conformance(ipc): pinned v44.4.5 entries for the draw.io IPC path — send/on/once, ipcMain.on/once/removeListener, event.reply, senderFrame, webContents.send delivery, IpcRendererEvent, structured-clone throws, contextBridge value rows, navigation-gen #464

Generated by an AI agent (Claude Code) on behalf of @0monish during Wayfinder charting of the Electron compatibility program; rewritten 2026-10-07 by the doctrine-audit repair pass (change log at the end). Planning only — no implementation is authorized by this issue.

Parent

Epic #463 · Map #391 · Unit F04 · Kind: conformance · Tier: Tier 1 · Maturity target: L2 · Size: M · Milestone: first-proof

What to build

Land red-until-implemented KEL-74 cells for the draw.io first-proof IPC path. Doc-sentence entries (ipc-renderer.md, ipc-main.md, ipc-main-event.md, ipc-renderer-event.md, context-bridge.md at v44.4.5): (1) ipcRenderer.send args reach an ipcMain.on listener by structured clone; (2) send throws synchronously for Function, Promise, Symbol, WeakMap, WeakSet; (3) ipcMain.once fires once and ipcMain.removeListener stops delivery; (4) event.reply reaches the sending frame and webContents.send reaches an ipcRenderer.on listener of that WebContents; (5) senderFrame.url equals the loaded document URL and senderFrame is null after the frame navigated or was destroyed; (6) IpcRendererEvent.sender is the ipcRenderer instance and ports is an empty list when nothing was transferred; (7) contextBridge rows: functions proxied (argument position, including a callback nested in an object argument, called N times from the preload world), other values copied and frozen, Symbol dropped, Error copied with message. Observed-only entries (no v44.4.5 doc sentence states them, so under the X01-T3 uncited-cell rule they land with expected status unknown; the recorded-oracle comparison is F04-T20's, next milestone): (8) per-channel order of N sends; (9) webContents.send with no renderer listener is dropped, not queued for a later listener; (10) stale event.reply after cross-document navigation is dropped without throwing; (11) a hash change during a pending request does not drop the reply; (12) a cancelled renderer-initiated navigation keeps IPC usable; (13) reply with unserializable args throws, and reply after render-frame disposal throws (drop-versus-throw boundary recorded as ▲). Doc-sentence entries are red-until-implemented cells in the X01-T3 representation (expected fail, implementing-ticket key named: entries 1, 3, 4 and 5 F04-T3, entry 2 F04-T11, entries 6 and 7 F04-T4) validated by the X01-T4 manifest owner.

Acceptance criteria

• Every doc-sentence entry is a red-until-implemented KEL-74 cell in the X01-T3 representation: expected status fail with its implementing-ticket key, a mapped test that asserts the current behaviour and passes, and a flip to pass in the implementing change; the required gate stays green; no entry is skipped, ignored, retried or silently red
• Every doc-sentence entry quotes the pinned Electron v44.4.5 sentence it asserts with the sentence digest; every entry without a sentence (8–13) is labelled observed-only and carries expected status unknown
• Every cell's oracle revision equals the corpus pin fixed by the X01-T3 pin rule (the v44.4.5 tag commit), the manifest passes the X01-T4 validator, and no cell cites Electron 44.3.0 or the KEL-75 snapshot commit
• The three navigation-generation entries required by the F04-A4 resolution (entries 10, 11, 12) are present
• No entry asserts a timing value or a performance number
• No sendSync, returnValue, invoke/handle or exposeInIsolatedWorld entry is in this set (owned by F04-T15, F04-T14, F04-T5)

Negative controls (each names the one mutation that must fail)

• Changing a cell's runner assertion from an expected status to skip makes the X01-T4 manifest validator fail
• Setting an observed-only entry (for example entry 8) to expect pass without a doc citation makes the X01-T4 validator reject the manifest
• Removing the implementing-ticket key from a red-until-implemented entry makes the X01-T4 validator reject the manifest
• Deleting the mapped test of entry 5 (senderFrame) makes execution admission fail because the cell names an unregistered test target

External predecessors (outside this tracker)

• Linear reference link to GitHub conformance(ipc): pinned v44.4.5 entries for the draw.io IPC path — send/on/once, ipcMain.on/once/removeListener, event.reply, senderFrame, webContents.send delivery, IpcRendererEvent, structured-clone throws, contextBridge value rows, navigation-gen #464 on KEL-80 (Backlog, unassigned; Linear, fetched 2026-10-07), titled with the GitHub number and 'tracker of record: GitHub' (orchestrator is the single writer; first check: that link exists)
• KEL-74 evidence schema (Done) and the KEL-237 lifecycle corpus manifest and runner pattern as present on origin/main 8678c0d (consumed, not extended)

Ownership and gates

• Tracker of record: this GitHub issue (no live Linear issue covers it; owner decision Linear owner for repo-writing Electron-compat slices (owner decision: align to nearest Linear issue, else GitHub is the tracker of record) #517). Claims, status and handoffs happen here under docs/agents/workflow.md § Tracker issue (rule lands with docs(agents): record the #517 tracker-of-record rule in root AGENTS.md and the workflow claim protocol #520). Linear reference: KEL-80 (Backlog) carries a link to this issue.
• Blocking edges: native GitHub blocked-by links on this issue (open blockers only: spec(conformance): first-proof evidence rules — one Electron oracle pin per corpus, per-cell pinned-doc citation, red-until-implemented cells, observed-only = unknown, artifact digest meaning, authority label, one shared manifest owner #532, test(compat): one shared corpus-manifest owner in keld-compat test support — exact-bytes digest, pin consistency, per-cell doc citation, red-until-implemented and uncited-cell validation, registered test targets; lifecycle corpus migrated byte-for-by #566)
• Linear owners and predecessors (repair-time analysis; statuses as fetched 2026-10-07): Tracker of record: GitHub conformance(ipc): pinned v44.4.5 entries for the draw.io IPC path — send/on/once, ipcMain.on/once/removeListener, event.reply, senderFrame, webContents.send delivery, IpcRendererEvent, structured-clone throws, contextBridge value rows, navigation-gen #464 under the Linear owner for repo-writing Electron-compat slices (owner decision: align to nearest Linear issue, else GitHub is the tracker of record) #517 owner decision (Linear owner for repo-writing Electron-compat slices (owner decision: align to nearest Linear issue, else GitHub is the tracker of record) #517 comment IC_kwDOSwkPJ88AAAABZxzzGA, 2026-10-06T20:32Z: align to the nearest live Linear issue whose scope covers the work, otherwise the GitHub issue is the tracker of record and no Linear issue is created). Linear reference link on KEL-80 (Backlog, unassigned; Linear, fetched 2026-10-07), the nearest surface ('Bridge: bounded virtual channels and traffic-replay conformance'). INFERENCE: KEL-80 is not the claim tracker because of its 2026-08-20 owner comment 'do not pick up'; if the owner aligns this slice to KEL-80 instead, KEL-80 becomes the tracker of record. Not KEL-237 (In Progress): its non-goals exclude compatibility-surface expansion.
• Review gates: none
• Platforms: macOS WKWebView cells first; WebKitGTK and WebView2 cells recorded unknown with a documented gap
• Electron members covered: ipcRenderer.send, ipcRenderer.on, ipcRenderer.once, ipcRenderer.removeListener, ipcMain.on, ipcMain.once, ipcMain.removeListener, IpcMainEvent.reply, IpcMainEvent.sender, IpcMainEvent.senderFrame, IpcRendererEvent.sender, IpcRendererEvent.ports, webContents.send, contextBridge.exposeInMainWorld

The authoritative agent contract is the latest Agent Brief comment on this issue (triage skill); this body is the planning record.

Out of scope

Implementation; Zettlr-only entries (invoke/handle, sendSync, function-valued returns) which land as the first acceptance criterion of F04-T14, F04-T15 and F04-T16; recorded Electron transcripts and BEHAVIOR_MATCH comparison of observed-only entries 8–13 (F04-T20, after the X01-T1 two-arm harness).

Notes

Startable once X01-T3 and X01-T4 land and the KEL-80 reference link exists. Agents cite the #517 owner record as the documented exception to the Linear-only claim protocol in root AGENTS.md and the workflow until the .agents/instructions.md amendment lands (the owner record names that gap itself).

Change log (doctrine-audit repair, 2026-10-07)

• Narrowed to the draw.io first-proof path; removed sendSync, returnValue, invoke/handle, handleOnce/removeHandler entries (critic yagni F04-T1; critic duplicates sync cluster; X06-D2 pull order)
• Added the three navigation-generation entries required by the closed F04-A4 resolution
• Stated the red-entry mechanism as KEL-74 expected-status cells flipped in the implementing PR (critic invariant_violations F01-T1..F06-T1)
• Relabelled per-channel send order, stale-reply drop and listener-less drop as observed-only recorded-oracle cells because no v44.4.5 doc sentence states them (critic ambiguity F04-EPIC; my read of the pinned docs 2026-10-07)
• Added IpcRendererEvent, webContents.send no-listener drop, reply drop-versus-throw boundary and nested-callback rows (critic coverage_gaps IpcRendererEvent; refuter semantics extra findings on renderer drop, A4 drop-versus-throw; X06-D3 semantics P3 rows)
• Moved oracle pin ownership to X01-T1 and added edge F04-T1 ← X01-T1 (critic duplicates F04-T5/X01-T1; refuter pin-drift findings)
• Replaced KEL-237 as owner with a missing-owner blocker because KEL-237 non-goals exclude compat-surface expansion (X06-D3 invariants item 2; X06-D6 semantics; KEL-237 description, Linear fetched 2026-10-07)
• Changed ready_state from ready-for-agent to needs-owner (X06-D6)
• Replaced the non-deterministic negative control with transcript mutations, one per key entry (rule 8)
• Replaced blocker X01-T1 (next, needs-info) with X01-T3 (pin, citation and red-until-implemented rules) and X01-T4 (shared manifest validator); AC1–AC3 and key_interfaces now cite X01-T3/X01-T4 (cross-checker finding 'first-proof slices gated on next-milestone X01-T1')
• Observed-only entries 8–13 now carry expected status unknown because X01-T3 permits an uncited cell only as unknown; their recorded-transcript comparison and the two transcript-mutation negative controls moved to new F04-T20 (next, blocked by X01-T1); negative controls replaced with X01-T4 validator mutations; each doc-sentence entry names its one implementing ticket (cross-checker finding 'first-proof slices gated on next-milestone X01-T1')
• Entry 4 now names webContents.send delivery explicitly, because F04-T3 and F04-T10 flip a 'webContents.send delivery' cell the entry list did not define (consequence of the same substitution)
• Owner: GitHub conformance(ipc): pinned v44.4.5 entries for the draw.io IPC path — send/on/once, ipcMain.on/once/removeListener, event.reply, senderFrame, webContents.send delivery, IpcRendererEvent, structured-clone throws, contextBridge value rows, navigation-gen #464 is the tracker of record under the Linear owner for repo-writing Electron-compat slices (owner decision: align to nearest Linear issue, else GitHub is the tracker of record) #517 owner decision comment (D adopted, verified on GitHub 2026-10-07), Linear reference on KEL-80; ready_state needs-owner → ready-for-agent; notes no longer cite X06-D6 (cross-checker finding X06-D7 tracker-of-record contradiction)