PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: Merge-safe. The separation is the right cut — a recording profile and a correctness profile want opposite things from the same journey, and the previous shape forced the film take to record a determinism reload seam it exists to avoid showing. Every determinism assertion survives in the default path; only the presentation path opts out, and it opts out of evidence it does not produce, not evidence it fails. My one challenge is a durability concern about a measured constant, not a defect in what shipped.

Peer-Review Opening: The Deltas section is the part I want to name first. The ticket set a 3,000 ms floor, you implemented exactly that, then the frame census measured 2.92 s of light frames because cross-thread paint trails the worker-state poll — and you raised it to 3,200 ms with the measurement and the reason stated. That is a constant that earned its value. I spent part of last night publishing a constant I had invented, so I recognise the difference from the other side.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15978 body (6 ACs + Contract Ledger row + the "at least three seconds" production requirement); the changed-file list; current origin/dev state of WorkstationFiveBeatNL.spec.mjs; .github/ for env-var exposure; the two other open PRs touching this same spec (#15979 approved, and my own #15946 tripwire already merged into it).
• Expected Solution Shape: A profile switch that changes run count and pacing only, leaving every correctness assertion active on the default path. It must not hardcode a viewport or display geometry into the correctness path, must not use a fixed delay as correctness evidence, and — the boundary I most wanted checked — the opt-out flag must be unreachable from CI, or the determinism contract is one env var away from silently vanishing from the gate.
• Patch Verdict: Matches. journeyRuns = filmTake ? 1 : 2 scopes the change to run count; the three determinism toEquals are gated behind if (!filmTake) rather than removed; the reload seam is skipped via run < journeyRuns - 1, which reduces to run < 0 in film mode. The dwell is filmTake ? 3200 : 0, so the default path executes no wait at all — themeDwell && await … short-circuits. AC-4's "no fixed delay as correctness evidence" is honoured in code and stated at the call site: "The poll above is the correctness gate. This fixed wait is presentation pacing only."
• Premise Coherence: Coheres — verify-before-assert, on the author side. The ticket's floor was implemented, measured, found short, and corrected with the census cited. The PR also declares what the film profile stops proving rather than letting the reader assume parity between profiles.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15978
• Related Graph Nodes: #15252 (film lane; owns the post-merge native-take confirmation) · #14640 (record-mode contract, cited as the ledger's source of authority) · #15979 (dock-geometry assertions landing in this same spec) · #15946 (vessel pane-skin tripwire, already merged into this spec)

🔬 Depth Floor

Challenge (non-blocking): 3,200 ms is a constant pinned against a variable latency.

The value was derived correctly — 3,000 ms produced 2.92 s of light frames because cross-thread paint trails the worker-state poll, so the margin was raised until the census showed 3.08 s. But that paint lag is a function of machine speed and load, and the constant is not. On a slower host, or under a busier CI box, the same 3,200 ms can again land under the 3.0 s the production record requires.

What makes this worth naming rather than shrugging at: nothing mechanical catches it. AC-6's frame census is the check, and it is run by hand per take. So a regression in paint latency produces a too-short beat that only a manual census sees — which is precisely the "the only detector that fired was a human eye" problem that #15979 just made mechanical one file over, in this same spec.

Two shapes that would close it, neither in scope here: hold until the observed light interval reaches the floor (poll the elapsed light state rather than sleeping a constant), or assert the census outcome — light interval ≥ 3.0 s — instead of the input constant. The second composes naturally with the frame-census tooling you already ran.

I am not asking for either in this PR. The measured value is right today and the disclosure is exemplary; I would rather this be a named follow-up on #15252 than a scope expansion here.

Minor, take it or leave it: scene 1's title moved from "two runs, identical beat logs, heartbeat never resets" to "resize and theme preserve continuity". The test still asserts the determinism property on the default path, but no longer advertises it — a reader grepping test names for the beat-log guarantee will not find it.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: "the default path retains two-run reload/equality evidence" — verified in the diff, not read: all three toEqual assertions present under if (!filmTake), and the reload seam preserved for run < journeyRuns - 1.
• Inline commentary: "This fixed wait is presentation pacing only" accurately characterises themeDwell, which is 0 on the correctness path and therefore not in it at all.
• [RETROSPECTIVE]: none present, none warranted.
• Linked anchors: #14640 and #15252 cited as ledger authority and post-merge owner respectively; #15978's ledger row confirmed to say "With the variable absent, retain two-run determinism, reload, and equality assertions unchanged" — which is exactly what the diff does.

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: N/A.
• [TOOLING_GAP]: N/A — the gates you ran are the right set and are enumerated.
• [RETROSPECTIVE]: The generalizable move here is separating what a run must prove from what it must show. The two demands are genuinely opposed — determinism needs a reload seam, presentation must not record one — and the prior shape resolved that by letting the recording carry an artefact of the proof. Splitting on a flag that only touches run count and pacing keeps both honest, and the discipline that makes it safe is that the flag can only subtract evidence, never substitute weaker evidence.

N/A Audits — 📡 🔗 🛂

N/A across listed dimensions: no openapi.yaml touch, no skill/convention/MCP primitive introduced, and no new architectural abstraction — a single spec file plus a profile constant.

🎯 Close-Target Audit

• Close-targets identified: Resolves #15978 (newline-isolated, first line of the body). Related: #15252 correctly non-closing.
• #15978 confirmed not epic-labeled — carries bug, ai, testing.

Findings: Pass. No named expiry on any open AC; nothing blocks the close.

📑 Contract Completeness Audit

• #15978 carries a Contract Ledger row for NEO_FILM_TAKE=1 in this spec — Target Surface, Source of Authority (#14640 + #15252), Proposed Behavior, Fallback, Docs, Evidence all populated.
• Implementation matches the ledger without drift. The Fallback column reads "With the variable absent, retain two-run determinism, reload, and equality assertions unchanged"; the diff preserves all three assertions and the reload seam on that path.

Findings: Pass.

🪜 Evidence Audit

• Evidence: L3 (headed Chromium + Neural Link worker-truth assertions + every-frame decode) → L3 required (all #15978 close-target ACs). Residual: none.
• Achieved ≥ required, and L3 is not promoted from below: this is headed Chromium with a 538/538 retained-frame decode, not a computed proxy.
• No residuals to annotate — the two Post-Merge Validation items are correctly scoped to #15252 and explicitly marked "not a #15978 merge blocker".
• Two-ceiling distinction: N/A — nothing shipped below its class.
• Deployment causality: the native display-capture confirmation is correctly classified Post-Merge (it needs merged dev), not used as a merge gate.

Findings: Pass. AC-6 is the one I checked hardest, since a frame census is easy to claim loosely — the receipt names 538/538 decoded, a 77-frame light interval at t=2.24–5.32s, and 0 post-ready blank/black frames in both streams. That is a counted population, not an impression.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at 923d77f030 (all checks). Author non-CI receipts present and head-appropriate: default profile 3 passed / 21.4 s; film profile 3 passed / 49.3 s; both with accelerated GL; geometry parity delta 0; diagnostic hashes recorded for both streams.
• Reviewer falsifier: run. Named concern — "can NEO_FILM_TAKE reach CI and silently disable the determinism contract?" Result: it appears in exactly two files, both under test/playwright/, and never anywhere under .github/. CI cannot set it; the gate holds on every CI run. This was the one thing that would have made the if (!filmTake) shape unsafe.
• Test location: N/A — no test added or moved; an existing canonical spec was modified in place.

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 97 - The flag touches run count and pacing only; no correctness assertion is reachable by it, and the default path executes zero added wait. Film-specific geometry stays in env (NEO_FILM_DISPLAY_BOUNDS) rather than the spec. 3 deducted for the test rename dropping the determinism property from name-based discovery.
• [CONTENT_COMPLETENESS]: 100 - The two comments that matter both exist and are precise: the correctness-gate disclaimer on the dwell, and the profile note explaining why film mode never puts the reload seam on camera. The PR body's Deltas section documents the 3,000→3,200 correction with its measurement. Actively checked for an unexplained constant (none — it is derived and shown) and for a silent AC deviation (none — the delta is declared).
• [EXECUTION_QUALITY]: 96 - Scored from exact-head CI plus both headed profile runs, not from the diff. run < journeyRuns - 1 degrades correctly to no-reload at journeyRuns = 1; themeDwell && short-circuits cleanly at 0; the pageErrorRuns message was correctly adapted from "both" to "all" for a variable run count. 4 deducted for the constant-vs-latency durability gap.
• [PRODUCTIVITY]: 100 - All six ACs verified independently against the diff and the receipts, including the two that are easy to assert loosely (AC-4's no-fixed-delay-as-correctness and AC-6's full census).
• [IMPACT]: 70 - No runtime surface, and the correctness profile is unchanged — but it unblocks the flagship film lane's B-03 beat, which the operator's own record requirement gates on.
• [COMPLEXITY]: 38 - One file, one profile constant, three gated assertion blocks. Low reader load; the branching is a single ternary consumed in four places.
• [EFFORT_PROFILE]: Quick Win - Small, contained diff resolving a genuine opposition between two demands on one journey, with disproportionate measurement work behind the constant.

Approving. The thing I would most want preserved if this is ever refactored: the flag may only subtract evidence, never substitute weaker evidence for it — that property is what makes the whole separation safe, and it currently lives only in the shape of the code.

Reviewed by Grace (@neo-opus-grace, Claude Opus 5, Claude Code) — cross-family GPT→opus seat.