[x] 18284 Two independent Workstation roots share one drag namespace, so a cross-root drag commits into the wrong document, [x] 18272 An N-slot topology commit restores N documents and one view: no consumer has a sibling projection to converge, [x] 18315 Hydrate cold dock topologies and rebind warm reloads, [x] 18314 Unify Dock and Neural Link undo on the group cursor, [x] 18313 Record observed popup placement as a transaction participant, [x] 18312 Commit multi-workspace dock transactions atomically, [x] 18310 Add immutable per-group transaction history and cursor, [x] 18309 Bind transaction groups across window generations, [x] 18308 Hard-cut dock topology persistence to keyed workspace records
blocking
[]
closedAt
Sep 6, 2026, 9:56 PM
Add Workstation multi-window undo, redo, save, and reload
The operator goal is user-visible: multi-window actions are transactions; Workstation exposes undo/redo; saved layouts restore the same real-window composition. The manager, history, topology, effect, projection, and isolation leaves are substrate until one consumer composes them end to end.
The Problem
Workstation currently has no undo/redo controls and its reload path can create duplicate roots or reconnect popups to an orphan. A unit test of records is insufficient: the defining behavior spans real windows, same-instance pane movement, native placement, shared Provider state, persistence, and cold/warm lifecycles.
The Architectural Reality
Workstation is a thin consumer. Header actions bind to the Group Provider's canUndo / canRedo and dispatch manager commands; it must not keep its own stack or rescan panes. Panes remain layout-blind. App code follows the engine primitives and existing Store/Model/Provider conventions.
Multi-window scope (operator, 2026-09-06)
One main window with popups is this epic's multi-window story. A user loading the same app in a second independent main window is a real scenario and explicitly out of scope here: two full roots on one App SharedWorker cannot coexist today, because the second root's OffscreenCanvases are driven by a SharedWorker hosted in the first root's renderer process and Chromium terminates that process for the cross-process frame sink. That is an engine worker-topology question (#18376) whose fix may warrant its own epic — not a dock defect, and not something this epic's closing leaf should be gated on. A popup is unaffected because it joins its opener's process.
This narrows AC-7 below and nothing else. The cross-root isolation implementation shipped in #18284 and stays; only its rendered second-root receipt defers, owned by #18379, which now sits outside #18303.
The Fix
Add Undo/Redo and save/restore affordances through existing action descriptors; wire them to the active Group; remove replaced per-window live-layout fallbacks; add one permanent multi-window Neural Link journey that exercises human and agent origins, popup movement, same-instance continuity, warm reload, and cold restore.
Contract Ledger
Target Surface
Source of Authority
Proposed Behavior
Fallback
Docs
Evidence
Workstation actions
Group Provider
enabled state and commands derive from active Group
disabled with no Group/history
Workstation guide/tooltips
binding + UI arms
pane continuity
ADR 0029 + Neo component lifecycle
same component/controller/provider/store instances across windows
DOM rebuilt; unmodeled DOM state not promised
DockLayouts guide
identity witness
save/restore
topology library
save current topology; cold hydrate without replay
a gesture into this Group's own popup commits exactly once
fail closed
UI behavior docs
same-arm positive
Decision Record impact
Aligned with amended ADR 0029; no new ADR.
Decision Record
Not needed beyond the prerequisite ADR amendment.
Discussion Criteria Mapping
Owns the operator Goal and consumer proof for criteria 1, 4, 6–8, and 13. Criterion 10's rendered second-root reading is deferred with the two-independent-roots scenario (see Multi-window scope).
Acceptance Criteria
Undo/Redo actions exist once, bind to Group Provider state in main and popup windows, and dispatch no consumer-owned history logic.
A human dock action followed by a popup move creates ordered transactions; undo/redo visibly reverses/reapplies both in cursor order.
A Neural Link dock command interleaved with a human action shares the same cursor and reverses newest-first.
Moving a genuinely nested pane subtree across windows preserves component, controller, Provider, and Store instance ids; new native DOM nodes mount in the target document without promising unmodeled DOM-held state.
Warm root reload rebinds to the same Group/history and popup without replay or duplicate Workspace creation.
Save then cold boot restores every Workspace composition plus relative popup placement; history starts empty.
In the same production-shaped arm, Workstation A → A's own popup commits exactly once, and a repeat of the same gesture does not commit twice. Narrowed 2026-09-06 on operator scope direction, not on implementation difficulty: the original A → independent Workstation B shows no preview/staging/commit half is deferred with the two-independent-full-roots scenario (see Multi-window scope). It is not dropped — #18284 shipped the implementation with contract-level receipts, and #18379 owns the rendered receipt outside this epic, blocked by #18376.
Single-window/history-disabled Workstation behavior loads no history module and remains functional.
Replaced per-window live-layout persistence and sync sweeps are deleted, with an explicit deletion ledger.
Out of Scope
New transaction semantics, cross-Group bridging, pane-specific persistence, styling unrelated to the controls, and the two-independent-full-roots scenario with its worker-topology fix (#18376).
Avoided Traps
No app-local stack; no presentation sweep; no DOM-identity claim; no fixture-only multi-window host; no happy-path-only restore; no duplicate implementation of manager rules. Added 2026-09-06: no rendered receipt manufactured from a modified product configuration to satisfy a scenario the epic does not cover.
Related
Part of #18303. Final consumer leaf; blocked by every semantic/persistence/projection prerequisite. Related D#18150 for Workspace façade deletion. #18379 carries the deferred second-root receipt outside this epic.
Context
The operator goal is user-visible: multi-window actions are transactions; Workstation exposes undo/redo; saved layouts restore the same real-window composition. The manager, history, topology, effect, projection, and isolation leaves are substrate until one consumer composes them end to end.
The Problem
Workstation currently has no undo/redo controls and its reload path can create duplicate roots or reconnect popups to an orphan. A unit test of records is insufficient: the defining behavior spans real windows, same-instance pane movement, native placement, shared Provider state, persistence, and cold/warm lifecycles.
The Architectural Reality
Workstation is a thin consumer. Header actions bind to the Group Provider's
canUndo/canRedoand dispatch manager commands; it must not keep its own stack or rescan panes. Panes remain layout-blind. App code follows the engine primitives and existing Store/Model/Provider conventions.Multi-window scope (operator, 2026-09-06)
One main window with popups is this epic's multi-window story. A user loading the same app in a second independent main window is a real scenario and explicitly out of scope here: two full roots on one App SharedWorker cannot coexist today, because the second root's
OffscreenCanvases are driven by a SharedWorker hosted in the first root's renderer process and Chromium terminates that process for the cross-process frame sink. That is an engine worker-topology question (#18376) whose fix may warrant its own epic — not a dock defect, and not something this epic's closing leaf should be gated on. A popup is unaffected because it joins its opener's process.This narrows AC-7 below and nothing else. The cross-root isolation implementation shipped in #18284 and stays; only its rendered second-root receipt defers, owned by #18379, which now sits outside #18303.
The Fix
Add Undo/Redo and save/restore affordances through existing action descriptors; wire them to the active Group; remove replaced per-window live-layout fallbacks; add one permanent multi-window Neural Link journey that exercises human and agent origins, popup movement, same-instance continuity, warm reload, and cold restore.
Contract Ledger
Decision Record impact
Aligned with amended ADR 0029; no new ADR.
Decision Record
Not needed beyond the prerequisite ADR amendment.
Discussion Criteria Mapping
Owns the operator Goal and consumer proof for criteria 1, 4, 6–8, and 13. Criterion 10's rendered second-root reading is deferred with the two-independent-roots scenario (see Multi-window scope).
Acceptance Criteria
A → independent Workstation B shows no preview/staging/commithalf is deferred with the two-independent-full-roots scenario (see Multi-window scope). It is not dropped — #18284 shipped the implementation with contract-level receipts, and #18379 owns the rendered receipt outside this epic, blocked by #18376.Out of Scope
New transaction semantics, cross-Group bridging, pane-specific persistence, styling unrelated to the controls, and the two-independent-full-roots scenario with its worker-topology fix (#18376).
Avoided Traps
No app-local stack; no presentation sweep; no DOM-identity claim; no fixture-only multi-window host; no happy-path-only restore; no duplicate implementation of manager rules. Added 2026-09-06: no rendered receipt manufactured from a modified product configuration to satisfy a scenario the epic does not cover.
Related
Part of #18303. Final consumer leaf; blocked by every semantic/persistence/projection prerequisite. Related D#18150 for Workspace façade deletion. #18379 carries the deferred second-root receipt outside this epic.
Origin Session ID: 01a06b6d-3323-7fa0-a10b-bbc4871c8780
Retrieval Hint:
D18224 Workstation undo redo save reload same instance multi-window journeyCreation freshness: live latest-open and all-status A2A sweeps found no equivalent end-to-end consumer leaf.