORE deciding the local drop — the coordinator arms the one-shot suppression via onRemoteDropOut on that same call stack. Both feeds are gated on the new sortGroup config (the §2.3 registry identity, threaded by the adapter): a dock without one produces zero coordinator traffic.
• DockLayoutAdapter (additive, opt-in) — threads two new projection options (crossWindowSortGroup, workspaceId) into every projected tab sort zone's config. Absent = fully in-window, byte-identical behavior (the coordinator no-ops on a null sortGroup).

Evidence: L1 (the executor is REAL in every foreign-drop spec — no transfer semantics mocked; the target/coordinator seams are injected exactly as the landed #14757 spec idiom established) → L2 for the live two-window gesture rides the G3 demo leaf per the ticket's own Out-of-Scope. Residual: none on this leaf's ACs.

Deltas from ticket

• AC-4 (source hooks + coordinator dock-blindness) is delivered review-checkable as the ticket itself specifies — the hooks are implemented and documented against the §2.3 mandatory table; the coordinator diff is zero lines (grep-provable).
• The ticket's five-seam list maps onto the landed target's four seams + clearPreview (the target's own optional fifth) — no seam was invented beyond #14757's shipped contract.

Test Evidence

• npm run test-unit -- test/playwright/unit/dashboard/DockCrossWindowParticipation.spec.mjs --workers=1 → 8 passed: the original five (registration lifecycle · seam binding · foreign drop through the REAL executor with normalizeTree slot collapse · durable hints ride the same commit for addTab AND splitNode · fail-closed matrix) plus the two review-cycle-1 falsifiers and an inertness guard:
  • id collision across workspaces (RA2's probe shape): source A and target B both catalog terminal → the foreign payload NEVER rides the local seam, the executor's collision precondition rejects, nothing commits; the identical gesture with the collision removed transfers cleanly (proving discrimination never blocked it); an UNSTAMPED payload whose id exists locally also fails closed.
  • source→target through the REAL coordinator (RA1): a real DockTabSortZone (real move/end lifecycle, seeded mid-gesture drag state, two windows registered on the real Neo.manager.Window map) engages the registered remote target — previewFor receives the hover at the correct window-local coordinates (screen 1400 → local 400), the source proxy suspends via the coordinator round-trip, the drop commits the REAL A→B transfer, the local dockCrossZoneDrop is suppressed — and the NEXT gesture with no remote target fires the local drop again: suppression is exactly-once.
  • no sortGroup = coordinator-inert: the same real source lifecycle without the opt-in produces zero remote engagement and no suspension.
• npm run test-unit -- test/playwright/unit/dashboard/ --workers=1 → 257 passed (full dashboard blast radius).
• npm run test-unit -- test/playwright/unit/apps/ --workers=1 at the cycle-1 head → 235 passed, 1 failed — the failure is the KNOWN pre-existing dev flake (fleetGrid.spec full-directory ordering race: AgentOS.view.fleet.HealthBar does not exist; the file passes 10/10 standalone at this head, receipt below; the same flake is documented as reproducing at base with the diff stashed in the fleet morning-start PR). Zero apps/ files in this diff.
• node --check clean; pre-commit gates green (whitespace, shorthand, jsdoc-types, ticket-archaeology, block-alignment).

Post-Merge Validation

• The G3 demo leaf wires a two-window composition (workspace set + getForeignDocument/commitTransfer seams) and proves the live cockpit→dock→OS-window continuity gesture (#14772 path)
• native drag QA: suspend/resume proxy behavior under a real remote hover (the popup-embodiment class stays #13028's boundary)

Commits

• 800dc0bd6 — the participation class + source hooks + adapter threading + 5-test spec.
• b328f4550 — review cycle 1: explicit DragCoordinator move/end feeds from the dock source (gated on the new sortGroup config) + workspace-identity drop discrimination + the three falsifiers; the source class summary now states the true wiring (the base chain carries no coordinator delegation).

Related: parent #13158 · authority: ADR 0029 §2.1/§2.3/§2.6 · consumed: #14757 (CrossWindowDragTarget), #14768 (transferItem), the #13025/#13028 coordinator lineage · unlocks: #14772 (fusion continuity) + the G3 demo leaf · v13.2 cornerstone-2.

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session 9cf9cce9-23bf-4211-ab0d-bab51d5e1d14.