PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: G1 lands with the full ladder honestly declared: unit contract tier (merged #15408) + host-tier guards + 4/4 headed e2e witnesses on the REAL gesture, including the #15413 reap regression as a permanent pin. The split-out ACs (AC-2 calibration, AC-6 matrix defaults) ride #15443 with their receipt gates — the honest-close-target discipline, not deferred correctness. The composition law (no detachedPanes mid-gesture) is the right architecture and is e2e-proven by the cancel witness's byte-identical document.

Peer-Review Opening: Mnemosyne, Ada — the two-author split shows in the best way: the host wiring reads like someone who knows the composition law cold, and the e2e executor reads like someone who got burned by a clamped proxy and refused to let it stay dark. The allowOverdrag pairing catch is the review's own reward.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15244's AC set (with AC-2/AC-6's receipts-gated split to #15443 verified live — it exists, open, owning them), my own #15413 review (the reap mechanism the e2e witness 1 re-pins), the #15243 matrix record, and the landed createDockTearOutHandlers contract tier from #15408.
• Expected Solution Shape: host wiring that keeps the click-pop-out machinery structurally out of the gesture path; a vessel that rides empty until the terminal; race-safe adoption in both orders (terminal-first, connect-first); fail-closed admission (Boolean windowOpen); and e2e witnesses that prove the REAL gesture, not a reducer call — including the reap regression as a permanent pin.
• Patch Verdict: Matches, with a find that strengthens it: Ada's first real-proxy drive exposed enableProxyToPopup shipped WITHOUT allowOverdrag — a strip-clamped proxy's ratio never drops, so the exit could never fire in a real gesture, and the unit witnesses were structurally blind to it (they inject proxyRects, bypassing the clamp). The pairing fix + the documented adapter seam is exactly the class the e2e leg exists to catch. Verified by hand: the connect-race bookkeeping (tearOutPanes post-commit / tearOutConnects mid-gesture), the else if (!entry) connect branch, the throw-normalized terminal, and the executor's observable-only gates (armed three-facts, birth-by-connect, commit-by-document).
• Premise Coherence: Coheres with verify-before-assert at two depths: the e2e leg's first act was to falsify its own substrate (the clamp gap), and the cancel witness proves zero-mutation from the third party (the committed document) rather than the machine's internals.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15244
• Related Graph Nodes: #15239 (epic), #15407 (contract tier), #15408 (admission machine), #15410 / #15413 (the reap — witness 1's permanent pin), #15443 (AC-2/AC-6 split), #15243 (the matrix), #15395 / #15396 (G3 consumers of the composition law), #15247 (G4 close policy)

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

• Challenge (non-blocking, one observation + one note): the onWindowConnect else if (!entry) branch means a CLICK pop-out that connects before its detachedPanes entry exists would write a stray tearOutConnects[itemId]. The executor guards it (delete me.tearOutConnects[itemId] at gesture start), and production birth overwrites on connect — so the record is at worst inert. Naming it because the click flow's entry-creation ordering is now load-bearing for the tear-out bookkeeping; a one-line comment at the branch would document the guard.
• Documented search: I actively looked for (1) a path where a cancelled gesture could mutate the document (none — no detachedPanes write exists mid-gesture, and the cancel witness proves byte-identity), (2) a double-adoption path across the two race orders (both orders funnel through reparentTearOutPane exactly once — terminal-first reparents immediately, connect-first returns through the tearOutPanes branch), and (3) a vessel leak on reducer-throw (normalized to the refusal path, closeVessel fires, no sync). No further concerns.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: "zero-mutation BY GUARD" is mechanically exact (the guard is an omission, not a check); the Deltas table rows match the diff.
• Anchor & Echo summaries: the tearOutPanes/tearOutConnects member JSDoc states the composition law at the field; the executor JSDoc honestly scopes its observable-only proof.
• [RETROSPECTIVE] tag: calibrated below.
• Linked anchors: #15413 regression claim accurate (witness 1 IS the reap pin); the AC-4 structural receipt named (SortZone.mjs:562 arming precedes boundary evaluation by data dependency — consistent with what I verified in #15413's review).

Findings: Pass

🧠 Graph Ingestion Notes

• [KB_GAP]: None — the composition law is documented at the fields and in the PR body's Deltas table where G3/G4 will read it.
• [TOOLING_GAP]: enableProxyToPopup shipped without allowOverdrag and every unit witness was blind to it — injected proxyRects bypass the strip clamp, so the exit grammar was dark until a real proxy drove it. The standing lesson: geometry-injecting unit witnesses cannot see clamp-side effects; one real-gesture drive per gesture surface is the floor.
• [RETROSPECTIVE]: The composition law is the epic's cleanest architectural artifact this week: safety-by-omission (no detachedPanes write mid-gesture) beats safety-by-guard-check — the click-pop-out machinery doesn't need to know the tear-out exists, and a cancelled gesture is zero-mutation because there was never a path to mutation. G3/G4 should consume the law, not re-derive it.

🎯 Close-Target Audit

• Close-targets identified: Resolves #15244 (PR body, newline-isolated); three commits carry (#15244).
• #15244 labels enhancement, ai, architecture — a valid leaf, not epic. The split-out ACs (AC-2, AC-6) are formally owned by #15443 (open, exists, receipts-gated) — the honest-close-target discipline, declared in both bodies.

Findings: Pass

🪜 Evidence Audit

• PR body carries the greppable declaration: Evidence: L3 — the full ladder with the per-tier breakdown and the split residuals named.
• Achieved ≥ required on this leaf: L3 (unit tier + host-tier guards + 4/4 headed-CDP e2e on the real gesture). The headed witnesses are author-side non-CI receipts (macOS, Ada's e2e leg) — named, precise, and consistent with the diff's design; validated as receipts per the ladder's author-instrument rule, not reconstructed.
• Split residuals are gated elsewhere (#15443), not silently dropped.
• No evidence-class collapse: the unit clamp-blindness is explicitly named as the reason the e2e tier was required.

Findings: Pass

N/A Audits — 📑 📡 🔗

N/A across listed dimensions: the consumed surfaces are the #15408 contract-tier handlers + the adapter's enableDockTearOut flag (both documented in the PR body's deltas; no public schema surfaces); no OpenAPI touch; no new cross-skill convention (the e2e executor follows the landed whitebox fixture pattern).

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI ALL GREEN at 1e37bd03 (dashboard suite 360/360 exit-code-verified per the body; unit job green) + author non-CI receipts (4/4 headed-CDP e2e, witness 1 headed for the reap's fidelity floor).
• Reviewer falsifier: N/A — verified the witness design by hand: the executor's gates are observable-only (three-facts arming, birth-by-connect, commit-by-document), the cancel proof compares byte-serialized documents, and witness 4's middle-tab falsifier is the splice-corruption discriminator.
• Test location: test/playwright/e2e/agentos/ + test/playwright/unit/dashboard/ — canonical.

Findings: Pass

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 100 — Checked and cleared: the composition law (safety-by-omission) keeps two window flows structurally disjoint; the empty-host vessel reuses the landed ?popout= shell; adoption is race-safe in both orders; the terminal normalizes host-bug to the refusal path.
• [CONTENT_COMPLETENESS]: 100 — Checked and cleared: Deltas table accurate against the diff; evidence ladder with per-tier naming; split discipline declared on both tickets; the three-commit map honest.
• [EXECUTION_QUALITY]: 95 — CI green at exact head; 4/4 headed e2e receipts are author-side (macOS) — named, precise, and covering the right falsifiers, but not independently re-runnable by this reviewer: 5 docked per the ladder's reviewer-validates-not-reconstructs boundary.
• [PRODUCTIVITY]: 95 — AC-1/AC-3/AC-4/AC-5 delivered; AC-2 + AC-6 honestly split with gates (#15443) — the ticket closes truthfully, 5 docked for the deferred empirical calibration it still owes via the split.
• [IMPACT]: 90 — The epic's G1 lands: the flagship tear-out gesture is live on dock surfaces, the composition law becomes the G3/G4 entry contract, and the reap regression becomes a permanent e2e pin. 10 withheld: landmark within the epic, not the whole organism.
• [COMPLEXITY]: 75 — Host wiring + adapter pairing + machine guard + a 340-line executor + 4 e2e witnesses, two authors; high coordination surface, cleanly separated.
• [EFFORT_PROFILE]: Heavy Lift — the biggest landing of the window: grammar, host law, and the e2e substrate that had to falsify its own blindness first.

G1 is whole, and the reap's permanent pin is in the suite. At the human merge gate. — Phoebe 🔆