[coneilen]

Summary

Qualifies real Windows keyboard input into the automatically restored selected terminal pane after workspace close/reopen without focus repair. Makes terminal ownership and teardown bounded, and verifies one official dependency archive before the unchanged required Swift real-zmx test.

Changes

• Add opt-in real restored-pane qualification with private state, real daemon/provider sessions, persisted selection and computed marker binding before guarded input.
• Reuse suspended held-original supervisors, finite child-handle teardown, raw streams and UNKNOWN retention; preserve all 12 terminal stress stages and actual held-root metrics.
• Preserve strict lease limits, RUNNER_TEMP membership/refusals, original CI failure artifacts, actual health/seed diagnostics and LF/CRLF source contracts.
• Create only fresh terminal artifact/ZMX roots with explicit current-user owner/private inheritable access at creation, followed by mandatory held-directory owner/non-reparse verification. Keep old Create and provider owner guards unchanged.
• Prefetch only official zig-gobject release asset 493157198 through the GitHub asset API. Require its exact byte size/SHA-256 and unchanged pinned Zig package hash before publishing a new job-owned global cache to the existing real-empty build/test.
• Compose that same helper and always-retained private evidence into the manual Windows release workflow, without changing tag/source-version rules, publication inputs, permissions or the package implementation.
• Use an empty private fetch context, current compiled ownership bindings and compile-only Swift-job preparation. Announce and flush the existing retention sentinel before an UNKNOWN lifetime hold; keep one unfiltered validation runner in its dedicated job.
• Add source, managed propagation, byte/hash, refusal, argument transport and CI-order contracts in the existing topology entry point; retain peer/compiler/hierarchy/Create/image prerequisites.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\Release.Tests.ps1 -> the release workflow requires exactly one gobject prefetch and evidence step; actual owned exit 1 with original stderr retained and all-six cleanup.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\Release.Tests.ps1 -> 9 passing contract groups and 2 LF/CRLF workflow variants, actual exit 0 and all-six cleanup; package/GitHub operations are controlled stubs.
REGRESSION: & .\Tools\windows\Tests\WindowsCiTopology.Tests.ps1 -> 59 assertion checks and separate 16 private-SDK cases passed; current source-bound retention mode separately passed one managed case/five assertions.

Current 04cc0e7 release composition

Only .github/workflows/windows-release.yml and Tools/windows/Tests/Release.Tests.ps1 were integrated from the coordinator-reviewed source patch SHA-256 10AC9B5C3EDB54703A65EBDD1C5E8ED60EC46E3F51F0F5C566FD2FF0795C98EB. Exact resulting Git blobs are 27780aa3291c4b59f966229931246b6b5b2b5eff and 4bbc99e249c8cad4115117acbb7593e48fb152aa.

The release workflow remains manual, single-job and action-pinned, with unchanged permissions, publish-default false and source/tag/version validation. Existing bootstrap supplies the pinned SDK; helper preparation builds current guards only. The helper's fixed official asset/byte SHA/package hash and UNKNOWN policy are unchanged. There is no ar occ URL/hash/cache expansion and no claim that this composition fixes its HTTP 503.

Prefetch publishes a fresh explicit ZIG_GLOBAL_CACHE_DIR, changing the cache location inherited by top-level 0.15.2 and 0.16.0 package builds; only the 0.16 package archive is preseeded. The nested VT 0.15.2 build retains its existing explicit .zig-cache\terminal-vt-global cache argument. package.ps1, graphcode-windows/build.zig, providers, manifests, pins and the helper are unchanged. An actual release build and Verify remain required before publication; these source/controlled tests are not an actual release artifact or manual workflow execution.

The owned RED retained 588 original stderr bytes, SHA-256 F1DDFDF5CBB9DEC4AF6F6985CC375377F959371D6BFBF50315D5E6238CAC8F9D. GREEN ran the same exact release test command, including both line-ending variants and the workflow's real parameter-binding probe, without real packaging/upload. TDD/privacy/diff checks passed, and the two committed files are LF with DCO/coauthor trailers.

Fresh canonical Release compilation for 04cc0e7 passed with zero warnings/errors after exact historical preservation of the old 7ef 14-file guard. New map SHA-256 B37B5E1864DCDE9751A8971FEFC5FA9C47605868D62937EE664A64D9334F0FC2 records 229/125/126 binding inputs; Runner's zero input attributes are not an empty-map passing proof. No prior native receipt was rebound.

Accepted 7efb34b prefetch validation

• & .\Tools\windows\Tests\WindowsCiTopology.Tests.ps1 -RetentionPropagationOnly with current canonical Debug bindings: one managed case/five assertions, zero failures. The actual source-bound observer consumed the production announcement in partial/completed/duplicate chunks. No native UNKNOWN lifetime hold was started.
• & .\Tools\tdd\Tests\TddEvidence.Tests.ps1: PASS. & .\Tools\windows\validate.ps1 -Task privacy: PASS. git diff --check: clean. All four committed files are UTF-8/LF, with DCO sign-off and Copilot coauthor.
• & .\Tools\windows\Build-CompiledValidationRunner.ps1 -Configuration Release: fresh committed-head build, zero warnings/errors, after exact hash/length preservation of the old 8c03 14-file Release guard. New input maps contain 229/125/126 inputs; Runner has zero input attributes and is not treated as an empty-map passing proof. No old native receipt was rebound.

The full helper ran once with the reviewed source seals, using current Debug ownership/Fixture bindings. Official asset API returned HTTP 200, 1,867,503 bytes and SHA-256 D572886E8672A46AC6C740E3FE3A1F1C9D9A1A9F09D59FD62328A41FCDB70196. Pinned Zig 0.16.0 fetched that local archive without save and returned exactly one gobject-0.3.2-Skun7F6HogCMynX2JqeSHS7xr-8pK4ob-qRFIcEasVi3, with empty stderr.

The fresh private context retained a zero-byte build.zig and no project manifest. Zig generated its own hash-addressed global archive, 1,860,099 bytes/SHA-256 469BAC4B266A95F2631CDA73E28AC9C89E4A910F73C61E3FF535CCC53F3C32F2; differing compressed bytes reflect recompression, not a changed package pin. Only a fresh fake GITHUB_ENV received one ZIG_GLOBAL_CACHE_DIR line. No real CI environment/shared cache was changed or local cache transferred. No provider build or acquired build script ran during this verification.

Full result SHA-256 EBCFC5943DCCCCE08CFEF55C6ED89658B2BC8F86B717EECDC7D6DF6DF1DD0547; post-verification seals 569A7A4CAC11F6A3C058361F463EAA9FF511FF3FA9F936C1F66EC242B9F0BEE1. Original outer, version and fetch streams and all-six cleanup proofs are retained. Existing authentication was not echoed or persisted; a private credential-literal check found zero matches in 73 owned artifacts. Tokens are excluded from native Zig children.

The original retention RED tool output is retained as a labeled tool-output copy, SHA-256 EB43F6A7D6A59A0E1FB1C53B625F3BB4730B024D17FF7AD3AEDAA8D48856AFB9; its attempted redirected file is zero bytes and is not independent raw-stream evidence. Earlier 83/87 totals were actual repeated assertion counts, not distinct-case claims; final source groups run once.

Preserved upstream failures and cache flow

Original 8c03 Swift jobs 128681471900 and the sole authorized rerun 128685363712 both failed fetching the pinned official gobject zstd URL with HTTP 504. Those attempts remain failed; the required hosted real-empty test did not execute. The exact ScheduledTask production test did pass once in the retry, 0.22s, separately from the failed provider build.

The direct official gzip download also failed with HTTP 504. The later official asset-API download verified bytes. Two local Zig fetch attempts in empty directories failed with the confirmed Zig 0.16 build-root regression, producing no package hash. Those failures remain preserved. The corrected empty-marker-context attempt verified the exact package pin (original result SHA-256 3DBC6E52FA1FA2497F16D9F84ECE443C5BA8E25705216100D6D27948DB323F7B); the current end-to-end helper independently repeated official transport and hash verification.

The new Swift step compiles existing bindings only, downloads/verifies the one fixed official asset in fresh job-owned storage, and publishes its cache only after both proofs and owned cleanup. Zig's unchanged build checks that global p/HASH.tar.gz before remote fetching and verifies package content during normal extraction. Provider checkouts/manifests/pins, tokens, permissions, job ceilings and the required Test-RealZmxEmptyList.ps1 consumer remain unchanged. Failure artifacts are retained; no mirror, generic cache fallback, waiver or retry loop was added.

On 7ef current PR CI, the official prefetch passed with the exact asset bytes and package hash, version/fetch all-six cleanup and zero-byte context. Artifact 13614145547 retains 915 files, SHA-256 a030e8bf6317a1ed06b496dbeac9273067be6a5949efdc27e647c979c3d75da2; hosted proof 370E2508DF5567A6E4298F3B69E59D8C510FC629D21680F3C01A34D20430F123. The unchanged real-empty step received that exact private global cache but then failed fetching vancluever/arocc revision ecbc5c799574e0da2758a961b12efa586007f03c with HTTP 503 through translate_c. The required real-empty XCTest did not execute. Raw job 128702403030 is retained, SHA-256 A2E49F308A416DE258A5512D5FDDC78138F84E5968F70764DD5A94ED92DF7A3E; no 7ef rerun or cache expansion was performed.

All other 7ef current code gates completed positively: full684/2231+1 with one PASS/execution marker, terminal12, shell65, real packaging/contracts/default integration, both deterministic hardening OS legs, and the exact ScheduledTask case once at 0.188s. Coverage SHA-256 B798364E5C3F7A2B2A1B99B64C762F1541078042175BE294092F9826C769A5BE and current positive proof EDDDBF0D7DCB485D3720EC8951B99043003D9BC50F49807839D8612D276C03AC remain 7ef execution, not 04cc CI or a release-build/cache-composition proof.

Accepted earlier native evidence and limits

The accepted 8c03 exact local other-six run remains historical native evidence: exit 0, 257.3894201s, all-six cleanup/no retention, mandatory fresh-owner verification before three healthy original seeds, 12 stages, five metric sets and 92 retained worker streams. Terminal result SHA-256 CF6CFAB9324E98F4315C1FCDFD407D8E969743DF7CBC40328B63A73599F71774; owner-path proof 6D3895B0D3008E8057B52C026B66D987178303BEDB8A542161FC121AB16C9C50. This is not DACL readback, atomic adversarial proof, elevation or existing-folder adoption.

The c171 restored-pane run remains applicable unchanged-product evidence: pane1 persisted, actual close/reopen, fresh computed nonce/PID/arithmetic, focusRepaired=false, ten finalized launches/all-six cleanup. It is not a new 7efb34b keyboard qualification. Existing owner14/resource11/pure12 contracts remain distinct from native provider/input evidence.

Earlier lease, health, CRLF and b02 configured-root owner mismatch failures remain failed; the b02 1546-character stderr and 80-file raw artifact are preserved. Failed private wrappers stay failed even when their original workloads were accepted separately. Historical full684/2231+1, shell65, integration, packaging and OS evidence is not substituted for current-head CI. Compiler raw-file EOF and producer custody remain unproven; no glyph, paired visual, hardware or whole-parity claim.

Before merge

Fresh 04cc0e7 PR CI must positively pass all required checks: unfiltered full684/2231+1, Swift production including exactly one started/passed/zero-failed GraphcodeWindowsProductionTests.WindowsDaemonTests/testWindowsScheduledTaskXMLRegistersLongUnicodeSupportAndPipe, the unchanged real-empty test executed once after a verified prefetch receipt, terminal12, shell65/default integration, packaging contracts/real, and both hardening OS legs. Existing exact CI-only packaging/sole ScheduledTask local exceptions are not broader waivers. This remains draft and unmerged; beta stays blocked until merge and final required checks are authorized, followed by an actual composed release build and Verify. No manual release dispatch or publication occurred.

macOS make test/make check were not run on this Windows host.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure