[coneilen]

Summary

Expose native selection for Graph, Quick Chats, and canonical sidebar destinations through one common UI Automation selection container. Relates to #801; the native contract is locally qualified, without claiming overall Windows/macOS visual parity or closing mixed criteria.

Changes

• Expose SelectionItem through QueryInterface, pattern availability, IsSelected, and a common ancestor Selection container with single-selection GetSelection.
• Route Select through existing navigation actions without optimistic state changes, report dispatch failures, and emit selection/property events after publication.
• Keep duplicate action aliases present without competing selection patterns; resolve Quick Chats coordinate hits to the canonical destination.
• Preserve independent worktree selection and invalidate retired/shut-down provider references, including retained selection arrays.
• Share surface-aware, project-qualified loop/chat selection between painting and accessibility; synchronously forward the active chat ID without changing navigation routing or composite project-surface behavior.
• Add intercepted C++ headless contracts, no-HWND App/Sidebar tests, and an explicitly separate headless runner mode.
• Require native root/container/runtime/process coherence and actual ElementSelected delivery for five distinct navigation destinations. Keep the parity ledger Partial rather than promoting broader visual or hardware parity.
• Add bounded, acceptance-gated edge popup/input observations used to investigate the full gate. These do not change dispatch, input fallback, guards, or popup command selection; input receipts explicitly leave the selection outcome unobserved.
• Integrate narrowly scoped acceptance prerequisites: preserve primary descendant-ownership refusals when diagnostics fail, admit only the exact optional receipt block in the source oracle, and emit timeout-fixture markers before nested PowerShell startup. Ownership guards, capture pumps, and original timeout budgets are unchanged.

Test plan

RED: & $env:GRAPHCODE_ZIG0152 test src\Accessibility.zig --test-filter 'UIA contract exposes' -> 1 executed, 1 failed at the missing root Selection pattern assertion
GREEN: & $env:GRAPHCODE_ZIG0152 test src\Accessibility.zig --test-filter 'UIA contract exposes' -> 1 executed, 1 passed
REGRESSION: & Tools\windows\validate.ps1 -Task windows-shell -SkipTrayLive -ShellValidationRoot D:\a81 -ShellTestManifest D:\a81utf8-full-2428b5ae-20261111-0507\manifests\all.json -SwiftExecutable $env:GRAPHCODE_SWIFT633 -> full unit and integration payload passed; 66 sections, 280 native checks, 179 headless checks, and five actual navigation-selection events

The historical Zig RED/GREEN commands ran from graphcode-windows with the pinned environment. Their original failing logs remain unchanged. Current acceptance is bound to HEAD 2428b5ae9ff52415508ecb245ca18731c1e37818, tree 68c2177a70c2c555eb1af69778fd3e53777ba28a:

• Tools\windows\Build-CompiledValidationRunner.ps1 -> Release build passed, zero warnings/errors.
• ValidationRunner.exe --repository-root $PWD.Path --artifact-root D:\a81timeout-fix-2428b5ae\affected-report --suite ui.native-runner-safety --suite ui.navigation-runner-contracts -> two registered units passed, exactly 16 safety and 14 plan executions. Selected exit 1/incomplete is intentional, not full acceptance.
• ValidationRunner.exe --repository-root $PWD.Path --artifact-root D:\a81timeout-fix-2428b5ae\compiled-unfiltered-report -> unfiltered 693/693 unique units Passed, 2,817 counted executions, no nonpositive units/errors, complete=true/fullInvocation=true, exit 0. Exactly one PASS marker and one execution marker.
• The full windows-shell payload on the REGRESSION line -> exit 0; 66/66 unique sections in exact catalog order, 65 Zig invocations and 69 positive summaries. App reported 1,734 passed, 19 skipped, zero failures; skipped tests are not runtime evidence.
• The same full payload compiled and executed the headless C++ contracts (179 checks, zero failures) and default native provider suite (280 checks, zero failures). Headless interception is not substituted for native UIA evidence.
• The same payload's live gate -> Graph, Quick Chats, project, loop, and chat each produced exactly one ElementSelected receipt with the exact subscribed sender/runtime/PID, followed by single-selection/container/GetSelection readback.
• & Tools\windows\Test-ShellSectionManifests.ps1 -Directory D:\a81utf8-full-2428b5ae-20261111-0507\manifests -ShardCount 1 -> aggregate passed, exit 0.
• pwsh -NoProfile -File Tools\windows\validate.ps1 -Task privacy -> investigation privacy gate passed, exit 0.

The canonical shell and aggregate payloads were invoked with the displayed named parameters inside an audited, argv-safe encoded bootstrap under OwnedChildSupervisor. Only that owned child sets UTF-8 no-BOM Console.OutputEncoding and OutputEncoding; both supervisor readers remain strict UTF-8. Before qualification, one owned no-GUI producer proved both raw streams exactly 555446385F50524F4F465FC2B70A, including the middle dot, and exact empty/space/quoted/Unicode parameter binding. The actual live caption also retained its exact middle dot, not a replacement character. The outer environment has no GRAPHCODE_UIA_GATE key; the canonical live gate alone sets/restores it.

All accepted supervised phases have root-exited/job-empty/stdout-EOF/stderr-EOF/resources-closed/CanRelease=true and retainedLeaseCount=0. The live gate also recorded owned-job cleanup and exact DPI-context restoration. Raw logs and candidate/binding/source hashes are retained privately.

Preserved failures are not relabeled: earlier capture/source-oracle/timeout-fixture failures motivated the narrow acceptance prerequisites. One full-shell controller incorrectly inherited UIA_GATE=1 into the bare-zmx fixture; another lacked an explicit child output-encoding contract and correctly failed strict capture on raw byte FA. Neither is counted as a passing qualification. Historical interrupted cleanup remains quarantined UNKNOWN under the separately approved fresh-run plan.

Limits: no actual PR HEAD CI had completed at publication. Physical tray interaction was explicitly skipped; paired macOS captures, overall visual parity, physical devices, and broader daemon-persistence claims are not established. An earlier popup cancellation's cause remains unattributed; a successful receipt-enabled run is not proof of a causal product fix. macOS make test/make check were not run on this Windows host. The extra Zig fmt check still reports only two identical pre-existing main-baseline hunks in App and GraphContextMenu; those unrelated hunks were preserved, not repaired or described as a green style check.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure