Resolves #16424

The active tab can no longer paint beneath the floating overflow control. Two changes in Neo.tab.plugin.Overflow, both at the layer the ticket's own reproduce-first AC surfaced: (1) in the degenerate active-never-hidden branch (active alone wider than the usable strip), applySplit now bounds the active button's box with an inline max-width — and because the persistent .neo-tab-button-indicator is an absolute child spanning that box, and the strip's crossfade indicator sizes from that rect, and the label lives inside it, all three painted layers inherit the correction from the single geometry they derive from; a neo-tab-overflow-capped cls turns the previously covered label cut into an honest ellipsis. (2) The reservation handed to computeOverflow is now max(controlWidth config, rendered control width) — the control's real width rides the same getDomRect round-trip as the extent (zero added latency), closing a measured 9px under-reservation (config 40, rendered 49) that let packed buttons underlap the control with no degenerate case involved. The cap lifts under the recapture latch before natural-width measurement, so a capped rect can never poison the natural-width cache. The pure computeOverflow core is untouched.

Evidence: L3 (live measured receipts on the workstation heavy header + red/green stash cycle + unit/e2e batteries below) → L3 required (the ACs are painted-geometry relationships). Residual: none.

Deltas from ticket

• Mechanism reframe (classification r1 on the ticket): the prescribed options clamp inside Strip.moveActiveIndicator, but reproduction showed the ticket's named element is a ~300ms crossfade flash (width: 0, opacity: 0 at rest — the ticket's own trap datum, now explained); the persistent segment is the per-button .neo-tab-button-indicator, and the BUTTON box is the root geometry. The fix moved one layer up so one owner corrects all three painted layers; Strip.mjs is deliberately untouched, and option 2's plugin↔Strip contract never becomes necessary.
• The "reserves correctly" out-of-scope premise was falsified by measurement (40 config vs 49 rendered), so the reservation-truth half landed here rather than as a papered-over constant bump — the measured width self-maintains across skins.
• Unit-stub seam update: the extent read changed shape (getDomRect() no-arg → getDomRect([ownerId(, controlId)]), one round-trip). The plugin unit spec's lean-owner stubs keyed on call arity; they now key on content (ids[0] === ownerId). Real component.getDomRect handles both shapes; no runtime consumer changes.
• AC5 verdict (vertical tab bars): the plugin packs widths against a horizontal strip extent and is mounted by dock compositions with top/bottom headers only; a vertical bar never mounts it, so the vertical moveActiveIndicator branch has no overflow control to collide with. Stated in applySplit's JSDoc rather than a vacuous vertical spec.

Test Evidence

New witness test/playwright/e2e/workstation/WorkstationTabOverflowCapNL.spec.mjs — the workstation heavy header stages the degenerate branch at default 1180x840 boot (twelve canonical titles in a narrow pane; the ticket author could not stage overflow because this composition is where it lives). Asserts, in symptom-first order: zero pressed-button ∩ control intersection anywhere, the capped box ends at the control edge, the per-button indicator spans exactly the capped box, maxWidth === floor(extent) − ceil(rendered control width) (AC4's same-value, render-grounded), ellipsis on the capped label, and full-width/no-cap on every ordinary header (AC3).

• Head: 1 passed ×4 (NEO_E2E_PORT=8156 npx playwright test workstation/WorkstationTabOverflowCapNL -c test/playwright/playwright.config.e2e.mjs --workers=1).
• Red-proof (fix stashed, themes rebuilt): 1 failed in 2.7s convicting on the symptom — Priority Alert Observatory: pressed button must not intersect the overflow control (the live baseline overlap measures 39.6px × 48px).
• Live receipts at head: cap 187px = floor(236.5) − ceil(49); capped box right 822.5 against control left 823; all pressed-button intersections 0; text-overflow: ellipsis computed.
• Unit: test/playwright/unit/tab/ + unit/dashboard/DockLayoutAdapter.spec.mjs → 62 passed (plugin file 23/23 ×3 head AND ×3 stashed-baseline; one early single-run flake of the theme-deferral test did not reproduce in 7 subsequent runs on either state).
• e2e adjacency: dashboard/DockTabOverflowNL (the generic floating-control journey: alignment, menu, partition, selection) + workstation/WorkstationNL full dense tour (26.2s — the tour drives this exact control via getPlugin('tab-overflow')) + overflow-menu theme test → 3 passed.

Surface coverage — src/tab/plugin/Overflow.mjs: unit/tab/plugin/Overflow.spec.mjs, e2e/dashboard/DockTabOverflowNL, e2e/workstation/WorkstationTabOverflowCapNL (new); apps/workstation: WorkstationNL, WorkstationTabOverflowCapNL.

Post-Merge Validation

• The operator's originating frame (heavy header, long active title beside the … control) shows the underline stopping at the control edge with an ellipsized label during the next film-take rehearsal.
• A dock composition with a customized control skin (wider than 49px) keeps buttons clear of the control — the measured reservation should self-maintain; worth one glance if any skin restyles .neo-tab-overflow-control.

Authored by Mnemosyne (Fable 5, Claude Code). Session 1913de09-6dc0-4d1e-a9a3-b51c33b46cdc.

Addressed Review Feedback

Responding to review https://github.com/neomjs/neo/pull/16490#pullrequestreview-4853058054 — both falsifiers were verified real against my original intent before repair (the "acceptable-by-construction" convergence claim in my own review brief was the exact thing your probe falsified; no rejected items).

• [ADDRESSED] RA1 — Give rendered control width an explicit lifecycle edge. Commit: 939965e069 Details: The create branch now installs observeConfig(control, 'mounted') — the mount itself re-projects, so the pass that creates the control converges estimate→rendered as the plugin's own lifecycle, and every later re-mount re-measures its fresh embodiment. Theme flips re-project through onOwnerThemeChange (the getDomRect round-trip queues behind the theme update on the same channel, so it observes the re-skinned control). The PR-body overclaim you flagged in the Rhetorical-Drift audit is now backed by these two edges plus the ordinary per-pass re-measure. Deterministic regression as asked: render-truth edge: the pass that creates the control converges estimate→rendered at mount, no external event needed starts at control === null, pins your falsified state as the intermediate contract (measuredControlWidth: null, cap 196, projectQueued: false), then reaches the 49 reservation / 187 cap with the mount flip as the only event — no resize, activation, or tab mutation.

• [ADDRESSED] RA2 — Preserve caller-owned maxWidth exactly. Commit: 939965e069 Details: Provenance now lives in an appliedCaps ledger (button id → the caller's maxWidth config value at cap time); property presence is never provenance. The cap moved from the style object to the public maxWidth config channel — one channel, one vdom owner (changeVdomRootKey), and the consumer's style.maxWidth is now never touched at all. Clear and recapture operate only on ledger members and restore the exact recorded value (recapture restores it reactively for true-natural measurement — a silent write would leave the capped vdom in place — and never re-records the plugin's own cap as prior). destroy() restores all recorded values so a dock rebuild cannot strand a cap. Both asked cells are pinned: a consumer-configured maxWidth is never plugin residue (ordinary + recapture passes, config 120 and style: {maxWidth: '120px', color: 'red'} both byte-preserved) and cap → recapture → no-overflow restores the exact caller value (caller ceiling 300 recorded → capped 196 → recapture holds provenance → restored exactly 300, marker cls removed, ledger empty).

Cycle-caught delta, for your re-review scope: the RA1 theme edge exposed a pre-existing churn class — syncControl rewrote identical menuList.items on every projection, which rebuilds the dropdown and closed an OPEN menu mid-interaction (caught by WorkstationNL's overflow-menu theme test going red on the first repair head). syncControl now carries a hiddenSignature idempotence gate: only a changed partition touches the menu; re-arm and re-align stay unconditional.

Evidence at 939965e069: unit 26 passed (23 carried + the 3 new pins); e2e dashboard/DockTabOverflowNL + workstation/WorkstationNL (full dense tour + the overflow-menu theme test back green at 1.6s) + workstation/WorkstationTabOverflowCapNL → 4 passed.

CI is running on this head — the actionable re-review request follows at green per the CI-green gate.

Origin Session ID: 1913de09-6dc0-4d1e-a9a3-b51c33b46cdc