Windows: Share the pinned local UI verifier and capture driver

Is your feature request related to a problem?
Lane-local capture harnesses have repeatedly consumed desktop time without completing the visual gate. The offline authority/data foundation in #818 and #820 does not execute or verify UI claims. A local verifier needs one shared capture lineage, exact production and ownership boundaries, and measured compatibility with the pinned tool.

Describe the solution you'd like
Implement the bounded G2 local verifier on the same lane-A driver used by the central cap worker, not a second capture harness. G1 merged as 6916bc2c2baabc2f83c92230aeee8b49e879758e; its validator and three schema blobs are identical to the reviewed candidate.

Receive the central driver's exact approved source/hash/export/mock/real-lifecycle handoff and promote reusable functions into one shared module. No parallel rewrite or product changes.
Assert public helper exports and Get-Command availability, exercise the actual actions guard against positive/negative mocks, and prove real isolated zmx/peer lifecycle and all-descendant cleanup with kernel-generation/executable ownership guards.
After separate plan, file-scope, installation and desktop approval, prove local WinAppCli v0.5.0 compatibility on an owned GraphCode Win32 window using inspect, invoke, wait-for and screenshot. Pin official commit fd7cb6f235fa54dd2c6e26386e65e967a2c8797a and x64 archive SHA-256 88735ce6c2582ac5fac6200194bf62467fdd72b44b2d230f3a4ed059fa79ee7d; no silent upgrade or unsupported sandbox/workflow-ID requirements.
Use source- and binary-measured command-specific JSON envelopes. The pinned search and wait commands return objects, not the arrays described by stale versioned documentation. A successful absence wait is not proof when provider errors can be swallowed; require a separately healthy exact owned root and typed observations.
Keep authority inputs outside the untrusted checkout; use a fresh production-SHA verifier context, sealed black-box observations before diff review, and a separate source audit that can invalidate but cannot manufacture evidence.
Use verifier-owned per-run support, daemon pipe, temp and run ID, plus a fixed canonical project fixture root with exclusive locking, positive ownership, refusal of foreign/reparse paths and verified scoped cleanup. Exact path-derived IDs are not portable across roots.
Report explicit observed states, proof components, uncovered obligations, counts, artifact hashes and cleanup failures. Schema validity, CLI exit zero, injected input, fixture state or empty output must not become whole-claim UI, physical-input, human-approval or parity success.
Add offline executable contracts and positive-count registration without running native UI or installing WinApp in CI. Keep local visuals in the product's same final slot; no screenshot/golden/pixel-baseline CI, generic scenario replay or TDD/result-transport changes.

The read-only plan proposes one agent definition, one shared driver module, one local preflight entrypoint, two offline test files, and narrow registration/documentation integration. Those are proposals, not implementation leases. Cap's exact approved handoff must be incorporated before the final public plan is approved. Current lane captures are not blocked on G2.

Describe alternatives you've considered
Independent per-lane scripts duplicated lifecycle, scope and cleanup mistakes. Parser-only preflight missed a nested helper that was unavailable to the caller. Trusting a tool's exit code or stale documentation would hide missing observations and provider failures. Expanding this PR into product accessibility fixes, CI replay, visual baselines or unpinned tools would obscure the bounded local-verifier contract.

Additional context
This is infrastructure, not an invented UI surface or a set of synthetic real claim IDs. G1 remains a valid-data-only boundary. Native preflight and implementation require explicit coordinator approval; read-only planning alone authorizes neither installation nor a desktop slot.

G3 UIA-only replay and opt-in TDD mapping are separate, after G1/G2 and the card/sidebar merges, with their own exact-head/result-transport design. Base-versus-head automation and any visual tier are later work. Existing A-E acceptance boxes and partial evidence remain intact.

Implementation plan (wave 2)

Lane G, G2: shared pinned local verifier and capture driver.
Tracker: #822. Date: 2026-10-14.
Status: planning draft ready for review; final approval, implementation leases, installation and native execution are NOT granted.

This is the sanitized public version of the reviewed planning revision. The coordinator authorized publication of this planning comment, not implementation. This same comment will be updated in place after the central capture worker supplies its actual approved handoff; no second harness or guessed helper API is authorized.

Dependency and approval gates

G1 actually merged in #820 as 6916bc2c2baabc2f83c92230aeee8b49e879758e. The validator and all three schema blobs were independently compared with the frozen reviewed candidate d1abb6ec0f9ca2e3820915426c367ddbd0188ae0:

File	Identical candidate and merged Git blob
`Tools\windows\Test-UiScenario.ps1`	`4110c1e34cfbe5ad251fcf4c77a2ded716bbea4f`
`windows-tests\ui-scenarios\scenario.schema.json`	`c0e412cf5a325c3659eccb91909819c2129f128c`
`windows-tests\ui-scenarios\claim-authority.schema.json`	`2540a13f94d364c902f1985c7796194178ff8812`
`windows-tests\ui-scenarios\fixture.schema.json`	`6f962673410310d0964706ce6c3d881180a79a6b`

The merge-only gate is satisfied; no candidate API redesign is necessary. Tracker allocation is also complete. All remaining gates are explicit:

Pending central-driver handoff: actual coordinator-approved source revision/hash, native-fragment provenance, public export inventory, successful callable actions-guard positive/negative mocks, and actual real lifecycle/cleanup evidence. The central worker owns its current adaptation and B-first job. G2 must not block that job, inspect guessed private locations, impose guessed export names, or independently rewrite its driver.
Pending final public plan approval and named file leases: the proposals below are not granted leases. The coordinator must incorporate the actual handoff, approve scope/models and supply independently trusted authority inputs.
Pending installation/native permissions: only after the preceding gates may the exact pinned local WinApp archive be installed in verifier-owned storage. A separately granted local desktop/preflight lease is required; neither G1 merge nor this comment grants it.
Pending measured compatibility: prove the pinned binary's inspect, invoke, wait-for and screenshot on an owned production GraphCode Win32 window before verifier logic relies on them. Source documentation is not runtime evidence.
Implement only the approved shared-module/agent/offline-contract slice. Different-vendor source/evidence acceptance and exact-head CI precede final product capture/verification in that product's existing ONE local slot.

If G1's API or the actual driver handoff changes the plan, update this comment and obtain renewed approval before implementation. G3 remains separately approved work after G1/G2 and the card/sidebar merges. No replay, TDD/result-transport changes or base-head/visual-tier automation is queued here.

G1 authority/boundaries: approved G1 plan and G1-only approval. Neither authorizes G2.

Source-derived gaps

Contributor rules, the canonical lane kickoff and orchestration plan were read from origin/main before investigation. Production-source citations below are from the planning audit at dd501e1befd3e00f9e31254a3c1c0c6595543c29; G1 citations are from the frozen candidate above, whose four API blobs are now confirmed identical after merge. These citations are not a new production/native audit of merged main.

Source	Current behavior / root cause	G2 boundary
`Tools\windows\Test-UiScenario.ps1:1-16,95-138,253-331`	Mandatory `ScenarioRoot`, external `AuthorityPath` and independently supplied `AuthoritySha256`; optional exact `ClaimId` array. Exit zero emits `status: valid-data`, hashes, positive declaration counts and coverage only.	Invoke the exit-bearing validator in a bounded child. Never translate data validation into a UI observation, human approval, runtime setup or verified claim.
`scenario.schema.json:28-167`; scenario `README.md:54-110`	Literal AutomationId, exact control type, owned scope and `matchCount: 1`; typed assertions and a closed operation set. No coordinates, private commands, scripts or visual tier.	Preserve v1. Shared action/readback primitives obey its semantics; a generic scenario interpreter belongs to G3.
`claim-authority.schema.json:6-49`; scenario `README.md:8-52`	Exact criterion/proof class and six state-applicability entries are externally supplied. Hash identity does not authenticate owner approval. Visual scenarios are rejected; complete-semantic applies only to semantic-uia.	Keep authority and trusted hash outside the untrusted checkout. Mixed/input components never close uncovered whole-claim obligations.
`fixture.schema.json:6-20`; validator `:140-175`; scenario `README.md:112-132`	Packaged manifests live under `ScenarioRoot\fixtures\id`; validation reads hashes but installs nothing. UNC, mapped network and reparse paths are refused.	Packaged source location is NOT the canonical execution root. Prove supported fixture version, content, source and production setup separately.
`Tools\windows\Tests\UiScenario.Tests.ps1:20-43,73-81,154-175,335-433,520-574`	Real bounded validator-child calls, named positive/negative contracts and positive structured suite counts.	Reuse this executable-contract reporting pattern; preserve G1 tests. Prior 166-contract history is not a G2 test run.
`graphcode-windows\src\App.zig:1671-1680,1756-1816`	UIA/supervisor hooks disable production GDI+, bypass first-run/workspace behavior and inject fixture/update state. Fixture rows act on presence.	Actually clear hooks, not set them to `"0"`. Hook-based captures are not scrubbed production proof.
`AccessibilityProvider.cpp:204-223,1015-1086,1221-1310`; `Accessibility.zig:118-125`	Native patterns are selective; dynamic IDs include path-derived row hashes; canvas cards are Buttons.	Observe literal IDs under the fixed root. No guessed IDs, ListItem assumption or cross-root portability claim. Native form Value support must be observed.
`ScrubbedShellStartup.Live.Tests.ps1:44-76,140-156`	Prior art for cleared child environment; old row selection uses Name/prefix/FindFirst.	Reuse launch isolation concepts, not weak selectors or the test's execution path.
`TerminalSurface.zig:559-575`; `ZmxSession.zig:27-42`; `dev.ps1:209-278,355-399`	Production cwd/provider/profile/session isolation exists; development startup inherits parent environment.	Isolation settings and behavior-changing test gates are different categories. Construct cleared child environments rather than treating development Run as qualification.
`uia-live-gate.ps1:4263-4455`; `Packaging.Standalone.Tests.ps1`	Existing job/launcher ownership, retained process handles and teardown-before-bounded-stream-drain patterns.	Reuse only through the approved central-driver handoff. Do not dot-source the executable gate or redesign its CI.
`ReadProjectGraph.Wire.ps1:18-25,48-115`; `ReadProjectGraph.FramePump.cs:33-60`	Real v2 hello/request correlation and length-prefixed UTF-8 distinguish served from never-opened projects. Existing pump has per-read waits and no frame-size bound.	Use cap's CLIENT of the REAL production daemon; apply bounded payload and total remaining-time checks, not a stub server or test shutdown hook.

G2 proposes no product/provider change. Missing required UIA fails the semantic/input/mixed component; it is not permission to patch the product or substitute pixels, HMENU, coordinates or private commands.

One shared driver and handoff ownership

The operator decision is to build G2 on the same lane-A lineage used by the central capture worker, not a second harness. Lane A extracted its first inline C# helper without executing the live gate. Its historical driver was prompt-specific and included mutation/private-command paths. A successful normal File > Exit capture did not prove its PID-only emergency-stop fallback safe.

The central worker owns its current adaptation/preflight and B-first job. G2 receives that exact accepted source and tests, then mechanically promotes reusable capture/native/ownership functions into ONE repository module. Add missing production/guard behavior in that module; consumers import it. No standalone G2 capture engine, independent native-helper fork or mid-job migration imposed on cap.

Handoff still pending: accepted source revision/hash, native-fragment hashes, actual public export names, callable actions-guard mock evidence with positive/negative counts, real daemon/client and pinned zmx lifecycle/cleanup receipts, retained failed attempts, and a changed/unchanged guard inventory. The coordinator will supply approved, privacy-safe provenance; private handoff locators are not part of this public plan.

Exact export names come from that actual accepted handoff. Require caller/module-scope availability and Get-Command success for those names, including the actions-evidence role, but do not invent names or force the central worker's API. Parse/zoom/lifecycle success does not establish that an actions function is publicly callable. No AST-only extraction can substitute for invoking the actual exported guard.

After coordinator acceptance of the transfer, G2 owns the proposed repository module. Cap continues owning its current local driver until its job ends. Later migration is coordinated. Missing handoff means blocked implementation, not permission to design a guessed replacement.

File-scope proposals, NOT approved leases

Five proposed new files:

File	Responsibility
`.github\agents\ui-verifier.md`	Fresh-context Phase A/B protocol, immutable authority, production-only setup, evidence/proof limits and existing same-slot integration. No orchestration or autonomous claim closure.
`Tools\windows\UiCaptureDriver.psm1`	Promote the actual cap helper/native definitions into one module: explicit agreed exports, production isolation, canonical ownership, strict UIA actions, pinned command adapter, guarded teardown and capture provenance. Preserve its inline/separated native-source lineage.
`Tools\windows\Test-UiVerifierPreflight.ps1`	Local entrypoint consuming that SAME module. Pin/export/mock and separately approved real lifecycle/owned WinApp checks. Offline mode cannot emit native-ready. Never invoked by CI.
`Tools\windows\Tests\UiCaptureDriver.Tests.ps1`	Executable OFFLINE contracts invoking exported action/ownership/cleanup guards through mocks. No UIA instantiation, native Add-Type execution, product launch or desktop access in CI.
`Tools\windows\Tests\UiVerifier.Tests.ps1`	Executable OFFLINE authority, pin/parser, result/count/seal/phase and failure contracts. Explicitly synthetic data; no real product scenarios.

Three exact existing-file proposals:

File	Only requested extension
`Tools\windows\Tests\ValidationRunner.Tests.ps1`	Two new OFFLINE child calls before final PASS, each with successful exit and its own positive executed/passed counts and zero failures. Preserve G1's child and every A/B/C/E contract. No native/preflight CI call.
`windows-tests\ui-scenarios\README.md`	Append shared-driver/local-preflight usage and limits; distinguish packaged manifests from canonical execution; preserve G1 contract and G3 deferral.
`investigation\windows-parity-lane-kickoff.md`	Narrow authority/fresh-verifier integration into existing step 7 for newly allocated work: same final slot, primary plus fixed neighbors, no extra A-E pass or retroactive recapture. No gate/model-policy redesign.

Names and refactoring details remain proposals until the actual handoff and coordinator approval. No lease is requested for G1 validator/schemas/tests, product/shared Swift, existing live gate, validate/bootstrap/development scripts, provider pins, workflows, TDD, replay/result transport, ledger or orchestration plan. Existing path-classifier ancestors cover these areas; no classifier change is needed. If an integration proposal is rejected, revise the plan rather than silently claim it is wired.

Trusted inputs and independent verifier protocol

Inputs are independently supplied production SHA, exact approved criterion IDs, external frozen authority file and separately trusted lowercase SHA-256, supported fixture ID/version/source hashes, canonical root, adapter revision, exact production shell/daemon/CLI/zmx binary hashes, WinApp pin/preflight record, accepted module/native-fragment hashes, requested states/surfaces and lease deadline. No default PR-head authority, adjacent approval field, implementer's explanation or PATH-found tool.

Phase A: genuinely fresh verifier context BEFORE receiving PR diff/tests/implementation rationale. Verify a dedicated clean checkout including untracked product inputs, production build provenance and exact binary/source mapping. Use ReleaseSafe shell/release daemon and CLI with pinned tools/providers, not Debug, smoke, stress, fixtures substituted for production or an old binary with a green build label.

Build and app environments are separate. Construct actual child ProcessStartInfo.Environment from an allowlist; do not inherit build SDK/INCLUDE/LIB or credential-bearing host state. Clear UIA/test/worktree-test/tray/supervisor/handoff hooks; shell smoke/action/error/large-paste/nonreading and fake provider/version/experimental/workspace/layout overrides. Presence-based hooks must be absent, not "0". Re-inventory production reads at the actual SHA in Phase B; prefix lists alone do not prove every hook is cleared.

Legitimate recorded production isolation includes owned support/profile/home/local/roaming/temp roots, a matching unique real daemon endpoint, exact real zmx path, isolated zmx storage and run/session prefixes. The production cwd override, if genuinely needed, can point only to the owned canonical project and must be disclosed; it is not permission to inject fixture rows. Persist ordinary production settings and onboarding marker only when appropriate to the requested state; never bypass a first-run criterion with a marker.

Observe baseline, actual action and typed end state per required state. Seal local raw observations/transcripts/artifact inventory and hashes before Phase B. Use unique run IDs and preserve failed attempts separately. Hash sealing detects mutation, not WORM storage or trusted execution.

Phase B: audit diff/source/build path for test branches, new environment hooks, fixture/stub substitution, production mismatch and unimplemented obligations. It may invalidate Phase A or require an approved rerun; it cannot manufacture an observation, weaken a criterion or convert a missing result into success.

Local evidence shapes; no G3 transport contract

Record	Required information
Run header	formatVersion/runId/phase, exact SHA and cleanliness, build/tool/module/native/binary hashes, OS/session/lease/deadline, owned isolation mapping, supported fixture/canonical-root/source identity, authority hash and selected IDs.
Observation	Exact claim/state/surface, elapsed time, proof component, requested operation/pattern, literal target/type/scope/count, owned PID/generation/exe/HWND/current runtime identity, read-success plus typed property/value, action receipt, baseline/end linkage and artifact hashes.
Coverage	Required/observed/passing states, explicit uncovered states/proof components, positive actual observations/actions/readbacks, scoped verified/failed/unverifiable outcome and reason.
Cleanup	Every owned shell/daemon/zmx/client/cmd/conhost/descendant identity, held-kernel exit/job census, bounded stream drain, exact canonical-child removal verification and retained failures.
Phase seal/audit	Phase-A header/observation/artifact hashes and positive counts; separate Phase-B audit references the seal without rewriting it.

Missing REQUIRED UIA is failed; unavailable harness/tool/lease is unverifiable. Both are non-passing. Missing Value is not empty string. Cleanup failure prevents verification even after passing observations. Infrastructure/preflight records receive no fabricated UI claim ID.

G1 valid-data is only input validation. Pure visual remains outside v1; semantic completion requires all applicable semantic states actually observed. Input/mixed evidence remains component-scoped until visual/physical/hardware/other required proof is independently satisfied and accepted. No model-generated overall PASS from schema counts, CLI exit zero, empty selection or missing observations.

Canonical fixture, real daemon/client and lifecycle

The approved PROJECT-root decision is C:\gcfx\fixture-id, fixed by approved fixture ID and identical locally/any future CI. This does not add native/WinApp CI. Support, daemon pipe, temp, zmx storage, transcript/output and run ID remain unique. Literal path-derived IDs are observed there and not declared portable across roots; root-independent identity is another product issue.

Acquire one shared per-fixture exclusive lock in a trusted registry outside the untrusted checkout, not separate per-run locks. Hold its FileShare.None handle across setup, relaunch and cleanup. Require positively owned canonical parent and an absent or already positively owned EMPTY exact child. Refuse foreign/nonempty/unowned/reparse children/ancestors, UNC/mapped network, device, ADS and traversal paths. Do not adopt a foreign empty folder by name or trust a scenario-supplied marker.

Record resolved directory/ACL/file identity; revalidate before copy/launch/relaunch/deletion. Keep ownership metadata/locks outside the child. Materialize only supported-version approved manifest files with positive counts and exact source/copied hashes; record reproducible adapter/setup provenance. No real user data, remote projects, credentials or paid backend turns by default. Backend-dependent states remain uncovered unless separately authorized; never edit lifecycle flags to manufacture them.

Production server is REAL graphcoded.exe; cap's peer is its owned protocol CLIENT, NEVER a stub/mock/replacement server for production evidence. Clearly labeled offline fake responses cannot enter native/production results.

For served/unserved preflight, keep both project paths under the approved fixed child. Positively open/join the served project and correlate real v2 request IDs; readProjectGraph must produce its one correlated response. The never-opened/unserved read must produce a correlated error without opening/mutating it. Setup receipts are not user-visible UI proof. Reuse cap's client with bounded 4-byte big-endian UTF-8 frames and one remaining-time deadline; refuse malformed, duplicate or uncorrelated data rather than return an empty graph.

Retain kernel handles and capture PID, exact creation generation and expected exe path/hash at launch. Establish an owned job before target spawning where supported. Include detached zmx daemons, clients, cmd.exe and conhost/all descendants. Never infer ownership from basename, all zmx processes or parent PID alone. Every stop requires matching executable AND generation; reused PID or unknown live metadata refuses termination. Only a held kernel handle proven exited can be skipped. CIM CreationDate is DateTime, not DMTF; stale CIM does not prove exit.

Prefer normal File > Exit; WM_CLOSE/Alt+F4 can hide to tray. Emergency cleanup must exercise the actual guarded path, not just parse it or rely on a previous successful normal exit. Stop only owned generations; verify kernel exit and empty owned-job census. No PID-only or kill-by-name fallback.

Keep exact existing provider pins: zmx 785b3fd15dcafd1882b495c831a10f98c201b908 with Zig 0.16.0; Winghostty 6286560d0aa3103e068b2b7afa81eac373d870c9; shell Zig 0.15.2; Swift 6.3.3. Real Windows seed syntax is zmx.exe run SESSION -d cmd, not POSIX shell syntax or swapped argument order. Pinned zmx README:138,448-449 and Windows startup tests document detached cmd/daemon and isolated IPC; README:112-120 notes writers surviving detach.

Begin stdout/stderr asynchronous drains immediately and bound output, but complete/retrieve them only after cleanup releases inherited daemon/session writers. Seed exit zero is not readiness or phase success. Require actual positive session/backend observations, zero owned survivors and completed bounded EOF drains. Preserve primary AND teardown/drain failures.

Keep the owned fixture through intentional persistence relaunch; capture new generation and reacquire HWND/elements. Finally delete ONLY the resolved, still-owned canonical child, never C:\gcfx or artifact/provider/session roots. Verify removal and zero survivors before releasing lock/lease. Incomplete cleanup retains failure/quarantine ownership and cannot advertise success or fixture availability.

Exact pinned WinApp compatibility plan; NOT executed

Official release/tag metadata was read; no installation or native preflight occurred:

WinAppCli v0.5.0, exact commit fd7cb6f235fa54dd2c6e26386e65e967a2c8797a.
Official winappcli-x64.zip.
Archive SHA-256 88735ce6c2582ac5fac6200194bf62467fdd72b44b2d230f3a4ed059fa79ee7d.
Release prerelease=false does not change the CLI's preview status.
No silent upgrade, bootstrap/CI install, global environment mutation, PATH fallback, unsupported workflow-ID or sandbox-targeting requirement.

After explicit authorization, download/extract only into new verifier-owned tool storage. Check archive before extraction, measure exact executable hash/version/help and process-local dependencies. Missing/mismatched pin blocks use; no silent upstream skill/toolchain/package installation.

Pinned source contradicts stale versioned JSON guidance. Under the exact source commit:

Source	Source-defined shape/behavior to preflight
`Helpers/UiJsonContext.cs:49-54,67-94`; `Models/UiElement.cs:9-29`	camelCase inspect object: `windows[]`, numeric HWND, element count, nested elements/children. Element fields include `type`, `automationId`, `selector`; do not assume a `controlType` field.
`Commands/UiSearchCommand.cs:75-82`; context `:96-101`	Search object `{matchCount,hasMore,matches}`, not an array.
`Commands/UiWaitForCommand.cs:117-131,160-201,208-224`; context `:175-183`	Wait object `{found,waitedMs,element?,timedOut}`, not an array. Lookup errors are swallowed into null at `:107-115`; `--gone` can exit zero on provider failure. Value equality is case-insensitive at `:156-158`.
`Commands/UiInvokeCommand.cs:20-22,59-103`; context `:109-114`	Multiple patterns and ancestor fallback can exit zero; receipt `{elementId,pattern,hwnd}` is not required-action proof.
`Commands/UiScreenshotCommand.cs:60-120`; context `:125-147`	Screenshot object `{filePath,width,height,processId,hwnd,windows?}`; owned dialogs may be composited. WGC/fallback success does not prove PrintWindow(2), pixels, privacy or exact scope.

The versioned documentation supports explicit -w targeting but is not native evidence. Actual binary preflight must confirm command-specific envelopes and positive/negative outcomes. No null/default coercion or one generic element-array parser.

Propose ONE separately granted local infrastructure preflight, maximum 15 minutes using the central SAME driver and owned production artifacts/fixtures/providers. Bring provenance-checked prebuilt binaries. Reserve last three minutes for cleanup: 0-2 pin/ownership/export gates; 2-5 real daemon/client served-unserved; 5-8 detached zmx/cmd; 8-12 WinApp/readbacks/capture; 12-15 cleanup. If it cannot fit, retain NotExecuted components and revise the bounded plan rather than perform an unapproved retry.

Discover only the owned GraphCodeWindowsShell window by expected exe/PID/generation/class/HWND. Require one actual graphcode-root UIA Window. Planned commands, with values observed and guarded by that SAME driver:

& $winapp ui inspect -w $ownedHwnd --depth 8 --json
& $winapp ui search $observedAutomationId -w $ownedHwnd --json
& $winapp ui invoke $observedAutomationId -w $ownedHwnd --json
& $winapp ui wait-for $observedAutomationId -w $ownedHwnd --property IsEnabled --value True --timeout 5000 --json
& $winapp ui wait-for $knownAbsentId -w $ownedHwnd --timeout 1000 --json
& $winapp ui screenshot -w $ownedHwnd --output $ownedPng --json

These commands are NOT executed evidence. Invoke only a harmless reversible production button with direct Invoke support, selected by the approved driver after observing exact singleton/pattern ownership. Establish a genuinely different initial state, record target/pattern/HWND receipt, then exact end-state readback. Constant IsEnabled=True before/after is not action-delivery proof. The absent-target timeout negative must be nonzero/timedOut while the healthy root remains observable.

WinApp's Name/substring/slugs/ancestor and multi-pattern choices cannot implement G1's strict target/pattern contract automatically. Use its invoke only for bounded, proven exact-Invoke paths; preserve/extend the SAME shared helper's held-element exact UIA pattern operations for other required actions. No posthoc receipt can repair an unintended ancestor action. Unsupported strict actions are refused/uncovered; direct UIA is not a substitute for a missing provider.

wait-for --gone alone is never absence proof. Require independent exact-scope enumeration and a distinct positive healthy root. Typed exact property comparison cannot be delegated to case-insensitive/fallback CLI text. Provider error, missing value, duplicate match, truncated tree or hasMore cannot become empty/false/absent success.

Pinned screenshot must create an owned nonempty decodable PNG with actual measured dimensions/PID/HWND. It proves compatibility only. Required evidence still uses the central PrintWindow(hwnd,hdc,2) implementation plus positive pixel variation/coverage. Measure real window/client geometry, DPI and zoom, not desired labels; pixel checks judge capture validity, not automatic parity.

For an owned native popup omitted by PrintWindow, only the established approved popup-only screen path is allowed: exact owner chain/generation, foreground, popup rectangle, WindowFromPoint center and 40px grid, abort for foreign/covered points. No full-screen capture, blind screen copy, ActivateWindow/Alt-tap or unapproved WinApp screen/focus workaround.

Native readiness requires positive public-export/mock counts, real production daemon plus cap CLIENT served/unserved receipts, actual pinned zmx/cmd/descendant observations, all four required WinApp verbs with readbacks, zero owned survivors and no drain failures. Parse success, seed exit zero, zoom alone or historical images never suffice.

Implementation and evidence plan; commands NOT executed

Incorporate actual cap handoff; secure final approval and named leases. Mechanically promote its reusable definitions into the proposed module without native initialization on import. Export the actual agreed public functions; prove caller-scope Get-Command availability and invoke the actual actions guard, not a nested function or AST extract.
Write callable positive and negative actions-guard MOCK contracts first. Parsing/missing-export errors are setup failures, not behavioral RED. With a callable positive path established, observe a real incremental RED when a wrong-generation or missing-baseline action is incorrectly accepted; preserve source/test hashes and failing output. Implement refusal and rerun the identical command.
Add production isolation, canonical lock, guarded teardown, command-specific pin parsers and result/seal/Phase-B contracts inside the shared module/agent. Offline mocks inject fake observations/native dependencies without loading UIA/native types or launching products. No generic scenario steps replay or real product scenario authoring.
Apply only approved registration/docs/kickoff extensions. Each new child must execute its own positive named suite; inherited G1 counts are insufficient.
Exact-head CI uses existing workflows; different-vendor source/evidence review opens every claimed log and checks source handoff/rebase diff. No CI dispatch/exemption/native replay/visual pipeline added.
Approved final production verification and local vision review remain in the product PR's ONE existing final slot. The earlier infrastructure compatibility preflight is separately approved, not a second A-E pass.

Future focused commands:

pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1
pwsh -NoProfile -File Tools\windows\Tests\UiVerifier.Tests.ps1
pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1

Each new suite emits a named structured summary with executed > 0, passed = executed, failed = 0; registration rejects missing/duplicate/zero/count-mismatched suites or nonzero exit. Quote measured counts, not anticipated test totals. Keep RED/GREEN separately; a compile/parse/missing API failure is not runtime RED. Existing PR template and TDD evidence rules stay unchanged; no PR body or observed test evidence is produced by this planning comment.

Group	Positive and negative controls
Public exports	Side-effect-free import and each actual agreed export resolves/calls from a fresh caller. Nested/missing/duplicate exports or AST-only presence fail. Zoom/lifecycle results do not replace actions evidence.
Actions	Exact owned singleton/requested pattern plus real baseline/action/end succeeds. Wrong PID/exe/generation/HWND/modal owner, zero/duplicate match, Name/wildcard/first/ancestor fallback, stale target, pattern receipt mismatch, no-op or after-only evidence fails. Pre-action refusal leaves action counter zero.
Properties/absence	Explicit typed empty text and genuinely absent target with healthy root succeed. Missing property, case mismatch, unreadable-as-false, dead root, provider failure or broad negative selector fails. Disabled state is observed, not inferred from failed invoke.
Pin/parsers	Exact pin and command-specific object shape succeeds. Wrong archive/exe/version, stale array parser, malformed/truncated data, `hasMore`, wrong receipt/HWND/pattern, timeout or exit-zero-with-warning fails. Provider-error absence cannot pass.
Fixtures/locks	Owned empty/absent canonical child, exclusive common lock and exact supported manifest succeed. Contention, foreign even empty root, nonempty/unowned/reparse/UNC/network/ADS/traversal, changed bytes/version or cleanup ownership change refuse before foreign action.
Kernel/lifecycle	Held expected live executable/generation stops and reaches kernel-exited/job-zero. Reused PID, missing live metadata or changed executable refuses; stale CIM skips only with proven exited handle. Include detached daemons, clients and conhost/descendants.
Failures/drains	Preserve assertion failure plus teardown receipts. Unready seed exit zero, timeout/cancel, surviving descendant, inherited writer preventing EOF, failed delete/cleanup/drain yields non-passing retained evidence. Exercise emergency cleanup, not only normal exit.
Authority/proof/seal	Trusted immutable criterion plus positive actual required states yields only scoped evidence. Changed hash/criterion/revision, fabricated claim, valid-data-only, zero observations, uncovered mixed/input components, mutated seal or Phase-B mismatch never yields whole-claim success.

Offline mocks do not prove real lifecycle. Native preflight must observe actual pinned zmx cmd retention, REAL graphcoded.exe/cap CLIENT served-unserved behavior and cleanup0 with kernel guards. Any approved real failure drill targets known owned processes only; never probe/stop a foreign process to test refusal.

Timers, same-slot visuals, privacy and scope limits

Keep G1 v1 bounds unchanged: strict UTF-8/draft-07/local refs, 1 MiB/depth32, 1-16 cases, 1-128 steps/assertions, ordinary/precondition10s, relaunch30s, cleanup15s, case60s and scenario180s INCLUDING cleanup. Declaration bounds are not runtime guarantees. Shared helper calls use monotonic remaining-time budgets and owned containment for hung COM/native work; retries do not restart budgets. Reserve cleanup before another action and before lease expiry. This primitive containment is not G3 replay/result transport.

Baseline and changed-head observations/captures must BOTH be actual production evidence for matching fixture versions; no after-only proof or historical beta26 relabeling. For approved before/head requirements, use the accepted before evidence or an approved before run in the same slot, not new base-head automation.

Primary states and fixed neighbors for shared paint/layout are sidebar, global Graph overview, project canvas and loop workspace in that SAME final slot, at most15 minutes. If coverage cannot fit, narrow/record uncovered states rather than add a slot or waive evidence. Existing accepted A-E slices are not retroactively given new obligations.

Local different-vendor vision review actually opens every cited primary/neighbor pair against the exact macOS state. No automatic visual scoring, screenshot/UIA CI, golden/pixel-baseline CI or extra A-E verifier pass. Posted/send-input keys remain injected; not physical-input/hardware proof.

The primary macOS source is 2ccf303a04f995184aae1d4b738a9eca0f71b79e. Before any future image use, read complete reference README/index/privacy report and exact state/capture metadata, using @1x-srgb copies. This planning work opened no images or made a visual finding. Held/excluded private media stays unavailable; never publish bundles, private handoff locators or unreviewed images. Every otherwise eligible image needs individual visual privacy clearance and explicit upload approval; masks/OCR/hashes alone do not clear adjacent content.

Preserve corrected reference semantics: fitted F1 is the ParityRef PROJECT at90%; global restored overview is distinct at45%; authored card250x96 is not fitted raster geometry. Those constraints are not new observations. Historical beta26 is pre-wave1, not current proof. No product claim or ledger row closes from this infrastructure or partial components.

Complexity and reviewer policy

Highly complex: a shared ownership/verification/proof mechanism across lanes, involving source/binary custody, UIA patterns, detached daemon/zmx lifecycles, fixed-root coordination and independent evidence. One shared module keeps it bounded; complexity does not justify a second harness or workflow framework.

Proposed implementer: gpt-6.1-sol, high, long_context. Separately approved standard follow-up fixes may use gpt-6-luna, high/default. Proposed source/evidence and local vision reviewer: claude-sonnet-5.5, high, different vendor from the OpenAI implementer. These are future coordinator assignments, not workers launched by this planner. Keep the existing five-failed-iterations escalation rule; API/scope/lease blockers require correction, not bypass.

Not verified: no G2 builds/tests, installed WinApp, native preflight, product execution, rendering/input/lifecycle/parity evidence, real scenario or claim closure. Repository files remain unchanged. The only currently authorized public write is this planning comment. Final approval, implementation, installation and native permissions remain pending the actual central-driver handoff and coordinator decisions.

Plan approved (coordinator): G2-R1 same-core repair only

The operator has approved a failure-aware handoff exception for G2. G1 is merged as6916bc2c2baabc2f83c92230aeee8b49e879758e. The accepted UTC packet remains useful offline evidence, but cap's actual B attempts produced zero images. Retain both the UTC lease refusal and the corrected attempt's real empty-ArgumentList binder failure, plus the supervisor's missing-release failure. They are harness failures, not product or visual findings.

First slice: mechanically promote and repair the SAME A/cap lineage. No second capture engine. Four new files approved: Tools/windows/UiCaptureDriver.psm1; Tools/windows/Invoke-UiCapture.ps1; Tools/windows/Invoke-UiCaptureWorker.ps1; Tools/windows/Tests/UiCaptureDriver.Tests.ps1. Embed the required extracted native helper in that same module with source/hash/license provenance; do not dot-source or execute the full live gate, or add an unapproved separate native source file. A harmless no-desktop rehearsal executable may be generated from source embedded in the test into worker-owned scratch, never a committed binary or additional undeclared source file.

Two exact existing-file leases: Tools/windows/Tests/ValidationRunner.Tests.ps1 gets one offline real-rehearsal child invocation with its own positive structured executed/passed/failed count check before final PASS, preserving G1 and all accepted lane blocks on rebase. windows-tests/ui-scenarios/README.md gets directly related shared-core repair/rehearsal usage and limits only. No classifier change is needed. No product/shared Swift, provider/pin, existing live-gate, validate/bootstrap, workflow, Tools/tdd, ledger, kickoff or agent-definition edits in R1.

Required fixes: the production Start-CapManagedProcess path must support a genuine empty argument array; test its actual binding, not a permissive substitute. The real supervisor must always write lease-release.json from finally, including malformed/expired leases and worker exceptions, preserving primary and cleanup errors without a null Exception/ErrorRecord assumption. Initialize an explicitly owned report location safely before failure paths; malformed input cannot choose a foreign output root. Preserve corrected explicit-offset UTC validation, maximum15-minute allocation, kernel-generation/executable identity, all-descendant cleanup and EOF guards.

New gate: execute the same capture command's real process/lease/supervisor/worker/release path end to end against a harmless executable requiring no desktop, including an empty argument list and nonempty arguments. No mocks on those paths. The target emits a positive readiness line and exits; log actual calls, arguments, process identities, result, cleanup and release receipt. GUI-only UIA/PrintWindow operations necessarily remain NotExecuted in this no-desktop rehearsal; do not call the result UI or image verification. A malformed lease must be refused and still produce a failure release receipt. Add real target failure/timeout cases if directly needed to prove finally and teardown. No machine-clock/timezone mutation or guard weakening. Retain an incremental real launch-contract RED, then the same command GREEN and wider offline regression, with positive counts and failure logs preserved.

Model/ownership: gpt-6.1-sol/high/long_context implementer; claude-sonnet-5.5/high different-vendor repaired-packet source/evidence review. The new worker owns its repository surface and scratch; cap's failed source and runtime directories are read-only, with no parallel modification or third cap attempt. Do not duplicate or rerun product/native/full Windows suites locally.

Still gated: no WinAppCli installation, local native compatibility preflight, production claim verifier/agent protocol, scenario replay, TDD transport, paid backend turns or desktop capture is approved by R1. Those remain later G2/G3 scopes. After the repaired packet passes the real rehearsal and different-vendor review, the coordinator may allocate the operator-approved single desktop job, B first then D/E/C, with current exact product-head gates and admission check. Any harness failure in that slot stops all capture and goes to the operator before further action. This issue remains open for the full verifier requirements; R1 must use Refs, not whole-issue Fixes.

Bind relocated fixtures and retain cleanup despite trace failures

Refuse incomplete fixture rewrites and unproved worker cleanup

Repair capture-core launches and failure-safe lease release (#823)

Coordinator accepted and merged the bounded G2-R1 repair in #823 as 65194b7, after independent repaired-packet review and 26 completed exact-head checks (22 success, 4 configured skips). The registered real no-desktop suite ran 31/31/0; both hosted full ValidationRunner jobs also ran G1 166/166/0. Frozen packet, original failures, and non-official recovery provenance remain retained. This is tooling/offline acceptance only: no product images, desktop/native compatibility, WinApp, production verifier, whole-claim verification or issue closure. All broader checklist items stay open. The next B capture requires a separate current-head, fresh-root and fixture admission plus an explicit lease; any repaired-harness slot failure stops all capture for operator review.

Plan approved (coordinator): G2-R2 lease-bound job identity

Operator-delegate authorization: parameterise the same capture core once; do not re-pin literals for each main move. The merged G2-R1 packet remains immutable history. This approval grants no desktop slot.

Exactly four existing-file leases: Tools/windows/UiCaptureDriver.psm1, Tools/windows/Invoke-UiCapture.ps1, Tools/windows/Invoke-UiCaptureWorker.ps1, Tools/windows/Tests/UiCaptureDriver.Tests.ps1. Same A/cap lineage; no second engine, new file, product change, workflow/runner/README edit, WinApp installation or full native-UI compatibility work.

The current job identity must be lease-bound data (or a job file whose hash the lease binds), not old head/base/job/equivalence/CI-text literals. Verify the named head/base exist; exact head CI identity and a nonempty all-green inventory; actual executable hashes against separately produced fresh build provenance; product-byte equivalence to the reviewed head according to the existing equivalence rule. No product build occurs in a desktop slot. Preserve before/after source versus actual built-at provenance, fixture and scene contracts, fully rewritten owned paths, explicit UTC and 15-minute/90-second guards, process generation/kernel/EOF proof, and failure-aware official release. Hash identity is not human approval. Parameterised identity must not falsely imply an unsupported D/E/C scene adapter ran.

Re-run the real 31-case no-desktop gate plus negatives for a lease naming red CI, mismatched binary hash, and a non-equivalent product diff. These must refuse with an official lease-release.json. Keep critical process/lease/supervisor/worker/release paths real, and preserve actual failing output. New admission controls require a genuine incremental RED/GREEN, not a compile-only proxy.

Separately authorised offline export-only execution of Test-CapNativeBindings: DLL load plus TryGetExport for all 16 bindings, no HWND actions or GUI. Record 16/16; a missing export stops before any slot. This does not clear WinApp/native UI compatibility.

Use gpt-6.1-sol/high/long_context implementation and claude-sonnet-5.5/high independent repaired-packet review. Exact-head CI remains required. Full local ValidationRunner stays NotExecuted because its existing hidden native fixtures are not authorised; run the new child directly and use hosted full-runner evidence. Freeze source hashes and current job/build/equivalence/CI evidence before admission. Any source change after review requires delta review and fresh applicable evidence. B is the first prospective single slot only after these gates and awaiting_input-clear admission. Any repaired-harness slot failure stops all capture for operator review. Refs #822 only; the full verifier remains open.

Coordinator decision: D adapter plan conditionally accepted; no active implementation lease

Read-only plan SHA-256 47C8DCA143C7C8450A44DBE3B1C3D7AF2D9BE4F4587766A5C13BE95806596BB5 is accepted in principle, with these decisions. Implementation still requires merged R2, re-reading its actual API and remapping exact function blocks, then an explicit activated lease. No slot is granted.

Approve only the proposed synthetic fixture peer acknowledgement of resumeSession for the exact D fixture project/node AAAAAAAA-AAAA-4AAA-8AAA-AAAAAAAAAAAA, through the same managed peer/lifecycle path. No forwarding to graphcoded, backend launch, agent attach, lifecycle mutation or additional resume identity. Every other unapproved verb/payload refuses. Record that this is metadata-only fixture behavior; it does not prove daemon/session/backend acceptance. The product's openGraphLoop sends resumeSession, while TerminalSurface.openLaunchedNode mounts pending chrome without creating a daemon session; do not bypass that path.
Accept missing-bound-chat live fallback as explicitly NotExecuted: normal product events route away, while the existing test directly constructs the fallback state. Component observation coverage is permitted but is not a runtime screenshot. A job requiring live fallback must refuse; no hook, timing race or fake image is approved.
Preserve the ten named scenes per phase, exact 1440x952 client geometry, 96-DPI measurement and shared fixed neighbors. Admit a measured placement that fits the actual work area; do not blindly copy B's 30-pixel Y anchor if the taller outer frame clips. No desktop/monitor change or reduced client size. Before a slot, the complete 20-image/wait/cleanup budget must fit 15 minutes including the reserved 90 seconds.
Proposed scope after R2 remapping is the same module/supervisor/worker/test plus the named narrow README append. Preserve B and all R2 admission, generation/kernel/EOF/release rules. Any top-level uniqueness/session-role helper change is a shared-guard delta needing B regression and independent review. No product, runner, gate, provider, pin or workflow edits.

Future implementation remains one adapter PR, different-vendor review, exact-head CI and real no-desktop command evidence before a separately admitted D slot after B's accepted release. Default local execution must use an explicit per-worker command allow-list; full ValidationRunner, windows-shell unit/integration and product/zmx launches remain prohibited outside a separately granted capture command. WinApp/full native compatibility is not authorized. Broader #822/#774 claims remain open.

Harden immutable admission reads and reviewed-delta coverage

Exercise distinct phase binary swaps in admission negatives

Bind capture admission to coordinator-leased job identity

Harden immutable admission reads and reviewed-delta coverage

READ-ONLY recommendation / proposed one-PR slice

Start with one real GraphCanvas memory-DIB paint export for local review, not another GUI lifecycle rewrite. This yields paint-only images, not complete application screenshots or parity acceptance. No manual fallback. J4 continues independently; this comment grants no implementation/native/desktop/install authority and closes no boxes.

Option	Determinism / owned popups / desktop	Cost, review fit and failure-history implication
Offscreen product paint	Fixed model/geometry is most controllable; actual GDI glyphs/shapes, but fonts/GDI+ still matter. Canvas needs no HWND/foreground/screen readback; native controls, HMENU popups and terminal surfaces are excluded.	Smallest first slice using existing DIB tests. PNGs fit local vision review. Avoids launch/CIM/journal failures by creating none of those resources; does not fix #826.
Pinned WinAppCli 0.5.0	Already WGC -> PrintWindow; visible direct-owned dialogs can be composited. Not headless: restores minimized windows, can foreground on blank retry; `--capture-screen` foregrounds and reads desktop. Not automatic complete menu coverage.	Best later real-window candidate. Removes custom capture/encoding, not fixture/lease/ownership/cleanup. Multi-window exit 0 can hide individual failed captures. Command, capture.
Direct WGC / HWND	No inherent foreground call; compositor rather than desktop-region pixels. HWND interop >=1903. >=24H2 `IncludeSecondaryWindows` defaults false and clips qualifying popups to root bounds; not full #32768 proof.	More COM/D3D/frame/readback/PNG maintenance, much already in the CLI. Occluded/minimized/locked-session GraphCode behavior unmeasured; upstream lifecycle failures remain. Microsoft contract.
FlaUI / WinAppDriver	UIA patterns do not prove pixels/actions. FlaUI element screenshots are desktop BitBlt; menu lookup is desktop-wide. WinAppDriver popup/screenshot internals remain unverified.	Adds .NET/UIA or installed server/client lifecycle. FlaUI v5 (2025) and WinAppDriver latest stable v1.2.1 (2020) are observed release dates, not an abandonment verdict. Neither proves guarded descendant cleanup. FlaUI, WinAppDriver.
Minimal launch/capture/kill	Can remove generic orchestration, not isolated support/pipe/temp, exact executable/kernel generation, readiness, bounded EOF, all-descendant cleanup, privacy or deadline/lease guards.	Fewer lines need not mean fewer failure modes. Do not repeat the four-repair chain with PID-only kill or success-shaped fallback.

Actual seam: GraphCanvas.zig:635-750,1132-1173 paints into supplied HDC; :3529-3605 already creates a DIB and checks real project/overview text/pill pixels. Production App.zig:9111-9225 separately presents it and adds workspace/provider content. NativeForms.zig:1190-1256,2161-2209 requires HWND/native children. The retained A2-related form-export commits e7aba36a / 0f825042 use a shown HWND parked offscreen + PrintWindow, not HWND-free form rendering; source prior art is verified, runtime success is not.

Proposed first PR (standard; lease required): extend existing private GraphCanvas.ParityDib and add one opt-in project-fixture export test; add only a synchronized GDI+ readiness query; one V2 JSON fixture; one converter-only BMP-to-PNG/provenance script plus eight focused contracts; one existing-root -lgdiplus registration adjustment and README paragraph. No product CLI, App/NativeForms/GraphModel edits, capture-core edits, new renderer/framework or visual CI.

Fixture: two idle Goal/Check cards and one edge decoded through Model.updateFromFrame, no createdAt/activity timestamps (JSON zero is not absent), 1280x720, 96-DPI mapping, 100% zoom. Output: exactly one opaque PNG + manifest binding source/test-binary/fixture/font/render facts and artifact hashes; three fresh same-host renders must have identical decoded pixels. This is a local determinism check, not golden/pixel-regression CI. Refuse missing GDI+ readiness, blank/partial/foreign output and provenance mismatch.

Future evidence, not run: one behavioral export-contract RED (expected one artifact, actual zero; not compile RED), same test GREEN with positive count/zero skips, converter 8/8, focused existing canvas/GDI+ regression and exact-head CI. Full proposed commands/file/function/output contracts are in the retained planning artifact. Different-vendor local vision must open and individually privacy-clear actual PNG/reference images; use a correctly matched companion project 100%, not 764-final-fixtures-fitted project 90%. No image opened here. Native input/a11y, modal/menu/terminal/compositor pixels, real persistence and whole parity remain unproved; ledger stays Partial.

History preserved: A/#808 produced 26 assets (20 direct + six composites), not general harness proof; old B had two attempts/zero GUI images (UTC +7h refusal, then empty-ArgumentList/release failure). R1 real 2/2 +31 and R2 49/export16 are narrower than capture success. E journal FileNotFound 49/47/2 differs from B OpenSharingViolation 49/47/2. J3's >=6 failures and main CIM 49/48/1 remain retained; no current B/C/D/E after-images. If J4 stops, operator chooses the alternative; no new repair owner.

Retained detailed plan: rcap-screenshot-recommendation.md, SHA-256 3C5B78718FF0E374469A70454736288223748A6AE00A6ADA167AAB962FD12B5E. Source reads only; no tests, native calls, captures or images executed/opened.

Read-only plan qualification: nonvisual contracts and readiness

This qualifies the recommendation; the original comment and sealed 3C5B... plan remain unchanged. The required evidence label is "real paint path, offscreen component render", not whole-window/compositor, popup, terminal, per-monitor-DPI or NativeForms-control proof. No new execution or implementation authority is granted here.

Use plain PowerShell positive-count converter tests, not the proposed Invoke-Pester command. Pester is already used by repository validation (validate.ps1:1010,1108), but local availability was not established and a new dependency is unnecessary. Require the actual eight named converter cases, eight passed, zero failed/skipped and a nonempty typed receipt.

Seven-file scope remains seven, subject to coordinator approval: the already-listed WindowsShell.Tests.ps1 must additionally register one literal top-level Canvas paint artifact codec contracts section, invoking the new PowerShell test and enforcing those counts. Its general runner checks positive counts for Zig commands only (:449-477), so registering a PowerShell section without its own count check is insufficient. The GraphCanvas Zig root does not run converter tests. Both existing GraphCanvas/GdiplusAA invocations need -lgdiplus. Existing sharding/aggregate commands cover the new section once registered; no workflow/new runner is needed. The fixture and scripts already match graphcode-windows/* / Tools/windows/* in Tools\ci\classify-changes.sh:103-109. These are synthetic codec/receipt contracts, not screenshot/golden/visual CI.

For readiness, use one gated test through existing GdiplusAA.initWith: worker-entry and release events keep startup paused while synchronized isReady()==false is asserted; after release, call the real SystemStartup.run() and require the production ready predicate within the finite budget. Use static-lifetime test events, always release on unwind, and normal cleanup; do not invent tokens, reset racing globals, rely on a fixed sleep, or change production fallback. The current shown-window startup test is not this proof.

All commands remain proposed/not run. Exact nonvisual registration, hosted command path and readiness conditions are in the separately sealed qualification addendum supplied to the coordinator. J4 remains independent; later sidebar/right-panel work requires first-slice success and separate leases.

Plan approved: offscreen real-paint canvas export, first slice

Operator direction and the read-only recommendation 3C5B78718FF0E374469A70454736288223748A6AE00A6ADA167AAB962FD12B5E plus qualification D13D2683D8F8FB072E3B1A24B79FC164F03FDE0B57896F7F10AF6ED46BE1158F are accepted for one bounded first-slice PR. Complexity is standard: gpt-6-luna/high implementer; claude-sonnet-5.5/high independent reviewer. No manual screenshots. Every artifact and consuming PR must use the evidence label "real paint path, offscreen component render". This does not prove whole-window/compositor/popup/terminal/per-monitor-DPI/NativeForms behavior or close parity criteria automatically.

Exactly seven file leases:

graphcode-windows/src/GraphCanvas.zig: existing private ParityDib ownership/error-unwind/readback/BMP transport plus one fixed opt-in production-paint fixture/export test adjacent to existing DIB tests. Call actual paint and paintHeader; no renderer copy, product paint policy change or App CLI.
graphcode-windows/src/GdiplusAA.zig: synchronized readiness observation and one gated actual-native startup test through existing initWith/SystemStartup.run. Preserve production async init/fallback/shutdown semantics; static-lifetime entry/release synchronization, finite waits and unwind, no fake token or racing global reset.
New graphcode-windows/fixtures/paint-project-v1.json: one fixed V2 two-card/one-edge synthetic graph, decoded through production Model.updateFromFrame; omit age/activity timestamps, no fixture directory or user profile access.
New Tools/windows/Convert-CanvasPaintArtifact.ps1: converter-only lossless BMP to opaque PNG and provenance/RGB validation; no capture/process/UIA/native helper import, resize, crop or labels.
New Tools/windows/Tests/CanvasPaintArtifact.Tests.ps1: eight named plain-PowerShell nonvisual converter contracts, actual converter calls, typed 8/8/0/0 and unique-name enforcement; no new Pester dependency.
Tools/windows/Tests/WindowsShell.Tests.ps1: -lgdiplus on the existing GraphCanvas AND GdiplusAA roots, plus one literal top-level Canvas paint artifact codec contracts section with its own exact typed/unique positive count check. No general runner/sharding/workflow change. Do not enable PNG export in CI.
graphcode-windows/README.md: narrow opt-in usage, provenance and evidence limits only.

No App, NativeForms, GraphModel, Sidebar/right-panel implementation, provider/pin, capture-core, ValidationRunner, validate/bootstrap, workflow, classifier, schema, ledger, agent, replay framework or new encoder dependency changes. Existing Windows path classification covers these fixture/tool directories. GraphCanvas work is confined to the private DIB/export-test blocks; C's separate production/sidebar/selection changes must be preserved on any rebase. J4 remains sole capture-core writer and continues unchanged.

One 1280x720/96-logical-DPI/100%-zoom project fixture, actual renderer/font/GDI+ facts, two 250x96 card bounds and edge containment, three fresh same-host RGB-identical renders, and exactly one final PNG plus one paint-only manifest after checked conversion. Keep native BMP transport and logs. Fonts/rasterization/headless-session support remain observed limits, not universal guarantees. No visible HWND, screen DC readback, foreground, product/daemon/zmx process, journal or desktop capture is part of this path.

Test first with a real missing-artifact RED against a compiling paint/DIB seam, then the same export GREEN, eight actual converter contracts, readiness contract and focused adjacent regression. Compiler/link/setup errors are not behavioral RED. No environment opt-in skip/empty count is acceptance. Exact local commands, owned fresh roots and permitted GDI-only execution are named in the assigned kickoff; anything additional requires prior approval. Full local ValidationRunner, windows-shell unit/integration, provider/product builds, live UIA/hidden native HWND fixture/WinApp and screenshots remain forbidden. Hosted CI is the regression gate and must positively execute the nonvisual converter section and native roots, not infer them from aggregate green.

A different-vendor local vision reviewer must individually open and privacy-clear the produced PNG and applicable approved macOS reference before accepting any paint/layout claim. Render output is local review input, not CI visual gating, a golden image or a pixel-regression pipeline. No whole-issue closure or ledger promotion from a decoded PNG. Sidebar/right-panel exports are later separate slices only after this first one proves out. Refuse blank/partial/wrong-size/foreign/reparse/stale/provenance/codec errors without success-shaped manifests. Preserve all failed runs and source hashes; never edit code during an in-flight test. Refs #822 only; no automatic product readiness, merge or capture authority.

Read-only addendum after final J4 stop: claim routing

Offscreen evidence is “real paint path, offscreen component render.” It can support canvas-only paint/layout claims after actual source-bound rendering and different-vendor local image review; it is not whole-window, native-control, popup, terminal, input or persistence proof. No new implementation/desktop/install/live-capture lease, repair owner or manual fallback follows.

Live criteria read: #764 8, #767 6, #774 2, #778 4 = 20, all unchecked. The retained traceability matrix copies every criterion verbatim by ordinal and maps all 30 exact canonical demoted rows, without promoting any.

Open claim	Offscreen-eligible part / remaining obligation
#764.1–8	Actual cards, states, colors, roles, edges/ports, worktree chips and static flow/fit layout are paint candidates, not implemented merely by rendering. Shared color-table invariants, count/hit/action consistency and initial-fit/movement/persistence need functional evidence. Native add controls need their real control path. rp1's first scene is only two idle cards/one edge, not six states/five types/ages/attention/overview or all eight boxes.
#767.1–6	Next separately approved Sidebar.draw scenes can assess actual navigation/icons/tree/selection/footer/short-height paint after rp1 proves out and C's accepted source is known. Read snapshot: main `29160994`, C/#817 still pending. Extras removal/activity relocation/default expansion/selection/switcher/responsive behavior remain product gaps or deferred scope. Minimum-width contracts/readback need not become a screenshot experiment; actual overlay/z-order/overflow popup composition does need native evidence.
#774.1–2	Later actual Quick Chats empty/populated canvas and paintQuickChatBar can cover component copy/stripe/date/state/age. D/#815 merged bar/identity/no-panel code with visuals deferred, not empty redesign or backend attachment. A tab painted “Agent” is not a mounted backend session. Native buttons, terminal glyphs/splits/attachment and actual visibility routes remain separate.
#778.1–4	No canvas menu facsimile. E/#816 already has supported HMENU semantics: six states/39 observations/12 negatives within 196 native tests. Preserve that; unsupported export/import/conversions remain gaps and Windows extras stay explicit. Actual popup glyph/hover/chrome needs a real popup; native chrome may differ.

All 30 canonical rows, split rather than blanket-covered (full per-row obligations/ledger lines are in the retained matrix):

Rows	Offscreen potential / residual
Connection failure presentation; No-project Welcome detail; Empty global graph; Empty project canvas; Node positioning; Connector handles; Worktree reclaim offer; Composite breadcrumb; Quick Chats canvas; Quick Chat cards	Later actual GraphCanvas fixture scenes can cover painted components. First scene intersects only static project positioning/edge geometry, not these whole stories. Real disconnect/open/hover/drag/reclaim/back/chat actions, native empty-state buttons and persistence remain separate.
Sidebar update banner; Sidebar error footer; Activity strip	Later Sidebar / actual bottom-strip scenes; no offered/error/activity fixture in rp1. Actual offer/error clear/filter/navigation and moving activity out of the sidebar are not proved by injected state.
Update command; Tray lifecycle; Project context menu; Recent projects; Add Folder menu; Composite card actions	Native command/popup/taskbar or functional obligations. Adjacent canvas/sidebar paint cannot prove menus, action outcomes or Explorer composition.
Rename chat; Delete chat; Chat rename/delete; Open Folder; Clone Repository sheet; Add Remote Repository sheet; Remote Connection info; Project Settings sheet; Available update alert; Project delete loops; Project remove/trash	Actual native prompt/picker/form/confirmation paths. NativeForms tile paint is not a whole form, and historical A2 used a shown HWND parked offscreen + PrintWindow. Input/cancel/validation/clone/remote/install/filesystem outcomes require their own runtime evidence; not all need new images.

Next slices are proposals only: after rp1 succeeds, one bounded Sidebar adapter; separately a right-panel GraphCanvas.paintLoopDetailRail scene for actual mini-map/relations/sparkline/footer. The right panel is a real HDC seam, not a terminal or NativeForms substitute. Authentic NativeForms/other dialogs need a separately scoped native HWND/control/theme/DPI/message approach. No expansion of rp1's seven files.

Truly native image class	Best non-manual option to qualify / incremental cost
Whole window, OS chrome, native dialogs/children	Pinned WinAppCli 0.5.0 on exact owned HWND, reusing its WGC/PNG implementation: medium qualification cost, lower new code than custom WGC. It still needs an interactive Windows/DWM environment and separately approved lifecycle/privacy authority.
Native menus/submenus	Preserve semantic evidence; for missing pixels, direct WGC on the actual owned popup HWND is the narrow candidate, but `#32768` feasibility is unproved: high COM/D3D/ownership qualification cost. Root secondary-window capture is clipped. If unsupported, only the operator may consider a separately approved automated ownership/occlusion-checked screen-region alternative; never hand capture, never an automatic fallback.
Actual terminal glyphs/split panes/backend tab	Qualify the pinned CLI's WGC path on the real mounted provider workspace: medium-high readiness/identity/cleanup cost. Reject blank/fallback-only output and fake Agent labels; no provider/backend launch is authorized here.
Tray/taskbar/Explorer	Prefer a separately approved automated tightly scoped screen-region route for these shell-owned pixels; app-root WGC cannot show them. High desktop/privacy/ownership cost. Native lifecycle/readback can cover nonvisual portions without images.

Pinned quirks matter: 0.5.0 capture source restores minimized windows and can foreground even without --focus after a blank PrintWindow fallback; --capture-screen foregrounds/reads desktop. Command source composites visible direct-owned windows side-by-side, can return 0 with some captures failed, and crop resolution may silently return the full image. Require exact roster/geometry/backend/source/binary evidence, not exit zero. WGC 24H2 secondary windows default false, require qualifying intersection/order and clip to root bounds; not full out-of-bounds menus or ownership/privacy. Foreground-free is not headless. No hidden/minimized/locked-session guarantee was established. New direct WGC has more interop/readback/lifetime maintenance; FlaUI/WinAppDriver adds dependencies/server state without removing desktop/lifecycle requirements. A minimal launch/kill script cannot discard executable/kernel-generation/lifetime, isolated support/pipe/temp, bounded EOF or all-descendant cleanup.

Final J4 is not green: retained cim-green3/report.json was read/hash-verified: 5 executed / 3 passed / 2 failed. The pure 12-row decision matrix/three mutant distinctions and one complete→exited endpoint/cleanup passed; negative WQL ProcessId=-1 failed InvalidQuery and filtered pending .Count failed StrictMode. Exact micro-race not forced; no full 49-pass/Phase B/accepted lifecycle fix. Permanent stop supersedes resume wording. J3 main 49/48/1, E journal 49/47/2 and B's distinct sharing violation remain different historical results. No new core owner; executor/adapter stay parked.

The old dirty-4faf PNG is historical legibility only, not current after/parity. Current source hashes at conversion cannot rebind old pixels: require exact actual render source + test EXE + native PASS log + per-image provenance and new before/after runs under existing approval. Companion metadata improves possible pairs but clears no image; project-90% is not project/global-100%, and held originals remain untouched.

Original 3C5B... / D13D... plans/comments stay immutable. This worker opened no images, ran no tests/native/build/install/capture, changed no product source, and launched no worker. All criteria/rows remain open/Partial; operator decides.

Retained exact 20-criterion / 30-row matrix: rcap-final-stop-traceability.md, SHA-256 98E4EA949B57044A5E8DEED2F8B1D5ED2E1B3E54B90152D961610FC40DFAC889.

Option 1 revision: stock 0.5.0, main window + real blank Clone only

Unapproved revision. V1's fork dependency rejected. Stock only; no fork/patch/derivative/external work. Restore/foreground recorded in dedicated LAST desktop slot, <=15min / 90s cleanup reserve. Backend may be unattested; fallback admissible only if all postconditions pass. No implementation/native/tests/install/images/new worker now.

Gates and retained boundaries

Requires #826 merged + revised review + explicit file/command grants. J5 alone repairs core; use accepted exports/hashes/journal/release, not J4/R2. Two Phase A fixture fixes leave636A unchanged; Phase B needs review. Preserve J4 5/3/2, wrong static WQL assumption, incomplete endpoint and original49 floor; matrices != endpoints.

Baseline: C/#817 24209d2a70efee78be2a8214edf013e9b787ccd0 (checkout unchanged29160994). E/B/D/C merged != visuals: #767 open, NotExecuted826. Offscreen e58: seven-file rebase/review only, no native export; two idle cards/one edge. No product/renderer/ledger edits.

Stock pin, invocations and per-capture success interpretation

Official 0.5.0 release: commit fd7cb6f235fa54dd2c6e26386e65e967a2c8797a; x64 ZIP SHA-256 88735ce6c2582ac5fac6200194bf62467fdd72b44b2d230f3a4ed059fa79ee7d, 37,881,954 bytes. Later grant: verify/extract privately, hash exe/dependencies, absolute path; no global install/PATH/source build/upgrade. NativeAOT/self-contained distribution; actual dependencies/compatibility unmeasured.

Tracked children of accepted worker, fresh admitted values; PROPOSALS ONLY:

& $PinnedWinApp ui screenshot --window $ExactMainHwnd --focus --output $FreshMainPng --json
& $PinnedWinApp ui screenshot --window $ExactCloneHwnd --focus --output $FreshClonePng --json

No --app, selector/crop, --capture-screen, new flag or record mode. Main before Clone opens, then capture Clone's own HWND; visible parent is an ancestor, not a captured member. Root-with-Clone-open refuses. Clone owns no visible popup/dialog; its native child controls remain required.

Command checks owned windows even with --window, composites with28px labels/8px gaps and can exit0 with failed members. Independent pre-roster guard precedes invocation; refuse every composite, even one surviving member. No selector makes silent crop-full-image fallback unreachable.

Operator-confirmed criterion(a): stock's single-image schema has no captured/success boolean. Per-capture success requires all, not exit0 alone:

Exit 0, finite both-stream EOF, exactly one strict JSON object (multiline allowed; no array/duplicate field/junk).
Required nonempty filePath string and positive integer width,height,processId,hwnd match fresh owned output, decoded PNG, admitted PID and requested HWND. Optional string windowTitle must match independently observed cleared title; null is omitted by stock.
Only these fields: no windows even null/empty, elementId, error/failed-member, invented backend/success field. Missing/incorrect result fails regardless of exit; retain/classify stderr.
Fresh owned non-reparse PNG, positive bytes/decode/hash, DWM geometry, unchanged roster/generation, content/privacy/vision must also pass. Optional title never waives native title/state evidence.

Local receipt binds raw stdout JSON bytes/hash + result fields + PNG path/bytes/hash; no field is patched into stock. All geometry/roster/content/privacy/vision conditions remain mandatory.

Independent target/roster, geometry and content postconditions

Operator-confirmed home: ONE read-only PowerShell helper, Tools\windows\Get-UiCaptureWindowObservation.ps1, beside core; included in nine files below. Minimal scoped Win32 queries: EnumWindows/EnumChildWindows, GW_OWNER, HWND PID/thread/class/visible/iconic, GetWindowRect/GetClientRect + screen mapping, DPI, DWM extended-frame/cloaked. Pass accepted held identity and reuse core root/process guards; no shadow identity/global framework or capture/restore/focus/input calls in this helper. Native interop loads only on expressly granted invocation, not discovery/import. No native implementation now.

Pre/post bind exact HWND/class/thread, same test PID/kernel generation/exe/parent/session, owner chain, admitted app top-levels and real target child IDs/classes/bounds. Filter identity/owner before titles/text; no foreign title census. Recursive owner checks reject foreign/cross-process/unknown/cyclic membership; stock direct-owner enumeration is insufficient. In-process Clone only, no OS broker/picker.

Expected main roster = main only; Clone roster = same main + owned Clone. No other owned visible popup/dialog; target owns none. Native children stay required. Immediately pre/post require unchanged rosters, control/target identity/geometry/state, healthy exact UIA root and live held generation; record permitted foreground separately. Exit/replacement/incomplete metadata/drift/modal/continuity failure refuses. Stock has no atomic capture-time HWND-generation receipt: pre/post stability does not exclude every transient race.

Strict DWM geometry: record D=(L,T,R,B) and GetWindowRect separately. W_D=R-L, H_D=B-T; positive rect, unchanged pre/post DWM/client/DPI, and

PNG.width = JSON.width, PNG.height = JSON.height, abs(PNG.width-W_D) <= epsilon, abs(PNG.height-H_D) <= epsilon.

96DPI only: DPI-aware physical integer RECT/PNG, no DIP conversion, defined epsilon=0 physical pixels. Other DPI/formulas need prior review. No crop/rescale, GetWindowRect substitution, backend-appropriate bounds or widening. Resize/move during capture fails.

ScreenshotAsync can restore/foreground, fall WGC -> PrintWindow, then foreground/retry a blank. WGC approximates DWM; PrintWindow uses GetWindowRect, often differing beyond rounding. Both rects diagnostic; DWM remains acceptance. Fallback passing all postconditions is admissible. Backend Unattested; dimensions/variance/correct pixels do not identify it. No headless/no-effect claim.

Adapter decodes PNG + mapped client region: proposed gate each = >=4 visible RGB colors, population variance of Y>=1, Y=0.2126R+0.7152G+0.0722B (0-255); zero visible samples fails. Record counts/regions/thresholds; reject all-zero/alpha-only/uniform/border-only, no tuning. Blankness only, not backend/fallback/freshness proof. Cleared local vision confirms scene/controls; inconclusive unverified.

Two real states, provenance, privacy and lifecycle

Only project main + real blank Clone: App.cloneRepository -> WindowsRepositoryDialogs.openClone/openRepositoryDialog/createRepositoryDialogControls, actual owned HWND/four EDITs/buttons/labels; code foregrounds/focuses it. Existing semantic command4106 needs reviewed navigation grant, not menu-pixel/physical-input proof. Cancel only; no clone/Connect/Browse/network/backend/destruction, fake tiles/hooks. Missing safe route/control identity blocks.

Closed OPTION1_ROOT_CLONE_V1: compatibility 2 images, not before/after; separately admitted paired packet 4 (each phase main/Clone). Exact source/binary per phase; main/Clone same held PID/generation within phase, distinct phase identities.

Bind source/head/base/files, binary/build/core/adapter/helper/tool/dependencies, review/equivalence/nonempty exact-head CI run/attempt/job, job/fixture/mapping/canonical-root/lease and per-image state/clock/DPI/theme/geometry/title/control census. Seal before diff review; no audit-invented/rebound pixels. C's retained headings/rectangular selection/extras do not close #767.

Proposed host: Win11 24H2 x64/same user-integrity/unlocked DWM/D3D11/SDR/96DPI. No locked/secure/offscreen/minimized/RDP/HDR/GPU-loss/broker guarantee. Native compatibility unmeasured.

Later grant names restore/foreground/launch/open/cancel and OS consent/border effects. --focus explicit; record observed pre/post iconic/foreground HWND, no foreign captions or invented call audit. Stable visible target preferred; restore-induced state/bounds drift still fails. No foreign focus restoration, permission bypass/screen-DC/manual fallback; user activity aborts.

Neutral private fixture/titles/URLs/paths; owner-only per-run output/support/profile/temp/TMP/cache, unique pipe/session, canonical fixture lock/owner/reparse/foreign guards. Precheck titles/labels/controls/JSON/logs/paths; quarantine identifying/unrelated content, never crop/redact into a pass. Hash raw; individual privacy then different-vendor local agent vision, correct cleared macOS state/scale/reference. No auto-publication/held722 images/visual CI/goldens/manual screenshots.

Preparation/install/build/review require prior grants; fresh exact admission before clock starts. LAST slot<=900s valid UTC, worker expiry-90s, no reset/extension. Ceilings clamped to deadline: launch90s/state60s/CLI+EOF10s/UIA wait5s; observations end750s, terminal/quiescence810s, cleanup/release final90s. No permissive retry/new-root/log overwrite. Post-release artifact review uses no desktop.

Reuse managed launch/journal/held handles; all descendants, pending launches, bounded both EOF. Live incomplete CIM refuses; gone needs kernel exit+EOF, not empty CIM/PID/name kill. Official finally release, accepted immutable snapshots/terminal manifest/positive cleanup inventory/hash preservation; no journal rewrite or old-success fallback on parse/hash/ACL/version/lease/sharing failures. Retain primary/cleanup errors, rejected artifacts, commands/JSON/streams/identity/release. Unproved cleanup nonzero; transport != visual/input/backend/persistence acceptance.

Minimal later file scope and validation proposals

Nine GraphCode files; zero external. B5/tenPRINTWINDOW hardcodes require closed-profile generalization at Assert-CapSceneContract, Save-CapSceneImage, Assert-CapWorkerManifest. Preserve B behavior/assertions; no generic replay/guard weakening/terminal expansion. All paths below are under Tools\windows\.

Proposed file	Exact responsibility
New `WinAppWindowCapture.psm1`	Pin/request; `Invoke-WinAppExactWindowCapture` via core; stock JSON/PNG/DWM/content/privacy/local receipt. Workflow/limits in help; no lifecycle clone.
New `winapp-capture-pin.json`	Official ZIP/source + measured extracted exe/dependencies.
New `Tests\WinAppWindowCapture.Tests.ps1`	Native-free adapter contracts/positive counts.
New `Get-UiCaptureWindowObservation.ps1`	Sole read-only native query helper; proposed `Get-CapWindowObservation`/`Assert-CapWindowRoster` bound to core-held identity; no capture/input/launch/cleanup.
Post-#826 `UiCaptureDriver.psm1`	`Assert-CapSceneContract`/`Assert-CapJobIdentity` closed-profile/tool/helper binding only; identity/native lifecycle unchanged.
Post-#826 `Invoke-UiCaptureWorker.ps1`	`Save-CapSceneImage`/`New-CapManifest`/two-state branch; stock child journal, Clone semantic open/cancel/census.
Post-#826 `Invoke-UiCapture.ps1`	`Assert-CapLease`/`Assert-CapPreflightReport`/`Assert-CapWorkerManifest`: profile/two-or-four inventory; finally/journals reused.
Post-#826 `Tests\UiCaptureDriver.Tests.ps1`	Actual admission/refusal/release; original49 + J5 preserved.
`Tests\ValidationRunner.Tests.ps1`	Native-free child/positive counts, existing pattern4704/4716; coordinate shared file.

Four core files J5-exclusive until merged/released/freshly leased. CI/DCO/privacy/TDD/budgets unchanged. Reuse core admission/isolation/process/EOF/journal/release; new helper/adapter/profile only.

Later tests: retained behavioral RED/GREEN/wider positive-count regression/fresh roots. Good envelope+postconditions passes; exit0-only/composite/error/field/path/PNG/DWM/owner/roster/generation/blank/privacy/timeout/EOF/cleanup/lease negatives refuse. All-postconditions fallback passes without backend proof. Matrices/stubs != native/actual-supervisor endpoints. No native tool/install/capture in CI.

Proposed commands, not run/authorized here:

pwsh -NoProfile -File Tools\windows\Tests\WinAppWindowCapture.Tests.ps1 -ScratchRoot $FreshAdapterRoot
pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot $FreshCoreRoot
pwsh -NoProfile -File Tools\windows\Invoke-UiCapture.ps1 -OwnedRoot $OwnedRoot -OutputDirectory $FreshOutput -JobPath $JobPath -JobSha256 $JobSha256 -FixtureMappingSha256 $MappingSha256 -ExecutionMode LIVE_CAPTURE -LeaseReceiptPath $LeasePath -LeaseReceiptSha256 $LeaseSha256 -PreflightReceiptPath $PreflightPath -PreflightReceiptSha256 $PreflightSha256

Core bounds screenshot child; no timeout flag assumed. Inspect/invoke/wait need separate exact-command/selector/healthy-root grant; wait-for --gone can swallow errors, not absence proof.

Coverage delta and unchanged complete traceability

Candidates: main composition/chrome + real blank Clone controls (row24), not whole card/sidebar criteria or clone/validation/progress/network/disk outcomes. Semantic/UIA/input/state/backend/persistence remain separate. Preserve HMENU semantics; menu pixels/terminaloption3/trayoption4 DEFERRED, offscreen scope unchanged.

Reuse predecessor mapping + immutable original sections7-8, option1-pinned-hwnd-plan.md SHA AB089ACD158E0AC506FB525E5A9A7FB911EFAA9FD93CFF2BA3E2CD640CE62544: 20 exact criteria (#764=8/#767=6/#774=2/#778=4), 30 canonical rows/order/main lines, mixed obligations unchanged. Full rcap-final-stop-traceability.md SHA 98E4EA949B57044A5E8DEED2F8B1D5ED2E1B3E54B90152D961610FC40DFAC889 unchanged. Original body/receipt immutable; old fork/WGC-only policy withdrawn, not inherited.

Zero promotions; ledger98=6Validated/89Partial/3OOS. Success-envelope/DWM/root-then-Clone interpretation now operator-confirmed; revised design/96DPI/variance implementation still needs review. Unmet postcondition => failure/Unsupported, no relaxation/fork/promise.

Read-only: scratch + PATCH6186605912/GET, no POST/worker/product/native/test/import/build/install/image/UIA/input/desktop/CI/PR. Artifact/SHA/original checks to coordinator/same reviewer; stop.

Plan accepted at design/source-review stage only

The shortened stock-only option-1 plan, SHA-256 39A5810F927E9D07BD76FCE4455631A76B485D8C9E2727E7374432AAE9CC96F2, has passed the same independent read-only review after the operator's clarification. The superseded fork proposal remains preserved as historical evidence, not authority. Stock pinned WinAppCli 0.5.0 only; no external fork, patch or derivative.

The first proposed slice stays the main window before any owned popup, then the real blank Clone dialog on its own HWND. It uses the confirmed strict single-result JSON/PNG binding, exact HWND/held-generation and unchanged roster checks, 96-DPI physical DWM-frame geometry with zero tolerance, independent nonblank checks, privacy review and local different-vendor vision. GetWindowRect is diagnostic only. Restore/foreground are permitted only within the explicitly admitted final desktop slot; backend remains unattested, and a fallback is admissible only when every acceptance check passes. A legitimate fallback may therefore be Unsupported on geometry, not a reason to widen bounds or retry silently.

The prospective nine-file GraphCode scope includes one read-only observation helper under Tools/windows, the stock adapter/pin/contracts, and only the necessary closed-profile integration with the repaired core and runner registration. It is not an active write lease: the four core files remain J5-exclusive. Menus retain their semantic evidence; terminal and tray remain deferred. The 20-criterion/30-row traceability grants no promotions or whole-issue closure.

Implementation, installation, native compatibility probes and capture remain blocked until #826 merges and the coordinator issues exact file/command grants for the accepted final core. This is source-level plan acceptance, not runtime compatibility, image acceptance, a desktop lease, a visual CI gate or permission for manual screenshots.

Document bounded parity evidence and execution admission (#828)

Frozen offscreen artifact admitted for scoped local review

The operator has permanently stopped rp1 as an executor at its five-failure limit. The last two were ungranted, worker-added validators (an ANSI-sensitive outer-console gate and a syntactically invalid post-conversion header check), not renderer/converter/product defects. That history remains preserved; no new fix owner, source change or executor restart is authorized.

Coordinator read-only admission has checked the actual published JSON and hashes: project-paint-v1.png is 33,248 bytes, SHA-256 4338A7F10FFBF18329F054B2340E5FCB59A8B5B2E97C17D45B195321BE47AA23; manifest SHA-256 AAFFA47BF9C75DD3DB756E67C4B4810583671CFA93ED9CCD884657F6913759C3. It contains exactly one 1280x720 artifact, labelled real paint path, offscreen component render. The manifest's seven source hashes agree with the native and conversion before/after receipts; base HEAD is 24209d2a70efee78be2a8214edf013e9b787ccd0, not a claim that the then-dirty feature existed at that commit.

The postc2 native receipt ABB9F845...F34A records exit 0 and the exact named 1/1 paint test; it binds wrapper E68840D6...6C10, test EXE 29BF1CDE...7D3A, canonical log 3004E128...F0D2 and paint receipt DFA724BD...4B85 through the retained producer/conversion receipts. Three same-host renders and the converter's decoded PNG RGB agree at 735b84aae3da48b864b3235fe1a42c3b0f52c700f82d90e85576444c9350749a. Conversion exited 0 and published exactly the PNG and manifest. These are provenance records, not cryptographic execution attestation or cross-machine determinism.

Initial individual privacy inspection of the actual Windows PNG found only synthetic fixture content, with no user names, home paths, credentials or unrelated desktop residue visible. One fresh Claude Sonnet 5.5/high local vision review is now limited to its two idle cards and one edge, compared with the individually cleared project-100% macOS frame. Different fixture states prevent whole-scene equivalence; incidental sidebar/header and whole-window/native behavior are outside this acceptance. No row promotion, whole-issue closure, image committed to the repository, visual CI/golden gate or manual screenshot follows this admission. The review result and mechanical draft-PR publication remain separate steps.

Local vision result: accepted with narrow limitations

One fresh Claude Sonnet 5.5/high reviewer viewed only the admitted Windows PNG (4338a7f1...aa23) and individually cleared macOS project-100% frame (f259c7d4...e935). Verdict: ACCEPT with stated limitations as real paint path, offscreen component render evidence.

Observed support is limited to two idle cards with legible title/state/detail/meta text, opaque fills, no clipping/overlap and a consistent grid. Only a short, low-contrast connector stub is visible; its label is displaced, and direction, routing, ports and full edge-rendering quality are not proved. The reference has different fixtures/states and meaningful card/pill/type/age/chip/edge differences. This is not an equivalent-scene or same-state parity comparison.

The reviewer saw only synthetic fixture text and no user paths, names, emails or secrets. Sidebar/header/window chrome, hidden right panel, all states/types/ages/attention, actions, input, accessibility, native window/provider behavior and persistence are not accepted by this image. Provenance/native 1/1/repeated RGB/codec checks are separately recorded measurements, not conclusions from pixels.

No ledger promotion or whole-criterion acceptance. The frozen seven-file capability is proceeding only to mechanical draft publication and exact-head CI, with rp1 permanently parked at 5/5. The original five failure/process-deviation history and all artifacts remain unchanged. No image is committed, no visual CI/golden suite is introduced and no live capture authority follows.

Export source-bound offscreen canvas paint evidence

Export source-bound offscreen canvas paint evidence (#830)

Frozen capability merged; scoped claims unchanged

#830 merged as baa2f0c6b9388f11219dd97e7d4cfed2176bc17b. All seven persisted file blobs match the admitted frozen source. After a conflict-free, explicitly approved docs-only rebase, final head e75fa381c63e7fdf43aa86a8ebc44240533db2e6 passed fresh first-attempt CI and fresh Ready-event DCO; no retry allowance was consumed on that head and repository protection was not bypassed.

The admitted local image remains real paint path, offscreen component render: two legible idle cards and a weak short connector stub. The Sonnet vision limitations, differing macOS fixtures, missing strong edge/direction/routing/port evidence and all whole-window/native/input/persistence exclusions remain intact. This is a capability merge, not a ledger promotion, whole-criterion acceptance or image-collection completion.

rp1 stays permanently parked at its five-failure stop; source, artifact and failed/process-deviation history remain preserved. No image is in the repository and no visual CI/golden baseline or manual screenshot route was introduced. Later scenes, native capture work and other surface adapters require separate file/command authority; #826 and this tracker remain open.

Pair combined macOS references without promoting Windows parity (#832)

Combined macOS return intake merged, Windows statuses unchanged

The metadata-only intake #832 merged as 661f283798986dd7f919ada60cc6dbfc34130845. It uses the sealed local combined collection from source 2ccf303a04f995184aae1d4b738a9eca0f71b79e and its authoritative v12 tables, with actual metadata paths and hashes in the ledger.

All 65 exact reference IDs are retained: 46 Recorded / 5 Differs / 14 macOS reference: accepted unrecorded / 0 Dropped. The 14 are precisely the user-accepted SSH/Codespace, updater and physical-pinch omissions; this is a macOS-reference disposition, not Windows acceptance or a new Out of scope status. All 30 qualified rows are mapped, plus additional affected canonical rows (53 distinct across the crosswalks); three subcases explicitly have no exact canonical row rather than inventing one.

The 98 canonical Windows row identities/order/statuses remain 6 Validated / 89 Partial / 3 Out of scope, with all thirty demoted rows still Partial and zero promotions. Current Windows evidence is still required. The original held images remain forbidden; no image was opened or committed by this docs intake, and producer reports/three operator samples/the separate earlier eleven-image sample are not blanket independent clearance of 442 PNGs.

Failed v4/v8 attempts, source-only v7, the historical v3 twelve-turn/two-turn-ceiling deviation, v11's separately permitted single response, transient folder fallback, direct-root Composite versus aggregation, differing states/zooms and inherited locator exceptions remain explicit. The command-lease retrospective is recorded: self-added validators/gates are out of lease.

This merge is text/JSON/hash reconciliation only. It authorizes no additional product, renderer, native, provider, capture, visual review or ledger promotion work and does not resume the permanently stopped rp1 executor or parked live-window pipeline.

Repair Windows capture attestation and immutable journals (#829)

Windows: Share the pinned local UI verifier and capture driver #822

Description

Activity

coneilen commented on Oct 14, 2026

Implementation plan (wave 2)

Dependency and approval gates

Source-derived gaps

One shared driver and handoff ownership

File-scope proposals, NOT approved leases

Trusted inputs and independent verifier protocol

Local evidence shapes; no G3 transport contract

Canonical fixture, real daemon/client and lifecycle

Exact pinned WinApp compatibility plan; NOT executed

Implementation and evidence plan; commands NOT executed

Timers, same-slot visuals, privacy and scope limits

Complexity and reviewer policy

coneilen commented on Oct 14, 2026

Plan approved (coordinator): G2-R1 same-core repair only

coneilen commented on Oct 15, 2026

coneilen commented on Oct 15, 2026

Plan approved (coordinator): G2-R2 lease-bound job identity

coneilen commented on Oct 15, 2026

Coordinator decision: D adapter plan conditionally accepted; no active implementation lease

6 remaining items

coneilen commented on Oct 15, 2026

READ-ONLY recommendation / proposed one-PR slice

coneilen commented on Oct 15, 2026

Read-only plan qualification: nonvisual contracts and readiness

coneilen commented on Oct 15, 2026

Plan approved: offscreen real-paint canvas export, first slice

coneilen commented on Oct 15, 2026

Read-only addendum after final J4 stop: claim routing

coneilen commented on Oct 15, 2026

Option 1 revision: stock 0.5.0, main window + real blank Clone only

Gates and retained boundaries

Stock pin, invocations and per-capture success interpretation

Independent target/roster, geometry and content postconditions

Two real states, provenance, privacy and lifecycle

Minimal later file scope and validation proposals

Coverage delta and unchanged complete traceability

coneilen commented on Oct 15, 2026

Plan accepted at design/source-review stage only

coneilen commented on Oct 15, 2026

Frozen offscreen artifact admitted for scoped local review

coneilen commented on Oct 15, 2026

Local vision result: accepted with narrow limitations

coneilen commented on Oct 15, 2026

Frozen capability merged; scoped claims unchanged

coneilen commented on Oct 15, 2026

Combined macOS return intake merged, Windows statuses unchanged

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions