[timeleft--]

Six Blueprints obscured their contracts behind delivery history and retained obsolete proposal language. They now explain action binding, request/view lifetimes, reusable MCP delivery, protected playback, rejected account-session isolation and proposed application feedback through complete flows, ownership boundaries, failure cases and rationale.

Approved, rejected and draft design decisions are preserved. Current source behavior is distinguished from published-package and bounded host evidence. Eight editable/rendered diagram bundles show the corresponding owners and flows. Independent review corrected a diagram that put current() presentation checks after callback completion; the guard is now inside the eligible callback.

Validation: 125 documentation/consumer-boundary tests, 131 relative references and 19 immutable source paths, unchanged package versions, hooks, LFS pointers, SVG parsing and visual inspection. Supporting historical inbound-link repairs are in PR #316. No runtime, design-approval, release or deployment changes. Rendered review: GitBook draft #10 — action and lifetime designs. The browser shows genuine existing-page diffs; complete headings, examples and all embedded diagrams were read back.

Merge when clean: yes

[yia-mw-agent]

Helmet-Review-Request: #318 (comment)

Approved at head 3bae458. I found no material defects.

Scope reviewed: the full merge-base-to-head diff against main. The merge base is cdad547 and equals the current origin/main. It covers 38 files: six Blueprints (action binding, request/view lifetimes, authorized playback, reusable MCP connector, plus the rejected account-isolation and draft application-feedback documents) and eight diagram bundles.

What I checked:

• Front matter, and so every design decision, is unchanged in all six files (approved, rejected, draft). The rewrites keep the approved design permalinks (a60acda, 564bcb2, 7836c80, c674060, feb037e, 6785ae1, 19fb26c, 6c268cc) and point to the full prior text at cdad547 for the earlier lifecycle records. That matches the blueprints/README.md lifecycle rule for editorial revisions.
• All 39 full SHAs cited in the changed Blueprints resolve to commits. Each cited PR-to-landed-commit pairing (#56/#58, #75, #84, #106, #113, #115, #124, #133, #140, #145, #165, #172, #234, #240, #245) matches the PR's merge commit. All 13 cited pullrequestreview-* IDs exist and are APPROVED at the stated head commits. Both cited issue comments exist on the stated issues.
• Release and registry claims: v0.7.7-rc.1 exists, all seven packages are at 0.7.7-rc.1, and next is 0.7.7-rc.1 for every published package, including both stacks.
• Behavior claims against source: action defaults 30,000/5,000 ms (packages/core/src/actions/limits.ts), server defaults 3,000/10,000 ms (packages/mcp/src/policy/index.ts), capability TTL 60 s, proof max age 60 s and 5 s clock tolerance with ES256 (media-service.ts), pinned MCP package and Zod versions (package-lock.json), the exported server and view APIs, createLitActions/createReactActions, ActionError, and the player owner's begin/start/retain/end/teardown. The text correctly notes that the sketch's keep/endCurrent map to retain/teardown. Label loss is final in playback-view.ts. The security-sensitive wording (no authorization from client checks, unknown outcome is not retryable, stale callbacks, buffered bytes not retracted) is consistent with the code and the approved designs.
• Links: all relative links and anchors inside the six changed files resolve. The eight PNGs are valid Git LFS pointers, all SVGs parse, and the .mmd sources agree with the prose, including the corrected current() placement.
• Checks run locally at this head: npm run test:docs (4 files, 125 tests) passed. check-blueprint-length.py printed only its advisory word-count warnings and exited 0. CI at review time: Documentation/policy, Version policy and GitBook pass.

Non-blocking notes:

1. Two inbound anchors into the rewritten action Blueprint break on this PR alone: docs/development-reference.md (#migration-rules) and blueprints/modules/action_binding.evidence.md (#lynx-lynx-jsgenui-070). PR #316 already repoints both to the cdad547 permalink, so they only matter if #318 merges before #316. Land #316 first or together.
2. The "Application types, builds, tests and release qualification" job was still pending when I looked. This PR changes no source, so it does not affect my verdict.
3. Several Blueprints are long (action_binding about 13k words). The check is advisory by design.

[yia-mw-agent]

Helmet-Review-Request: #318 (comment)

Approved at 5320a09. I reviewed the full merge-base-to-head diff against main (merge-base cdad547, 38 files: six Blueprints and eight diagram bundles) and found no material defects. The change is documentation only. No runtime, package-version or approval-state change.

Checks run on the exact head:

• npm run test:docs passed: 4 files, 125 tests (guide, actions-document, tour-document, consumer-boundary).
• Scripted check over the changed files: 0 broken relative links, all SVGs parse as XML, all .excalidraw files parse as JSON, and every changed PNG is a Git LFS pointer. Every changed .mmd has its .svg, .png and .excalidraw siblings.
• npm run format:check -- cdad547 HEAD found no Prettier-checkable files in the diff.
• Factual claims I spot-checked against the repository and registry:
  • Five packages under packages/ are at 0.7.7-rc.1 in source, and npm next is 0.7.7-rc.1 for core, mcp, react, components and lit. The v0.7.7-rc.1 release exists.
  • The pinned commits (ff0f4da, the design and amendment SHAs, the PR landing SHAs) resolve, and the files pinned at ff0f4da exist there.
  • Moved source paths (packages/core/src/host-links.ts, actions/outcome.ts) exist.
  • Defaults match source: DEFAULT_OPERATION_MS 3,000 and DEFAULT_REQUEST_MS 10,000; action deadlineMs 30,000 and hookMs 5,000; media capability TTL 60 s, proof max age 60 s, clock tolerance 5 s.
  • The player owner's real method names (retain, teardown) match the Blueprint's note about its illustrative keep/endCurrent.
• The commit added since the 3bae458 head (5320a09) changes one sentence in reusable_mcp_connector.blueprint.md. It drops the link to the Ansari adoption design and states that adopting applications own their migration, merge and deployment decisions. That is consistent with the page's scope and introduces no broken link.
• Design decisions are preserved. Approved, rejected and draft statuses are intact. The account-session-isolation Blueprint is clearly labelled as a rejected proposal. The application-owned-feedback Blueprint is still a draft, and the added text says editing it grants no approval. The diagrams place the current() check inside the eligible callback, matching the prose.

Non-blocking observations: none that need action. The PR is large, but the rewrites are self-consistent and cross-linked.