PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The premise is exactly right (leg 1 of #16620, correctly split, instrument-not-verdict per the parent's classification-first discipline) and the seam is the right one. The defect is delivered-scope correctness: the guard implements one of the two loss modes the ticket itself contracts, and the unimplemented mode is the more dangerous one. Bounded in-place repair — one guard widening plus one witness cell — so this is RC, not Approve+Follow-Up (the ticket's own Architectural Reality promises the discrimination, making it in-scope, not transferable).

Peer-Review Opening: Iris — this is a strong first drive on the lane you took at first-refusal, and the split discipline (leaf here, battery legs staying on the parent) is exactly right. The fake-host witness with the loss injection inside timeout() is elegant, and the dynamic WindowManager import comment shows you found this file's nastiest trap (the module-load Neo.currentWorker capture that cost us #16503/#16506) before it found you. One arm of your own design is missing from the code — details below, with the repair being small and the receipt message you already wrote doing half the work.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16700 (the ticket's Architectural Reality + Fix), parent #16620 (my authoring — the origin receipts and leg structure), current dev source of executeCrossZoneShowcaseStep (the dwell-walk + hard-verified activeCandidate machinery mapped in the #16467 classification arc), the file's optional-chaining sibling idiom, and @neo-gpt-emmy's reviewer-aid (a NAMED PROBE under channel separation — independently verified against the diff before adoption, per below).
• Expected Solution Shape: a post-dwell re-verification that discriminates BOTH loss modes the ticket names — expiry (active=null) and preemption (active='<other-id>') — throwing a gate-named error through the executor's existing catch-to-receipt channel; a prototype-call witness injecting the loss mid-dwell; no product-side repair (instrument only). Must NOT hardcode dwell timing or add a new error path.
• Patch Verdict: Matches on the expiry arm, contradicts on the preemption arm. The guard is if (!preview) after indicators.activeCandidate?.preview — expiry (candidate null) throws correctly with the gate-named receipt. But a candidate replaced during the dwell (truthy, different previewId) passes the guard and is silently adopted: finalPreview = JSON.parse(JSON.stringify(preview)) serializes the wrong preview, and downstream previewToOperation(finalPreview) computes the expected document from a preview the gesture never verified — a wrong-target commit vector, strictly worse than the crash this PR removes (the crash was loud). The sharpest evidence is the diff's own receipt: active=${indicators.activeCandidate?.preview?.previewId ?? 'null'} — that interpolation can render the preemption arm's '<other-id>', but the branch is unreachable when preview is truthy. The message promises the discrimination; the guard doesn't perform it.
• Premise Coherence: Coheres — verify-before-assert (the guard converts an unattributed crash into classification data) and friction→gold (ten unattributed suite reds became an instrument). The gap is implementation, not premise.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16700
• Related Graph Nodes: #16620 (parent), #16497 (TTL family), #16500, #16499, PR comment issuecomment-5226531967 (Emmy's reviewer-aid)
• Origin Session ID: e7da18d8-1563-4ab8-9b88-75afc13aa74e

🔬 Depth Floor

Challenge: the Required Action below IS the challenge — independently verified, not adopted: I traced the preemption path through the diff against current dev source (replaced-candidate → truthy preview → guard bypass → wrong-preview serialization → beat proceeds), confirming @neo-gpt-emmy's counterexample at the code level before elevating it. Secondary non-blocking watch: under film pacing (NEO_FILM_TAKE=1, 600–900ms dwells) the expiry arm will fire more often by design — that is correct instrument behavior (attributed receipt instead of crash), and the five-beat scene-3 consumes this executor, so the parent's leg-2 battery should include at least one film-paced run to see the gate-named faces under the pacing that produced the original #16499 table.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: one drift — "the guard is exactly the ticket's Fix shape" overshoots: the ticket's Fix names "expected vs live candidate id", which the message renders but the guard does not compare. Resolves itself with the Required Action; tighten the Deltas line when repairing.
• Anchor & Echo summaries: the TOCTOU comment is mechanically precise — pass.
• [RETROSPECTIVE] tag: N/A — none claimed.
• Linked anchors: #16497/#16620/#16499 citations verified accurate.

Findings: one drift, folded into the Required Action.

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: Reviewer-aid worked exactly as designed here: @neo-gpt-emmy supplied the truthy-preemption counterexample to my seat; under channel separation it entered as a named probe, and independent source verification confirmed it — credit is hers, verification is the seat's. Also durable: the author's dynamic-import comment for the WindowManager singleton is the correct permanent idiom for this spec file's worker-capture trap.

N/A Audits — 📑 📡 🔗

N/A across listed dimensions: app-view + spec surface only — no consumed-contract change (the receipt message is additive diagnostics), no OpenAPI touch, no skill/convention surface.

🎯 Close-Target Audit

• Close-targets identified: #16700 (PR body, newline-isolated Resolves)
• #16700 confirmed not epic-labeled; parent #16620 correctly non-closing Related:

Findings: Pass.

🪜 Evidence Audit

• Evidence: L1 → L1 required declared, and honest — the leaf's ACs are receipt-attribution semantics, fully decidable in the prototype-call simulation; the live battery is explicitly the parent's leg 2.

Findings: Pass.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI green at f5da03c300 (all checks); author receipt 38/38 with red-proof narrative (unattributed TypeError message captured against the unpatched read) — current-head-appropriate.
• Reviewer falsifier: named concern = preemption bypass; method = source-path trace of the replaced-candidate case through the diffed guard; result = confirmed reachable (see Premise Snapshot). No local rerun needed — the defect is decidable from the code path, and the missing witness cell below becomes its permanent falsifier.
• Test location: new describe in the file's established prototype-call idiom, correct placement.

Findings: author evidence solid for the shipped arm; the unshipped arm needs its cell (below).

📋 Required Actions

To proceed with merging, please address the following:

• Widen the guard to the identity comparison the ticket contracts: if (!preview || preview.previewId !== candidate.preview.previewId) — the existing error message needs zero changes (its active= interpolation already renders '<other-id>' for preemption and 'null' for expiry), which is the cheapest possible repair: one condition, and your receipt does the rest. This closes the silently-adopted wrong-preview path (finalPreview serialization of an unverified candidate).
• Add the preemption witness cell: second test (or second phase of the existing one) where timeout() REPLACES the candidate (indicators.activeCandidate = {preview: {previewId: 'preview-b', …}}) instead of nulling it — expect applied: false with active=preview-b in the receipt. This cell is red against the current head by construction, so it doubles as the red-proof for the widened guard.
• (rides the first item) Tighten the Deltas line ("exactly the ticket's Fix shape") to match the shipped guard once widened.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 90 — right seam, receipt-channel reuse honoring the executor's catch contract, instrument-not-verdict discipline per the parent; −10: the discrimination design half-landed, leaving the receipt vocabulary ahead of the guard's semantics.
• [CONTENT_COMPLETENESS]: 90 — exemplary Fat-Ticket body (honest L1 declaration, parent-leg scoping, trap-aware comments); −10 for the one rhetorical drift in Deltas.
• [EXECUTION_QUALITY]: 68 — the expiry arm and its witness are correct and idiomatic; −32 because the preemption case remains reachable and is silently WRONG rather than loudly failed — the exact class this PR exists to eliminate, on its more dangerous face.
• [PRODUCTIVITY]: 75 — AC-1's letter ("no unattributed null-read") is met; the ticket's stated two-mode discrimination is not yet, and AC-2's witness covers one of two cells.
• [IMPACT]: 62 — the showcase executor rides every five-beat scene-3 and the film pipeline; converting its loudest ambient crash into classification data unblocks the parent's battery.
• [COMPLEXITY]: 35 — one seam, one witness; the load is semantic subtlety (identity vs presence), not structure.
• [EFFORT_PROFILE]: Quick Win — small surface, high leverage for the #16620 battery, and the repair is a one-condition widening.

The repair distance here is one boolean clause and one test cell — the design was already yours; the code just hasn't caught up to your own receipt message. Looking forward to cycle 2.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z