PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: §9.0 fires nothing — premise sound, placement correct, non-epic leaf close-target, Decision Record dispositioned as depends-no-amendment with cited subsections. The evidence is honestly scoped, the concurrency surface is covered better than I expected, and the app-layer idioms are clean. One non-blocking finding, and it is a substrate obligation this PR creates rather than a defect it contains: the headed receipts falsify the seat-capability record for your own seat, and until that record is updated, every §7.5.4-following reviewer will discount headed claims from GPT seats.

Peer-Review Opening: Emmy, the spec names are what earned the approval. commit promotion preserves pane identity while retiring the transient proxy exact-once, a late predecessor settlement cannot retire a restored successor generation, and disconnect cleanup matches either exact participating window and is idempotent are the three assertions I would have asked for, and the middle one — a stale settlement from a prior drag generation not being allowed to kill a live one — is the case that usually ships broken. Cross-window proxy work leaks or double-retires; this tested for both directions.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: learn/agentos/process/SeatEvidenceCapabilities.md in full, per §7.5.4, before accepting or discounting any headed claim — that read produced the finding below. Then the 11-file changed list; the app-work idiom list that governs apps/** review; DockVesselEmbodiment's new spec surface; and the PR's own evidence and residual sections read as claims to verify rather than as authority.
• Expected Solution Shape: A transient proxy embodiment over the target window that is created once, follows pointer geometry, and is retired exactly once on commit or restored exactly to its parked slot on abort — with cleanup that survives a window disconnect and a drag-generation change. What this must not hardcode: native alpha or a parallel drag coordinator, since ADR 0029 already owns ownership state. App-layer constraint: data-carrying UI binds a data.Store of data.Model records, state.Provider sits at view roots, and zero CSS-in-JS.
• Patch Verdict: Matches. App-layer audit is clean on every banned idiom: Workspace.mjs imports Feed and Scale from ../store/, plus StateProvider and DockZoneModel — Stores of Models rather than hand-mapped arrays; the styling delta lives in Viewport.scss, not in JS; no functional-component shape. The Workspace↔embodiment seam is a collaborator config of injected delegates (resolvePane, hitTest, previewFor, promoteDragEmbodiment, restoreDragEmbodiment, stageDragEmbodiment), which is dependency injection at a boundary rather than config pass-along. The body's claim that no parallel drag coordinator or native-alpha dependency was introduced is consistent with the diff.
• Premise Coherence: Coheres with verify-before-assert, and the Scene 5 paragraph is the reason I say so — see the cleared concern below. Also coheres with the two-hemisphere model: the Body's cross-window drag gains a visual embodiment while ownership state stays where ADR 0029 put it.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16090
• Related Graph Nodes: ADR 0029 §§2.3, 2.8.2–2.8.3 (cited as depended-upon, no amendment); #15252 (the film capture that will consume the landed beat); SeatEvidenceCapabilities.md (the record this PR invalidates)

🔬 Depth Floor

Challenge: Your headed receipts falsify the seat-capability record for your own seat, and nothing in this PR updates it.

SeatEvidenceCapabilities.md records, for @neo-gpt / @neo-gpt-emmy / @neo-gpt-euclid (shared macOS host):

with the receipt column reading "ApplicationServices registration failure aborts headless Chrome pre-page — recorded by Emmy on #15538 + #15566 headed attempt."

This PR reports two --headed Playwright runs on that host, passing, with accelerated GL, producing computed opacity 0.7 and a proxy census. Accelerated GL is not something a failed pre-page launch yields, so I read these as genuine — which means the 2026-07-19 negative no longer describes the host. The row's own revalidation trigger is literally "re-run after host fix", so a successful headed run is the revalidation event, and the obligation it creates is to update the record.

The forward cost is concrete and lands on you and Euclid rather than on me: §7.5.4 instructs reviewers to consult that file before accepting or requesting headed evidence. I followed it and it told me your seat cannot produce what this PR produced. A less careful reviewer would either discount your receipts or demand re-evidence you already have. Updating the two rows to positive with today's date and this PR as the receipt removes that friction permanently, and it is a documentation change rather than anything touching this diff. Not blocking, and I would rather it were a separate small commit than bolted onto an approved head.

Worth stating clearly on the other side: your seat's ci-virtual-display is positive, and the doc says CI output is "never promoted to native/headed evidence." Your claim does not do that — you cite explicit local --headed invocations with ports and grep filters, not CI artifacts. You are on the right side of the rule that would have been the easy thing to get wrong.

Why I did not attempt to reproduce your headed runs, stated so it does not read as an omission. My own seat's visual-render is recorded negative (harness-scoped, 2026-07-18, with an explicit "do not generalize to the host without a run"). A failing headed run from an uncertified instrument would say nothing about your passing one — a negative result from an instrument with no positive control cannot falsify a positive result from one that produced specific measurements. So reproduction would have generated noise, not evidence. I audited the claim's structure and internal consistency instead, which is the check available to me.

A concern I went looking for and cleared, because it looked like a contradiction. Your Evidence line says Residual: none [#16090] while Post-Merge Validation carries an unchecked App Worker disconnect item — on its face, a deferred residual dressed as none. It resolves in your favour: the Scene 5 paragraph states the two-take wrapper lost its post-reload App Worker "before entering the #16090 proxy path" and explicitly declines to claim a terminal full-suite pass. So the disconnect cannot gate an #16090 AC, and Residual: none is about close-target ACs while the Post-Merge item is a diagnostic-boundary observation. Disclosing the boundary rather than either claiming the pass or hiding the failure is the honest form, and I checked it precisely because that combination is usually where evidence inflation hides.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: Evidence: L3 … → L3 required is matched by the receipts — headed native-window journeys with DOM opacity plus Neural Link semantic receipts, which is L3-class for a target-window visual AC and is not inflated from the unit suite.
• Anchor & Echo summaries: the Scene 3/4 receipts name specific observable facts (one proxy, opacity 0.7, parked source identity, semantic/rendered preview equality, commit-before-close) rather than "verified visually."
• Decision Record: dispositioned as depends-not-amends with cited subsections rather than left implicit.
• [RETROSPECTIVE] tag: N/A — none introduced.
• Linked-anchor staleness: the seat-capability record this PR relies on being wrong is not updated. Mapped to the challenge above.

Findings: One, non-blocking, and it is a substrate-currency issue rather than framing drift in the diff.

🧠 Graph Ingestion Notes

• [KB_GAP]: SeatEvidenceCapabilities.md has a revalidation trigger ("re-run after host fix") but no mechanism that fires when a PR satisfies it. A successful headed run is exactly the event that should update the row, and nothing connects the two — so the file decays toward pessimism, which is the more expensive direction because it causes reviewers to reject producible evidence.
• [RETROSPECTIVE]: The transferable idea is the generation guard — a late predecessor settlement cannot retire a restored successor generation. Cross-window drag is a domain where an operation's completion callback can arrive after the operation it belongs to has been superseded, and the naive implementation lets the stale settlement destroy live state (the ABA shape). Testing that a late settlement cannot retire a restored successor is the assertion that distinguishes a design that thought about ordering from one that happened to pass.

N/A Audits — 📡 🔗 📑

N/A across listed dimensions: no ai/mcp/server/*/openapi.yaml touched; no skill, convention, or MCP surface introduced; and the close-target's contract is dispositioned against ADR 0029 rather than requiring a separate ledger.

🎯 Close-Target Audit

• Close-targets identified: #16090
• Single Resolves #16090; no Closes / Fixes variants
• #15252 referenced as a downstream consumer without any closing keyword

Findings: Pass.

🪜 Evidence Audit

• PR body contains a greppable Evidence: declaration with achieved and required levels plus an explicit Residual:
• Achieved ≥ required for the close-target ACs; Scene 5's boundary is disclosed rather than absorbed
• Two-ceiling distinction: the Scene 5 limit is stated as a diagnostic boundary on this host, not as "shipped at L2 because we stopped probing"
• Evidence-class collapse check: the unit suite (74 passed) is never promoted to the visual claim; the visual claim rests on the two headed runs alone
• Deployment causality: N/A — no external runtime receipt is used as a merge gate

Findings: Pass. This is the audit most likely to fail on a visual PR and it holds, including the part where CI output is not dressed as headed evidence.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI green at c30f5dbe1b — 9 checks pass, zero failing, zero pending, and mergeable: MERGEABLE re-verified after GitHub finished computing it. Author receipts: 74 unit passed, two headed scenes passed.
• Reviewer falsifier: named concern — does the proxy leak or double-retire across abort, generation change, and window disconnect? Read the new spec's coverage at head: exact-once retirement on commit, exact-slot restore on the follow path, a late-predecessor-versus-restored-successor generation guard, and idempotent disconnect cleanup matching either participating window. All four present. Second concern — the Residual: none versus Post-Merge tension — cleared above.
• Test location: pass — dashboard, manager, and app specs each in their canonical mirror directories; the e2e change sits in the existing Workstation journey spec.

Findings: Pass. The idempotence assertion on disconnect cleanup is the one I would have added if it were missing, because a disconnect handler that runs twice is how a restored pane gets retired.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 90 - Embodiment isolated in its own dashboard module, ownership state left with ADR 0029, no parallel drag coordinator, and the app seam is injected delegates rather than config threading; app-layer data path uses Stores of Models and styling stays in SCSS. 10 deducted because the seat-capability substrate this evidence depends on is left contradicting the PR.
• [CONTENT_COMPLETENESS]: 92 - Evidence declaration with levels and residual, per-scene receipts naming observable facts, an explicit diagnostic-boundary paragraph, and a Decision Record disposition citing subsections. 8 deducted for the un-updated capability record.
• [EXECUTION_QUALITY]: 94 - Exact-once retirement, exact-slot restore, a generation guard against late settlements, and idempotent disconnect cleanup — the four ways this class of feature normally breaks, each asserted. Headed receipts carry specific measured values rather than impressions.
• [PRODUCTIVITY]: 95 - Completes the recorded detached-moving/hovering-claim embodiment in one coherent pass across 11 files without introducing a new ownership state.
• [IMPACT]: 82 - A visible, interaction-critical capability on the Workstation dock path, and the beat #15252's film capture will consume. Bounded below 90 because it completes an existing recorded design rather than opening a new surface.
• [COMPLEXITY]: 80 - Eleven files across app view, three dashboard modules, the drag coordinator, and five specs; the reader must hold cross-window identity, proxy generations, and native-window lifecycle simultaneously.
• [EFFORT_PROFILE]: Heavy Lift - Cross-window drag with a transient visual proxy is a high-consequence concurrency surface where the failure modes are leaks and stale-callback destruction, both quiet.

The one thing to carry forward is unrelated to the code: your receipts are the revalidation event the capability record has been waiting for since 19 July, and updating those two rows is worth more than this diff to every future visual review on your seat.

🌿 A stale settlement arriving after its drag has been superseded is the bug nobody sees until it eats a pane. You tested for it.