PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: The diff is narrower than the ticket permits and adds no debt. It introduces one fail-closed handshake plus a shared sentinel, and it repairs a live correctness bug on the way. Approve+Follow-Up would be wrong — there is nothing deferred; my one challenge is a diagnostics-timing improvement, not debt the merge creates.

Peer-Review Opening: Thanks for this — the exclusive-write plus ready-hash binding is the right shape, and the sentinel fix is a real bug caught in passing. One non-blocking challenge below about when a misconfiguration surfaces.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16046 title/scope via the PR's Resolves line, the changed-file list, current dev gpuIntent.mjs (the pre-change Boolean(process.env.NEO_FILM_TAKE) sentinel), and the parent film lane #15252 context from the A2A record.
• Expected Solution Shape: A capture run must not begin beat one before the recorder has acknowledged a specific verified start state. The simplest acceptable shape is a file handshake with an identity binding, so an old acknowledgement cannot unblock a new take. It must NOT hardcode recorder paths, and film-only behaviour must be inert for ordinary E2E runs.
• Patch Verdict: Matches, and improves on the minimum. The go receipt is bound to readySha256 (WorkstationFiveBeatNL.spec.mjs), so a stale go for a different ready state is refused rather than silently accepted — that identity binding is the part a weaker implementation would omit. writeExclusive uses flag: 'wx', so a leftover file fails rather than being reused.
• Premise Coherence: Coheres with verify-before-assert. The receipt is the evidence — the run cannot assert readiness it has not published and had acknowledged. canonicalize() sorting keys before hashing means the proof is stable across writers rather than dependent on one producer's formatting, which is what makes the assertion falsifiable by a third party.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16046
• Related Graph Nodes: #15252 (parent film lane), #15906 (cross-window docking app surface)

🔬 Depth Floor

• Challenge: resolveFilmControl() fails closed on shape at module load — atomic triple, absolute paths, pairwise-distinct, film-mode-required — but not on writability. writeExclusive(filmControl.readyFile, …) will throw ENOENT if the parent directory does not exist, and that throw happens after a headed Chrome launch and the journey running to beat one. So a one-character path typo is discovered at the most expensive possible moment in the run, with an fs error rather than the contract's own diagnostics. An fs.ensureDir/access probe inside resolveFilmControl() would move that whole class to collection time and match the fail-closed intent already present three lines above it. Non-blocking: the failure is loud and correct, just late.

  Secondary, minor: a stale readyFile surfaces as a raw EEXIST from writeExclusive, while stale goFile/receiptFile get the friendly expect(...) messages ("the film go file must not predate readiness"). Same failure class, asymmetric diagnostics.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: framing matches what the diff substantiates (no overshoot)
• Anchor & Echo summaries: precise codebase terminology, no metaphor or overshooting anchor
• [RETROSPECTIVE] tag: N/A — none present
• Linked anchors: cited tickets actually establish the claimed pattern

Findings: Pass. The body claims "a causal boundary between verified workstation readiness and beat one" and the diff substantiates exactly that — no broader claim about capture quality or determinism beyond the handshake.

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: The sentinel repair is the durable lesson, not the handshake. Boolean(process.env.NEO_FILM_TAKE) made 0 and false select film mode — an env-var truthiness bug that is invisible until someone disables a flag by setting it to zero and gets the opposite behaviour. Centralising on isFilmTake() with an exact '1' comparison, and routing all four consumer classes (launch, pacing, video, pixel-witness) through it, converts a repeated-idiom hazard into one auditable decision point.

N/A Audits — 📑 📡 🔗

N/A across listed dimensions: test-harness-only change — no public/consumed contract surface, no OpenAPI tool descriptions, no skill/convention/AGENTS.md surfaces touched.

🎯 Close-Target Audit

• Close-targets identified: #16046
• For each #N: not independently verified. I did not fetch #16046's labels, so I am flagging rather than claiming this check. Its title reads as a leaf ("bind take-17 recorder start to semantic readiness") and it was created today as a lane-claim, so an epic label is unlikely — but unlikely is not verified.

Findings: Unverified, non-blocking. Author or next reviewer should confirm.

🪜 Evidence Audit

• PR body contains an Evidence: declaration line
• Achieved evidence ≥ close-target required evidence — declared L3 → L3 required, "No residuals"
• If residuals exist: N/A — none declared
• Two-ceiling distinction: the body distinguishes what ran (headed Chrome, live Neural Link, delayed external go writer) from what was not rerun (the dense-workstation journey), explicitly and without inflation
• Evidence-class collapse check: no L1/L2 promoted to L3 framing — the L3 claim rests on a named headed run
• Deployment causality: N/A — no external runtime receipt used as a merge gate

Findings: Pass. The fail-closed matrix listing (partial, relative, non-film, same-path, stale-ready, stale-go, stale-receipt, wrong-ready-hash) is the strongest part of the evidence — each named boundary maps to a specific guard in resolveFilmControl() / awaitFilmGo().

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI green; author per-surface receipts present and specific (8/8 sentinel unit matrix, 9/9 five-beat, 2/2 controlled film surface with a 750 ms zero-byte go file, receipt hash equality)
• Reviewer falsifier: N/A — no named behavioral concern. My challenge is about failure timing, not failure correctness, and the author's zero-byte-go-file case already exercises the partial-write path I would otherwise have probed.
• Test location: pass — sentinel decision core under unit/e2e/, journey under e2e/workstation/, matching existing placement.

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 92 - Shared sentinel replaces a repeated idiom across four consumer classes; film-only logic stays inert for ordinary E2E via a single guard. Helpers are local to the spec that owns them rather than prematurely hoisted.
• [CONTENT_COMPLETENESS]: 95 - The three-file contract is validated on every axis it can be wrong (presence, atomicity, absoluteness, distinctness, mode) and each has a named failing case in the evidence.
• [EXECUTION_QUALITY]: 90 - wx exclusive create, ready-hash-bound go, canonicalized hashing, poll that tolerates ENOENT/SyntaxError but rethrows everything else. Deducted only for the late writability failure noted above.
• [PRODUCTIVITY]: 88 - +250 lines closing a real ordering hazard plus an unrelated live bug found in the same sweep.
• [IMPACT]: 85 - Unblocks the flagship film lane's capture gate; the sentinel fix protects every existing film-mode consumer from an env-var truthiness trap.
• [COMPLEXITY]: 55 - Conceptually small; the handshake's subtlety is concentrated in identity binding rather than spread across the diff.
• [EFFORT_PROFILE]: Quick Win - Bounded, self-contained, and it removes a class of silent misbehaviour rather than adding a feature surface.

The identity binding is what makes this more than a sleep. A go receipt that merely says "ready" would let a leftover acknowledgement start a take against the wrong state; requiring readySha256 means the recorder must have seen this run. That is the difference between a handshake and a delay, and it is the part worth keeping if this pattern spreads to other capture lanes.