First tear-out source projection exposes a cleared Workstation body

Context

#15955 treats appearance as a hypothesis until a current presented-frame witness names the exercised boundary. Its stale-video claim was withdrawn, and retired #16152 remains closed.

The corrected witness in PR #16154 isolates the first tear-out source projection. At exact head 3088764ced, a populated headed run on accelerated ANGLE/Metal completed the detach commit while the measured Workstation crop fell from baseline entropy 5.362489868987215 to 0.15755374068679046 across 117 consecutive presented frames.

Phase timing falsified the earlier candidate-2 attribution: the minimum frame preceded candidate 2's projection because executeTearOutStep() returned before its projection refresh settled. Once that executor awaited settlement, the separately isolated candidate-2 control stayed above its baseline-relative continuity floor.

The Problem

The first detachItem commit preserves the dock node topology but removes one item from a retained tab node. DockProjectionReconciler.reconcileProjection() nevertheless takes its general staged-shell transaction:

• mount a visibility-hidden target shell;
• move retained pane/button descendants and tab chrome;
• swap old/new shell visibility;
• destroy the empty source shell.

That transaction is necessary for structural topology changes. For an item-only detach with an otherwise identical structural shell, replacing the shell creates an avoidable compositor-visible interval in which the old source body is cleared before the retained target descendants present.

Worker truth, the tear-out receipt, popup birth, and final DOM/component presence can all be correct while that frame is visible.

The Architectural Reality

• DockProjectionReconciler owns identity-preserving projections for every dock consumer; a Workstation-local cover would leave the framework transaction broken.
• The dock document commits before render effects. The repair must preserve model-first transfer and source/target ownership.
• Surviving tab container, toolbar, strip, button, pane, store, and DOM identities are the permanence contract.
• Same-topology item reconciliation is not equivalent to the existing geometry-only fast path: it must explicitly reconcile the live tab items and active selection.
• Any structural mismatch must fail closed to the existing staged transaction.
• captureWorkspaceContinuity() is the consecutive CDP presented-frame oracle. Sampled screenshots and DOM presence are weaker evidence.

The Fix

1. Add an explicit retainTopology admission to DockProjectionReconciler.
2. Reuse the strict topology proof: every structural node must retain identity, type, ancestry, child order, and split orientation.
3. When admitted, reconcile tab item/active deltas against the existing shell, park owner-held panes, update materialized tab bars, and project overflow without replacing the shell.
4. Fail closed to the staged-shell transaction when any structural property differs.
5. Let Workstation request this admission only for detachItem.
6. Flip the #16154 red control to a positive continuity assertion and retain the minimum-frame attachment on failure.

Decision Record impact

none — this repairs the existing identity-preserving projection contract.

Acceptance Criteria

• PR #16154 preserves the exact pre-fix first-tear-out red witness and its headed-only launch contract.
• retainTopology is opt-in; ordinary non-geometry refreshes continue to use the staged transaction.
• A same-topology item detach keeps the exact shell and surviving tab chrome while parking the detached live pane.
• Structural identity, ancestry, order, type, or split-orientation changes fail closed to the staged transaction.
• Retained tab container, toolbar, strip, button, pane, store, and DOM identities remain stable.
• No frame uses duplicate source/target pane DOM, cloned content, a loading mask, opacity cover, or a timing delay.
• The repaired headed witness keeps every measured frame above its justified baseline-relative entropy floor.
• Focused DockProjectionReconciler tests and the full unit suite pass.
• The PR body names exact red/green heads and receipts.

Out of Scope

• Candidate 2 and later cross-window docking legs; they remain separate measured boundaries.
• Popup bootstrap/theme continuity.
• Native-titlebar admission and cursor cleanup.
• Film editing, capture retiming, or changing dock-document semantics.

Avoided Traps

• Do not reopen retired #16152.
• Do not add sleeps or extend the 300 ms chrome settle window.
• Do not mask the gap with neo-no-animation, opacity, an overlay, or duplicate content.
• Do not weaken structural equality to make more projections eligible.
• Do not infer presented continuity from DOM/component presence.
• Do not make retained-topology reconciliation Workstation-local.

Related

Related: #15955 · #16152 · #15927 · #15951 · #15136

Origin Session ID: 019fac4d-7844-7422-9486-7f73ccf308f5

Retrieval Hint: first tear-out source projection retainTopology entropy 0.15755 exact structural shell