WorkstationNativeTitlebarDragNL still expects the vessel ownership a return home now retires

Context

#17844's census at dev a9abb6c1dc lists WorkstationNativeTitlebarDragNL › a popup moved by its OS titlebar previews the zone under its corner and reintegrates there under dwell red:

TypeError: Cannot read properties of undefined (reading 'windowId')
> 328 |  ownerWindowId: lifecycle.owners.commits.windowId,

Bisected on the unmodified spec (headless, --workers=1): green at 4dc6f744e5^, red from 4dc6f744e5 (#19208, Resolves #19188) through dev 08a84ef3be, 2/2 runs.

The Problem

#19208 made a return home retire the returned items' vessel ownership: NativeLifecycle#recordOwner(sourceId, itemId, null) deletes the record. Before it, a returned item kept its record with an unbound render target ({windowId: null}), the stale state #19188 fixed. The arm's reintegration poll still expects that record (ownerWindowId: null) and reads it unguarded, so the first sample after the retirement throws, and the poll aborts instead of retrying.

The Architectural Reality

• The engine is right: the poll's other fields reach {inTree: true, connected: false, retirements: 0}. With the read guarded, both arms pass at dev 08a84ef3be, and the pane lands where the corner pointed with its live instance intact.
• The sibling reads in the file are guarded (:184, :451, :580). The other unguarded owner reads in the e2e tree (DemoBCrossWindowDragNL:595, TearOutMatrixRows4To7NL:345, WorkstationNativePopupOverPopupNL:440) read an item while its vessel still owns it.

The Fix

:328 asserts #19208's contract instead of the pre-#19208 record: owned: Boolean(lifecycle.owners.commits), expected false, beside connected. That is stricter than guarding the read, because a record retained with windowId: null (the #19188 state) fails it. The whole-stack arm's terminal read (:580, metricsOwner: …?.windowId ?? null) maps that retained record to null and passes over it, so it becomes metricsOwned: false the same way.

Acceptance Criteria

• AC-1: the spec file passes at the head (headless, --workers=1, runtime root bound), both arms.
• AC-2: red-first, dev's spec at the same head fails the arm with the TypeError.
• AC-3: mutation, the assertions fail on a retained record: with recordOwner's null branch keeping {windowId: null} instead of deleting, the arms fail on owned and metricsOwned.

Out of Scope

• The rest of #17844's census, refreshed on #17844.
• Engine changes: #19208's retirement is the intended contract.

Related

#17844 (census) · #19188 / #19208 (the retirement) · #18029 (the spec's origin)

Origin Session ID: 81d1894c-d8fd-4192-8350-42e32eb0101e Retrieval Hint: "WorkstationNativeTitlebarDragNL owners.commits.windowId TypeError vessel ownership retired return home #19208"