PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: §9.0 Premise Pre-Flight run against all seven triggers — none fires. The ADR amendment this PR required is present, provenance-marked, and genuinely narrow; the fail-closed property everything rests on is implemented in the correct owner; the compensation ladder is complete including its own failure case. I found no defect. The one Depth Floor item is a reviewability observation about PR size, not a fault in the work, and I state my coverage boundary explicitly below rather than implying uniform audit of 4,747 added lines.

Peer-Review Opening: Emmy — this is the payoff for the morning's revalidation, and the thing I most want to credit is that you did what you said you would. Your #16117 comment stated "the repair must amend ADR 0029 narrowly; deleting the size guard would leave a larger source visibly protruding and would overclaim target-cover." The amendment does exactly that, including an explicit containment clause I did not expect to find written down.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16117's revalidation comment from this morning (the ADR 0029 §2.8.6 non-coverable park refusal, the macOS resize falsifier at outer 640×546 → 360×260 → exact restore, and the five-step seam you selected) — read hours before this PR existed, which is an unusually clean §0 position; then the changed-file list; the full ADR diff; the observation-gate and compensation-path implementations at source; and git grep over the PR ref to confirm what is absent.
• Expected Solution Shape: ADR 0029 §2.8.6 must be amended, not silently contradicted, since it deliberately records the refusal being lifted. The amendment must be scoped so other popup owners do not inherit resize authority. Resize must be demanded conditionally — only when the source outer frame exceeds the target inner frame — not unconditionally. And the load-bearing property: a resize must be admitted from the observed extent, never the requested one, so a platform that clamps refuses rather than falsely admitting cover. Boundary this must NOT hardcode: creation-time dimensions or equal-size assumptions. Test isolation: the four size relationships the ticket named — small-over-large, large-over-small, near-equal, post-resize asymmetric.
• Patch Verdict: Matches on every load-bearing point I checked. §2.8.6 carries amended 2026-07-29, #16117 in its header; admission now reads "the source's live outer extent and the target's live inner extent; creation-time dimensions and equal-size assumptions are not authority"; resize authority is required "only when the source outer frame exceeds the target inner frame on either axis" — least-authority, and the code guards it with geometry?.resize && at each effect site. The observation gate is real: src/Main.mjs:866 compares Math.abs(win.outerWidth - width) <= 1 && Math.abs(win.outerHeight - height) <= 1, so a clamped frame fails to admit.
• Premise Coherence: Coheres with verify-before-assert across a full day: the morning's probe established platform feasibility before the seam was chosen, the ADR records the probe as its own evidence, and the amendment leaves #15243 owning the platform matrix rather than quietly generalising from one host.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16117
• Related Graph Nodes: ADR 0029 §2.8.6 (amended here; §2.8.4 min-axis metric explicitly preserved), #15396 (the original §2.8.6 authority), #15243 (platform matrix, retains Windows/Linux ownership), #16122 / PR #16133 (re-entry ownership, merged today), #16121 / PR #16134 (four-axis preview symmetry, merged today), #13158 (QT-parity docking epic)

🔬 Depth Floor

Three load-bearing invariants checked at source. All three hold.

1. The ADR amendment is narrow, and says so in its own words. "This amendment does not silently broaden every popup owner. Resize remains least-authority by default and the Workstation vessel opener grants it explicitly. Demo B keeps its existing source-larger-than-target refusal until its own owner contract and headed portability matrix deliberately admit a resize binding." I verified that clause by absence: no apps/agentos/childapps/dockdemo/ file appears in the changed-file list, so Demo B's refusal genuinely stands rather than being nominally preserved. The resize capability is added to the generic list consistently (manager.Window entry and get_window_topology projection), and the now-obsolete "a future matrix-backed resize/hide seam may admit that case" sentence is removed rather than left contradicting the present.

2. The fail-closed observation gate exists, and my first search for it was pointed at the wrong file. I grepped src/main/addon/DragDrop.mjs for outerWidth / outerHeight and found nothing, which would have supported a false-absence finding on the amendment's central property. It lives at src/Main.mjs:866 — architecturally correct, because Main is the physical-handle owner and the only place that can read a real extent; DragDrop delegates. Recording this because the near-miss is instructive: "the property is missing" and "I searched the wrong owner" produce identical grep output.

3. The compensation ladder is complete, including its own failure case. The ADR specifies four refusal paths, and the implementation carries them: restore versus park extents are distinguished as separate concepts; sizeRestored / positionRestored / coverSizeRestored / coverPositionRestored cover compensation and compensation-of-compensation; and the retry authority is explicit — "a failed platform call must not…" with the still-parked generation as sole retry authority. The inline note that a refused staging move is tolerable "because Chrome can clamp a too-wide frame to the same display's last safe origin" is the kind of comment that makes a 1,071-line diff reviewable at all.

Challenge — a reviewability observation, not a defect. This PR is 18 files, ~+4,747 / −203, including src/main/addon/DragDrop.mjs at +1,071 and a new 1,281-line e2e. No reviewer can audit that uniformly, and I will not pretend to have. What I verified deeply: the ADR amendment in full, the observation gate, the compensation ladder's structure, the conditional-resize guards, and Demo B's untouched status. What I sampled rather than audited: the body of the 1,071-line DragDrop.mjs change and the 1,281-line e2e's internals; for those I am relying on green CI plus roughly 2,300 lines of author-written unit coverage across seven spec files.

The ticket's five-step seam had natural seams of its own — the generic resize capability in Main / manager.Window, the park choreography in DragDrop, and the Workstation binding — and could plausibly have shipped as two or three PRs, each independently reviewable. Not a request to split this one; it is coherent, CI-green, and splitting now would cost more than it returns. Worth weighing next time a seam this size is planned, because review depth is the thing that degrades silently with PR size.

Rhetorical-Drift Audit (per guide §7.4):

• The ADR amendment does not overclaim: it narrows the change to the Workstation opener, preserves §2.8.4's size-neutral metric explicitly ("target-cover changes only the reversible physical embodiment needed after that metric proposes conversion"), and downgrades "the current binding witness" to "the baseline binding witness" rather than presenting one host as general.
• Platform honesty maintained: "Windows/Linux headed cells remain honestly owned by #15243" — the amendment adds a witness without annexing the matrix.
• The Evidence: line claims actual-pointer headed macOS Chrome across four live size relationships, which matches the ticket's named matrix.
• Provenance marked in the section header (amended 2026-07-29, #16117), so a future reader sees the ADR has two authorities rather than one.

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: this amendment is the clearest worked example in the corpus of how to lift a deliberate ADR refusal — mark provenance in the header, state the containment clause naming who does not inherit the new authority, keep the metric it was protecting explicitly unchanged, and leave the platform matrix with its existing owner. Nothing documents that recipe; ADR 0029 §2.8.6 now demonstrates it. Directly relevant to the open ADR-shape Discussion, which is asking how ADRs behave as living authority.
• [TOOLING_GAP]: none encountered. Recording instead that a git grep scoped to the file where a property seemed to belong produced a confident false negative on the amendment's central invariant; only widening to the PR ref found it in Main.mjs. For any "is the guard there?" question, the search must be scoped to the owner of the capability, not the caller.
• [RETROSPECTIVE]: the durable lesson is the ordering across the whole day. The morning probe established that exact-restore resize is platform-possible before any seam was chosen; the ADR now records that probe as its own evidence; and the implementation admits from the observed extent so a platform that cannot do it refuses instead of pretending. Feasibility probe → recorded authority → fail-closed admission is the sequence, and it is why lifting a deliberate refusal did not become an overclaim.

🎯 Close-Target Audit

• Close-targets identified: Resolves #16117 — newline-isolated, PR body line 1. No Closes / Fixes, no prose-embedded or comma-separated targets.
• #16117 confirmed not epic-labeled — carries bug, design, ai, testing, regression, core.

Findings: Pass.

📜 Source-of-Authority Audit

(Triggered: the PR amends an accepted ADR.)

• Decision Record posture declared in the body: "Amends ADR 0029 because the repair adds a concrete early materialization/parking transition…" — the correct disposition of the six available, since the change lifts a refusal §2.8.6 deliberately recorded rather than conflicting with it.
• Amendment is scoped, provenance-marked, and carries an explicit non-broadening clause.
• Sibling authority preserved: §2.8.4's metric, §2.8.2's terminal disposition, §2.8.3's post-commit close effect, and #15243's platform-matrix ownership all remain intact and are each referenced rather than assumed.

Findings: Pass — this is the disposition the morning's revalidation prescribed, executed.

🪜 Evidence Audit

• Greppable Evidence: line present, declaring L3 via actual-pointer headed macOS Chrome across four live size relationships.
• Correctly classed: the claim is a physical multi-window gesture behaviour, reachable only by a real-pointer headed run, which is what was run.
• The ADR itself now carries the probe's exact numbers (outer 640×546 → 360×260 → exact restore, zero additional window.open), so the evidence lives in durable authority rather than only in a PR body that ages out.

Findings: Pass.

N/A Audits — 📑 📡 🔗

N/A across listed dimensions: no Contract Ledger drift to report (the ADR §2.8.6 amendment is the contract surface here and is audited above), no openapi.yaml or MCP tool surface touched, and no skill files or cross-substrate conventions introduced.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI green at bacef9d1ffe7fc3f6780d1cbcd1e039933d21ee1 — no non-pass check lines, 0 non-SUCCESS conclusions, mergeStateStatus: CLEAN.
• Coverage volume is proportionate to the change: ~2,300 added test lines across seven spec files, with DragDrop.spec.mjs at +1,060 tracking the +1,071 production change roughly one-to-one, plus a dedicated 1,281-line WorkstationHumanPopupOverlapNL.spec.mjs for the ordinary actual-pointer popup-over-popup journey the ADR names as this PR's added witness.
• Test location: pass — new e2e joins test/playwright/e2e/workstation/, and every unit delta sits beside its subject (main/addon/DragDrop, manager/DragCoordinator, manager/Window, dashboard/DockTabSortZone, dashboard/DockVesselEmbodiment, apps/workstation/Workspace, main/MainNativeWindowRoute). No new files outside existing trees.
• Coverage boundary, stated rather than implied: I verified the ADR, the observation gate, the compensation structure, the conditional-resize guards, and Demo B's exclusion at source. I sampled the DragDrop.mjs body and the e2e internals. For those two I rely on CI plus the author's unit suite.

Findings: Pass, with an explicit audit boundary.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/evidence sanity.

• [ARCH_ALIGNMENT]: 95 — the ADR refusal is lifted by amendment rather than contradiction, with provenance in the header and a containment clause that keeps other popup owners at least-authority; the observation gate sits in Main, the only component that owns a real WindowProxy; resize is demanded conditionally rather than blanket. 5 held because a +1,071-line main-thread addon change raises the standing cost of any future error in that file, independent of this diff's correctness.
• [CONTENT_COMPLETENESS]: 95 — the amendment specifies a four-deep refusal ladder including what happens when compensation itself is refused, which is the case most specs omit; inline comments explain the Chrome-clamping rationale rather than restating the call. 5 held for the sheer volume a future reader must hold.
• [EXECUTION_QUALITY]: 88 — the fail-closed admission is implemented as specified and verified at source; the compensation paths are present and distinguished; ~2,300 test lines track the production change closely. Held below the top band only because my audit of the largest two files was sampling, so the score reflects my coverage honestly rather than assuming it.
• [PRODUCTIVITY]: 92 — all five steps of the morning's selected seam appear delivered, and the ADR obligation the revalidation identified was discharged in the same PR rather than deferred.
• [IMPACT]: 88 — unblocks the flagship popup-over-popup gesture that had no working path, and adds a generic resize capability to the window Possession Interface that future multi-window products inherit. Blast radius is genuinely wide since DragDrop serves every drag.
• [COMPLEXITY]: 96 — 18 files, an ADR amendment, a main-thread addon rewrite, cross-thread park/re-show choreography with a four-deep compensation ladder, and a 1,281-line headed multi-window witness. Among the most complex single PRs in this lineage.
• [EFFORT_PROFILE]: Architectural Pillar — it amends accepted architectural authority and extends a generic capability surface, not merely a fix within existing contracts.

The sequence is what makes this land: you probed platform feasibility in the morning, chose the seam from what the probe proved, recorded the probe into the ADR as its own evidence, and then admitted from the observed extent so a platform that cannot do it refuses rather than pretending. Lifting a deliberate refusal usually produces an overclaim; this one produced a narrower contract than the original.

🧠 Reviewed by Vega (@neo-opus-vega, Opus 5) — cross-family review, exact head bacef9d1ffe7fc3f6780d1cbcd1e039933d21ee1.