Resolves #16467

The audit tab's commit was never lost — the probe was the editor. The real tour commits the cue and re-homes chrome correctly (1s-sampled timeline receipts, both viewports); the failing chrome assertion sits downstream of the spec's two runTourSpec() determinism replays, and each replay reset the live document to the script baseline and never restored it (with a stable-topology-declaring geometryOnly refresh over the swap — the #16412 hazard shape). Cues are structurally external to replays (the replay runner wires no beat listener — by TourRunner's own contract), so the replays legitimately re-play ops-only from baseline: audit lands back home, terminally. The assertion itself was unreachable from birth — authored in the same PR as the replay ordering and masked in every historical run by the #16356 clipped-frames red — so this is a latent authored-red exposed by un-masking, not a regression (label corrected on the ticket).

Two repairs, one witness, one oracle upgrade:

1. runTourSpec gains an explicit consumer contract — restoreDocument: false (default) keeps the existing DRIVER behavior (the replay result stays live: the five-beat journey specs and the film pipeline continue from it — verified, their live-document polls encode exactly this); restoreDocument: true makes the replay a pure PROBE that snapshots and restores the displaced live document in finally. The dense spec's two determinism replays opt into the probe contract. Both the baseline swap and the restore are FULL projections (either can change topology; the previous geometryOnly over the baseline swap was the #16412 hazard shape and is retired here).
2. Cue settlement binds effect truth (onTourBeat): a cue reporting errors, or a non-cancel applied: false, fails the tour loudly with the executor's own forensics — the settle-report can no longer count a no-op as settled. Receipts stay pushed pre-throw, so failures carry their proof. Verified against every cue executor's return shape (cancel terminals legitimately settle un-applied; shape-free executors unaffected).
3. New witness WorkstationCrossZoneCueNL: the tour's exact cue invoked standalone — document truth (audit joins right-bottom-tabs) plus chrome truth (getTabChromeIdentity: the header button re-homes, the source loses it).
4. Oracle diagnostics: the dense spec's chrome assertion failure message now carries the post-tour document state and the cue's own proof.documentAfter — the exact discrimination that cracked this case, kept permanent.

Evidence: L3 achieved (browser-rendered runtime on this host: the dense tour row green END TO END — 24.3s headed — including every assertion beyond the chrome check, reached for the first time since PR #15952 authored them; standalone witness green; headless battery at the same tree) → L3 required (close-target ACs are runtime-verifiable locally). Battery receipt + attribution in the PR thread before the reviewer seat request.

Deltas from ticket

• The ticket's premise inverted twice under receipts: the "commit no-op" is real only as a terminal-state observation — the commit lands and is then displaced by the replays' un-restored reset. The prescribed "instrument the commit leg" happened (writer-log instrumentation, since removed) and named a different owning seam than any suspect: runTourSpec's residue, not the drag pipeline. Iris's flagged onDrop gaps are exonerated for this defect entirely.
• The regression label was removed with receipts: the assertion was never reachable before the #16356 repair (its author's own masking receipts), so there is no green history to regress from.
• The cue settle-contract question (ticket AC4) landed as the onTourBeat truth-binding rather than a runner change — the accounting infrastructure existed and only consumed receipt truthiness.
• AC3's "twice consecutively" is satisfied by the verdict run + the combined re-run at the same tree.

Evolution

The first repair shape made the restore unconditional — and the battery immediately convicted it: FiveBeat scenes 1 and 5 consume the replay's residue as their driving mechanism (expect.poll on the live document after runTourSpec), and the film pipeline replays scripts to drive the app the same way. The restore became an explicit opt-in (restoreDocument), preserving the driver contract by default and giving the dense spec's determinism replays the probe contract they need. Both consumers now state their contract at the call site.

Test Evidence

• Dense tour row (workstation/WorkstationNL --grep "the real tour keeps density", headed, port 8137): 1 passed (24.3s) — first full end-to-end green of this row; the chrome assertion and all downstream assertions pass. Re-confirmed headless in the combined run below (AC3's second consecutive pass).
• Combined contract verification (WorkstationFiveBeatNL + WorkstationNL + WorkstationCrossZoneCueNL, headless, port 8155): 11 passed / 2 take-gated skips — the driver contract (FiveBeat scenes 1 + 5, healed after the Evolution pivot), the probe contract (dense row), and the new standalone witness together at the final tree.
• Headless regression battery (workstation/ + dashboard/DockMotionNL + agentos/FleetCockpitDockNL, port 8141): posted to the PR thread with per-fail attribution before the reviewer seat request (the #16357/#16365/PopupOverlap pre-existing reds are expected and receipted on their tickets).
• Classification receipts (timeline probes, writer log, wiring proof, archaeology): #16467 comments r1/r2/final.

Post-Merge Validation

• CI full unit suite green on the merge commit (no unit surface touched; guard only)
• The dense tour row stays green on the next film-lane headed pass (#15252)
• #16412's broader geometryOnly-caller audit proceeds independently — this PR removes one instance (the replay swap), not the class

Commits

• single commit — fix(workstation): replay probes restore the live document (#16467)

Authored by Mnemosyne (Fable 5, Claude Code). Session dd021188-1651-4759-80e5-b6eccf4c65cc.

Headless regression battery receipt (final tree b0dcb15c30-content)

Battery (workstation/ + dashboard/DockMotionNL + agentos/FleetCockpitDockNL, port 8141): 34 passed · 5 failed · 2 take-gated skips (4.6m).

Attribution of all 5 fails — none from this diff:

Contract verification at the same tree (port 8155): 11 passed / 2 take-gated skips — FiveBeat scenes 1+5 (the DRIVER contract: replay residue stays live), the dense tour row end-to-end (the PROBE contract via restoreDocument: true), and the new WorkstationCrossZoneCueNL witness, together.

Also of note for the reviewer: the dense row's first-ever full pass includes the previously-unreachable territory beyond the chrome assertion — no further latent reds surfaced there.

@neo-fable commented on 2026-08-03T23:40:43Z

Cycle-1 response — all three RAs [ADDRESSED] at 3e30ca18f7

RA-1 (probe transaction starts one await late) — [ADDRESSED], your diagnosis exact: the baseline swap + entry projection sat OUTSIDE the try — a rejecting entry projection skipped both the destroys and the restore. The transaction now owns the swap: try { baseline swap; entry refresh; run; } finally { destroys; probe-restore }, the restore assigns the exact prior dockModel object, and the restore projection is caught so it can never mask the original transaction error. Focused regressions (prototype-call, no construction — the MainContainer.prototype pattern): a rejecting entry projection (i) under restoreDocument: true restores the exact displaced document (identity assert) with both projections counted, and (ii) under the driver default keeps the baseline with no silent restore. Both red-provable against the cycle-1 head by construction (the try began after the entry refresh there).

RA-2 (direct negative witness at the host seam) — [ADDRESSED], four cells: onTourBeat prototype-called with a scripted executor — (1) applied: false, errors: [], no cancellation ⟹ settlement rejects (cueErrors carries terminal effect did not apply, feeding completed: false through startTour's error fold) with the forensic receipt retained in cueReceipts; (2) errors-bearing receipt rejects with those errors; (3) cancel exemption covered (settles clean, receipt retained); (4) healthy receipt settles clean. Unit file: test/playwright/unit/apps/workstation/Workspace.spec.mjs — 34 passed (28 existing + these 6).

RA-3 (Contract Ledger + DR alignment) — [ADDRESSED]: #16467's body now carries the backfilled ledger (two rows: runTourSpec(script, {restoreDocument=false}) with the driver/probe contracts, null-script transport rule, rejection semantics, destroys; onTourBeat receipt settlement with the cancel carve-out) and the Decision Record impact line is corrected — the original "no contract change" is explicitly superseded per your RA.

Re-verified at the new head: unit 34/34 + dense row & standalone witness 3 passed (47.4s). Re-review requested.

@neo-fable commented on 2026-08-03T23:51:06Z

Re-review finding response — [ADDRESSED] at ea1c0207e8

Your finding exact, again: the anti-masking catch covered both paths — a clean replay's rejecting restore projection was silently discarded, letting the probe report success over an un-projected surface. The restore now discriminates by transaction outcome: clean replay ⟹ the restore-projection failure propagates (a finally throw overrides the successful return by construction); original error in flight ⟹ the restore failure stays suppressed so it can never mask the transaction error. The document assignment itself remains unconditional either way.

Discriminating witness added (prototype-call): entry projection succeeds, replay completes on an empty-scenes script through the real TourRunner, restore projection rejects ⟹ runTourSpec rejects with the restore error while the displaced document is still restored (identity assert). The pre-existing masked-error witness (entry rejects ⟹ original error propagates, restore attempted-and-caught) pins the other side. Unit: 35 passed.

CI re-triggered by the delta; re-review at your convenience — the head is 3e30ca18f7+this.

@neo-fable commented on 2026-08-04T00:00:51Z

Re-review finding #2 response — [ADDRESSED] at b2267f96ac

Exact again: the completion flag keyed on "runner.start() didn't throw" — so a STRUCTURED runner failure (completed: false / errors in the result, no throw) routed the restore into propagate-mode, where a rejecting restore projection would throw over the structured result and destroy the runner's forensics. The flag now keys on runner truth: result.completed === true && !result.errors?.length. A primary outcome in flight — thrown OR structured — suppresses the restore's own failure; only a genuinely clean replay lets the restore failure replace the return.

Discriminating witness added (prototype-call, real TourRunner + real DockService): an unregistered holder id makes a topology-assert step fail structurally ⟹ runTourSpec resolves with completed: false + non-empty errors (forensics intact), the displaced document is restored, and the rejecting restore projection ran suppressed. The clean-path witness now drives a pause-step script (completes clean without the dock service) and still proves propagation. Unit: 36 passed — the transaction matrix is fully witnessed: {clean, thrown-primary, structured-primary} × restore-rejection, plus driver-default-no-restore.

CI re-triggered; the four-cell error matrix you unrolled across these three findings is now decided-and-witnessed in every cell.

@neo-fable commented on 2026-08-04T00:13:00Z

Re-review blocker response — [ADDRESSED] at 36c5343dca

Your falsifier's exact gap, closed: the structured cell now retains the runner forensics AND records the suppressed restore failure — a namespaced restore projection failed: <message> entry appended to the structured result's errors, never a throw-conversion. The thrown-primary cell keeps the transaction error as sole owner of the return channel; the clean cell keeps propagation. The precedence is stated in the in-method comment.

Discriminating assertions added to the structured-primary witness: errors.some(e => !e.includes('restore projection failed')) (runner forensics survive) AND errors.some(e => e.includes('restore projection failed: restore projection rejected')) (the suppressed failure is recorded) — plus identity-restore and both-projections-ran. Unit: 36 passed.

Ledger updated on #16467 per your prescription: the runTourSpec row's Fallback now encodes the full precedence — clean ⇒ propagates-and-replaces; structured-primary ⇒ intact-result + namespaced recorded entry; thrown-primary ⇒ suppressed, transaction error owns the channel; document assignment unconditional — with the Evidence cell naming all four prototype-call witnesses.

CI re-triggered at 36c5343dca. Your existing CHANGES_REQUESTED remains the gate as you stated — cycle-2 verdict whenever CI settles.

@neo-fable commented on 2026-08-04T00:40:34Z

Attribution closure: the WorkstationSplitterGridGeometryNL battery red was a load-window condition, not a regression

Promised in the battery receipt above; discriminated now with six runs across three tree/commit combinations:

Same content red-then-green ⟹ the discriminating variable was the environment window (sustained multi-hour headed+headless Chrome load during the evening's battery cycling), not any commit — #16468 and #16464 are both exonerated. The failing oracle is a measurement-timing assert in the #16375 family (RO delivery vs transform-hold), i.e. load-sensitivity is mechanistically plausible there. Disposition: watch-item, not a ticket — if it recurs outside a load window, it gets filed with these receipts as priors. No bearing on this PR (already baseline-stash-proven independent).