Film capture cannot bind recorder start to semantic readiness

Context

The recorded workstation journey in #15252 now has executable five-beat app mechanics, but the native recorder still has no causal boundary it can use to start on the verified frame before beat one.

At current dev head 62e5669c0fb7d107f3da56a1931c7be8c0e202c2, test/playwright/e2e/workstation/WorkstationFiveBeatNL.spec.mjs:1199-1218 verifies the pristine opening state and immediately invokes the first tour operation. The normalized five-beat log remains local to the test and is only compared/asserted at :1428-1435; it is not exported as a hashable artifact.

A second film-mode defect is independently reproducible at test/playwright/e2e/utils/gpuIntent.mjs:93. A full consumer census also found test/playwright/e2e/workstation/WorkstationNL.spec.mjs:40 independently parsing the same sentinel by truthiness:

NEO_FILM_TAKE=0 ... activeLaunchArgs()
=> {"filmProfile":true,"e2eProfile":false,"hasFrameLimitDisable":false}

Live latest-open sweep: checked the latest 20 open issues at 2026-07-27T07:34Z; no equivalent one-PR leaf or in-flight A2A claim exists. Knowledge Base search surfaced only the parent #15252.

The Problem

Starting the native screen recorder before the semantic opening assertions risks recording a wrong topology, dead feed, stale vessel, or wrong stage. Starting it after those assertions currently misses beat one because the test proceeds immediately. A sleep cannot bind the two processes to the same verified state.

The run also lacks an external, canonical receipt proving which normalized five-beat log completed after the recorder acknowledged readiness. A decodable video and a green test can therefore exist without a causal link between their start boundary and semantic witness.

Finally, all three consumers currently parse any non-empty NEO_FILM_TAKE value as enabled, while the intended public contract is the exact sentinel 1.

The Architectural Reality

• The Playwright journey owns semantic truth: opening dock document, pane identities, heartbeat, stage geometry, and normalized beat log.
• gpuIntent.mjs:isFilmTake() is the sentinel authority consumed by both WorkstationNL.spec.mjs and WorkstationFiveBeatNL.spec.mjs; the specs do not own parallel parsers.
• The native capture runner owns recorder process timing and cannot infer worker truth from pixels.
• The boundary belongs in the test runner as an explicit file receipt handshake. It does not belong in production app code, AppleScript window heuristics, or a timing delay.
• activeLaunchArgs() and WorkstationFiveBeatNL.spec.mjs consume the same film sentinel and must agree on its exact activation semantics.

The Fix

Add a film-only, all-or-none absolute-path control contract:

1. The test verifies its existing pristine opening assertions.
2. It writes one exclusive canonical neo.film.take17.ready.v1 receipt and publishes its SHA-256.
3. It blocks before the first visual beat until the recorder writes neo.film.take17.go.v1 bound to that exact ready hash.
4. After the journey completes, it attaches a canonical neo.film.five-beat-semantic-receipt.v1 and, in controlled film mode, writes the same receipt to the runner-owned output path.
5. All launch, pacing, video, and pixel-witness consumers select film mode through one shared exact-sentinel helper.

Contract Ledger

Decision Record impact

None. This is a test/capture boundary for the existing five-beat contract and does not amend an ADR.

Acceptance Criteria

• NEO_FILM_TAKE=0 and an unset value select ordinary E2E launch behavior; only exact 1 selects film mode.
• Control files are accepted only as a complete absolute-path tuple in film mode.
• A controlled run refuses stale go or semantic-receipt files and writes the ready receipt exclusively.
• The ready receipt is emitted only after the existing opening topology, identity, heartbeat, zero-vessel, and stage assertions pass.
• The first visual beat cannot start until a go receipt cites the exact ready SHA.
• The completed normalized beat log is attached as canonical JSON; the controlled external receipt has the identical SHA.
• Ordinary mode retains two-run beat-log equality.
• A native headed controlled film-profile smoke passes the GL dependency and Scene 5 with zero skipped, unexpected, or flaky results.
• The exact full five-beat spec passes after the change.

Out of Scope

• Starting or stopping screencapture.
• Recording, editing, promoting, or publishing the final film.
• Display privacy review, OCR, audio, captions, or aesthetic acceptance.
• Changes to production docking mechanics.
• Closing the parent film ticket.

Avoided Traps

• Recorder-first timing: records before semantic admission.
• Test-first timing: loses beat one.
• Fixed sleeps: correlate clocks but do not bind state.
• Pixel-derived readiness: cannot prove worker truth.
• Boolean environment parsing: treats 0 as enabled.

Related

Parent: #15252

Retrieval Hint: take 17 five-beat semantic-ready recorder go receipt Retrieval Hint: branch codex/15252-five-beat-film, source head 62e5669c0fb7d107f3da56a1931c7be8c0e202c2