Context
Found while closing #16356 (the Security zero-rect FLIP staging frame). That defect failed the dense-tour headed row at its clipped-frames oracle on every run since 2026-08-02, masking every assertion downstream of it. With the #16356 repair in place, the row advanced ~68 assertion-lines deeper for the first time — and failed deterministically at the chrome-identity comparison.
Receipts (2/2 identical, headed, dev 3a39616cd3 + the #16356 repair): cross-zone + split/return preserve every chrome identity while Audit changes owner fails with the same one-line diff both runs:
- expected: right-bottom-tabs.buttons.audit = "neo-tab-header-button-16"
+ received: right-top-tabs.buttons.audit = "neo-tab-header-button-16"
Same button id — identity preserved — but the audit tab is still under its SOURCE container. The tour's completion line reads Tour complete — 11 deterministic beats and 6 surface cues settled. with zero errors in the same runs.
The Problem
The dense tour's audit beat is a cross-zone-showcase cue (apps/workstation/tour/denseWorkstation.mjs ~:107): a synthetic pointer drag from right-top-tabs, two dwells (scale-tabs edge-bottom, then right-bottom-tabs tab-into), terminal: 'commit'. The expected end state — audit joins Commits in right-bottom-tabs — never materializes: the commit lands nothing, the item stays home, and the cue still reports settled.
That is a silent falsification of the product thesis the film narrates ("release commits exactly what you saw"): a drag whose preview grammar runs on camera and whose release does nothing, while every settle-report stays green. Observation and inference separated: the un-moved chrome is measured; WHERE the commit is lost (never produced / produced-then-refused / committed-then-reverted) is not yet known.
The Architectural Reality
- The cue + the failing expectation both landed in
0b33291043 (PR #15952, 2026-07-26) — authored together, presumably against a then-green behavior. Honest bound: PR CI runs no e2e job, so "green at authoring" rests on the author's posted headed receipts, not CI history; no bisect has run yet.
- The commit seam churned heavily inside the window
0b33291043..3a39616cd3, including PR #16321 (the #16309 fix: exact-target acquisition, onDragMove gains groupNodeId/writeRenderer, indicator feed re-plumbed), PR #16140 (native titlebar drags), PR #16137 (popup-over-popup proxies), PR #16134 (remote previews to exact targets — whose zone-narrowing was #16309's convicted layer 1).
- The
#16309 close-out explicitly flagged, and deliberately did NOT build: DockDragAffordances.onDrop carries the same two gaps repaired on the move side — no stored-home fallback, no groupNodeId in its fallback produce(). That flagged seam is a prime suspect for a commit that arrives outside the narrowed exact zone and produces nothing.
- Closed precedent
#14913 is the same defect family with the opposite symptom: the producer's five-zone hit-test classified a header-band drop as edge/split (landed WRONG); fixed with a header-strip carve-out in the preview producer. Here the drop lands NOWHERE — but the tab-into classification territory has verified history.
- The monitor's identity oracles (
securityReplacementFrames, container/header persistence) stay green: this is not a projection identity loss, it is a missing document mutation.
The Fix
Classification first — no repair until the losing gate is named with receipts:
- Instrument the cue's commit leg on the failing run: pointer position at terminal-commit vs the target's acquisition zone rect, whether
produce() is invoked and what it returns, the indicator candidate + active preview state at release, and which onDrop path executes (primary vs fallback).
- The receipt names the owning seam (acquisition zone vs indicator candidate vs onDrop fallback vs commit refusal), then repair at that seam.
- If the cue's settle contract turns out to be effect-blind by design (a
terminal: 'commit' cue can settle without its document effect), that is its own defect: a commit-terminal cue must verify its document effect or fail the tour — repair it here or file the receipted successor.
Do not add dwell extensions, screenplay delays, or pointer-path fudging.
Acceptance Criteria
Out of Scope
#16356 FLIP staging repair (separate PR, in flight — this ticket's receipts were taken on top of it)#16406 / #16423 / #16424 chrome paint glitches- Cross-window preview/commit seams beyond what the commit leg needs (
#16309 successors stay with their owner)
Contract Ledger
(Backfilled per PR #16473 review RA-3 — the repair added a consumed contract the original body did not anticipate.)
| Target Surface |
Source of Authority |
Behavior (as shipped in PR #16473) |
Fallback |
Docs |
Evidence |
Workspace.runTourSpec(script, {restoreDocument=false}) |
this ticket + TourRunner contract (cues external to replays) |
DRIVER default: the replay result stays live (journey specs + film pipeline continue from it). PROBE opt-in restoreDocument: true: the displaced live document is restored in finally, including on a rejecting entry projection; runner/service destroys always run. script: null resolves to the default script (transport callers cannot send undefined). Both baseline swap and restore are full projections. |
Omitted option ⇒ existing driver behavior byte-for-byte. Restore-projection failure precedence (probe mode): clean replay ⇒ the failure propagates and replaces the return (a probe may not report success over an un-projected surface); structured primary (completed: false / runner errors) ⇒ the structured result returns intact and the restore failure is appended to its errors as a namespaced restore projection failed: … entry; thrown primary ⇒ the transaction error owns the return channel and the restore failure stays suppressed. The document assignment itself is unconditional. |
Method JSDoc + in-method precedence comment. |
Unit (prototype-call): rejecting-entry restore identity + driver-no-restore + clean-replay restore-propagation + structured-primary forensics-plus-recorded-restore-failure. E2e: FiveBeat scenes 1+5 (driver) + dense-row determinism replays (probe). |
Workspace.onTourBeat cue settlement |
this ticket AC (a settle-report may not count a no-op as settled) |
A cue receipt with errors, or applied: false without cancelled: true, rejects the settlement (tour completed: false); the forensic receipt is pushed to cueReceipts before the throw. |
Receipt shapes without those keys settle as before; cancel terminals settle un-applied by design. |
In-method comment. |
Unit: four-cell prototype-call witnesses (empty-errors un-applied / errors / cancel-exempt / healthy). |
Decision Record impact
none at the ADR tier — aligned-with ADR 0029; the consumed-contract additions above are ticket-scoped and recorded in the Contract Ledger (the original "no contract change" statement was superseded by the repair's shape; corrected per PR #16473 review RA-3).
Related
Related: #16356 (masking layer + discovery context) · #16309 / PR #16321 (flagged onDrop gaps, acquisition reshape) · PR #16134 (zone narrowing precedent) · PR #15952 (cue + expectation origin) · #14913 (closed tab-into misclassification precedent) · #15252 (film gate) · #16357 (adjacent gesture family)
Live latest-open sweep: checked the latest 20 open issues on 2026-08-03 at ~19:40Z; no equivalent found. A2A all-status sweep (last 30, herd window): no overlapping claim. KB semantic sweep: nearest match is closed #14913 (precedent, not duplicate).
Origin Session ID: 0ea45eb0-5687-4796-8bef-c2cf37b08186
Retrieval Hint: audit cross-zone cue commit no-op chrome identity right-bottom-tabs
Context
Found while closing
#16356(the Security zero-rect FLIP staging frame). That defect failed the dense-tour headed row at its clipped-frames oracle on every run since 2026-08-02, masking every assertion downstream of it. With the#16356repair in place, the row advanced ~68 assertion-lines deeper for the first time — and failed deterministically at the chrome-identity comparison.Receipts (2/2 identical, headed, dev
3a39616cd3+ the#16356repair):cross-zone + split/return preserve every chrome identity while Audit changes ownerfails with the same one-line diff both runs:Same button id — identity preserved — but the audit tab is still under its SOURCE container. The tour's completion line reads
Tour complete — 11 deterministic beats and 6 surface cues settled.with zero errors in the same runs.The Problem
The dense tour's audit beat is a
cross-zone-showcasecue (apps/workstation/tour/denseWorkstation.mjs~:107): a synthetic pointer drag fromright-top-tabs, two dwells (scale-tabsedge-bottom, thenright-bottom-tabstab-into),terminal: 'commit'. The expected end state — audit joins Commits inright-bottom-tabs— never materializes: the commit lands nothing, the item stays home, and the cue still reports settled.That is a silent falsification of the product thesis the film narrates ("release commits exactly what you saw"): a drag whose preview grammar runs on camera and whose release does nothing, while every settle-report stays green. Observation and inference separated: the un-moved chrome is measured; WHERE the commit is lost (never produced / produced-then-refused / committed-then-reverted) is not yet known.
The Architectural Reality
0b33291043(PR#15952, 2026-07-26) — authored together, presumably against a then-green behavior. Honest bound: PR CI runs no e2e job, so "green at authoring" rests on the author's posted headed receipts, not CI history; no bisect has run yet.0b33291043..3a39616cd3, including PR#16321(the#16309fix: exact-target acquisition,onDragMovegainsgroupNodeId/writeRenderer, indicator feed re-plumbed), PR#16140(native titlebar drags), PR#16137(popup-over-popup proxies), PR#16134(remote previews to exact targets — whose zone-narrowing was#16309's convicted layer 1).#16309close-out explicitly flagged, and deliberately did NOT build:DockDragAffordances.onDropcarries the same two gaps repaired on the move side — no stored-home fallback, nogroupNodeIdin its fallbackproduce(). That flagged seam is a prime suspect for a commit that arrives outside the narrowed exact zone and produces nothing.#14913is the same defect family with the opposite symptom: the producer's five-zone hit-test classified a header-band drop as edge/split (landed WRONG); fixed with a header-strip carve-out in the preview producer. Here the drop lands NOWHERE — but the tab-into classification territory has verified history.securityReplacementFrames, container/header persistence) stay green: this is not a projection identity loss, it is a missing document mutation.The Fix
Classification first — no repair until the losing gate is named with receipts:
produce()is invoked and what it returns, the indicator candidate + active preview state at release, and whichonDroppath executes (primary vs fallback).terminal: 'commit'cue can settle without its document effect), that is its own defect: a commit-terminal cue must verify its document effect or fail the tour — repair it here or file the receipted successor.Do not add dwell extensions, screenplay delays, or pointer-path fudging.
Acceptance Criteria
right-bottom-tabsat tour end (document + projected chrome).terminal: 'commit'cue whose document effect does not land fails its settle-report (or the receipted successor ticket for that contract is filed).Out of Scope
#16356FLIP staging repair (separate PR, in flight — this ticket's receipts were taken on top of it)#16406/#16423/#16424chrome paint glitches#16309successors stay with their owner)Contract Ledger
(Backfilled per PR
#16473review RA-3 — the repair added a consumed contract the original body did not anticipate.)#16473)Workspace.runTourSpec(script, {restoreDocument=false})restoreDocument: true: the displaced live document is restored infinally, including on a rejecting entry projection; runner/service destroys always run.script: nullresolves to the default script (transport callers cannot sendundefined). Both baseline swap and restore are full projections.completed: false/ runner errors) ⇒ the structured result returns intact and the restore failure is appended to itserrorsas a namespacedrestore projection failed: …entry; thrown primary ⇒ the transaction error owns the return channel and the restore failure stays suppressed. The document assignment itself is unconditional.Workspace.onTourBeatcue settlementerrors, orapplied: falsewithoutcancelled: true, rejects the settlement (tourcompleted: false); the forensic receipt is pushed tocueReceiptsbefore the throw.Decision Record impact
none at the ADR tier — aligned-with ADR 0029; the consumed-contract additions above are ticket-scoped and recorded in the Contract Ledger (the original "no contract change" statement was superseded by the repair's shape; corrected per PR
#16473review RA-3).Related
Related:
#16356(masking layer + discovery context) ·#16309/ PR#16321(flagged onDrop gaps, acquisition reshape) · PR#16134(zone narrowing precedent) · PR#15952(cue + expectation origin) ·#14913(closed tab-into misclassification precedent) ·#15252(film gate) ·#16357(adjacent gesture family)Live latest-open sweep: checked the latest 20 open issues on 2026-08-03 at ~19:40Z; no equivalent found. A2A all-status sweep (last 30, herd window): no overlapping claim. KB semantic sweep: nearest match is closed
#14913(precedent, not duplicate).Origin Session ID: 0ea45eb0-5687-4796-8bef-c2cf37b08186
Retrieval Hint:
audit cross-zone cue commit no-op chrome identity right-bottom-tabs