Recognize vessel ownership in Workstation tear-out receipts

Context

A successful Workstation tear-out now transfers the pane into a full vessel Workspace. The scripted journey still checks the older single-document detach contract. Grace's runtime snapshot, preserved by #18502 / PR #18503, shows metrics absent from workstation-main and present in workstation-vessel:metrics when the journey reports failure.

This ticket repairs that consumer predicate and its receipt. The participant-catalog diagnostic remains #18502's separate deliverable.

The Problem

At dev 335b2ca43a, apps/workstation/tour/NativeGestureDriver.mjs:940 requires both absence from the origin tree and presence in the origin catalog. The same conjunction is repeated in executeTearOutStep:855–875, including its applied, error and proof fields. Fixing only the poll would still return failure.

Independent execution of the actual predicate confirms the mismatch: settled source without metrics plus the expected vessel containing it returns false. A source still containing the record accepts even with a duplicate vessel copy. The runtime result is a correct transfer; the observer's success condition is wrong.

The Architectural Reality

ADR 0029 §2.3 requires transferItem to remove the source tree/catalog entry and add the target catalog/placement atomically. Plain detachItem retains its distinct single-document semantics.

Workstation's vessel adoption executes transferItem to Workspace.vesselWorkspaceId(itemId) (Workspace.mjs:2204). getWorkspaceDocument(workspaceId) already resolves committed root or Group-participant document truth; no new engine registry, instrumentation or operation is needed.

Existing Workstation tear-out/cancel/re-entry journeys and their proof readers consume this result. DemoB's separate implementation and plain-detach tests are not automatically equivalent consumers.

The Fix

Repair the native tour driver's success observation around the exact expected vessel participant. Reuse one ownership decision for polling and the final receipt. A successful transfer requires removal from the source and ownership/placement in the expected vessel, with unrelated catalog records preserved.

Make the receipt explicit about source and target document truth; replace the misleading source-only catalog assertions and update their actual Workstation readers together. Keep missing participant, lost record, wrong destination and duplicated ownership distinguishable from successful transfer. Preserve cancellation and re-entry semantics.

Contract Ledger Matrix

Acceptance Criteria

• A real successful tear-out returns applied: true and a receipt consistent with source and expected vessel documents.
• Focused controls fail closed for source-only detach, absent vessel, lost item, wrong vessel and duplicated ownership; the former transfer rejection is red before and green after the repair.
• Polling and final receipt use the same semantic ownership decision. Catalog preservation is checked across the participants involved, without pretending the source retains the transferred record.
• Update all actual Workstation readers of the changed proof fields and the stale origin-catalog assertion. Keep cancellation/re-entry, unrelated panes and component/store identity assertions intact.
• Run the selected headed Workstation tear-out/source-continuity witnesses with the explicit Brain runtime and custom E2E config. Record newly exposed later failures separately; no whole native matrix or film acceptance is implied.

Out of Scope

Group transfer, popup admission, native route capabilities, physical park/restore policy, DemoB behavior, broad NL battery repair and the Workstation playback-owner extraction. No engine API or new source directory.

Avoided Traps

Do not change the engine to satisfy the old observer, merely invert one assertion, accept any participant that happens to contain the item, or fix only the wait while leaving applied false. Do not revive plain-detach expectations on the full-vessel path. Do not merge the separate diagnostic PR's scope into this repair.

Decision Record impact

Aligned with ADR 0029 §2.3 and the existing Group participant contract; no ADR amendment.

Sweeps and ownership

Live latest 20 open issues and latest 30 all-state A2A checked at 2026-09-08T22:00–22:02Z. #18502 explicitly excludes this repair and hands it to Emmy; no competing repair ticket found. Own six open assignments checked, with #18458 and #16498 bodies read: playback extraction and post-restore child-loss are distinct. Problem-noun Memory Core queries found the prior Group/native observation migration (session d14f2413-4744-43e9-a6c1-191166d58fe9) but no existing predicate repair. Current source and runtime snapshot govern the fix. Labels verified live.

Taking this as the next active implementation; #18458 remains at its existing PR's CI gate.

Related: #17844 · #18502 · #18458

Origin Session ID: 153d2e0a-ebae-4087-bcd5-3c92d213132c

Retrieval Hint: Workstation waitForTearOutCommit origin catalog false after full vessel transfer