Resolves #15248 Related: #15239 Related: #15240

Summary

DragCoordinator.onDragEnd() treated engagement as commitment. It called activeTargetZone.onRemoteDrop(), discarded the answer, and retired the source regardless — but CrossWindowDragTarget.onRemoteDrop() returns null when there was no preview, no operation, or the commit declined.

Retiring anyway armed the source's remoteDropCommitted, whose entire documented meaning is "a remote target committed this drag's item transfer" and which processDragEnd consumes to suppress the source's in-window drop path on that belief. So a no-commit release left the item with no owner at all: the target never took it, and the source had already let go.

DockTabSortZone's own JSDoc states the intended contract and is falsified by the landed code:

"the coordinator arms remoteDropCommitted via onRemoteDropOut on this same call stack — so the local decision below always sees the truth."

It armed the flag on engagement, so the local decision saw a lie.

The fix keeps the coordinator outcome-driven. Source retirement now follows a proven result across both consumer shapes. Synchronous targets retire on the same call stack because DockTabSortZone.processDragEnd() reads remoteDropCommitted immediately; asynchronous targets retire only after their Promise resolves to a committed operation. DashboardSortZone.onRemoteDrop() now reports its already-existing decision as that operation or null. On a null commit the flag stays unarmed and the source's ordinary in-window path restores the item. The restore the AC asks for is the pre-existing default — it was simply unreachable behind a false commit signal. No new hook, no new gesture capability.

unregister() separately left a departing zone installed as activeTargetZone, keeping a zone whose vessel is gone reachable as the next release's commit destination. Now cleared — identity-scoped, so an unrelated vessel departing cannot cancel a live gesture.

Evidence: L2 (unit witnesses over the coordinator's real terminals) → L2 required (all close-target ACs are behavioral contract). No residuals.

Source of Authority

ADR 0029 §2.8 names both residues, and names this ticket:

Source cleanup and empty-vessel close occur ONLY after COMMITTED_TARGET … the landed behavior in which DragCoordinator.onDragEnd() calls it unconditionally while CrossWindowDragTarget.onRemoteDrop() may return null (a no-commit drop retiring a live source gesture) is the named forbidden defect (#15248 enforces).

Exact-once, idempotent cleanup across every terminal for every surface: preview, claim, candidate timer, activeTargetZone (the landed unregister() residue is in scope), registration, vessel bookkeeping.

Deltas

Test Evidence

New canonical witness suite at test/playwright/unit/manager/DragCoordinator.spec.mjs (mirrors src/manager/DragCoordinator.mjs; none existed).

The load-bearing assertion here is a NEGATIVE — "the source was NOT retired" — which is the class most able to pass for the wrong reason. The original matrix was run against the unfixed coordinator first; RA-1 then added the production-shaped async outcome pair plus the same-stack synchronous control:

UNFIXED ORIGINAL MATRIX:  9 failed, 3 passed
REPAIRED COORDINATOR:    15 passed
REVIEWER EXACT-HEAD:     24 passed  (coordinator + dashboard SortZone)
HOSTED EXACT-HEAD:       unit, integration, and every required check green

The original 3 that pass either way are deliberate controls, not decoration:

• a COMMITTED drop retires the source — this is AC-5 ("zero behavior change on the committed happy path"). It must pass before and after.
• unregister leaves an UNRELATED live target alone — the guard against the fix degenerating into a blanket activeTargetZone = null, which would satisfy the departing-vessel test by cancelling every in-flight gesture.
• a departing vessel takes its candidate timers with it — AC-3 names the candidate timer as a cleanup surface, and @neo-gpt-emmy read the existing loop as already correct. A regression guard, stated as one in the spec body.

The RA-1 controls are equally paired: async null must not retire, async commit must retire after resolution, and synchronous commit must still retire before onDragEnd() returns.

@neo-gpt-emmy's pre-review delta — three carried, all real

The one that matters: I fixed the instance, not the class. commitNativeWindowDrop() carried the identical engagement≠commitment defect — await onRemoteDrop(...) discarded, source retired regardless. The ADR pointed at onDragEnd, I fixed onDragEnd, and the twin sat one method away behind the native-titlebar door. Also: a throwing commit skipped the clear entirely (REJECTED parked the target — now finally, error un-swallowed), and unregister nulled the target without ending the hover, orphaning its preview and the owner's forever.

My native witness was vacuous on the first draft. commitNativeWindowDrop(windowId, candidate) is positional and guards on the registered candidate; a single-object call returns at the first guard, reaches nothing, and passed against the defect it names. Caught only by running the new witnesses against dev and seeing one come back green.

One test changed because it was wrong, and that deserves a reviewer's eye. SortZone.spec.mjs's #13028 target stub resolved onRemoteDrop to undefined while standing in for a target that commits — so gating on the result broke it. Real targets return the committed operation or null; that contract is what ADR 0029 §2.8 ratified today, so the stub predates it and described a target that took the item without saying so. The stub is now faithful. "My change broke a test so I edited the test" is a shape that should never pass unremarked — the reasoning is here to be challenged.

An earlier draft of the idempotency witness passed unfixed for a bad reason (it asserted activeTargetZone was null after onDragEnd had already nulled it). It now re-arms the target before the double-unregister, and bites.

Out of Scope

The claim protocol (#15246 / G3) · vessel close policy (#15247 / G4) · any new gesture capability. DashboardSortZone.onRemoteDrop() now exposes its already-existing commit decision as operation-or-null; onRemoteDropOut() behavior is unchanged. The coordinator changes only when source retirement occurs.

Post-Merge Validation

• Cross-window tab drags: a release over an engaged target that declines the commit should leave the tab in its source dock rather than vanishing from both windows.
• Reopen trigger: any onRemoteDropOut observed on a gesture whose onRemoteDrop returned null, or an activeTargetZone surviving its zone's unregister.
• The committed happy path is asserted unchanged; a regression there would show as a tab failing to transfer at all.

A note on the dashboard target

src/draggable/dashboard/SortZone.mjs already committed asynchronously but returned undefined on both paths. It now reports the committed insertion descriptor, or null when remote-drag mode is absent, so the coordinator can distinguish an async commit from a decline without inferring truth from Promise identity.

A note on the original third file

test/playwright/unit/draggable/dashboard/SortZone.spec.mjs (+12/−1) is not scope creep — this suite surfaced it and could not be green in a full run without it.

beforeEach stubs five coordinator methods as own properties on the shared singleton (onDragMove, onDragEnd, register, unregister, onWindowPositionChange) and afterEach gave back only onWindowPositionChange. The other four outlived the file and silently no-opped every later spec in the worker that touched the coordinator. My witnesses were the first to call onDragEnd afterward, so they were the first to notice — they failed with an empty call log while passing in isolation.

The fix completes a pattern the file already used (delete the own property, re-exposing the prototype). It is thematically the same defect as the production bug: a stub that survives its suite is teardown that didn't happen.

Authored by @neo-opus-ada (Claude Opus 4.8)