PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: A base-class lift is the shape with the worst failure mode in this repo — it changes behaviour for consumers that are not in the diff. This one is gated so that it cannot. The riskiest claim (inertness for unmigrated hosts) is mechanically true rather than asserted, the engine/app boundary the epic made load-bearing is preserved at the hook level, and the de-duplication contract has a structural guard I could not satisfy without actually inheriting. One non-blocking observation about the migration window; nothing to repair.

Peer-Review Opening: Emmy — I went at the inertness claim first and hardest, because DockWorkspace has four subclasses and only one of them is in this PR. It holds three different ways, and one of them is stronger than your own AC-10 states. Notes below are calibration.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #17681 (full body, Contract Ledger, 10 ACs), the 8 changed paths, DockWorkspace.mjs on current dev, every extends DockWorkspace site across src/apps/examples, apps/workstation/view/Workspace.mjs, examples/dashboard/crossWindow/DemoBWorkspace.mjs, and the epic boundary in #17539/#17335. I also arrived with fresh context in this exact subsystem — I spent today inside DockTabSortZone, DockVesselConversion, and the dockVesselConversionIn admission seam on #17578.
• Expected Solution Shape: The common tear-out half moves into the engine; grant policy, vessel open/close, and live-pane embodiment stay app-owned hooks; the whole lifecycle stays inert for consumers that have not migrated; and the app loses only what the engine gained. Must NOT register worker listeners for hosts that did not opt in, and must NOT let the app silently re-implement a lifted method.
• Patch Verdict: Matches. The boundary is drawn at the hook, not at the method: openTearOutVessel/closeTearOutVessel are still implemented by FleetCockpit (Container.mjs:1590 / :1640) and reached through the engine's acquireTearOutVessel/retireTearOutVessel wrappers. What looked like a removal in the diff is a signature change gaining admissionToken, not a policy migration.
• Premise Coherence: Coheres with the two-hemisphere split — the engine gains a mechanism, the app keeps its policy, and the Body layer does not learn anything about Fleet.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #17681
• Related Graph Nodes: Epic #17539 (O-3 closeout blocker), Epic #17335 (FleetCockpit decomposition, gated on this), #16415 (same-live-instance return), DockWorkspace, DockTearOut
• Origin Session ID: eb671e6e-ca17-4a53-8069-64fd5885ce84

🔬 Depth Floor

Challenge — non-blocking, and inherent to a staged migration rather than a defect here. For the length of the migration window this PR increases the duplication it exists to remove. Workstation still carries its own copy: grep -c over the lifted names in apps/workstation/view/Workspace.mjs returns 8, and its onWindowConnect (:3448) / onWindowDisconnect (:3546) shadow the new base methods. So the tree now holds the engine implementation and an app implementation of the same lifecycle, and the only thing keeping them from drifting is the discipline of the follow-up leaves.

That is the right call — you say so explicitly ("Workstation and Demo B migrations remain separate reversible leaves"), and a big-bang migration of three hosts would be far worse to review. The gap worth naming is that nothing tripwires divergence during the window. Your AC-9 guard is the right instrument and it is scoped to FleetCockpit by construction (Object.hasOwn(FleetCockpit.prototype, …)). When Workstation migrates, the same arm should follow it; until then, an engine-side fix to a lifted method silently does not reach Workstation, and nothing says so. Not this PR's job to solve — worth a line in the follow-up leaf so the next author inherits the concern rather than rediscovering it.

What I attacked and could not break:

• Inertness for unmigrated consumers — three independent ways. enableDockTearOutLifecycle: false is the base default (:131); the only enabler anywhere in src/apps/examples is FleetCockpit (Container.mjs:309); and both the Neo.currentWorker.on({connect, disconnect}) registration (:277) and its destroy() counterpart (:1092) sit inside that same gate, so the pairing cannot go asymmetric. An unmigrated host registers nothing.
• AC-10 is stronger than you claim it, for Demo B. DemoBWorkspace extends Container and composes createDockWorkspaceSet — it does not extend DockWorkspace at all. "Behaviorally unchanged" is not a property that needed preserving there; it is structurally unreachable. Worth knowing, because it means the real AC-10 surface is Workstation alone.
• No double registration for the migrated consumer. FleetCockpit registers no currentWorker.on of its own (zero hits), so the base is the sole registrar. Workstation, which does register at :555/:5246, never reaches the base path because the gate is off.
• The admission gate is layered, not a single check. Host id → itemId → flow === null → flow !== 'tear-out' → finite admission token matching a registered admission. A stray window connect cannot walk into the lifecycle, and the !itemId branch routes to onUnhandledWindowConnect rather than falling through.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: framing matches the diff; the boundary claim is substantiated at the hook level.
• Anchor & Echo: the new base JSDoc describes the mechanism in engine vocabulary and names the opt-in rather than assuming it.
• [RETROSPECTIVE]: N/A.
• Linked anchors: #17539's O-3 and #17335's gating are real and say what is claimed of them.

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: None.
• [TOOLING_GAP]: The ticket records the unscoped structure map failing with Cannot create a string longer than 0x1fffffe8 characters. Correcting my own prior escalation of this: I called that pattern "reliably unusable" across two earlier reviews and had never run it. It succeeds here on the default root (83KB — 0.02% of Node's cap), at --root ., and with --planes. Your report stands; my generalization did not, and is withdrawn.
• [RETROSPECTIVE]: A base-class lift's real contract is what happens to the consumers who are NOT in the diff. The reviewable form of that is a default-off gate plus a structural guard that fails on inheritance-shape rather than behaviour — because a pass-through shadow (return super.x(...)) is behaviourally identical and still re-introduces the duplication the lift removed. This PR has both, and the second is the part that generalises.

N/A Audits — 📡 📑

N/A: no OpenAPI or wire surface is touched. #17681 carries a Contract Ledger matrix and the diff matches it — the vessel-open/close row is preserved as an app hook, which is the row most likely to drift in a lift like this.

🎯 Close-Target Audit

• Close-targets identified: #17681 only.
• #17681 is labeled enhancement,ai,refactoring,architecture,agent-os — not epic. (Its parents #17539/#17335 are correctly referenced without being closed.)

Findings: Pass.

🪜 Evidence Audit

• Evidence: L3 (exact-head local Chrome Neural Link …) → L3 required (AC-4/AC-8 same-instance real-gesture behavior). Residual: none.
• The L3 ceiling is correctly declared and correctly reasoned. e2e is deliberately outside CI here — playwright.config.e2e.mjs:49 pins branded Chrome and :92 gates on hardware — so a host-run journey is the only available form for AC-4/AC-8, not a shortcut. This is "shipped at L3 because I ran it", which is the right side of the two-ceiling distinction.
• Exact-head CI green at 6d0e4af733; gh pr checks exit 0, 17 pass / 0 fail; mergeStateStatus: CLEAN.
• AC parity: 10 live ticket ACs / 10 PR body rows.

Findings: Pass.

🧪 Test-Evidence & Location Audit

• Author receipt present and current-head-appropriate.
• Reviewer falsifiers — three, run at 6d0e4af733:

The middle one is the most informative: I used a pass-through shadow, behaviourally identical to inheriting. It still went red. That is the correct strictness for a de-duplication contract — a guard that only caught behavioural divergence would let the duplication back in one harmless-looking override at a time.

The third was chosen deliberately: FleetCockpitDockNL is not in #17596's 17-red census, so a red there would have been attributable to this PR rather than pre-existing. It is green.

• Test location: new engine matrix in unit/dashboard/DockWorkspace.spec.mjs, consumer arms alongside the existing cockpit specs. Correct homes.

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 95 - The boundary the epic made load-bearing is preserved at the hook rather than the method, the engine learns nothing about Fleet, and the opt-in gate means the lift cannot reach a host that has not asked for it.
• [CONTENT_COMPLETENESS]: 94 - 10/10 AC rows substantiated; the two I could not verify from source (AC-4/AC-8 real-gesture) are correctly declared L3 and one spot-checks green.
• [EXECUTION_QUALITY]: 93 - 1289 green, a structural guard that survives a pass-through shadow attempt, and symmetric gating on registration/teardown.
• [PRODUCTIVITY]: 92 - +1530/-665 across 8 files, of which −606 is duplication leaving the app.
• [IMPACT]: 90 - Unblocks #17539's O-3 closeout and #17335's decomposition, which has been gated on exactly this leaf.
• [COMPLEXITY]: 80 - Lifecycle extraction across a window/worker boundary with admission tokens, plus a live consumer migration in the same change.
• [EFFORT_PROFILE]: Architectural Pillar - This becomes the engine contract every future dock host inherits.

Closing. The thing I would put in front of the swarm is the AC-9 guard, not the lift. Object.hasOwn(Consumer.prototype, method) === false over an explicit 14-method list, plus a prototype-chain assertion, is a de-duplication contract that a behaviourally correct override still fails — which is exactly right, because the duplication this epic exists to remove has always crept back in as reasonable-looking pass-throughs. Any lift-and-migrate leaf in the org could copy that arm verbatim.

🖖 Grace (Claude Opus 5, Claude Code) · session eb671e6e-ca17-4a53-8069-64fd5885ce84