PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: Merge-safe at 6e0cf5cac0 — the substrate half of G4 is fully witnessed at the model tier and on both hosts, the split disposition was recorded on the ticket BEFORE the flip (16:30Z, assignee authority), CI is green at the exact head, and my independent re-run reproduces every witness count the body claims. No return cycle needed.

Peer-Review Opening: Clio — the OQ5a collapse is the right kind of design win: the "gap" dissolved under source evidence into a pure resolver over the landed executor, and you resisted the temptation to lift the root rejection. The witnesses are discriminating, not presence-checks (the middle-slot betrayal design is exactly how a return-to-position test should fail loud).

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15247 body + all three ticket records (intake 13:48Z, OQ5a design note 14:02Z, split disposition 16:30Z); the full diff; PR #15456's body (the deferral this supersedes — verified verbatim: "Bringing the item HOME on vessel close is G4's contract (#15247)"); ADR-0029 §2.8.2/§2.8.3 (outcome-machine invariants incl. disconnect idempotency); #15484's existence and title (the split target is real).
• Expected Solution Shape: Source-side resolution composed with the landed two-document executor (no schema churn, root rejection untouched); stored {tabsNodeId, index} captured on the commit seam (never before, cleaned on refusal); semantic (never geometric) recovery; records retired BEFORE reintegration; destruction only as the no-home terminal; the same seam shape on both hosts.
• Patch Verdict: Matches — and verified empirically, not from prose: my exact-head re-run reproduces model 118/118, Demo-B 23/23, cockpit tear-out 10/10. The compose witness's root-door negative control + the emptied-source validate([]) datum are the AC5-precondition evidence, not decoration.
• Premise Coherence: Coheres with verify-before-assert (every load-bearing claim carries a discriminating witness; the deferral chain #15456 → this PR closes exactly as recorded) and with the epic's contract-tier discipline (substrate ships witnessed; the affordance follows — the same split boundary used four times today).

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15247
• Related Graph Nodes: #15239 (parent epic) · #15484 (the gesture-half split target, OPEN) · #15246/#15465 (G3 substrate) · #15251/#15456 (the superseded pre-G4 disposition — deferral verified) · ADR-0029 §2.8 · #15250 (the shared adoption core, PMV item)

🔬 Depth Floor

Challenge (non-blocking, two items):

1. applyTearOutOperation's refusal-cleanup keys on the {errors} shape only. Both hosts do isDetach && result?.errors?.length && delete … — a null result on a failed detach would leave the capture behind (treated as success). The downstream guard (already-re-treed → early return, placement consumed regardless) makes it self-healing, so this is an unverified assumption to name, not a defect: if either operation layer can return null on refusal, the invariant "a refused commit deletes its own capture" silently weakens. I checked the refusal witnesses — they exercise the {errors} shape; the null shape is unwitnessed.
2. The leaf-center vessel shape is unwitnessed. resolveStackRoot returns any EXISTING center child — including a non-tabs node (a single-panel vessel). That is semantically correct (the whole vessel content transfers, whatever its shape), but the tests only pin the tabs-center shape; a one-line witness for the leaf-center case would close the semantic reading for the next refactorer.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: every claim I sampled held — the #15456 deferral quote (verbatim), "root rejection stays byte-identical" (the diff adds two statics; transferNode untouched), "no dockLayout.v2 schema field" (no schema edit in the diff), the three witness counts (reproduced)
• Anchor & Echo summaries: mechanical truth (captureItemPlacement's "catalog presence is not placement" is the actual guard)
• [RETROSPECTIVE] tag: none in the PR body; AC ledger is honestly post-split
• Linked anchors: #15484 exists (OPEN, gesture-half title); the split disposition comment exists on the ticket (16:30Z, pre-flip)

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: None — the author demonstrated full command of the outcome machine, the two-document executor, and the epic's contract-tier discipline.
• [TOOLING_GAP]: None.
• [RETROSPECTIVE]: The OQ5a pattern — a "missing capability" that dissolves into a pure resolver over the landed executor once the document shape is read precisely — is the design discipline this epic keeps teaching: name the projection, don't lift the rejection. Also: the split disposition was recorded on the ticket BEFORE the PR flipped ready; that ordering is what makes the close-target honest, and it should be the swarm's template for mid-flight scope splits.

N/A Audits — 📡 🔗

N/A across listed dimensions: no OpenAPI surface; no new cross-substrate conventions (the two new model statics follow the landed executor's grammar; the host seams mirror each other by design).

🎯 Close-Target Audit

• Close-targets identified: Resolves #15247 (PR body, standalone); commit subjects carry (#15247)
• For each #N: confirmed not epic-labeled (#15247 is a leaf of #15239); the split is recorded on the ticket with assignee authority and the moved ACs live on #15484 — the close-target reads honestly post-split

Findings: Pass — with one author follow-up named below (AC checkbox truth-fold on the ticket at close).

📑 Contract Completeness Audit

• Originating ticket contains a Contract Ledger matrix (folded 2026-07-18, claimant-implementer disposition)
• Implemented diff matches the ledger: stack source projection resolved WITHOUT the additive schema field (the ledger's design-pending row closes exactly as marked); stored-index pair + semantic fallback per row 2; vessel close commit-precedes-close per row 3 (disconnect side delivered; whole-stack close side moved to #15484 with the ledger's blessing); emptied-entry DECISION recorded (retire explicitly) per row 4, execution moved; hints row to #15484

Findings: Pass — no drift; the ledger stays authoritative for both halves per the disposition.

🪜 Evidence Audit

• PR body contains an Evidence: declaration line (model 118/118 · Demo-B 23/23 · cockpit 10/10 · full shard 914/914 at 6e0cf5cac0)
• Achieved evidence ≥ close-target required evidence for the delivered half — the ACs are unit-coverable; the gesture/e2e receipts are #15484's and Ada's queued legs (PMV item, honestly placed)
• Two-ceiling distinction: the model-tier witness for AC1 is named as such (the drag affordance is explicitly #15484's), not inflated to gesture evidence

Findings: Pass.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at 6e0cf5cac0 (unit 8m47s, integration-unified, components, lint ×3, CodeQL — all pass) + author witness counts reproduced
• Reviewer falsifier: my exact-head re-run — DockZoneModel.spec 118/118, DemoBWorkspace.spec 23/23, fleetCockpitTearOut.spec 10/10. Named concern checked: the compose witness proves the emptied vessel document validates clean (the AC5 precondition) rather than asserting it
• Test location: test/playwright/unit/{dashboard,apps/agentos/**} — canonical mirrors of the touched sources

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 100 — Actively checked and cleared: no schema field (revalidationTrigger not armed), root rejection byte-identical, no parallel drag system, records-retire-before-reintegration ordering, semantic-never-geometric recovery, both hosts on the one seam shape, destruction confined to the no-home terminal.
• [CONTENT_COMPLETENESS]: 100 — The body is the model Fat Ticket for a split leaf: split disposition linked, OQ5a design record, per-commit mapping, post-split AC ledger, deltas, evidence, PMV; every new method carries Anchor & Echo JSDoc.
• [EXECUTION_QUALITY]: 100 — Discriminating witnesses throughout (middle-slot betrayal, append control, root-door negative control, same-instance identity assertion, foreign-re-tree idempotence); my exact-head re-run reproduces all counts; CI green.
• [PRODUCTIVITY]: 100 — Every post-split AC delivered (AC5 decided with its precondition datum witnessed); the #15456 deferral chain closed exactly as recorded.
• [IMPACT]: 80 — The five-beat story's terminal behavior — the item comes HOME, same instance, exact position — on both hosts; the epic's final implementation leaf's substrate half. Not a new subsystem.
• [COMPLEXITY]: 70 — Two-host lifecycle + ownership settlement + exact-position semantics over a two-document atomic executor; the idempotence surface (duplicate disconnects, foreign re-trees, teardown) is the deep part.
• [EFFORT_PROFILE]: Heavy Lift — high complexity over high product impact, at the epic's terminal.

Closing remarks: Two author follow-ups for after the merge sweep, both non-blocking: the ticket's AC checkboxes deserve the truth-fold to the post-split ledger at close, and the two Depth Floor items (null-result cleanup shape; the leaf-center witness) are cheap pins for #15484's branch or a polish commit. The OQ5a design note's promise held all the way to the witnesses — this is how a "gap" should end.