From 226492fb17b15e74f119b51764e8f6f2177aa7db Mon Sep 17 00:00:00 2001
From: Ned <ned.twigg@diffplug.com>
Date: Thu, 1 Oct 2026 18:42:35 -0700
Subject: [PATCH 1/2] Audit companion contracts and rationales; follow docs
 imports on Windows

---
 docs/prose-audit.md            |  6 ++-
 docs/specs/website-docs.md     |  2 +-
 package.json                   |  2 +-
 scripts/docs-surfaces.mjs      | 26 ++++++++++++
 scripts/docs-surfaces.test.mjs | 30 +++++++++++++
 scripts/prose-audit.mjs        | 30 +++++++++----
 scripts/prose-audit.test.mjs   | 77 ++++++++++++++++++++++++++++++++++
 scripts/public-docs-lint.mjs   | 22 ++--------
 8 files changed, 164 insertions(+), 31 deletions(-)
 create mode 100644 scripts/docs-surfaces.mjs
 create mode 100644 scripts/docs-surfaces.test.mjs
 create mode 100644 scripts/prose-audit.test.mjs

diff --git a/docs/prose-audit.md b/docs/prose-audit.md
index 7a5a9f8ac..810ee0ce4 100644
--- a/docs/prose-audit.md
+++ b/docs/prose-audit.md
@@ -11,13 +11,15 @@ pnpm audit:prose
 pnpm audit:prose --changed=origin/main
 ```
 
-The full pass proves corpus coverage. The changed pass selects any spec whose text or referenced code changed from the given base, plus working-tree changes. Use the stacked PR's actual base branch rather than assuming `main`. `--json` emits machine-readable results.
+The full pass inventories the corpus; it does not prove that its claims match implementation. The changed pass selects any spec whose text, rationale, or code referenced by either changed from the given base, plus working-tree changes. Use the stacked PR's actual base branch rather than assuming `main`. `--json` emits machine-readable results.
+
+The inventory includes `AGENTS.md`, `SECURITY.md`, `SELF_HOST.md`, and `docs/compatible-agents.md`, plus each existing rationale and its references. Imported implementation files still need manual inspection: changed selection follows explicit references, not transitive imports.
 
 The command is dependency-free and advisory. Its thresholds intentionally favor recall: a hit is a review prompt, not a lint failure or permission to delete text. The default report caps each spec's detail; add `--all` or `--json` to inspect every hit.
 
 ## Review one cluster
 
-1. Read each spec and the rationale sections matching the headings being touched.
+1. Read each spec and its paired rationale. Review every behavior-bearing section, including sections with no advisory hit; follow implementation imports and check both spec claims against code and relevant code branches against the spec.
 2. Inspect every resolved reference. Resolve any reported file-like reference manually; ambiguity often means the pointer itself can be clearer.
    A `Files` / `Code Map` section should offer useful entrypoints to follow through imports, while section-local `Source of truth:` pointers locate particular rules. Keep both when they serve those distinct jobs; check map paths and role descriptions against code without requiring exhaustive coverage or a map in every spec.
 3. Give each hit one disposition:
diff --git a/docs/specs/website-docs.md b/docs/specs/website-docs.md
index bcc2f2561..785245f36 100644
--- a/docs/specs/website-docs.md
+++ b/docs/specs/website-docs.md
@@ -317,7 +317,7 @@ state and clear WCAG AA both at rest and on hover** (rationale).
 WCAG AA against the surface carrying it; never dim text with opacity**
 (rationale). `docsMutedTextForSurfaces` and `website/src/lib/docs-accent.test.ts` pin
 the base and every registered tinted surface composition across bundled themes;
-`checkNoDimmedDocsText` pins the call sites, allowlisting what is not text.
+`checkNoDimmedDocsText` pins the call sites, allowlisting what is not text. **Must follow transitive relative imports with repository-relative paths on every platform.** `scripts/docs-surfaces.test.mjs` pins the graph traversal.
 
 **Must prompt a reader to pick a theme until they answer, and dismiss both
 responsive placements together.** Picking one and closing the prompt both count.
diff --git a/package.json b/package.json
index 3d3e92f6d..be79415cf 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "build:hosted": "pnpm --filter dormouse-hosted build",
     "test:hosted": "pnpm --filter remote-lib-common build && pnpm --filter dormouse-hosted test",
     "build": "pnpm run build:vscode && pnpm --filter dormouse-lib build:pocket && pnpm --filter dormouse-website build && pnpm build:hosted",
-    "test": "node scripts/spec-lint.mjs && node scripts/spec-lint-selftest.mjs && node scripts/public-docs-lint.mjs && node scripts/xterm-lint.mjs && node --test scripts/xterm-bump.test.mjs && node scripts/loopback-lint.mjs && node scripts/loopback-lint-selftest.mjs && node scripts/deploy-lint.mjs && node scripts/deploy-lint-selftest.mjs && node scripts/installer-verify-test.mjs && node scripts/ps1-cmdlet-lint.mjs && node scripts/ps1-cmdlet-lint-selftest.mjs && node scripts/e2e-lint.mjs && node scripts/e2e-lint-selftest.mjs && node scripts/clamp-issue-body-selftest.mjs && node --test scripts/sign-and-deploy.test.mjs && node --test scripts/workflow-audit.test.mjs && node --test scripts/pairing-walkthrough/proc.test.mjs && node --test scripts/security-audit.test.mjs && pnpm --filter dormouse-hosted test:deploy && pnpm --filter dormouse-hosted test:miniflare && pnpm -r --filter \"!dormouse-hosted\" run test",
+    "test": "node scripts/spec-lint.mjs && node scripts/spec-lint-selftest.mjs && node --test scripts/prose-audit.test.mjs scripts/docs-surfaces.test.mjs && node scripts/public-docs-lint.mjs && node scripts/xterm-lint.mjs && node --test scripts/xterm-bump.test.mjs && node scripts/loopback-lint.mjs && node scripts/loopback-lint-selftest.mjs && node scripts/deploy-lint.mjs && node scripts/deploy-lint-selftest.mjs && node scripts/installer-verify-test.mjs && node scripts/ps1-cmdlet-lint.mjs && node scripts/ps1-cmdlet-lint-selftest.mjs && node scripts/e2e-lint.mjs && node scripts/e2e-lint-selftest.mjs && node scripts/clamp-issue-body-selftest.mjs && node --test scripts/sign-and-deploy.test.mjs && node --test scripts/workflow-audit.test.mjs && node --test scripts/pairing-walkthrough/proc.test.mjs && node --test scripts/security-audit.test.mjs && pnpm --filter dormouse-hosted test:deploy && pnpm --filter dormouse-hosted test:miniflare && pnpm -r --filter \"!dormouse-hosted\" run test",
     "lint:specs": "node scripts/spec-lint.mjs && node scripts/spec-lint-selftest.mjs",
     "lint:public-docs": "node scripts/public-docs-lint.mjs",
     "audit:prose": "node scripts/prose-audit.mjs",
diff --git a/scripts/docs-surfaces.mjs b/scripts/docs-surfaces.mjs
new file mode 100644
index 000000000..5741e6113
--- /dev/null
+++ b/scripts/docs-surfaces.mjs
@@ -0,0 +1,26 @@
+import { posix } from 'node:path';
+
+/** Follow relative TypeScript imports from the route-owned entrypoints.
+ * Git paths use forward slashes on every OS; native path.join on Windows
+ * silently drops imported components from the checked documentation surfaces.
+ */
+export function collectDocsSurfaces(seeds, files, read) {
+  const tracked = new Set(files);
+  const seen = new Set();
+  const queue = [...seeds];
+  while (queue.length > 0) {
+    const rel = queue.shift();
+    if (seen.has(rel) || !tracked.has(rel)) continue;
+    seen.add(rel);
+    for (const [, spec] of read(rel).matchAll(/from\s+["'](\.[^"']+)["']/g)) {
+      const resolved = posix.join(posix.dirname(rel), spec);
+      for (const ext of ['.tsx', '.ts']) {
+        if (tracked.has(resolved + ext)) queue.push(resolved + ext);
+      }
+    }
+  }
+  return {
+    surfaces: [...seen].filter(rel => rel.endsWith('.tsx')).sort(),
+    missingSeeds: seeds.filter(rel => !tracked.has(rel)),
+  };
+}
diff --git a/scripts/docs-surfaces.test.mjs b/scripts/docs-surfaces.test.mjs
new file mode 100644
index 000000000..ed6afe650
--- /dev/null
+++ b/scripts/docs-surfaces.test.mjs
@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { collectDocsSurfaces } from './docs-surfaces.mjs';
+
+test('docs checks reach nested components through TS bridges and cyclic imports on every OS', () => {
+  const source = {
+    'website/src/pages/Guide.tsx': `import { theme } from '../lib/theme'; import { Page } from '../components/Page';`,
+    'website/src/lib/theme.ts': `export { ThemeControl } from '../components/ThemeControl';`,
+    'website/src/components/Page.tsx': `import { Guide } from '../pages/Guide'; import React from 'react';`,
+    'website/src/components/ThemeControl.tsx': '',
+  };
+  const reads = [];
+  const result = collectDocsSurfaces(['website/src/pages/Guide.tsx'], Object.keys(source), rel => {
+    reads.push(rel);
+    return source[rel];
+  });
+  assert.deepEqual(result, {
+    surfaces: ['website/src/components/Page.tsx', 'website/src/components/ThemeControl.tsx', 'website/src/pages/Guide.tsx'],
+    missingSeeds: [],
+  });
+  assert.equal(new Set(reads).size, reads.length);
+});
+
+test('missing seeds are reported and absent imports are never read', () => {
+  const source = { 'src/Page.tsx': `import { Absent } from './Absent'; import { Package } from 'package';` };
+  assert.deepEqual(collectDocsSurfaces(['src/Page.tsx', 'src/Missing.tsx'], Object.keys(source), rel => {
+    assert.ok(Object.hasOwn(source, rel));
+    return source[rel];
+  }), { surfaces: ['src/Page.tsx'], missingSeeds: ['src/Missing.tsx'] });
+});
diff --git a/scripts/prose-audit.mjs b/scripts/prose-audit.mjs
index 65ad9c4d1..3d973f84e 100644
--- a/scripts/prose-audit.mjs
+++ b/scripts/prose-audit.mjs
@@ -16,7 +16,7 @@ const unknown = args.filter((arg) => !['--all', '--json', '--help', '--changed']
 if (args.includes('--help')) {
   console.log(`Usage: pnpm audit:prose [--changed[=<base>]] [--all] [--json]
 
-Without --changed, audits every spec and the code files it references.
+Without --changed, audits every spec, companion contract, rationale, and referenced code.
 --changed audits specs or references changed from <base> (default: origin/main),
 including staged, unstaged, and untracked files. --all expands the concise report.
 Findings are advisory.`);
@@ -29,7 +29,7 @@ if (unknown.length > 0) {
 
 const read = (rel) => readFileSync(join(ROOT, rel), 'utf8');
 const git = (...gitArgs) => execFileSync('git', gitArgs, { cwd: ROOT, encoding: 'utf8' });
-const tracked = git('ls-files').trim().split('\n').filter(Boolean);
+const tracked = git('ls-files', '--cached', '--others', '--exclude-standard').trim().split('\n').filter(Boolean);
 const trackedSet = new Set(tracked);
 const basenameIndex = new Map();
 for (const rel of tracked) {
@@ -43,7 +43,7 @@ const specFiles = readdirSync(join(ROOT, 'docs/specs'))
   .filter((name) => name.endsWith('.md') && !name.endsWith('.rationale.md'))
   .map((name) => `docs/specs/${name}`)
   .sort();
-specFiles.push('SELF_HOST.md');
+specFiles.push('AGENTS.md', 'SECURITY.md', 'SELF_HOST.md', 'docs/compatible-agents.md');
 const budgets = JSON.parse(read('scripts/spec-word-budgets.json'));
 const codeExtensions = new Set(SOURCE_EXTENSIONS.map((ext) => `.${ext}`));
 const extension = (rel) => /\.[^.\/]+$/.exec(rel)?.[0] ?? '';
@@ -211,27 +211,38 @@ function changedFiles(base) {
 
 let reports = specFiles.map((spec) => {
   const text = read(spec);
-  const rationale = spec === 'SELF_HOST.md' ? null : spec.replace(/\.md$/, '.rationale.md');
-  const { refs, unresolved } = referencesOf(spec, text);
+  const rationalePath = spec.replace(/\.md$/, '.rationale.md');
+  const rationaleText = existsSync(join(ROOT, rationalePath)) ? read(rationalePath) : null;
+  const specReferences = referencesOf(spec, text);
+  const rationaleReferences = rationaleText === null ? { refs: [], unresolved: [] } : referencesOf(rationalePath, rationaleText);
+  const refs = [...new Set([...specReferences.refs, ...rationaleReferences.refs])].sort();
+  const unresolved = [...new Set([...specReferences.unresolved, ...rationaleReferences.unresolved])].sort();
   const prose = proseCandidates(text);
-  const code = codeCandidates(text, refs);
+  const rationale = rationaleText === null ? null : {
+    path: rationalePath,
+    words: wordCount(rationaleText),
+    references: rationaleReferences.refs,
+    unresolved: rationaleReferences.unresolved,
+    prose: proseCandidates(rationaleText),
+  };
+  const code = codeCandidates(text + '\n' + (rationaleText ?? ''), refs);
   return {
     spec,
     words: wordCount(text),
     budget: budgets[spec],
-    rationale: rationale && existsSync(join(ROOT, rationale)) ? { path: rationale, words: wordCount(read(rationale)) } : null,
+    rationale,
     references: refs,
     unresolved,
     prose,
     code,
-    score: prose.length + code.reduce((sum, file) => sum + file.findings.length, 0),
+    score: prose.length + (rationale?.prose.length ?? 0) + code.reduce((sum, file) => sum + file.findings.length, 0),
   };
 });
 
 if (changedArg) {
   const base = changedArg.includes('=') ? changedArg.slice(changedArg.indexOf('=') + 1) : 'origin/main';
   const changed = changedFiles(base);
-  reports = reports.filter((report) => changed.has(report.spec) || changed.has(report.rationale?.path) || report.references.some((ref) => changed.has(ref)));
+  reports = reports.filter((report) => changed.has(report.spec) || changed.has(report.spec.replace(/\.md$/, '.rationale.md')) || report.references.some((ref) => changed.has(ref)));
 }
 
 if (json) {
@@ -245,6 +256,7 @@ for (const report of reports) {
   const rationale = report.rationale ? `; rationale ${report.rationale.words}w` : '';
   console.log(`${report.spec} — ${report.words}/${budget}w; ${report.references.length} refs${rationale}; ${report.score} hit(s)`);
   const hits = report.prose.map((hit) => ({ ...hit, path: report.spec }));
+  for (const hit of report.rationale?.prose ?? []) hits.push({ ...hit, path: report.rationale.path });
   for (const file of report.code) {
     for (const hit of file.findings) hits.push({ ...hit, path: file.path });
   }
diff --git a/scripts/prose-audit.test.mjs b/scripts/prose-audit.test.mjs
new file mode 100644
index 000000000..8ef1e7700
--- /dev/null
+++ b/scripts/prose-audit.test.mjs
@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { copyFileSync, mkdirSync, mkdtempSync, rmSync, writeFileSync, appendFileSync, unlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { test } from 'node:test';
+
+const source = dirname(fileURLToPath(import.meta.url));
+function fixture(t) {
+  const root = mkdtempSync(join(tmpdir(), 'dormouse-prose-audit-'));
+  assert.equal(dirname(root), tmpdir());
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const put = (path, text) => {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), text);
+  };
+  for (const name of ['prose-audit.mjs', 'spec-md.mjs']) {
+    mkdirSync(join(root, 'scripts'), { recursive: true });
+    copyFileSync(join(source, name), join(root, 'scripts', name));
+  }
+  put('scripts/spec-word-budgets.json', '{}');
+  put('docs/specs/example.md', '# Example\n\nSee \x60src/direct.ts\x60.\n');
+  put('src/direct.ts', 'export const direct = true;\n');
+  put('src/rationale.ts', 'export const rationale = true;\n');
+  for (const path of ['AGENTS.md', 'SECURITY.md', 'SELF_HOST.md', 'docs/compatible-agents.md']) put(path, '# Contract\n');
+  put('docs/specs/example.rationale.md', '# Rationale\n\nSee \x60src/rationale.ts\x60.\n\n' + 'Measured because this boundary matters. '.repeat(35) + '\n');
+  put('SELF_HOST.rationale.md', '# Installer evidence\n\nSee \x60src/rationale.ts\x60.\n');
+  const git = (...args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  git('init', '-q');
+  git('add', '.');
+  git('-c', 'user.name=Audit Fixture', '-c', 'user.email=audit@example.invalid', 'commit', '-qm', 'fixture');
+  const run = (...args) => JSON.parse(execFileSync(process.execPath, ['scripts/prose-audit.mjs', '--json', ...args], { cwd: root, encoding: 'utf8' }));
+  return { root, run, git };
+}
+
+test('full inventory includes companion contracts and installer rationale', t => {
+  const { run } = fixture(t);
+  const { specs } = run();
+  assert.deepEqual(specs.map(report => report.spec).sort(), ['AGENTS.md', 'SECURITY.md', 'SELF_HOST.md', 'docs/compatible-agents.md', 'docs/specs/example.md'].sort());
+  assert.equal(specs.find(report => report.spec === 'SELF_HOST.md').rationale.path, 'SELF_HOST.rationale.md');
+});
+
+test('rationale prose and its source references participate in the inventory', t => {
+  const { run } = fixture(t);
+  const report = run().specs.find(report => report.spec === 'docs/specs/example.md');
+  assert.deepEqual(report.references, ['src/direct.ts', 'src/rationale.ts']);
+  assert.deepEqual(report.rationale.references, ['src/rationale.ts']);
+  assert.ok(report.rationale.prose.some(hit => hit.kind === 'LONG'));
+  assert.ok(report.rationale.prose.some(hit => hit.kind === 'RATIONALE'));
+  assert.equal(report.score, report.prose.length + report.rationale.prose.length + report.code.reduce((sum, file) => sum + file.findings.length, 0));
+});
+
+test('changed selection includes code referenced only by rationale', t => {
+  const { root, run } = fixture(t);
+  appendFileSync(join(root, 'src/rationale.ts'), 'export const changed = true;\n');
+  assert.deepEqual(run('--changed=HEAD').specs.map(report => report.spec).sort(), ['SELF_HOST.md', 'docs/specs/example.md']);
+});
+
+test('removed rationale still selects its owning spec', t => {
+  const { root, run } = fixture(t);
+  unlinkSync(join(root, 'docs/specs/example.rationale.md'));
+  const reports = run('--changed=HEAD').specs;
+  assert.deepEqual(reports.map(report => report.spec), ['docs/specs/example.md']);
+  assert.equal(reports[0].rationale, null);
+});
+
+test('changed selection resolves a newly present untracked referenced source', t => {
+  const { root, run, git } = fixture(t);
+  appendFileSync(join(root, 'docs/specs/example.md'), 'See \x60src/new.ts\x60.\n');
+  git('add', 'docs/specs/example.md');
+  git('-c', 'user.name=Audit Fixture', '-c', 'user.email=audit@example.invalid', 'commit', '-qm', 'future reference');
+  writeFileSync(join(root, 'src/new.ts'), '// Newly implemented source.\n');
+  const reports = run('--changed=HEAD').specs;
+  assert.deepEqual(reports.map(report => report.spec), ['docs/specs/example.md']);
+  assert.ok(reports[0].references.includes('src/new.ts'));
+});
diff --git a/scripts/public-docs-lint.mjs b/scripts/public-docs-lint.mjs
index 22a870f87..f6b2007a2 100644
--- a/scripts/public-docs-lint.mjs
+++ b/scripts/public-docs-lint.mjs
@@ -24,6 +24,7 @@
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { repoRoot, readRepoFile, trackedFiles } from './lint-kit.mjs';
+import { collectDocsSurfaces } from './docs-surfaces.mjs';
 import {
   hasScheme,
   inlineToText,
@@ -78,24 +79,9 @@ function docsSurfaces() {
     `${WEBSITE_SRC}/components/DocsLayout.tsx`,
     ...DOCS_PAGES.map((page) => `${WEBSITE_SRC}/${page.module.replace(/^\.\//, '')}`),
   ];
-  const tracked = new Set(trackedFiles());
-  const seen = new Set();
-  const queue = [...seed];
-  while (queue.length > 0) {
-    const rel = queue.shift();
-    if (seen.has(rel) || !tracked.has(rel)) continue;
-    seen.add(rel);
-    for (const [, spec] of readRepoFile(rel).matchAll(/from\s+["'](\.[^"']+)["']/g)) {
-      const resolved = join(dirname(rel), spec);
-      for (const ext of ['.tsx', '.ts']) {
-        if (tracked.has(resolved + ext)) queue.push(resolved + ext);
-      }
-    }
-  }
-  for (const rel of seed) {
-    if (!tracked.has(rel)) fail(`${rel}: docsSurfaces seed names a file that does not exist`);
-  }
-  return [...seen].filter((rel) => rel.endsWith('.tsx')).sort();
+  const { surfaces, missingSeeds } = collectDocsSurfaces(seed, trackedFiles(), readRepoFile);
+  for (const rel of missingSeeds) fail(`${rel}: docsSurfaces seed names a file that does not exist`);
+  return surfaces;
 }
 
 /** Each source read once and parsed once, then shared by every check. */

From 5587eac6ffa9942a8831d724e9d25446b4a40eeb Mon Sep 17 00:00:00 2001
From: Ned <ned.twigg@diffplug.com>
Date: Thu, 1 Oct 2026 18:42:35 -0700
Subject: [PATCH 2/2] Reconcile Surface and Workspace specs; preserve Tool
 recovery and drop ownership

---
 docs/specs/glossary.md                        | 28 ++++++-------
 docs/specs/layout.md                          | 40 ++++++++-----------
 docs/specs/layout.rationale.md                |  6 +--
 docs/specs/shortcuts.md                       |  8 ++--
 docs/specs/tiling-engine.md                   | 35 ++++++++--------
 lib/src/components/Wall.tsx                   |  1 +
 lib/src/components/WorkspaceWindow.test.tsx   | 28 +++++++++++++
 .../wall/WorkspaceSelectionOverlay.tsx        |  2 +-
 .../wall/keyboard/handle-dual-tap.ts          |  2 +-
 lib/src/components/wall/lath-wall-store.ts    |  8 ++--
 .../wall/use-session-persistence.ts           |  6 ++-
 lib/src/lib/lath/layout.ts                    |  4 +-
 lib/src/lib/ring-geometry.ts                  |  2 +-
 lib/src/lib/session-restore.test.ts           | 26 ++++++++++++
 lib/src/lib/session-restore.ts                |  2 +-
 scripts/spec-word-budgets.json                |  4 +-
 16 files changed, 124 insertions(+), 78 deletions(-)

diff --git a/docs/specs/glossary.md b/docs/specs/glossary.md
index 9b4e2f098..60acd9f26 100644
--- a/docs/specs/glossary.md
+++ b/docs/specs/glossary.md
@@ -16,7 +16,7 @@ A **Surface** is the durable occupant of a Pane — the content in a slot. Three
 
 A **Pane** is one Lath leaf, a slot in the tiling layout (`docs/specs/tiling-engine.md`); `lib/src/components/Wall.tsx` owns Panes and Surfaces both.
 
-A Pane holds exactly one Surface today, but the model reserves several (a future in-pane surface strip), so **`dor` targets content — `read` / `send` / `await` / `kill` — by Surface ref (`surface:N`)**, holding Pane refs back for layout-only commands (rationale).
+A Pane holds one primary Surface today; helpers share its Pane ([Containers](#containers)). The model reserves several primary Surfaces per Pane (a future in-pane surface strip), so **`dor` targets content by Surface ref (`surface:N`)**, reserving Pane refs for layout-only commands (rationale).
 
 **Surface kinds** — the `kind` a `dor` handle reports, derived from the Pane's params, never stored on the id:
 
@@ -30,13 +30,9 @@ A Pane holds exactly one Surface today, but the model reserves several (a future
 
 | Surface | Persisted `surfaceType` (`docs/specs/transport.md`) | `renderMode` (`docs/specs/dor-browser.md`) | CLI `kind` | CLI `render_mode` |
 |---|---|---|---|---|
-| tool Session | `'tool'` | `iframe`, `agent-browser-screencast` or `playwright-screencast` when serving | `tool` | renderer or `null` |
+| tool Session | `'tool'` | Tool renderer when serving | `tool` | renderer or `null` |
 | terminal Session | `'terminal'` (default, omitted) | — | `terminal` | `null` |
-| browser · iframe | `'browser'` | `iframe` | `browser` | `iframe` |
-| browser · screencast | `'browser'` | `agent-browser-screencast` | `browser` | `agent-browser-screencast` |
-| browser · popped out | `'browser'` | `agent-browser-popout` | `browser` | `agent-browser-popout` |
-| browser · playwright screencast | `'browser'` | `playwright-screencast` | `browser` | `playwright-screencast` |
-| browser · playwright popout | `'browser'` | `playwright-popout` | `browser` | `playwright-popout` |
+| browser Surface | `'browser'` | Browser renderer | `browser` | same as `renderMode` |
 
 **Kinds are capability sets, not exclusive categories** — terminal and browser carry one capability each, `tool` both. **Operations gate on the capability they need, never on the kind enum** ([Liskov contract](#liskov-contract)): `read` / `send` / `await` / port scans need the terminal, nav / render-mode / agent-browser verbs the browser. **`dor list --json` rows always emit `has_terminal` and `has_browser`** (rationale). **Must declare each kind's capabilities in the `hasTerminal` / `hasBrowser` table.** Persistence keeps its own `PersistedSurfaceType` discriminant (`docs/specs/transport.md`).
 
@@ -59,7 +55,7 @@ The containment hierarchy `dor` handles commit to (`docs/specs/dor-cli.md`):
 Window ⊃ Workspace ⊃ Pane ⊃ Surface  (terminal = Session | browser)
 ```
 
-**Surface identity:** a primary Surface's id is its Lath leaf id; a helper receives its Lath leaf only on promotion. A terminal Surface's *is* its `SessionId`, stable (I1); browser replacement and relaunch have different identity effects (I10).
+**Surface identity:** a primary Surface's id is its Lath leaf id; a helper receives its Lath leaf only on promotion. A terminal Surface's id is its `SessionId`, stable (I1); browser replacement and relaunch have different identity effects (I10).
 
 ## Containers
 
@@ -153,7 +149,7 @@ A **Session** is the tuple of its `SessionId` plus one state per layer (I1).
 | `Paned` | Rendered in the content area: a primary Lath leaf or its shown auxiliary helper |
 | `Zoomed` | Subset of `Paned` — the passthrough-focused pane is maximized; acquiring zoom gives focus, losing focus returns it to `Paned` |
 | `Doored` | Rendered as a door on the baseboard. DOM survival is a rendering decision, not part of this state: browser DOM retention follows **parking** (`docs/specs/tiling-engine.md` → "Parked leaves"); a terminal Surface unmounts its element (Registry: `Orphaned`) and remounts the same xterm on reattach — nothing replays |
-| `Hidden` | In neither pane nor door — webview closed or mid-transition. A Surface in a hidden Workspace is **not** `Hidden`: it stays `Paned` or `Doored`, mounted and live. Process and Activity unaffected. |
+| `Hidden` | In neither Pane nor Door — webview closed or mid-transition. A Surface in a hidden Workspace retains its `Paned` or `Doored` View state; Registry behavior follows `docs/specs/layout.md` → Workspace lifecycle. Process and Activity unaffected. |
 
 ### Link
 
@@ -214,7 +210,7 @@ A system verb is a lifecycle transition driven by the runtime.
 | Verb | Effect |
 |---|---|
 | `register` / `dispose` | Create / destroy a Registry entry |
-| `release` | Destroy a Registry entry **without** killing its Process (Registry: Mounted → Disposed, Process: Live → Live). The one verb a `transferWorkspace` runs, and never reachable from an unmount. |
+| `release` | Destroy a `Mounted` or `Orphaned` Registry entry **without** killing its `Live` or `Exited` Process. Explicit Workspace transfer and refused-adoption cleanup only, never an unmount. |
 | `mount` / `unmount` | Attach / detach the persistent DOM element (low-level op; the Registry entry survives `unmount`). A **parked** leaf stays mounted while `Doored` or `Hidden` (`docs/specs/tiling-engine.md` → "Parked leaves") |
 | `exit` | Host observes process death (Process: Live → Exited) |
 | `resume` | Webview reopens over retained PTYs (Link: Severed → Resuming → Live; Registry rebuilt from replay data; Process stays Live/Exited) |
@@ -227,14 +223,14 @@ A system verb is a lifecycle transition driven by the runtime.
 
 | Category | Valid when | Examples |
 |---|---|---|
-| **Universal** | any state combination | `kill`, `rename`, state queries |
-| **View-gated** | `View ≠ Hidden` | `focusSession` |
+| **Universal** | no layer-state gate | `kill`, `rename`, state queries |
+| **View-gated** | `View ≠ Hidden` | `focusSession(id, true)` |
 | **Process-gated** | `Process = Live` | `writePty`, `resizePty` |
 | **Registry-gated** | `Registry = Mounted` | `refitSession` |
 | **Terminal-gated** | Surface has a terminal ([Panes and Surfaces](#panes-and-surfaces)) | `dor read` / `send` / `await`, port scans |
 | **Browser-gated** | Surface has a browser | browser nav / render-mode ops |
 
-**Must check the relevant precondition for gated operations; universal operations accept every layer state.** Missing Registry entries silently no-op, while `dor` capability gates return an error. Uniform typed precondition errors are staged ([Future](#future)).
+**Must satisfy gated operations' layer preconditions at the call site or in the operation; universal operations have no layer-state gate.** Missing Registry entries silently no-op, while `dor` capability gates return an error. Uniform typed precondition errors are staged ([Future](#future)).
 
 Source of truth: `focusSession` / `refitSession` in `lib/src/lib/terminal-lifecycle.ts`; `requireTerminalSurface` / `requireBrowserSurface` in `lib/src/components/wall/use-dor-control.ts`.
 
@@ -242,9 +238,9 @@ Source of truth: `focusSession` / `refitSession` in `lib/src/lib/terminal-lifecy
 
 - I1: `SessionId` is immutable for the life of a Session and stable across `resume` / `restore`.
 - I2: Process state is independent of Registry, View, and Link. A `Live` process may be `Doored` or `Hidden`; an `Exited` process may still be `Paned`.
-- I3: Activity state survives `minimize` / `reattach`. `ALERT_RINGING` fires only on a *fresh* transition, never on `mount` or `reattach`.
+- I3: **Must preserve Activity through the layout-only `minimize` / `reattach` transition.** User engagement may acknowledge a ring (`docs/specs/alert.md` → Engagement). `ALERT_RINGING` fires only on a fresh transition, never on `mount` or `reattach`.
 - I4: `Registry: Orphaned` outlives no Session state except `View: Doored` or a Surface in a hidden Workspace — at rest every other entry is `Mounted` or `Disposed`, so an `Orphaned` entry that is neither is a leak.
-- I5: `kill` is universally valid and always ends at `View: Hidden`; its per-kind effects are the [User verbs](#user-verbs) row.
+- I5: `kill` accepts every layer state; a successful closure ends at `View: Hidden`. Closure guards belong to `docs/specs/terminal-context.md` → Promotion and source closure and `docs/specs/dor-tool.md` → Closing unsaved Tools; per-kind effects are the [User verbs](#user-verbs) row.
 - I6: `rename` is universally valid including when `Process = Exited` and `View = Doored`.
 - I7: Every Surface sits in exactly one Pane; every Pane and its Surfaces belong to exactly one Workspace; every Workspace belongs to one Window.
 - I8: **Must preserve Process and Activity during `switchWorkspace`, without firing a fresh ring** (I3). A switch reattaches terminal elements but resumes and restores nothing, so no ring can fire (`docs/specs/layout.md` → Workspaces).
@@ -280,7 +276,7 @@ Remote-only vocabulary (**Viewer**, and the wire-level `DirectoryEntry` projecti
 - A persisted type is `Persisted<Shape>` where `<Shape>` is the glossary noun (`PersistedPane`, `PersistedDoor`, `PersistedWorkspace`, `PersistedWindow`).
 - A handle type is `<Layer>State` (`ActivityState`, not `SessionUiState`).
 - Surface kinds are lowercase strings; [Panes and Surfaces](#panes-and-surfaces) is canonical for how persisted `surfaceType`, `renderMode`, and CLI `kind` / `render_mode` relate.
-- Container names are `PascalCase` nouns (`Workspace`, `Window`); a Workspace's id type is `WorkspaceId`. A Window carries no id today — `dor` addresses it only through the reserved `window:<n>` ref (`docs/specs/dor-cli.md`), with `WindowId` reserved for when it needs one. Container verbs suffix the container (`createWorkspace`, `switchWorkspace`), distinct from the layer-agnostic Session `rename`.
+- Container names are `PascalCase` nouns (`Workspace`, `Window`); a Workspace's id type is `WorkspaceId`. `dor` addresses a Window by its host label (`window:<label>`, or `window:1` on a single-Window host; `docs/specs/dor-cli.md` → Handle Model); `WindowId` remains reserved for a shared identity type. Container verbs suffix the container (`createWorkspace`, `switchWorkspace`), distinct from the layer-agnostic Session `rename`.
 
 ## Future
 
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index 1868527c1..930453fd7 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -230,7 +230,7 @@ A Workspace's name is **auto**, italic (`AUTO_NAME_CLASS`) and derived from its
 - **Any vote inside a git repository wins**: the name is the most common `<repo> @ <branch>`, and directories outside a repository are ignored. `<repo>` is origin's repository name, else the main checkout's folder, so every worktree shares it; a detached HEAD shows a short hash.
 - **Otherwise the most common directory**, counted by `cwdIdentity` and shown by basename: `~` for local home, a remote one with its host.
 - **A tie keeps the current name when it is among the tied**, else takes the earliest member's (Lath leaf order, then Doors).
-- **Must hold the current name through a lookup's first three misses** (rationale), then vote "no repository" so the Workspace names itself from its healthy members, else its folder; `Workspace N` until a terminal reports a directory.
+- **Must hold the current name for a never-answered path until three consecutive unanswered lookups** (rationale), then vote "no repository" so the Workspace names itself from its healthy members, else its folder; `Workspace N` until a terminal reports a directory.
 - **Never ask git about a remote cwd.** **Must re-ask after a command finishes** (rationale). A host without `gitInfo` names by directory.
 - **A path absent from a `gitInfo` answer is unanswered, never "no repository"**, as is every path of a rejected request. **A host failure must reject**, never answer `{}`. An unanswered path keeps its last answer, else holds the name, and is re-asked after a delay doubling per miss.
 - **An untouched editor never submits**: it submits on blur, and opening it must not pin an auto-name, even one that changed while it was open.
@@ -290,7 +290,7 @@ nothing (`iframeSurfaceRefs` on the Wall handle; `standalone/src/workspace-drag.
 
 - **Create** adds an auto-named Workspace, `Workspace N` until its terminals name it ([Workspace names](#workspace-names)), makes it active, and gives its Wall no restored record, so Lath's fresh branch spawns one default-shell pane.
 - **Close** confirms first when the Workspace holds touched Surfaces or running work, with a kill-confirm letter over the Window's content area, then closes every member Surface. **Must atomically replace the last closed Workspace with a fresh one and select its tab**, after disposing the old Surfaces (`lib/src/components/WorkspaceWindow.test.tsx`). **Must serialize closes across the Window.**
-- - **A Workspace whose Wall has not registered is refused** (`workspace '<ref>' is still mounting`, one wording for every caller), never closed past — the Wall walks the member Surfaces, so dropping it would leave its Sessions running unheld (`docs/specs/glossary.md` → "Invariants" I4). **A gesture waits out the registration gap first**, as `dor workspace close` does, so `×` right after a create closes rather than silently doing nothing.
+- **A Workspace whose Wall has not registered is refused** (`workspace '<ref>' is still mounting`, one wording for every caller), never closed past — the Wall walks the member Surfaces, so dropping it would leave its Sessions running unheld (`docs/specs/glossary.md` → "Invariants" I4). **A gesture waits out the registration gap first**, as `dor workspace close` does, so `×` right after a create closes rather than silently doing nothing.
 - **Rename** edits the Workspace `name` only — no Surface title, and not the per-pane inline rename — and pins it ([Workspace names](#workspace-names)).
 - **Reorder** moves a tab in the strip and renumbers `workspace:<n>` refs with it only where they are positional (`docs/specs/dor-cli.md` → "Handle Model"); **a press inside the open rename editor never starts a reorder**.
 - **Must drop the closing Workspace’s rename editor and pending confirmation, and no other’s** (`releases the rename lease when the tab being renamed is middle-clicked closed` in `lib/src/components/WorkspaceStrip.test.tsx`; `preserves another Workspace’s rename and close confirmation when closing a sibling` in `lib/src/components/wall/workspace-lifecycle.test.ts`).
@@ -338,7 +338,7 @@ Wall starts in `command` mode. Embedders may pass `initialMode="passthrough"` wh
 
 **Enter passthrough mode:** clicking any pane body or header; `Enter` or `z` on a selected pane; creating a terminal through a manual split (`|` / `%` / `-` / `"`, a header split button) or a host New Terminal action; clicking or pressing `Enter` on a door (restoring the session first); clicking a Workspace tab's TODO pill ([Workspace tabs](#workspace-tabs)). **Focus is always deferred via `requestAnimationFrame`** so it lands after the click/mousedown event finishes.
 
-**Enter command mode:** Left Cmd keydown, then Right Cmd keydown within 500ms — or the same left-then-right gesture with Shift.
+**Enter command mode:** Left Cmd keydown, then Right Cmd keydown less than 500ms later — or the same left-then-right gesture with Shift.
 
 - Detected in a capture-phase `keydown` listener on `e.key === 'Meta'` (or `'Shift'`) plus `e.location`, so it fires even while xterm holds DOM focus. **Anything but `location === 1` counts as the right-hand key.**
 - **The Meta and Shift tracks are independent** — Left Cmd then Right Shift does not trigger — and **both are always live** (rationale).
@@ -352,9 +352,9 @@ Wall starts in `command` mode. Embedders may pass `initialMode="passthrough"` wh
 
 **Must use `,` to rename the selected terminal pane or Workspace tab in command mode**, without activating an inactive Workspace. The `+` button has no rename action. Pinned by `comma edits the highlighted Workspace without switching, then returns to navigation` in `lib/src/components/WorkspaceWindow.test.tsx`.
 
-**Must support Workspace navigation in command mode through bare `1`–`9`, arrows, and `Enter`.** Digits select by strip position; out-of-range positions are consumed without switching. **Never bind `c`, `n`/`p`, `$`, `&`, or Workspace `x`.** Rename inputs and confirmation dialogs retain their own controls. Pinned by `lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts` and `lib/src/components/WorkspaceWindow.test.tsx`.
+**Must support Workspace navigation in command mode through bare `1`–`9`, arrows, and `Enter`.** Digits select by strip position; out-of-range positions are consumed without switching. **Never bind `c`, `n`/`p`, `$`, or `&`.** Rename inputs and confirmation dialogs retain their own controls. Pinned by `lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts` and `lib/src/components/WorkspaceWindow.test.tsx`.
 
-All keys are handled in one capture-phase `keydown` listener on `window` (`use-wall-keyboard.ts`), which delegates in a fixed order to the modules in `lib/src/components/wall/keyboard/`: *(an inactive Workspace or an answered key stops here)* → dual-tap → editable-field clipboard → mouse-selection keys → *(passthrough stops here)* → *(a rename or the chrome lease stops here)* → kill confirmation → *(an open dialog stops here)* → Workspace shortcuts → pane shortcuts → pane navigation. **A key whose target sits inside `[data-terminal-context]` leaves that chain before dual-tap**: it reaches editable-field clipboard, then mouse-selection keys against the focused helper terminal, and stops — so no Wall gesture, the mode-exit dual-tap included, fires from inside an open context. **Must let one Wall answer each key**, even a key that activates another Workspace (`answers a key from one Wall even when that key activates another` in `lib/src/components/WorkspaceWindow.test.tsx`). **Must prevent default and stop propagation for handled command keys.** Bare Meta/Shift presses stop only internal dispatch; the detector leaves their DOM event untouched.
+All keys are handled in one capture-phase `keydown` listener on `window` (`use-wall-keyboard.ts`), which delegates in a fixed order to the modules in `lib/src/components/wall/keyboard/`: *(an inactive Workspace or an answered key stops here)* → dual-tap → editable-field clipboard → mouse-selection keys → *(passthrough stops here)* → *(a rename or the chrome lease stops here)* → kill confirmation → *(an open dialog stops here)* → Workspace shortcuts → pane shortcuts → pane navigation. **A key whose target sits inside `[data-terminal-context]` leaves that chain before dual-tap**: it reaches diagnostic-text copy, editable-field clipboard, then mouse-selection keys against the focused context terminal, and stops — so no Wall gesture, the mode-exit dual-tap included, fires from inside an open context. **Must let one Wall answer each key**, even a key that activates another Workspace (`answers a key from one Wall even when that key activates another` in `lib/src/components/WorkspaceWindow.test.tsx`). **Must prevent default and stop propagation for handled command keys.** Bare Meta/Shift presses stop only internal dispatch; the detector leaves their DOM event untouched.
 
 That order is load-bearing twice: a rename input suppresses the pane shortcuts but **not** the mode-exit gesture or the field's own clipboard chords; and a staged kill confirmation hijacks each key reaching it before the dialog gate, so the confirm letter works even though the modal is open.
 
@@ -407,7 +407,7 @@ Source of truth: `rectUnionOutline` in `lib/src/lib/rect-union-outline.ts` and `
 
 ### Ring travel
 
-The ring's rect (and its `{tl,tr,br,bl,inset}` shape) is driven **per-frame by a JS tween, never a CSS transition**; DESIGN.md's ban on animating layout properties does not reach it (rationale). Motion is `FOCUS_MOTION_MS` (220ms — half `LATH_MOTION_MS`) on the house curve `cubic-bezier(0.22, 1, 0.36, 1)`.
+The ring's rect and shape are driven **per-frame by a JS tween, never a CSS transition**; DESIGN.md's ban on animating layout properties does not reach it (rationale). Motion is `FOCUS_MOTION_MS` (220ms — half `LATH_MOTION_MS`) on the house curve `cubic-bezier(0.22, 1, 0.36, 1)`.
 
 Per-frame writes are **imperative**: `SelectionRing` gives the overlay refs to its stable shell; the rAF loop writes rect, path `d`, marching dash, and smear geometry, then **re-applies after structural renders, pre-paint**, so fresh nodes do not flash. **Never reintroduce per-frame React state** — reconciling this subtree competes with travel for the frame budget (rationale).
 
@@ -424,17 +424,11 @@ Source of truth: `lib/src/lib/rect-tween.ts` (position and velocity), `lib/src/l
 
 #### Directional motion smear
 
-Each travelling edge trails a soft band sized by its own motion. A line smears only by moving *across* itself, so **a horizontal edge is driven by its vertical speed and a vertical edge by its horizontal speed, and all four edges are independent.** Each speed normalizes against `cfg.focusRing.smearFullSpeed` into a single `t`; width ramps from `strokeWidth` to `smearMaxPx`, alpha from 0 to `smearPeakAlpha`. **Must give stationary edges zero alpha.** A settled or reduced-motion ring has null speeds and the smear layer is `display: none`, keeping snapshots deterministic.
+**Must smear each travelling edge by its own perpendicular analytic velocity**, with zero alpha for stationary edges and no smear when settled, under reduced motion, or around a source/helper union. **Must keep smear separate from the crisp, unbroken outline**; extent and intensity remain independent (rationale).
 
-- **Velocity is analytic**: `sampleRingVelocity` differentiates the tween (`E'` from `LATH_EASING.slope`), so the smear peaks on the opening frame and needs no smoothing. **Never finite-difference rendered positions** (rationale).
-- **Never divide alpha by the widening factor** — extent and intensity are independent knobs, and `smearFullSpeed` alone shapes a travel (rationale).
-- **Never collapse the four edge speeds to one horizontal and one vertical**, e.g. from the ring *centre's* velocity (rationale).
-- **Two layers**, because one closed path cannot carry four widths (rationale): the smear is a sibling `<g data-ring="smear">` of eight pieces drawn underneath, and **never transforms or re-alphas the outline (`<path data-ring="outline">`)**, whose own per-frame writes stay its `d` and its perimeter-fitted dash.
-- **Eight pieces: four edges plus four corners**, every one cut from ONE shared point set (`ringPoints`) that `roundedRectPath` also walks, so the smear provably tiles the ring — pinned by `lib/src/lib/ring-geometry.test.ts`. A corner reaches two widths at once through a `scale` transform that `cornerPath` compensates for, and takes the mean of its two edges' opacity (rationale; mechanism documented at `cornerPath`). **Find each piece by `data-piece`, never by index.**
-- **Dash length is computed, never measured.** `ringPerimeter` returns the outline's exact length in closed form — straight runs plus `1.6232252401402307 × r` per corner. **Never substitute `π/2`** (the quarter-*circle* value: 3% short, silently shifting every dash) **or reinstate `SVGGeometryElement.getTotalLength()`** (a synchronous style+layout flush every frame) (rationale).
-- **Never reintroduce an SVG `feGaussianBlur` here** (rationale).
+**Must compute dash length from the rendered path's geometry**, never a DOM path measurement or a quarter-circle approximation (rationale). **Never use an SVG `feGaussianBlur` here** (rationale).
 
-Source of truth: `lib/src/lib/ring-geometry.ts`.
+Source of truth: `sampleRingVelocity` in `lib/src/lib/rect-tween.ts`; `writeSmear` in `lib/src/components/wall/WorkspaceSelectionOverlay.tsx`; `ringPoints` / `cornerPath` / `ringPerimeter` in `lib/src/lib/ring-geometry.ts`. Tests: `lib/src/lib/ring-geometry.test.ts`; `lib/src/components/wall/WorkspaceSelectionOverlay.test.tsx`.
 
 ### Position tracking
 
@@ -446,7 +440,7 @@ Source of truth: `lib/src/components/wall/WorkspaceSelectionOverlay.tsx`; `subsc
 
 ## Spatial navigation
 
-**Arrow navigation resolves against Lath's pure `neighbors(tree, rect, id, direction, opts)` query, never a DOM rect scan** — the same laid-out rects the screen shows (`docs/specs/tiling-engine.md` → "Layout"). The keyboard handlers reach it through the engine-neutral `WallNav` seam (`lib/src/components/wall/keyboard/types.ts`), whose `findInDirection` calls `lath.store.neighborOf`: a candidate must be strictly beyond the leaf's edge on the primary axis; one overlapping on the secondary axis is preferred; ties break deterministically on nearest edge-to-edge distance; with no overlapping candidate the nearest non-overlapping one wins.
+**Must resolve arrow navigation through the engine-neutral `WallNav` seam to Lath's `neighborOf`, never a DOM rect scan.** Neighbor eligibility and precedence belong to `docs/specs/tiling-engine.md` → "Layout".
 
 **Back-navigation.** A breadcrumb tracks the last navigation direction and origin pane; **the opposite direction returns to the origin instead of doing a spatial lookup**, which is what makes asymmetric layouts navigate reversibly.
 
@@ -458,7 +452,7 @@ Source of truth: `lib/src/components/wall/WorkspaceSelectionOverlay.tsx`; `subsc
 
 **`Cmd/Ctrl+Arrow` swap.** Swaps Surface **content** between two panes, leaving the layout shape unchanged. One Lath `swap` op trades the two leaf identities, and because per-leaf metadata and terminal-registry entries are keyed by id, title/params/session follow automatically — **never write a companion title swap** — with no DOM reattach. Selection stays on the moved Surface, so **the breadcrumb records the *partner*** (the pane now holding the old slot): the opposite `Cmd+Arrow` swaps back exactly and a plain opposite arrow selects the partner.
 
-**Must ignore swap chords while non-pane chrome is selected**, including when a prior pane move left a breadcrumb (`lib/src/components/wall/keyboard/handle-pane-shortcuts.test.ts`). Source of truth: `handlePaneShortcuts` in `lib/src/components/wall/keyboard/handle-pane-shortcuts.ts`.
+**Must ignore swap chords while non-pane chrome is selected**, including when a prior pane move left a breadcrumb (`lib/src/components/wall/keyboard/handle-pane-shortcuts.test.ts`). Source of truth: `WallNav` in `lib/src/components/wall/keyboard/types.ts`; `nav` in `lib/src/components/Wall.tsx`; `handlePaneShortcuts` in `lib/src/components/wall/keyboard/handle-pane-shortcuts.ts`; `handlePaneNavigation` in `lib/src/components/wall/keyboard/handle-pane-navigation.ts`.
 
 ## Minimize and reattach
 
@@ -488,11 +482,11 @@ Triggered by `,` in command mode or by clicking the session name in the pane hea
 
 The name `<span>` is replaced by an `InlineEditInput` (shared with the browser URL editor in `docs/specs/dor-browser.md`): same font (`font-mono font-medium`), `bg-transparent`, no border, seeded from the label with the failure glyph stripped. `Enter` confirms, `Escape` cancels, `blur` confirms — **whichever lands first settles the edit**, so the blur following an Enter/Escape unmount cannot submit a second time. It stops propagation on `mousedown`/`click`/`keydown` so the panel click and the header drag never fire.
 
-The field is **controlled by its own draft state**, seeded at mount and untouched by later prop changes, and **the `select()` ref callback has a stable identity** so it runs exactly once (rationale). **Mounting is the reset** — the editor exists only during a rename, so each one starts from the current label. Clipboard chords inside the field are the wall's job on hosts whose webview has no native Edit menu (`docs/specs/mouse-and-clipboard.md` §8.9).
+**Must seed each rename from the current label and preserve the user's draft and selection across header re-renders** (rationale). Clipboard chords follow `docs/specs/mouse-and-clipboard.md` §8.9.
 
 Submitted values are rejected when empty or when they fail the `setTerminalUserTitle` validation that also guards title seeding (`docs/specs/terminal-state.md` → Supported OSC Inputs). `<unnamed>` is the default panel placeholder but is otherwise allowed as a user pin. **On rejection the input still closes** — it is not a blocking dialog — and a warning popover anchored under it names the offending value, dismissing on the next pointerdown, scroll, resize, `Escape`, or after `cfg.overlays.warningAutoDismissMs` (3s; 0 under visual snapshots, pinned in `lib/.storybook/preview.ts`).
 
-Source of truth: `lib/src/components/wall/IllegalRenameWarning.tsx`, `lib/src/components/wall/use-dismiss-overlay.ts`.
+Source of truth: `InlineEditInput` in `lib/src/components/wall/InlineEditInput.tsx`; `usePaneRename` in `lib/src/components/wall/use-pane-rename.tsx`; `IllegalRenameWarning` in `lib/src/components/wall/IllegalRenameWarning.tsx`; `useDismissOverlay` in `lib/src/components/wall/use-dismiss-overlay.ts`.
 
 ## Session lifecycle and terminal registry
 
@@ -500,7 +494,7 @@ Source of truth: `lib/src/components/wall/IllegalRenameWarning.tsx`, `lib/src/co
 
 | Op | Behavior |
 |---|---|
-| **Create** `getOrCreateTerminal` | Creates xterm.js with UnicodeGraphemes, Fit, and Image addons plus a PTY; reuses an existing entry. `allowProposedApi: true` enables UnicodeGraphemesAddon. **The WebGL addon is not loaded here** ([Renderer](#renderer)). |
+| **Create** `getOrCreateTerminal` | Creates xterm.js through `createXtermHost` and a PTY; reuses an existing entry. **The WebGL addon is not loaded here** ([Renderer](#renderer)). |
 | **Resume** `resumeTerminal` | Creates the xterm entry and writes replay data, spawning no PTY. Webview recreated over retained Live or Exited PTYs (Link: Severed → Resuming → Live). |
 | **Restore** `restoreTerminal` | Creates the xterm entry and spawns a new PTY with the saved cwd; **replays no transcript** (`docs/specs/transport.md` → "What is persisted"). Cold start from a saved Snapshot (Link: Cold → Live). |
 | **mount / unmount** | `mountElement` reparents the persistent DOM element into a container, `unmountElement` removes it. **The Registry entry survives**, and **neither fits the terminal** — the caller owns fitting ([Animations](#animations)). |
@@ -533,11 +527,11 @@ Source of truth: `TerminalWebglRenderer` in `lib/src/lib/terminal-webgl.ts`; `mo
 
 ### Session persistence
 
-The snapshot is written through a debounced (500ms) save, its layout in the native Lath format (`lathLayout`; `docs/specs/tiling-engine.md` → "Persistence"); `docs/specs/transport.md` → "Persistence policy" lists what is persisted and owns the never-persist rules. **Derived command/app labels on minimized doors are display-only** — never persisted as user-pinned titles.
+**Must coalesce scheduled saves into one 500ms timer without restarting it on later commits.** The snapshot stores its layout in the native Lath format (`lathLayout`; `docs/specs/tiling-engine.md` → "Persistence"); `docs/specs/transport.md` → "Persistence policy" lists what is persisted and owns the never-persist rules. **Derived command/app labels on minimized doors are display-only** — never persisted as user-pinned titles.
 
 Three save triggers, in ascending urgency:
 
-- Any Lath store commit (add/remove/resize/swap/meta, including the active pane the layout records) **schedules** the debounced save.
+- Any Lath store commit (add/remove/resize/swap/meta, including the active pane the layout records) **schedules** the save.
 - Content changes with no Lath commit — `onPtyData` (terminal output, OSC CWD, title candidates), activity/TODO, pane title/command state, minimized-door changes — only **mark the session dirty**; a 30s heartbeat persists only when dirty, so an idle app stops writing.
 - PTY exit, `onRequestSessionFlush`, `pagehide`, unmount, and extension shutdown requests **flush immediately and unconditionally** — the correctness net for any dirty-trigger gap (a program calling `chdir()` emits no event, so its persisted CWD may go stale until the next output — accepted).
 
@@ -565,7 +559,7 @@ Renderer Activity storage is owned by `docs/specs/alert.md` → Public State.
 
 ## Theme
 
-`.lath-host` / `.lath-leaf` in `lib/src/index.css` give an app-bg host, a terminal-bg body, and a 30px header band per leaf, applied by LathHost from the shared `PANE_HEADER_HEIGHT_PX`. The content area uses a 7px top/sides inset and 2px bottom inset (`px-1.75 pt-1.75 pb-0.5` on wrapper, `inset-x-1.75 top-1.75 bottom-0.5` on container); **the `LATH_LAYOUT_OPTS` gap of `PANE_GUTTER_PX` is the only visual separator between panes**. The host paints `var(--color-app-bg)` so gutters and rounded pane/header corner cutouts match host chrome; **terminal content backgrounds are painted by the React terminal wrappers and xterm host elements, never by the leaf containers**. The two-layer `@theme --color-*` → `var(--vscode-*)` token strategy is `docs/specs/theme.md`'s.
+`.lath-host` / `.lath-leaf` in `lib/src/index.css` give an app-bg host, a terminal-bg body, and a 30px header band per leaf, applied by LathHost from the shared `PANE_HEADER_HEIGHT_PX`. The content area uses a 7px top/sides inset and 2px bottom inset (`px-1.75 pt-1.75 pb-0.5` on wrapper, `inset-x-1.75 top-1.75 bottom-0.5` on container); **the `LATH_LAYOUT_OPTS` gap of `PANE_GUTTER_PX` is the only visual separator between panes**. The host paints `var(--color-app-bg)` so gutters and rounded pane/header corner cutouts match host chrome; **terminal content backgrounds are painted by the React terminal wrappers and xterm host elements, never by the outer leaf containers**. The two-layer `@theme --color-*` → `var(--vscode-*)` token strategy is `docs/specs/theme.md`'s.
 
 ## Animations
 
diff --git a/docs/specs/layout.rationale.md b/docs/specs/layout.rationale.md
index 43649c3d1..6014e850b 100644
--- a/docs/specs/layout.rationale.md
+++ b/docs/specs/layout.rationale.md
@@ -40,13 +40,13 @@ xterm.js paints only its own rendered surface, and integer row fitting leaves a
 
 ## Workspaces
 
-**Why `visibility: hidden` in one grid cell rather than `display: none`.** A `display:none` Wall has no box, so every xterm in it would refit on the way back — including a resize that happened while it was hidden. Sharing one grid cell keeps every Wall's box identical, so a switch's reattach fit finds an unchanged grid (checked in the browser-dev harness by resizing with Workspace 2 visible and finding Workspace 1's screen already at the new size, 2026-09).
+**Why `visibility: hidden` in one grid cell rather than `display: none`.** Every Wall retains a full layout box while hidden. Reattachment avoids a grid change when dimensions remain unchanged; a resize while hidden is fitted on activation (`lib/src/components/TerminalPane.test.tsx`).
 
-**Why a hidden Workspace's terminals are detached rather than merely hidden.** xterm pauses rendering only when its screen element stops intersecting (`RenderService` in `@xterm/xterm`), and a `visibility: hidden` box still intersects, so a hidden pane kept rasterizing every output frame and holding a GL context. Reusing the minimize primitives pauses it and releases the context; the box stays laid out, so the reattach fit finds the same grid and sends no PTY resize (2026-09).
+**Why a hidden Workspace's terminals are detached rather than merely hidden.** A `visibility: hidden` screen still intersects xterm's rendering observer, retaining rendering work and a GL context. Detachment pauses rendering and releases the context; it preserves the Session and grid (2026-09).
 
 **Why a move confirms for iframes but not for agent-browser Surfaces.** An agent-browser Surface's session lives in the host process; the target window reconnects its viewer and the page is as it was. A plain iframe is a document inside the source webview, and no API carries a document between webviews — the alternative, keeping every Workspace in its own native child webview and reparenting it, was prototyped on a vendored Tauri fork and rejected for the fork (2026-09). The confirmation is the kill's typed letter rather than a button because what is lost is as gone as a killed process, and the same gesture already means that.
 
-**Why `inert` is only defense in depth.** `visibility: hidden` already removes focusability, so the attribute exists for a future presentation that keeps the subtree visible.
+**Why an inactive Wall is inert before it is hidden.** During the outgoing fade the Wall remains visible beneath its successor. `inert` removes its focusability immediately, before `visibility: hidden` takes effect.
 
 **Why the strip's reorder drag does not capture the pointer on press.** A captured pointer retargets the following `click` to the capture element, so capturing on `pointerdown` swallowed the activate button's click and no tab could be activated by mouse (found in the browser-dev harness, 2026-09). Capture is only useful once the gesture is a drag, which is where it now happens.
 
diff --git a/docs/specs/shortcuts.md b/docs/specs/shortcuts.md
index 6c7ac93cd..56f0feeb9 100644
--- a/docs/specs/shortcuts.md
+++ b/docs/specs/shortcuts.md
@@ -8,8 +8,8 @@
 
 | Key | Action | Description |
 |-----|--------|-------------|
-| Left ⌘ → Right ⌘ (within 500 ms) | Enter command mode | Only exits passthrough; inert in command mode. |
-| Left ⇧ → Right ⇧ (within 500 ms) | Enter command mode | Independent of the ⌘ track; the gesture for keyboards with no right ⌘. |
+| Left ⌘ → Right ⌘ (less than 500 ms) | Enter command mode | Only exits passthrough; inert in command mode. |
+| Left ⇧ → Right ⇧ (less than 500 ms) | Enter command mode | Independent of the ⌘ track; the gesture for keyboards with no right ⌘. |
 | `Enter` (command) | Enter passthrough or activate | Focus the selected pane or reattach a door; Workspace targets follow the table below. |
 
 A focused cross-origin iframe surface swallows the gesture; the proxy shim detects it in-frame and re-posts it to the Wall (`docs/specs/dor-browser.md`).
@@ -50,7 +50,7 @@ Standalone only — a bare Wall (VS Code, the website playground) leaves these k
 
 ## Terminal selection & clipboard
 
-Both modes, ahead of the passthrough gate, and only on a terminal **selected** Surface — a browser surface owns its clipboard keys (below), a focused Dormouse text field owns them ahead of everything (`docs/specs/mouse-and-clipboard.md` §8.9).
+Both modes, ahead of the passthrough gate, and only on a terminal **selected** Surface — a browser surface or a Tool without its terminal view shown owns its page clipboard keys (below); a focused context terminal owns terminal clipboard keys; a focused Dormouse text field owns its clipboard chords (`docs/specs/mouse-and-clipboard.md` §8.9).
 
 | Key | Action | Description |
 |-----|--------|-------------|
@@ -70,7 +70,7 @@ Every key not claimed above forwards to the embedded page while a screencast pan
 
 | Key | Action | Description |
 |-----|--------|-------------|
-| `⌘V` / `Ctrl+V` | Paste into page | Replays the *local* clipboard as per-character key events — the embedded browser's own clipboard is empty. |
+| `⌘V` / `Ctrl+V` | Paste into page | Inserts the *local* clipboard as text through the host. |
 | `⌘`/`Ctrl` + `a` / `c` / `x` | Select all / copy / cut | Routed through the host's `edit` operation. |
 | `c` / `Esc` (render-swap warning) | Continue / cancel | Confirm dropping the non-active tabs when swapping a multi-tab screencast surface to the `iframe` renderer. |
 
diff --git a/docs/specs/tiling-engine.md b/docs/specs/tiling-engine.md
index 8e2b8ac20..7575a6762 100644
--- a/docs/specs/tiling-engine.md
+++ b/docs/specs/tiling-engine.md
@@ -52,7 +52,7 @@ Derived pure queries, each of which **must be called with the same `rect` + `opt
 
 | Query | Answers |
 | --- | --- |
-| `neighbors(tree, rect, id, direction, opts) → LeafId \| null` | Spatial navigation. Candidates must lie strictly beyond the leaf's edge; secondary-axis overlap preferred, then nearest edge-to-edge, tie-broken by smaller y, then x, then id. |
+| `neighbors(tree, rect, id, direction, opts) → LeafId \| null` | Spatial navigation. Candidates must lie beyond or touch the leaf's edge; secondary-axis overlap preferred, then nearest edge-to-edge, tie-broken by smaller y, then x, then id. |
 | `autoEdge(tree, rect, id, opts) → Edge` | Aspect-ratio split heuristic: laid-out rect wider than tall → `'right'`, else `'bottom'` (also `'right'` for a missing leaf). |
 | `sashes(tree, rect, opts) → { splitPath, boundary, dir, rect }[]` | One entry per adjacent child pair of every split. `dir` is the parent split's axis (`'row'` → a vertical divider, col-resize); `rect` is the gap band between the pair, zero-thickness when `gap: 0` (the adapter widens the hit area). |
 | `nodeRectAtPath(tree, rect, opts, path) → Rect \| null` | Rect of any interior node under the same geometry, walking only the root→leaf spine. |
@@ -63,16 +63,15 @@ Source of truth: `lib/src/lib/lath/layout.ts`.
 
 All ops are pure and synchronous, take the tree as their first argument (elided in the table), and return `{ tree: LathTree; ok: boolean }` plus op-specific fields. **On `ok: false` the returned `tree` is the input object**, on `ok: true` always a fresh one — so identity-comparison detects a rejected op, and tree identity never signals "no visual change." **Speculative evaluation is free**: sash live-resize and DnD previews run `layout(op(tree, …).tree, …)` per frame without committing (rationale).
 
-| Op | Notes |
-| --- | --- |
-| `split(at, edge, newId)` | Inserts `newId` beside `at`, extending the parent split when directions match (flatten invariant) or nesting a new one. The new leaf takes half of `at`'s weight. |
-| `remove(id)` | Siblings absorb the weight proportionally; single-child splits collapse and re-flatten. Returns a `RestoreToken`. |
-| `replace(oldId, newId)` | Atomic identity swap in place — no transient add/remove states (the `dor iframe` replace-untouched-terminal case). |
-| `move(id, target: DropTarget)` | Remove + insert as one op; the leaf carries its old normalized weight into the new context. `target.path` is read against the input tree, then re-found post-removal by surviving leaf set — falling back to the target's first surviving leaf if that subtree dissolved. |
-| `swap(a, b)` | Leaf identity swap (drag-onto-center; the Cmd-Arrow swap). `a === b` is rejected. |
-| `resize(splitPath, boundary, deltaPx, rect, opts)` | Adjusts the weights of children `boundary`/`boundary + 1`, clamped so neither drops below its recursive `minLeaf` span, with an epsilon floor keeping both strictly positive (a `minLeaf` of 0 may render 0px but never stores weight 0). A fully-clamped no-op is still `ok: true`. Streamed during a sash drag: pass the *original* tree each frame with a cumulative delta; the final tree commits on pointerup. |
-| `insert(id, target: DropTarget, weight = 0.5)` | The insert half of `move`, public for external (Door) drops: a NEW leaf at a drop target carrying `weight`, clamped into (0,1). Swap targets, existing ids, empty trees, and paths off the tree are rejected. |
-| `restore(token, opts?)` | Reinserts a removed leaf, best effort (below). |
+| Operation | Behavior |
+|---|---|
+| `split` | Insert a new leaf beside a reference, taking half its weight. |
+| `remove` | Remove a leaf and return its restore context; siblings absorb its weight proportionally. |
+| `replace` / `swap` | Change leaf identities atomically, preserving geometry. |
+| `move` | Remove and reinsert atomically, carrying the old weight; resolve the target against the input tree and re-find it after removal. |
+| `resize` | Clamp adjacent weights against recursive minimums and a positive floor; a fully clamped no-op still succeeds. Callers pass the drag-start tree and cumulative delta. |
+| `insert` | Insert a new leaf beside an edge target; reject swap targets, duplicates, empty trees and missing paths. |
+| `restore` | Reinsert from a persisted token through the tiers below. |
 
 `DropTarget` is either a leaf swap or an edge at an ancestor path; the latter gives DnD its depth levels.
 
@@ -106,7 +105,7 @@ Source of truth: `hitTest` in `lib/src/lib/lath/hit-test.ts`; `createDragControl
 
 ## Restore tokens (Doors)
 
-`remove` returns a JSON-serializable `RestoreToken` of the leaf's ancestry: its own `leafId`; `siblingId` (the nearest same-parent sibling leaf it sat beside); `siblingLeafIds` / `siblingFingerprint` (that sibling *node's* leaf set and structure fingerprint, **written on every non-root removal and consulted only when the set holds more than one leaf**, i.e. when the sibling was itself a split subtree); `edge` (such that neighbor-tier restore is `split(siblingId, edge, leafId)`); its normalized `weight` and child `index`; and a structure-only `fingerprint` — kinds, dirs, leaf ids, no weights — of the parent split *post-removal*. **A root-leaf removal writes neither sibling field**, with `siblingId` and `fingerprint` null, so it can only reach the fallback tier. `restore` applies three tiers, driven from the Wall's `handleReattach`:
+**Must persist `RestoreToken` as the Door's sole restore payload.** Its canonical fields and capture rules live beside `remove` in `lib/src/lib/lath/ops.ts`. Legacy tokens without sibling-subtree context retain the older leaf-neighbor behavior when exact restoration fails. Root-leaf removals can reach only fallback. `restore` applies three tiers from the Wall's `handleReattach`:
 
 1. **exact** — the fingerprinted context still exists around `siblingId`: reinsert at the original index and weight, existing siblings shrinking proportionally;
 2. **neighbor** — the sibling still exists: split beside it on the original edge;
@@ -116,7 +115,7 @@ Source of truth: `hitTest` in `lib/src/lib/lath/hit-test.ts`; `createDragControl
 - A survivor that is a split subtree keeps **exact**, targeted by `siblingLeafIds` / `siblingFingerprint`, so `A | (B over C)` restores beside the whole `B/C` column rather than inside it.
 - **Must supply a live `fallbackRef` when exact/neighbor tiers fail in a nonempty tree**; otherwise restore returns `ok: false`.
 
-Tokens serialize with Doors (`PersistedDoor.token`) as the sole restore payload. A parked leaf still carries one: parking decides whether the DOM survives, the token decides where the leaf lands.
+A parked leaf still carries a token: parking decides whether DOM survives, the token decides where the leaf lands.
 
 Source of truth: `RestoreToken` / `restore` in `lib/src/lib/lath/ops.ts`.
 
@@ -151,7 +150,7 @@ The **store** is the state machine + geometry + enter hints, reached directly as
 **`lath-wall-store.ts` is the sole state authority.** Its snapshot `{ tree, leafMeta, parked, zoomedId, revision }` sits behind a `useSyncExternalStore` contract: identity stable between commits, `leafMeta`/`parked` reused by identity when a commit does not touch them, `revision` bumping on *every* commit including meta and zoom writes. The reported layout geometry and the pending enter-hint map are side state, never in the snapshot, so neither notifies.
 
 - **Every tree mutation commits atomically**; a rejected op commits nothing, notifies nothing, and returns the failure verbatim.
-- Geometry-dependent queries (`neighborOf`, `autoEdgeFor`, `resizeBoundary`, restore's fallback tier, `addLeaf`'s null-position autoEdge) read the rect + opts LathHost last reported via `setLayoutGeometry`, which **rejects a degenerate (zero-area) rect** in favor of the `!geometry` fallback (rationale).
+- Geometry-dependent queries (`neighborOf`, `autoEdgeFor`, `resizeBoundary`, restore's fallback tier, `addLeaf`'s null-position autoEdge) read the rect + opts LathHost last reported via `setLayoutGeometry`, which **must reject zero-area reports**, retaining the last valid geometry or using the no-geometry fallback before the first valid report (rationale).
 - `LATH_LAYOUT_OPTS` (gap `PANE_GUTTER_PX` = 7; `minLeaf` 100×60) lives here as the one geometry both the store and the adapter lay out with.
 
 **`lath-wall-engine.ts` is the Wall-facing handle**, holding only what the store does not — the animator and its `exitMs` / `markDying` / `isDying` / frame + wake signals, the vocabulary maps (Edge ↔ dor direction, arrow → direction), the meta builders (`terminalLeafMeta` / `browserLeafMeta` / `leafMetaFromPersistedDoor`), `shouldParkOnMinimize`, and the persistence conveniences `serializeLayout` / `seed` — and **no selection/focus/mode/activation state**. Two projection rules bind its readers: `listPanes()` is tree pre-order + meta, so **parked leaves are not visible and are not listed**, while `getMeta(id)` *does* resolve Doored leaves.
@@ -178,11 +177,11 @@ Source of truth: `BODY_COMPONENTS` / `TAB_COMPONENTS` / `OVERLAY_COMPONENTS` in
 
 **Animation is core, not adapter.** The headless **animator** turns committed layout changes into presentation frames as a pure function of time (`now` is always passed in — no DOM, timers, or `Date`), so every renderer animates identically and tests assert real interpolated values against a fake clock. [layout.md → Animations](layout.md#animations) owns the user-visible zoom / spawn / kill behaviors this implements.
 
-- `createAnimator({ durationMs, easing? })` exposes `retarget(targets, now, enters?, { snap?, layers? })`, `markDying(id, now, { shrinkTowardBottomRight? })`, `isDying(id)`, `framesAt(now): Map<LeafId, Frame>` (`Frame = { rect, opacity, layer }`), and `settledAt(now)` — **an adapter stops ticking once settled**. **Layers are discrete, never interpolated** — `LATH_LAYER_TILED` 0 / `LATH_LAYER_DYING` 1 / `LATH_LAYER_ELEVATED` 2, a rising leaf entering the higher band before geometry moves and a lowering one staying until the motion settles; adapters map the bands to renderer z-order.
+- **Must stop ticking once `settledAt(now)` is true.** The canonical animator interface and frame shape are `LathAnimator` / `Frame` in `lib/src/lib/lath/animator.ts`. **Layers are discrete, never interpolated**: a rising leaf adopts the higher band before moving; a lowering leaf keeps it until settled. Adapters map `LATH_LAYER_TILED`, `LATH_LAYER_DYING`, and `LATH_LAYER_ELEVATED` to renderer z-order.
 - Default motion is the house easing (`LATH_MOTION_MS` 440ms, `cubic-bezier(0.22, 1, 0.36, 1)` solved in JS by `cubicBezier`); `createAnimator` takes a bare `t → eased` and hands no easing back. **A caller needing a *rate* must read `slope(t)` off the `Easing` `cubicBezier` returns — `LATH_EASING` for house motion** — never differences of successive samples (rationale; [layout.md → Ring travel](layout.md#ring-travel) is the cautionary case).
 - **A `retarget` mid-flight starts every leaf from its current interpolated frame** — interruptible by construction, no in-progress guards. `snap: true` starts leaves already settled (sash-drag commits, container resizes: hand-placed geometry must not tween), as does a retarget whose from/to frames already match.
-- **Enter hints are derived by the store's mutators, not passed in.** `addLeaf` / `restoreLeaf` / `insertLeaf` set the hint to the *opposite* of the edge they commit (`oppositeEdge`, so a pane placed right grows from its left boundary; a reattach hint therefore comes from the door token's edge), `consumeEnterHints` drains it at the next retarget, and the leaf's frames begin collapsed against that boundary at opacity 0. **Precedence**: a re-admitted parked leaf's held rect (an `EnterFrom` rect at full opacity) beats an explicit `setEnterHint`, which beats a derived hint (rationale). The only `setEnterHint` user is the auto-spawn refill (`'top-left'`, the killed last pane having shrunk toward the bottom-right).
-- **Exit is two-phase.** The Wall's `lath.markDying(id, { shrinkTowardBottomRight })` freezes and fades the leaf in place — the last-pane kill shrinking toward its bottom-right corner — with its terminal DOM still mounted; a `setTimeout(lath.exitMs)` then runs `disposeSession` and commits `store.removeLeaf`, and survivors tween into the reclaimed space on the resulting retarget. The finalizer bails if the leaf is already gone (superseded by a replace) and **forgets the surface ref only after the removal** (rationale). `isDying` makes a second kill a no-op. Dying leaves get `pointer-events: none`; a dying zoomed leaf keeps its elevated inset geometry and layer while LathHost applies the animator's opacity.
+- **Must derive add/insert hints from the opposite placement edge and reattach hints from the opposite token edge.** **Must prefer a parked leaf's held rect over an explicit hint, and an explicit hint over a derived hint**; held rects start at full opacity, edge hints collapsed at opacity 0. `consumeEnterHints` drains hints at retarget. Auto-spawn alone overrides entry with `'top-left'`. Capture and precedence mechanics live at `deriveEnterHint` / `admit` in `lib/src/components/wall/lath-wall-store.ts` (rationale).
+- **Exit is two-phase.** The Wall's `lath.markDying(id, { shrinkTowardBottomRight })` freezes and fades the leaf in place — the last-pane kill shrinking toward its bottom-right corner — with its terminal DOM still mounted; a `setTimeout(lath.exitMs)` then commits `store.removeLeaf` before `disposeSession`, and survivors tween into the reclaimed space on the resulting retarget. The finalizer bails if the leaf is already gone (superseded by a replace) and **forgets the surface ref only after the removal** (rationale). `isDying` makes a second kill a no-op. Dying leaves get `pointer-events: none`; a dying zoomed leaf keeps its elevated inset geometry and layer while LathHost applies the animator's opacity.
 - **Ownership split**: the core animator is pure and owns the dying state; the *engine* owns the animator instance, `exitMs`, and the frame/wake signals (`markDying` fades without a store commit, so it wakes the tick loop itself); the *store* owns the enter-hint map; *LathHost* drives a rAF tick while unsettled and applies `framesAt` **imperatively** to the leaf divs (left/top/width/height/opacity/z-index/box-shadow/pointer-events). **Reduced motion is the same code path**, not a branch — `durationMs` 0 under `motionIsInstant()`, which the visual-snapshot `animate: false` in `lib/.storybook/preview.ts` also sets. **A no-deps layout effect re-asserts the current frames after any unrelated React commit**, so a mid-tween re-render cannot snap styles back to target (rationale). **There is no CSS entrance/exit path.**
 
 Source of truth: `createAnimator` in `lib/src/lib/lath/animator.ts`; the animator ownership in `lib/src/components/wall/lath-wall-engine.ts`; the enter-hint derivation in `lib/src/components/wall/lath-wall-store.ts`; the frame-application effects in `lib/src/components/wall/LathHost.tsx`.
@@ -203,7 +202,7 @@ Source of truth: `lib/src/components/wall/pane-props.ts`; `PaneWriteContext` in
 
 The versioned Lath layout rides inside `PersistedSession`, and saves write only the native Lath layout. Store metadata also covers Doored leaves, so `lathLayoutFromStore` filters it to tree members and the save path materializes each Door's live metadata separately. Every leaf's metadata goes out through `persistableLeafMeta`: **a Tool's derived browser fields are stripped and a Tool still awaiting approval persists as a plain terminal** (`docs/specs/dor-tool.md` → Persistence and hosts). A restart therefore cold-loads every Surface where the user left it, a Tool as the terminal running its command — **a parked document never survives a restart, only a minimize**.
 
-**The session read boundary resolves the layout once**: `persistedLathLayout` returns the native `lathLayout` only after validating node shapes, tree invariants, and valid metadata for exactly its leaves; otherwise undefined. `lib/src/lib/lath/persistence.test.ts` pins rejection and `lib/src/components/wall/lath-wall-engine.test.ts` pins recovery. **Both recovery paths then gate on the layout's leaf set matching the visible pane set** — the resume gate in `reconnect.ts`, the cold path in `session-restore.ts` — with the `restoredLathLayout` prop and the engine's `seed` seeing only a Lath layout. An absent, rejected, or empty one falls back to fresh panes, except that **a cold restore holding a visible Tool pane synthesizes a single-row layout from the pane projection instead**, dropping browser panes, so a Tool's command survives corrupt geometry.
+**The session read boundary resolves the layout once**: `persistedLathLayout` returns the native `lathLayout` only after validating node shapes, tree invariants, and valid metadata for exactly its leaves; otherwise undefined. `lib/src/lib/lath/persistence.test.ts` pins rejection and `lib/src/components/wall/lath-wall-engine.test.ts` pins recovery. **Both recovery paths then gate on the layout's leaf set matching the visible pane set** — the resume gate in `reconnect.ts`, the cold path in `session-restore.ts` — with the `restoredLathLayout` prop and the engine's `seed` seeing only a Lath layout. An absent, rejected, or empty one falls back to fresh panes, except that **a cold restore holding a visible Tool pane must synthesize a valid single-row layout from the pane projection instead**, dropping browser panes, so Tool identity and commands survive corrupt geometry. Pinned through engine hydration by `preserves multiple Tool kinds through engine hydration with %s geometry` in `lib/src/lib/session-restore.test.ts`.
 
 Source of truth: `LeafMeta` / `LathPersistedLayout` / `lathLayoutFromStore` / `isLathPersistedLayout` in `lib/src/lib/lath/persistence.ts`; `persistableLeafMeta` in `lib/src/components/wall/lath-wall-engine.ts`; `lathLayout` / `token` in `lib/src/lib/session-types.ts`; the save in `lib/src/components/wall/use-session-persistence.ts` / `lib/src/lib/session-save.ts`; `persistedLathLayout` in `lib/src/lib/session-restore.ts`, consumed by `lib/src/lib/reconnect.ts`.
 
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 9be8420bd..b31687cd7 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -1071,6 +1071,7 @@ export function Wall({
     ownsSurface,
     selectedIdRef,
     selectedTypeRef,
+    activeRef,
     surfaceRefsForSave,
     workspaceId,
   });
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index 3fa312bc9..43dc1822f 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -15,6 +15,7 @@ import { recordToolDirty, resetToolDirty } from '../lib/tool-dirty-store';
 import { browserLeafMeta, toolLeafMeta } from './wall/lath-wall-engine';
 import { leafTree } from '../lib/lath/model';
 import { WorkspaceWindow } from './WorkspaceWindow';
+import * as clipboard from '../lib/clipboard';
 import { WorkspaceStrip } from './WorkspaceStrip';
 import * as workspaceStore from '../lib/workspace-store';
 import * as workspaceMotion from './workspace-motion';
@@ -105,6 +106,33 @@ async function render(node = <WorkspaceWindow initialPaneIds={['pane-a']} />): P
 }
 
 describe('WorkspaceWindow', () => {
+  it('routes native file drops only to the active Workspace selected pane', async () => {
+    const first = getActiveWorkspaceId();
+    createWorkspace({ id: 'ws-2', activate: false });
+    const listeners = new Set<(paths: string[]) => void>();
+    Object.assign(fake, {
+      onFilesDropped: (handler: (paths: string[]) => void) => {
+        listeners.add(handler);
+        return () => { listeners.delete(handler); };
+      },
+    });
+    const paste = vi.spyOn(clipboard, 'pasteFilePaths').mockImplementation(() => {});
+    await render();
+    expect(listeners.size).toBe(2);
+    const drop = () => { for (const listener of listeners) listener(['C:/work/example.txt']); };
+    await act(async () => { drop(); });
+    expect(paste.mock.calls).toEqual([['pane-a', ['C:/work/example.txt']]]);
+    paste.mockClear();
+    await act(async () => { setActiveWorkspace('ws-2'); });
+    const [secondPane] = leafIdsIn('ws-2');
+    await act(async () => { drop(); });
+    expect(paste.mock.calls).toEqual([[secondPane, ['C:/work/example.txt']]]);
+    paste.mockClear();
+    await act(async () => { setActiveWorkspace(first); });
+    await act(async () => { drop(); });
+    expect(paste.mock.calls).toEqual([['pane-a', ['C:/work/example.txt']]]);
+  });
+
   it('clicking + enters the new terminal in passthrough and moves keyboard focus off the button', async () => {
     const first = getActiveWorkspaceId();
     await render(<><WorkspaceStrip /><WorkspaceWindow initialPaneIds={['pane-a']} /></>);
diff --git a/lib/src/components/wall/WorkspaceSelectionOverlay.tsx b/lib/src/components/wall/WorkspaceSelectionOverlay.tsx
index cb9ca58d8..097aaf3fa 100644
--- a/lib/src/components/wall/WorkspaceSelectionOverlay.tsx
+++ b/lib/src/components/wall/WorkspaceSelectionOverlay.tsx
@@ -121,7 +121,7 @@ interface DisplayedRing extends RingFrame {
  * is the only inset in play.
  *
  * Each edge smears only by its OWN motion across itself, so the four are
- * independent — see `docs/specs/layout.md` → "Ring travel" for why a single
+ * independent — see `docs/specs/layout.rationale.md` → "Directional motion smear" for why a single
  * ring-centre velocity gets ordinary split layouts wrong.
  *
  * Straight edges carry their width in a plain `stroke-width`. Corners cannot —
diff --git a/lib/src/components/wall/keyboard/handle-dual-tap.ts b/lib/src/components/wall/keyboard/handle-dual-tap.ts
index 1adbc3f6d..8198a7d94 100644
--- a/lib/src/components/wall/keyboard/handle-dual-tap.ts
+++ b/lib/src/components/wall/keyboard/handle-dual-tap.ts
@@ -1,7 +1,7 @@
 import type { DualTapState, WallKeyboardCtx } from './types';
 
 /**
- * Detects left-then-right Meta or Shift within 500 ms and exits passthrough.
+ * Detects left-then-right Meta or Shift less than 500 ms apart and exits passthrough.
  * Always consumes Meta/Shift presses (returns true) so later handlers don't
  * misinterpret a bare modifier press as a navigation key.
  */
diff --git a/lib/src/components/wall/lath-wall-store.ts b/lib/src/components/wall/lath-wall-store.ts
index a20759208..20b81302e 100644
--- a/lib/src/components/wall/lath-wall-store.ts
+++ b/lib/src/components/wall/lath-wall-store.ts
@@ -300,11 +300,9 @@ export function createLathWallStore(): LathWallStore {
     restoreSnapshot(saved) { commit(saved); },
 
     seed(tree, meta) {
-      // `meta` carries the incoming Wall whole: the tree's leaves AND any Doors seeded
-      // beside them (hydration passes both). Parked Surfaces outlive it — Workspace
-      // switching parks the outgoing Wall and then seeds the incoming one, so dropping
-      // their meta here would discard exactly what the switch preserved, and would
-      // strand DOM the store no longer knows anything about. Seeded ids win.
+      // Hydration supplies tree leaves and Doors. Retain metadata for existing
+      // parked documents so reseeding cannot strand their DOM; incoming metadata
+      // wins. Workspace switching does not seed: each Workspace keeps its own Wall.
       //
       // Unparking is keyed off the TREE, not off `meta`: a parked id handed in only as
       // a Door row is still a Door, and must keep both its DOM and its held rect.
diff --git a/lib/src/components/wall/use-session-persistence.ts b/lib/src/components/wall/use-session-persistence.ts
index d38f2977c..7c9b9c33a 100644
--- a/lib/src/components/wall/use-session-persistence.ts
+++ b/lib/src/components/wall/use-session-persistence.ts
@@ -35,6 +35,7 @@ export function useSessionPersistence({
   doorsRef,
   selectedIdRef,
   selectedTypeRef,
+  activeRef,
   ownsSurface,
   surfaceRefsForSave,
   workspaceId,
@@ -51,6 +52,8 @@ export function useSessionPersistence({
   doorsRef: RefObject<DooredItem[]>;
   selectedIdRef: RefObject<string | null>;
   selectedTypeRef: RefObject<WallSelectionKind>;
+  /** Only the visible Workspace receives user-originated native drops. */
+  activeRef: RefObject<boolean>;
   /** Whether a Surface belongs to this Wall — panes AND Doors. The adapter fans
    *  every Session's traffic to every mounted Wall, so this is what keeps one
    *  Workspace from persisting on another's keystroke. Must be stable: the
@@ -287,7 +290,7 @@ export function useSessionPersistence({
     // (docs/specs/mouse-and-clipboard.md -> "8.7 Drag-to-Paste").
     // See diffplug/dormouse#38 and tauri-apps/tauri#14373.
     const unsubFilesDropped = platform.onFilesDropped?.((paths) => {
-      if (paths.length === 0) return;
+      if (!activeRef.current || paths.length === 0) return;
       const sid = selectedTypeRef.current === 'pane' ? selectedIdRef.current : null;
       if (!sid) return;
       if (!ownsSurface(sid)) return;
@@ -329,6 +332,7 @@ export function useSessionPersistence({
     scheduleSessionSave,
     selectedIdRef,
     selectedTypeRef,
+    activeRef,
   ]);
 
   return { flush: flushSessionSave, serialize, serializeNow };
diff --git a/lib/src/lib/lath/layout.ts b/lib/src/lib/lath/layout.ts
index a36e20dcc..07549fa50 100644
--- a/lib/src/lib/lath/layout.ts
+++ b/lib/src/lib/lath/layout.ts
@@ -166,7 +166,7 @@ export function nodeRectAtPath(tree: LathTree, rect: Rect, opts: LayoutOpts, pat
 }
 
 /** Nearest leaf in `direction`, computed from the laid-out rects (no DOM). Candidates
- *  must lie strictly beyond the current leaf's edge in that direction; overlapping
+ *  must lie beyond or touch the current leaf's edge in that direction; overlapping
  *  candidates on the secondary axis win, then nearest edge-to-edge distance.
  *  Deterministic ties: smaller (y, x), then id.
  *  Callers pass the same `rect`/`opts` they render with. */
@@ -186,7 +186,7 @@ export function neighbors(
   const cands: Cand[] = [];
   for (const [pid, r] of rects) {
     if (pid === id) continue;
-    // Strictly beyond the current edge (boundary-touching candidates are kept).
+    // Beyond or touching the current edge.
     if (direction === 'left' && r.x + r.width > c.x) continue;
     if (direction === 'right' && r.x < c.x + c.width) continue;
     if (direction === 'up' && r.y + r.height > c.y) continue;
diff --git a/lib/src/lib/ring-geometry.ts b/lib/src/lib/ring-geometry.ts
index 546a97a81..9a7844e00 100644
--- a/lib/src/lib/ring-geometry.ts
+++ b/lib/src/lib/ring-geometry.ts
@@ -6,7 +6,7 @@
 // need independent widths. Both come from the point set below, so the smear
 // provably tiles the ring instead of agreeing with it by inspection.
 //
-// See `docs/specs/layout.md` → "Ring travel" for why the smear is a separate
+// See `docs/specs/layout.rationale.md` → "Directional motion smear" for why the smear is a separate
 // layer and how the corner taper works.
 
 import type { RingRect, RingShape } from './rect-tween';
diff --git a/lib/src/lib/session-restore.test.ts b/lib/src/lib/session-restore.test.ts
index 9fa93acee..ad465bca4 100644
--- a/lib/src/lib/session-restore.test.ts
+++ b/lib/src/lib/session-restore.test.ts
@@ -15,6 +15,8 @@ vi.mock('./terminal-registry', () => ({
 }));
 
 import { restoreSession } from './session-restore';
+import { isLathPersistedLayout } from './lath/persistence';
+import { createLathWallEngine } from '../components/wall/lath-wall-engine';
 
 function createPlatform(
   savedState: PersistedSession | null,
@@ -387,6 +389,30 @@ it('recovers Tool metadata from pane rows when its layout is unusable', () => {
   expect(restored?.lathLayout?.leafMeta.tool.params?.url).toBeUndefined();
 });
 
+it.each(['absent', 'corrupt'] as const)('preserves multiple Tool kinds through engine hydration with %s geometry', geometry => {
+  vi.clearAllMocks();
+  const restored = restoreSession(createPlatform({
+    version: 3,
+    lathLayout: geometry === 'corrupt' ? { version: 1, tree: { root: {} }, leafMeta: {} } : undefined,
+    panes: [
+      { id: 'tool-a', title: 'A', cwd: '/repo', surfaceType: 'tool', command: 'pnpm storybook', tool: { render: 'iframe', port: 'auto' } },
+      { id: 'shell', title: 'Shell', cwd: '/repo' },
+      { id: 'tool-b', title: 'B', cwd: '/repo', surfaceType: 'tool', command: 'pnpm dev', tool: { render: 'agent-browser-screencast', port: 'announced' } },
+      { id: 'web', title: 'Web', cwd: null, surfaceType: 'browser' },
+    ],
+  }));
+  expect(restored?.paneIds).toEqual(['tool-a', 'shell', 'tool-b']);
+  expect(isLathPersistedLayout(restored?.lathLayout)).toBe(true);
+  const engine = createLathWallEngine();
+  expect(engine.seed(restored?.lathLayout, restored?.paneIds, () => 'unexpected'))
+    .toEqual({ paneIds: ['tool-a', 'shell', 'tool-b'], fresh: false });
+  expect(engine.getMeta('tool-a')).toMatchObject({ component: 'tool', params: { command: 'pnpm storybook' } });
+  expect(engine.getMeta('tool-b')).toMatchObject({ component: 'tool', params: { command: 'pnpm dev', toolRender: 'agent-browser-screencast' } });
+  expect(engine.getMeta('shell')?.component).toBe('terminal');
+  expect(engine.getMeta('web')).toBeUndefined();
+  expect(terminalRegistryMocks.restoreTerminal.mock.calls.map(([id]) => id)).toEqual(['tool-a', 'shell', 'tool-b']);
+});
+
 it('restores the preview slot mark and open target from pane rows when its layout is unusable', () => {
   const restored = restoreSession(createPlatform({ version: 3, panes: [
     { id: 'slot', title: 'viewer', cwd: '/repo', untouched: false, surfaceType: 'tool', command: 'view /repo/a.md',
diff --git a/lib/src/lib/session-restore.ts b/lib/src/lib/session-restore.ts
index ce1cba038..8d233ffdf 100644
--- a/lib/src/lib/session-restore.ts
+++ b/lib/src/lib/session-restore.ts
@@ -72,7 +72,7 @@ export function restoreSession(platform: PlatformAdapter, sources: RestoreSource
     const nodes: LathNode[] = recoverable.map(pane => ({ kind: 'leaf', id: pane.id }));
     lathLayout = {
       version: 1,
-      tree: { root: nodes.length === 1 ? nodes[0] : { kind: 'split', dir: 'row', children: nodes.map(node => ({ node, weight: 1 })) } },
+      tree: { root: nodes.length === 1 ? nodes[0] : { kind: 'split', dir: 'row', children: nodes.map(node => ({ node, weight: 1 / nodes.length })) } },
       leafMeta: Object.fromEntries(recoverable.map(pane => [pane.id, pane.surfaceType === 'tool' ? {
         component: 'tool', tabComponent: 'tool', title: pane.title,
         params: { surfaceType: 'tool', command: pane.command, cwd: pane.cwd,
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 238186ff8..6dbf3035d 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -13,7 +13,7 @@
   "docs/specs/dor-tools-lib.md": 400,
   "docs/specs/glossary.md": 3000,
   "docs/specs/hosted.md": 4800,
-  "docs/specs/layout.md": 12050,
+  "docs/specs/layout.md": 11750,
   "docs/specs/mobile-terminal-ui.md": 2300,
   "docs/specs/mouse-and-clipboard.md": 5250,
   "docs/specs/one-time.md": 3850,
@@ -35,7 +35,7 @@
   "docs/specs/terminal-escapes.md": 4100,
   "docs/specs/terminal-state.md": 2550,
   "docs/specs/theme.md": 2400,
-  "docs/specs/tiling-engine.md": 4700,
+  "docs/specs/tiling-engine.md": 4450,
   "docs/specs/transport.md": 5050,
   "docs/specs/tutorial.md": 2050,
   "docs/specs/vscode.md": 7300,