diff --git a/investigation/ui-parity-matrix.md b/investigation/ui-parity-matrix.md
index 5e95e18e..75d519a1 100644
--- a/investigation/ui-parity-matrix.md
+++ b/investigation/ui-parity-matrix.md
@@ -451,12 +451,123 @@ pixels, not a real window/composition, popups, terminal, native controls, input,
 accessibility, physical input or persistence. Never rebind old dirty
 `4fafbfb2` pixels with conversion-time current hashes. Sidebar/right-panel/
 NativeForms slices require separate later approvals after the first proves out.
-The selected stock-only real-window route under #822 requires #826 merge,
+At this earlier merged-slice checkpoint, the selected stock-only real-window
+route under #822 required #826 merge,
 an accepted current plan and separate exact implementation/native/install/capture
 grants. A reviewed plan alone is not an execution lease; no capture mechanics
 are available by virtue of this ledger. No manual screenshots or
 screenshot/golden/pixel-baseline CI fallback is authorized.
 
+### 2026-10-15 source and capture-status retrospective
+
+This is a bounded source/receipt update, **not visual acceptance**. It leaves
+all 98 canonical identities, order and statuses at **6 Validated / 89 Partial /
+3 Out of scope**, all thirty qualified rows `Partial`, every full B8/C6/D2/E4
+criterion unchecked, and the 65-item/30-row crosswalks, digests, locators and
+privacy limits above unchanged. It opens/copies/uploads no images, including
+the held issue-722 originals or publication-hold notice.
+
+**Qualified source repair, not a successful capture.**
+[#829](https://github.com/scgopi/GraphCode/pull/829) merged as
+`badcf5149be2a01abd866e4cf180521f485fa2c4`; the coordinator verified all four
+reviewed blobs, both hosted 59-case runs (Windows 2022 and 2025), all nine
+required status contexts and fresh Ready/DCO admission. Configured path skips
+are not runtime proof. The original qualified role-label RED and old CI failures
+remain evidence. [#826](https://github.com/scgopi/GraphCode/issues/826) stays
+open because the later **real pinned-provider** path failed.
+
+The source-bound PTR BEFORE build was actually
+`112d458303891f87af6c1dc6beaf7e48073fd65c` (first-parent B baseline before
+#814's `4fafbfb2`); AFTER was actually
+`944ee565ed2e36885b8cf1087fc5fbe2d05d38b6`, not a new build of badcf.
+Reviewed `944ee565`, test merge `59e9fd3e4e017fcc65202290c1ceee632e15cc60`
+and merged `badcf514` have the same **complete tree**
+`a6ccbfd5580d9fba0c336da93e716609c4538ce0`. Five-clone raw
+proofs total **14,260 file checks / zero mismatch**, not unique contents;
+separate actual LFS-filter counts are 43 per GraphCode clone / zero providers.
+Setup's original console/exit/EOF were lost after the Tee failure; the
+operator qualified self-written five-positive reports plus held-PID exit,
+not an invented observed exit 0. Coordinator assembly 1 failed on
+OrderedDictionary/Measure-Object before writes; corrected explicit accumulation
+and fixture path preceded the one renewed assembly 2's **13 source/data
+records**, not new builds or native execution.
+The read-only assembly receipts are
+`C:\gcs\coord2\coor-b-assembly2-readback.json` and
+`C:\gcs\coord2\coor-b-assembly2-inventory.json`.
+
+**One actual B slot, zero images.** User-selected coordinator execution used
+lease `640c69a9-049e-46ba-9ebe-5c813a3f93a1`, granted
+`2026-10-15T23:50:18.464Z` / expiry `2026-10-16T00:05:18.464Z`,
+run `cdba36a51f144798b40fd78bdb50251b`. At about 23:50:45Z the exited
+seed launcher PID 36288 failed bounded stdout/stderr EOF because daemon
+PID 22760 held inherited pipes. The retained
+`C:\gccp\capture-coordinator-b1\manifest.json` and `lease-release.json`
+record `guiLaunches=[]`, `images=[]`, **captures 0** and
+**CLEANUP_UNPROVEN**: both worker EOF flags false and final binding null.
+The operator's separate later daemon stop/zero GraphCode-zmx process report
+does not make that original receipt clean. No paired vision, checkbox or
+ledger promotion follows; **no retry or new live B lease** was granted.
+The [actual mechanism report](https://github.com/scgopi/GraphCode/issues/826#issuecomment-6205088603)
+is tracked separately in [#834](https://github.com/scgopi/GraphCode/issues/834).
+Core-59b's actual 59/59 result was explicitly **not a real-zmx/peer rehearsal**,
+with `Start-CapOfflineSeed` stubbed; it did not exercise this daemon failure.
+Earlier public cap stop comments
+[#764](https://github.com/scgopi/GraphCode/issues/764#issuecomment-6204588086) /
+[#826](https://github.com/scgopi/GraphCode/issues/826#issuecomment-6204588503)
+predate this slot and are not capture-mechanism results.
+
+**Simpler component route, still no accepted pixels.** Merged
+[#830](https://github.com/scgopi/GraphCode/pull/830) supplies **real paint path,
+offscreen component render** capability, not a live window, screenshot,
+manual/golden CI or a whole-row verdict. The new #764 worker has neutral
+JSON/eight-box mapping. Its actual one-case native RED (expected 6, found 2)
+preceded the coordinator's exact grant: a qualified admission of a
+**deviation**, not retroactive authority or a RED retry. M2/M3 standing scope
+permits scoped offscreen GDI tests/scene contracts/conversion on owned outputs,
+production paint unchanged; no actual GREEN/PNG/vision is yet accepted by the
+coordinator. Source findings alone are not confirmed visual bugs; actual
+scenes and paired review are required for a visual verdict. Track a suspected
+paint bug separately, not in this evidence change. No box/row is promoted.
+
+The fixture-only reader fix for [#833](https://github.com/scgopi/GraphCode/issues/833) has
+actual held-writer `80070020` RED (harness exit 0, one failed record),
+tracked-helper AST GREEN 1/1 with same-byte SHA, a 59-unique-named-case
+all-pass suite with identical named floor, and one accepted source review.
+The published draft is [#836](https://github.com/scgopi/GraphCode/pull/836),
+head `359a033ba749a9bcf2648ba8b96ee424ad8f398a`. At documentation freeze
+`2026-10-16T01:14:57.815Z`, coordinator-verified **original CI is blocked**:
+port [38832369751](https://github.com/scgopi/GraphCode/actions/runs/38832369751),
+job 116753854474, failed `VerifyValidationRunner` before Swift/real-zmx test
+execution. `Get-Content` hit `mp-start.identity` sharing violation in the
+unchanged `uia-live-gate.ps1` blob at badcf/359a, already using atomic
+pending-file move; holder/cause **unknown**.
+Hardening [38832369710](https://github.com/scgopi/GraphCode/actions/runs/38832369710)
+Windows 2025 job 116753830293 actually executed **59 / 57 passed / 2 failed**:
+target-nonzero lacked Failure/release/EOF evidence and the repaired-report
+gate refused the failed rehearsal; underlying cause **unknown**. Windows
+2022 job 116753830273 has actual log/JSON **59 / 59 passed / 0 failed**,
+still stubbed/no-desktop, not real-zmx/GUI. These original failed results do
+not establish all nine required status contexts as passing, Ready/merge or a
+#834 lease. The operator separately authorized **one diagnostic rerun of only
+failed jobs**, on unchanged `359a033ba749a9bcf2648ba8b96ee424ad8f398a`,
+in runs 38832369751 and 38832369710 (attempt 2), not a source fix or reset.
+This document grants **no additional rerun, new fix owner, native/GUI/capture
+execution**. The sole published file is
+`Tools\windows\Tests\UiCaptureDriver.Tests.ps1`. The separate wrapper has six local contract GREEN
+results, also **Pending coordinator verification/merge**, and is not available
+on the read main. Missing-API wrapper RED was not behavioural/test-first
+evidence. #834 has an **approved design/final cost addendum only** for suspended
+CreateProcessW/handle-list work preserving public `zmx run -d`, not a repair
+already executed or an execution grant; an internal `--daemon` bypass is not
+approved. No implementation edits before #836 merge (the #833 fixture fix)
+and the exact sole-core lease; Sonnet 5.5/high source review precedes any
+native execution. Real production zmx/peer RED/GREEN, orphan cleanup,
+permanent no-stub preflight and the full 59-case + #833 floor remain gates.
+D adapter then option-1 helper remain
+downstream. The orchestration plan carries these bounded dependencies; none
+resumes stopped owners, authorizes capture or changes the reference/privacy
+limits.
+
 ## Preview delivery lanes
 
 The [Windows preview-readiness plan](windows-preview-release-plan.md) separates
diff --git a/investigation/windows-parity-lane-kickoff.md b/investigation/windows-parity-lane-kickoff.md
index d604d54c..850737bb 100644
--- a/investigation/windows-parity-lane-kickoff.md
+++ b/investigation/windows-parity-lane-kickoff.md
@@ -19,7 +19,7 @@ Each issue gets two workers, in order (operator decision, 2026-10-14):
 ### If you are the planning worker
 
 Produce the plan from evidence, not memory. Read-only on the repository. Build,
-test or desktop execution requires the per-issue command grant in Environment;
+test or desktop execution requires the per-milestone command allow-list in Environment;
 planning permission alone authorizes none of them.
 
 1. **Read** the issue, its comments (including earlier attempts' findings), the ledger rows,
@@ -149,8 +149,9 @@ D/#815 and C/#817 source slices, not whole issue closure. #768/#778/#764/#774/#7
 remain open, full B8/C6/D2/E4 criteria stay unchecked and B/C/D/E visual
 acceptance is NotExecuted (#826). Preserve all 98 ledger identities/order and
 **6 Validated / 89 Partial / 3 Out of scope**; thirty demoted rows stay Partial.
-The orchestration plan's current execution/evidence authority governs J5,
-parked adapters and the separately gated stock-only real-window route.
+The orchestration plan's current execution/evidence authority distinguishes
+the historical J5 repair, current pending repairs, parked adapters and the
+separately gated stock-only real-window route.
 
 - **One issue, one PR, one coherent slice.** The first PR fixes the issue's primary
   defect. Leave remaining acceptance boxes unticked and list them. Small PRs merge;
@@ -161,9 +162,14 @@ parked adapters and the separately gated stock-only real-window route.
 
 ## Environment: do exactly this
 
-**Execution admission overrides the examples below.** Every worker needs a
-**per-issue exact local command allow-list** and **fresh owned roots** before
-execution. Repository bootstrap/build/test examples are **not blanket permission**.
+**Execution admission overrides the examples below.** New active work uses the
+user-approved milestone policy under "When it isn't working", not a five-failure
+counter. Every worker needs a **standing per-milestone allow-list** and
+**fresh owned roots** before execution. For low-risk offscreen/tests, record
+commands, owner, tools, source/output roots, positive counts, immutable logs and
+ceilings together; do not require a new microgrant for each already listed
+command. Anything outside that list needs an explicit grant. Native GUI and
+desktop slots remain separately bounded. Repository examples are **not blanket permission**.
 No local full `Tools\windows\Tests\ValidationRunner.Tests.ps1`,
 no `validate.ps1 -Task windows-shell` unit/integration, and
 no GraphCode/daemon/zmx/provider build or launch unless separately explicitly
@@ -171,12 +177,21 @@ granted. CI owns broad/native regression. Narrow harmless-process, offscreen
 or capture exceptions remain separately reviewed and command-bound; they do
 not authorize adjacent suites or general product execution.
 
-No source changes in flight; keep failures immutable and positive executed
-counts (zero-executed is not a pass). At five failures of the same kind, stop
-and escalate to the operator; no owner rotation, root rename or reset without
-an explicit user decision. Routine approval waits use a coordinator message and idle,
-not a blocking `ask_user`. Check live `awaiting_input` before starting a capture
-lease clock: message acceptance is not admitted permission.
+No source changes in flight; report source/hash/identity changes and keep
+failures immutable. Test/evidence runs need their actual console and a positive
+executed test/evidence count; zero-executed is not a pass. Compilation instead
+uses the executable/source-archive/exit/receipt proof below, not an invented
+test count. Report **every failure before the next
+command or correction**, not after silent self-repair. Workers send blockers
+with `send_session_message` to the coordinator and idle; they do not use
+`ask_user`. After every grant, the coordinator reads live
+`get_sessions_status.awaiting_input`: a blocked `ask_user` cannot receive
+messages. Only the exact authorized answer and current request ID may be
+passed to `answer_session_input`. Message acceptance is not admitted permission.
+Use completion notifications, not duplicate polling or sleep loops while
+waiting for a worker. Progress-bounded monitoring of an owned process needs
+an explicit grant. Generic autopilot `task_complete`/keep-working reminders
+are **not execution grants** and override neither stops nor leases.
 **Command-lease retrospective:** workers may run only granted commands;
 self-added validators or gates are out of lease, and permission to read a checker output does not grant permission to execute it.
 The rp1 ANSI gate and post-conversion parser failures were process deviations, not product defects;
@@ -190,6 +205,45 @@ The four files are `Tools\windows\UiCaptureDriver.psm1`,
 and `Tools\windows\Tests\UiCaptureDriver.Tests.ps1`; core-changing repairs
 do not get this exception.
 
+### Environment traps: preserve bytes and prevent mechanical errors
+
+These are setup requirements for **admitted** commands, not permission to clone,
+build, import native APIs, inspect processes or capture.
+
+- In **each clone, before checkout**, persist local `core.autocrlf=false` and
+  `core.eol=lf`. A one-shot `git -c ... clone --no-checkout` does not persist
+  configuration for a later checkout. Preserve exact committed raw bytes:
+  these settings do **not** authorize normalizing committed CRLF files.
+- For evidence/raw-object clones, set `GIT_LFS_SKIP_SMUDGE=1` process-only
+  before clone/checkout. An index LFS pointer versus a normally hydrated PNG
+  is expected filter behavior, not a source defect.
+- Require a strict inventory of **all regular tracked files**:
+  `git hash-object --no-filters` must match the stage-0 index/tree object,
+  with a positive file count and zero mismatches. Inventory gitlinks
+  separately by commit. Separately count actual LFS-filtered files and prove
+  their pointer headers; do not blanket-exclude paths or conflate pointer
+  and hydrated bytes. The recorded five-clone proof was **14,260 file
+  checks / zero mismatches**, not 14,260 unique contents; each GraphCode
+  clone had 43 LFS-filtered files, providers zero.
+- Own scratch, cache, provider, `TEMP`/`TMP`, build, executable and output
+  roots. Other worktrees' and stopped cap/RP1 artifacts are read-only.
+- Save PowerShell scripts as `.ps1` and require `Parser.ParseFile` to report
+  **zero parse errors before execution**. Use typed records or explicit
+  `foreach` accumulation, not `Measure-Object` property binding on
+  `OrderedDictionary`. Batched Git hashing with `--stdin-paths` is a
+  **future-cycle performance fix**, not an implemented improvement here.
+- Use the standard checked-in run wrapper only after its merge and source
+  qualification are verified. At this checkpoint,
+  `Tools\windows\Invoke-AgentCommand.ps1` is **local GREEN, pending merge**,
+  not available on the read main. Until qualified, the coordinator supplies
+  literal `Out-File -NoClobber` commands. Never use
+  `Tee-Object -NoClobber`: `Tee-Object` has no such parameter.
+- Successful Zig builds can have **zero-byte logs**; silence alone is not a
+  failure or hold. A positive executable, source archive, exit evidence and
+  build receipt prove compilation, not runtime parity. Preflight/capture
+  logs instead require a nonempty **actual** positive summary/count;
+  never append synthetic success text.
+
 The following root/tool setup applies **only when the exact commands are
 separately granted**; do not bootstrap, seed or build merely to start a lane.
 Replace `<id>` with your lane id, for example `c4`.
@@ -249,7 +303,9 @@ Report each step's result, or NotExecuted with the reason.
    - Write the failing test first, and keep its output.
    - Layout criteria are testable as geometry: rects lie inside the client area and above
      the footer, text bounds come from the container, and nothing overlaps.
-   - A compile error is not RED.
+   - A missing-API compile error is not behavioural RED. Documentation-only
+     source checks are static evidence, not product-runtime RED; report an
+     evidence gap rather than inventing a test or checker.
 3. **GREEN.** Run only admitted focused commands and quote the positive executed count.
 4. **Push a draft PR; exact-head CI owns broad/native regression.**
    - Execute locally only the approved exact allow-list. A focused root, script
@@ -297,16 +353,66 @@ Report each step's result, or NotExecuted with the reason.
 - An empty result is not a pass.
 - Keep failed attempts. Label harness failures separately from product failures.
 
-## When it isn't working
-
-- A failed iteration is one of:
-  - a fix attempt after which the same test still fails;
-  - a substantive review rejection;
-  - an exact-head CI failure that you caused.
-- After **5 failed iterations of the same kind**, stop and send `STUCK` with a handoff note:
-  what you tried, the failing output, the reviewer findings, and what's worth keeping.
-- Before that, iterate only within admitted commands. Waiting for approval,
-  desktop, CI or review is not a failure; it grants no execution permission.
+## When it isn't working: milestones, fresh eyes and hard ceilings
+
+**User-approved policy, 2026-10-15, for new active work.** It replaces the
+five-iteration rule prospectively, not historical failure records or permanent
+stops. Cap, J3, J4 and RP1 remain stopped, not archived, unless a new explicit
+user decision changes their disposition.
+
+1. Define **3-5 observable milestones** per task. About **60 minutes or 40
+   raw tool calls without reaching a milestone**, whichever comes first,
+   requires a one-page handoff and a **new, history-free fresh-eyes session**.
+   Supply the requirement, admitted scope, evidence/failed approaches, costs
+   and next observable result, not the old conversation history. Fresh eyes
+   asks: are we closer, is there a simpler route, and are we solving the
+   right problem? Decide **one further time box to continue**, replan,
+   restart or escalate. Renaming roots or heads never resets a ceiling.
+2. Keep a "what are we doing, in order to do what?" dependency list back to
+   the requested outcome. At **three levels removed, STOP and replan**.
+   If evidence preparation costs more than about **3x the work proved**,
+   request a simpler requirement rather than adding more plumbing.
+3. Prevent mechanical errors using the saved-script/ParseFile-zero and
+   qualified-wrapper requirements above; do not turn typos into a new
+   failure counter. Preserve and immediately report every failure, including
+   deviations from the command allow-list.
+4. Work only inside the standing milestone allow-list. Paused approval,
+   CI or review does not grant neighbouring commands, native work or a
+   desktop slot. Re-engagement records actual scope, time and tool calls.
+5. A worker stops at **6 hours ACTIVE, 60 AI credits or 400 raw tool calls**
+   from kickoff/fresh-eyes re-engagement, whichever occurs first:
+   handoff, then **IDLE**. **Only the user/operator can extend it.**
+   Report wall time and raw calls; if credits cannot be measured, write
+   **credits UNKNOWN**, never an estimate. The coordinator has the same
+   handoff/operator gate at **12 hours or 150 AI credits between actual
+   documentation checkpoints**.
+
+### Historical stops and evidence-cost retrospective
+
+The cap owner `9b889` stopped permanently at its historical five counted
+self-authored command recipes: precondition parser, wrong expected raw pin
+SHA, malformed `Copy-Item`, unsupported `Tee-Object -NoClobber` wrapper,
+and `ParseFile` interpolation plus a late fix. The 43-file LFS gate failure
+was an **operator specification defect, uncounted**; expected Zig silence
+and an atomic no-op patch context miss were also uncounted. The operator's
+"about six hours without desktop / four of five typo-class" is an
+**assessment**, not a new timing measurement. The public stop comments on
+[#764](https://github.com/scgopi/GraphCode/issues/764#issuecomment-6204588086)
+and [#826](https://github.com/scgopi/GraphCode/issues/826#issuecomment-6204588503)
+predate the actual coordinator slot and are **not capture-mechanism results**.
+
+The capture worker `9b889`'s own blocking `ask_user` delayed admission of the queued
+core-59b rerun grant roughly **12:25-13:48 (about 80 minutes)** until the
+operator answered. The coordinator failed to detect that pending input; the
+live awaiting-input/answer rule above prevents message delivery from being
+mistaken for admission. Coordinator B assembly 1
+failed on `OrderedDictionary`/`Measure-Object` before writes; explicit
+`foreach` accumulation and a fixture-path correction preceded the **one
+renewed assembly 2**, which produced 13 source/data records, not new builds
+or native evidence. Preserve these failures even though counting is no
+longer the active policy. Current source/capture facts and pending repairs
+are in the orchestration plan and the ledger's bounded retrospective;
+none revives a stopped owner or grants another live slot.
 
 ## Communication
 
@@ -315,6 +421,7 @@ Message the coordinator only for:
 - `LEASE REQUEST` and `LEASE RELEASED`;
 - a lease-scope question (outside-lane files or a scope decision);
 - `STUCK`;
+- a milestone handoff, hard-ceiling stop or failure/deviation before correction;
 - `PR READY`.
 
 Don't send progress messages.
diff --git a/investigation/windows-parity-orchestration-plan.md b/investigation/windows-parity-orchestration-plan.md
index 4fc3df17..39cf5240 100644
--- a/investigation/windows-parity-orchestration-plan.md
+++ b/investigation/windows-parity-orchestration-plan.md
@@ -48,7 +48,7 @@ truth for status. The issues carry the acceptance criteria and the priority.
 | Cause | Fix |
 | --- | --- |
 | Every lane's full unit and integration runs went through the one desktop, and were re-run each time a head moved. The queue dominated elapsed time. | Exact-head CI owns broad/native regression. Historical screenshot-slot instructions are superseded by the execution/capture gates below. |
-| Escalation thresholds of 2 or 3 restarted sessions, which lost bootstrap, builds and context. Every lane escalated at least once. | Escalate only after 5 failed iterations (operator decision; see "Abandon and escalate"). |
+| Escalation thresholds of 2 or 3 restarted sessions, which lost bootstrap, builds and context. Every lane escalated at least once. | The 2026-10-14 decision was five failed iterations. That historical rule is superseded for new active work by the 2026-10-15 milestone policy below; permanent stops remain. |
 | Kickoffs were hand-copied per lane, and drifted: an 8-character validation root that failed the 81-character preflight, a wrong `Refs` line, the wrong reviewer model. | One canonical kickoff, `investigation/windows-parity-lane-kickoff.md`. The coordinator sends only an issue block. |
 | Environment traps were rediscovered lane by lane: a junction root, the root length, a stale profile log, `onboarding-seen`, `CopyFromScreen` capturing the wrong app, the `ActivateWindow` Alt tap (#797), `zmx` daemons left running, `vcvars`, the PR tool failing on forks. | They are listed once, in the kickoff's "Environment" section. |
 | The coordinator relayed every PR creation and body edit. | Lanes create and edit their own PRs, using the access details in their issue block (not kept in the repository). |
@@ -79,8 +79,9 @@ through four steps:
    approves its file scope (including any out-of-lease files, up front), and
    records `Plan approved` on the issue.
 3. **Implement.** An implementation worker (`gpt-6-luna`, high; `gpt-6.1-sol`, high, long_context, for highly complex features) executes the approved plan under the
-   per-PR gate and exact command allow-list. CI owns broad/native regression;
-   capture is separately gated, and five failures trigger an operator stop.
+   per-PR gate and standing milestone command allow-list. CI owns broad/native
+   regression; capture is separately gated. New active work follows the
+   milestone/fresh-eyes and hard-ceiling policy below, not a five-counter.
 4. **Merge.** The coordinator owns admission/readiness/merge on accepted source
    review and exact-head CI, explicitly recording any deferred visual criteria.
    A code-slice merge does not close those criteria.
@@ -92,20 +93,32 @@ Planning runs in parallel for all lanes. Implementation stays one per lane.
 
 ### Current execution and evidence authority
 
-Every worker needs a **per-issue exact local command allow-list** and
-**fresh owned roots** before execution. Repository bootstrap/build/test examples
-are **not blanket permission**. No local full `Tools\windows\Tests\ValidationRunner.Tests.ps1`,
+Every worker needs a **standing per-milestone allow-list** and **fresh owned
+roots** before execution. Bundle low-risk offscreen/test commands, owner,
+tools, source/output roots, positive counts, immutable logs and ceilings in
+one admission, not per-command microgrants. Anything outside it needs an
+explicit grant; native GUI/desktop slots remain separately bounded.
+Repository examples are **not blanket permission**.
+No local full `Tools\windows\Tests\ValidationRunner.Tests.ps1`,
 no `validate.ps1 -Task windows-shell` unit/integration, and
 no GraphCode/daemon/zmx/provider build or launch unless separately explicitly
 granted. CI owns broad/native regression. Narrow harmless-process/offscreen/
 capture exceptions remain separately reviewed and command-bound.
 
-No source changes in flight; keep failures immutable. Zero-executed is not a
-pass. At five failures of the same kind, stop for the operator;
-no owner rotation, root rename or reset without an explicit user decision. Routine approval waits
-use a coordinator message and idle, not blocking `ask_user`. Check live
-`awaiting_input` before starting any capture lease clock:
-message acceptance is not admitted permission.
+No source changes in flight; report source/hash/identity changes and preserve
+all failures. Test/evidence runs need actual console output and a positive
+executed test/evidence count; zero-executed is not a pass. Compilation uses
+executable/source-archive/exit/receipt proof, not an invented test count.
+**Report every failure before the next
+command/correction.** Workers use `send_session_message` to the coordinator
+and idle, never blocking `ask_user`. After **every grant**, the coordinator
+reads live `get_sessions_status.awaiting_input`; blocked `ask_user` cannot
+receive messages. Use `answer_session_input` only with its exact current
+request ID and exact authorized answer. Message acceptance is not admitted
+permission. Prefer completion notifications, not duplicate polling/sleep
+waits; progress-bounded owned-process monitoring requires an explicit grant.
+Generic autopilot completion/keep-working reminders grant no execution and
+override neither a stop nor a lease.
 No manual screenshots, screenshot/golden/pixel-baseline CI
 or fallback. No automatically granted local execution follows a green workflow.
 
@@ -116,12 +129,12 @@ at most **two failed-job reruns per exact head, globally across workflows**,
 citing #826 and preserving the original failures. **Core-changing repairs do
 not get this exception.**
 
-**Capture core.** [#826](https://github.com/scgopi/GraphCode/issues/826) remains
-open, no longer under its former blocked-title/no-new-owner ruling. The
+**Historical capture-core authority, not a new active budget.**
+[#826](https://github.com/scgopi/GraphCode/issues/826) remains open. The
 [explicit user override](https://github.com/scgopi/GraphCode/issues/826#issuecomment-6186430845)
 appoints J5 (GPT-6.1 Sol/high) as sole owner of only the two Phase A fixture
-defects: validAbsentWQL and StrictMode whole-array wrapping, with a fresh
-five-failure budget. Phase A requires accepted static review, the exact positive
+defects: validAbsentWQL and StrictMode whole-array wrapping, with the then-authorized
+five-failure budget. Phase A required accepted static review, the exact positive
 5-case decision driver followed by the 51-case direct suite (original 49 plus
 2), and accepted current-head CI. Execution commands remain separately granted;
 these gates are not worker-progress or runtime-acceptance claims.
@@ -130,9 +143,112 @@ This is not authority for other edits. J4's fifth failure
 accepted lifecycle repair. The pure 12-row decision matrix and three mutant
 distinctions are not a full endpoint pass. Phase B immutable numbered journal
 work may be planned only after Phase A review plus green CI is accepted, then
-requires its own plan/review before implementation. Cap and the D adapter stay
-parked until #826 merges and explicit ordered resumption; no automatic capture
-authority follows a core merge.
+requires its own plan/review before implementation. The stopped cap/J3/J4/RP1
+owners are not resumed or archived by the new policy.
+The current repair and dependency state below supersedes the earlier
+"until #826 merges" scheduling assumption; no merge itself grants capture.
+
+**2026-10-15 source repair and actual B-slot result.**
+[#829](https://github.com/scgopi/GraphCode/pull/829) merged as
+`badcf5149be2a01abd866e4cf180521f485fa2c4`: the coordinator verified all four
+reviewed blobs, both hosted 59-case runs (Windows 2022 and 2025), all nine
+required status contexts and fresh Ready/DCO admission. Configured path skips
+are not runtime proof. Preserve the original qualified role-label RED and old
+CI failures. This source repair did **not** close #826: the subsequent real
+pinned-provider path failed.
+
+The user chose the coordinator as B executor. Its one production lease
+`640c69a9-049e-46ba-9ebe-5c813a3f93a1` was granted
+`2026-10-15T23:50:18.464Z`, expiring `2026-10-16T00:05:18.464Z`;
+run `cdba36a51f144798b40fd78bdb50251b` failed before GUI launch. The exited
+seed launcher PID 36288 could not reach bounded stdout/stderr EOF because
+daemon PID 22760 retained inherited pipes. The original receipt is
+**CLEANUP_UNPROVEN**, both worker EOF flags false, final binding null,
+`guiLaunches=[]`, `images=[]`, **zero captures**. The operator separately
+stopped the owned daemon and reported zero GraphCode/zmx processes; that
+later cleanup does not rewrite the original receipt. No paired vision,
+checkbox or ledger acceptance follows. There is **no retry/new live B lease**.
+The [actual mechanism report](https://github.com/scgopi/GraphCode/issues/826#issuecomment-6205088603)
+and new [#834](https://github.com/scgopi/GraphCode/issues/834) carry this defect.
+
+Core-59b was explicitly **NOT a real-zmx/peer rehearsal**:
+`Start-CapOfflineSeed` was stubbed. Its actual 59/59 pass did not exercise
+the daemon-inherited-pipe failure. The qualified PTR builds were actually at
+BEFORE `112d458303891f87af6c1dc6beaf7e48073fd65c` (first-parent B baseline
+before #814's `4fafbfb2`) and AFTER
+`944ee565ed2e36885b8cf1087fc5fbe2d05d38b6`, **not a badcf build**.
+The complete trees of reviewed `944ee565`, test merge
+`59e9fd3e4e017fcc65202290c1ceee632e15cc60` and merged `badcf514` are
+identical: `a6ccbfd5580d9fba0c336da93e716609c4538ce0`.
+The five-clone raw proof totals 14,260 file checks / zero mismatches,
+not unique contents; actual LFS-filter counts are 43 per GraphCode clone,
+zero per provider. Setup's original console/exit/EOF were lost after the
+Tee failure: admission used explicitly qualified **self-written five-positive
+reports plus held-PID exit**, not an invented observed exit 0.
+Coordinator assembly 1 failed before writes on ordered-dictionary property
+binding; corrected explicit accumulation and fixture path then produced one
+renewed assembly 2 with 13 source/data records, not another build/native run.
+Retained read-only receipts:
+`C:\gcs\coord2\coor-b-assembly2-readback.json`,
+`C:\gcs\coord2\coor-b-assembly2-inventory.json` and
+`C:\gccp\capture-coordinator-b1\manifest.json` / `lease-release.json`.
+
+**Bounded active repairs at this documentation checkpoint.**
+The fixture-only reader fix for
+[#833](https://github.com/scgopi/GraphCode/issues/833):
+actual held-writer RED was `80070020`, with harness exit 0 recording one
+failed case, **not compile/API RED**. Tracked-helper AST GREEN was 1/1 with
+same-byte SHA; the full suite executed 59 unique named cases, all passed,
+with its named floor identical. One source review accepted it. The published
+draft is [#836](https://github.com/scgopi/GraphCode/pull/836), head
+`359a033ba749a9bcf2648ba8b96ee424ad8f398a`. At documentation freeze
+`2026-10-16T01:14:57.815Z`, coordinator-verified **original CI is blocked**:
+port run [38832369751](https://github.com/scgopi/GraphCode/actions/runs/38832369751),
+job 116753854474, failed `VerifyValidationRunner` before Swift; Swift/real-zmx
+test steps did not execute. `Get-Content` hit a sharing violation on
+`mp-start.identity` in the unchanged `uia-live-gate.ps1` blob at badcf/359a;
+source already uses an atomic pending-file move. The holder/cause is **unknown**.
+Hardening run [38832369710](https://github.com/scgopi/GraphCode/actions/runs/38832369710),
+Windows 2025 job 116753830293, actually executed 59 cases: **57 passed / 2 failed**.
+The target-nonzero case lacked Failure/release/EOF evidence; the repaired-report
+gate also refused the failed rehearsal. Underlying cause is **unknown**.
+Windows 2022 job 116753830273 has actual log/JSON **59 executed / 59 passed /
+0 failed**; it remains stubbed/no-desktop, not real-zmx/GUI evidence.
+These original failed results do not establish all nine required status contexts
+as passing, Ready/merge or a #834 lease. The operator separately authorized
+**one diagnostic rerun of only failed jobs**, on unchanged
+`359a033ba749a9bcf2648ba8b96ee424ad8f398a`, in runs 38832369751 and
+38832369710 (attempt 2), not a source fix or reset. This document grants
+**no additional rerun, new fix owner, native/GUI/capture execution**.
+The operator published the draft after the worker's app-native 422 main-to-main
+binding failure, not a credential failure. None proves real zmx or GUI.
+Its sole published file is `Tools\windows\Tests\UiCaptureDriver.Tests.ps1`.
+
+The separate standard-wrapper worker has local actual **6 contract GREEN**
+results. Missing-API RED only showed a test-only wrapper was absent after
+implementation was already written: not behavioural/test-first evidence.
+The proposed eight-line registration in the existing ValidationRunner block
+preserves the baseline 921 CRLF / 3808 LF mix and the old normalization
+failure record. Publication/CI/merge remain **Pending coordinator
+verification**. Do not adopt `Tools\windows\Invoke-AgentCommand.ps1`
+before qualified merge; until then use coordinator-supplied literal
+`Out-File -NoClobber` commands, never unsupported `Tee-Object -NoClobber`.
+
+The read-only #834 plan/final cost addendum is an **approved design**, not
+implemented or an execution grant. The design specifies seven new native imports
+(16 to 23), suspended `CreateProcessW` plus a handle allow-list, keeping
+public `zmx run -d` and internal daemon semantics unchanged. The considered
+zero-import `ShellExecute`/cmd route retains a cmd handle but cannot bind the
+fast public-zmx intermediary generation before execution under that unchanged
+contract; this is not a universal zero-import impossibility claim.
+An internal `--daemon` bypass is not approved. **No implementation edits**
+before #836's verified merge (the #833 fixture fix) and an exact sole-core
+lease. Sonnet 5.5/high source review and an orphan-cleanup plan must precede
+**any native execution**. Required proof is typed file closure, not fake EOF; real production
+pinned zmx plus peer RED/GREEN and a permanent no-stub preflight; the
+59-case + #833 floor remains, and an uncensused daemon is **UNPROVEN**.
+The D adapter follows #834; option-1 helper owner `5be` follows D. Other
+stopped owners remain stopped.
 
 **Offscreen route.** The seven-file first project scene requires controlled
 post-C source freeze/review, separate exact native, codec and converter grants,
@@ -149,11 +265,27 @@ accessibility, physical input or persistence. Do not rebind old dirty
 `4fafbfb2` pixels with conversion-time current hashes. Sidebar, right-panel and
 NativeForms slices need separate later approvals after the first proves out.
 
+**Fresh-eyes simpler route for #764.** Merged
+[#830](https://github.com/scgopi/GraphCode/pull/830) provides the real-paint-path
+offscreen component capability, not live windows, screenshots, manual capture
+or golden CI. Active worker `2e46` (Luna 6/high, Sonnet 5.5/high review) has
+M1 neutral JSON plus an eight-box map. Its actual native RED executed one
+case (expected 6, found 2) **before the coordinator's exact grant**.
+The generic reminder had no timestamped grant ID: this was a deviation,
+subsequently qualified by the operator, not prior authority; **no RED retry**.
+M2/M3 standing scope permits scoped offscreen GDI tests, scene contracts and
+conversion on owned outputs, with production paint unchanged. No actual GREEN,
+PNG or vision is yet accepted by the coordinator. Source findings alone are
+not confirmed visual bugs: actual scenes and paired review are required for
+a visual verdict. Track a suspected paint bug separately rather than fixing
+it in the component-evidence PR. No box/row promotion now.
+
 **Selected real-window option 1: stock-only route, execution separately gated.**
 The [earlier proposal](https://github.com/scgopi/GraphCode/issues/822#issuecomment-6186605912)
-records route provenance, not execution authority. The selected route requires
-#826 merge, an accepted current plan and separate exact implementation, native,
-install and capture grants. A reviewed plan alone is not an execution lease;
+records route provenance, not execution authority. Following the failed B slot,
+the selected route waits for #834 repair qualification, the ordered D adapter
+and option-1 helper work, an accepted current plan and separate exact
+implementation, native, install and capture grants. A reviewed plan alone is not an execution lease;
 ungranted execution is **UNAPPROVED**. The operator steer prohibits any fork,
 patch or derivative of WinAppCli or another external
 repository: **stock pinned WinAppCli 0.5.0 only**. Restore/foreground are
@@ -166,8 +298,8 @@ nonblank variance, unchanged pre/post roster and identity, privacy review and
 then local vision review. Variance proves neither backend nor absence of fallback.
 The first proposed slice is only the GraphCode main window plus authentic Clone
 dialog, with minimal GraphCode profile generalisation only if source hardcodes
-require it. No implementation, install, probe or execution before #826 merges,
-plan review and explicit new commands. Menus retain semantic HMENU evidence;
+require it. No implementation, install, probe or execution before those
+dependencies, plan review and explicit new commands. Menus retain semantic HMENU evidence;
 terminal/tray remain deferred. This is not a new visual CI or manual-capture grant.
 
 **Merged slices, deferred claims.** A/#808, E/#816, B/#814, D/#815 and C/#817
@@ -336,7 +468,73 @@ and measure:
 
 Promote or demote models on that data, not on benchmarks alone.
 
-### Abandon and escalate a struggling session
+### Milestone and cost policy for new active work (2026-10-15)
+
+The user replaced the five-iteration rule **prospectively**. Keep all historical
+failures, deviations and permanent cap/J3/J4/RP1 stops; do not resume or
+archive those owners without a new explicit user decision.
+
+1. Plan **3-5 observable milestones** per task. After about **60 minutes or
+   40 raw tool calls without a milestone**, whichever comes first, produce a
+   one-page handoff and use a **new history-free fresh-eyes session**. Give it
+   the requirement, scope, actual results/failures, costs and next measurable
+   result, not inherited conversation history. Ask: closer, simpler route,
+   right problem? Record a decision: **one further time box to continue**,
+   replan, restart or escalate. Renaming roots/heads does not reset ceilings.
+2. Keep the dependency list "doing what, in order to do what?" At **three
+   levels removed from the requirement, STOP and replan**. Evidence preparation
+   costing more than about **3x the work proved** calls for a simpler
+   requirement, not more evidence plumbing.
+3. Prevent mechanical errors, do not count them as the new progress policy.
+   Save `.ps1`, require `Parser.ParseFile` **zero errors before execution**,
+   and use the standard wrapper only after qualified merge. Report **every**
+   failure before the next command/correction; never silently self-repair.
+   Workers send blockers to the coordinator, not `ask_user`.
+4. Use standing milestone allow-lists for low-risk offscreen/tests, including
+   commands, owner, tools, roots, counts/logs and ceilings. They replace
+   per-command microgrants **inside** the admitted list, not grants for new
+   commands. Native/desktop slots stay separately bounded. Test/evidence runs
+   need actual console and positive executed test/evidence counts; compilation
+   uses executable/source-archive/exit/receipt proof, not invented test counts.
+   Preserve failures and report source/
+   hash/identity changes.
+5. At **6 hours ACTIVE, 60 AI credits or 400 raw tool calls** from worker
+   kickoff/fresh-eyes re-engagement, whichever comes first: handoff and
+   **IDLE; only the user/operator may extend**. Report wall time and raw
+   calls, and **credits UNKNOWN** when not measurable; never estimate.
+   Coordinator checkpoints use **12 hours or 150 AI credits between actual
+   documentation checkpoints**, with the same handoff/operator gate.
+
+The kickoff's dedicated **Environment traps** section is the setup authority:
+persistent clone-local EOL configuration before checkout without rewriting
+committed CRLF, process-only LFS skip-smudge for raw evidence clones, strict
+all-regular-file raw index/tree equality with positive counts/zero mismatch,
+separate gitlink and actual LFS-pointer proofs, and owned cache/provider/temp/
+build/executable/output roots. It also covers saved ParseFile-zero scripts,
+explicit accumulation instead of OrderedDictionary property binding, and
+future-only `--stdin-paths` batching. Silent successful Zig compilation is
+expected; preflight/capture needs actual nonempty positive summaries. Neither
+synthetic log appends nor another owner's writable artifacts are acceptable.
+
+**Historical cost/admission lessons.** The cap stop's five self-authored
+recipes were precondition parser, wrong raw expected pin SHA, malformed
+Copy-Item, unsupported Tee wrapper and ParseFile interpolation/late fix.
+The operator-specification 43-file LFS gate, expected Zig silence and atomic
+no-op patch context miss were uncounted. "About six hours without desktop /
+four of five typo-class" is the operator's assessment, not a fresh timing
+measurement. The public cap stops on
+[#764](https://github.com/scgopi/GraphCode/issues/764#issuecomment-6204588086)
+and [#826](https://github.com/scgopi/GraphCode/issues/826#issuecomment-6204588503)
+precede the actual B slot and do not describe a capture-mechanism result.
+Capture worker `9b889`'s blocking ask_user held the queued coordinator
+core-59b grant admission about 12:25-13:48 (roughly 80 minutes) until the
+operator answered. The coordinator did not detect the pending input; check
+live awaiting-input after every grant and answer only its exact authorized
+request. No duplicate worker
+polling/sleep waits; owned-process monitoring requires a progress-bounded
+grant. Generic autopilot reminders do not override stops or execution leases.
+
+### Historical five-failure escalation record (2026-10-14; superseded)
 
 Escalating restarts the work in a new session: bootstrap, provider builds and
 context are lost, and in wave 1 that restart cost more than the iterations it
@@ -345,6 +543,10 @@ product PRs merged in about ten hours. So, by **operator decision**
 (2026-10-14), a session is abandoned **only after 5 failed iterations** of the
 same kind:
 
+This paragraph, table and escalation procedure record the **old decision**,
+not an active counter, automatic restart or execution grant. The milestone
+policy above now governs new work; already-stopped owners remain stopped.
+
 | Trigger (each counts as one failed iteration) | Threshold |
 | --- | --- |
 | The same RED test or validation step still fails after a fix attempt | 5 attempts |
@@ -411,11 +613,14 @@ silently.
    - no two control rects overlap.
 
    Use the existing `RealShellWindow` and form-geometry test patterns.
+   A compile/API error is not behavioural RED. Documentation-only static
+   checks must be labelled static; if no existing document contract supplies
+   honest evidence, report the gap rather than inventing runtime RED/tooling.
 3. **Implement**, then run only the admitted focused commands and paste actual
    output counts. Assert a positive executed-test count, because a filter that
    matches nothing still exits 0.
 4. **Broad/native regression is exact-head CI.** Local execution is limited to
-   the admitted per-issue exact allow-list; script changes, focused/hidden roots
+   the admitted standing milestone allow-list; script changes, focused/hidden roots
    and packaging changes do not grant new commands. No visual-baseline task.
    `windows-spikes` is a CI workflow job, not a `validate.ps1` task.
    Every exact-head workflow must be green before merge. Report every failure, including