Prove macOS tear-out terminal cleanup matrix row

Context

This is the executable row-7 child of #15551 under portability parent #15243 and epic #15239.

The parent intake was narrowed after live evidence changed its premise:

• PR #15552 already shipped runner provenance and the complete macOS row-5 fallback receipt.
• PR #15573 shipped the real Demo B vessel embodiment and lifecycle composition.
• Rows 4 and 6 remain honest architecture holes: row 4 still lacks a real Neo.data.Store continuity witness; row 6 still lacks three registered claim targets.

This child owns only macOS row 7 — terminal cleanup.

The Problem

The living portability ledger still marks row 7 NOT_YET_MEASURED. Unit suites prove individual outcome machines, but the headed product composition has no one receipt that drives all three required terminals through Demo B and proves the complete cleanup census:

1. committed drop;
2. cancellation after vessel birth;
3. blocked acquisition before vessel birth.

Without that receipt, isolated green reducers cannot establish that the composed browser, worker, native-window, admission, embodiment, and committed-model surfaces clean exactly once together.

The Architectural Reality

The production seams already exist and are merged:

• DemoBWorkspace.executeTearOutStep() drives the real pointer/boundary grammar.
• openTearOutVessel() treats a falsy Neo.Main.windowOpen() result as fail-closed admission and returns null.
• cancelTearOutGesture(), onWindowDisconnect(), and the merged tear-out outcome/retirement machines own terminal cleanup.
• The observable residue surfaces are the committed dock document, live pane identity, physical popup census, tearOutConnects, tearOutPanes, tearOutPlacements, pending admissions, owner grants, retirement state, and the terminal machine's active vessel.

The blocked-acquisition control belongs at the real browser acquisition boundary: a test-owned globalThis.open wrapper returns null for the one tear-out target while preserving unrelated opens. It must not replace the product reducer, synthesize a terminal, or add a production test switch.

The Fix

Extend the existing headed matrix witness family and its living ledger only.

For every branch, snapshot all observable cleanup surfaces before and after the first terminal. Deliver the terminal signal a second time and require the complete snapshot to remain byte-equivalent.

Fold only macOS row 7 to PASS when all acceptance criteria and universal invariants pass. Rows 4 and 6 remain NOT_YET_MEASURED.

Contract Ledger

Decision Record Impact

Aligned with ADR 0029. This child measures the accepted lifecycle contract; it does not amend ownership, terminal semantics, or vessel policy.

Acceptance Criteria

• A headed macOS Chrome witness drives committed drop, post-birth cancel, and blocked acquisition through the real Demo B gesture surface.
• The blocked branch controls only the browser acquisition return and proves the product's real fail-closed path; no reducer mock, synthetic terminal, or production test hook is added.
• Each branch records committed document truth, singleton pane identity/home, popup count, and the complete admission/ownership/retirement lifecycle census.
• Committed drop mutates the dock document exactly once and preserves the one live pane instance.
• Cancel and blocked acquisition leave the committed document byte-identical and restore/preserve the same live pane at one semantic home.
• Every first terminal reaches zero inappropriate residue for its outcome.
• A repeated equivalent terminal is a complete no-op against the recorded snapshot.
• Gesture continuity, same-instance permanence, JSON-only persisted state, exact-once commit, and idempotent cleanup are asserted explicitly.
• Runtime, page, and popup error ledgers remain empty.
• Structured receipts are emitted and macOS row 7 alone is promoted in learn/guides/specificfeatures/TearOutPortabilityMatrix.md.
• Rows 4 and 6 plus every Windows/Linux cell remain NOT_YET_MEASURED.
• No src/** or apps/** production file changes.

Out of Scope

• Inventing the missing row-4 Store authority.
• Treating three physical windows as three row-6 claimants.
• Completing Windows or Linux cells.
• Changing ADR 0029, production outcome semantics, or popup policy.
• Adding test-only switches to production code.

Avoided Traps

• No unit-only cleanup proof presented as the headed product receipt.
• No popup-count proxy presented as registered-target identity.
• No reducer mock replacing the terminal under test.
• No partial branch promoted to a row verdict.
• No new evidence ledger.

Related

• Parent/tracker: #15551
• Portability parent: #15243
• Epic: #15239
• Shipped row-5 tranche: #15555 / PR #15552
• Shipped vessel embodiment: #15396 / PR #15573
• Prior unit-level cleanup substrate: #15248
• Authority: Discussion #15204 and ADR 0029

Freshness Receipt

Immediately before creation at 2026-07-19T15:21:18.324Z, the latest 20 open issues and latest 30 A2A messages across read states were rechecked. Targeted all-state searches for tear-out terminal cleanup, blocked acquisition, repeated terminal, and exact-once cleanup found no open row-7 product-composition child. Closed #15248 is the unit-level substrate, not this headed portability receipt.

Handoff

Start from fresh origin/dev. Modify the existing row-4–7 matrix spec and living ledger only. Preserve each branch's exact pre-terminal snapshot so idempotency is falsifiable by full equality rather than selected counters.

Origin Session ID: ad71d4c3-3e37-4a17-8df7-8415509def84

Retrieval Hint: macOS tear-out matrix row 7 drop cancel blocked acquisition exact-once cleanup repeated terminal Demo B