Record the Windows beta9 preview candidate

investigation/windows-preview-release-plan.md

@@ -10,7 +10,70 @@ The critical path is terminal correctness plus a packaged production-daemon
 flight, followed by fixes for any reproduced core bugs. It is not closing all
 36 Partial rows, and it is not just visual polish.
 
-### 2026-10-05 replacement Windows candidate (beta8)
+### 2026-10-05 replacement Windows candidate (beta9)
+
+The current replacement candidate is
+`399ae42dd08bac31408c925d09863b1a40f3755e`, the merge commit for
+[#635](https://github.com/scgopi/GraphCode/pull/635), with parents
+`3ca7db805f4c36019665dcd16f2989fb1f10ca51` and
+`48c3c06db69a2f7bb687aff61d20420ad27a586b`. It replaces
+`0.1.78-windows.beta8`, which is failed/superseded and immutable.
+
+The attended beta8 Dev Box run found two terminal defects, which #635 fixes:
+
+- **Unreadable output:** the shell published v1 pseudo-glyph cells. It now
+  publishes Winghostty v2 glyph snapshots with Ghostty VT as the default
+  renderer, and stages cells and glyphs atomically.
+  `GRAPHCODE_EXPERIMENTAL_TERMINAL_VT=0` remains the explicit legacy rollback.
+- **Wrong session on Stop:** Stop could target a different zmx session from the
+  daemon-owned workspace session. Attach, resize and teardown now all
+  canonicalize the session name to `graphcode-<UUID>` exactly once, matching the
+  daemon's `TerminalLayout.zmxSessionName`.
+
+#635 merged with exact-head CI green.
+
+Local full Windows shell validation passed at the candidate source with
+`VALIDATE_EXIT=0`: **54/54** sections, App **747/747**, scrubbed startup
+**5/5**, the real-daemon round trip, and the live UIA gate. This local result
+covers the pinned smoke/stress terminal path. It does not establish
+human-observed terminal readability on the Dev Box client.
+
+The local annotated tag/version `0.1.78-windows.beta9` has tag object
+`d16569a84d5fd582220c243d072494f18d1ca560` and peels exactly to the source.
+`origin/main` equalled the candidate at tag creation. It is local, unpushed,
+and unpublished.
+
+The unsigned ZIP is **48,232,557 bytes**, SHA-256
+`f3c49fbe2eb37a74cf5bc879326e8dd7b8ed7501bc340affec53348a46aaa163`, with
+**50 files** and payload-manifest SHA-256
+`48a807adddb7362833a51a1ef2a59f799c77a52bc8ac78491acd3e484e84d975`.
+Repository and extracted setup verification each reported exactly one PASS.
+The packaged binary reports `0.1.78-windows.beta9` and Worktrees state
+`deferred`.
+
+Executable SHA-256 values:
+
+- shell `22d8c6b2095b2f1e1ef430c90062810a99d290e940f791b24c4cdeff28efa172`
+- daemon `2eb05ba35c09e28fb5eed911cef27f3487553b0e5126d2ad254db524d0b4029c`
+- CLI `2e3d58081f6fb201ec7f78300776b9bd05f0ce91791397eb3ec308aa2d49ba1d`
+- zmx `9676ebdfd3ca144ca2bfc59cc871bccaa152b5b26a12119d9c887f2de7f6e075`
+
+The daemon and CLI are byte-identical to beta8. zmx was rebuilt from the same
+pinned commit; its source and package hashes match. The packaged binaries
+passed the scrubbed startup gate **5/5** locally.
+
+The custody ZIP SHA-256 is
+`2f76eb86718102dce838bc1f9eb7a0945655321f8230623b3e344e91e243d156`. Create,
+Verify and the file-only offline restore passed with **43/43/43** LFS, exact
+detached HEAD/tag, zero remotes and clean status.
+
+The handoff `GraphCode-DevBox-Handoff-0.1.78-windows.beta9` has `hashes.sha256`
+SHA-256 `bd57e1e11c02fb3bc4644c8faf91137bf4e9272c2c01f8dbd0f629af9a108dce`;
+all **8/8** entries verified. Its Dev Box prompt adds a terminal readability and
+session-ownership gate after the Core-visibility gate, before any backend
+credits are spent.
+
+### Historical beta8 candidate
 
 The current replacement candidate is
 `1bd0398108dd8e72e51bcf84a2af534d1531ab32`, the merge commit for
@@ -95,7 +158,9 @@ zero remotes, clean status and **43/43/43** LFS.
 
 The handoff `GraphCode-DevBox-Handoff-0.1.78-windows.beta8` has `hashes.sha256`
 SHA-256 `9b06f2efea1d026e22a541cec4ee5c7154f3127101b693f2f4ae68ab6857c19f`;
-all **8/8** entries verified. Its Dev Box plan is unchanged.
+all **8/8** entries verified. Its Dev Box plan is unchanged. The attended
+beta8 run then found the terminal defects fixed by #635; beta8 evidence is
+retained unchanged.
 
 ### Historical beta7 candidate
 
@@ -823,14 +888,14 @@ lease or equivalent authorized hosted evidence. No desktop available means a
 proof gap, not PASS; hosted server evidence must not be relabelled client proof.
 
 - [x] **Exact artifact:** candidate source
-  `1bd0398108dd8e72e51bcf84a2af534d1531ab32`, version/tag
-  `0.1.78-windows.beta8`, annotated tag object
-  `45675a9ae9e5791047e7131d74858d08565e19a0`, package SHA-256
-  `d118ad0cd3e12b1d62acf4b2c3907ec2f51e4e458bffed545b50911f20968246`,
+  `399ae42dd08bac31408c925d09863b1a40f3755e`, version/tag
+  `0.1.78-windows.beta9`, annotated tag object
+  `d16569a84d5fd582220c243d072494f18d1ca560`, package SHA-256
+  `f3c49fbe2eb37a74cf5bc879326e8dd7b8ed7501bc340affec53348a46aaa163`,
   50-file payload manifest SHA-256
-  `d8c5664ba5cb57e8880d3839fb2a969b6c8fd325df449daea158ffc8ad359f31`,
+  `48a807adddb7362833a51a1ef2a59f799c77a52bc8ac78491acd3e484e84d975`,
   and provider provenance are recorded in
-  `GraphCode-DevBox-Handoff-0.1.78-windows.beta8`. Tag/source match. The
+  `GraphCode-DevBox-Handoff-0.1.78-windows.beta9`. Tag/source match. The
   repository ZIP verifier and extracted standalone setup each reported exactly
   one PASS; the
   package explicitly declares `UNSIGNED (not code signed)`, records
@@ -885,7 +950,7 @@ proof gap, not PASS; hosted server evidence must not be relabelled client proof.
   steps, recovery locations and a bug-report route. Never ask testers to bypass
   security policy. Invite only after the core gates have actual evidence.
 
-The **Exact artifact** gate is complete for `0.1.78-windows.beta8`. The other **six** gates
+The **Exact artifact** gate is complete for `0.1.78-windows.beta9`. The other **six** gates
 remain open and require evidence that source, hosted CI, and hidden-window
 tests cannot manufacture:
 
@@ -907,17 +972,17 @@ is manual-dispatch only, checks out an **existing tag**, and defaults
 and produces `graphcode-windows-x86_64.zip` plus its `.sha256` sidecar.
 Checksums detect corruption; they do not authenticate the publisher.
 
-The completed local exact-artifact record is the unpublished Windows beta8
-candidate: source/tag `1bd0398108dd8e72e51bcf84a2af534d1531ab32` /
-`0.1.78-windows.beta8`, ZIP SHA-256
-`d118ad0cd3e12b1d62acf4b2c3907ec2f51e4e458bffed545b50911f20968246`,
+The completed local exact-artifact record is the unpublished Windows beta9
+candidate: source/tag `399ae42dd08bac31408c925d09863b1a40f3755e` /
+`0.1.78-windows.beta9`, ZIP SHA-256
+`f3c49fbe2eb37a74cf5bc879326e8dd7b8ed7501bc340affec53348a46aaa163`,
 source-custody ZIP SHA-256
-`5e2c23bb7cb050e7d8a8dcc59dd587f4d587cad00b02e84d2bf77e93454ed2e8`,
-and versioned handoff `GraphCode-DevBox-Handoff-0.1.78-windows.beta8`. The tag
+`2f76eb86718102dce838bc1f9eb7a0945655321f8230623b3e344e91e243d156`,
+and versioned handoff `GraphCode-DevBox-Handoff-0.1.78-windows.beta9`. The tag
 is local and unpushed, there is no matching release, and publication is false.
 README-FIRST requires restoration through the included
 `Restore-GraphCodeSource.ps1`; it forbids GitHub cloning and bare-bundle
-cloning for this custody path. The superseded beta1 through beta7 tags, ZIPs, handoffs and retained
+cloning for this custody path. The superseded beta1 through beta8 tags, ZIPs, handoffs and retained
 failure evidence remain immutable; do not transfer or qualify them and do not
 delete or rewrite their records. The local Windows
 beta1 tag object remains retained unchanged, but its `0.1.78-beta1` name is
@@ -957,7 +1022,7 @@ execute either side without relying on hidden session state:
   runs the production/native/backend/lifecycle evidence on a new corporate
   Dev Box, cleans up and returns a hashed evidence bundle. It never publishes.
 
-For `0.1.78-windows.beta8`, the versioned handoff binds the exact candidate source/tag, ZIP,
+For `0.1.78-windows.beta9`, the versioned handoff binds the exact candidate source/tag, ZIP,
 source-custody ZIP, provider/toolchain identities, Approval A, and the exact
 candidate Dev Box plan whose SHA-256 is
 `7693ff32e8b76ed99ed5094e8e2c7f3012c72d827b3eb6a374c7a812b8d7a1b6`.
@@ -1003,10 +1068,10 @@ The bounded source/tooling queue is complete. Remaining work is bottom-up and
 permission-bound; it should not start with another parity-row sweep:
 
 1. **Installed production-core and onboarding qualification - #556:** the
-   exact source-bound Windows beta8 candidate
-   `1bd0398108dd8e72e51bcf84a2af534d1531ab32` was built through
+   exact source-bound Windows beta9 candidate
+   `399ae42dd08bac31408c925d09863b1a40f3755e` was built through
    [#578](https://github.com/scgopi/GraphCode/pull/578)'s supported route with
-   the #604 release-candidate guard and includes #624, #626, #628, #630 and #633. Its independently reverified
+   the #604 release-candidate guard and includes #624, #626, #628, #630, #633 and #635. Its independently reverified
    LFS-aware custody ZIP and versioned handoff now exist; transfer and Dev Box
    execution are still NotExecuted. After authorization, use the included
    restore script and the exact candidate Dev Box plan to run
@@ -1027,7 +1092,7 @@ permission-bound; it should not start with another parity-row sweep:
    future dump-backed diagnosis requires separate authorization and a new
    candidate if product code changes.
 3. **Keep the release gates honest:** **Exact artifact** is complete for
-   `0.1.78-windows.beta8`;
+   `0.1.78-windows.beta9`;
    the other **six** gates remain open. The installed production-core result,
    native input and destructive fixture permission, named authenticated backend
    authorization, handoff transfer and execution, Approval B, and publication