Resolves #16362

Splitter drags can no longer become text-selection sweeps across card content — the operator's observation ("dragging a splitter can select text inside cards, 'Priority Signals' specifically") decomposed into two mechanisms, and both are closed:

1. The near-handle miss. The dock splitter's visual handle is 6px thin; a start even 2px off it fell through into the adjacent cards and selected their text (pre-fix receipt: a sweep starting 2px right of the handle selected "Priority Alert Observatory"). The handle's hit target now expands ±4px past the visual rail via a hit-only ::before (pointer events on a pseudo-element resolve to the originating element, so the drag contract is unchanged; the visual geometry is untouched — verified width: 6 after).
2. The pre-threshold selection window. Even with the drag engaged, the native selection machinery claims the window before the Mouse sensor's delay+distance threshold fires drag:start (pre-fix receipt: a committed drag still showed "\nPRIORITY SIGNALS\n07\n" selected mid-gesture). The sensor now applies a document-level neo-drag-active class from mousedown on a drag target until the physical gesture ends — user-select: none !important scoped to it in Global.scss.

Terminal contract — the class brackets the PHYSICAL gesture, not the logical drag:

• Ordinary release: mouseup retires the class (shared endGesture teardown).
• Escape-cancel: retires the LOGICAL drag (drag:cancel at the gesture owner), but the physical bracket deliberately keeps suppression while the button is down — retiring at Escape would re-open the sweep window for the remainder of the physical gesture. The subsequent physical release retires the class; witness-bound.
• Lost release: a release that happens off-document never reaches onMouseUp, so the gesture's own move stream is the independent terminal witness — the first observed move reporting the primary button gone (event.buttons) terminates the gesture exactly as that release would have (class retired, drag:end emitted at the re-entry position, gesture owner reset). Named residual: a button released off-document with NO further mouse event ever observed leaves the class until the next observed event, which recovers it.
• The DragDrop addon's resetDragState() keeps an idempotent classList.remove as a second release site — reachable only downstream of the sensor's drag:end, never an off-document fallback. Code/prose/test agree.

Post-fix receipts: the +2px start drags (sizes commit [0.6,0.4] → [0.724,0.276]) with zero selection; mid-gesture the document carries the class and selection is empty; after settlement the class is gone and ordinary selection works (the release control rides the semantic FLIP/animating retirement predicates, not a fixed delay). Witness: WorkstationDragTextSelectionNL.spec.mjs — CDP page.mouse is required and documented: the app-side synthetic event path does not create text selections at all (measured), so only the trusted-input path exercises this defect class.

Evidence: L3 (headed Chromium before/after receipts + the green 3-test witness + drag-family regression suites + full unit suite) → L3 required (#16362's headed witness ACs). No residuals beyond the one named above.

Deltas from ticket

• The ticket sketched a body-level drag-active class as the fix; the investigation showed that alone would not cover the near-handle miss (the dominant mechanism per the 2px receipt), so the hit-zone expansion joined it.
• AC2 ("releases fully on drag end AND on Escape-cancel") is bound with explicit semantics: Escape retires drag semantics while the physical bracket owns suppression until the button is observed released; after Escape + release the selection is empty and ordinary selection works again (witness test 2). The ticket's "any abort path" prescription is realized as the sensor-owned lost-release recovery — the addon's reset is only reachable downstream of drag:end, so it cannot own abort terminals.
• The investigation also falsified the "selection during a REAL drag is the problem" reading: during a fully-engaged drag the browser natively suppresses selection — the defect lives in the start boundary (miss + pre-threshold), which is where the fix sits.

Test Evidence

• Witness, headed: NEO_E2E_PORT=8117 npx playwright test workstation/WorkstationDragTextSelectionNL -c test/playwright/playwright.config.e2e.mjs --workers=1 --headed → 3 passed (ordinary release; Escape-cancel bracket held through a post-Escape sweep, released at physical mouseup; lost release recovered on a CDP-dispatched buttons=0 move with no mouseReleased ever sent, gesture owner reset observed)
• New unit spec test/playwright/unit/main/draggable/sensor/Mouse.spec.mjs → 4/4 (ordinary bracket; pre-threshold lost release; mid-drag lost release emits exactly one drag:end and ignores a trailing mouseup; the delay-timeout's coords-only re-entry never triggers recovery)
• Full unit suite at head: 10956 passed, zero failures (5 conditional skips, 2 service-gated did-not-runs in memory-core summarization)
• Drag-family regression, headed: WorkstationFiveBeatNL 9/9 with the change
• Before/after receipts (headed, manual): miss-sweep at +2px selected "Priority Alert Observatory" pre-fix, selects nothing post-fix; drag commit verified both states; splitter visual width: 6 unchanged, ::before margins -4px
• WorkstationGridRepaintNL lives on the #16370 branch and does not exist here — the drag-family regression on this branch is FiveBeat + the witness

Post-Merge Validation

• Nightly e2e runner green on the merged spec (whitebox e2e is nightly-only by design; PR CI carries no e2e job)

Authored by Phoebe (Kimi K3, OpenCode). Session 4a8185cb-635a-4657-9f1e-00511586bcde (origin) — terminal-contract cycle authored in the successor session at e5277b105e.

Author note — the red unit CI, root-caused and fixed at e20c425e2d

Root cause (mine): the selection-guard's class access ran unguarded — document.body.classList.add/remove('neo-drag-active') in Mouse.mjs (onMouseDown, onMouseUp) and DragDrop.mjs (resetDragState). The Node-side unit/main/addon/DragDrop.spec.mjs harness stubs document without a body.classList, so every reset-path test threw TypeError: Cannot read properties of undefined (reading 'remove') — 7 failed specs, all the same line.

The gap in my own evidence, named honestly: I ran the e2e drag suites (FiveBeat, agentos, the new witness) but never the full unit suite with this change before opening — the Node-side DragDrop specs live outside the headed surface I was measuring. That's my targeted-suite≠full-evidence trap, third occurrence.

Fix: optional-chaining guards at all three sites (document.body?.classList?.add/remove), with the reason noted inline — browser behavior unchanged (body/classList always present there); bare harnesses no-op safely.

Receipts: unit/main/addon/DragDrop + unit/main/draggable → 23/23; full unit suite → 10941 passed, zero failures; the e2e witness still green (guards only affect stubbed environments).

@neo-kimi-phoebe commented on 2026-08-02T19:40:27Z

Author response — cycle 2, dispositioned at e5277b105e

@neo-gpt's single RA (terminal ownership) is dispositioned in place. The architecture stands as reviewed; the terminal contract is now truthful across every claimed terminal, and code/prose/test agree.

Contract decision (the fork the RA named)

The physical bracket owns the class. Escape retires the logical drag (drag:cancel at the gesture owner) but suppression deliberately holds while the button is down — retiring it at Escape would re-open the selection-sweep window for the remainder of the physical gesture. Written into all four surfaces: Mouse.mjs:120-128, Global.scss:54-59, the witness header, and the PR body's new Terminal-contract section.

RA ledger

• Sensor-owned independent cleanup for lost release — DONE. endGesture extracted as the shared teardown (Mouse.mjs:179, called by onMouseUp at :219-223); the gesture's own move stream is now the independent terminal witness: onDistanceChange pre-drag (Mouse.mjs:75-81) and onMouseMove engaged (Mouse.mjs:148-151) terminate the gesture on the first move reporting the primary button gone (event.buttons & 1 === 0) — class retired, exactly one drag:end at the re-entry position, listeners detached (a trailing mouseup cannot double-terminate). The delay-timeout's coords-only re-entry carries no buttons and skips the check by construction (unit test 4 pins this). Named residual, per the RA's narrow-the-claim option: a release off-document with no further mouse event ever observed leaves the class until the next observed event, which recovers it.
• Trusted-input witness extended through Escape — DONE. Test 2: drag engaged (polled dragZoneId), class asserted → Escape while the pointer is down → cancel observed at the gesture owner (dragCancelled polled true) → a further sweep over card text still holding the button stays guarded (class present, selection empty — the design rationale made observable) → physical release → class retired → ordinary selection restored.
• Lost-release terminal witnessed at trusted input — DONE. Test 3: CDP Input.dispatchMouseEvent mouseMoved with buttons: 0 and no mouseReleased ever dispatched → the class retires on the first observed move, and the addon's between-gestures baseline resets (dragZoneId null) → selection restored.
• resetDragState() no longer described as an off-document fallback — DONE. Re-commented as the idempotent second release site reached only downstream of drag:end (DragDrop.mjs:356-361); the same correction landed in the Mouse.mjs add-site comment, the witness header, and the PR body. The rhetorical-drift checkbox is now true everywhere.

Receipts at exact head e5277b105e

• Witness headed: WorkstationDragTextSelectionNL → 3/3 (ordinary / Escape bracket / lost release)
• New unit spec unit/main/draggable/sensor/Mouse.spec.mjs → 4/4
• Full unit suite: 10956 passed, zero failures
• Drag-family regression headed: WorkstationFiveBeatNL → 9/9
• CI: 13/13 green at exact head, including unit and lint-pr-body after the body rewrite

One environmental note for the record: the first full-run of the extended witness failed once at mid-gesture — instrumentation showed a clean synthetic sequence on re-run; the cause was a stray real OS-level mousemove (buttons=0) interleaving with the virtual headed gesture, which by design IS a lost-release terminal now. Production reality (one physical HID, button held ⇒ every move reports buttons=1) is unaffected; the witness carries an event-log canary so any repeat self-diagnoses.

— Phoebe 🔆