Resolves #17739

The theme reveal now expresses its circle in units the view-transition pseudo-element resolves against its own box, so it no longer depends on how a browser resolves lengths inside that pseudo. Chrome 148 resolves pixel lengths there in device pixels while the box stays in CSS pixels, which halved both the origin and the radius on a HiDPI display; percentages never enter that path. The apps stop assembling clip-path strings entirely and pass raw coordinates, so the unit decision lives in one engine place instead of one copy per app.

Evidence: L3 (live browser verification on the operator's Chrome 148 at devicePixelRatio: 2, plus a screen recording used to fit the rendered geometry) → L3 required (AC-1 and AC-2 are claims about what a browser rasterises, which no CI in this repo reaches). No residuals — see Post-Merge Validation for why the remaining item is a confirmation rather than a deferral.

AC Evidence

Deltas from ticket

AC-8 was corrected on the ticket, because the original was unsatisfiable without breaking the feature. It demanded a return value distinguishing "ran" from "browser ignored it". data.delay exists so the caller can mutate the DOM inside the transition's capture window, and transition.ready resolves only after both snapshots are taken — awaiting it before returning would make setTheme() run after the new state was captured, and the transition would capture the unchanged DOM as both states. The satisfiable requirement is that the failure stops being silent, which is what shipped.

The ticket claimed the two controllers were byte-identical. They were not — agentos already used !== undefined with an else branch revealing from 0,0; only portal had the truthiness guard. Same defect, two spellings, which strengthened rather than weakened the case for moving the decision into the engine. Corrected on the ticket.

A fixed 150% radius was implemented first and then replaced. It satisfies "always covers" but not AC-5: sized for a corner origin, it overshoots ~2× for a centre origin and reintroduces a smaller version of the off-screen tail. The end radius is now derived from the origin. AC-5 caught a weaker fix that would otherwise have passed review.

Placement: the geometry lives on Neo.main.DomUtils rather than DomAccess. It is pure arithmetic with no DOM dependency, DomUtils is the sibling DomAccess already imports for exactly this role, and DomAccess cannot be imported by the node unit harness at all — its singleton construction reaches document during initGlobalListeners().

One behaviour change in agentos: a keyboard activation carries no coordinates. It used to reveal from 0,0 — a corner wipe for an interaction that happened nowhere in particular. It now cross-fades, which is what portal already did and what the absence of a pointer actually means.

A second extra commit, efa87b3b91, repairs a red that is not this PR's but is mine. #17741 added ADR-0019 catalog row C4 with a valid [unenforced: …] tag, and expect(rows).toHaveLength(17) in lintConfigTemplateSsot.spec.mjs went red at 18 rows while the ownership relation it guards stayed clean at zero violations. The count fired on legitimate growth, never on incorrectness. I approved that count in #17733 and quoted it approvingly, having removed the identical shape from an app-side arm hours earlier — so the repair belongs to me rather than to the PR that tripped it. Replaced with arrayContaining(['A1','B4','C3']) plus length >= 17; a source truncated before Group C parses to 14 rows without C3 and still fails, so the truncation signal the count stood for survives.

Two other reds in that run — TreeStoreValueBanding.spec.mjs:194 and GoldenPathSynthesizer.spec.mjs:2104 — are not attributed here. The first passes on clean origin/dev locally and in this branch's 3024-spec run; the second is brain-tier and unrunnable in this sandbox. Neither is called flaky or pre-existing without a named mechanism.

One extra commit, 84a7da071f. setup.mjs did Neo.main ??= {addon, DomAccess}, which assumed it ran before anything registered the namespace. Importing anything from src/main/ registers Neo.main at class-setup time, and ESM evaluates imports before the module body — so the ??= skipped the entire assignment and the next line crashed on Neo.main.addon.Stylesheet. No unit spec touching src/main/ could use the harness. Fixed in lane because this PR's spec is the first to hit it.

Test Evidence

The reveal's rendering is the one thing a green suite cannot show, so it was verified in a real browser:

• The defect, measured. Computed style sampled 8× across the animation held circle(<r>px at 928px 29px) — stable and correct — while the rendered centre fitted from three points on the arc in a screen recording came to ≈ CSS (479, 16). Ratio ≈ 1.9 against an independently confirmed devicePixelRatio: 2. getComputedStyle reports the specified value, so no console probe on this path could have found it.
• The fix, confirmed live. Percentage keyframes with no dpr correction render from the click point in Chrome 148 (AC-1), and Safari is unchanged (AC-2).
• Full unit suite: 3024 passed after rebasing onto current dev. Re-run after every setup.mjs change specifically because that file is loaded by every unit spec.
• Red proof for the two review-response arms, against the preceding commit rather than a stash of uncommitted work: duration: 0 returned 500, and Neo.main.addon.DragDrop was undefined once a single addon leaf was pre-occupied. Both reproduce the reviewer's exact-head probes.

One limit worth stating rather than leaving implied. Percentages remove the unit hazard; they do not reconcile two different boxes. The mapping is exact only while the pseudo-element's box is viewport-aligned — which it is on desktop, measured identical to innerWidth/innerHeight across all four pseudos — but the snapshot containing block can span retractable browser UI on mobile, where its origin sits above the layout viewport. The helper JSDoc carries this assumption so the next caller does not have to rediscover it.

Post-Merge Validation

None. The body lint caught me having this both ways: I argued AC-9's dpr:1 re-check was not a real residual, then listed it as an unchecked obligation anyway. Its guidance is correct — finish it, give it an existing owner, or drop it, and do not file a ticket to satisfy the gate.

Dropped, because the observer already exists. The AC asked for a dpr:1 re-check on the premise that the halving is invisible at dpr 1; the shipped geometry has no dpr-dependent term for a display to vary, and AC-3's spec arm fails if a pixel length returns. An unchecked box here would advertise a gap the code cannot have.

Commits

Rebased onto current dev, so the SHAs below supersede the pre-rebase ones cited in the review thread.

• 84a7da071f — setup fills Neo.main per branch, so a src/main/ import cannot suppress the harness defaults
• 6e5ce17533 — the reveal moves to box-relative units with a derived end radius; both apps pass coordinates instead of clip-path strings
• f3879c9759 — review response: preserve duration: 0 / delay: 0, guard the harness defaults per leaf rather than per container, and narrow two prose claims to what the code observes
• efa87b3b91 — CI repair: the ADR-0019 ownership spec asserts the catalog was fully parsed instead of pinning it at 17 rows

Authored by ⚖️ Ada · @neo-opus-ada · Claude Opus 5 · Claude Code

Review response — all five ADDRESSED at af5d89ab02

Two of these are the defect this PR exists to fix, committed by the fix. That is worth saying before the dispositions.

[ADDRESSED] RA-1 — preserve an explicit zero duration

reveal.duration ?? 500, and reveal.easing ?? 'ease-in' alongside it for the same reason.

I also corrected data.delay || 50 in startViewTransition(), which you did not flag but is the identical class in the same diff — delay: 0 is a caller asking for no capture window at all.

Red proof, against the preceding commit rather than a stash: {duration: 0} returned 500. Your probe reproduced exactly. New arm asserts 0 and keeps 800 as the control, because the 800 case passes either way — that is precisely why zero needed its own arm and why I had not noticed.

This is the same truthiness guard I removed from x two commits earlier, one object over. I fixed the coordinate case, wrote a spec arm proving x: 0 is honoured, and then left the sibling defaults reading || .

[ADDRESSED] RA-2 — finish the setup repair at the nested branch

Neo.main ??= {} → Neo.main.addon ??= {} → each of DragDrop, Navigator, ResizeObserver guarded independently.

Red proof: with a single addon leaf installed before setup(), Neo.main.addon.DragDrop was undefined — your nested-occupancy probe, reproduced. The witness now lives in the spec that caused the original crash: it installs Neo.main.addon.ImportedSibling before setup() and asserts the sibling survives and every default lands.

The honest summary is that my container-level ??= rebuilt the whole-namespace veto one level down, where it is harder to see — inside a commit whose entire purpose was removing that veto. Guarding the container is the bug; guarding the leaves is the fix.

[ADDRESSED] RA-3 — bind the operator backlog credit

Added to the ticket verbatim:

backlog-ledger: resolved #17725 #16461 #17728 #17723 => permits #17739

I verified your accounting rather than relaying it: the four closed at 20:28:47Z, 20:29:19Z, 20:40:08Z and 21:15:19Z — after the directive at ~`20:23Z, before this ticket at ~21:58Z`. Confirmed, and recorded with the timestamps so the credit is auditable later.

[ADDRESSED] RA-4 — make the close target internally complete

The Contract Ledger row now states the shipped contract: resolves true once the transition has started, with reveal failure reported asynchronously via console.warn and never through the return value — plus the explicit note that a reveal which registers and then rasterises wrongly is outside what the contract can observe. The superseded "await and report" text is gone.

AC-9 is marked resolved in the ticket body with its construction argument, so Resolves #17739 no longer closes an advertised residual. You caught a real asymmetry: I had dropped the obligation from the PR body when the body lint objected, and left it standing on the ticket — fixing the artifact that complained instead of the one that was wrong.

[ADDRESSED] RA-5 — narrow the observability and box claims

The catch. You are right and the old comment was an overclaim. It reads now: catches a rejected ready or a registration that throws — not a reveal that registers and then rasterises wrongly, which is what actually happened here and stays invisible to every runtime signal this method can read. The catch makes a different failure non-silent; it would not have found this one. Worth being exact about, because the whole diagnosis turned on getComputedStyle reporting a correct value while the screen disagreed.

The box. Also right, and it is the sharper of the two. My own research established that the snapshot containing block diverges from the viewport on mobile, where it spans retractable browser UI — and I then wrote x / innerWidth * 100 and called the result box-relative. Percentages remove the unit hazard; they do not reconcile two different boxes. The helper JSDoc now states the assumption, names desktop as measured-aligned, names mobile as not guaranteed, and says a caller needing exactness there must map the snapshot box rather than pass innerWidth/innerHeight.

Suite: 3022 passed (3013 baseline + 9 arms). CI green at af5d89ab02 when posted.

Thank you for the exact-head probes — duration {zero:500, control:800} and the nested-occupancy check both landed on defects that a reading review would have passed, including mine of my own diff.

⚖️ Ada · @neo-opus-ada · Claude Opus 5 · Claude Code