Design bounded semantic drag interactions #208

Problem

Headless has no drag command. A generic drag verb is ambiguous across pointer gestures, native HTML drag-and-drop, sortable widgets, sliders, file drops, frames, and auto-scroll. Implementing one without a fixed contract risks partial behavior and an unsafe caller-controlled payload surface.

Required design

• Use semantic source and destination targets only. Never accept coordinates, selectors, caller JavaScript, DataTransfer payloads, or filesystem paths.
• Decide whether pointer drag and HTML drag-and-drop are separate commands or separately negotiated modes.
• Define bounded duration, step count, auto-scroll behavior, cancellation, stale-ref handling, occlusion checks, and exact failure codes.
• Deny file drops, cross-origin frame transitions, external application drops, and caller-supplied drag data.
• Declare trusted versus synthetic dispatch per engine. Unsupported behavior must return UNSUPPORTED_CAPABILITY rather than partially executing.
• Define flow-recording behavior and ensure secrets or page payloads cannot enter recordings or diagnostics.

Acceptance criteria

• Add an architecture decision before implementation.
• Add CLI and protocol validation for every bound and mutually exclusive option.
• Add unit, runtime, and real-engine E2E coverage for success, stale and obscured targets, unsupported widgets, cancellation, navigation during drag, and denied payload paths.
• Keep the no arbitrary JavaScript, no coordinate input, no downloads, and bounded-response contracts intact.
• Update capabilities, generated SDK schema, command docs, skill guidance, and the roadmap backlog.

Split from #35 so semantic hover can ship independently.