Reopened 2026-09-22 for original AC-2. The merged Group source and agent/human cursor work remains delivered. The open boundary is deployed Neural Link undo/redo/list/save/replay with a real groupId; direct-service tests and one agent-write arm do not exercise that transport. Closeout evidence.
Context
The Engine already exposes Neural Link begin/commit/undo/redo through a private TransactionService keyed by writer/session, while ordinary dock UI gestures bypass it. DockService#buildDockReverse creates one-holder snapshots and a second dock-side undo authority. D#18224 resolved that these must be migrated, not supplemented.
The Problem
Two histories over one heap disagree under interleaving: writer A can undo an older whole-document snapshot over a newer human B mutation. A Group cursor must reverse B before A regardless of origin. Deleting the whole legacy sessions map in the first dock increment would also break non-dock commands before their compensation path exists.
The Architectural Reality
All dock origins—human gesture, Workstation action, Neural Link dock operation, restore—target one Group. Neural Link commands select a Group and operate its latest cursor, not one writer's private latest entry. Non-dock command execution remains on the legacy service until migrated; mixed batches are refused.
The Fix
Route dock begin/commit/undo/redo/list/save/replay into manager.Transaction; delete DockService#buildDockReverse and dock-side recordUndo; preserve non-dock sessions temporarily; return structured Group/cursor results through the existing tool surface. The delivered cut must be net-negative across replaced undo code.
Ordinary popup admission
The all-dock-origin cut includes ordinary tear-out birth: admit a full Workspace and its semantic document through the Group claim before the first committed pop-out, then record that transition through the same Group history. A documentless reservation is provisional native-window admission only; it must not survive as the committed popup representation. Preserve the live pane subtree, compensate failed admission, and delete the replaced bare-vessel document/promotion ownership in the same cut. Placement consumes the admitted document in #18313; the complete user journey is proved in #18316. This supplies #18311's already-planned popup-as-Workspace prerequisite without changing its extraction scope.
Accepted Group lifecycle boundary
Per D#18150 step 3 and its terminal mapping, this leaf accepts admissions, connection cache, vessel ownership and retirement directly into the settled Group. The tearOutAdmissions, tearOutConnects, tearOutPanes and tearOutRetirements state and corresponding lifecycle methods must leave Workspace with their teardown; forwarding wrappers or a renamed intermediate dock owner do not discharge the cut. #18311 retains pane-handoff choreography and the native identity witness. Transaction stays generic, with dock participant and native effect seams supplied by its consumers. Accepted by @neo-gpt as #18314 owner; implementation remains open until the deletion and behavior are proved.
The same cut owns the remaining Workstation vesselWorkspaces owner-lookup consolidation against Group participant identity, as required by #18318 AC-4. Full popup documents already alias their Workspace owner; the remaining lookup must not become a second participant-membership authority. Euclid retains final consumer integration alongside Emmy's NativeLifecycle contribution. This is accepted work, not a completed acceptance claim.
Contract Ledger
| Target Surface |
Source of Authority |
Proposed Behavior |
Fallback |
Docs |
Evidence |
| dock undo authority |
D#18224 criterion 7 |
one Group cursor across all writers |
missing Group fails closed |
Neural Link docs/JSDoc |
agent/human interleave arm |
| NL commands |
current TransactionService tools |
target Group, report Group cursor/history |
non-dock commands retain old path |
tool docs |
exact tool contract tests |
| dock reverse builder |
current DockService |
deleted |
none |
source cleanup |
zero-call/zero-symbol census |
| mixed batch |
first-increment constraint |
rejected before partial replay |
structured refusal |
docs |
mixed red control |
Decision Record impact
Depends on amended ADR 0029 and the Group transaction contract.
Decision Record
No new ADR; this is the authority migration required by #18303.
Discussion Criteria Mapping
Owns criterion 7 and criterion 3's deletion ledger for the undo surface.
Acceptance Criteria
Out of Scope
Migrating every non-dock command, Workstation button styling, or cross-Group undo.
Avoided Traps
No second adapter history; no writer-private cursor; no wholesale sessions-map deletion; no partial mixed replay; no close-target overclaim for non-dock migration.
Related
Part of #18303. Blocked by immutable history and atomic commit.
Origin Session ID: 01a06b6d-3323-7fa0-a10b-bbc4871c8780
Retrieval Hint: D18224 one undo authority DockService buildDockReverse TransactionService Group cursor
Creation freshness: live latest-open and all-status A2A sweeps found no equivalent authority-migration leaf.
Context
The Engine already exposes Neural Link begin/commit/undo/redo through a private
TransactionServicekeyed by writer/session, while ordinary dock UI gestures bypass it.DockService#buildDockReversecreates one-holder snapshots and a second dock-side undo authority. D#18224 resolved that these must be migrated, not supplemented.The Problem
Two histories over one heap disagree under interleaving: writer A can undo an older whole-document snapshot over a newer human B mutation. A Group cursor must reverse B before A regardless of origin. Deleting the whole legacy sessions map in the first dock increment would also break non-dock commands before their compensation path exists.
The Architectural Reality
All dock origins—human gesture, Workstation action, Neural Link dock operation, restore—target one Group. Neural Link commands select a Group and operate its latest cursor, not one writer's private latest entry. Non-dock command execution remains on the legacy service until migrated; mixed batches are refused.
The Fix
Route dock begin/commit/undo/redo/list/save/replay into
manager.Transaction; deleteDockService#buildDockReverseand dock-siderecordUndo; preserve non-dock sessions temporarily; return structured Group/cursor results through the existing tool surface. The delivered cut must be net-negative across replaced undo code.Ordinary popup admission
The all-dock-origin cut includes ordinary tear-out birth: admit a full Workspace and its semantic document through the Group claim before the first committed pop-out, then record that transition through the same Group history. A documentless reservation is provisional native-window admission only; it must not survive as the committed popup representation. Preserve the live pane subtree, compensate failed admission, and delete the replaced bare-vessel document/promotion ownership in the same cut. Placement consumes the admitted document in #18313; the complete user journey is proved in #18316. This supplies #18311's already-planned popup-as-Workspace prerequisite without changing its extraction scope.
Accepted Group lifecycle boundary
Per D#18150 step 3 and its terminal mapping, this leaf accepts admissions, connection cache, vessel ownership and retirement directly into the settled Group. The
tearOutAdmissions,tearOutConnects,tearOutPanesandtearOutRetirementsstate and corresponding lifecycle methods must leave Workspace with their teardown; forwarding wrappers or a renamed intermediate dock owner do not discharge the cut. #18311 retains pane-handoff choreography and the native identity witness. Transaction stays generic, with dock participant and native effect seams supplied by its consumers. Accepted by @neo-gpt as #18314 owner; implementation remains open until the deletion and behavior are proved.The same cut owns the remaining Workstation
vesselWorkspacesowner-lookup consolidation against Group participant identity, as required by #18318 AC-4. Full popup documents already alias their Workspace owner; the remaining lookup must not become a second participant-membership authority. Euclid retains final consumer integration alongside Emmy's NativeLifecycle contribution. This is accepted work, not a completed acceptance claim.Contract Ledger
Decision Record impact
Depends on amended ADR 0029 and the Group transaction contract.
Decision Record
No new ADR; this is the authority migration required by #18303.
Discussion Criteria Mapping
Owns criterion 7 and criterion 3's deletion ledger for the undo surface.
Acceptance Criteria
DockService#buildDockReverseand dock-siderecordUndoare deleted with no parallel compatibility path.Out of Scope
Migrating every non-dock command, Workstation button styling, or cross-Group undo.
Avoided Traps
No second adapter history; no writer-private cursor; no wholesale sessions-map deletion; no partial mixed replay; no close-target overclaim for non-dock migration.
Related
Part of #18303. Blocked by immutable history and atomic commit.
Origin Session ID: 01a06b6d-3323-7fa0-a10b-bbc4871c8780
Retrieval Hint:
D18224 one undo authority DockService buildDockReverse TransactionService Group cursorCreation freshness: live latest-open and all-status A2A sweeps found no equivalent authority-migration leaf.