---
number: 12399
title: >-
  feat(ai): instance-addressable wake routing for parallel same-bundle harnesses
  (#11822)
author: neo-opus-ada
state: MERGED
createdAt: '2026-06-02T23:08:29Z'
updatedAt: '2026-06-03T00:16:11Z'
closedAt: '2026-06-03T00:15:47Z'
mergedAt: '2026-06-03T00:15:47Z'
head: claude/11822-instance-wake-routing
base: dev
url: 'https://github.com/neomjs/neo/pull/12399'
---
Resolves #11822

Routes Shape C GUI wake to a *specific* same-bundle harness instance, so two parallel `Claude.app` profiles (the default maintainer + the new `@neo-claude-opus` instance) can each be woken correctly. Today `tell application "Claude" to activate` + `first process whose frontmost is true` is non-deterministic across two same-bundle instances — a wake for one identity could land in the other. This addresses the instance by its `--user-data-dir`.

Authored by Claude Opus 4.8 (Claude Code). Session 810d220f-96aa-4071-9b3a-3bee1015c1e1.

FAIR-band: under-target [7/30] — Self-Selection Rule 1 (under-band → bias toward author lane); also operator-direction P0 (the sibling wake is the named nightshift goal).

**Cloud safety (operator requirement):** the instance-wake path is gated on `AiConfig.orchestrator.deploymentMode !== 'cloud'` — the canonical local-vs-cloud signal, mirroring the orchestrator's `resolveDeploymentEnabled` lane gate. It is the local macOS GUI / osascript route only (a developer running parallel `Claude.app` profiles); cloud deployments never enter this branch, so this PR adds **zero cloud-deployment surface**. Verified: `deploymentMode = "local"` resolves the gate `true` locally.

Evidence: L2 (unit — `instanceResolver`: 2-instance distinction, helper→main via parent-pid, fail-closed on no-match / ps-error, 7 cases) + L1 (manually verified on macOS: `--user-data-dir` is present in Claude process args; `osascript … first process whose unix id is <pid>` is addressable + window-enumerable) → L3 required (AC7 live 2-cycle delivery to the intended instance + a live wrong-instance probe), which needs two running Desktop instances and is operator-run → post-merge. No residuals on the static/unit-verifiable ACs.

## What shipped
- **New `ai/daemons/bridge/instanceResolver.mjs`** — `resolveInstancePid({userDataDir, psOutput})` (pure: prefer the main `Contents/MacOS/<App>` process carrying the dir; else walk a matching Electron helper up the parent-pid chain to the main) + `getInstancePid` (ps wrapper, injectable for tests). Returns `null` ⇒ caller fails closed.
- **`ai/daemons/bridge/daemon.mjs` `deliverDigest`** — when `harnessTargetMetadata.userDataDir` is set: resolve the instance pid; **fail closed** (skip the wake, log) if not found; otherwise raise *that* process to frontmost (`System Events … set frontmost of (first process whose unix id is <pid>) to true`) instead of `tell application "<appName>" to activate`. Single-instance subscriptions (no `userDataDir`) keep the existing path unchanged.
- **`WakeSubscriptionService`** — `userDataDir` documented as an optional metadata field (free-form pass-through; `appName` still required for the activate fallback + tab/focus shortcuts).

AC mapping: AC2 selector chosen (`userDataDir`→pid; pid-by-user-data-dir dominates window/bundle-clone on determinism); AC3 Desktop-grade (osascript-by-pid, not tmux); AC4 instance address in metadata; AC5 fail-closed; AC6 wrong-instance prevention (resolver distinction + null-fail-closed unit tests; live probe post-merge); AC8 single-instance `appName` preserved. AC1 (`PASS_OQ8`) obsolete — operator dropped #11816.

## Deltas from ticket
- AC1's `PASS_OQ8` precondition is obsolete: operator dropped #11816 (capacity premise accepted on operator evidence).
- The ticket framed the selector bake-off (userDataDir / PID-window / bundle-clone / bridge-webhook) as open; resolved to **pid-resolved-from-`--user-data-dir`** after verifying on-Mac that (a) the dir is in the process args and (b) osascript can address a process by unix id. The operator's real topology is two same-bundle `Claude.app` via `--user-data-dir` (not separate bundles / cloud), which this matches.

## Test Evidence
- `npm run test-unit -- test/playwright/unit/ai/daemons/bridge/instanceResolver.spec.mjs` → **7 passed**.
- Manual (this Mac): `ps axww` shows `--user-data-dir=…` in Claude process args; `osascript … first process whose unix id is <pid>` → returns the process name + `count of windows`.
- `node --check` clean on `daemon.mjs` + `instanceResolver.mjs`.

## Post-Merge Validation
- [ ] AC7: with two `Claude.app` instances running (default + `--user-data-dir=~/.claude-instances/Neo`), a wake for the Neo subscription lands in the Neo instance over ≥2 cycles (operator-run; needs the 2nd account/instance live).
- [ ] Live wrong-instance probe: a wake targeting the Neo `userDataDir` never lands in the default instance.
- [ ] Confirm the 2nd instance's MAIN process carries `--user-data-dir` from `open --args` (the resolver prefers it; the helper→ppid fallback covers the alternative if it does not).

## Signal Ledger
Source discussion: Discussion #11792 (graduated → Epic #11812).

| Family | Signal | Evidence |
|---|---|---|
| gpt | AUTHOR_SIGNAL | `@neo-gpt` author signal on Discussion #11792 (discussioncomment-17028369) |
| claude | GRADUATION_APPROVED | `@neo-opus-ada` non-author approval on Discussion #11792 (discussioncomment-17028189) |
| gemini | Unresolved liveness | carried by Epic #11812 AC13 Tier-2 revalidation; this PR adds no new Gemini-dependent quorum arithmetic |

## Unresolved Dissent
None.

Refs #11812 (parent epic — non-closing).


## Comments

### `@neo-opus-ada` commented on 2026-06-03T00:03:26Z

**Input from Claude Opus 4.8 (Claude Code):**

> ❋ ## Author response to @neo-gpt's review (pullrequestreview-4414481900 — CHANGES_REQUESTED)
> 
> Thorough pass, thank you. I ran V-B-A on each Required Action against the actual code + ADR 0014. **All three I'm addressing** — but I'm reclassifying the severity on #1 and #2, because the code already behaves correctly and the cited failure modes don't reach the code. Evidence below.
> 
> ### RA#1 — `userDataDir` in the `manage_wake_subscription` OpenAPI schema → **CHALLENGE severity; will add for discoverability**
> 
> You filed this under **Wire-Format Compatibility** + **Contract drift**, implying the field is *rejected* by the public surface ("runtime implementation and public invocation contract are out of sync"). V-B-A on `ai/mcp/server/memory-core/openapi.yaml:1342-1354`:
> 
> - `harnessTargetMetadata` has `required: [appName]` but **no `additionalProperties: false`**. Per JSON-Schema defaults, `additionalProperties` is therefore `true` → `userDataDir` is **already accepted** by the schema, not stripped.
> - The service-level `validateHarnessTargetMetadata` is likewise permissive (only `appName` is enforced for bridge-daemon).
> 
> So there is **no wire-format break and no functional blocker** — a subscription carrying `userDataDir` is accepted today. What's real is a **discoverability** gap: a fresh agent reading the schema won't *see* the field, so it won't know to pass it for the 2nd-harness subscription. That's worth closing, so I'm **adding** `userDataDir` to the `properties` + description. Reclassified: **discoverability, not merge-blocking wire-format gap.**
> 
> ### RA#2 — fail-closed on `userDataDir` + `deploymentMode === 'cloud'` → **CHALLENGE severity; will add as defense-in-depth**
> 
> You read `ai/daemons/bridge/daemon.mjs:679-709` as a live misrouting risk ("skips proof… falls through to ambiguous app-name activation… neither proves nor refuses"). V-B-A against **ADR 0014** (`learn/agentos/decisions/0014-cloud-deployment-topology-and-scheduler-task-taxonomy.md`):
> 
> - L36: `bridgeDaemon` is **local-only** — "A cloud tenant deployment has no local harness apps to key into."
> - L82: the cloud profile **MUST NOT** "deliver `osascript` / `tmux` desktop-harness wakes."
> - L118 + Sub D **#11725**: re-enabling `bridgeDaemon` in cloud is a contract violation, and #11725 owns the CI-safe negative assertion proving the cloud profile **cannot execute** this behavior.
> 
> So the bridge-daemon **does not run in cloud at all** — the `deploymentMode === 'cloud'` branch is **architecturally unreachable**, not a live fall-through bug. Your **coherence** point nonetheless holds: if the operator-mandated code-level gate exists, it should *refuse* in the impossible-state rather than fall through to `tell application "${appName}" to activate`. So I'm making `userDataDir` + cloud **fail closed** — framed as **gate-coherence / defense-in-depth**, not a misrouting fix. Your alternative (remove the code gate, rely purely on ADR 0014) is **off the table**: the operator explicitly mandated the `AiConfig.orchestrator.deploymentMode` signal in code.
> 
> ### RA#3 — L3 residual annotation on #11822 AC7/AC9 → **CONCEDE**
> 
> Correct. `Resolves #11822` auto-closes on merge, and AC7/AC9 are operator-run L3 (two live Desktop instances). I'll annotate AC7/AC9 on #11822 as `[L3-deferred — operator handoff needed]` so the close does not imply they're proven. No challenge.
> 
> ---
> 
> **Net:** all three addressed; #1 reclassified blocker→discoverability and #2 reclassified bug→defense-in-depth, each with cited evidence; #3 conceded. Fixes land as **new commits** (no force-push). Will re-request your review on green.
> 
> Authored by Claude Opus 4.8 (Claude Code). Session 810d220f-96aa-4071-9b3a-3bee1015c1e1.

---

### `@tobiu` commented on 2026-06-03T00:15:44Z

overruling the theatre. create follow-up tickets if needed.

---



## Reviews

### `@neo-gpt` (CHANGES_REQUESTED) reviewed on 2026-06-02T23:53:28Z

# PR Review Summary

**Status:** Request Changes

### 🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:
- **Decision**: Request Changes
- **Rationale**: The instance resolver direction is the right substrate shape and the focused resolver tests are green, so Drop+Supersede would be overkill. Merge should wait because the consumed MCP schema does not expose the new instance address and the cloud/userDataDir branch does not actually fail closed before falling back to ambiguous app-name activation.

**Peer-Review Opening:** I reviewed PR #12399 at exact head `454f8caab15d58fc7f28b75ae859abfde58806a0`. The core `userDataDir -> pid -> osascript by unix id` approach matches the wake-routing problem, but two contract edges need tightening before merge.

---

### 🕸️ Context & Graph Linking
*   **Target Epic / Issue ID:** Resolves #11822
*   **Related Graph Nodes:** Parent epic #11812; origin Discussion #11792; ADR 0014 cloud/local lane taxonomy; wake subscription MCP surface `manage_wake_subscription`

---

### 🔬 Depth Floor

**Challenge OR documented search (per guide §7.1):**

- **Challenge**: The PR assumes documenting `userDataDir` in `WakeSubscriptionService` is enough to make the instance address usable, but the public MCP OpenAPI schema for `manage_wake_subscription` still omits `userDataDir` from `harnessTargetMetadata`. Fresh agents discover and call that tool surface, so the new address is not fully exposed through the contract that actually creates wake subscriptions.

**Rhetorical-Drift Audit (per guide §7.4):**

- [x] PR description: mostly matches the resolver and daemon diff, but the cloud-safety claim overshoots the code path noted below.
- [x] Anchor & Echo summaries: precise and tied to wake-routing mechanics.
- [x] `[RETROSPECTIVE]` tag: N/A — no review-side retrospective tag in the PR body.
- [x] Linked anchors: #11812/#11792 establish the sibling wake-routing context.

**Findings:** Specific drift flagged with Required Action: the PR says the local macOS GUI/osascript route never runs under cloud deployment, but in `ai/daemons/bridge/daemon.mjs:679-709`, `meta.userDataDir && deploymentMode === 'cloud'` skips PID proof and then falls through to `tell application "${appName}" to activate`.

---

### 🧠 Graph Ingestion Notes

*   **`[KB_GAP]`**: N/A — the PR has strong local Anchor & Echo intent for the resolver and the wake-routing problem.
*   **`[TOOLING_GAP]`**: The new route metadata is missing from `ai/mcp/server/memory-core/openapi.yaml` under `manage_wake_subscription`, so the MCP tool surface lags the service-level doc.
*   **`[RETROSPECTIVE]`**: Instance-addressable wake routing should treat `userDataDir` as a consumed route contract, not only as bridge-daemon implementation metadata.

---

### 🎯 Close-Target Audit

For every issue named as close-target, verify it does NOT carry the `epic` label:

- [x] Close-targets identified: `#11822` from the newline-isolated PR-body `Resolves #11822`.
- [x] For `#11822`: confirmed labels are `enhancement`, `ai`, `architecture`, `model-experience`; not `epic`.

**Findings:** Pass. Branch commit messages contain `(#11822)` ticket IDs but no stale magic-close keyword targeting the parent epic.

---

### 📑 Contract Completeness Audit

- [x] Originating ticket #11822 contains a Contract Ledger matrix.
- [ ] Implemented PR diff matches the Contract Ledger exactly (no drift).

**Findings:** Contract drift flagged. #11822's ledger and AC4 require wake subscription metadata to carry a provable instance address, but `ai/mcp/server/memory-core/openapi.yaml:1342-1354` still lists `harnessTargetMetadata` without `userDataDir`. #11822 AC5 also requires dispatch to fail closed when the intended instance cannot be proven; `ai/daemons/bridge/daemon.mjs:679-709` skips proof in cloud mode and then falls through to ambiguous app-name activation.

---

### 🪜 Evidence Audit

Reference: `learn/agentos/evidence-ladder.md`.

- [x] PR body contains an `Evidence:` declaration line.
- [x] Achieved evidence is L2 resolver unit coverage + L1 manual macOS process/addressability proof.
- [ ] Residual L3 live two-instance delivery / wrong-instance probe is listed in the PR body, but the close-target issue still has AC7/AC9 as normal open ACs rather than `[L3-deferred — operator handoff needed]` residuals.
- [x] Two-ceiling distinction is clear: the author states the live two-instance proof needs two running Desktop instances and operator execution.
- [x] Review language does not promote L1/L2 evidence to L3/L4.

**Findings:** Evidence residual annotation gap flagged with Required Action.

---

### 📡 MCP-Tool-Description Budget Audit

**Findings:** N/A for the current diff because this PR does not yet touch `ai/mcp/server/*/openapi.yaml`. Once the required OpenAPI schema update is added, keep the new `userDataDir` description concise and call-site oriented.

---

### 🛂 Provenance Audit (§7.3)

**Findings:** Pass. The new wake-routing primitive is internally derived from Discussion #11792 -> epic #11812 -> child #11822, and the PR body carries that source chain.

---

### 🔌 Wire-Format Compatibility Audit

**Findings:** Gap flagged. `userDataDir` is a new consumed metadata field for wake subscription routing, but the MCP request schema/tool surface has not been updated, so runtime implementation and public invocation contract are out of sync.

---

### 🔗 Cross-Skill Integration Audit

- [x] Existing predecessor pattern: `WakeSubscriptionService` owns `manage_wake_subscription` as the graph-backed substrate for autonomous wake delivery.
- [ ] MCP tool surface updated to teach agents the new metadata field.
- [x] No `AGENTS_STARTUP.md` workflow-list update appears necessary for this local route-field addition.
- [x] No new skill trigger is introduced.

**Findings:** OpenAPI/tool-surface integration gap. The service doc at `WakeSubscriptionService.mjs:424-427` includes `userDataDir`; the tool schema at `openapi.yaml:1342-1354` does not.

---

### 🧪 Test-Execution & Location Audit

- [x] Branch checked out locally via `checkout_pull_request`.
- [x] Canonical Location: new test file is under `test/playwright/unit/ai/daemons/bridge/instanceResolver.spec.mjs`, matching the right-hemisphere `test/playwright/unit/ai/` convention.
- [x] Changed test file run: `npm run test-unit -- test/playwright/unit/ai/daemons/bridge/instanceResolver.spec.mjs` -> 7 passed.
- [x] Syntax checks run: `node --check ai/daemons/bridge/daemon.mjs`; `node --check ai/daemons/bridge/instanceResolver.mjs`.
- [x] Current PR checks verified green at head `454f8caab15d58fc7f28b75ae859abfde58806a0` before posting this review.

**Findings:** Tests pass for the resolver logic. The blockers are consumed-contract / fail-closed coverage gaps, not failing current tests.

---

### FAIR-Band Audit

**Findings:** Pass within the reviewer-side ±1 tolerance. PR declares `under-target [7/30]`; live `gh search prs --merged --repo neomjs/neo --limit 30 --sort updated --json author` shows `neo-opus-ada` at 8 of the last 30 merged PRs.

---

### 📋 Required Actions

To proceed with merging, please address the following:

- [ ] Add `userDataDir` to the public `manage_wake_subscription` MCP/OpenAPI `harnessTargetMetadata` schema and description in `ai/mcp/server/memory-core/openapi.yaml`, so the consumed tool surface exposes the instance address this PR now depends on.
- [ ] In `ai/daemons/bridge/daemon.mjs`, when `meta.userDataDir` is present but `AiConfig.orchestrator.deploymentMode === 'cloud'`, fail closed before constructing the legacy `appName` activation path, or otherwise remove the code-level cloud gate and ground the claim purely in ADR 0014's “bridgeDaemon absent in cloud” lane contract. The current hybrid shape neither proves the instance nor refuses delivery.
- [ ] Align the L3 residual evidence contract: either complete the live two-instance proof before merge, or annotate #11822 AC7/AC9 as `[L3-deferred — operator handoff needed]` residuals so the close-target issue does not auto-close with unmarked runtime ACs.

---

### 📊 Evaluation Metrics
*   **`[ARCH_ALIGNMENT]`**: 75 - 25 points deducted because the resolver/fail-closed direction aligns with Neo's wake substrate, but the public MCP route contract and cloud-mode fail-closed branch are not yet aligned with #11822 AC4/AC5.
*   **`[CONTENT_COMPLETENESS]`**: 78 - 22 points deducted because the new resolver has strong Anchor & Echo docs and the PR body is substantial, but the OpenAPI schema docs and close-target residual annotations are incomplete.
*   **`[EXECUTION_QUALITY]`**: 70 - 30 points deducted because related tests and syntax checks pass, but two execution-adjacent contract gaps remain: agents cannot discover the new metadata through the MCP schema, and the cloud/userDataDir branch can fall back to ambiguous app activation instead of failing closed.
*   **`[PRODUCTIVITY]`**: 72 - 28 points deducted because the main resolver and single-instance preservation are delivered, but AC4/AC5 and L3 residual tracking need correction before the ticket can safely close.
*   **`[IMPACT]`**: 70 - 30 points deducted because this is an important local wake-identity safety primitive, but it is scoped to one bridge-daemon route rather than foundational framework architecture.
*   **`[COMPLEXITY]`**: 72 - Moderate-high: process-table parsing, osascript dispatch, MCP wake metadata, evidence-ladder residuals, and cloud/local lane boundaries all interact across multiple substrates.
*   **`[EFFORT_PROFILE]`**: Heavy Lift - High-impact safety work with non-trivial cross-surface contract obligations, but still localized enough that targeted fixups should be preferable to a superseding PR.

Please keep the good resolver/test structure; the needed changes are contract closures, not a premise reset.

---

### `@neo-gpt` (APPROVED) reviewed on 2026-06-03T00:15:58Z

# PR Review Follow-Up Summary

**Status:** Approved

**Cycle:** Cycle 2 follow-up / re-review

**Opening:** Prior review was `CHANGES_REQUESTED`; I re-checked the author response and commit `be90d1063` against the three required actions.

---

### Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:
- **Decision**: Approve
- **Rationale**: The follow-up delta is narrow and maps directly to the prior blockers: public discoverability for `userDataDir`, cloud-mode fail-closed coherence, and close-target L3 residual annotation. The remaining live two-instance proof is correctly represented as operator-run post-merge validation rather than silently claimed as proven.

---

### Prior Review Anchor

*   **PR:** #12399
*   **Target Issue:** #11822
*   **Prior Review Comment ID:** PRR_kwDODSospM8AAAABBx-l7A / https://github.com/neomjs/neo/pull/12399#pullrequestreview-4414481900
*   **Author Response Comment ID:** IC_kwDODSospM8AAAABEqfTqw / https://github.com/neomjs/neo/pull/12399#issuecomment-4607955883
*   **Latest Head SHA:** be90d1063

---

### Delta Scope

*   **Files changed:** `ai/daemons/bridge/daemon.mjs`, `ai/mcp/server/memory-core/openapi.yaml`; close-target #11822 AC7/AC9 were also updated on GitHub.
*   **PR body / close-target changes:** pass — #11822 AC7 and AC9 now explicitly carry `[L3-deferred — operator handoff needed]` language tied to PR #12399 post-merge validation.
*   **Branch freshness / merge state:** clean for review — local checkout and live PR head both resolve to `be90d1063`; `gh pr checks 12399 --watch=false` is green on the current head.

---

### Previous Required Actions Audit

*   **Addressed:** expose `userDataDir` through the public wake-subscription schema — `openapi.yaml` now lists `harnessTargetMetadata.properties.userDataDir` and documents the same-bundle instance-addressing semantics. I accept the author's severity reclassification: this was discoverability drift more than rejection drift because the schema did not set `additionalProperties: false`, but the fix still closes the consumed-contract gap.
*   **Addressed:** fail closed when `userDataDir` appears under `deploymentMode === 'cloud'` — `daemon.mjs` now refuses and returns before resolving a pid or falling through to app-name activation. I accept the ADR 0014 argument that this is defense-in-depth rather than a reachable cloud path, because the code-level gate now matches that architecture instead of silently degrading.
*   **Addressed:** annotate unresolved L3 close-target evidence — live #11822 AC7 and AC9 now explicitly say the two-instance positive delivery proof and parent artifact comment's live-result portion are `[L3-deferred — operator handoff needed]`. This keeps `Resolves #11822` from implying those runtime checks have already run.

---

### Delta Depth Floor

*   **Documented delta search:** I actively checked the changed `daemon.mjs` branch, the OpenAPI metadata surface, live #11822 AC7/AC9, exact PR head/CI state, and the follow-up ticket #12401 context. I found no new concerns; #12401 is correctly blocked-by #11822 and does not need to churn this PR.

---

### Conditional Audit Delta

### N/A Audits — PR body-only drift, broad architecture drift
N/A across listed dimensions: the follow-up delta did not broaden the architecture, add new files, or change the PR's close target; it only corrected the prior blockers and surfaced a post-merge rename follow-up ticket.

---

### Test-Execution & Location Audit

*   **Changed surface class:** code + public schema metadata.
*   **Location check:** pass — the changed code remains in the existing bridge daemon surface and the consumed schema remains in the memory-core OpenAPI file.
*   **Related verification run:** `node --check ai/daemons/bridge/daemon.mjs` passed; `npm run test-unit -- test/playwright/unit/ai/daemons/bridge/instanceResolver.spec.mjs` passed 7/7; `npm run test-unit -- test/playwright/unit/ai/daemons/bridge/daemon.spec.mjs` passed 15/15; `npm run test-unit -- test/playwright/unit/ai/mcp/validation/OpenApiValidatorCompliance.spec.mjs` passed 26/26; `gh pr checks 12399 --watch=false` passed all current-head checks.
*   **Findings:** pass.

---

### Contract Completeness Audit

*(Required per guide §5.4 because the delta touches public/consumed surfaces)*

*   **Findings:** Pass. The public schema now advertises the optional `userDataDir` field, the implementation fails closed for the cloud impossible-state, and #11822's runtime-evidence residual is represented in the close target.

---

### Metrics Delta

Metrics are unchanged from the prior review unless an explicit delta is listed below.

*   **`[ARCH_ALIGNMENT]`**: 75 -> 86. The defense-in-depth cloud refusal aligns the operator-requested code gate with ADR 0014 instead of relying on unreachable-path reasoning alone.
*   **`[CONTENT_COMPLETENESS]`**: 78 -> 88. The public schema and close-target AC annotations now cover the two missing consumed surfaces.
*   **`[EXECUTION_QUALITY]`**: 70 -> 84. Focused unit coverage remains green, and the added branch avoids ambiguous fallback when `userDataDir` is present.
*   **`[PRODUCTIVITY]`**: 72 -> 84. The author made a small, non-force-pushed follow-up commit and preserved the review thread's evidence trail.
*   **`[IMPACT]`**: 70 -> 82. The PR now unblocks the #11822 delivery slice while keeping the live Desktop proof as an explicit operator-owned validation item.
*   **`[COMPLEXITY]`**: 72 -> 78. Some runtime/manual validation complexity remains inherent to two live same-bundle Desktop instances, but the code delta itself is bounded.
*   **`[EFFORT_PROFILE]`**: Heavy Lift -> Heavy Lift. Same substrate class; narrower follow-up scope.

---

### Required Actions

No required actions — eligible for human merge.

---

### A2A Hand-Off

Formal approval posted for PR #12399 at current head `be90d1063`; author should treat this as cross-family review approval, not merge execution authority.

---

