The focused external-Brain evidence work on #17844 now reaches Demo B's cross-window proof. DemoBPerspectivesNL retains the original pane but reads mount count 3 where its endpoint expects 2. An oracle-preserving cold-gesture diagnostic at Engine bfd1d262b2 captured the actual executor receipt:
Stage
Pane mount delta
Source → live vessel
1
Vessel → target header proxy
0
Final target document
1
Total
2
The target embodiment is header=true, ownsPane=false, settled=true and visible=true. Same-instance, non-reset frames, source removal, target placement, one transfer and source-drop suppression all pass. The receipt rejects only “target proxy added exactly one mount” and “vessel, proxy and final target each mounted once”.
The Problem
The example's post-transfer oracle still requires the old pane-owning proxy (proxy +1, total +3). The accepted header-only proxy carries no pane mount. This rejects a valid committed transfer and prevents the perspective tour from continuing. The cold cross-window witness mirrors those stale numbers; the perspective endpoint still assumes only one transfer mount.
The Architectural Reality
DemoBWorkspace#commitCrossWindowTransfer already captures pre-gesture, settled vessel, settled proxy and final target counters; its existing deltas isolate every stage.
VesselEmbodiment's header branch renders a header and never stages the pane. Its snapshot exposes header, ownership, settlement, visibility and window identity.
DemoBCrossWindowDragNL.spec.mjs's cold arm reads the complete receipt; its round-trip arm already expects header-only ownership.
DemoBPerspectivesNL.spec.mjs owns the paced tour and deterministic no-pause replay.
Design authority: ADR 0029 §2.8.6 says “the live pane stays in the parked vessel until the drop”; merged PR #19254 implemented that contract. The current stage receipt matches it.
The Fix
Align the example-owned proof and its two dependent E2E witnesses with the header-only path. Explicitly prove a settled visible header proxy for the correct item and target that does not own the pane, then require stage deltas 1/0/1 and total 2. Retain single-commit/drop suppression, document ownership, identity and frame checks. The perspective endpoint must count the vessel and final-target mounts; the tour and replay must then finish. Align the full Group workspace-key set and optional catalog-reference expectations with ADR 0029 and the landed placement/reference changes; correct the stale example comments. The headed-only physical adapter must not compete with headless native park/retirement.
The resumed full journey exposed two further causal gaps. Demo B starts asynchronous surface cues from observational beat events without supplying TourRunner's existing stepSettlement callback, so zero-pause restore can overtake reattach. Wire the current cue outcome and projection into that callback. A sanctioned Main delta trace then showed ancestor update 363 and toolbar update 364 each insert the same new header id, while worker/VDOM membership is unique; the DOM duplicate persists for five seconds.
The attempted Reconciler commit-suppression repair did not remove the duplicate and was discarded. A subsequent pre-send probe found an emitted deep host without in-flight protection. Generic renderer prerequisite #19467 owns that defect; this leaf retains the strict consistency check and a later direct toolbar-write control. Its runtime scope remains the two existing example modules and two E2E witnesses. The measured cue/receipt repair also updates the existing DemoBWorkspace size-guard baseline from 2,503 to 2,514 code lines; the PR supplies the guard-required per-path growth rationale.
Prescription checked: host proof/cue ordering belong in DemoBWorkspace. The generic renderer's emitted-root protection belongs to prerequisite #19467 and remains outside this leaf.
Contract Ledger
Surface
Authority
Behavior
Fallback
Docs
Evidence
executeCrossWindowStep receipt
Host proof + ADR 0029 §2.8.6
Existing receipt shape accepts the valid header transfer; still rejects failed ownership/continuity/stage checks
Current cue and projection finish before the next beat; both modes preserve pane continuity and deterministic logs
Existing runner abort boundary
Owning JSDoc
Complete perspective journey
Chrome consistency witness
Existing worker/VDOM/DOM agreement, with prerequisite #19467
New header membership and a later toolbar write stay coherent
Existing strict failure
Witness JSDoc
Main delta red control and focused journey
Decision Record impact: aligned-with ADR 0029; no authority mutation.
Structure map: N/A — existing Body example/witness restoration; no new modules or Agent OS surface.
Acceptance Criteria
Host requires a settled, visible header-only proxy for the expected item and target, with ownsPane=false.
Host proof requires vessel +1, proxy +0, target +1, total +2, retaining every other commit, ownership, suppression, identity and frame check.
Cold cross-window witness asserts that same stage/embodiment contract; round-trip and cancellation arms remain verified.
Paced perspective tour and deterministic no-pause replay finish with the original counter, expected mounts, advancing frames, complete registered Group capture, optional-reference metadata and the existing changed-topology restore outcome.
Focus-header worker, VDOM and DOM membership are unique after projection and a subsequent toolbar write; the duplicate-birth red control remains recorded.
Both complete existing spec files pass with the external Brain runtime; the unchanged host/oracle receipt remains the red control.
A focused receipt is linked to #17844; full-battery and headed/native acceptance are not certified by this leaf.
Out of Scope
Generic Main/VDOM lifecycle changes, weaker settlement, new tour paths, placement history repair, full-battery or headed acceptance.
Avoided Traps
Do not change only the scalar endpoint: the host receipt itself aborts the tour. No pane staging added to justify old counts, no swallowed refusal, no new helper.
Related
Related: #17844
Renderer prerequisite delivered: #19467 via merged PR #19468
Origin Session ID: 01a11843-6adc-72c0-b895-ab4207603b32
Retrieval Hint: "Demo B cross-window rejected receipt header-only proxy mount delta 1 0 1 total 2"
Creation sweep: exact live history searches found no equivalent repair; closed #19288 explicitly excludes the later perspective assertion. MC raw/summary and KB queries found adjacent cross-window history/embodiment work, but no prior ruling about this stale receipt. Own-assignment sweep: four open Engine tickets; only parent #17844 touches this surface and requires separate repair leaves. Latest-created open queue and all-state recent claims rechecked immediately before filing.
Resumed evidence: ADR 0029 §2.2 defines capture as every semantic workspace; a3f6bbcd2a adopted workspaceSet.ids plus placement hints, and 2509fb1089 removed the redundant catalog reference. Existing TourRunner JSDoc identifies the host-owned awaited cue boundary. The current Main delta trace identifies two insertNode births under the same toolbar in successive ancestor/toolbar flights. The prior closed chrome-collision ticket used a different canonical-reference cure; its discarded timing hypotheses are not assumed here.
tobiu referenced in commit 735ae3d - "fix(demo): align header proof and await tour cues (#19461) (#19469) on Oct 8, 2026, 11:27 AM
Context
The focused external-Brain evidence work on #17844 now reaches Demo B's cross-window proof.
DemoBPerspectivesNLretains the original pane but reads mount count 3 where its endpoint expects 2. An oracle-preserving cold-gesture diagnostic at Enginebfd1d262b2captured the actual executor receipt:The target embodiment is header=true, ownsPane=false, settled=true and visible=true. Same-instance, non-reset frames, source removal, target placement, one transfer and source-drop suppression all pass. The receipt rejects only “target proxy added exactly one mount” and “vessel, proxy and final target each mounted once”.
The Problem
The example's post-transfer oracle still requires the old pane-owning proxy (proxy +1, total +3). The accepted header-only proxy carries no pane mount. This rejects a valid committed transfer and prevents the perspective tour from continuing. The cold cross-window witness mirrors those stale numbers; the perspective endpoint still assumes only one transfer mount.
The Architectural Reality
DemoBWorkspace#commitCrossWindowTransferalready captures pre-gesture, settled vessel, settled proxy and final target counters; its existing deltas isolate every stage.VesselEmbodiment's header branch renders a header and never stages the pane. Its snapshot exposes header, ownership, settlement, visibility and window identity.DemoBCrossWindowDragNL.spec.mjs's cold arm reads the complete receipt; its round-trip arm already expects header-only ownership.DemoBPerspectivesNL.spec.mjsowns the paced tour and deterministic no-pause replay.Design authority: ADR 0029 §2.8.6 says “the live pane stays in the parked vessel until the drop”; merged PR
#19254implemented that contract. The current stage receipt matches it.The Fix
Align the example-owned proof and its two dependent E2E witnesses with the header-only path. Explicitly prove a settled visible header proxy for the correct item and target that does not own the pane, then require stage deltas 1/0/1 and total 2. Retain single-commit/drop suppression, document ownership, identity and frame checks. The perspective endpoint must count the vessel and final-target mounts; the tour and replay must then finish. Align the full Group workspace-key set and optional catalog-reference expectations with ADR 0029 and the landed placement/reference changes; correct the stale example comments. The headed-only physical adapter must not compete with headless native park/retirement.
The resumed full journey exposed two further causal gaps. Demo B starts asynchronous surface cues from observational beat events without supplying TourRunner's existing stepSettlement callback, so zero-pause restore can overtake reattach. Wire the current cue outcome and projection into that callback. A sanctioned Main delta trace then showed ancestor update 363 and toolbar update 364 each insert the same new header id, while worker/VDOM membership is unique; the DOM duplicate persists for five seconds.
The attempted Reconciler commit-suppression repair did not remove the duplicate and was discarded. A subsequent pre-send probe found an emitted deep host without in-flight protection. Generic renderer prerequisite #19467 owns that defect; this leaf retains the strict consistency check and a later direct toolbar-write control. Its runtime scope remains the two existing example modules and two E2E witnesses. The measured cue/receipt repair also updates the existing DemoBWorkspace size-guard baseline from 2,503 to 2,514 code lines; the PR supplies the guard-required per-path growth rationale.
Prescription checked: host proof/cue ordering belong in DemoBWorkspace. The generic renderer's emitted-root protection belongs to prerequisite #19467 and remains outside this leaf.
Contract Ledger
executeCrossWindowStepreceiptremoteSnapshot.embodimentVesselEmbodiment#snapshotDecision Record impact: aligned-with ADR 0029; no authority mutation. Structure map: N/A — existing Body example/witness restoration; no new modules or Agent OS surface.
Acceptance Criteria
Out of Scope
Generic Main/VDOM lifecycle changes, weaker settlement, new tour paths, placement history repair, full-battery or headed acceptance.
Avoided Traps
Do not change only the scalar endpoint: the host receipt itself aborts the tour. No pane staging added to justify old counts, no swallowed refusal, no new helper.
Related
Related: #17844 Renderer prerequisite delivered: #19467 via merged PR #19468
Origin Session ID: 01a11843-6adc-72c0-b895-ab4207603b32 Retrieval Hint: "Demo B cross-window rejected receipt header-only proxy mount delta 1 0 1 total 2"
Creation sweep: exact live history searches found no equivalent repair; closed
#19288explicitly excludes the later perspective assertion. MC raw/summary and KB queries found adjacent cross-window history/embodiment work, but no prior ruling about this stale receipt. Own-assignment sweep: four open Engine tickets; only parent#17844touches this surface and requires separate repair leaves. Latest-created open queue and all-state recent claims rechecked immediately before filing.Resumed evidence: ADR 0029 §2.2 defines capture as every semantic workspace; a3f6bbcd2a adopted workspaceSet.ids plus placement hints, and 2509fb1089 removed the redundant catalog reference. Existing TourRunner JSDoc identifies the host-owned awaited cue boundary. The current Main delta trace identifies two insertNode births under the same toolbar in successive ancestor/toolbar flights. The prior closed chrome-collision ticket used a different canonical-reference cure; its discarded timing hypotheses are not assumed here.