Stop cross-window transfers from invalidating dockZone.v1

Context

While implementing the real two-window scene in #14772, the detached-topology capture became the first integration falsifier for the cross-window transfer output shipped by #14769 / PR #15017. The transfer itself succeeds, but DockZoneModel.captureTopologyPerspective() rejects the receiving document:

windowDocuments[0] contains unexpected field "owningWorkspaceId" at windowDocuments[0].items.workbench.owningWorkspaceId: field is outside the saved-layout schema

Live source inspection found exactly one production writer for owningWorkspaceId / fallbackTarget—DockCrossWindowParticipation after DockZoneModel.transferItem()—and no production reader. The existing unit asserts the write, so its green result currently certifies the schema violation rather than the persistence contract.

The Problem

DockCrossWindowParticipation#commitOperation() mutates the transferred item record before publishing the source/target pair. Those two loose fields are not members of the finite dockZone.v1 item schema, so a valid atomic transfer yields documents that can still drive the live projection but cannot be captured as a saved topology.

This also violates the executor's record-verbatim invariant: DockZoneModel.transferItem() moves the catalog record unchanged, while the adapter immediately changes its shape. The splitNode hint is additionally premature: it records the original target node even though the operation creates a new item-specific tabs node.

The failure is architectural, not Demo-B-specific. Stripping fields inside the demo, capturing before the transfer, or capturing after reattachment would merely hide the shared producer defect and erase the changed-topology proof.

The Architectural Reality

• dockZone.v1 is the finite, per-workspace document contract. Unexpected item keys fail closed at capture/validation.
• DockZoneModel.transferItem() owns the atomic two-document tree/catalog change and preserves the item record verbatim.
• ADR 0029 §2.1/§2.2 places durable window placement intent in a separate, still-pending windowPlacementHints layer on the topology envelope—not inside item records.
• ADR 0029 §2.3 also says hints update in the same transfer commit. That statement is only implementable once a workspace-set transaction owns {sourceDocument, targetDocument, hintLedger}. DockCrossWindowParticipation currently owns only the document pair and cannot truthfully provide that atomicity.
• No current runtime consumer reads these hints. Demo B intentionally reports a missing second window as an unrestored remainder; adding semantic recovery here would change the feature contract rather than repair it.

Structure-map gate: npm run --silent ai:structure-map -- --files --loc was run. Placement is N/A for new files: this correction edits the existing src/dashboard participation sibling, its existing unit, and ADR 0029.

The Fix

1. Remove the loose owningWorkspaceId / fallbackTarget writes from DockCrossWindowParticipation and correct its JSDoc to describe the actual document-only, record-verbatim commit.
2. Replace the hint-on-item unit with executable regressions for both addTab and splitNode: exact transferred-record identity, finite-schema-valid source/target documents, and successful captureTopologyPerspective() after publication.
3. Amend ADR 0029 §2.3/§2.4 so hint updates are conditional on the future placement layer participating in a workspace-set transaction. Keep the separate-layer and semantic-recovery direction; remove the false claim that today's document-only participation already updates it atomically.
4. Keep #14772's post-transfer topology capture as the whitebox integration tripwire.

Contract Ledger

Decision Record impact

Amends ADR 0029. The separate hint layer and semantic-recovery direction remain; the amendment corrects commit ownership and sequencing. It removes the impossible implication that a document-only adapter can satisfy a not-yet-existent three-part transaction.

ADR successor-risk: adr-amendment-required — artifact this ticket (2026-07-14); ADR 0029 is accepted on dev; fresh evidence is the exact topology-capture rejection plus the live writer/reader sweep; route: amend ADR and implementation in the same PR.

Acceptance Criteria

• Cross-window addTab and splitNode transfers publish the original item record verbatim; neither result contains owningWorkspaceId nor fallbackTarget.
• Both source and target documents remain valid finite dockZone.v1 documents after each transfer.
• DockZoneModel.captureTopologyPerspective() succeeds over each published two-document pair.
• Local drops, foreign/local discrimination, exact-once publication, and fail-closed transfer behavior remain unchanged.
• JSDoc and ADR 0029 describe the actual current transaction boundary and the future ledger owner without claiming shipped hint persistence.
• The focused participation unit and the dashboard unit blast radius pass.
• #14772's real post-transfer topology probe passes without app-local field stripping.

Out of Scope

• Implementing windowPlacementHints or choosing its final envelope spelling.
• Semantic fallback/recovery, changed-topology reconciliation, or automatic popup creation.
• Persisting window ids, coordinates, monitor geometry, or runtime target references.
• Changing DragCoordinator, DockZoneModel.transferItem(), or Demo B's scene order.

Avoided Traps

• Whitelisting the two fields in dockZone.v1 would make perspective-specific placement intrinsic item state.
• Nesting a placement object in each item has the same ownership error and still has no consumer.
• Building the whole ledger inside #14772 would couple a flagship demo to an unfinished persistence subsystem.
• Silently sanitizing capture output would weaken the validator and conceal invalid worker-owned truth.

Related

Parent #13158 · blocks #14772 · regression source #14769 / PR #15017 · executor predecessor #14768.

Live latest-open sweep: checked the latest 20 open issues at 2026-07-14T22:22:37Z; no equivalent found. A2A in-flight sweep: checked the latest 30 messages across all read states at 2026-07-14T22:22:37Z; no competing claim found.

Origin Session ID: adddb25d-fc36-4b08-b9a3-3a62a108cda1

Retrieval Hint: cross-window transfer invalid dockZone owningWorkspaceId fallbackTarget topology capture workspace-set hint transaction

Authored by Emmy (GPT-5.6 Sol Ultra, Codex).