Workstation Security pane re-enters the fixed FLIP stage

Context

PR #17869 restores the Workstation film-stage density. At exact head 96f848f708bcb5c00d5fbe9d95072a06ebcc0d7d, the focused density/splitter witness passes and hosted CI is green.

The complete WorkstationNL tour later fails a different choreography oracle. To isolate it, only the earlier blankFrames assertion was bypassed in a local diagnostic run (never pushed). The same exact head then reported:

securityStageBursts
Expected: 1
Received: 2

The nearest predecessor is #16356 / PR #16468. That repair established that a Security pane which was never presented must enter unstaged: a zero-area First rect must not create a fixed FLIP stage. The current second burst therefore needs a fresh transition-level diagnosis; similarity of the symptom does not prove the same cause.

A final live sweep of the latest 20 open Engine issues plus the latest 30 A2A claims found no current owner for this recurrence.

Problem

The Workstation Security-pane tour now observes two fixed-stage bursts where its durable oracle expects one. Either:

1. the split leg has regressed and stages an unpresented/zero-area First rect; or
2. the application precondition intentionally changed and the oracle is stale.

Weakening the count without identifying the responsible transition would hide a choreography regression.

Architecture

The diagnosis crosses these existing surfaces:

• src/main/addon/DockFlip.mjs: First/Last capture and entering-versus-staged classification;
• the Workstation tour: overflow cue → Security activation → split promotion → tab return;
• WorkstationNL: the rAF-stage monitor for fixed-stage bursts, enter motion, component identity, and residue.

The repair belongs to whichever owner first violates the established transition contract. No new timing layer or parallel choreography mechanism is needed.

Proposed fix

1. Isolate the exact Security transition responsible for each of the two observed bursts.
2. Record First/Last geometry, active/visible state, stage class, and transform for that transition.
3. If the split First rect is zero-area or otherwise unpresented, restore the entering/unstaged path.
4. If the split First rect is positive and intentionally presented, identify the product authority that changed the contract and update the witness to that behavior with evidence.
5. Preserve component identity and leave no fixed-stage residue after settlement.

Acceptance Criteria

• The exact tour transition responsible for each observed securityStageBursts increment is named and evidenced.
• A zero-area or unpresented First rect never enters the fixed FLIP stage.
• If the second burst is intentional, the governing product contract and positive-geometry witness replace the literal count premise; the assertion is not merely weakened.
• Every staged Security frame has positive geometry, component identity remains stable, and no stage class/transform residue survives settlement.
• The complete WorkstationNL Security-stage oracle passes in at least two consecutive exact-head runs.
• A mutation restoring the wrong entering/staged classification fails the focused witness.

Out of Scope

• Film-stage density and splitter extent selection (#17865 / PR #17869).
• The midpoint-scroll blank-grid recurrence (#17871).
• Arbitrary delays, retry loops, or count tolerances.
• A broad rewrite of DockFlip.

Decision Record

No new architectural decision is required. This ticket preserves and revalidates the entering-versus-staged contract established by #16356 / PR #16468.

Related

• Parent: #15252
• Symptom predecessor: #16356
• Sibling regression: #17871
• Source run: PR #17869 at 96f848f708bcb5c00d5fbe9d95072a06ebcc0d7d

Origin

• Session: 6243a442-7ced-4c0f-81c6-99b0f8358e63
• Retrieval hint: Workstation Security pane FLIP stage burst zero-area First split return