[coneilen]

Summary

Replace the monolithic PowerShell Windows validation contract with a normal compiled C# entry that cannot report success with missing coverage. Preserve the native validation preconditions and lifetime observations exposed by actual CI, without weakening required checks or executing the old monolith.

Changes

• Pin SDK 10.0.403 and integrate verified installed/private SDK resolution with the Windows bootstrap.
• Share complete production bindings between their real consumers and the compiled contracts; validate source/reference fingerprints and loaded assembly identity.
• Require independent unit manifests, exact counts/groups, suite-result provenance, same-invocation composite proof, and a normal full invocation before emitting success markers.
• Preserve real PowerShell semantics through protected named adapters and owned suspended/job-based child supervision, raw-byte capture, bounded deadlines, independent EOF proof, primary errors, and UNKNOWN lifetime retention.
• Switch the dedicated PR job and scheduled hardening fallback to the compiled full command, including an owned Pester 5 prerequisite and measured 25-minute execution / 40-minute job caps.
• Preserve the main product baseline's caller registrations instead of registering unshipped Cards feature tests.
• Preserve failing smoke's nonzero exit, activate the existing visible workspace before exercising its actions, and refuse requested actions that never ran. Six native controls cover both stderr producers, successful exits, and missing activation/focus effects.
• Finalize endpoint captures before reading them, but observe the product's daemon lifetime before job teardown can manufacture the expected result.
• Retain hidden evidence only under the two explicit .ci-validation-runner upload roots; classify console failures by sanitized suite ID and exception type without leaking raw payloads.
• Isolate only owned nonactivating pointer fixtures. A real unrelated same-process HWND control verifies recipient refusal before any pointer messages; production recipient/DPI guards remain unchanged.
• Restore the owned graph surface after Delete selection opens the loop workspace, reacquire the same card before Fit Canvas, and clear the completed stress-job reference only after successful removal. Twenty additional required guards preserve the original nine visibility and 21 Select contracts.
• Distinguish a control's immediate hit-test container from its exact GA_ROOT input owner in the shared UIA helper. Five real hidden Win32 topology controls preserve strict PID, ancestry, recipient and exact-root admission; physical flat/nested clicks remain a separate interactive proof, not an inferred canonical result.
• Publish the current compiled assembly once at the real Windows task boundary when its environment entry is absent, rather than relying on a local preset. Preserve supplied/empty/missing state, current-worktree loader checks, native child inheritance and exception-safe process-only restoration.
• Keep application-product edits restricted to three App.zig functions: App.run smoke-exit/reporting, runSmokeWorkspaceActions prerequisites, and smokeContractPassed's requested-but-unexecuted guard. No DaemonClient, Workspace, AppFont, GraphCanvas, shared Swift, or unrelated Cards feature changes.

Test plan

RED: & .\Tools\windows\ValidationRunner\bin\Debug\net10.0-windows\ValidationRunner.exe --self-test -> actual behavioral run: 22 executed, 21 failed with "RED: coverage admission is not implemented"; original output retained
GREEN: & .\Tools\windows\ValidationRunner\bin\Release\net10.0-windows\ValidationRunner.exe --self-test -> 65 executed, 65 passed, 0 failed, 0 skipped on local commit 90479b3
REGRESSION: & .\Tools\windows\ValidationRunner\bin\Release\net10.0-windows\ValidationRunner.exe --repository-root $PWD --artifact-root (Join-Path $base 'pr956-90479b38-full') -> 605/605 units, 2094 direct checks, exit 0 on local commit 90479b3

• From Tools\windows\ValidationRunner: dotnet --version selected 10.0.403; dotnet build -c Release completed with 0 warnings and 0 errors.
• Normal unfiltered command: & .\Tools\windows\ValidationRunner\bin\Release\net10.0-windows\ValidationRunner.exe --repository-root $PWD --artifact-root $a, where $a is an owned evidence directory. Local commit 90479b38 passed 605/605 required units, 2,094 direct checks, exit 0, complete=true, fullInvocation=true, in 1,003.87 seconds. All 146 changed source-file hashes remained unchanged. The derived 465-case proof covers 126 original templates and is not counted again as direct execution.
• Repeated the normal compiled build/run on the authoritative Cards feature tree after guarded source integration: 578/578, 2,008 direct checks, exit 0, stderr 0, in 981.03 seconds. All 1,133 unleased original files, the original index/HEAD, and the old monolith source were preserved. No old monolith execution occurred.
• First-head hosted CI observed two missing feature registrations, absent hidden artifacts, and a held-root exit observation failure. Its compiled job stopped after 141 units/1,010 checks without an uploaded report. A faithful local canonical run reproduced the Delete abort with a CRLF adapter; this is not represented as recovered hosted stderr. Original failures are retained.
• Focused fixes: the original Delete LF/CRLF adapters each passed 30 cases; the four-combination matrix passed 120 cases and rejected two structural mutants. The expanded producer guards passed 50/50, including 20 new navigation/lifecycle controls, in direct and LF/CRLF canonical runs. Topology passed 39 cases. Ownership passed 70 cases plus 44 mandatory native cases. Handoff adapter regression passed 13 cases.
• The new native smoke fixture passed all six controls. Successful requested smoke retained exit 0; both original stderr-file and owned-capture failure paths returned nonzero with the real daemon diagnostic. Requested-but-unexecuted actions and an omitted focus effect were refused.
• The isolated Wire payload passed 57/57, including all original 56 cases and the new real wrong-root overlay refusal. Its selected host invocation intentionally remained incomplete and nonzero; that is not claimed as a full-root pass.
• The final local unit evidence passed 63 complete/disjoint sections (22/17/24); the affected App shard and shard 2 ran serially with stable owned caches. The App suite reported 1,587 passed, 18 existing skipped, 0 failed; the formerly failing close-box key case explicitly reported OK, not a skip. The native accessibility executable passed 259 checks. Earlier concurrent key-case and expired-cache failures remain retained and are not rewritten as passes.
• Serial native integration with an exclusively owned short root passed smoke, unassisted daemon handoff, six controls, scrubbed startup, and wire roundtrip. The renewed-foreground runs then exposed the repaired Delete scenario and later reached the complete edge create/edit/cancel workflow before the nested node-sheet click refused. All failures and their cleanup evidence remain retained; none is a full integration pass.
• The nested-click RED was independently reproduced in an ordinary compiled fixture: flat click passed, nested click refused the wrong immediate-container foreground owner. The corrected helper passed five real hidden topology/strict-negative controls. Actual corrected flat/nested input GREEN remains unproven pending the prepared user-launched foreground host; no synthetic keys, input-queue attachment, generic same-PID fallback, or foreground-policy change was added.
• Hosted head 5a7a3bd4 passed the compiled full 604/604, 2,087 direct checks and retained its scoped hidden artifact. Its unit 1 and native integration jobs then failed the same absent-assembly-environment prerequisite at GDI startup and scrubbed startup. Earlier local commands had a preset and did not exercise that CI path.
• The new scoped caller regression passed 7/7 production-function/native-child controls. The final exact local unit 1 command ran with GRAPHCODE_VALIDATION_ASSEMBLY explicitly absent, passed 17/63 sections, and produced GDIPLUS_STARTUP_LIVE: PASS; executed=1; observations=2; original absence was restored afterward. Updated three-shard manifests independently passed 63 complete/disjoint sections (22/17/24). The strict fixture-directory loader was not weakened.
• pwsh -NoLogo -NoProfile -File Tools\tdd\Tests\TddEvidence.Tests.ps1 passed.
• pwsh -NoLogo -NoProfile -File Tools\windows\validate.ps1 -Task privacy passed.
• git diff --check passed; every branch commit has its DCO sign-off and required co-author trailer.

Limits: the current compiled full is green and unchanged native unit-input evidence covers all 63 shard sections, but actual corrected local nested-click input and local native integration remain unverified. The user explicitly approved a PR #956-only exception permitting these verified fixes to be pushed with that limitation disclosed. This does not waive hosted native integration, any required check, or strict up-to-date enforcement: all must pass on the new head before normal merge. These contracts and controlled fixtures do not establish hardware/glyph/visual parity or a merge result.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure

make test and make check are macOS-only and were not run on this Windows host. The completed Windows commands and remaining native/final-source limits are distinguished above.