[coneilen]

Summary

Repair the matched-scene seed receipt path that stopped C8 with an actual DirectoryNotFoundException, and close the separately reproduced held-launcher signal gap without expanding the existing termination budget. This is tooling only: no product changes, capture, Restart, visual review or parity claim.

Current head: d7d790cdc3986b4d10eb7de9ad5e3fe5847bd839. Prior hosted-budget head: 9624776bfbfed9e60848dd2773fa268d45121fc9. Initial S2 head: 4185d276865101369c5184429d768558a4e598e1. Base: 782659f765c099adeef0f2003d0c219ab7b96164 (preserves #898). Earlier evidence below remains historical and unchanged; follow-up repairs and actual qualifications are appended after the checklist.

Changes

• Bind matched S initial/exit/final receipt writes to the initialized scene root and retain that exact owned path. B/D keep their existing normal/per-session layouts. Ensure only the intended seed receipt directory exists before launch.
• Preserve NOT_CREATED / CLEANUP_UNPROVEN if the first receipt was never published; native job closure is not fabricated receipt success.
• After existing owned-job termination and empty proof, wait on the original registered held launcher handle, validating native PID and creation time against its original live-image attestation. Termination, empty wait, identity checks and signal wait spend the same existing 5000 ms monotonic window. This is a post-termination held-handle exit wait, not natural exit. The final kernel-live refusal, census, EOF and daemon-held-pipe termination design remain unchanged.
• Record actual signal-observation latency and remaining wait budget; unsignalled handles retain null latency and still refuse. No post-termination image query, PID reopen, replacement handle or failure fallback.
• Add exactly two registered groups: 175 -> 177 default / 178 -> 180 real. Preserve existing identities/subcases, all eight S groups and the fourteen-subcase G group. The supervisor requires exactly 180, zero skips, and both new identities exactly once.
• Cover actual worker seed writes and never-created cleanup, all 18 scenes x 2 phases, collision-refusing short scratch defaults, and deterministic delayed-signal / exhausted-budget / wrong-PID / wrong-generation / missing-attestation refusals.

Exact six-file scope: Tools/windows/Invoke-UiCapture.ps1, Invoke-UiCaptureWorker.ps1, UiCaptureDriver.psm1, Tests/UiCaptureDriver.Tests.ps1, Tests/ValidationRunner.Tests.ps1, and UI-CAPTURE-SCENARIOS.md. No production allowlist or existing unrelated-parent test change.

Test plan

Commands below use the equivalent repository-relative script path; the immutable private outer receipts retain the complete actual absolute argv, source pins and held root/job evidence.

RED: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot D:\s2-508e3a58\red02\suite -PrebuiltFixtureManifest D:\s2-508e3a58\red02-fixtures\suite\fixtures.json -PrebuiltFixtureManifestSha256 D18158733112866AC0FFF1F555DDE9F7CED5B16000B51F7132B9CC3F76EC0E82 -SeedPathContractOnly -> 0/2 groups; actual Start-CapOfflineSeed then Write-CapJsonAtomic/File.WriteAllText threw System.IO.DirectoryNotFoundException for before-s-tabs-goal-needs-you; original worker 7C91BDD8, not a compile/API failure.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot D:\s2-508e3a58\wait02-focused\txxxxxxxxx\gde17c89b\suite -PrebuiltFixtureManifest D:\s2-508e3a58\wait02-fixtures\suite\fixtures.json -PrebuiltFixtureManifestSha256 7FC54EA5220F2FDC50020DF0322EC030E1888FBED32EAB6AE7B107BD05262869 -SeedPathContractOnly -> 2/2 groups passed, 36/36 actual scene-path lifecycles, both phases 18/18, not-created/collision/held-signal/budget/identity negatives passed.
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot D:\s2-508e3a58\default177\txxxxxxxxxxxxx\gc2b2c4cc\suite -PrebuiltFixtureManifest D:\s2-508e3a58\wait02-fixtures\suite\fixtures.json -PrebuiltFixtureManifestSha256 7FC54EA5220F2FDC50020DF0322EC030E1888FBED32EAB6AE7B107BD05262869 -> exactly 177 executed, 175 passed, 2 failed, 0 skipped; operator accepted the pre-existing unrelated-parent test-design failure and its report-gate cascade; no local rerun.

Additional deterministic behavioral RED, before the wait repair:

pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot D:\s2-508e3a58\delay-red\txxxxxxxxxxxxxx\g53bd02ea\suite -PrebuiltFixtureManifest D:\s2-508e3a58\delay-red-fixtures\suite\fixtures.json -PrebuiltFixtureManifestSha256 0085C7D1BC8F159560D7C4A3D3721169B1505E0017886BF40D654623B3345F3E -SeedPathContractOnly -SeedPathCase ExitWait -> existing first group 0/1; actual worker Close-CapOfflineSeed refused Job member remains kernel-live while the real held process signal was delayed.

The delayed-signal controls inject only the close-job return/empty boundary, explicitly labelled not native termination/job-empty proof. Their held process, native wait/refusal and separate safety-job/EOF teardown are real. The 36-scene matrix uses the actual unmodified job closer, not that injection. The matrix target is a hidden harmless fixture intentionally exiting 23 before readiness, not real zmx or a product.

Focused observations: signal delay 411.3765 ms; exhausted-window negative had 84 ms remaining, refused with null signal latency, and observed 5008.8411 ms wall time (configured 5000 ms plus observation/scheduling overhead, not a measured wall-time-at-most-5000 claim). Matrix signal observations were 2.749-13.0172 ms. Actual SID length 52 and guard-computed lease length 239 / 240, using the actual registered allocator under private process-only TEMP/TMP length 40; the runneradmin reference temp path is length 39. This is local evidence, not hosted evidence.

Local full-suite disposition and required hosted gate

The local all-177 command ran UiCaptureDriver.Tests.ps1 through the actual registered root allocator. It did not run the entire ValidationRunner.Tests.ps1 wrapper and its other contracts. All original eight S groups, both S2 groups and G exactly once with all 14 subcases passed.

The unrelated-parent negative uses the suite's own held pwsh identity as a fake app root. Its own console host PID 3048, creation 134369112493496943, has native parent PID 55712, creation 134369112493357098, and appeared 13.9845 ms after that suite root. Retained native snapshots/session/parent proof identify it as own harness infrastructure, not foreign/older relative to the scanned root and not a product ConPTY leak. Its conhost.exe 0x4 command shape is recognized; the unchanged parent-role allowlist refuses it. The separate app fixture parent is 55268 / 134369113389363639 and child is 65548 / 134369113396654789.

AST comparisons with the base confirm unchanged app-child fixture, ancestry/identity/metadata guards and launch functions. The new worker seed closer/native wait are not called on this failed guard path; shared job closure occurs later. The second report-gate failure follows from the earlier failed case in the report's results array. No failure was erased or reclassified as passing.

User/operator final disposition: accepted as a pre-existing test-design flaw, not S2's regression; ship unchanged, no allowlist/test-root fix or local rerun. Exact-head hosted CI's full registered ValidationRunner is the full-suite gate: PENDING operator train. No CI dispatch, polling or merge was performed by this lane.

180 real: not run in S2. It is required first during the separately authorized later preparation. No live GUI, C8R, real Restart, parity or beta qualification is claimed. Frozen C8 remains CLEANUP_UNPROVEN, 6/36 images; its six private images and all historical records were not altered or reviewed.

Retained private evidence, not uploaded

All attempts remain under D:\s2-508e3a58: first red (test path too long, no seed launch), red02 (intended seed-write RED plus secondary kernel-live failure), green (test pin-disposal/removal ordering error), green02 (18/36 matrix then kernel-live failure), delay-red (deterministic wait RED), final-focused (new post-termination image-query failure, matrix 9/36), wait02-focused (2/2 and 36/36 GREEN), and default177 (175/177 plus the disclosed accepted failures). Passing runs did not overwrite failing logs.

s2-full177-classification.json SHA256 D31F613C002D854E02851E365B2B753DDA9CBD927E487CD73B37D761E14528FA binds the native candidate evidence, exact call sites and limits. Full report SHA256 43151CDA754C7D072D4CA1C70EBC8BA45543BC15C912DF6A551D42B7D953FA71; trace 682E40D639843462B1E497EDBC505754F29CFCDE232F719C822308D48947DDEE; outer receipt D98A57ABA487675FC9A3FD63860E495BCF13126C7F61D40E4C03ACA55D1B9788.

Every actual qualification retained assigned-before-gate held root identity, actual root exit, owned job Active=0, both launcher EOFs and frozen source hashes. Full177 root 55712 exited 1; its held kernel exit/owned outer closure are proven, not a passing suite or an upgrade of a failed inner check. The exclusive native slot is released; no further native commands remain.

Frozen source	SHA256
Supervisor	005E0759CCF40EFB0661C1A854A05FD53B816F3A423B66B4F8AE2AF4E77CBA9B
Worker	ADEB8254AA95E1D768AC9412DA6A104010B16591191B01B49F1A2BA83B61147A
Driver module	43B32ADD8D6356C6C095106F9A8102F77E845D3AAEEE389D32981AF7ADBF84B8
Capture tests	2298BE58AD7071F67FAF546CB3F185CB86086F32E3E1CF13DED79D1DE3A71CD4
Registration	15353B27A2892A7F2EB8C55CDBF1B738BE96091A4E91EEB3E8FB4C0583DD893F
Scenario documentation	CA4F4EC61A6A49997DA9889FFFF4E4AC2ABF5DA2F59D21D320C8D79C51D60DAC

One normal default code review found the scratch-budget issue; it was fixed with real collision-refusal controls. One focused fix-delta review returned no significant findings. Later held-handle changes followed explicit operator rulings and the deterministic/matrix evidence above; no extra review loop was run. Review artifact s2-code-review.json SHA256 EFE701F5329A6F8C04020C4C22A7EE46CBC491A15157ED2D6AF0A7333347A98C.

PowerShell parser checks and git diff --check passed; touched working files and staged blobs are LF. macOS make test / make check were not run for this Windows tooling-only change. The actual TDD body checker is run before publishing.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure

Hosted-budget repair on the same PR

Fresh operator grant, not an extension of the original box: dispatch start 2026-10-19T20:30:30.6700610Z, immutable hard deadline 2026-10-19T21:30:30.6700610Z; actual acknowledgement 20:31:29.6473447Z. Normal signed follow-up commit 9624776bfbfed9e60848dd2773fa268d45121fc9, parent 4185d276865101369c5184429d768558a4e598e1; no history rewrite.

The original head did not merge. Exact hosted run 39313802869, attempt 2, job 118284605892, windows-2022, failed S2's own first group with Post-termination wait restarted or overran its existing budget. The matrix group passed. Actual hosted registered result was 177 executed, 175 passed, 2 failed, 0 skipped; the second report-gate failure is the known failed-result cascade.

Classification limits: the old assertion combined unsignalled/null state, supplied native wait at most 100 ms, and wall elapsed less than 6000 ms. The job log does not expose which conjunct failed. The artifact inventory is empty, not passing evidence: upload patterns still selected the old gc-ui-capture-* root while the actual root was gf952ad50. Therefore hosted supplied milliseconds, monotonic origin/configuration timestamp and wall elapsed are unknown. Neither scheduling jitter nor an exact hosted production overrun is claimed.

The native source already calculated its argument after PID/generation checks from the same original deadline; this repair adds observation of that calculation, not a new production timeout. A deterministic delay after actual worker Close reproduced the observational test defect with unchanged original production module/worker pins: actual supplied wait 83 ms, unsignalled with null latency, injected observation delay 1500 ms, wall elapsed 6537.3732 ms, old assertion failed.

Scoped fix and strict evidence

• The native method now exposes the exact monotonic timestamp used to calculate the actual argument passed to WaitForSingleObject, after held identity checks. The existing overload remains compatible. The worker receipt adds original Terminate timestamp, original deadline, frequency and configured timestamp.
• The contract independently requires deadline = original Terminate + 5 * frequency, unchanged origin, and supplied argument exactly max(0, floor((deadline - configuredTimestamp) * 1000 / frequency)). Fresh-window, changed-origin, fresh-5000 and one-ms overspend mutations all refuse. No rounding-up, restarted window or observational tolerance is allowed in that calculation.
• Wall time is a separate observation: configured 5000 ms + explicitly injected delay + 5000 ms observational scheduling tolerance. This tolerance changes neither native wait arguments nor kernel-live refusal. It does not assert a measured wall-time-at-most-5000 guarantee.
• Both affected CI workflows now add exact g plus eight lowercase hex capture-root patterns alongside the legacy patterns, under the same declared TEMP root. File types, .git exclusions, artifact names, settings, gates, triggers and timeouts remain unchanged. A filesystem-only contract selects current/legacy files positively and rejects unrelated roots; an actual hosted upload remains unverified.

Follow-up delta is exactly six files: Tools/windows/Tests/UiCaptureDriver.Tests.ps1, UiCaptureDriver.psm1, Invoke-UiCaptureWorker.ps1, UI-CAPTURE-SCENARIOS.md, .github/workflows/windows-hardening.yml, .github/workflows/windows-port-validation.yml. The cumulative PR now has eight files. Registration delta 0: 177 default / 180 real, original two S2 identities unchanged. Static comparison retained all 112 Invoke-CapTest call registrations unchanged; no P2, product, allowlist, reserve or daemon-pipe cleanup edits.

New actual commands and results

The private controller supplies held-generation, assigned-before-gate native job containment, actual root exit, both launcher EOFs and frozen source pins. Exact absolute target argv and manifest hashes are retained in the outer receipts.

Phase	Actual private controller command	Result
RED	pwsh -NoProfile -File C:\Users\coneilen\.copilot\session-state\46410da1-0f89-4d5b-9d26-0589dc2c3b05\files\s2-hosted-budget\Invoke-S2HostedQualification.ps1 -RunName red-delay -Mode ExitWait -FixtureManifest D:\s2h-508e3a58\red-fixtures\suite\fixtures.json	1 group executed, 0 passed, 1 failed: old combined budget assertion; real supplied83ms unchanged, only post-Close observation delayed
GREEN / focused regression	pwsh -NoProfile -File C:\Users\coneilen\.copilot\session-state\46410da1-0f89-4d5b-9d26-0589dc2c3b05\files\s2-hosted-budget\Invoke-S2HostedQualification.ps1 -RunName green-all36 -Mode Focused -FixtureManifest D:\s2h-508e3a58\green-fixtures\suite\fixtures.json	2/2 groups passed, 36/36 actual scene lifecycles, 18/18 each phase, 36 exact native-budget proofs; restart/overspend and identity negatives passed

New actual exhausted-window observation: elapsed before native configuration 4953.721 ms, supplied argument 46 ms, exactly matching the floor of the remaining original budget. With the injected1500ms post-Close delay, observed wall time was 6524.9995 ms, within the separate11500ms observation cap. The handle remained unsignalled and the unchanged kernel-live refusal fired. Positive control supplied 4969 ms after 30.313 ms of the same window; all four budget mutations per control and three original identity negatives refused. These controls retain the disclosed injected close-job return boundary; they are not fabricated native empty-job evidence.

Both workflow filesystem contracts selected 2 current/legacy files per workflow, refused 3 unrelated roots per workflow, and checked the unchanged privacy/file-type patterns. The 36-scene matrix used actual production job closure and the new actual native argument observations. No local whole ValidationRunner.Tests.ps1 run, new full177 run or180 real run was requested or performed for this follow-up.

Native slot S2-hosted-budget-validation released after actual closure 2026-10-19T20:41:28.7238578Z: root19336 / creation134369158519415998 exited0 with held kernel exit, assigned-before-gate job, Active=0, both EOFs, census and source-freeze checks. No native commands remain.

Preserved packets and landing limits

Private s2-hosted-budget/classification.json SHA256 51C93028FC0479EE024D25D1EBCDCDE3584C5717E0ED3D9BA12D4534B196BBA1 binds the exact failed hosted head/platform/attempt/log and missing-measurement limits. Retained job log SHA256 0D17F28E60379799ECA119EBBD4F1DDCDC2AC7A8E3FE0FB0362FD9057606F1BD; artifact-inventory SHA256 E338FB10E6740E1E43CDBE137DA3A22EC09F95D8097C5F247E751DE5F81F87B4.

New RED outer receipt SHA256 0BB6EBE1A4430E6007062C91B77671749F7786DABE84151C753D664DA6CBC6D9; GREEN outer receipt 3F722B445D09B7C71FCA4FC38C10AC736963FAE71027AB189BEF3D3E61A6B554; GREEN report 627941881C167679F6C1D1A9C469F473D3B0A8843C6B5A1CED4A4268C1198F07. All old local/hosted failures remain immutable; no extra review loop, local full rerun, CI dispatch/poll or merge was performed.

Exact-new-head hosted full registered ValidationRunner remains PENDING operator train. Historical local177=175/177 is not made green by this focused repair. 180 real: not run in S2. P2 remains separate; no C8R preparation, GUI/input/capture/image review, product/parity/beta claim, or C8 status upgrade.

Artifact privacy contract repair — 2026-10-19

Fresh45-minute operator grant: start 2026-10-19T21:10:20.8894667Z, immutable hard deadline 2026-10-19T21:55:20.8894667Z; actual acknowledgement 21:11:17.7214229Z. This is a new grant, not an extension. Signed normal follow-up head d7d790cdc3986b4d10eb7de9ad5e3fe5847bd839, parent 9624776bfbfed9e60848dd2773fa268d45121fc9; no amend or force push.

The prior head did not merge. Read-only attempt1 logs and uploaded reports bind these exact jobs to 9624776b:

Job	Run	Platform / shell shown in log	Actual registered result
118296796414	39321592231	windows-2022 / pwsh.EXE	177 executed, 173 passed, 4 failed, 0 skipped
118296796529	39321592231	windows-2025 / pwsh.EXE	177 executed, 174 passed, 3 failed, 0 skipped
118296816707	39321592462	windows-spikes Swift, windows-2022 / pwsh.EXE	177 executed, 175 passed, 2 failed, 0 skipped

All three reports fail S2's own artifact contract at line2812 with Capture artifact privacy exclusion or inclusion count differs. The second report-gate failure is the downstream cascade. Additional runner-specific failures remain recorded and out of scope, not declared proven flakes. Full PowerShell version and per-comparison expected/actual counts were not emitted by those logs/reports.

Source-linked classification: all three uploaded test-source pins are 27EF07DAFF411C6D44697766FBA4A0C5531F7DCE144E8403DBA7DD99FAA29CD5, exactly matching the CRLF encoding of the prior committed test source (local LF pin 4506105B...). The old regex captured a trailing CR as part of the exclusion path. Read-only controlled LF/CRLF parsing of each workflow gives 14 patterns, 6 inclusions and 1 exclusion per root in both cases; only the exact exclusion comparison changes from true with LF to false with CRLF (last character42 * versus13 CR). This disproves the need to relax inventory counts in that reproduction.

Hosted workflow bytes were not uploaded, and the old assertion did not emit which conjunct failed. Thus CRLF workflow encoding on those past runners is inferred, not a claimed historical filesystem audit. The actual existing contract with an isolated CRLF workflow copy reproduces the same failure; the repair changes only workflow line-terminator parsing and exact test evidence.

Exact repair and evidence boundary

• Parse paths without CR/LF terminators, using [^\r\n]+ and the optional CR before the line end. No broad Trim, path-whitespace removal, case folding, ! removal or wildcard rewriting.
• Require the exact inclusion/exclusion multiset from the two allowed roots and six explicit suffixes, with each expected path occurring exactly once. Duplicate/overlap, private-path mutation, missing exclusion marker and trailing path-space controls all refuse. Counts were not weakened to a lower bound.
• Write an explicit isolated fixture manifest: current and legacy roots plus three unrelated negative roots, six intended files and two .git private sentinels per root. Compare exact included and excluded relative-path sets, requiring no missing, extra or private file in the included partition. Each workflow has 12 included and 4 excluded files, derived from those writes, not ambient TEMP totals.
• Cover LF and CRLF through the same actual contract function. The proof is exact workflow literals + the existing PowerShell root wildcard matcher + explicit .git fixture partition, not a translation/execution of Actions' full glob engine or a claim about a new hosted upload. No matcher dependency was installed.

Only Tools/windows/Tests/UiCaptureDriver.Tests.ps1 and directly related UI-CAPTURE-SCENARIOS.md changed in this follow-up: 86 additions / 27 deletions. Production worker/module budget configuration, native identity/kernel/EOF guards, workflow upload paths, registration, P2 and product code are unchanged. Delta0: 177 default / 180 real; all112 Invoke-CapTest call registrations and the two S2 identities/order remain unchanged.

Actual RED / GREEN and focused qualification

Phase	Actual command	Actual result
RED	pwsh -NoProfile -File C:\Users\coneilen\.copilot\session-state\46410da1-0f89-4d5b-9d26-0589dc2c3b05\files\s2-artifact-privacy\Invoke-PrivacyContract.ps1 -RunName red-crlf -LineEnding CRLF	Actual existing function refuses the isolated CRLF copy with the original privacy assertion; failure retained, not a compile error
GREEN	pwsh -NoProfile -File C:\Users\coneilen\.copilot\session-state\46410da1-0f89-4d5b-9d26-0589dc2c3b05\files\s2-artifact-privacy\Invoke-PrivacyContract.ps1 -RunName green-crlf -LineEnding CRLF	2/2 workflow contracts pass; both LF/CRLF variants inside each pass exact14 patterns,12 included/4 excluded files and4 mutation refusals per ending
GREEN	pwsh -NoProfile -File C:\Users\coneilen\.copilot\session-state\46410da1-0f89-4d5b-9d26-0589dc2c3b05\files\s2-artifact-privacy\Invoke-PrivacyContract.ps1 -RunName green-lf -LineEnding LF	Same exact2/2 positive counts, privacy sets and mutation refusals
Focused regression	pwsh -NoProfile -File C:\Users\coneilen\.copilot\session-state\46410da1-0f89-4d5b-9d26-0589dc2c3b05\files\s2-artifact-privacy\Invoke-S2PrivacyQualification.ps1 -RunName final-focused -Mode Focused -FixtureManifest D:\s2p-508e3a58\final-fixtures\suite\fixtures.json	2/2 S2 groups pass, 36/36 actual scene lifecycles, 18/18 each phase; exact original configured-budget/identity controls remain green

The native runner's complete absolute target argv, manifest hash and frozen source hashes are retained in its outer receipt. s2-artifact-privacy-validation is released after actual closure 21:20:13.9933049Z: root27752 / creation134369182187339959 exited0, held kernel exit, assigned-before-gate own job Active=0, both launcher EOFs, census and source-freeze checks. No native commands remain.

The new RED is D:\s2p-508e3a58\red-crlf\result.json SHA256 8D1A43B355C6DCA229B65EC9B26A70DB3052F8A76C4CBF8EDED22899FE902854; CRLF GREEN B9A1591D8CC99B55437AD5D043F9B26872D1371C00F9CEBA01B095FAAE307945; LF GREEN D72DB71584E072292ADD2115900D0247BE7BE0E1CE6153AF39F97B76F5E631ED. Focused outer receipt SHA256 4117392F54FF1682B56FE2E20508F6AF68F29F49FBBAC4879EEC77EDC5E71EE2; focused report 645D26BA0CCA57AEE4094F2F11AC6277609D0983531FA11995C5825F72AD4B21.

All earlier local/hosted failures and source pins remain preserved. No new full177/full180 run or whole-review loop was requested or performed. 180 real: not run in S2. Exact-new-head hosted whole registered ValidationRunner remains PENDING operator train; no CI polling, dispatch, rerun or merge by this lane. C8 stays CLEANUP_UNPROVEN6/36; private images unopened, no C8R, GUI/input/capture/product/parity/beta claim.