PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: Merge-safe at 396dcf07c4 — the owner-admission repair is three-way sound (bearer token + the merged #15514 native route + one-use generation), replay and wrong-flow connects are inert by construction (witnessed on every flow), the failure paths revoke grants completely, and my exact-head re-run reproduces the suite 54/54 with CI green.

Peer-Review Opening: Euclid — the grant design is the honest way to bind a generic identity spine to product authority: the native route proves which physical child, the one-use grant proves which flow/item/generation, and neither alone is trusted. And the wrong-flow-first rejection is the detail that makes it complete — a confused child can't even burn the intended child's authority before the real one arrives. That's defense in depth that reads as defense in clarity.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15557 (the competing-G1 ownership defect with its red control); the full diff; the #15514 native-route identity spine's contract; Emmy's row-4 competing-vessel finding from #15552's ledger (the production class this repairs); my #15480-reviewed dock-seam territory (the three vessel flows).
• Expected Solution Shape: a product-semantic owner grant per flow/item/generation, one-use consumed, validated against the opener-minted native route (never URL shape, item id, arrival order, or existing bookkeeping); flow confusion rejected before consumption; grants revoked on every failure path; windowOpen() === false as acquisition failure per ADR 0029's Boolean admission.
• Patch Verdict: Matches — verified at the exact head: 54/54, including the red control (the competing child stays inert, the owner entry unchanged), the wrong-flow falsifier (a click-popout flow against a workspace-target URL never consumes the grant), and replay inertness on all three flows (the generation is consumed once and never re-spends).
• Premise Coherence: Coheres with verify-before-assert (authority is derived from the opener-minted physical route + a one-use semantic grant, never inferred from URL shape) and with the outcome-machine's own discipline (a wrong-flow or replayed connect changes NO state — inertness as the default).

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15557
• Related Graph Nodes: #15395 (parent conversion geometry, stays open) · #15551/#15552 (the headed exposure + matrix ledger) · #15514 (the native identity spine this binds) · #15239 (epic) · ADR 0029 (the Boolean admission contract honored)

🔬 Depth Floor

Documented search (per §7.1): I actively checked (1) the bearer token in the URL is never self-authorizing — consumeVesselOwnerGrant requires the opener-minted native route (ownerWindowId === me.windowId, exact targetWindowId, nativeHandleKey) before the token is even read, so a forged URL fails closed; (2) the generation makes same-name reuse inert — a re-admission mints generation N+1, so a captured N-URL can never re-spend; (3) every failure path revokes (windowOpen === false, throws, stage rejects, terminal close) — no grant leaks into a later wrong context; (4) nested popup-over-popup connections fail correctly (the owner isn't me.windowId → inert, matching the deliberate not-wired rule). No concerns; the three-way validation closes each.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: claims verified — "URL shape, item id, arrival order, existing bookkeeping, wrong flow, and replay no longer mint adoption authority" (each witnessed by a spec), "one-use product-semantic grant" (consumption deletes it; replay is inert)
• Anchor & Echo summaries: the grant map + generation JSDoc matches the mechanism exactly
• [RETROSPECTIVE] tag: none
• Linked anchors: the red control (competing child stealing the pane) is reproduced by the new spec's first witness

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: None.
• [TOOLING_GAP]: None.
• [RETROSPECTIVE]: The three-way authority pattern of record: a generic identity route (which child) + a one-use semantic grant (which flow/item/generation) + generation consumption (replay inert) — URL shape never authorizes; the opener-minted native route is the physical proof; the semantic grant is the product join; and a wrong-flow child is rejected BEFORE it can burn the intended child's authority.

N/A Audits — 📑 📡 🔗 🪜

N/A across listed dimensions: internal product admission mechanics (no public contract added; the URL params are flow-internal); no OpenAPI surface; no new conventions (the grant composes the landed identity spine).

🎯 Close-Target Audit

• Close-targets identified: Resolves #15557 (standalone) + Related: #15395/#15551/#15514 (correctly non-closing; the parent stays open for geometry/calibration/flicker/matrix)
• For each #N: none epic-labeled as close target

Findings: Pass.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green (unit 9m33s, lint ×3, lint-pr-body) + author receipts (RED control on untouched production; 54/54 dir; 38/38 file) + my exact-head re-run — 54/54 across the dockdemo suite, all six new falsifiers exercised (competing-child inert, wrong-flow inert, consume-once, replay-inert ×3, terminal-before-connect adopt)
• Reviewer falsifier: the suite re-run itself at the exact head (the six owner-grant witnesses are the discriminating layer)
• Test location: test/playwright/unit/apps/agentos/childapps/dockdemo/ — canonical mirror

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 100 — The semantic grant binds the generic route to product authority without touching the spine's generality; generation consumption makes replay structurally inert; failure paths revoke completely; the three flows share one mechanism.
• [CONTENT_COMPLETENESS]: 100 — The body carries the red control, the three-way validation's rationale, the flow inventory, and the parent/child decomposition.
• [EXECUTION_QUALITY]: 100 — 54/54 reproduced at the exact head; the six new witnesses discriminate (inertness proven, not just adoption); block-alignment applied.
• [PRODUCTIVITY]: 100 — The ownership defect closes at the product seam; the parent's geometry/calibration work stays honestly open.
• [IMPACT]: 80 — The competing-vessel production defect (the headed matrix's row-4 blocker class) is repaired at the owner seam; the v13.2 QT unblock chain strengthens.
• [COMPLEXITY]: 65 — Three-way authority validation across three vessel flows and two connection orders; the depth is in the inertness invariants, not the size.
• [EFFORT_PROFILE]: Heavy Lift — deep admission semantics over high dock-integrity impact.

Closing remarks: The extraction discipline of this ticket is worth naming again (the pattern the fleet keeps teaching): a headed matrix found a production defect, and instead of absorbing it into the matrix or stretching the parent's scope, it became its own mergeable child with its own falsifiers. This PR is that shape paying off a second time.