@unrulysystems/native-motion 0.1.0-alpha.0

package/src/native/driver/workletDriver.ts

@@ -0,0 +1,3860 @@
+// The real native driver (specs/M2.1-BUILD-PACKET.md, Milestone 3): core's `Driver` seam implemented
+// over the Reanimated UI runtime. The substrate meets the graph exactly at this seam — commands cross
+// JS→UI once each (O(1), REQ-DRIVER-013), the frame loop advances everything UI-side with core's own
+// `stepProp` + generators (REQ-DRIVER-003: no forked math — the crossing chain is worklet-tagged core
+// dist, see packages/core/scripts/tag-worklet-dist.mjs), and each element's props mirror into shared
+// values that animated styles read.
+//
+// Frame source (REQ-DRIVER-011): the LIVE loop is a single driver-owned `useFrameCallback` — real
+// vsync (Choreographer / CADisplayLink) — owned by the `useWorkletDriver` hook. It is deliberately
+// NOT a UI-runtime `requestAnimationFrame` chain: that is a software poll (animationQueuePollingRate),
+// wrong on 120Hz and drift-prone — review cycle 1 rejected exactly that. Settle-cancel
+// (REQ-DRIVER-020): when every element quiesces, the UI side notifies JS ONCE (settleNotified guard)
+// and JS deactivates the frame callback after a synchronous re-check (a command racing the settle edge
+// must win); a deactivated callback costs zero per-frame work — the M2.0 JS-thread driver burned CPU
+// forever and is deleted.
+//
+// Command→trajectory resolution is split across the runtimes on plain-data lines: the JS side converts
+// the public `Transition` with the same COMPONENT converters the reference driver uses
+// (`toSpringConfig` / `toTimingConfig`), and the UI side CONSTRUCTS the generator closure where it
+// runs — a closure cannot cross runtimes (packet §Grounding), plain configs can.
+
+import { useEffect, useRef } from 'react'
+import {
+  makeMutable,
+  useFrameCallback,
+  type FrameInfo,
+  type SharedValue,
+} from 'react-native-reanimated'
+import { executeOnUIRuntimeSync, scheduleOnRN, scheduleOnUI } from 'react-native-worklets'
+import {
+  buildRepeatedGenerator,
+  delayGenerator,
+  inertiaGenerator,
+  resolveSpring,
+  resolveSpringGenerator,
+  toDelayMs,
+  toRepeatFoldOptions,
+  retargetSpring,
+  stepProp,
+  timingGenerator,
+  toKeyframesConfig,
+  toSpringConfig,
+  type Driver,
+  type ElementHandle,
+  type Generator,
+  type InertiaTransition,
+  type RepeatFoldOptions,
+  type RepeatLeg,
+  type KeyframesConfig,
+  type LivePropState,
+  type PropStep,
+  type PropTargetTo,
+  type PropTransition,
+  type SpringConfig,
+  type TimingConfig,
+  type Transition,
+} from '@unrulysystems/native-motion-core'
+import {
+  adaptPreparedDriver,
+  applyPathProgressInto,
+  instantFinalKeyframe,
+  instantGenerator,
+  isDurationZeroInstantTransition,
+  keyframeOffsetAt,
+  keyframeSegmentEase,
+  isRepeatFoldRefusalIdentity,
+  isTimingLaneTransition,
+  iterationMeasurementLane,
+  repeatRefusalMessage,
+  toTimingLaneConfig,
+  REPEAT_REFUSAL_KEY,
+  REPEAT_REFUSAL_NAME,
+  type ArcScratch,
+  type PathChannelGeometry,
+  type PathProgressSample,
+  type PreparedDriver,
+  type PreparedPropTarget,
+} from '@unrulysystems/native-motion-core/internal-driver'
+// Type-only: the runtime registry/session enter the UI runtime inside uiLayoutEngine, which
+// imports them from the file-tagged worklet-layout subpath (the root-entry import above never
+// reaches a UI worklet from this file).
+import type {
+  LayoutIdentityRole,
+  LayoutIdToken,
+  WindowSpaceRect,
+} from '@unrulysystems/native-motion-core/worklet-layout'
+import { assertSetupNotReplayedOnDisposed } from './strictModeReplay'
+import { isInstantWindowOpen } from './instantWindow'
+import {
+  createUiLayoutState,
+  uiLayoutAttach,
+  uiLayoutCommit,
+  uiLayoutCouple,
+  uiLayoutDetach,
+  uiLayoutOpacityWitness,
+  uiLayoutStep,
+  uiLayoutUncouple,
+  uiProjectionAttach,
+  uiProjectionDetach,
+  uiProjectionSetProjection,
+  uiSetProjectionRadiusFeed,
+  type UiLayoutHolderOutputs,
+  type UiProjectionOutputs,
+  type UiLayoutState,
+} from './uiLayoutEngine'
+
+// A transition resolved JS-side to plain data so it can cross to the UI runtime. Mirrors the reference
+// driver's start/retarget selection (spring is the fallback; tween goes through TIMING; REQ-TIMING-006:
+// an authored duration-ONLY bag with no `type` also resolves 'tween', the pin's keyframes generator).
+// `keyframes`
+// carries the multi-keyframe timing config (REQ-API-033) resolved through the SAME COMPONENT converter
+// (`toKeyframesConfig`) the reference driver uses, so an ARRAY target selects it UI-side with zero
+// resolution skew between the two driver implementations — the target shape, not `kind`, selects it.
+// `kind` is the SCALAR generator selector (spring is the fallback — an omitted type WITHOUT
+// `duration` resolves to 'spring'; an omitted type WITH `duration` resolves to 'tween',
+// REQ-TIMING-006). `explicitSpring` preserves whether the type was LITERALLY 'spring' (vs defaulted), which
+// the keyframe-ARRAY branch needs: an array's default is a keyframes tween, so only an EXPLICIT spring
+// routes an array to spring physics — collapsing omitted→spring for arrays skews vs the reference
+// driver (review major 8). Tween is never a spring, so its `explicitSpring` is the literal `false`.
+type PlainTransition =
+  | {
+      readonly kind: 'spring'
+      readonly config: SpringConfig
+      readonly keyframes: KeyframesConfig
+      readonly explicitSpring: boolean
+      // T18-a (REQ-API-049): the repeat fold's options, resolved JS-side to plain scalars, or null
+      // when the fold is inert. An authored `Transition` never crosses the marshal.
+      readonly repeat: RepeatFoldOptions | null
+      // T18-b (REQ-TIMING-004): the delay rebase's shift in MS, resolved JS-side through the same
+      // `toDelayMs` seconds→ms crossing the reference driver uses. Plain scalar — the authored
+      // seconds never cross. (Inertia is command-layer-only and carries no authored delay, so its
+      // arm omits this — the same totality law as `repeat`.)
+      readonly delayMs: number
+    }
+  | {
+      readonly kind: 'tween'
+      readonly config: TimingConfig
+      readonly keyframes: KeyframesConfig
+      readonly explicitSpring: false
+      readonly repeat: RepeatFoldOptions | null
+      readonly delayMs: number
+    }
+  | {
+      // U7a + transition-default-selection F5: the instant lane (the pin's makeAnimationInstant,
+      // motion-dom@12.42.2 motion-value.ts:89-98,122-136) — the guard is type-independent:
+      // `type: false` (U7a) OR `duration === 0 && !repeatDelay` (F5). NO trajectory generator —
+      // the final keyframe commits on the driver's next update tick (never synchronously at
+      // command time), and the authored delay is honored through the shared rebase (only the
+      // pin's GLOBAL instant flag zeroes delay — 7b's window, not this lane). The start/retarget
+      // seams never fold it, so it carries no repeat/keyframes fields.
+      readonly kind: 'instant'
+      readonly delayMs: number
+    }
+  | {
+      // R16 (REQ-GESTURE-023): the gesture free-drag release's two-phase inertia descriptor.
+      // Command-layer only (never authored); plain scalar data so the marshal rides verbatim.
+      readonly kind: 'inertia'
+      readonly config: PlainInertiaConfig
+      readonly explicitSpring: false
+    }
+
+// The inertia descriptor as plain worklet-marshalable data. The bounds ride verbatim from the
+// prepared descriptor: `undefined` for an absent bound (no constraints on the release, or the
+// side omitted) — an undefined-valued optional DOES cross the marshal, benign since the UI side
+// treats it as an absent bound; the ±Infinity sentinel for the open side of a resolved
+// constraint set (the drag-constraints law); or a finite number.
+type PlainInertiaConfig = {
+  readonly power: number
+  readonly timeConstant: number
+  readonly bounceStiffness: number
+  readonly bounceDamping: number
+  readonly restDelta: number
+  readonly restSpeed: number
+  readonly min: number | undefined
+  readonly max: number | undefined
+}
+
+type PlainCommand =
+  | {
+      readonly kind: 'start'
+      // `velocity` rides the marshal verbatim (plain data): the REQ-DRIVER-023 generator seed. `to` is a
+      // scalar destination OR a keyframe array the value interpolates THROUGH (REQ-API-033, R8). The
+      // prepared per-prop `transition` is marshaled to PlainTransition JS-side (REQ-DRIVER-030).
+      readonly targets: Readonly<Record<string, PlainStartTarget>>
+      // The gesture RELEASE edge (review r8 major 24): true ⇒ this start ends the hold on its targets;
+      // false ⇒ a declarative start that CONTENDS on a gesture-held prop (drifts the live value
+      // without clearing the hold, REQ-DRIVER-026). Plain boolean, marshaled.
+      readonly releasesGesture: boolean
+      readonly path?: {
+        readonly fromX: number
+        readonly fromY: number
+        readonly toX: number
+        readonly toY: number
+        readonly peak: number
+        readonly signedStrength: number
+        readonly rotationScale: number
+        readonly transition: PlainTransition
+      }
+    }
+  | {
+      readonly kind: 'retarget'
+      readonly targets: Readonly<Record<string, number>>
+      readonly transition: PlainTransition
+      readonly targetTransitions?: Readonly<Record<string, PlainTransition>>
+    }
+  | { readonly kind: 'stop' }
+
+// The per-target payload crossing to the UI runtime: `to`/`from`/`velocity` plain data, plus the
+// OPTIONAL per-prop transition ALREADY marshaled to PlainTransition JS-side (R8 M2 per-prop defaults).
+type PlainStartTarget = {
+  readonly to: PropTargetTo
+  readonly from: number
+  readonly velocity: number
+  readonly transition: PlainTransition
+}
+
+// Marshal an already-complete REQ-DRIVER-030 target snapshot to UI-runtime data. Caller accessors,
+// mutation detachment, velocity defaulting, and transition fallback were all handled once by core's
+// adapter; this backend performs only the host-specific config conversion.
+function marshalStartTargets(
+  targets: Readonly<Record<string, PreparedPropTarget>>,
+  marshalTransition: (transition: PropTransition) => PlainTransition,
+): Readonly<Record<string, PlainStartTarget>> {
+  const out: Record<string, PlainStartTarget> = {}
+  for (const key of Object.keys(targets)) {
+    const t = targets[key]!
+    // defineProperty preserves an own `__proto__` key without changing this plain object's prototype;
+    // the worklets serializer receives the same ordinary-object shape as before REQ-DRIVER-030.
+    Object.defineProperty(out, key, {
+      enumerable: true,
+      value: Object.freeze({
+        to: t.to,
+        from: t.from,
+        velocity: t.velocity,
+        transition: marshalTransition(t.transition),
+      }),
+    })
+  }
+  return Object.freeze(out)
+}
+
+// Core deliberately prepares target maps with a null prototype so an own `__proto__` key remains data.
+// Worklets 0.10.2 serializes an ordinary record only when its prototype is Object.prototype, so rebuild
+// that map at the host crossing without using assignment (which would invoke the legacy __proto__ setter).
+export function marshalRetargetTargets(
+  targets: Readonly<Record<string, number>>,
+): Readonly<Record<string, number>> {
+  const out: Record<string, number> = {}
+  for (const key of Object.keys(targets)) {
+    Object.defineProperty(out, key, { enumerable: true, value: targets[key]! })
+  }
+  return Object.freeze(out)
+}
+
+export function marshalRetargetTransitions(
+  transitions: Readonly<Record<string, PropTransition>> | undefined,
+  marshalTransition: (transition: PropTransition) => PlainTransition,
+): Readonly<Record<string, PlainTransition>> | undefined {
+  if (transitions === undefined) return undefined
+  const out: Record<string, PlainTransition> = {}
+  for (const key of Object.keys(transitions)) {
+    Object.defineProperty(out, key, {
+      enumerable: true,
+      value: marshalTransition(transitions[key]!),
+    })
+  }
+  return Object.freeze(out)
+}
+
+// One element's live UI-side state. Plain records (not Map) — everything here is created and mutated on
+// the UI runtime only; `shared` are the Reanimated shared values animated styles bind to.
+interface UiElementState {
+  active: boolean
+  // Per-prop gesture hold count (REQ-DRIVER-024, G-INV-7, review r7 major 23): the number of props a
+  // gesture holds. A `write` establishes a hold; only the MATCHING release/stop command clears it —
+  // an unrelated command is a PARTIAL overlay and must not release another prop's hold. While any
+  // prop is held the element is UNSETTLED (a finger is down, REQ-GESTURE-002) — the live analog of
+  // the M1 session's ActivityHandle — so the frame loop emits no spurious settle edge mid-drag. A
+  // count (not a boolean) keeps the @frame-path quiesce check O(1) + allocation-free (REQ-DRIVER-021).
+  heldCount: number
+  readonly committed: Record<string, number>
+  // Gesture-phase live velocity per held prop (REQ-DRIVER-025, G-INV-3, review r4 c14e15): the
+  // platform velocity the most recent `write` carried, mirrored from the reference driver. A prop
+  // WITH an entry here is held; uiLiveFor reports it (no generator ⇒ this is the live velocity) so
+  // the release-edge C1 seam is continuous; cleared per prop by the matching command; a
+  // settled/never-written prop has no entry ⇒ 0.
+  readonly heldVelocity: Record<string, number>
+  // Last recognizer-write version applied per prop. A live `write` is scheduled while `liveFor`
+  // crosses synchronously, so the JS side compares this marker with its queued-write mirror to
+  // provide read-your-writes without replaying or reordering the UI lane (REQ-DRIVER-024/-025).
+  readonly writeVersion: Record<string, number>
+  readonly props: Record<string, PropStep>
+  // A layout host proxy owns a complete transform array while it is in flight. Each property
+  // therefore exposes its live command state so the proxy mirror follows the ACTUAL gesture,
+  // keyframe, exit, or bound-value authority instead of a render-time animate snapshot.
+  readonly layoutMirror: Record<string, WorkletDriverPropertyState>
+  // Contention target per gesture-held prop (REQ-DRIVER-026), mirrored from the reference driver: the
+  // declarative `to` + transition a held prop animates toward while the finger owns it. A finger write
+  // RE-ANCHORS the contending generator to the freshly-committed finger value so the drift continues
+  // FROM the finger's position, never jumping back to the generator's stale trajectory (review r10
+  // major 29, G-INV-2). Cleared at release/stop and when the finger takes over a settled contention.
+  readonly contending: Record<string, { to: PropTargetTo; transition: PlainTransition }>
+  // The frame loop's iteration list for `props`, rebuilt at command edges (uiApplyCommand) —
+  // Object.keys per element per vsync is frame-executed garbage (REQ-DRIVER-021).
+  propKeys: string[]
+  readonly shared: Record<string, SharedValue<number>>
+  // T23 C: the onUpdate marshal arm. When armed, the frame step emits ONE primitive payload
+  // per frame to JS while any committed value changed since the last emission (the pin's
+  // value-change cadence, VisualElement.ts:574-586). lastNotified is the change discriminator.
+  onUpdateArmed: boolean
+  readonly lastNotified: Record<string, number>
+  // The live onUpdate callback's registration generation, mirrored from the JS arm/disarm edge.
+  // A staged frame entry carries it so the JS envelope drain drops an entry whose listener
+  // registration changed between commit and drain (packet §2a live-generation lookup).
+  registrationGeneration: number
+  // Off-frame-prefilled member slots for the sealed frame envelope (REQ-DRIVER-021): capacity
+  // grows only where propKeys is rebuilt (command/registration edge); uiEmitFrameValues fills
+  // keys/values by index and never constructs a Record or grows these in-frame.
+  readonly frameKeys: string[]
+  readonly frameValues: number[]
+  path: {
+    progress: PropStep
+    geometry: PathChannelGeometry
+    // Caller-owned command-edge scratch for the allocation-free arc samplers (REQ-DRIVER-021,
+    // packet §6 arc-return-records repair): uiStepAll writes these slots every frame.
+    sample: PathProgressSample
+    scratch: ArcScratch
+  } | null
+}
+
+// `Driver.write` is the sole production event-write seam (REQ-DRIVER-029). Gesture writes hold
+// until their release command; bound MotionValues are instantaneous retargets with no release.
+// The shape travels with that one write call so the UI owner can preserve both laws without a
+// binding-only side channel.
+export type WorkletDriverWriteShape = 'gesture-hold' | 'bound-value-retarget'
+
+export type WorkletDriver = Omit<Driver, 'write'> & {
+  write(
+    handle: ElementHandle,
+    values: Readonly<Record<string, number>>,
+    velocities?: Readonly<Record<string, number>>,
+    eventShape?: WorkletDriverWriteShape,
+  ): void
+}
+
+/**
+ * Give the fold's refusal the SAME identity the reference backend gives it (fix-up review MAJOR).
+ *
+ * `buildRepeatedGenerator` returns a bare `Error` — it is shared with the UI runtime, where a throw
+ * is a `std::terminate`, so it never constructs a severity. The reference backend re-wraps that into
+ * an `InvalidTransitionError` naming `repeat`; this backend cannot construct that class here (a core
+ * class inside a worklet), and would gain nothing if it could, because `uiGuardLane` marshals only
+ * `{name, message}` to RN. So it reproduces the two fields the crossing actually carries, from the
+ * shared builder, and `driverParity.differential.test.ts` compares the two backends' refusals
+ * directly — the trajectory differential is blind to a fold that BOTH backends refuse, which is how
+ * this one survived a round.
+ */
+// alloc-ok: lifecycle-edge — built only on the refusal path, once per rejected animate command.
+function uiRepeatRefusal(repeat: number, refusal: Error): Error {
+  'worklet'
+  const named = new Error(repeatRefusalMessage(repeat, refusal.message)) as Error & { key: string }
+  named.name = REPEAT_REFUSAL_NAME
+  // The offending property. `uiGuard` marshals it beside the name, so the severity router
+  // recognizes this refusal after the crossing exactly as it recognizes the reference backend's.
+  named.key = REPEAT_REFUSAL_KEY
+  return named
+}
+
+/**
+ * The dual-authority bound-value refusal's marshalled identity (REQ-DRIVER-034). The message is
+ * byte-identical to what the synchronous lane throws — the adapter's catch matches its prefix —
+ * but a name is what survives the scheduled lane's `{name, message, key}` marshal, where an
+ * `instanceof` cannot. Thrown ONLY from `uiApplyWrite`'s validate-all-keys phase (before ANY
+ * mutation), so a live-lane guard that recognizes it knows the element is exactly as the refused
+ * write found it.
+ */
+const BOUND_VALUE_WRITE_REFUSAL_NAME = 'BoundValueWriteRefusal'
+
+// alloc-ok: lifecycle-edge — built only on the refusal path, once per refused retarget write.
+function uiBoundValueWriteRefusal(key: string): Error {
+  'worklet'
+  const named = new Error(
+    `cannot write bound value '${key}': it is owned by a gesture or declarative command.`,
+  ) as Error & { key: string }
+  named.name = BOUND_VALUE_WRITE_REFUSAL_NAME
+  // The offending property. `uiGuard` marshals it beside the name, so the JS-side delivery names
+  // the same key the synchronous rethrow carries.
+  named.key = key
+  return named
+}
+
+/** The scheduled lane's recognition half, decided on the marshalled record (structural, like the fold refusal's). */
+function isBoundValueWriteRefusalIdentity(name: unknown): boolean {
+  'worklet'
+  return name === BOUND_VALUE_WRITE_REFUSAL_NAME
+}
+
+/** UI-runtime state a layout-transform mirror reads without crossing back to JS. */
+export interface WorkletDriverPropertyState {
+  readonly active: SharedValue<boolean>
+  readonly target: SharedValue<number>
+}
+
+interface UiDriverState {
+  readonly driverId: number
+  readonly elements: UiElementState[]
+  // One settle notification per in-flight→idle edge (REQ-DRIVER-020). Starts true (nothing in
+  // flight); any start/retarget command re-arms it.
+  settleNotified: boolean
+  // The JS-owned command/lifecycle epoch that opened the current live run. Carrying this plain
+  // number back with the UI settle edge lets JS reject a stale edge without reading a SharedValue
+  // (which itself can synchronously cross back into the UI runtime).
+  loopEpoch: number
+  // The layout-identity engine (specs/LAYOUT-UITHREAD-PORT-BUILD-PACKET.md), created lazily at the
+  // first layout attach so element-only drivers pay nothing for it.
+  layout: UiLayoutState | null
+  // Per-identity settle watchers. These are intentionally separate from the driver's global
+  // quiescence edge: one unrelated property animation or pending identity must not delay a
+  // mounted layoutId completion for an identity that has already reached rest.
+  layoutSettleWatchers: UiLayoutSettleWatcher[]
+  // The reusable sealed-envelope emission transaction (REQ-DRIVER-021) — constructed with the
+  // driver record, prefilled at command/registration edges, sealed at most once per frame.
+  readonly emission: UiFrameEmissionState
+}
+
+interface UiLayoutSettleWatcher {
+  readonly id: string
+  readonly key: number
+}
+
+// --- Sealed frame mailbox envelope (REQ-DRIVER-021, packet §2a closed-envelope law) --------------
+// One UI frame stages every demanded entry into the driver's reusable emission transaction with
+// indexed writes into off-frame-prefilled slots, then the seal edge serializes exactly ONE closed
+// envelope across one scheduleOnRN(dispatchChannelMailboxTurnEnvelope, envelope) crossing. The
+// entry shapes structurally mirror the motion layer's ChannelMailboxEntry vocabulary (the driver
+// layer stays motion-import-free); values here are numbers only, so the element member sequence
+// carries number tags alone.
+
+interface UiFrameMailboxElementMember {
+  readonly key: string
+  readonly kind: 'number'
+  readonly value: number
+}
+
+type UiFrameMailboxEntry =
+  | {
+      readonly kind: 'ELEMENT_HOST_COMMIT'
+      readonly index: number
+      readonly driverId: number
+      readonly handleId: number
+      readonly registrationGeneration: number
+      readonly commitSequence: number
+      readonly values: readonly UiFrameMailboxElementMember[]
+    }
+  | {
+      readonly kind: 'LAYOUT_RELEASE'
+      readonly index: number
+      readonly layoutRegistrationId: number
+    }
+  | {
+      readonly kind: 'PROJECTION_STALE'
+      readonly index: number
+      readonly report: { readonly source: string; readonly code: string; readonly detail: string }
+    }
+  | { readonly kind: 'LAYOUT_SETTLE'; readonly index: number; readonly layoutAnimationId: number }
+  | {
+      readonly kind: 'DRIVER_SETTLE'
+      readonly index: number
+      readonly driverId: number
+      readonly schedulerEpoch: number
+    }
+  // The driver's last envelope: the UI record is deleted right after this seals, so nothing more
+  // can be sealed for the driver and JS may forget its mailbox on receipt — in order, behind every
+  // envelope sealed before the dispose crossing landed.
+  | { readonly kind: 'DRIVER_DISPOSED'; readonly index: number; readonly driverId: number }
+
+interface UiFrameMailboxEnvelope {
+  readonly kind: 'CHANNEL_MAILBOX_TURN_ENVELOPE'
+  readonly mailboxOrigin: 'UI'
+  readonly mailboxDrainId: number
+  readonly driverId: number
+  readonly eventCount: number
+  readonly endIndex: number
+  readonly entries: readonly UiFrameMailboxEntry[]
+  readonly closingMarker: { readonly kind: 'CHANNEL_MAILBOX_END'; readonly index: number }
+}
+
+// The reusable per-driver emission transaction: every slot array is prefilled at a command or
+// registration edge; a frame only fills by index and bumps counts. The sole allocation is the
+// closed-envelope serialization at the seal edge (alloc-ok:mailbox-envelope-emission).
+interface UiFrameEmissionState {
+  // Changed-element entry slots (capacity = elements.length, grown at the register edge).
+  readonly elementHandles: number[]
+  readonly elementGenerations: number[]
+  readonly elementCommitSequences: number[]
+  readonly elementMemberCounts: number[]
+  elementEntryCount: number
+  // Layout-settle staging (capacity = layoutSettleWatchers.length, grown at subscription).
+  readonly layoutSettledKeys: number[]
+  layoutSettledCount: number
+  // The driver settle edge: -1 when no settle is staged this frame.
+  driverSettleEpoch: number
+  // Set by the dispose crossing for the driver's final envelope.
+  disposeStaged: boolean
+  // Monotonic per-driver envelope id (doubles as the origin-scoped mailbox drain id).
+  commitSequence: number
+}
+
+// The JS callback registry deliberately lives outside each worklet closure. A per-identity
+// listener can close over the MotionView lifecycle, whose unsubscribe path points back to this
+// registry. Capturing that Map from the UI-frame worklet turns the listener graph cyclic while
+// iOS serializes it. UI worklets carry only the driver/key pair; these JS dispatchers recover the
+// live callback after the RN crossing.
+interface LayoutCallbackRegistry {
+  readonly release: Map<number, () => void>
+  readonly settled: Map<number, () => void>
+}
+
+const layoutCallbacksByDriver = new Map<number, LayoutCallbackRegistry>()
+
+// The global driver settle edge shares the layout emitter's ownership rule: a UI worklet carries
+// only a driver id and a primitive epoch. Keeping the hook-local callback on JS avoids serializing
+// React state, the frame callback, or a callback registry back into the UI frame closure.
+const driverSettleCallbacks = new Map<number, (epoch: number) => void>()
+
+// `scheduleOnRN` callbacks originate from UI worklets. Worklets can invoke the JS target before the
+// UI dispatcher has unwound, so application callbacks must never run in that native callback extent:
+// a synchronous read (`committed`, `liveFor`, or a layout query) would re-enter `runSyncSerialized`
+// and recreate the iOS AB-BA lock inversion. Every driver-owned UI→JS dispatcher therefore first
+// moves delivery onto the next JS task. A promise microtask is insufficient: Hermes can drain it
+// while the synchronous JSI dispatchEventToJS invocation is still unwinding. Keep this
+// JS-thread-local depth around the deferred
+// delivery too: commands preserve the existing queued re-entry law, and the depth remains correct
+// if a consumer synchronously induces a second driver callback.
+let uiOriginatedCallbackDepth = 0
+
+// React Native's event emitter and the worklet frame dispatcher both enter JavaScript while the
+// UI runtime still owns the inbound call. Keep one marker for both origins: every mutating driver
+// crossing consults it before selecting its synchronous verification lane.
+export function runNativeEventCallback<T>(callback: () => T): T {
+  uiOriginatedCallbackDepth += 1
+  try {
+    return callback()
+  } finally {
+    uiOriginatedCallbackDepth -= 1
+  }
+}
+
+function deliverUiOriginatedCallback(callback: () => void): void {
+  runNativeEventCallback(callback)
+}
+
+function deferUiOriginatedCallback(callback: () => void): void {
+  // A zero-delay task is a scheduling boundary, not a retry: it preserves FIFO delivery among
+  // one frame's notifications while guaranteeing the native UI→JS dispatcher has returned.
+  setTimeout(() => deliverUiOriginatedCallback(callback), 0)
+}
+
+// The deferral seam is exported for the motion layer's scheduleOnRN severity reporters (seal
+// r3, F1): a JS throw or report delivered inside the native UI→JS dispatch extent is the AB-BA
+// class — every severity delivery lands one JS task later, exactly like the settle dispatches.
+export { deferUiOriginatedCallback }
+
+// An RN host event's layoutId measure/commit path needs a stronger boundary than the user
+// callback marker above: the lifecycle currently returns synchronous role/flight results, so it
+// runs in the next FIFO task after `dispatchEventToJS` has unwound rather than attempting a
+// partial asynchronous layout API with fabricated return values.
+export function deferNativeEventWork(callback: () => void): void {
+  setTimeout(callback, 0)
+}
+
+function deliverDriverSettled(driverId: number, epoch: number): void {
+  const callback = driverSettleCallbacks.get(driverId)
+  callback?.(epoch)
+}
+
+function deliverLayoutRelease(driverId: number, key: number): void {
+  const registry = layoutCallbacksByDriver.get(driverId)
+  const callback = registry?.release.get(key)
+  if (callback === undefined) return
+  registry!.release.delete(key)
+  callback()
+}
+
+function deliverLayoutSettled(driverId: number, key: number): void {
+  const registry = layoutCallbacksByDriver.get(driverId)
+  const callback = registry?.settled.get(key)
+  if (callback === undefined) return
+  registry!.settled.delete(key)
+  callback()
+}
+
+interface ElementFrameValueCallbackRegistration {
+  readonly generation: number
+  readonly callback: (values: Readonly<Record<string, number>>) => void
+}
+
+const elementFrameValueCallbacks = new Map<
+  number,
+  Map<number, ElementFrameValueCallbackRegistration>
+>()
+let elementFrameValueRegistrationGeneration = 0
+const acceptedFrameMailboxDrainIdByDriver = new Map<number, number>()
+
+function nextElementFrameValueRegistrationGeneration(): number {
+  if (elementFrameValueRegistrationGeneration >= Number.MAX_SAFE_INTEGER) {
+    throw new Error('frame-value listener registration generation exhausted.')
+  }
+  elementFrameValueRegistrationGeneration += 1
+  return elementFrameValueRegistrationGeneration
+}
+
+function validateFrameMailboxEnvelope(envelope: UiFrameMailboxEnvelope): void {
+  if (
+    envelope.kind !== 'CHANNEL_MAILBOX_TURN_ENVELOPE' ||
+    envelope.mailboxOrigin !== 'UI' ||
+    envelope.eventCount <= 0 ||
+    envelope.eventCount !== envelope.entries.length ||
+    envelope.endIndex !== envelope.eventCount - 1 ||
+    envelope.closingMarker.kind !== 'CHANNEL_MAILBOX_END' ||
+    envelope.closingMarker.index !== envelope.endIndex
+  ) {
+    throw new Error('invalid closed driver-frame mailbox envelope.')
+  }
+  for (let index = 0; index < envelope.entries.length; index += 1) {
+    const entry = envelope.entries[index]!
+    if (entry.index !== index) throw new Error('non-contiguous driver-frame mailbox envelope.')
+    if (
+      (entry.kind === 'ELEMENT_HOST_COMMIT' ||
+        entry.kind === 'DRIVER_SETTLE' ||
+        entry.kind === 'DRIVER_DISPOSED') &&
+      entry.driverId !== envelope.driverId
+    ) {
+      throw new Error('cross-driver entry in driver-frame mailbox envelope.')
+    }
+  }
+  const accepted = acceptedFrameMailboxDrainIdByDriver.get(envelope.driverId) ?? 0
+  if (envelope.mailboxDrainId !== accepted + 1) {
+    throw new Error('duplicate or out-of-order driver-frame mailbox envelope.')
+  }
+}
+
+function drainFrameMailboxEnvelope(envelope: UiFrameMailboxEnvelope): void {
+  validateFrameMailboxEnvelope(envelope)
+  acceptedFrameMailboxDrainIdByDriver.set(envelope.driverId, envelope.mailboxDrainId)
+  for (const entry of envelope.entries) {
+    switch (entry.kind) {
+      case 'ELEMENT_HOST_COMMIT': {
+        // The live-generation lookup precedes public record materialization: a listener replaced
+        // after UI commit cannot receive its predecessor registration's queued frame.
+        const registration = elementFrameValueCallbacks.get(entry.driverId)?.get(entry.handleId)
+        if (
+          registration === undefined ||
+          registration.generation !== entry.registrationGeneration
+        ) {
+          break
+        }
+        const values: Record<string, number> = {}
+        for (const member of entry.values) {
+          Object.defineProperty(values, member.key, {
+            enumerable: true,
+            value: member.value,
+          })
+        }
+        registration.callback(values)
+        break
+      }
+      case 'LAYOUT_RELEASE':
+        deliverLayoutRelease(envelope.driverId, entry.layoutRegistrationId)
+        break
+      case 'PROJECTION_STALE':
+        deliverProjectionStaleReport(entry.report)
+        break
+      case 'LAYOUT_SETTLE':
+        deliverLayoutSettled(envelope.driverId, entry.layoutAnimationId)
+        break
+      case 'DRIVER_SETTLE': {
+        // Proof seam witness (no-op when the hook is unset): receipt and the UI emission count
+        // are observed only after the envelope receipt has crossed the AB-BA task boundary.
+        const marker = (globalThis as ProofMarkerJsGlobal).__nativeMotionProofMarker
+        if (marker !== undefined) {
+          mirrorProofSettleEmissionToJs(uiProofSettleEmissionCount())
+          marker(`settle-dispatch driver=${entry.driverId} epoch=${entry.schedulerEpoch}`)
+        }
+        deliverDriverSettled(entry.driverId, entry.schedulerEpoch)
+        break
+      }
+      case 'DRIVER_DISPOSED':
+        // The UI record is gone and this envelope validated in order behind everything sealed
+        // before it, so the accepted drain id has nothing left to guard. Forgetting it at
+        // dispose() instead reset the counter under an envelope still in flight, which validated
+        // as "duplicate or out-of-order" and killed the app on the presence card (Android bug
+        // bash 2026-09-05).
+        acceptedFrameMailboxDrainIdByDriver.delete(entry.driverId)
+        break
+      default: {
+        const exhaustive: never = entry
+        throw new Error(`unrecognized driver-frame mailbox entry: ${String(exhaustive)}`)
+      }
+    }
+  }
+}
+
+// The arrival-ordered drain queue. Receipts keep the one AB-BA deferral (the flush runs one JS
+// task after the native dispatch extent, entry handlers in envelope order, no second scheduling
+// boundary), but the DRAIN ORDER is this queue's — never the host timer's. Every receipt used to
+// defer its drain behind its OWN setTimeout(0); RN's JavaTimerManager holds timers in a
+// PriorityQueue ordered by targetTime alone (JavaTimerManager.kt, no timer-id tie-break), so two
+// receipts registering in the same catch-up millisecond under host contention could fire
+// inverted — the later envelope then validates one ahead of the accepted counter, the counter
+// never passes the gap, and every later envelope of the driver fails "duplicate or out-of-order"
+// (bugbash 2026-09-08, three AUTO-walk deaths around cards 96/97 with 459 ms stretched frames).
+const pendingFrameMailboxEnvelopes: UiFrameMailboxEnvelope[] = []
+let frameMailboxFlushScheduled = false
+
+function flushFrameMailboxEnvelopes(): void {
+  frameMailboxFlushScheduled = false
+  while (pendingFrameMailboxEnvelopes.length > 0) {
+    drainFrameMailboxEnvelope(pendingFrameMailboxEnvelopes.shift()!)
+  }
+}
+
+function dispatchChannelMailboxTurnEnvelope(envelope: UiFrameMailboxEnvelope): void {
+  pendingFrameMailboxEnvelopes.push(envelope)
+  if (frameMailboxFlushScheduled) return
+  frameMailboxFlushScheduled = true
+  deferUiOriginatedCallback(flushFrameMailboxEnvelopes)
+}
+
+interface PendingGestureWrite extends LivePropState {
+  readonly version: number
+}
+
+// Per-driver UI-runtime registry, namespaced on the worklet global by a JS-side id so two drivers never
+// share state. Lazily created UI-side; never serialized back. dispose() deletes the record —
+// component unmount must not strand holder outputs and graph state in the worklet global
+// (review round 4 major 5).
+interface UiManualGroupSlot {
+  lastCommittedTimestampMs: number
+  pendingAbsoluteTimestampMs: number
+  attendeeCount: number
+  attendees: number[]
+}
+
+interface UiGlobal {
+  __nativeMotionDrivers?: Record<number, UiDriverState>
+  // Host layout channels keep only primitive current-frame records here. It shares the driver's
+  // lifetime: disposal removes the record so a remounted gallery never inherits stale geometry.
+  __nativeMotionProjectionHostFrames?: Record<number, unknown>
+  // Command-edge-prefilled manual group slots. Frame lookup is peek-only.
+  __nativeMotionManualGroups?: Record<number, UiManualGroupSlot>
+}
+
+function uiDriverState(driverId: number): UiDriverState {
+  'worklet'
+  const g = globalThis as UiGlobal
+  if (g.__nativeMotionDrivers === undefined) g.__nativeMotionDrivers = {}
+  let state = g.__nativeMotionDrivers[driverId]
+  if (state === undefined) {
+    state = {
+      driverId,
+      elements: [],
+      settleNotified: true,
+      loopEpoch: 0,
+      layout: null,
+      layoutSettleWatchers: [],
+      emission: {
+        elementHandles: [],
+        elementGenerations: [],
+        elementCommitSequences: [],
+        elementMemberCounts: [],
+        elementEntryCount: 0,
+        layoutSettledKeys: [],
+        layoutSettledCount: 0,
+        driverSettleEpoch: -1,
+        disposeStaged: false,
+        commitSequence: 0,
+      },
+    }
+    g.__nativeMotionDrivers[driverId] = state
+  }
+  return state
+}
+
+// @frame-path — non-creating read for the per-frame paths: after dispose() a late vsync or
+// settle-edge re-check must observe "gone" — the get-or-create above would silently resurrect an
+// empty record and re-leak it.
+function uiDriverStatePeek(driverId: number): UiDriverState | null {
+  'worklet'
+  const g = globalThis as UiGlobal
+  if (g.__nativeMotionDrivers === undefined) return null
+  return g.__nativeMotionDrivers[driverId] ?? null
+}
+
+// A JS error thrown across `executeOnUIRuntimeSync` is FATAL on react-native-worklets 0.5.1
+// Release builds: the sync return path dereferences state the pending Hermes exception left
+// behind and the process dies with SIGSEGV (fault addr 0x28, mqt_v_js) instead of rethrowing —
+// no red screen, no log line (packet finding 2026-07-10: bisected to the layout-screens rewire
+// 3494387, the first tree whose registry fail-loud throws crossed inside a sync worklet;
+// reproduced on both platforms; the un-workletized-crossing SIGSEGV draft gains a sibling).
+// Engine ops therefore NEVER throw across the boundary: the crossing worklet catches via
+// `uiGuard`, marshals `{name, message}` back as plain data, and the JS side rethrows the same
+// typed error through `unwrapUiOutcome`. Every caller keeps the exact fail-loud contract
+// (name + message verbatim); only the transport is defensive.
+//
+// Shape: the crossing worklet is passed DIRECTLY to `executeOnUIRuntimeSync` (the pattern this
+// file relies on everywhere), the module-scope worklet `uiGuard` (same capture class as
+// uiDriverState) does the catching, and the fallible body is a UI-BORN closure created inside
+// the crossing worklet — no generic `wrap(fn)` helper, so no worklet-in-closure serialization
+// is ever required. The scheduled lane (`scheduleOnUI`) cannot rethrow synchronously and keeps
+// its pre-existing loud UI-runtime failure via uiGuardLane — a recorded follow-up (packet).
+// `key` completes the refusal's IDENTITY across the crossing. Class identity cannot be marshalled,
+// so a consumer recognizes a typed refusal structurally (`isRepeatFoldRefusal`) — and it reads
+// `name` AND `key`. Carrying only `name` and `message` left the shipping backend's refusal
+// unrecognizable to the severity router, which then rethrew it uncaught out of a React lifecycle:
+// the exact defect the router was added to prevent (T18-a round-9 review BLOCKING 1). A plain
+// string rides the marshal; `undefined` means the failure named no property.
+type UiOutcome<T> =
+  | { readonly ok: true; readonly value: T }
+  | {
+      readonly ok: false
+      readonly name: string
+      readonly message: string
+      readonly key: string | undefined
+    }
+
+// alloc-ok: construction — reusable UI outcome slots filled in place on every crossing; the
+// frame path never mints a fresh {ok,value} / {ok,name,message,key} record.
+const uiGuardSuccessSlot: { ok: true; value: unknown } = { ok: true, value: undefined }
+const uiGuardFailureSlot: {
+  ok: false
+  name: string
+  message: string
+  key: string | undefined
+} = { ok: false, name: 'Error', message: '', key: undefined }
+
+function uiGuard<T>(run: () => T): UiOutcome<T> {
+  'worklet'
+  try {
+    uiGuardSuccessSlot.value = run()
+    return uiGuardSuccessSlot as UiOutcome<T>
+  } catch (e) {
+    if (!(e instanceof Error)) {
+      uiGuardFailureSlot.name = 'Error'
+      uiGuardFailureSlot.message = String(e)
+      uiGuardFailureSlot.key = undefined
+      return uiGuardFailureSlot
+    }
+    const key = (e as Error & { key?: unknown }).key
+    uiGuardFailureSlot.name = e.name
+    uiGuardFailureSlot.message = e.message
+    uiGuardFailureSlot.key = typeof key === 'string' ? key : undefined
+    return uiGuardFailureSlot
+  }
+}
+
+// DECLARATION ORDER IS LOAD-BEARING for every worklet below: the workletizer emits each one as
+// a non-hoisted const, so a worklet may only reference worklets declared ABOVE it — a forward
+// capture is `undefined` at module load under Hermes and dies as "undefined is not a function"
+// on the UI runtime, with no JS stack. Pinned by check-worklet-forward-refs.test.ts.
+
+function uiSetMirrorActive(element: UiElementState, key: string, active: boolean): void {
+  'worklet'
+  const mirror = element.layoutMirror[key]
+  if (mirror !== undefined) mirror.active.value = active
+}
+
+function uiSetMirrorTarget(element: UiElementState, key: string, target: number): void {
+  'worklet'
+  const mirror = element.layoutMirror[key]
+  if (mirror !== undefined) mirror.target.value = target
+}
+
+// Two-lane guard for crossings that ride `cross()`: the manual (sync) lane marshals the outcome
+// back for a JS-side rethrow; the live (scheduled) lane cannot marshal synchronously — and must
+// NEVER rethrow on the UI runtime (a bare std::terminate on iOS — the AUTO SIGABRT class, payload
+// agent-2026-07-29-967871). A live-lane failure marshals {name, message, code} to RN through the
+// same scheduleOnRN severity channel the settle dispatches ride (loud there — development throws
+// on the RN side after unwind, production reports) and retires the affected element's flight:
+// its props/holds clear so it settles at its committed values — the last valid visual state,
+// never a half-applied frame continuing silently.
+function uiGuardLane(
+  manual: boolean,
+  run: () => void,
+  driverId: number,
+  affectedHandle: number | undefined,
+  // Whether `run` commits ATOMICALLY — builds everything before mutating anything, so a refusal
+  // leaves the element exactly as it found it. Only the command lane does; `uiApplyWrite`
+  // re-anchors a contending generator inside its per-key mutation loop, so a refusal there is
+  // half-applied and MUST still retire. Passed explicitly at every site (never defaulted) so a new
+  // lane has to state its own answer rather than inherit a wrong one (round-10 BLOCKING 2).
+  commitsAtomically: boolean,
+): UiOutcome<void> {
+  'worklet'
+  const outcome = uiGuard(run)
+  if (!manual && !outcome.ok) {
+    // REQ-DRIVER-034: a dual-authority refusal of a bound-value retarget is a designed operating
+    // condition of the ADMITTED pin pattern (a bound MotionValue animated on the same key), not a
+    // lane fault. The synchronous lane hands it to the adapter's catch-and-latch; the scheduled
+    // lane cannot marshal a throw back, so it delivers the refusal to the driver's JS subscribers
+    // (the adapter's latch) instead. The refusal throws from the write's validate-BEFORE-mutate
+    // phase, so the element is exactly as the refused write found it — no retire, no severity
+    // report while a subscriber exists, and the admitted flight runs on. The crossing stays
+    // fire-and-forget O(1) (REQ-DRIVER-013): one extra scheduleOnRN on the refusal path only.
+    if (isBoundValueWriteRefusalIdentity(outcome.name)) {
+      scheduleOnRN(
+        notifyBoundValueWriteRefusal,
+        driverId,
+        affectedHandle ?? -1,
+        outcome.key ?? '',
+        outcome.message,
+      )
+      return outcome
+    }
+    scheduleOnRN(
+      dispatchDriverLaneFailure,
+      driverId,
+      outcome.name,
+      outcome.message,
+      'driver-lane-failure',
+      // Definite string across the marshal — `undefined` is not a value this crossing carries
+      // (the `releasesGesture` precedent, r8 major 24). Empty means the failure named no property.
+      outcome.key ?? '',
+    )
+    // A FOLD refusal from an ATOMIC lane is not a lane fault. It is a typed, per-property refusal
+    // raised in the build phase, so the element is exactly as the refused command found it and
+    // every other prop is healthy. Retiring destroyed all of them — the direct negation of the
+    // ratified severity law's "remaining keys proceed" (round-9 BLOCKING 2). Every other failure,
+    // and every failure from a lane that mutates as it goes, leaves UI state of unknown validity
+    // and still retires.
+    const perPropertyRefusal =
+      commitsAtomically && isRepeatFoldRefusalIdentity(outcome.name, outcome.key)
+    if (perPropertyRefusal) {
+      // Nothing to retire — but the refused command still consumed a loop epoch, and the JS side
+      // already re-armed the vsync callback for it. The retire used to re-arm the settle edge as a
+      // side effect; without it a refusal on an ALREADY-SETTLED element leaves `settleNotified`
+      // latched true from the previous settle, so `frameStep` never reaches its quiescent branch:
+      // the loop runs forever and the settle dispatch never fires (round-10 BLOCKING 1).
+      // PEEK, never get-or-create: a refusal must not mint a record for a driver that has been
+      // disposed. The retire arm is reached only with a live handle, so it cannot; this arm has no
+      // such guarantee once a future lane passes `commitsAtomically` (round-10 review observation).
+      const state = uiDriverStatePeek(driverId)
+      if (state !== null) state.settleNotified = false
+    } else if (affectedHandle !== undefined) {
+      const state = uiDriverState(driverId)
+      const element = state.elements[affectedHandle]
+      if (element !== undefined) {
+        // The retire mirrors the stop command's COMPLETE semantics (review 0f37d35ab9cd): the
+        // collections are readonly properties, so keys are deleted rather than the cells
+        // reassigned; propKeys is emptied (propKeys mirrors props at every mutation edge — a
+        // stale entry breaks uiStepAll's invariant); and every mirror active flag clears with
+        // its target reset to committed, so the layout mirror lane can END — a latched
+        // active=true would withhold a concurrent layout flight indefinitely. Committed values
+        // stay — the last valid visual state.
+        for (const key of Object.keys(element.props)) delete element.props[key]
+        for (const key of Object.keys(element.contending)) delete element.contending[key]
+        for (const key of Object.keys(element.heldVelocity)) delete element.heldVelocity[key]
+        for (const key of Object.keys(element.layoutMirror)) {
+          uiSetMirrorActive(element, key, false)
+          const committed = element.committed[key]
+          if (committed !== undefined) uiSetMirrorTarget(element, key, committed)
+        }
+        element.active = false
+        element.heldCount = 0
+        element.propKeys.length = 0
+        state.settleNotified = false // re-arm the settle edge so the retirement notifies
+      }
+    }
+  }
+  return outcome
+}
+
+// The RN-side severity-law reporter for live driver-lane failures (iOS AUTO SIGABRT Phase 2):
+// scheduled from the UI lane like the settle dispatches. Development throws HERE on the RN side
+// (the standing severity law); production reports through the error channel. Mirrors
+// motion/severity.ts's ambient law — the driver layer stays motion-import-free, and the law is
+// __DEV__-defined so the mirror cannot drift.
+declare const __DEV__: boolean | undefined
+
+function dispatchDriverLaneFailure(
+  driverId: number,
+  name: string,
+  message: string,
+  code: string,
+  // Empty means the failure named no property — `undefined` never crosses this marshal.
+  key: string,
+): void {
+  const error = new Error(
+    `worklet driver ${String(driverId)}: [${code}] ${name}: ${message}`,
+  ) as Error & { name: string; key?: string }
+  // The refusal's identity survives to the RN side too: a consumer's error channel receives the
+  // same `{name, key}` the synchronous lane's rethrow carries, so one predicate recognizes a fold
+  // refusal wherever it arrives from.
+  if (key !== '') {
+    error.name = name
+    error.key = key
+  }
+  // Severity delivery defers one JS task (seal r3, F1): this scheduleOnRN target runs inside
+  // the native UI→JS dispatch extent, and a JS throw crossing that extent is the AB-BA class —
+  // the same deferral seam the settle dispatches ride. Development still throws, production
+  // still reports — one task later, after the dispatcher unwinds.
+  deferUiOriginatedCallback(() => {
+    if (typeof __DEV__ === 'undefined' || __DEV__ !== false) throw error
+    console.error(error)
+  })
+}
+
+// REQ-DRIVER-034: per-driver JS subscribers to the scheduled lane's dual-authority bound-value
+// refusals. Keyed by driverId because the UI→RN marshal carries primitives only; the driver's
+// `onBoundValueWriteRefusal` is the only writer and `dispose()` the only bulk deleter.
+const boundValueWriteRefusalListenersByDriverId = new Map<
+  number,
+  Set<(handle: number, key: string) => void>
+>()
+
+/**
+ * The scheduled lane's dual-authority refusal delivery (REQ-DRIVER-034). The live lane cannot
+ * marshal the refusal back into the adapter's synchronous catch, so it is delivered to the
+ * driver's subscribers — the adapter latches `delegateRefusesOwnedWrites` and owned writes stay
+ * with the flight. A refusal with NO subscriber is a consumer riding the retarget lane without
+ * its designed terminal: it reports through the same severity channel any lane failure takes.
+ * Delivery defers one JS task like every UI-originated dispatch (the seal-r3 AB-BA law).
+ */
+function notifyBoundValueWriteRefusal(
+  driverId: number,
+  handle: number,
+  key: string,
+  message: string,
+): void {
+  const listeners = boundValueWriteRefusalListenersByDriverId.get(driverId)
+  if (listeners === undefined || listeners.size === 0) {
+    dispatchDriverLaneFailure(
+      driverId,
+      BOUND_VALUE_WRITE_REFUSAL_NAME,
+      message,
+      'driver-lane-failure',
+      key,
+    )
+    return
+  }
+  deferUiOriginatedCallback(() => {
+    for (const listener of Array.from(listeners)) listener(handle, key)
+  })
+}
+
+// The RN-side severity-law reporter for drained stale projection-tree reports (iOS AUTO SIGABRT
+// F2): a stale-tree event on a KNOWN-then-torn-down id is a ROUTINE teardown race, not a contract
+// violation — development warns, production reports an Error through the console channel, and
+// neither lane throws (the tree already no-oped the stale update at its last valid visual state).
+// THREE codes escalate (seal r7 F4, seal r8 F2, seal r9 F1) plus the ring's own overflow record
+// (seal r9 F3 — contained reports dropped before delivery): a never-registered id is a
+// wrong-forest/mistyped publish, an invalid-frame-input report is malformed input on a LIVE
+// registered node (stale ids are reported before validation ever runs), and a non-finite-output
+// report is undefined scale geometry on a live node (refused, frozen at the last valid finite
+// state) — fail-loud classes, so development throws, deferred one JS task through the same
+// seal-r3 seam as dispatchDriverLaneFailure, and production reports. The report type is a
+// structural mirror of the core tree's drain record (the worklet-layout barrel keeps the core
+// layout declaration sets pinned), and the law mirrors motion/severity.ts exactly like
+// dispatchDriverLaneFailure — the driver layer stays motion-import-free.
+function deliverProjectionStaleReport(report: {
+  readonly source: string
+  readonly code: string
+  readonly detail: string
+}): void {
+  const message = `[${report.code}] ${report.detail} (projection tree, iOS AUTO SIGABRT campaign)`
+  if (
+    report.code === 'projection-unregistered-node' ||
+    report.code === 'projection-invalid-frame-input' ||
+    report.code === 'projection-non-finite-output' ||
+    report.code === 'projection-report-overflow'
+  ) {
+    const refusal = new Error(message)
+    if (typeof __DEV__ === 'undefined' || __DEV__ !== false) throw refusal
+    console.error(refusal)
+    return
+  }
+  if (typeof __DEV__ === 'undefined' || __DEV__ !== false) {
+    console.warn(message)
+    return
+  }
+  console.error(new Error(message))
+}
+
+function unwrapUiOutcome<T>(outcome: UiOutcome<T>): T {
+  if (outcome.ok) return outcome.value
+  const error = new Error(outcome.message) as Error & { key?: string }
+  error.name = outcome.name
+  // Reattached so the rethrown error carries the same identity the reference backend's typed
+  // refusal does — `{name, key}` is what a consumer branches on (`isRepeatFoldRefusal`).
+  if (outcome.key !== undefined) error.key = outcome.key
+  throw error
+}
+
+// Async half of `cross`: named worklet so scheduleOnUI does not mint an anonymous UI lambda
+// that captures another worklet (diamond-DAG serialization class). `work` is a schedule arg.
+function invokeAsyncCrossWork(work: (synchronous: boolean) => UiOutcome<void>): void {
+  'worklet'
+  work(false)
+}
+
+// Live count of UI-runtime driver records — the disposal path's observable (device proofs assert
+// it stays bounded across remounts; a leak here grows monotonically, review round 4 major 5).
+export function uiDriverStateCount(): number {
+  return unwrapUiOutcome(
+    executeOnUIRuntimeSync(() => {
+      'worklet'
+      return uiGuard(() => {
+        const g = globalThis as UiGlobal
+        if (g.__nativeMotionDrivers === undefined) return 0
+        return Object.keys(g.__nativeMotionDrivers).length
+      })
+    })(),
+  )
+}
+
+// Settle-channel forensics (iOS AUTO SIGABRT settle-gap investigation, seal-r15 F2; seal-r16
+// F2 moves the public surface behind `@unrulysystems/native-motion/verification`). The JS-side
+// marker is installed by the proof app's ExamplesScreen; unset elsewhere, so every push is a
+// no-op in ordinary builds. UI-side counters are PRIMITIVE UI-global cells that never ride the
+// channel under test — and they only mutate when the proof app has armed the witness (the
+// marker install at driver mount arms UI; ordinary consumers never arm, so settle/completion
+// paths stay zero-cost).
+interface ProofSettleChannelUiGlobal {
+  __nativeMotionProofWitnessArmed?: boolean
+  __nativeMotionProofSettleEmissions?: number
+  __nativeMotionProofLayoutCallbackInvocations?: number
+  __nativeMotionProofLayoutCallbackEpochDrops?: number
+  __nativeMotionProofLayoutCallbackCancelled?: number
+  __nativeMotionProofLayoutOnCompleteScheduled?: number
+}
+type ProofMarkerJsGlobal = {
+  __nativeMotionProofMarker?: (marker: string) => void
+  __nativeMotionLastProofSettleEmissions?: number
+  __nativeMotionLastProofLayoutCallback?: string
+}
+
+function isProofMarkerInstalled(): boolean {
+  return (globalThis as ProofMarkerJsGlobal).__nativeMotionProofMarker !== undefined
+}
+
+// Arm the UI-runtime witness cells. Called from driver mount when the proof marker is present,
+// and from the verification entry for isolation tests / verification screens.
+export function armUiProofWitnesses(): void {
+  unwrapUiOutcome(
+    executeOnUIRuntimeSync(() => {
+      'worklet'
+      return uiGuard(() => {
+        ;(globalThis as ProofSettleChannelUiGlobal).__nativeMotionProofWitnessArmed = true
+      })
+    })(),
+  )
+}
+
+// Mirror the latest UI settle-emission count onto the JS global + marker. Called from the
+// JS-side settle dispatch (not from the UI worklet) so the worklet-closures gate never sees a
+// non-worklet helper capture on the frame path. The public gallery reads the JS cell without
+// importing engine-internal readers (purity ban: only App.tsx may import `/verification`).
+function mirrorProofSettleEmissionToJs(count: number): void {
+  const g = globalThis as ProofMarkerJsGlobal
+  g.__nativeMotionLastProofSettleEmissions = count
+  g.__nativeMotionProofMarker?.(`ui-settle-emissions=${count}`)
+}
+
+// The UI-side settle-emission witness count, read synchronously (never through the channel
+// under test). Verification/internal only — not on the consumer-facing package root.
+export function uiProofSettleEmissionCount(): number {
+  return unwrapUiOutcome(
+    executeOnUIRuntimeSync(() => {
+      'worklet'
+      return uiGuard(
+        () => (globalThis as ProofSettleChannelUiGlobal).__nativeMotionProofSettleEmissions ?? 0,
+      )
+    })(),
+  )
+}
+
+// The layout-completion callback's witness counters packed for one proof-log line —
+// invocations / epoch-guard drops / cancellations / onComplete scheduled (seal-r15 F2). A
+// zero invocation count names Reanimated's completion delivery; invocations > scheduled names
+// our guard or the cancel path; scheduled > JS receipt names the crossing.
+export function uiProofLayoutCallbackWitness(): string {
+  return unwrapUiOutcome(
+    executeOnUIRuntimeSync(() => {
+      'worklet'
+      return uiGuard(() => {
+        const g = globalThis as ProofSettleChannelUiGlobal
+        return `${g.__nativeMotionProofLayoutCallbackInvocations ?? 0}/${g.__nativeMotionProofLayoutCallbackEpochDrops ?? 0}/${g.__nativeMotionProofLayoutCallbackCancelled ?? 0}/${g.__nativeMotionProofLayoutOnCompleteScheduled ?? 0}`
+      })
+    })(),
+  )
+}
+
+// Last-pushed JS-side copies (filled by scheduleOnRN when armed). The proof gallery reads these
+// without a package import; verification screens can use the sync readers above instead.
+export function lastPushedProofSettleEmissionCount(): number {
+  return (globalThis as ProofMarkerJsGlobal).__nativeMotionLastProofSettleEmissions ?? 0
+}
+
+export function lastPushedProofLayoutCallbackWitness(): string {
+  return (globalThis as ProofMarkerJsGlobal).__nativeMotionLastProofLayoutCallback ?? '0/0/0/0'
+}
+
+function uiLayoutSlot(state: UiDriverState, spring: SpringConfig | undefined): UiLayoutState {
+  'worklet'
+  if (state.layout === null) state.layout = createUiLayoutState(spring, state.driverId)
+  return state.layout
+}
+
+function uiElementAt(state: UiDriverState, handle: number): UiElementState {
+  'worklet'
+  const element = state.elements[handle]
+  if (element === undefined) {
+    // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN through the lane's
+    // designed transport (Phase 2); this throw is the payload, never the delivery.
+    throw new Error(
+      `unknown element handle ${String(handle)}: it was never registered on this driver.`,
+    )
+  }
+  return element
+}
+
+// Generator construction ON the UI runtime — the reference driver's startGenerator/retargetGenerator,
+// verbatim semantics (spring default, tween positional reseed, spring retarget carries velocity).
+// `velocity` is the REQ-DRIVER-023 seed (the gesture release's platform handoff, unscaled); a tween is
+// position-based and ignores it by construction — explicit 0 so the contract reads at the seam.
+// A CONTENDING target drifts FROM the committed finger value — never a backward jump off the finger
+// (REQ-DRIVER-026 / G-INV-2, review major 25; mirror of the reference driver's anchorContentionToLive).
+// A keyframe array's non-null FIRST element would restart near keyframes[0], rewinding the drift;
+// re-seed the first keyframe from-current (null-first, R8-F2) so the trajectory runs the live value →
+// remaining keyframes. A scalar and an already-null-first array are unchanged.
+function uiAnchorContentionToLive(to: PropTargetTo): PropTargetTo {
+  'worklet'
+  if (typeof to === 'number' || to[0] === null) return to
+  return Object.freeze([null, ...to.slice(1)])
+}
+
+const UI_KEYFRAME_DEFAULT_DURATION_MS = 300
+const UI_KEYFRAME_VELOCITY_SAMPLE_MS = 5
+
+interface UiKeyframeSegment {
+  readonly start: number
+  readonly end: number
+  readonly to: number
+  readonly generator: Generator | null
+}
+
+function uiKeyframesValueAt(
+  segments: readonly UiKeyframeSegment[],
+  first: number,
+  firstTime: number,
+  last: number,
+  lastTime: number,
+  elapsedMs: number,
+): number {
+  'worklet'
+  if (elapsedMs <= firstTime) return first
+  if (elapsedMs >= lastTime) return last
+  for (let index = 0; index < segments.length; index++) {
+    const segment = segments[index]
+    if (segment === undefined) break
+    if (elapsedMs <= segment.end) {
+      if (segment.generator === null) return segment.to
+      return segment.generator.sample(elapsedMs - segment.start).value
+    }
+  }
+  return last
+}
+
+// UI-safe counterpart of core's public keyframesGenerator. `uiStartGenerator` receives only targets
+// and configs that the JS-side adapter has already validated and normalized, so it must not cross
+// core's raw public-boundary capture/refusal helpers. File-tagging that public module made the
+// Worklets plugin rewrite ordinary typed-error classes to absent `__classFactory` calls on device.
+// This constructor retains the pinned timing semantics for valid prepared input while closing that
+// boundary: each segment delegates easing math to the already UI-safe timingGenerator.
+//
+// alloc-ok: command edge. Segment generators and their mutable samples are constructed once; the
+// returned sampler mutates only its reused output record on the frame path.
+export function uiKeyframesGenerator(
+  keyframes: readonly (number | null)[],
+  config: KeyframesConfig,
+  from: number,
+): Generator {
+  'worklet'
+  const count = keyframes.length
+  const duration = config.duration ?? UI_KEYFRAME_DEFAULT_DURATION_MS
+  const values: number[] = []
+  for (let index = 0; index < count; index++) {
+    const keyframe = keyframes[index]
+    if (keyframe === undefined)
+      // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN (Phase 2); a total
+      // target guard the JS-side boundary already enforces, never a UI delivery.
+      throw new Error(`prepared keyframes target is missing index ${String(index)}`)
+    values.push(keyframe === null ? from : keyframe)
+  }
+
+  const segments: UiKeyframeSegment[] = []
+  for (let index = 0; index < count - 1; index++) {
+    const segmentFrom = values[index]
+    const segmentTo = values[index + 1]
+    if (segmentFrom === undefined || segmentTo === undefined)
+      // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN (Phase 2); a total
+      // target guard the JS-side boundary already enforces, never a UI delivery.
+      throw new Error(`prepared keyframes target is incomplete at segment ${String(index)}`)
+    const start = keyframeOffsetAt(config.times, index, count) * duration
+    const end = keyframeOffsetAt(config.times, index + 1, count) * duration
+    const span = end - start
+    segments.push({
+      start,
+      end,
+      to: segmentTo,
+      // A duplicated offset is legal: core treats it as an instantaneous transition. Avoid
+      // timingGenerator's t/0 path and preserve the same exact `to` result here.
+      generator:
+        span <= 0
+          ? null
+          : timingGenerator(segmentTo, {
+              duration: span,
+              ease: keyframeSegmentEase(config.ease, index),
+            })({ from: segmentFrom, velocity: 0 }),
+    })
+  }
+
+  const firstSegment = segments[0]
+  const lastSegment = segments[segments.length - 1]
+  const first = firstSegment === undefined ? from : values[0]!
+  const last = lastSegment === undefined ? first : lastSegment.to
+  const firstTime = firstSegment?.start ?? 0
+  const lastTime = lastSegment?.end ?? 0
+
+  const out = { value: first, velocity: 0, done: false }
+  return {
+    sample(elapsedMs: number) {
+      const current = uiKeyframesValueAt(segments, first, firstTime, last, lastTime, elapsedMs)
+      const previousElapsedMs = Math.max(elapsedMs - UI_KEYFRAME_VELOCITY_SAMPLE_MS, 0)
+      const elapsedDeltaMs = elapsedMs - previousElapsedMs
+      out.value = elapsedMs >= duration ? last : current
+      out.velocity = elapsedDeltaMs
+        ? ((current -
+            uiKeyframesValueAt(segments, first, firstTime, last, lastTime, previousElapsedMs)) /
+            elapsedDeltaMs) *
+          1000
+        : 0
+      out.done = elapsedMs >= duration
+      return out
+    },
+  }
+}
+
+// R8-F1 (UI-runtime mirror of the reference driver's springKeyframeGenerator): a keyframe ARRAY under
+// an EXPLICIT spring. A spring interpolates EXACTLY two keyframes — the pinned Motion throws for more.
+// Two run spring physics from keyframes[0] (the explicit origin; null first reads `from`, R8-F2) to
+// keyframes[1]; a longer array FAILS LOUD naming the successor so it never reaches the spring generator.
+function uiSpringKeyframeGenerator(
+  config: SpringConfig,
+  keyframes: readonly (number | null)[],
+  from: number,
+  velocity: number,
+): Generator {
+  'worklet'
+  if (keyframes.length !== 2) {
+    // ui-throw-ok: guarded by uiGuard/uiGuardLane — the R8-F1 refusal marshals to RN through the
+    // lane's designed transport (Phase 2); the message names the successor, never a UI delivery.
+    throw new Error(
+      `a spring transition cannot interpolate through ${keyframes.length} keyframes — a spring ` +
+        'animates exactly two (origin → target). Keyframe index 2 (the successor) is unreachable; ' +
+        'use a tween for a multi-keyframe array (REQ-API-033, R8-F1).',
+    )
+  }
+  const origin = keyframes[0]
+  const target = keyframes[1]
+  // Validation guarantees a length-2 array whose only legal null is index 0 and whose target parses;
+  // the guard keeps this TOTAL under noUncheckedIndexedAccess (never hit for a valid target).
+  if (origin === undefined || target === undefined || target === null) {
+    // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN (Phase 2); a total
+    // shape guard the JS-side validation already enforces, never a UI delivery.
+    throw new Error(
+      'malformed two-keyframe spring array — a non-null numeric target is required (REQ-API-033).',
+    )
+  }
+  const seedFrom = origin === null ? from : origin
+  return resolveSpringGenerator(target, config)({ from: seedFrom, velocity })
+}
+
+// The transition's own resolved iteration length in ms, or null when only the scan can measure it —
+// the UI mirror of the reference driver's `knownIterationDurationMs` (the pin's `calculatedDuration`
+// rule). Configs were resolved JS-side, so this reads them directly.
+function uiKnownIterationDurationMs(transition: PlainTransition, to: PropTargetTo): number | null {
+  'worklet'
+  // Narrows the plain-data union off the inertia arm (and the U7a instant arm, which never
+  // reaches the fold that consumes this) as well as answering the lane's first question.
+  if (transition.kind === 'inertia' || transition.kind === 'instant') return null
+  // Core's ONE lane rule, never re-derived here — this backend held the second parallel copy that
+  // the T18-a fix-up review found drifting (round 3 MAJOR).
+  const lane = iterationMeasurementLane(
+    typeof to === 'number',
+    transition.explicitSpring,
+    transition.kind === 'tween',
+  )
+  if (lane === 'keyframes') return transition.keyframes.duration ?? null
+  if (lane === 'timing') return transition.config.duration ?? null
+  const resolved = resolveSpring(transition.config)
+  return resolved.calculatedDuration !== null && resolved.calculatedDuration > 0
+    ? resolved.calculatedDuration
+    : null
+}
+
+function uiUnrepeatedGenerator(
+  transition: PlainTransition,
+  to: PropTargetTo,
+  from: number,
+  velocity: number,
+  reversed: boolean,
+): Generator {
+  'worklet'
+  // U7a: the instant lane — no trajectory generator runs; the final keyframe commits past t=0
+  // (the command edge seeds committed from sample(0), so nothing moves at command time). Never
+  // folded, so `reversed` is always false here; the arm stays total over the union regardless.
+  if (transition.kind === 'instant') {
+    return instantGenerator(instantFinalKeyframe(to))({ from, velocity: 0 })
+  }
+  if (typeof to !== 'number' && reversed && transition.kind !== 'inertia') {
+    // Resolve from-current nulls BEFORE reversing (R8-F2), mirroring the reference driver: the pin
+    // mirrors the RESOLVED keyframes, and a null that slid to the tail would re-read `from` at the
+    // wrong end. `times`/`ease` are deliberately untouched — the pin reverses keyframes only.
+    const resolvedKeyframes: number[] = []
+    for (let index = to.length - 1; index >= 0; index--) {
+      const value = to[index]
+      resolvedKeyframes.push(value === null || value === undefined ? from : value)
+    }
+    const mirroredFrom = resolvedKeyframes[0] ?? from
+    if (transition.explicitSpring) {
+      return uiSpringKeyframeGenerator(
+        transition.config,
+        resolvedKeyframes,
+        mirroredFrom,
+        -velocity,
+      )
+    }
+    return uiKeyframesGenerator(resolvedKeyframes, transition.keyframes, mirroredFrom)
+  }
+  if (typeof to !== 'number') {
+    if (transition.kind === 'inertia') {
+      // ui-throw-ok: guarded by uiGuard/uiGuardLane — a keyframe array under an inertia transition
+      // is a command-shape defect the release never produces (R16); fail loud, never a silent
+      // spring/keyframe misroute.
+      throw new Error(
+        'a keyframe array cannot run under an inertia transition (REQ-GESTURE-023, R16).',
+      )
+    }
+    // A keyframe ARRAY routes by `explicitSpring`, NOT `kind` — the UI-runtime mirror of the reference
+    // driver's `transition.type === 'spring'` (REQ-API-033, R8-F1; no cross-engine skew). Only a
+    // LITERAL spring interpolates a keyframe array as spring (two → physics; >2 → fail loud naming the
+    // successor); a tween OR the DEFAULT (an omitted type, whether it resolved 'tween' by REQ-TIMING-006
+    // or stayed the 'spring' fallback) routes the
+    // array THROUGH the keyframes generator (position-based, seed velocity dropped, null-first reads
+    // `from`). Configs were resolved JS-side (toSpringConfig/toKeyframesConfig), identical here.
+    if (transition.explicitSpring)
+      return uiSpringKeyframeGenerator(transition.config, to, from, velocity)
+    return uiKeyframesGenerator(to, transition.keyframes, from)
+  }
+  if (transition.kind === 'inertia') {
+    // R16 (REQ-GESTURE-023): the two-phase generator recomputes its ideal from the seed and owns
+    // the walls; `to` is the mirror terminal only. The seed velocity is the platform release
+    // velocity, momentum-gated upstream (REQ-GESTURE-027).
+    return inertiaGenerator({
+      power: transition.config.power,
+      timeConstant: transition.config.timeConstant,
+      bounceStiffness: transition.config.bounceStiffness,
+      bounceDamping: transition.config.bounceDamping,
+      restDelta: transition.config.restDelta,
+      restSpeed: transition.config.restSpeed,
+      ...(transition.config.min !== undefined ? { min: transition.config.min } : {}),
+      ...(transition.config.max !== undefined ? { max: transition.config.max } : {}),
+    })({ from, velocity })
+  }
+  // The scalar mirrored leg: origin and target swap and the seed velocity negates (the pin builds
+  // its second generator with `velocity: -velocity`). Mirrors the reference driver exactly.
+  const scalarTo = reversed ? from : to
+  const scalarFrom = reversed ? to : from
+  const scalarVelocity = reversed ? -velocity : velocity
+  if (transition.kind === 'tween') {
+    // transition-default-selection F5: a zero-length timing base takes the pin's
+    // makeAnimationInstant SHAPE — hold the seed at t ≤ 0, commit the final keyframe past it —
+    // mirroring the reference driver's `unrepeatedGenerator`. Only repeatDelay-bearing bags reach
+    // this (a zero duration without one resolved to kind:'instant' JS-side); it keeps the fold's
+    // zero-length plays from committing at the command edge.
+    if (transition.config.duration === 0) {
+      return instantGenerator(scalarTo)({ from: scalarFrom, velocity: 0 })
+    }
+    return timingGenerator(scalarTo, transition.config)({ from: scalarFrom, velocity: 0 })
+  }
+  return resolveSpringGenerator(
+    scalarTo,
+    transition.config,
+  )({
+    from: scalarFrom,
+    velocity: scalarVelocity,
+  })
+}
+
+// T18-a (REQ-DRIVER-031): the UI-runtime entry that applies the repeat fold. It calls core's SHARED
+// `buildRepeatedGenerator` with its own unrepeated construction — the identical call the reference
+// driver makes. Parity with that backend is enforced by `driverParity.differential.test.ts`, which
+// executes both over the same commands and compares trajectories frame for frame; sharing the call
+// is not enough on its own (both seams shared it and still skewed on retarget). An inertia release
+// never carries authored options, so it never folds.
+function uiStartGenerator(
+  transition: PlainTransition,
+  to: PropTargetTo,
+  from: number,
+  velocity: number,
+): Generator {
+  'worklet'
+  // U7a: the instant lane never folds (the pin's shouldSkip ignores repeat outright), so it
+  // narrows off with inertia here; its authored delay still crosses through `delayMs` below.
+  const fold =
+    transition.kind === 'inertia' || transition.kind === 'instant' ? null : transition.repeat
+  // T18-b (REQ-TIMING-004 / REQ-DRIVER-032): the delay rebase wraps AROUND the fold-or-generator,
+  // through core's SHARED `delayGenerator` — the identical call the reference driver makes at
+  // both phases. An inertia release carries no authored delay (its arm omits `delayMs`, the same
+  // totality law as `repeat`). Parity is held by the executing differential floor, not by the
+  // shared call alone.
+  const delayMs = transition.kind === 'inertia' ? 0 : transition.delayMs
+  if (fold === null)
+    return delayGenerator(uiUnrepeatedGenerator(transition, to, from, velocity, false), delayMs)
+  // Legs built EAGERLY and passed as values (never a factory invoked on UI — the wrong-runtime
+  // crash class the closures gate fails closed on); identical shape to the reference driver.
+  const leg: RepeatLeg =
+    fold.repeatType === 'mirror'
+      ? { type: 'mirror', mirrored: uiUnrepeatedGenerator(transition, to, from, velocity, true) }
+      : { type: fold.repeatType }
+  const folded = buildRepeatedGenerator(
+    fold.repeat,
+    leg,
+    fold.repeatDelayMs,
+    uiUnrepeatedGenerator(transition, to, from, velocity, false),
+    uiKnownIterationDurationMs(transition, to),
+  )
+  if (folded instanceof Error) {
+    // ui-throw-ok: guarded by uiGuard/uiGuardLane — the T18-a L3 refusal marshals to RN through the
+    // lane's designed transport, naming the unexecutable fold rather than running a NaN trajectory.
+    throw uiRepeatRefusal(fold.repeat, folded)
+  }
+  return delayGenerator(folded, delayMs)
+}
+
+function uiUnrepeatedRetargetGenerator(
+  transition: PlainTransition,
+  live: PropStep,
+  to: number,
+): Generator {
+  'worklet'
+  // U7a: the instant lane at the retarget seam — commit the new target past t=0 from the live
+  // value. The retarget's own authored delay wraps this in uiRetargetGenerator, exactly like
+  // the reference driver's retargetGenerator.
+  if (transition.kind === 'instant') {
+    return instantGenerator(to)({ from: live.value, velocity: 0 })
+  }
+  if (transition.kind === 'tween') {
+    // F5: the zero-length timing base takes the instant SHAPE here too — the same routing as
+    // `uiUnrepeatedGenerator`, seeded from the live value (no cross-seam skew).
+    if (transition.config.duration === 0) {
+      return instantGenerator(to)({ from: live.value, velocity: 0 })
+    }
+    return timingGenerator(to, transition.config)({ from: live.value, velocity: 0 })
+  }
+  if (transition.kind === 'inertia') {
+    // R16: a retarget into an inertia transition re-seeds the two-phase generator from the LIVE
+    // generator's sample — the same continuity law as a spring retarget (C0/C1).
+    const at = live.generator.sample(live.elapsed)
+    return inertiaGenerator({
+      power: transition.config.power,
+      timeConstant: transition.config.timeConstant,
+      bounceStiffness: transition.config.bounceStiffness,
+      bounceDamping: transition.config.bounceDamping,
+      restDelta: transition.config.restDelta,
+      restSpeed: transition.config.restSpeed,
+      ...(transition.config.min !== undefined ? { min: transition.config.min } : {}),
+      ...(transition.config.max !== undefined ? { max: transition.config.max } : {}),
+    })({ from: at.value, velocity: at.velocity })
+  }
+  return retargetSpring(live.generator, live.elapsed, to, transition.config)
+}
+
+/**
+ * T18-a fix-up (review BLOCKER): the retarget seam carries the fold, identically to
+ * `uiStartGenerator`. An endless repeat is never `done`, so every changed scalar animate key
+ * arrives HERE rather than at `start` — dropping the fold stopped the loop permanently on the
+ * first retarget. Declared below `uiUnrepeatedRetargetGenerator` because the workletizer emits
+ * each worklet as a non-hoisted const (see the declaration-order note above).
+ */
+function uiRetargetGenerator(transition: PlainTransition, live: PropStep, to: number): Generator {
+  'worklet'
+  const base = uiUnrepeatedRetargetGenerator(transition, live, to)
+  // U7a: the instant lane never folds — same narrowing as uiStartGenerator.
+  const fold =
+    transition.kind === 'inertia' || transition.kind === 'instant' ? null : transition.repeat
+  // T18-b (REQ-DRIVER-032): a retarget applies its OWN delay — the pin starts a fresh animation
+  // per retarget — wrapping the (possibly folded) trajectory AROUND the fold, identical to the
+  // reference driver's retargetGenerator. A mid-delay retarget reseeds from the held first
+  // keyframe at velocity 0, which is exactly what the outgoing delay wrapper reports while held.
+  const delayMs = transition.kind === 'inertia' ? 0 : transition.delayMs
+  if (fold === null) return delayGenerator(base, delayMs)
+  const leg: RepeatLeg =
+    fold.repeatType === 'mirror'
+      ? { type: 'mirror', mirrored: uiUnrepeatedGenerator(transition, to, live.value, 0, true) }
+      : { type: fold.repeatType }
+  const folded = buildRepeatedGenerator(
+    fold.repeat,
+    leg,
+    fold.repeatDelayMs,
+    base,
+    uiKnownIterationDurationMs(transition, to),
+  )
+  if (folded instanceof Error) {
+    // ui-throw-ok: guarded by uiGuard/uiGuardLane — the L3 refusal marshals to RN through the
+    // lane's designed transport, exactly as the start seam does.
+    throw uiRepeatRefusal(fold.repeat, folded)
+  }
+  return delayGenerator(folded, delayMs)
+}
+
+// Clear the gesture hold on ONE prop (the matching release/stop owns it now). Idempotent — clearing
+// an unheld prop is a no-op, so heldCount stays exact (review r7 major 23). Command-edge only.
+function uiReleaseHold(element: UiElementState, key: string): void {
+  'worklet'
+  if (element.heldVelocity[key] !== undefined) {
+    delete element.heldVelocity[key]
+    element.heldCount--
+  }
+}
+
+function uiTerminalTarget(to: PropTargetTo): number {
+  'worklet'
+  if (typeof to === 'number') return to
+  for (let index = to.length - 1; index >= 0; index--) {
+    const value = to[index]
+    if (value !== null && value !== undefined) return value
+  }
+  // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN (Phase 2); a total
+  // shape guard the JS-side boundary already enforces, never a UI delivery.
+  throw new Error('a property command needs a numeric terminal target for its layout mirror.')
+}
+
+// alloc-ok: command-edge — grow an element's frame member slots to cover every committed key the
+// frame can stage (propKeys plus the path-claimed x/y/pathRotation extras). Called wherever
+// propKeys is rebuilt; uiEmitFrameValues fills by index and never grows these in-frame.
+function uiPrefillElementFrameSlots(element: UiElementState): void {
+  'worklet'
+  const required = element.propKeys.length + 3
+  while (element.frameKeys.length < required) {
+    element.frameKeys.push('')
+    element.frameValues.push(0)
+  }
+}
+
+function uiApplyCommand(state: UiDriverState, handle: number, command: PlainCommand): void {
+  'worklet'
+  const element = uiElementAt(state, handle)
+  switch (command.kind) {
+    case 'start': {
+      // Only a gesture RELEASE (`releasesGesture`) or a `stop` ends a hold. A declarative start on a
+      // gesture-held prop CONTENDS instead of being skipped (REQ-DRIVER-026, Motion's shared-value
+      // model): it seeds a generator that drifts the live value while the finger still owns the prop,
+      // so a mid-drag `animate` change moves the element and the release reads the drifted origin. The
+      // finger's release velocity is preserved (uiLiveFor held-velocity precedence, REQ-DRIVER-025);
+      // the hold clears only at release/stop. Mirror of the reference driver.
+      const releasesGesture = command.releasesGesture === true
+      // PHASE 1 — build every prop's generator WITHOUT mutating UI state; a construction that throws
+      // (an explicit spring on a >2-keyframe array, R8-F1) aborts the WHOLE command before ANY prop
+      // commits (fail-closed atomicity — mirror of the reference driver; review major 19).
+      const plans: {
+        key: string
+        stillHeld: boolean
+        seededValue: number
+        generator: Generator
+        to: PropTargetTo
+        transition: PlainTransition
+      }[] = []
+      for (const key of Object.keys(command.targets)) {
+        const target = command.targets[key]! // key came from Object.keys
+        // A gesture-RELEASE start takes over the prop (hold clears in phase 2), so it is treated as NOT
+        // still-held and uses the command's `from`. A CONTENDING start on a prop the finger still holds
+        // drifts from the CURRENT live value (never `from`) so committed does not jump off the finger.
+        const stillHeld = !releasesGesture && element.heldVelocity[key] !== undefined
+        const from = stillHeld ? element.committed[key]! : target.from
+        // The per-prop transition wins over the command-level one for THIS prop (R8 M2), mirror of the
+        // reference driver. The prepared target's transition is complete; no backend fallback remains.
+        const transition = target.transition
+        // A still-held (contending) start drifts from the finger value: seed the first keyframe
+        // from-current so it never rewinds to keyframes[0] (major 25); a non-held start plays the
+        // array's own origin verbatim. Mirror of the reference driver.
+        const generator = uiStartGenerator(
+          transition,
+          stillHeld ? uiAnchorContentionToLive(target.to) : target.to,
+          from,
+          target.velocity,
+        )
+        // Seed committed/value/shared from the generator's TICK-0, not the raw `from` (REQ-API-033 seed
+        // law; review major dfeaa4bf4bcf). A scalar generator samples `from` at t=0 (no-op). A
+        // still-held start keeps the finger-authoritative committed. sample(0) is a pure read.
+        const seededValue = stillHeld ? from : generator.sample(0).value
+        plans.push({ key, stillHeld, seededValue, generator, to: target.to, transition })
+      }
+      // PHASE 2 — commit every plan. No throw path here, so UI state mutates atomically.
+      for (const plan of plans) {
+        if (releasesGesture) uiReleaseHold(element, plan.key)
+        element.props[plan.key] = {
+          generator: plan.generator,
+          elapsed: 0,
+          value: plan.seededValue,
+          done: false,
+        }
+        element.committed[plan.key] = plan.seededValue
+        const shared = element.shared[plan.key]
+        if (shared !== undefined) shared.value = plan.seededValue
+        uiSetMirrorTarget(element, plan.key, uiTerminalTarget(plan.to))
+        uiSetMirrorActive(element, plan.key, true)
+        // Track the contention target so a later finger write re-anchors this generator (major 29);
+        // `plan.to` was already captured at command time (major 20). A released/non-held start owns the
+        // prop outright, so clear any prior contention.
+        if (plan.stillHeld)
+          element.contending[plan.key] = { to: plan.to, transition: plan.transition }
+        else delete element.contending[plan.key]
+      }
+      // Command-edge rebuild of the frame loop's iteration list (REQ-DRIVER-021): Object.keys here
+      // is O(1) per command; in uiStepAll it was per element per vsync.
+      if (command.path !== undefined) {
+        const geometry = command.path
+        const generator = uiStartGenerator(geometry.transition, 1000, 0, 0)
+        const seeded = generator.sample(0).value
+        element.path = {
+          progress: { generator, elapsed: 0, value: seeded, done: false },
+          geometry: {
+            fromX: geometry.fromX,
+            fromY: geometry.fromY,
+            toX: geometry.toX,
+            toY: geometry.toY,
+            peak: geometry.peak,
+            signedStrength: geometry.signedStrength,
+            rotationScale: geometry.rotationScale,
+          },
+          sample: { x: 0, y: 0, pathRotation: 0 },
+          scratch: { control: { x: 0, y: 0 }, sample: { x: 0, y: 0, rotate: 0 } },
+        }
+        delete element.props.x
+        delete element.props.y
+        delete element.props.pathRotation
+        applyPathProgressInto(
+          seeded,
+          element.path.geometry,
+          false,
+          element.path.sample,
+          element.path.scratch,
+        )
+        const sample = element.path.sample
+        if (element.committed.x !== undefined) {
+          element.committed.x = sample.x
+          const sharedX = element.shared.x
+          if (sharedX !== undefined) sharedX.value = sample.x
+        }
+        if (element.committed.y !== undefined) {
+          element.committed.y = sample.y
+          const sharedY = element.shared.y
+          if (sharedY !== undefined) sharedY.value = sample.y
+        }
+        if (geometry.rotationScale && element.committed.pathRotation !== undefined) {
+          element.committed.pathRotation = sample.pathRotation
+          const sharedR = element.shared.pathRotation
+          if (sharedR !== undefined) sharedR.value = sample.pathRotation
+        }
+      } else if (element.path !== null) {
+        if (element.path.geometry.rotationScale && element.committed.pathRotation !== undefined) {
+          element.committed.pathRotation = 0
+          const sharedR = element.shared.pathRotation
+          if (sharedR !== undefined) sharedR.value = 0
+        }
+        element.path = null
+      }
+      element.propKeys = Object.keys(element.props)
+      uiPrefillElementFrameSlots(element)
+      element.active = element.propKeys.length > 0 || element.heldCount > 0 || element.path !== null
+      state.settleNotified = false // re-arm the settle edge
+      break
+    }
+    case 'retarget': {
+      // PHASE 1 — build every prop's generator WITHOUT mutating UI state, exactly as `start` does.
+      // A retarget can be refused from BELOW (a fold re-measures its iteration from the LIVE value,
+      // so a `repeat` that `start` accepted can be unexecutable here), and the severity router's
+      // per-key re-issue is built on "a refused command is as if it had never been issued". This
+      // backend committed per key inside the build loop, so a refusal on a later key left every
+      // earlier key already re-seeded — the reference backend's invariant, absent on the backend
+      // that ships (T18-a round-9 review BLOCKING 2).
+      const plans: {
+        key: string
+        to: number
+        from: number
+        generator: Generator
+        held: boolean
+      }[] = []
+      for (const key of Object.keys(command.targets)) {
+        const to = command.targets[key]! // key came from Object.keys
+        const transition = command.targetTransitions?.[key] ?? command.transition
+        // A retarget is never the gesture release. A retarget on a gesture-HELD prop CONTENDS
+        // (REQ-DRIVER-026): it seeds a fresh generator from the finger-authoritative COMMITTED value
+        // (not the possibly-stale generator value — a finger write may have advanced committed past it,
+        // review r10 major 29) toward the new target, and records the contention so a later write
+        // re-anchors it. A non-held prop retargets normally with velocity continuity. Same fail-loud
+        // rule: a retarget of a prop never started/registered is a caller bug, never a silent 0. Mirror
+        // of the reference driver.
+        const held = element.heldVelocity[key] !== undefined
+        if (held) {
+          const from = element.committed[key]! // held ⇒ written ⇒ committed exists
+          plans.push({
+            key,
+            to,
+            from,
+            generator: uiStartGenerator(transition, to, from, 0),
+            held,
+          })
+          continue
+        }
+        const live = element.props[key]
+        if (live !== undefined && !live.done) {
+          plans.push({
+            key,
+            to,
+            from: live.value,
+            generator: uiRetargetGenerator(transition, live, to),
+            held,
+          })
+          continue
+        }
+        const base = live !== undefined ? live.value : element.committed[key]
+        if (base === undefined) {
+          // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN through the
+          // lane's designed transport (Phase 2); this throw is the payload, never the delivery.
+          throw new Error(
+            `cannot retarget '${key}': it was never registered or started on this element.`,
+          )
+        }
+        plans.push({
+          key,
+          to,
+          from: base,
+          generator: uiStartGenerator(transition, to, base, 0),
+          held,
+        })
+      }
+      // PHASE 2 — commit every plan. No throw path here, so UI state mutates atomically.
+      for (const plan of plans) {
+        if (plan.held)
+          element.contending[plan.key] = {
+            to: plan.to,
+            transition: command.targetTransitions?.[plan.key] ?? command.transition,
+          }
+        else delete element.contending[plan.key]
+        element.props[plan.key] = {
+          generator: plan.generator,
+          elapsed: 0,
+          value: plan.from,
+          done: false,
+        }
+        element.committed[plan.key] = plan.from
+        uiSetMirrorTarget(element, plan.key, plan.to)
+        uiSetMirrorActive(element, plan.key, true)
+      }
+      element.propKeys = Object.keys(element.props) // command-edge rebuild (REQ-DRIVER-021)
+      uiPrefillElementFrameSlots(element)
+      // Recompute from what remains in flight: a held retarget seeds a contending generator and a held
+      // element stays active regardless (heldCount > 0). Mirror of the reference driver.
+      element.active = element.propKeys.length > 0 || element.heldCount > 0
+      state.settleNotified = false // re-arm the settle edge
+      break
+    }
+    case 'stop': {
+      // Halt every animation AND release every gesture hold (stop = halt everything).
+      if (element.path !== null) {
+        if (element.path.geometry.rotationScale && element.committed.pathRotation !== undefined) {
+          element.committed.pathRotation = 0
+          const sharedR = element.shared.pathRotation
+          if (sharedR !== undefined) sharedR.value = 0
+        }
+        element.path = null
+      }
+      for (const key of Object.keys(element.props)) delete element.props[key]
+      for (const key of Object.keys(element.heldVelocity)) delete element.heldVelocity[key]
+      for (const key of Object.keys(element.contending)) delete element.contending[key]
+      for (const key of Object.keys(element.layoutMirror)) {
+        uiSetMirrorActive(element, key, false)
+        const committed = element.committed[key]
+        if (committed !== undefined) uiSetMirrorTarget(element, key, committed)
+      }
+      element.heldCount = 0
+      element.propKeys.length = 0
+      element.active = false
+      break
+    }
+  }
+}
+
+// The gesture write lane ON the UI runtime (REQ-DRIVER-024): commit event-driven values and
+// interrupt any in-flight animation on the written props through ONE entry point — committed
+// state, the shared values the style binds, and animation state can never skew. EVENT-edge, not
+// frame-path: Object.keys here is O(1) per recognizer event (the uiApplyCommand precedent), and
+// the frame loop never calls this.
+function uiApplyWrite(
+  state: UiDriverState,
+  handle: number,
+  values: Readonly<Record<string, number>>,
+  velocities: Readonly<Record<string, number>> | undefined,
+  writeVersion: number,
+  eventShape: WorkletDriverWriteShape,
+): void {
+  'worklet'
+  const element = uiElementAt(state, handle)
+  // Validate ALL keys before mutating ANY — a malformed write never half-applies (fail-closed).
+  for (const key of Object.keys(values)) {
+    if (!(key in element.committed)) {
+      // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN through the lane's
+      // designed transport (Phase 2); this throw is the payload, never the delivery.
+      throw new Error(`cannot write '${key}': it was never registered on this element.`)
+    }
+    if (
+      eventShape === 'bound-value-retarget' &&
+      (element.heldVelocity[key] !== undefined || element.props[key] !== undefined)
+    ) {
+      // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN through the lane's
+      // designed transport (Phase 2); this throw is the payload, never the delivery. The NAMED
+      // refusal (validation phase, nothing mutated) is what the live arm routes to the adapter's
+      // refusal handling instead of retiring an admitted flight (REQ-DRIVER-034).
+      throw uiBoundValueWriteRefusal(key)
+    }
+  }
+  for (const key of Object.keys(values)) {
+    const finger = values[key]!
+    if (eventShape === 'bound-value-retarget') {
+      element.committed[key] = finger
+      const shared = element.shared[key]
+      if (shared !== undefined) shared.value = finger
+      uiSetMirrorTarget(element, key, finger)
+      uiSetMirrorActive(element, key, false)
+      continue
+    }
+    if (element.heldVelocity[key] === undefined) element.heldCount++ // count a NEW hold once
+    element.committed[key] = finger
+    element.writeVersion[key] = writeVersion
+    const shared = element.shared[key]
+    if (shared !== undefined) shared.value = finger
+    uiSetMirrorTarget(element, key, finger)
+    uiSetMirrorActive(element, key, true)
+    // Refresh the per-prop held platform velocity so uiLiveFor reports it while held (G-INV-3 C1 seam,
+    // held-velocity precedence over any contending generator); omitted ⇒ 0.
+    element.heldVelocity[key] = velocities?.[key] ?? 0
+    // Reconcile the prop's generator with the finger write (REQ-DRIVER-026). A LIVE declarative
+    // contention is RE-ANCHORED to the freshly-committed finger value so it drifts FROM here — never a
+    // backward jump to the generator's stale trajectory (review r10 major 29, G-INV-2). Otherwise the
+    // finger owns the value outright: a plain grab interrupts the pre-existing animation
+    // (REQ-GESTURE-012), and a SETTLED contention is finished, so its generator is dropped (else
+    // uiStepAll keeps forcing its value). Mirror of the reference driver.
+    const contention = element.contending[key]
+    const prop = element.props[key]
+    if (contention !== undefined && prop !== undefined && !prop.done) {
+      element.props[key] = {
+        // Re-anchor FROM the finger: seed a keyframe array's first element from-current so the drift
+        // continues from `finger`, never rewinding to keyframes[0] (major 25). Mirror of reference.
+        generator: uiStartGenerator(
+          contention.transition,
+          uiAnchorContentionToLive(contention.to),
+          finger,
+          0,
+        ),
+        elapsed: 0,
+        value: finger,
+        done: false,
+      }
+    } else {
+      if (prop !== undefined) delete element.props[key]
+      delete element.contending[key]
+    }
+  }
+  element.propKeys = Object.keys(element.props) // command-edge rebuild (REQ-DRIVER-021)
+  uiPrefillElementFrameSlots(element)
+  if (eventShape === 'bound-value-retarget') {
+    // A MotionValue set has no release edge. It commits through the same write lane, but is
+    // immediately quiescent unless another property was already active.
+    element.active = element.propKeys.length > 0 || element.heldCount > 0
+    return
+  }
+  // A gesture write holds the element unsettled (G-INV-7): a finger is down driving it, so it stays
+  // active with no animation until the matching release command clears the hold — never a spurious
+  // settle edge mid-drag (the reviewer-reproduced re-grab defect).
+  element.active = true
+}
+
+// The grab live-read ON the UI runtime (REQ-DRIVER-025). An in-flight prop re-samples its
+// generator at the current elapsed — pure by elapsed time (REQ-CORE-001), scalars copied out
+// immediately (the sample record is generator-owned and reused). Settled/never-animated ⇒
+// velocity 0. Gesture-edge only, never frame-executed.
+function uiLiveFor(
+  state: UiDriverState,
+  handle: number,
+  key: string,
+): LivePropState & { readonly writeVersion: number } {
+  'worklet'
+  const element = uiElementAt(state, handle)
+  // HELD-VELOCITY PRECEDENCE (REQ-DRIVER-025): a held (finger-down) prop reports the platform finger
+  // velocity its write carried EVEN when a contending declarative generator is in flight
+  // (REQ-DRIVER-026) — the release seed is the finger's number, never the generator's. The value is
+  // the live committed number (finger position, or the contending animation's drift). Read BEFORE the
+  // generator branch so contention can't leak the generator velocity into the release seam (per-prop
+  // since review r7 major 23). Mirror of the reference driver.
+  const heldV = element.heldVelocity[key]
+  if (heldV !== undefined) {
+    const base = element.committed[key]
+    if (base === undefined) {
+      // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN through the lane's
+      // designed transport (Phase 2); this throw is the payload, never the delivery.
+      throw new Error(`cannot read '${key}': it was never registered on this element.`)
+    }
+    return { value: base, velocity: heldV, writeVersion: element.writeVersion[key] ?? 0 }
+  }
+  const live = element.props[key]
+  if (live !== undefined && !live.done) {
+    const sample = live.generator.sample(live.elapsed)
+    return {
+      value: sample.value,
+      velocity: sample.velocity,
+      writeVersion: element.writeVersion[key] ?? 0,
+    }
+  }
+  const base = element.committed[key]
+  if (base === undefined) {
+    // ui-throw-ok: guarded by uiGuard/uiGuardLane — failures marshal to RN through the lane's
+    // designed transport (Phase 2); this throw is the payload, never the delivery.
+    throw new Error(`cannot read '${key}': it was never registered on this element.`)
+  }
+  // A settled or never-animated non-held prop has velocity 0 (REQ-DRIVER-025).
+  return { value: base, velocity: 0, writeVersion: element.writeVersion[key] ?? 0 }
+}
+
+// @frame-path — advance every active element by one frame (core's pure step), mirror into shared
+// values, quiesce settled elements. Returns whether ANY element is still in flight. Indexed loops
+// over the command-edge-maintained propKeys list: for..of iterators and Object.keys arrays per
+// element per vsync are frame-executed garbage (REQ-DRIVER-021).
+function uiStepAll(state: UiDriverState, elapsedMs: number): boolean {
+  'worklet'
+  let anyElementActive = false
+  for (let e = 0; e < state.elements.length; e++) {
+    const element = state.elements[e]!
+    if (!element.active) continue
+    let anyPropActive = false
+    for (let i = 0; i < element.propKeys.length; i++) {
+      const key = element.propKeys[i]!
+      const prop = element.props[key]! // propKeys mirrors props at every command edge
+      stepProp(prop, elapsedMs)
+      element.committed[key] = prop.value
+      const shared = element.shared[key]
+      if (shared !== undefined) shared.value = prop.value
+      if (prop.done && element.heldVelocity[key] === undefined) {
+        uiSetMirrorTarget(element, key, prop.value)
+        uiSetMirrorActive(element, key, false)
+      }
+      if (!prop.done) anyPropActive = true
+    }
+    if (element.path !== null) {
+      const path = element.path
+      stepProp(path.progress, elapsedMs)
+      applyPathProgressInto(
+        path.progress.value,
+        path.geometry,
+        path.progress.done,
+        path.sample,
+        path.scratch,
+      )
+      const sample = path.sample
+      if (element.committed.x !== undefined) {
+        element.committed.x = sample.x
+        const sharedX = element.shared.x
+        if (sharedX !== undefined) sharedX.value = sample.x
+      }
+      if (element.committed.y !== undefined) {
+        element.committed.y = sample.y
+        const sharedY = element.shared.y
+        if (sharedY !== undefined) sharedY.value = sample.y
+      }
+      if (path.geometry.rotationScale && element.committed.pathRotation !== undefined) {
+        element.committed.pathRotation = sample.pathRotation
+        const sharedR = element.shared.pathRotation
+        if (sharedR !== undefined) sharedR.value = sample.pathRotation
+      }
+      if (path.progress.done) element.path = null
+      else anyPropActive = true
+    }
+    // Quiesce once every prop settles (REQ-DRIVER-020) — UNLESS a gesture still holds a prop (a
+    // finger is down, no animation but unsettled, G-INV-7). heldCount is O(1) so this @frame-path
+    // check allocates nothing (REQ-DRIVER-021). A held element stays active until the matching
+    // release clears it, so no spurious settle edge fires mid-drag.
+    if (!anyPropActive && element.heldCount === 0) element.active = false
+    else anyElementActive = true
+  }
+  return anyElementActive
+}
+
+// T23 C (@frame-path): fill the changed-element prefix of the reusable emission transaction.
+// Public records do not exist on UI: this path copies into command-edge-prefilled primitive slots,
+// and the single envelope seal serializes them after every participant has committed.
+function uiEmitFrameValues(state: UiDriverState): void {
+  'worklet'
+  const emission = state.emission
+  for (let i = 0; i < state.elements.length; i++) {
+    const element = state.elements[i]!
+    if (!element.onUpdateArmed) continue
+    let changed = false
+    for (let k = 0; k < element.propKeys.length; k++) {
+      const key = element.propKeys[k]!
+      if (element.lastNotified[key] !== element.committed[key]) {
+        changed = true
+        break
+      }
+    }
+    // U8: path claims x/y/pathRotation out of `props` (they are not in propKeys). Still
+    // emit them — the pin's onUpdate sees path-driven latest values.
+    if (!changed) {
+      if (element.committed.x !== undefined && element.lastNotified.x !== element.committed.x)
+        changed = true
+      else if (element.committed.y !== undefined && element.lastNotified.y !== element.committed.y)
+        changed = true
+      else if (
+        element.committed.pathRotation !== undefined &&
+        element.lastNotified.pathRotation !== element.committed.pathRotation
+      )
+        changed = true
+    }
+    if (!changed) continue
+    let memberCount = 0
+    for (let k = 0; k < element.propKeys.length; k++) {
+      const key = element.propKeys[k]!
+      const value = element.committed[key]!
+      element.frameKeys[memberCount] = key
+      element.frameValues[memberCount] = value
+      memberCount += 1
+      element.lastNotified[key] = value
+    }
+    if (element.committed.x !== undefined && element.props.x === undefined) {
+      element.frameKeys[memberCount] = 'x'
+      element.frameValues[memberCount] = element.committed.x
+      memberCount += 1
+      element.lastNotified.x = element.committed.x
+    }
+    if (element.committed.y !== undefined && element.props.y === undefined) {
+      element.frameKeys[memberCount] = 'y'
+      element.frameValues[memberCount] = element.committed.y
+      memberCount += 1
+      element.lastNotified.y = element.committed.y
+    }
+    if (element.committed.pathRotation !== undefined && element.props.pathRotation === undefined) {
+      element.frameKeys[memberCount] = 'pathRotation'
+      element.frameValues[memberCount] = element.committed.pathRotation
+      memberCount += 1
+      element.lastNotified.pathRotation = element.committed.pathRotation
+    }
+    const entryIndex = emission.elementEntryCount
+    emission.elementHandles[entryIndex] = i
+    emission.elementGenerations[entryIndex] = element.registrationGeneration
+    emission.elementCommitSequences[entryIndex] = emission.commitSequence + 1
+    emission.elementMemberCounts[entryIndex] = memberCount
+    emission.elementEntryCount += 1
+  }
+}
+
+function uiStageSettledLayoutWatchers(state: UiDriverState): void {
+  'worklet'
+  if (state.layout === null) return
+  let retainedCount = 0
+  for (let watcherIndex = 0; watcherIndex < state.layoutSettleWatchers.length; watcherIndex += 1) {
+    const watcher = state.layoutSettleWatchers[watcherIndex]!
+    if (state.layout.registry.isSettled(watcher.id)) {
+      const stagedIndex = state.emission.layoutSettledCount
+      state.emission.layoutSettledKeys[stagedIndex] = watcher.key
+      state.emission.layoutSettledCount += 1
+    } else {
+      state.layoutSettleWatchers[retainedCount] = watcher
+      retainedCount += 1
+    }
+  }
+  state.layoutSettleWatchers.length = retainedCount
+}
+
+// alloc-ok:mailbox-envelope-emission — this is the one conditional UI serialization edge. Every
+// frame producer above fills reusable primitive slots; only a demanded non-empty turn constructs
+// the closed transport records and crosses once to the named JS receipt.
+function uiSealFrameEmission(
+  state: UiDriverState,
+  staleReports:
+    | readonly {
+        readonly source: string
+        readonly code: string
+        readonly detail: string
+      }[]
+    | null,
+): void {
+  'worklet'
+  const emission = state.emission
+  const layoutReleaseCount = state.layout?.releaseCount ?? 0
+  const staleReportCount = staleReports?.length ?? 0
+  const driverSettleCount = emission.driverSettleEpoch < 0 ? 0 : 1
+  const disposeCount = emission.disposeStaged ? 1 : 0
+  const eventCount =
+    emission.elementEntryCount +
+    layoutReleaseCount +
+    staleReportCount +
+    emission.layoutSettledCount +
+    driverSettleCount +
+    disposeCount
+  if (eventCount === 0) return
+
+  const mailboxDrainId = emission.commitSequence + 1
+  const entries = Array.from({ length: eventCount }) as UiFrameMailboxEntry[]
+  let entryIndex = 0
+  for (let stagedIndex = 0; stagedIndex < emission.elementEntryCount; stagedIndex += 1) {
+    const handle = emission.elementHandles[stagedIndex]!
+    const element = state.elements[handle]!
+    const memberCount = emission.elementMemberCounts[stagedIndex]!
+    const values = Array.from({ length: memberCount }) as UiFrameMailboxElementMember[]
+    for (let memberIndex = 0; memberIndex < memberCount; memberIndex += 1) {
+      values[memberIndex] = {
+        key: element.frameKeys[memberIndex]!,
+        kind: 'number',
+        value: element.frameValues[memberIndex]!,
+      }
+    }
+    entries[entryIndex] = {
+      kind: 'ELEMENT_HOST_COMMIT',
+      index: entryIndex,
+      driverId: state.driverId,
+      handleId: handle,
+      registrationGeneration: emission.elementGenerations[stagedIndex]!,
+      commitSequence: emission.elementCommitSequences[stagedIndex]!,
+      values,
+    }
+    entryIndex += 1
+  }
+  if (state.layout !== null) {
+    for (let releaseIndex = 0; releaseIndex < layoutReleaseCount; releaseIndex += 1) {
+      entries[entryIndex] = {
+        kind: 'LAYOUT_RELEASE',
+        index: entryIndex,
+        layoutRegistrationId: state.layout.releaseKeys[releaseIndex]!,
+      }
+      entryIndex += 1
+    }
+  }
+  if (staleReports !== null) {
+    for (let reportIndex = 0; reportIndex < staleReportCount; reportIndex += 1) {
+      entries[entryIndex] = {
+        kind: 'PROJECTION_STALE',
+        index: entryIndex,
+        report: staleReports[reportIndex]!,
+      }
+      entryIndex += 1
+    }
+  }
+  for (let settledIndex = 0; settledIndex < emission.layoutSettledCount; settledIndex += 1) {
+    entries[entryIndex] = {
+      kind: 'LAYOUT_SETTLE',
+      index: entryIndex,
+      layoutAnimationId: emission.layoutSettledKeys[settledIndex]!,
+    }
+    entryIndex += 1
+  }
+  if (emission.driverSettleEpoch >= 0) {
+    entries[entryIndex] = {
+      kind: 'DRIVER_SETTLE',
+      index: entryIndex,
+      driverId: state.driverId,
+      schedulerEpoch: emission.driverSettleEpoch,
+    }
+    entryIndex += 1
+  }
+  if (emission.disposeStaged) {
+    entries[entryIndex] = { kind: 'DRIVER_DISPOSED', index: entryIndex, driverId: state.driverId }
+  }
+
+  const endIndex = eventCount - 1
+  const envelope: UiFrameMailboxEnvelope = {
+    kind: 'CHANNEL_MAILBOX_TURN_ENVELOPE',
+    mailboxOrigin: 'UI',
+    mailboxDrainId,
+    driverId: state.driverId,
+    eventCount,
+    endIndex,
+    entries,
+    closingMarker: { kind: 'CHANNEL_MAILBOX_END', index: endIndex },
+  }
+
+  // Close/reset before the host call: test hosts may invoke scheduleOnRN synchronously, and
+  // callback reentry belongs to a later transaction even under that deliberately eager seam.
+  emission.elementEntryCount = 0
+  emission.layoutSettledCount = 0
+  emission.driverSettleEpoch = -1
+  emission.disposeStaged = false
+  if (state.layout !== null) state.layout.releaseCount = 0
+  scheduleOnRN(dispatchChannelMailboxTurnEnvelope, envelope)
+  // The drain id is consumed only once the envelope has crossed. Advancing the counter at seal
+  // start let a seal whose host crossing failed skip an id the JS side never receives, and every
+  // later envelope validated as "duplicate or out-of-order" (bugbash 2026-09-08, AUTO walk).
+  emission.commitSequence = mailboxDrainId
+}
+
+function uiManualGroupPeek(groupId: number): UiManualGroupSlot | null {
+  'worklet'
+  const g = globalThis as UiGlobal
+  if (g.__nativeMotionManualGroups === undefined) return null
+  return g.__nativeMotionManualGroups[groupId] ?? null
+}
+
+function uiPrefillManualGroupSlot(groupId: number, attendeeCapacity: number): void {
+  'worklet'
+  const g = globalThis as UiGlobal
+  if (g.__nativeMotionManualGroups === undefined) g.__nativeMotionManualGroups = {}
+  const existing = g.__nativeMotionManualGroups[groupId]
+  if (existing !== undefined) {
+    while (existing.attendees.length < attendeeCapacity) existing.attendees.push(-1)
+    return
+  }
+  const attendees: number[] = []
+  for (let i = 0; i < attendeeCapacity; i += 1) attendees.push(-1)
+  g.__nativeMotionManualGroups[groupId] = {
+    lastCommittedTimestampMs: 0,
+    pendingAbsoluteTimestampMs: 0,
+    attendeeCount: 0,
+    attendees,
+  }
+}
+
+function uiPrefillManualGroupSlotGuarded(
+  groupId: number,
+  attendeeCapacity: number,
+): UiOutcome<void> {
+  'worklet'
+  return uiGuard(() => {
+    uiPrefillManualGroupSlot(groupId, attendeeCapacity)
+  })
+}
+
+function uiCopyManualAttendeesIntoSlots(
+  groupId: number,
+  orderedAttendees: readonly number[],
+): void {
+  'worklet'
+  const group = uiManualGroupPeek(groupId)
+  if (group === null) return
+  const count = orderedAttendees.length
+  if (count > group.attendees.length) {
+    // ui-throw-ok: guarded by uiGuard (uiExecuteManualFrame) — the manual lane crosses
+    // synchronously, so the JS caller unwraps this as a loud lifecycle defect: a group step was
+    // handed more attendees than its command-edge prefill sized.
+    throw new Error('manual frame attendee batch exceeds preallocated group capacity.')
+  }
+  for (let i = 0; i < count; i += 1) group.attendees[i] = orderedAttendees[i]!
+  group.attendeeCount = count
+}
+
+function uiBeginManualFrame(
+  groupId: number,
+  elapsedMs: number,
+  orderedAttendees: readonly number[],
+): void {
+  'worklet'
+  uiCopyManualAttendeesIntoSlots(groupId, orderedAttendees)
+  const group = uiManualGroupPeek(groupId)
+  if (group === null) return
+  group.pendingAbsoluteTimestampMs = group.lastCommittedTimestampMs + elapsedMs
+  for (let i = 0; i < group.attendeeCount; i += 1) {
+    uiDriverStatePeek(group.attendees[i]!)
+  }
+}
+
+function uiInvokeManualParticipant(groupId: number, elapsedMs: number, driverId: number): void {
+  'worklet'
+  const state = uiDriverStatePeek(driverId)
+  if (state === null) return
+  if (uiManualGroupPeek(groupId) === null) return
+  // The caller's elapsed primitive steps the props directly. Deriving it as a difference of two
+  // accumulated absolute timestamps drifts by ULPs, and a delay or repeat-fold boundary that the
+  // reference driver crosses at an exact frame then lands one frame late here
+  // (driverParity.differential.test.ts, the repeatDelay and endless-repeat retarget rows).
+  uiStepAll(state, elapsedMs)
+  if (state.layout !== null) {
+    uiLayoutStep(state.layout, elapsedMs)
+  }
+}
+
+function uiRevokeManualParticipant(groupId: number, driverId: number): void {
+  'worklet'
+  void groupId
+  uiDriverStatePeek(driverId)
+}
+
+function uiCommitManualFrame(groupId: number): void {
+  'worklet'
+  const group = uiManualGroupPeek(groupId)
+  if (group === null) return
+  group.lastCommittedTimestampMs = group.pendingAbsoluteTimestampMs
+}
+
+function uiExecuteManualFrame(
+  groupId: number,
+  elapsedMs: number,
+  orderedAttendees: readonly number[],
+): UiOutcome<void> {
+  'worklet'
+  return uiGuard(() => {
+    uiBeginManualFrame(groupId, elapsedMs, orderedAttendees)
+    const group = uiManualGroupPeek(groupId)
+    if (group === null) return
+    for (let i = 0; i < group.attendeeCount; i += 1) {
+      const driverId = group.attendees[i]!
+      if (uiDriverStatePeek(driverId) === null) {
+        uiRevokeManualParticipant(groupId, driverId)
+        continue
+      }
+      uiInvokeManualParticipant(groupId, elapsedMs, driverId)
+      const state = uiDriverStatePeek(driverId)
+      if (state === null) continue
+      uiEmitFrameValues(state)
+      let staleReports:
+        | readonly {
+            readonly source: string
+            readonly code: string
+            readonly detail: string
+          }[]
+        | null = null
+      if (state.layout !== null) {
+        staleReports = state.layout.projection.tree.drainStaleReports()
+        uiStageSettledLayoutWatchers(state)
+      }
+      uiSealFrameEmission(state, staleReports)
+    }
+    uiCommitManualFrame(groupId)
+  })
+}
+
+class ManualFrameGroup {
+  constructor(
+    readonly groupId: number,
+    readonly participantDriverIds: number[],
+  ) {}
+
+  get size(): number {
+    return this.participantDriverIds.length
+  }
+
+  step(elapsedMs: number, invocationOrder?: readonly number[]): void {
+    const orderedAttendees = invocationOrder ?? this.participantDriverIds
+    // alloc-ok:manual-crossing — one frozen primitive attendee batch per group step
+    const frozen = Object.freeze(orderedAttendees.slice())
+    // The elapsed primitive crosses as authored; the UI slot owns the absolute clock so every
+    // participant steps by exactly what the caller advanced (no timestamp round trip).
+    unwrapUiOutcome(executeOnUIRuntimeSync(uiExecuteManualFrame)(this.groupId, elapsedMs, frozen))
+  }
+}
+
+export interface WorkletDriverOptions {
+  // Fired on the JS thread once per in-flight→settled edge (every element quiesced, frame callback
+  // deactivated). One O(1) UI→JS crossing per edge — never per frame.
+  readonly onAllSettled?: (() => void) | undefined
+  // When true the driver never runs a frame source; time advances only through explicit
+  // `step(elapsedMs)` calls with SYNCHRONOUS command crossings. This is the deterministic mode the
+  // on-device behavioral checks drive. Live drivers come from `useWorkletDriver` (REQ-DRIVER-011).
+  readonly manualStepping?: boolean
+  // The layout-identity flight + crossfade spring (one config drives both — registry law). Fixed
+  // at the layout slot's lazy creation; the registry default applies when omitted.
+  readonly layoutSpring?: SpringConfig
+}
+
+// One layout holder's animated-style outputs: the top-left-anchored transform correction, the
+// crossfade opacity, and z-lift as 0/1 (the screen maps it to zIndex/elevation). Written UI-side
+// every frame while the layout engine is in flight — never from JS.
+export interface LayoutIdentityHolderShared {
+  readonly translateX: SharedValue<number>
+  readonly translateY: SharedValue<number>
+  readonly scaleX: SharedValue<number>
+  readonly scaleY: SharedValue<number>
+  readonly opacity: SharedValue<number>
+  readonly zLifted: SharedValue<number>
+}
+
+/** One entry of the U6 W4 opacity witness: a held holder's token and its live painted opacity. */
+export interface LayoutIdentityHolderOpacityWitness {
+  readonly token: string
+  readonly opacity: number
+}
+
+// The driver's layout-identity surface (specs/LAYOUT-UITHREAD-PORT-BUILD-PACKET.md §The crossing
+// contract). Every lifecycle call crosses SYNCHRONOUSLY on one lane, so re-entry orderings
+// (detach then attach of the same token in one JS turn) can never reorder; per-frame work never
+// crosses. Rects are already validated + branded by the binding (fail-loud stays JS-side).
+/** Per-edge layout-identity options (REQ-API-035 MotionConfig policy → layoutId lane). */
+export interface WorkletLayoutFlightOptions {
+  readonly instant?: boolean
+  /** Component-tree address for a layoutId holder whose transform must feed descendants. */
+  readonly projectionComponentId?: string
+  /** Family-3: duration/ease (ms) for layoutId projection flight — data-only for worklets. */
+  readonly timing?: import('@unrulysystems/native-motion-core').TimingConfig
+  /** T22: per-flight spring (engine SpringConfig ms) — data-only for worklets; excludes timing. */
+  readonly spring?: import('@unrulysystems/native-motion-core').SpringConfig
+}
+
+export interface WorkletProjectionRect {
+  readonly x: number
+  readonly y: number
+  readonly width: number
+  readonly height: number
+}
+
+export interface WorkletProjectionShared {
+  readonly translateX: SharedValue<number>
+  readonly translateY: SharedValue<number>
+  readonly scaleX: SharedValue<number>
+  readonly scaleY: SharedValue<number>
+  // NaN denotes no radius correction. MotionView formats the actual host style at its boundary.
+  readonly borderRadiusX: SharedValue<number>
+  readonly borderRadiusY: SharedValue<number>
+  readonly targetDeltaScaleX: SharedValue<number>
+  readonly targetDeltaScaleY: SharedValue<number>
+  readonly treeScaleX: SharedValue<number>
+  readonly treeScaleY: SharedValue<number>
+}
+
+/** Primitive address of one UI-runtime projection record for a host-layout frame callback. */
+export interface WorkletProjectionHostFeed {
+  readonly driverId: number
+  readonly componentId: string
+}
+
+/** UI-runtime projection-tree lifecycle, separate from layoutId holder identity. */
+export interface WorkletDriverProjection {
+  attach(
+    componentId: string,
+    parentId: string | null,
+    projectionParticipant: boolean,
+    borderRadius?: number | null,
+  ): void
+  detach(componentId: string): void
+  /**
+   * Register, replace, or clear (null) the host's live radius feed (seal r13, F4): an
+   * animated/gesture/bound radius channel's driver cell, read every frame so the tree's
+   * correction answers the CURRENT authored radius. Unmount compaction rides detach.
+   */
+  setProjectionRadiusFeed(componentId: string, cell: SharedValue<number> | null): void
+  setProjection(
+    componentId: string,
+    source: WorkletProjectionRect,
+    target: WorkletProjectionRect,
+    progress: number,
+  ): void
+  sharedFor(componentId: string): WorkletProjectionShared
+  hostFeedFor(componentId: string): WorkletProjectionHostFeed
+}
+
+export interface WorkletDriverLayout {
+  attach(
+    id: string,
+    token: LayoutIdToken,
+    rect: WindowSpaceRect | null,
+    options?: WorkletLayoutFlightOptions,
+  ): LayoutIdentityRole
+  commitRect(
+    id: string,
+    token: LayoutIdToken,
+    rect: WindowSpaceRect,
+    options?: WorkletLayoutFlightOptions,
+  ): boolean
+  // Returns whether this detach retained the holder as an exiting reverse-flight record. The
+  // lifecycle uses this current edge result rather than an historical attach role.
+  detach(id: string, token: LayoutIdToken, options?: WorkletLayoutFlightOptions): boolean
+  // Get-or-create: styles bind at render time, before the first attach lands at onLayout; a
+  // never-attached holder's record sits at rest pose.
+  sharedFor(id: string, token: LayoutIdToken): LayoutIdentityHolderShared
+  // U6 W4 verification witness (the device proof cards' crossfade row): the live painted opacity
+  // of every holder record the identity still holds — the mounted lead AND an exiting retained
+  // follower, never a departed ghost. A lifecycle-edge sync read, never per frame; an unknown or
+  // dropped id witnesses empty.
+  opacityWitnessFor(id: string): readonly LayoutIdentityHolderOpacityWitness[]
+  releasable(id: string, token: LayoutIdToken): boolean
+  isSettled(id: string): boolean
+  holds(id: string, token: LayoutIdToken): boolean
+  isLead(id: string, token: LayoutIdToken): boolean
+  // Fires once when this identity reaches rest, independent of other active elements or layout
+  // identities. An already-settled identity delivers synchronously at registration.
+  subscribeSettled(id: string, onSettled: () => void): () => void
+  // Couple an exiting holder's release to a presence callback: fires EXACTLY ONCE when the
+  // registry reports the crossfade is done with the holder (first report wins on both runtimes);
+  // returns an uncouple for unmount-before-settle.
+  coupleRelease(id: string, token: LayoutIdToken, safeToRemove: () => void): () => void
+  readonly projection: WorkletDriverProjection
+}
+
+// The native driver + the binding surface the smoke/screens need beyond the core seam: per-prop shared
+// values for animated styles. `driver` satisfies core's `Driver` contract exactly.
+export interface WorkletDriverBinding {
+  readonly driver: WorkletDriver
+  sharedFor(handle: ElementHandle, key: string): SharedValue<number>
+  /**
+   * Legacy test/check-surface adapter. Production bindings call `driver.write` with the explicit
+   * retarget shape; this adapter delegates to that same seam and never crosses to UI directly.
+   */
+  writeBoundValue(handle: ElementHandle, values: Readonly<Record<string, number>>): void
+  /**
+   * REQ-DRIVER-034: subscribe to this driver's dual-authority `cannot write bound value`
+   * refusals delivered on the SCHEDULED lane. The synchronous lane still throws the refusal
+   * into the caller's catch; the scheduled lane cannot marshal a throw back, so the refusal is
+   * delivered here (one JS task later, like every UI-originated dispatch) instead of retiring
+   * the admitted flight. Returns the unsubscribe; unsubscribing after dispose() is a no-op.
+   */
+  onBoundValueWriteRefusal(listener: (handle: ElementHandle, key: string) => void): () => void
+  /** The current command/hold state for a mounted property, consumed only by layout mirrors. */
+  propertyStateFor?(handle: ElementHandle, key: string): WorkletDriverPropertyState
+  /**
+   * T23 C: arm/clear the per-frame committed-values listener for one element (the onUpdate
+   * marshal). While armed, JS receives ONE primitive payload per frame in which any committed
+   * value changed — the whole registered record each time (the pin's latest-values contract).
+   * Delivery is post-commit fire-and-forget observability; null clears the arm.
+   */
+  setFrameValuesListener(
+    handle: ElementHandle,
+    listener: ((values: Readonly<Record<string, number>>) => void) | null,
+  ): void
+  readonly layout: WorkletDriverLayout
+  // Quiesce-before-unmount (review round 4 major 5): deletes this driver's UI-runtime state —
+  // elements, the layout slot, every holder output. `useWorkletDriver` calls it automatically at
+  // component unmount; manual (deterministic) drivers call it when their rig is done. Idempotent.
+  //
+  // Post-dispose contract: constructive calls (register/command/step/attach/couple/reads of element
+  // state) fail loud — they are use-after-free. Teardown-convergent calls are DEFINED, not defects,
+  // because React deletes a subtree parent-first: the owning hook's dispose() cleanup runs before
+  // descendant unmount effects, which still call deactivate/detach on the way out (device-observed
+  // release FATAL, 2026-07-10: assertLive→setActive→MotionView unmount inside
+  // commitPassiveUnmountEffectsInsideOfDeletedTree). dispose() already deleted everything those
+  // calls would touch, so: setActive(false) and layout.detach no-op; a late async measureInWindow
+  // completion's layout.commitRect is dropped; layout.releasable/isSettled read true (the
+  // registry's dropped-id semantics extended to a dropped driver).
+  dispose(): void
+  // Liveness read (REQ-DRIVER-022's non-throwing class): true once dispose() ran. The hook's
+  // effect setup consults it to fail loud on a StrictMode replay (strictModeReplay.ts).
+  isDisposed(): boolean
+}
+
+// Internal live-loop wiring, provided only by `useWorkletDriver`: activate the (single) frame
+// callback when a command lands.
+interface LiveLoopHooks {
+  readonly nextEpoch: () => number
+  readonly startLoop: () => void
+}
+
+let nextDriverId = 0
+const identityValueChannelDriverIds = new WeakMap<WorkletDriverBinding, number>()
+
+/** Engine-internal identity lookup; the public/native binding shape does not expose driver ids. */
+export function identityValueChannelDriverIdForBinding(
+  binding: WorkletDriverBinding,
+): number | null {
+  return identityValueChannelDriverIds.get(binding) ?? null
+}
+
+function createDriverCore(
+  options: WorkletDriverOptions,
+  live: LiveLoopHooks | null,
+): {
+  binding: WorkletDriverBinding
+  driverId: number
+} {
+  const driverId = nextDriverId++
+  const manual = options.manualStepping === true
+  const privateGroup = new ManualFrameGroup(driverId, [driverId])
+  if (manual) {
+    unwrapUiOutcome(executeOnUIRuntimeSync(uiPrefillManualGroupSlotGuarded)(driverId, 1))
+  }
+  if (!manual && live === null) {
+    // REQ-DRIVER-011: the live frame source is the hook-owned useFrameCallback; there is no
+    // frame-source-less live mode to fall back to.
+    throw new Error(
+      'live worklet drivers are created via useWorkletDriver(); use manualStepping for the deterministic mode.',
+    )
+  }
+  // JS-side mirror of each element's shared values so sharedFor() needs no UI-runtime round trip.
+  const sharedByHandle: Record<string, SharedValue<number>>[] = []
+  const layoutMirrorByHandle: Record<string, WorkletDriverPropertyState>[] = []
+  // The live write lane is asynchronous but gesture-edge reads are synchronous. Mirror only the
+  // newest queued recognizer write per prop; `liveFor` uses the UI-applied version to distinguish a
+  // genuinely pending write from an applied write whose value may since have drifted under
+  // contention. The mirror never mutates UI state, so command/write/release ordering stays intact.
+  const pendingWriteByHandle: Record<string, PendingGestureWrite>[] = []
+  // T23 (device crash 3): the JS-side registration snapshot per handle. Live mode QUEUES the
+  // register cross while committed() reads through the immediate sync lane, so a same-turn
+  // read (a label entrance's discrete/color retarget in the mounting render) outruns the
+  // push. A never-stepped element's committed values ARE its registration values — steps run
+  // on the UI runtime BEHIND the same queue — so serving the snapshot is exact, never a
+  // fallback; truly-unknown handles stay loud via this array's own range.
+  const registeredCommittedByHandle: Record<string, number>[] = []
+  let nextGestureWriteVersion = 1
+
+  // Crossing discipline: the live path schedules (fire-and-forget, O(1) per command,
+  // REQ-DRIVER-013); the manual/verification path normally crosses SYNCHRONOUSLY so
+  // command→step→read sequences are strictly ordered. The exception is a command transitively
+  // invoked by a UI→JS callback: it queues even in manual mode to avoid a `runSyncSerialized`
+  // re-entry while the UI thread is in `triggerUI`. A queued command preserves FIFO order with its
+  // originating callback; direct manual calls retain their deterministic synchronous contract.
+  // Crossing works return a UiOutcome (their bodies ride uiGuardLane): the sync lane unwraps it
+  // JS-side; the scheduled lane's failures marshal to RN through the settle-dispatch channel and
+  // retire the affected element (iOS AUTO SIGABRT Phase 2) — never a UI-runtime rethrow.
+  function cross(work: (synchronous: boolean) => UiOutcome<void>): void {
+    const synchronous = manual && uiOriginatedCallbackDepth === 0
+    if (synchronous) unwrapUiOutcome(executeOnUIRuntimeSync(() => work(true))())
+    // Named worklet + worklet arg (not an anonymous UI lambda that captures another worklet —
+    // diamond-DAG hang class). Pass `work` as a scheduleOnUI argument (branded worklet ref).
+    else scheduleOnUI(invokeAsyncCrossWork, work)
+  }
+
+  // Disposal latch: CONSTRUCTIVE use after dispose() is a lifecycle defect — fail loud instead of
+  // silently resurrecting an empty UI record through uiDriverState's get-or-create. Teardown-
+  // convergent calls (setActive(false), layout.detach, a late commitRect, liveness reads) are
+  // instead defined no-ops/terminal values — see the WorkletDriverBinding.dispose() contract.
+  let disposed = false
+  function assertLive(operation: string): void {
+    if (disposed) {
+      throw new Error(
+        `worklet driver ${String(driverId)} is disposed: ${operation} after dispose() is a lifecycle defect.`,
+      )
+    }
+  }
+
+  // JS-side Transition → plain-data resolution, single-sourced through the COMPONENT converters —
+  // identical selection logic to the reference driver's startGenerator (spring is the fallback;
+  // 'tween' for an explicit tween OR an authored duration-only untyped bag, REQ-TIMING-006).
+  function toPlainTransition(rawTransition: PropTransition): PlainTransition {
+    // The shared core adapter already detached and froze this transition. Re-capturing here would
+    // reintroduce backend-specific materialization after the REQ-DRIVER-030 boundary.
+    const transition = rawTransition
+    // U7b: the GLOBAL instant window (the pin's MotionGlobalConfig.instantAnimations consult,
+    // motion-dom@12.42.2 motion-value.ts:100-109) — while open, EVERY starting transition takes
+    // the U7a instant commit with delay ZEROED (the pin zeroes delay only for the global flag;
+    // the authored type:false below honors it — F2). Read HERE, JS-side, before the marshaling —
+    // the pin's inertia lane honors the flag too, so this precedes every kind.
+    if (isInstantWindowOpen()) {
+      return { kind: 'instant', delayMs: 0 }
+    }
+    // A controller-resolved default (DefaultTransition, consult agent-2026-07-19-e715fd) normalizes
+    // HERE, JS-side, mirroring the reference driver's normalizeTransition (no cross-driver skew): a
+    // `type:'keyframes'` default → an equivalent tween (an ABSENT `ease` is preserved so the keyframes
+    // generator keeps its intrinsic per-segment easeInOut for the 800ms default); a spring default
+    // carries `restSpeed` into the SpringConfig settle threshold. Since U7c (REQ-SPRING-014) an
+    // authored spring may carry restSpeed/restDelta too — the same extraction reads either, and
+    // toSpringConfig's own passthrough agrees. The UI runtime stays config-only; it never sees the
+    // union.
+    const restSpeed =
+      transition.type === 'spring' && 'restSpeed' in transition ? transition.restSpeed : undefined
+    const authored: Transition | InertiaTransition =
+      transition.type === 'keyframes'
+        ? {
+            type: 'tween',
+            duration: transition.duration,
+            ...(transition.ease !== undefined ? { ease: transition.ease } : {}),
+            ...(transition.delay !== undefined ? { delay: transition.delay } : {}),
+            ...(transition.repeat !== undefined ? { repeat: transition.repeat } : {}),
+            ...(transition.repeatType !== undefined ? { repeatType: transition.repeatType } : {}),
+            ...(transition.repeatDelay !== undefined
+              ? { repeatDelay: transition.repeatDelay }
+              : {}),
+          }
+        : transition
+    // Every plain transition carries the keyframes config too (REQ-API-033): a keyframe ARRAY target
+    // selects it UI-side, matching the reference driver's `toKeyframesConfig`. `explicitSpring` carries
+    // the LITERAL type so the array branch can distinguish an explicit spring from the omitted-type
+    // fallback (which resolves to `kind: 'spring'` when no `duration` is authored but must route
+    // arrays to keyframes — review major 8).
+    // An inertia transition never interpolates a keyframe array — it short-circuits BEFORE the
+    // keyframes converter, which would refuse the unknown type (R16).
+    if (authored.type === 'inertia')
+      return {
+        kind: 'inertia',
+        config: {
+          power: authored.power,
+          timeConstant: authored.timeConstant,
+          bounceStiffness: authored.bounceStiffness,
+          bounceDamping: authored.bounceDamping,
+          restDelta: authored.restDelta,
+          restSpeed: authored.restSpeed,
+          min: authored.min,
+          max: authored.max,
+        },
+        explicitSpring: false,
+      }
+    // U7a + transition-default-selection F5: the instant lane short-circuits BEFORE the keyframes
+    // converter (which owns no `false` type) — the pin's guard is type-independent
+    // (`type: false` OR `duration === 0 && !repeatDelay`, motion-value.ts:89-98). Plain data
+    // only: the delay rebase shift in ms.
+    if (authored.type === false || isDurationZeroInstantTransition(authored)) {
+      return { kind: 'instant', delayMs: toDelayMs(authored) }
+    }
+    const keyframes = toKeyframesConfig(authored)
+    // T18-a (REQ-API-049): the repeat family resolves JS-side into plain scalars, exactly like every
+    // other config — the UI runtime receives numbers and a string, never the authored object. `null`
+    // (not `undefined`) marks an inert fold so the marshaled shape stays a closed, total record.
+    const repeat = toRepeatFoldOptions(authored)
+    // T18-b (REQ-TIMING-004 / REQ-API-050): the delay shift crosses seconds→ms HERE, JS-side,
+    // through the same `toDelayMs` boundary the reference driver reads — the UI runtime receives
+    // a plain number, never the authored seconds.
+    const delayMs = toDelayMs(authored)
+    if (authored.type === 'tween' || isTimingLaneTransition(authored))
+      return {
+        kind: 'tween',
+        // REQ-TIMING-006 + transition-default-selection F1/F6: the timing lane — a typed tween OR
+        // an authored duration-ONLY bag OR a defined ease-only bag (F6's `isTimingLaneTransition`,
+        // the pin's defined-typeless lane at the 300ms default, JSAnimation.ts:106-116) — resolves
+        // through the ONE config builder (`toTimingLaneConfig`): the pin's `animateMotionValue`
+        // `ease: "easeOut"` base (motion-dom@12.42.2 motion-value.ts:45-49) whenever no ease
+        // spelling is authored, the authored ease verbatim for the ease-only form. The generator
+        // default [0.25, 0.1, 0.35, 1] (REQ-TIMING-002) no longer governs an authored
+        // typed tween; it survives only as the pin's per-key default tween. Never the old
+        // omitted-type duration-spring (device-measured peak 1.046, u7a-2026-08-18), and never the
+        // REQ-SPRING-003 generic spring for an ease-only bag.
+        config: toTimingLaneConfig(authored),
+        keyframes,
+        explicitSpring: false,
+        repeat,
+        delayMs,
+      }
+    return {
+      kind: 'spring',
+      config:
+        restSpeed !== undefined
+          ? { ...toSpringConfig(authored), restSpeed }
+          : toSpringConfig(authored),
+      keyframes,
+      explicitSpring: authored.type === 'spring',
+      repeat,
+      delayMs,
+    }
+  }
+
+  const backend: Omit<PreparedDriver, 'write'> & {
+    write(
+      handle: ElementHandle,
+      values: Readonly<Record<string, number>>,
+      velocities?: Readonly<Record<string, number>>,
+      eventShape?: WorkletDriverWriteShape,
+    ): void
+  } = {
+    register(initial) {
+      assertLive('register')
+      const shared: Record<string, SharedValue<number>> = {}
+      const layoutMirror: Record<string, WorkletDriverPropertyState> = {}
+      for (const key of Object.keys(initial)) {
+        shared[key] = makeMutable(initial[key]!)
+        layoutMirror[key] = { active: makeMutable(false), target: makeMutable(initial[key]!) }
+      }
+      const handle = sharedByHandle.length as ElementHandle
+      sharedByHandle.push(shared)
+      layoutMirrorByHandle.push(layoutMirror)
+      pendingWriteByHandle.push({})
+      registeredCommittedByHandle.push({ ...initial })
+      const committed = { ...initial }
+      cross((synchronous) => {
+        'worklet'
+        return uiGuardLane(
+          synchronous,
+          () => {
+            const state = uiDriverState(driverId)
+            state.elements.push({
+              active: false,
+              heldCount: 0,
+              committed,
+              heldVelocity: {},
+              writeVersion: {},
+              props: {},
+              contending: {},
+              propKeys: [],
+              shared,
+              layoutMirror,
+              onUpdateArmed: false,
+              lastNotified: {},
+              registrationGeneration: 0,
+              frameKeys: [],
+              frameValues: [],
+              path: null,
+            })
+            // alloc-ok: registration edge — grow the emission transaction's entry capacity to
+            // cover the new element; the frame only fills these slots by index.
+            state.emission.elementHandles.push(0)
+            state.emission.elementGenerations.push(0)
+            state.emission.elementCommitSequences.push(0)
+            state.emission.elementMemberCounts.push(0)
+          },
+          driverId,
+          undefined,
+          false, // register: a fresh element push; the fold cannot reach this lane
+        )
+      })
+      return handle
+    },
+
+    command(handle, command) {
+      assertLive('command')
+      let plain: PlainCommand
+      if (command.kind === 'stop') {
+        plain = { kind: 'stop' }
+      } else if (command.kind === 'start') {
+        plain = {
+          kind: 'start',
+          targets: marshalStartTargets(command.targets, toPlainTransition),
+          // Carry the release marker across the marshal as a definite boolean (plain data, no undefined
+          // over the worklet boundary) so the UI runtime honors ownership (r8 major 24).
+          releasesGesture: command.releasesGesture,
+          ...(command.path === undefined
+            ? {}
+            : {
+                path: {
+                  fromX: command.path.fromX,
+                  fromY: command.path.fromY,
+                  toX: command.path.toX,
+                  toY: command.path.toY,
+                  peak: command.path.peak,
+                  signedStrength: command.path.signedStrength,
+                  rotationScale: command.path.rotationScale,
+                  transition: toPlainTransition(command.path.transition),
+                },
+              }),
+        }
+      } else {
+        plain = {
+          kind: 'retarget',
+          targets: marshalRetargetTargets(command.targets),
+          transition: toPlainTransition(command.transition),
+          ...(command.targetTransitions === undefined
+            ? {}
+            : {
+                targetTransitions: marshalRetargetTransitions(
+                  command.targetTransitions,
+                  toPlainTransition,
+                )!,
+              }),
+        }
+      }
+      const loopEpoch = live !== null && plain.kind !== 'stop' ? live.nextEpoch() : null
+      cross((synchronous) => {
+        'worklet'
+        return uiGuardLane(
+          synchronous,
+          () => {
+            const state = uiDriverState(driverId)
+            // Stamp the epoch BEFORE the apply: a failed command re-arms the settle edge from
+            // inside uiGuardLane — with a retire for a genuine lane fault, without one for a fold
+            // refusal (which mutated nothing) — and that re-arm must not be dropped as stale by
+            // the epoch gate, because the failed command is still the latest intent (seal r2, F1).
+            if (loopEpoch !== null) state.loopEpoch = loopEpoch
+            uiApplyCommand(state, handle, plain)
+          },
+          driverId,
+          handle as number,
+          // uiApplyCommand builds every generator before committing anything, on both the start
+          // and retarget cases, so a refusal here leaves the element exactly as it found it.
+          true,
+        )
+      })
+      if (loopEpoch !== null) live!.startLoop()
+    },
+
+    step(elapsedMs) {
+      assertLive('step')
+      // Legacy single-member adapter: the group owns the one JS→UI crossing. Multi-member groups
+      // must call ManualFrameGroup.step directly.
+      if (privateGroup.size !== 1) {
+        throw new Error(
+          `worklet driver ${String(driverId)} belongs to a multi-member ManualFrameGroup: call group.step instead of driver.step.`,
+        )
+      }
+      privateGroup.step(elapsedMs)
+    },
+
+    committed(handle) {
+      assertLive('committed')
+      // Unknown-handle loudness moves JS-side (this driver assigned every valid handle); the
+      // UI read returns null while the register cross is still queued and the snapshot serves.
+      const registered = registeredCommittedByHandle[handle as number]
+      if (registered === undefined) {
+        throw new Error(
+          `unknown element handle ${String(handle)}: it was never registered on this driver.`,
+        )
+      }
+      const outcome = unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverState(driverId)
+            if ((handle as number) >= state.elements.length) return null
+            return { ...uiElementAt(state, handle as number).committed }
+          })
+        })(),
+      )
+      return outcome === null ? { ...registered } : outcome
+    },
+
+    setActive(handle, active) {
+      // Deleted-tree ordering: the owner's dispose() runs before a child MotionView's unmount calls
+      // setActive(false). The element record is already gone — deactivation is subsumed, and the
+      // early return must not cross (uiDriverState's get-or-create would resurrect the record).
+      // Activation stays fail-loud: animating a disposed driver is use-after-free.
+      if (disposed && !active) return
+      assertLive('setActive')
+      const loopEpoch = active && live !== null ? live.nextEpoch() : null
+      cross((synchronous) => {
+        'worklet'
+        return uiGuardLane(
+          synchronous,
+          () => {
+            const state = uiDriverState(driverId)
+            uiElementAt(state, handle as number).active = active
+            if (loopEpoch !== null) state.loopEpoch = loopEpoch
+          },
+          driverId,
+          handle as number,
+          false, // setActive: a flag write, not a build; the fold cannot reach this lane
+        )
+      })
+      if (loopEpoch !== null) live!.startLoop()
+    },
+
+    isActive(handle) {
+      assertLive('isActive')
+      return unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            return uiElementAt(uiDriverState(driverId), handle as number).active
+          })
+        })(),
+      )
+    },
+
+    // The one event-write lane (REQ-DRIVER-024/-029): recognizer writes and bound-value retargets
+    // ride the same ordered crossing. The shape decides ownership; no secondary binding seam.
+    // Neither event starts an animation (the declarative/release command arms the loop).
+    write(handle, values, velocities, eventShape = 'gesture-hold') {
+      assertLive('write')
+      const writeVersion =
+        eventShape === 'gesture-hold' ? nextGestureWriteVersion++ : nextGestureWriteVersion
+      const keys = Object.keys(values)
+      const registered = sharedByHandle[handle as number]
+      const pending = pendingWriteByHandle[handle as number]
+      // Do not mirror a malformed multi-prop write: uiApplyWrite validates the whole write before
+      // mutation, so reflecting only its valid subset would manufacture a state the UI rejects.
+      let canMirror = registered !== undefined && pending !== undefined
+      for (const key of keys) {
+        if (registered?.[key] === undefined) canMirror = false
+      }
+      cross((synchronous) => {
+        'worklet'
+        return uiGuardLane(
+          synchronous,
+          () => {
+            uiApplyWrite(
+              uiDriverState(driverId),
+              handle as number,
+              values,
+              velocities,
+              writeVersion,
+              eventShape,
+            )
+          },
+          driverId,
+          handle as number,
+          // uiApplyWrite re-anchors a contending generator INSIDE its per-key mutation loop, so
+          // a refusal there is half-applied and must retire (round-10 BLOCKING 2).
+          false,
+        )
+      })
+      if (eventShape === 'gesture-hold' && canMirror && pending !== undefined) {
+        for (const key of keys) {
+          pending[key] = {
+            version: writeVersion,
+            value: values[key]!,
+            velocity: velocities?.[key] ?? 0,
+          }
+        }
+      }
+    },
+
+    // The grab live-read (REQ-DRIVER-025): synchronous — the begin seed is needed before the next
+    // recognizer event lands. O(1) per gesture edge. A queued recognizer write is covered by the
+    // per-prop version fence below, so terminal reads cannot overtake it. A sync read can still
+    // overtake a JUST-scheduled release command; it then reads the pre-release value — exactly what
+    // the element still renders, so an immediate re-grab's C0 seam holds.
+    liveFor(handle, key) {
+      assertLive('liveFor')
+      const liveRead = unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            return uiLiveFor(uiDriverState(driverId), handle as number, key)
+          })
+        })(),
+      )
+      const pendingByKey = pendingWriteByHandle[handle as number]
+      if (pendingByKey !== undefined) {
+        const pending = pendingByKey[key]
+        if (pending === undefined) return { value: liveRead.value, velocity: liveRead.velocity }
+        if (liveRead.writeVersion < pending.version) {
+          return { value: pending.value, velocity: pending.velocity }
+        }
+        delete pendingByKey[key]
+      }
+      return { value: liveRead.value, velocity: liveRead.velocity }
+    },
+  }
+
+  const preparedDriver = adaptPreparedDriver(backend, () => {
+    assertLive('command')
+  })
+  const driver: WorkletDriver = {
+    ...preparedDriver,
+    write(handle, values, velocities, eventShape = 'gesture-hold') {
+      if (eventShape === 'gesture-hold') {
+        preparedDriver.write(handle, values, velocities)
+        return
+      }
+      backend.write(handle, values, velocities, eventShape)
+    },
+  }
+
+  // ——— The layout-identity surface (specs/LAYOUT-UITHREAD-PORT-BUILD-PACKET.md) ———
+  // Lifecycle crossings are SYNCHRONOUS on one lane: they are O(1) per mount/commit/unmount edge,
+  // and a scheduled lane would let a re-attach of a token overtake its own detach. Per-frame work
+  // never crosses; the frame callback (or manual step) carries release edges via scheduleOnRN.
+  const layoutSpring = options.layoutSpring
+  const layoutSharedByHolder = new Map<string, LayoutIdentityHolderShared>()
+  // Projection-tree output belongs to a concrete Motion component, not a layoutId holder. Keep
+  // its shared cells on JS solely for render-time lookup; their values are written only by the UI
+  // ledger in uiLayoutEngine.
+  const projectionSharedByComponent = new Map<string, WorkletProjectionShared>()
+  let nextCouplingKey = 0
+  const layoutCallbacks: LayoutCallbackRegistry = {
+    release: new Map<number, () => void>(),
+    settled: new Map<number, () => void>(),
+  }
+  layoutCallbacksByDriver.set(driverId, layoutCallbacks)
+  let nextSettleWatcherKey = 0
+  const layoutReleaseCallbacks = layoutCallbacks.release
+  const layoutSettleCallbacks = layoutCallbacks.settled
+
+  // JSON-encode the pair: unambiguous for any id/token content (no separator to collide with) and
+  // text-safe (review round 2026-07-09: a NUL-byte separator made this file classify as binary).
+  function layoutHolderKey(id: string, token: LayoutIdToken): string {
+    return JSON.stringify([id, String(token)])
+  }
+
+  // Get-or-create: animated styles must bind holder outputs at RENDER time, before the first
+  // attach lands at onLayout — a throwing lookup would invert the render→layout order. A record
+  // for a never-attached holder just sits at rest pose (identity transform, opacity 1, no lift).
+  function ensureHolderShared(id: string, token: LayoutIdToken): LayoutIdentityHolderShared {
+    const holderKey = layoutHolderKey(id, token)
+    let shared = layoutSharedByHolder.get(holderKey)
+    if (shared === undefined) {
+      shared = {
+        translateX: makeMutable(0),
+        translateY: makeMutable(0),
+        scaleX: makeMutable(1),
+        scaleY: makeMutable(1),
+        opacity: makeMutable(1),
+        zLifted: makeMutable(0),
+      }
+      layoutSharedByHolder.set(holderKey, shared)
+    }
+    return shared
+  }
+
+  function ensureProjectionShared(componentId: string): WorkletProjectionShared {
+    let shared = projectionSharedByComponent.get(componentId)
+    if (shared === undefined) {
+      shared = {
+        translateX: makeMutable(0),
+        translateY: makeMutable(0),
+        scaleX: makeMutable(1),
+        scaleY: makeMutable(1),
+        borderRadiusX: makeMutable(Number.NaN),
+        borderRadiusY: makeMutable(Number.NaN),
+        targetDeltaScaleX: makeMutable(1),
+        targetDeltaScaleY: makeMutable(1),
+        treeScaleX: makeMutable(1),
+        treeScaleY: makeMutable(1),
+      }
+      projectionSharedByComponent.set(componentId, shared)
+    }
+    return shared
+  }
+
+  const layout: WorkletDriverLayout = {
+    projection: {
+      attach(componentId, parentId, projectionParticipant, borderRadius = null) {
+        assertLive('layout.projection.attach')
+        const outputs = ensureProjectionShared(componentId) as unknown as UiProjectionOutputs
+        unwrapUiOutcome(
+          executeOnUIRuntimeSync(() => {
+            'worklet'
+            return uiGuard(() => {
+              uiProjectionAttach(
+                uiLayoutSlot(uiDriverState(driverId), layoutSpring),
+                componentId,
+                parentId,
+                outputs,
+                projectionParticipant,
+                borderRadius,
+              )
+            })
+          })(),
+        )
+      },
+
+      detach(componentId) {
+        // React's child-before-parent cleanup is a tree invariant. A disposed driver already
+        // owns all records, so a trailing unmount is convergent just like layout.detach.
+        if (disposed) return
+        assertLive('layout.projection.detach')
+        projectionSharedByComponent.delete(componentId)
+        unwrapUiOutcome(
+          executeOnUIRuntimeSync(() => {
+            'worklet'
+            return uiGuard(() => {
+              uiProjectionDetach(uiLayoutSlot(uiDriverState(driverId), layoutSpring), componentId)
+            })
+          })(),
+        )
+      },
+
+      setProjectionRadiusFeed(componentId, cell) {
+        assertLive('layout.projection.setProjectionRadiusFeed')
+        unwrapUiOutcome(
+          executeOnUIRuntimeSync(() => {
+            'worklet'
+            return uiGuard(() => {
+              uiSetProjectionRadiusFeed(
+                uiLayoutSlot(uiDriverState(driverId), layoutSpring),
+                componentId,
+                cell,
+              )
+            })
+          })(),
+        )
+      },
+
+      setProjection(componentId, source, target, progress) {
+        assertLive('layout.projection.setProjection')
+        const loopEpoch = live?.nextEpoch() ?? null
+        unwrapUiOutcome(
+          executeOnUIRuntimeSync(() => {
+            'worklet'
+            return uiGuard(() => {
+              const state = uiDriverState(driverId)
+              if (loopEpoch !== null) state.loopEpoch = loopEpoch
+              uiProjectionSetProjection(
+                uiLayoutSlot(state, layoutSpring),
+                componentId,
+                source,
+                target,
+                progress,
+              )
+            })
+          })(),
+        )
+        if (loopEpoch !== null) live!.startLoop()
+      },
+
+      sharedFor(componentId) {
+        assertLive('layout.projection.sharedFor')
+        return ensureProjectionShared(componentId)
+      },
+
+      hostFeedFor(componentId) {
+        assertLive('layout.projection.hostFeedFor')
+        // This is only an address. The host-layout channel reads/writes the UI-global ledger
+        // directly on every frame; no function or JS→UI crossing crosses this boundary.
+        return { driverId, componentId }
+      },
+    },
+
+    attach(id, token, rect, options) {
+      assertLive('layout.attach')
+      const shared = ensureHolderShared(id, token)
+      const outputs = shared as unknown as UiLayoutHolderOutputs
+      // Capture primitives so the worklet closure does not close over `options`.
+      // optionsPresent: retain (omit) vs clear ({} without timing) vs set (tjynor).
+      const optionsPresent = options !== undefined
+      const instant = options?.instant === true
+      const projectionComponentId = options?.projectionComponentId ?? null
+      const timing = options?.timing ?? null
+      const spring = options?.spring ?? null
+      const loopEpoch = live?.nextEpoch() ?? null
+      const role = unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverState(driverId)
+            state.settleNotified = false // an entering pairing may begin a flight — re-arm the edge
+            if (loopEpoch !== null) state.loopEpoch = loopEpoch
+            return uiLayoutAttach(
+              uiLayoutSlot(state, layoutSpring),
+              id,
+              token,
+              rect,
+              outputs,
+              instant,
+              projectionComponentId,
+              timing,
+              spring,
+              optionsPresent,
+            )
+          })
+        })(),
+      )
+      if (loopEpoch !== null) live!.startLoop()
+      return role
+    },
+
+    commitRect(id, token, rect, options) {
+      // measureInWindow completes async, so a commit can land after the tree unmounted and the
+      // owner disposed. The registry it would commit into is gone — drop the stale measurement
+      // (same late-completion class as the frame callback's post-dispose vsync peek); throwing
+      // here would detonate inside the host's measurement callback.
+      if (disposed) return false
+      assertLive('layout.commitRect')
+      const optionsPresent = options !== undefined
+      const instant = options?.instant === true
+      const timing = options?.timing ?? null
+      const spring = options?.spring ?? null
+      const loopEpoch = live?.nextEpoch() ?? null
+      const committedLead = unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverState(driverId)
+            state.settleNotified = false // a lead commit retargets the flight
+            if (loopEpoch !== null) state.loopEpoch = loopEpoch
+            return uiLayoutCommit(
+              uiLayoutSlot(state, layoutSpring),
+              id,
+              token,
+              rect,
+              instant,
+              timing,
+              spring,
+              optionsPresent,
+            )
+          })
+        })(),
+      )
+      if (loopEpoch !== null) live!.startLoop()
+      return committedLead
+    },
+
+    detach(id, token, options) {
+      // Same teardown-convergence rule as setActive(false): dispose() dropped the registry and
+      // every holder, which subsumes leave(). A descendant detaching after the owner disposed is
+      // legal deleted-tree ordering, not use-after-free.
+      if (disposed) return false
+      assertLive('layout.detach')
+      const optionsPresent = options !== undefined
+      const instant = options?.instant === true
+      const timing = options?.timing ?? null
+      const spring = options?.spring ?? null
+      // A retained layout holder receives its final detach from the UI-originated release
+      // callback. It does not need the `holds()` result at that point (the release already won),
+      // so queue the cleanup rather than synchronously re-entering the UI registry while the UI
+      // runtime is still dispatching its callback. Ordinary lifecycle detaches retain their
+      // exact synchronous result contract below.
+      if (uiOriginatedCallbackDepth > 0) {
+        const loopEpoch = live?.nextEpoch() ?? null
+        cross((synchronous) => {
+          'worklet'
+          return uiGuardLane(
+            synchronous,
+            () => {
+              const state = uiDriverState(driverId)
+              state.settleNotified = false
+              if (loopEpoch !== null) state.loopEpoch = loopEpoch
+              uiLayoutDetach(
+                uiLayoutSlot(state, layoutSpring),
+                id,
+                token,
+                instant,
+                timing,
+                spring,
+                optionsPresent,
+              )
+            },
+            driverId,
+            undefined,
+            false, // layout detach: no element handle; the fold cannot reach this lane
+          )
+        })
+        if (loopEpoch !== null) live!.startLoop()
+        return false
+      }
+      const loopEpoch = live?.nextEpoch() ?? null
+      const exitingHolderRetained = unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverState(driverId)
+            state.settleNotified = false // a lead leaving begins the reverse flight
+            if (loopEpoch !== null) state.loopEpoch = loopEpoch
+            uiLayoutDetach(
+              uiLayoutSlot(state, layoutSpring),
+              id,
+              token,
+              instant,
+              timing,
+              spring,
+              optionsPresent,
+            )
+            return state.layout!.registry.holds(id, token)
+          })
+        })(),
+      )
+      if (loopEpoch !== null) live!.startLoop()
+      return exitingHolderRetained
+    },
+
+    sharedFor(id, token) {
+      assertLive('layout.sharedFor')
+      return ensureHolderShared(id, token)
+    },
+
+    releasable(id, token) {
+      // Liveness queries are non-throwing by contract (a dropped id reads releasable). dispose()
+      // drops everything, so the dropped-id axiom extends to the whole driver — an exit polling
+      // across the teardown boundary converges instead of crashing.
+      if (disposed) return true
+      assertLive('layout.releasable')
+      return unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverStatePeek(driverId)
+            const slot = state === null ? null : state.layout
+            // No slot means nothing was ever tracked — the registry's dropped-id semantics.
+            return slot === null ? true : slot.registry.releasable(id, token)
+          })
+        })(),
+      )
+    },
+
+    isSettled(id) {
+      // Same dropped-driver axiom as releasable(): nothing tracked means nothing in flight.
+      if (disposed) return true
+      assertLive('layout.isSettled')
+      return unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverStatePeek(driverId)
+            const slot = state === null ? null : state.layout
+            return slot === null ? true : slot.registry.isSettled(id)
+          })
+        })(),
+      )
+    },
+
+    holds(id, token) {
+      if (disposed) return false
+      assertLive('layout.holds')
+      return unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverStatePeek(driverId)
+            const slot = state === null ? null : state.layout
+            return slot === null ? false : slot.registry.holds(id, token)
+          })
+        })(),
+      )
+    },
+
+    isLead(id, token) {
+      if (disposed) return false
+      assertLive('layout.isLead')
+      return unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverStatePeek(driverId)
+            const slot = state === null ? null : state.layout
+            return slot === null ? false : slot.registry.isLead(id, token)
+          })
+        })(),
+      )
+    },
+
+    opacityWitnessFor(id) {
+      // Same dropped-driver axiom as isSettled(): a dropped driver holds nothing to witness.
+      if (disposed) return []
+      assertLive('layout.opacityWitnessFor')
+      return unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverStatePeek(driverId)
+            const slot = state === null ? null : state.layout
+            return slot === null ? [] : uiLayoutOpacityWitness(slot, id)
+          })
+        })(),
+      )
+    },
+
+    subscribeSettled(id, onSettled) {
+      assertLive('layout.subscribeSettled')
+      const key = nextSettleWatcherKey++
+      layoutSettleCallbacks.set(key, onSettled)
+      const emittedNow = unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverState(driverId)
+            const slot = state.layout
+            if (slot === null || slot.registry.isSettled(id)) return true
+            state.layoutSettleWatchers.push({ id, key })
+            // alloc-ok: lifecycle edge — one staged-settle slot per registered watcher. The frame
+            // writes by index and never grows this transport array.
+            state.emission.layoutSettledKeys.push(0)
+            return false
+          })
+        })(),
+      )
+      if (emittedNow) {
+        deliverLayoutSettled(driverId, key)
+        return () => {}
+      }
+      return () => {
+        layoutSettleCallbacks.delete(key)
+        unwrapUiOutcome(
+          executeOnUIRuntimeSync(() => {
+            'worklet'
+            return uiGuard(() => {
+              const state = uiDriverStatePeek(driverId)
+              if (state === null) return
+              let w = 0
+              for (let i = 0; i < state.layoutSettleWatchers.length; i++) {
+                const watcher = state.layoutSettleWatchers[i]!
+                if (watcher.key !== key) {
+                  state.layoutSettleWatchers[w] = watcher
+                  w += 1
+                }
+              }
+              state.layoutSettleWatchers.length = w
+            })
+          })(),
+        )
+      }
+    },
+
+    coupleRelease(id, token, safeToRemove) {
+      assertLive('layout.coupleRelease')
+      const key = nextCouplingKey++
+      layoutReleaseCallbacks.set(key, safeToRemove)
+      const loopEpoch = live?.nextEpoch() ?? null
+      // Registration and the already-releasable check are ONE atomic UI hop (the engine re-checks
+      // at registration), so the immediate-release frontier cannot race a frame in between.
+      const emittedNow = unwrapUiOutcome(
+        executeOnUIRuntimeSync(() => {
+          'worklet'
+          return uiGuard(() => {
+            const state = uiDriverState(driverId)
+            if (loopEpoch !== null) state.loopEpoch = loopEpoch
+            let emitted = false
+            uiLayoutCouple(uiLayoutSlot(state, layoutSpring), id, token, key, () => {
+              emitted = true
+            })
+            return emitted
+          })
+        })(),
+      )
+      if (emittedNow) {
+        deliverLayoutRelease(driverId, key)
+        return () => {}
+      }
+      if (loopEpoch !== null) live!.startLoop()
+      return () => {
+        layoutReleaseCallbacks.delete(key)
+        unwrapUiOutcome(
+          executeOnUIRuntimeSync(() => {
+            'worklet'
+            return uiGuard(() => {
+              const state = uiDriverStatePeek(driverId)
+              const slot = state === null ? null : state.layout
+              if (slot !== null) uiLayoutUncouple(slot, key)
+            })
+          })(),
+        )
+      }
+    },
+  }
+
+  const binding: WorkletDriverBinding = {
+    driver,
+    sharedFor(handle, key) {
+      assertLive('sharedFor')
+      const shared = sharedByHandle[handle as number]?.[key]
+      if (shared === undefined) {
+        throw new Error(
+          `no shared value for handle ${String(handle)} prop '${key}': register it first.`,
+        )
+      }
+      return shared
+    },
+    writeBoundValue(handle, values) {
+      driver.write(handle, values, undefined, 'bound-value-retarget')
+    },
+    onBoundValueWriteRefusal(listener) {
+      assertLive('onBoundValueWriteRefusal')
+      let listeners = boundValueWriteRefusalListenersByDriverId.get(driverId)
+      if (listeners === undefined) {
+        listeners = new Set()
+        boundValueWriteRefusalListenersByDriverId.set(driverId, listeners)
+      }
+      const subscribed = listener as (handle: number, key: string) => void
+      listeners.add(subscribed)
+      return () => {
+        listeners.delete(subscribed)
+        if (listeners.size === 0) boundValueWriteRefusalListenersByDriverId.delete(driverId)
+      }
+    },
+    setFrameValuesListener(handle, listener) {
+      assertLive('setFrameValuesListener')
+      // JS registry first (the crossing below is fire-and-forget): the listener must be
+      // recoverable the moment the UI arm lands, and clearing must drop it even if the
+      // disarm crossing is still queued.
+      let byHandle = elementFrameValueCallbacks.get(driverId)
+      if (byHandle === undefined) {
+        byHandle = new Map()
+        elementFrameValueCallbacks.set(driverId, byHandle)
+      }
+      const registrationGeneration = nextElementFrameValueRegistrationGeneration()
+      if (listener === null) byHandle.delete(handle as number)
+      else
+        byHandle.set(handle as number, {
+          generation: registrationGeneration,
+          callback: listener,
+        })
+      const armed = listener !== null
+      cross((synchronous) => {
+        'worklet'
+        return uiGuardLane(
+          synchronous,
+          () => {
+            const element = uiElementAt(uiDriverState(driverId), handle as number)
+            element.onUpdateArmed = armed
+            element.registrationGeneration = registrationGeneration
+            // The pin's cadence is value-change only, so an arm edge emits nothing by itself.
+            // Disarm clears the change markers so a later re-arm cannot suppress its first
+            // genuinely-changed frame against stale lastNotified values.
+            if (!armed) {
+              for (const key of Object.keys(element.lastNotified)) {
+                delete element.lastNotified[key]
+              }
+            }
+          },
+          driverId,
+          undefined,
+          false, // arm flag write: no build; the fold cannot reach this lane
+        )
+      })
+    },
+    propertyStateFor(handle, key) {
+      assertLive('propertyStateFor')
+      const state = layoutMirrorByHandle[handle as number]?.[key]
+      if (state === undefined) {
+        throw new Error(
+          `no layout mirror state for handle ${String(handle)} prop '${key}': register it first.`,
+        )
+      }
+      return state
+    },
+    layout,
+    dispose() {
+      if (disposed) return // idempotent — an unmount effect and an explicit call may both run
+      disposed = true
+      layoutReleaseCallbacks.clear() // a pending safeToRemove must not fire into an unmounted tree
+      layoutSettleCallbacks.clear()
+      layoutCallbacksByDriver.delete(driverId)
+      driverSettleCallbacks.delete(driverId)
+      elementFrameValueCallbacks.delete(driverId)
+      boundValueWriteRefusalListenersByDriverId.delete(driverId)
+      // The mailbox's accepted drain id is NOT forgotten here: envelopes the UI runtime sealed
+      // before this crossing lands are still in flight, and they validate against it. The UI
+      // side seals the driver's final DRIVER_DISPOSED envelope before deleting the record; JS
+      // forgets the mailbox on that receipt, in order.
+      cross((synchronous) => {
+        'worklet'
+        return uiGuardLane(
+          synchronous,
+          () => {
+            const g = globalThis as UiGlobal
+            const state = uiDriverStatePeek(driverId)
+            if (state !== null) {
+              state.emission.disposeStaged = true
+              uiSealFrameEmission(state, null)
+            }
+            if (g.__nativeMotionDrivers !== undefined) delete g.__nativeMotionDrivers[driverId]
+            if (g.__nativeMotionProjectionHostFrames !== undefined)
+              delete g.__nativeMotionProjectionHostFrames[driverId]
+            if (g.__nativeMotionManualGroups !== undefined)
+              delete g.__nativeMotionManualGroups[driverId]
+          },
+          driverId,
+          undefined,
+          false, // dispose: no element to retire; the fold cannot reach this lane
+        )
+      })
+    },
+    isDisposed: () => disposed,
+  }
+  identityValueChannelDriverIds.set(binding, driverId)
+  return { binding, driverId }
+}
+
+// Deterministic (manual-stepping) driver — the on-device verification surface. Live drivers MUST come
+// from `useWorkletDriver` (REQ-DRIVER-011), so `manualStepping: true` is required here.
+export function createWorkletDriver(options: WorkletDriverOptions): WorkletDriverBinding {
+  return createDriverCore(options, null).binding
+}
+
+// The LIVE native driver: one driver-owned `useFrameCallback` (real vsync, REQ-DRIVER-011) steps the
+// whole graph. Created inactive; a command activates it; the settle edge deactivates it.
+export function useWorkletDriver(options: WorkletDriverOptions = {}): WorkletDriverBinding {
+  // The UI dispatcher is stable for the driver's lifetime, but its React callback is read-current:
+  // a layoutId introduced after mount can install the Presence settle owner on a later render.
+  const onAllSettledRef = useRef(options.onAllSettled)
+  onAllSettledRef.current = options.onAllSettled
+
+  // A stale UI settle may be queued to JS while a new JS command has already started. The epoch
+  // changes synchronously on that command edge, so the JS dispatcher can reject the stale settle
+  // without a synchronous UI-runtime re-check (which deadlocks iOS when the frame is mid-crossing).
+  const loopEpochRef = useRef(0)
+
+  // Create the driver core once, BEFORE the frame callback, so the worklet captures the plain
+  // driverId directly. The startLoop/settle closures reference `frameCallback` lazily — they only run
+  // after a command lands (post-render), when the const below is initialized.
+  const stateRef = useRef<{
+    binding: WorkletDriverBinding
+    driverId: number
+  } | null>(null)
+  if (stateRef.current === null) {
+    stateRef.current = createDriverCore(
+      { ...options, manualStepping: false },
+      {
+        nextEpoch: () => ++loopEpochRef.current,
+        startLoop: () => frameCallback.setActive(true),
+      },
+    )
+    // Seal-r16 F2: the proof app installs `__nativeMotionProofMarker` at module load; arm the
+    // UI witness cells once so settle/completion counters stay zero-cost for ordinary consumers.
+    if (isProofMarkerInstalled()) armUiProofWitnesses()
+  }
+  const driverId = stateRef.current.driverId
+
+  // The frame reaches this JS closure only through deliverDriverSettled() below. The primitive
+  // epoch closes the command-vs-settle race without JS→UI `runSyncSerialized` re-entry from a
+  // UI-originated dispatchEvent callback.
+  const settleHandlerRef = useRef<((epoch: number) => void) | null>(null)
+  if (settleHandlerRef.current === null) {
+    settleHandlerRef.current = (settledEpoch) => {
+      // Proof seam witness (no-op when the hook is unset): the epoch guard's verdict with both
+      // epochs AND the driver id — delivered vs dropped-stale names whether the guard is the dead
+      // link; the driver id attributes the verdict to the MotionView that owns it (finding B:
+      // the 2026-08-18 capture could not attribute its three delivered lines).
+      const proofMarker = (globalThis as ProofMarkerJsGlobal).__nativeMotionProofMarker
+      if (loopEpochRef.current !== settledEpoch) {
+        proofMarker?.(
+          `settle-verdict dropped-stale driver=${driverId} settled=${settledEpoch} current=${loopEpochRef.current}`,
+        )
+        return
+      }
+      proofMarker?.(
+        `settle-verdict delivered driver=${driverId} settled=${settledEpoch} current=${loopEpochRef.current}`,
+      )
+      frameCallback.setActive(false)
+      onAllSettledRef.current?.()
+    }
+  }
+  driverSettleCallbacks.set(driverId, settleHandlerRef.current)
+
+  // @frame-path — THE per-frame step (REQ-DRIVER-011 single callback; REQ-DRIVER-021 scan root).
+  // Starts inactive; per frame it advances the whole graph by the vsync-reported delta (null on
+  // the first invocation → 0; a post-background gap is clamped by core's dt ceiling inside
+  // stepProp, REQ-CLOCK-003). Peek, don't create: a vsync racing dispose() must not resurrect the
+  // deleted record.
+  const frameStep = (frame: FrameInfo) => {
+    'worklet'
+    const state = uiDriverStatePeek(driverId)
+    if (state === null) return
+    const dt = frame.timeSincePreviousFrame ?? 0
+    const anyElementActive = uiStepAll(state, dt)
+    uiEmitFrameValues(state)
+    // The layout engine rides the SAME frame source (REQ-DRIVER-011) and joins the same settle
+    // edge (REQ-DRIVER-020). Every conditional notification stages into the same primitive turn;
+    // the seal below is the frame's only UI→JS crossing.
+    let anyLayoutActive = false
+    let staleReports:
+      | readonly {
+          readonly source: string
+          readonly code: string
+          readonly detail: string
+        }[]
+      | null = null
+    if (state.layout !== null) {
+      anyLayoutActive = uiLayoutStep(state.layout, dt)
+      // The stale projection-report drain rides the SAME frame edge (F2): a layoutId-only scene
+      // has no layoutTransition commit/frame drains, so every driver frame drains the tree's
+      // ring to RN — a quiet frame gets the shared frozen empty array, allocating nothing.
+      staleReports = state.layout.projection.tree.drainStaleReports()
+      // Watch only identities with an interested completion owner. This is O(watchers), never a
+      // scan of every mounted identity, and emits as soon as the watched id settles even while
+      // another identity or property remains active.
+      uiStageSettledLayoutWatchers(state)
+    }
+    if (!anyElementActive && !anyLayoutActive && !state.settleNotified) {
+      state.settleNotified = true
+      // The UI-side settle-emission witness (seal-r15 F2, proof-only; seal-r16 F2 gated): a
+      // primitive counter on the UI global — never crossing on the channel under test. Armed
+      // only when the proof app installed the marker (driver mount); ordinary consumers skip.
+      // The JS-side last-pushed cell is filled from the envelope's DRIVER_SETTLE handler (not a
+      // proof-only crossing — the frame retains its one-envelope traffic law).
+      const proofGlobal = globalThis as ProofSettleChannelUiGlobal
+      if (proofGlobal.__nativeMotionProofWitnessArmed === true) {
+        proofGlobal.__nativeMotionProofSettleEmissions =
+          (proofGlobal.__nativeMotionProofSettleEmissions ?? 0) + 1
+      }
+      state.emission.driverSettleEpoch = state.loopEpoch
+    }
+    uiSealFrameEmission(state, staleReports)
+  }
+  const frameCallback = useFrameCallback(frameStep, false)
+
+  // Quiesce-before-unmount (round 4 major 5): the component owning this driver is going away —
+  // delete the UI-runtime state so remounts (gallery page changes, auto-mode key swaps) never
+  // strand holder outputs and graph state in the worklet global. The binding survives re-renders
+  // in stateRef. A StrictMode setup→cleanup→setup replay reaches this setup with the binding
+  // already disposed — that replay is a deferred capability and fails loud (REQ-DRIVER-022;
+  // BRIEF Decisions 2026-07-10), never a silent resurrection.
+  useEffect(() => {
+    const binding = stateRef.current!.binding
+    assertSetupNotReplayedOnDisposed(binding.isDisposed())
+    return () => {
+      binding.dispose()
+    }
+  }, [])
+
+  return stateRef.current.binding
+}