[schlessera]

Closes #1756

What changed

Discovery's selected-note actions reveal outgoing targets using bounded evidence from the original root. Hop distances remain root-relative; each applied scene and its node fields/edges come from one response. Counts, loading, errors, neutral integrity recovery, pending sync evidence, Reset expanded and once-only addition notices appear in the existing phone card and desktop rail. Deliberate expansion interpolates survivors and fades new marks over 200 ms; reduced motion, sync and reset cut directly.

Why this shape

Implements the accepted rev 2 and its two bounded corrections on #1756, building on the delivered #1482 placement. Requests use the existing Discovery route and depth-eight/node/edge bounds. Sync retains path intent when capped/shallow/stale evidence is inconclusive; complete fresh depth-eight absence establishes only the supported reachability bound. Invalidations abort transport and reject late completion, with distinct fresh cache epochs even when computedAt is unchanged. Reset restores the original depth-M response, including its own limit flag. Selection checks id and path.

The public additive contract is limited to UI-kit action description/loading/accessibility props and the loading icon. Graph controller state remains behind the explicitly internal stores member. The package contract, API report and minor changesets accompany the change.

Current candidate

Head 7438e84 includes main 61399d1; tree f1a5795d55bf9c253ab13b1a839d2a8aa418c15d. The refresh integrates delivered native event observation, animation capture, native release and current UI/contract changes. The sole README conflict preserves both Discovery expansion and Settings guides. Controller/helper code is unchanged from the original implementation. The native expansion fixture additionally checks the loading spinner's computed reduced-motion policy.

Frozen install and refreshed-base build/types pass. Before the motion correction, local runs at bd08109 passed 55 focused units / 246 assertions, 153 native graph cases in seven files, and 260 native UI-kit pointer/keyboard cases. After the correction, the rebuild, strict types and current bun run check:pr --base origin/main pass (626 tests / 3724 assertions), as do 10 Storybook rule cases, 51 ghost/motion unit tests and all 43 native expansion cases. Full pending changeset package validation/status pass with a minor release and no major. The mechanical UI detector reports no findings.

The 28 committed card/header/status captures were reviewed together across phone/desktop and dark/paper. The corrected native expansion run validates the same baselines without updating them.

Behavioral proof

The following failing-first and mutation receipts are preserved from implementation head 4b610b1, not relabelled as new controls on the refreshed base. The corresponding controller/helper/unit-test code is byte-identical; the native fixture adds the computed loading-motion assertion below.

Behavioral receipts: the original-root store test first failed with the supported outgoing target absent. Raw-base reset and transport-abort tests failed before their fixes; id-reuse selection failed before the identity correction. Ten controller mutations were run separately and restored: degree-derived counts; incoming reveal; ego distances (direct Expected 2 / Received 1); mixed survivor fields; removed base guard; removed generation guard; removed computedAt guard; removed fresh cache epoch; blind absence deletion; and requesting depth nine. Each named test failed on the intended assertion. The fresh-cache test now re-enters the query after obsolete transport settles.

Native mutation: bypassing the shader opacity failed DISCOVERY_MOTION_200MS_GPU on actual WebGL pixels (Expected 0 / Received 7486); the other 42 expansion cases passed. The restored test checks transparent fill/outline, half opacity and nonzero pixels at 100 ms, exact final positions/opacity at 200 ms, and reset cancellation. Natural frame sampling does not assume an overloaded browser delivers every intermediate frame.

The new 43-case native expansion matrix covers sparse/dense/limited/stale scenes, 320/1440px, both themes and motion preferences, keyboard activation, target sizes, loading focus, repeated activation, retry, root races, reset focus, sync failure/recovery/late completion, neutral integrity recovery, zero additions and native depth-eight earlier/same-hop eligibility. Independent unit BFS and actual supported core-query/server-adapter tests cover real/virtual roots, incoming links, moved/deleted/unreachable paths, the 5000-node cap and edge-only 20000-edge cap. Captures separate card, summary and status; 28 new images were visually reviewed. Existing #1919 phone pointer overlap is exercised through the existing keyboard node-list path and remains separately tracked.

Hosted finding and correction

First ready run 38805224202, attempt 1, at checkout 9d43cc7 (parents 61399d1 / bd08109, tree 7ed5cf5a202b1c1df737208cf6b75ed4accb051c), fails the existing single reduced-motion override guard: both Storybook themes report Expected 1 / Received 2, and unit shard 1's ghost stylesheet test fails the same invariant. The new spinner's separate media rule caused this regression. Both failing execution logs independently confirm that checkout; immutable API and local Git agree. The failed jobs were not rerun unchanged.

The spinner now uses the existing shared reduce block; its ordinary animation rule precedes that block so the override wins. Original Storybook/unit assertions remain unchanged. Focused Storybook proof passes all 10 cases and ghost/motion units pass 51 tests. The actual native loading state now asserts computed animation name under both motion preferences. Removing only the spinner selector from the compiled consumer reduced-motion rule fails 16 of 43 native cases on DISCOVERY_LOADING_MOTION_POLICY (Expected none / Received bk-action-spin); restoring the exact compiled bytes passes all 43. Rebuild, strict types and refreshed preflight (626 tests / 3724 assertions) pass. The source correction superseded that failed run; the normal concurrency policy cancelled its remaining three jobs. That run is not complete green qualification. No existing assertion or offline guard was weakened.

Final hosted qualification

Automatic ready CI 38807611966, attempt 1, passes all 14 selected jobs and aggregate. All 13 execution checkout logs independently match 6c9af40. Immutable API and local Git agree on parents 61399d1 / 7438e84 and tree f1a5795d55bf9c253ab13b1a839d2a8aa418c15d. The head-only contract gate passes separately.

• Both browser shards pass: 4580 / four existing exclusions and 4228 / six existing exclusions, including the unchanged single-override Storybook checks.
• Both layouts pass: 514 / 579. Shard 2 executes all 43 expansion cases, including the computed loading-motion assertion and actual WebGL motion proof.
• All four unit shards pass, including the existing ghost stylesheet guard, controller tests and actual core-query/server-adapter bounds fixtures.
• Packaging, verification, captures and native runtime pass. Downloaded artifacts confirm all four healthy Claude/Pi × UID 1000/0 cells with AppArmor, complete first/warm phases without timeout, actual queued refresh, newline-complete final events and clean shutdown/owned cleanup. The separate expected-failure namespace control verifies its intended failure/recovery and stays qualification: false.

Native prerequisite #1935 is delivered by #1963. Issue and PR retain milestone 0.44.0. Minor ui-react/ui-kit changesets, authoritative package contract and API report are included. No supported query, wire, CLI/MCP or frontmatter contract changes. Earlier draft CI intentionally skipped behavior and is not qualification. Existing #1919 phone pointer overlap remains separately tracked as described above.