Retain bounded selector-refusal evidence without observing successful waits

[coneilen]

Summary

Retain bounded, typed evidence when an existing selector definitively refuses, without changing the selector, ownership decision or wait budget. A polling wait keeps only its last already-enumerated references; diagnostic property reads and the single record occur after failure, never on an eventually successful wait.

This is the mechanical replay of the accepted dea7de2a374b6619e0a69f0b22ff16603a3311f6 patch onto the merged journal core at 77ec22136a99f55e7d0be00ce37979525753a57f (#852). It adds no new product behavior. Existing draft PR #850 is retained; this private packet does not create another PR or change its public body.

Refs #848

Changes

• Add CapSelectorRefusal/1 scalar JSON through the unchanged legacy trace serializer: complete-set cumulative stage counts, up to 16 deterministic near-match candidates, bounded strings and the first 64 distinct actually read PIDs with raw/distinct/sample counts and explicit truncation/completeness.
• Preserve Name, AutomationId, ProcessId, IsOffscreen, BoundingRectangle and ControlType values, distinguishing missing/null/getter failure from real values. Canonical empty bounds and NaN/infinity remain successfully read typed values; the original raw bounds predicate is unchanged.
• Defer polling diagnostics to TERMINAL_LAST_POLL_SNAPSHOT, preserving the original refusal, deadline, retry predicate and 100 ms cadence. No sink performs no diagnostic work; stale references are read errors, not a fresh query or invented PID. Observer failures use the existing explicit error channel and are attempted at most once per wait.
• Register all 13 focused groups in the normal suite: exactly 85 ordinary / 88 real-seed cases, retaining all 75 merged-base case names and the original 59 inventory. Update the caller's exact count to 85 and document the schema and evidence limits.
• Mechanically resolve the single expected conflict at the suite-count line: merged-base 72 ordinary / 75 real-seed plus the accepted 13 selector groups gives 85 / 88. Count/registration/documentation reconciliation does not weaken assertions or widen a budget.
• Preserve the accepted selector helpers, Find/Resolve functions and the old worker byte-for-byte where applicable; the worker remains SHA-256 8468E1692A3E27D3C0D89BC2F4C5C853ACACD312BBEC2A251C2CF32B25104CA1. All seven merged journal functions and all 51 base test functions remain text-identical to 77ec2213. No supervisor, native API, process identity, app, Zig, shared Swift, provider pin, workflow or parity-ledger changes are included.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -SelectorRefusalContractOnly -ScratchRoot C:\gsf8\red -> HISTORICAL original execution, not a new rebase RED: 1 executed, 0 passed, 1 failed on unchanged 584A production: exact legacy Alpha/open-project- found=0 refusal occurred, then "Existing zero-match refusal occurred, but retained CapSelectorRefusal evidence is missing."
GREEN: pwsh -NoProfile -NonInteractive -File D:\depot\copilot-worktrees\GraphCode\coneilen-solid-sniffle\Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -SelectorRefusalContractOnly -ScratchRoot D:\gf85\s; pwsh -NoProfile -NonInteractive -File D:\depot\copilot-worktrees\GraphCode\coneilen-solid-sniffle\Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -FixtureContractOnly -JournalTimingContractOnly -JournalFirstOpenContractOnly -JournalObservationContractOnly -ScratchRoot D:\gf85\j -> two separate fresh-host executions, exits 0; selector 13 unique/13 passed/0 failed and setup+journal 5 unique/5 passed/0 failed; all frozen source/artifact hashes unchanged.
REGRESSION: pwsh -NoProfile -File D:\gcs\r850m\Invoke-850RebasedQualification.ps1 -RunRoot D:\gr85 -ExpectedControllerSha256 DA421999D36EA12CF94F03E561836D68D6A23D331A4285538B5A3EFA785CF0F9 -RuntimeDeadlineUtc '2026-10-17T02:45:59.4088611+00:00' -OuterDeadlineUtc '2026-10-17T03:36:06.4007745Z' -> ONE admitted contained run, exit 0; 88 unique/88 passed/0 failed, all base 75 plus 13 selector groups retained, original 59 missing=0/failed=0.

The regression command is one actual invocation, not another GREEN rerun. The focused commands ran separately because their early-return modes must not silently omit a group; the setup command includes the fixture binder and all four journal groups. The initial M1 plan listed four journal cases before the coordinator explicitly added -FixtureContractOnly; the actual result is five, not four.

The two focused CAP_TRACE_FAILURE ... ToInt64 lines are specifically matched passing malformed-context observer negatives. The setup/journal stderr line is the deliberate blocked manifest-creation-budget\snapshots observation failure while reporting JournalUnavailable; the corresponding group passed. The full run's stderr contains exactly those three matched negative-fixture lines, not a blanket exemption for real journal failures.

Current local qualification finished at 2026-10-17T02:33:35.8875616Z. Two native C fixtures compiled before the added suite job and all 14 bound artifacts were verified; the suite did not fall back to compiling them. All eight controller helper extents remained exact. The gated generation was assigned before targets, with kill-on-close only and no breakaway. Job counts were 0/0/0 queried before close, actual stdout/stderr EOF was proven, and no owned vctip was observed. No safety-net kill was relabeled clean.

The retained-file seal checked 33 official releases, 96 numbered envelope/payload hashes, canonical JSON, predecessor/identity bindings, and 10 unique canonical CAP_JOURNAL_FINAL_V2 records that were actually LAST in worker stdout. Six actual ready real-zmx phases covered three cases times two phases. All eight post-source hashes and the unchanged native-helper hash were bound. Distribution: 21 refused-no-worker, six released-zero-survivors, four expected failed-zero-survivors and two deliberate cleanup-unproven negatives retained as unproven. Empty official outer stderr has length 0 and SHA-256 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855; it is corroborating metadata beside positive exit 0/PASS/88 evidence, not an empty-result-as-pass claim.

Current report SHA-256: EC20C184DFC22BB734244900DE52E0B640F8F17CC786BC7099E3B0D38920F5C2. Controller result: D2FA27B0C30AF11DED016087DD9C2FFDA04909133A5B1EE550B13A540EAE8C34. Configuration: B5B4AD68D12E515393F5F4FCA8C8058CCCFA787A03AE0AD533DCCD247FC7DA78. Owner file-only seal: 076FC26C005027A0E18A6E2A3A9A34F97E59DEE0535C2A314AADFFAD29013D2A. Coordinator independent retained-file proof: 6EDD41F3A6A99C5185544EE7044C60E0313E81594CB5CE4473EF282DB2945A7D.

This is local contained harness qualification, not hosted CI. Acceptance still requires Windows 2022 AND Windows 2025 green on the exact new head, with no real journal-unavailability failure and no #846-shaped failure. Earlier old-head CI outcomes remain failures or diagnostics as recorded below. The full ValidationRunner, Windows shell/product suites, macOS make test and make check were not run during this rebase. Caller registration is source-reviewed, not a full ValidationRunner execution.

Historical GS11 qualification completed at 2026-10-16T21:43:50Z: 85/85/0, 33 releases, 96 numbered envelopes and six ready real-zmx phases. Historical report SHA-256: BA35082C1E18E055E1069D54AB2C613AB39322E7CA21AFDD5791BC669DCF158A; historical file seal: B6B3F9C5C5408B8483C9DD241BCC19FE23DCCAF799AB2AF490D47C59B39D5072; historical independent audit: DD802BEF402599A3F9C3DE39AEFC0022CE06C25AB9B52CDCE4B7CBA60CF0B1F2. These are not relabeled as 88-case runs or new source fixes. The earlier pwsh -NoProfile -File Tools\windows\validate.ps1 -Task privacy passed with "Privacy checks passed"; that is historical execution, not a new rebase privacy run.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure

The unchecked macOS commands were not executed on this Windows host. The scoped PowerShell source followed existing patterns and parsed before its admitted execution; that is not a claim that make check ran.

Preserved execution history

• Initial behavioral RED was 1/0/1 on unchanged production. Focused attempts were 8/6/2, diagnostic 8/6/2, 8/7/1 and diagnostic 8/7/1 before focused 8/8/0. They exposed a getter-error-to-null defect, a leaked test serialization spy and an unsupported test MyCommand.Name assumption. Every failed console/report remains distinct; tests retained the null/missing/read-error, original exception and explicit observer-failure assertions.
• That M2 focused 8/8 was not accepted source: independent review rejected per-inner-poll observations and nonfinite-bound read-error classification. No full run used that rejected controller. Its final artifact seal finished 30 seconds after the original M2 stop; this was a packaging overrun, not an extended source/runtime grant.
• R2 first demonstrated the observer effect behaviorally: actual worker wait succeeded on poll two, but the rejected source performed diagnostic work during the first refusal (9/8/1). R2's first 13-case attempt was 13/6/7: an unavailable nominal rectangle type, a test closure capture and empty-array shape were classified from retained fields and corrected under explicit grants. Final R2 was 13/13/0. The empty-bounds fixture is explicitly synthetic, not a WPF/native instance.
• C:\gso9 was interrupted by a host-session restart, not an OS reboot. Its suite outcome is UNKNOWN and in-job cleanup UNPROVEN, neither PASS nor FAIL. Fixture preparation alone had completed.
• C-drive capacity exhaustion blocked replacement preparation before a native attempt. The operator moved fresh run roots and all parent/precompile/suite TEMP to D: without a junction or alias. No source/toolchain version changed.
• D:\gs10 actually failed 85/83/2: the normal real-zmx case was CLEANUP_UNPROVEN and the dependent exact-report gate failed. Positive traces identified an unchanged identity/journal path's initial Snapshot call for a conhost; why its Handle was null remains unobserved. Neither trace contained B capture refuses first Alpha project selector; retained UIA candidates are not inspectable #848 Find/Resolve/Wait/diagnostic commands in that case. Separate tracker #849 retains the facts. The later same-source D:\gs11 pass is not a source fix, proof of flakiness, or resolution of that unknown cause.
• The two ToInt64 observer-error lines were deliberate passing malformed-context negative groups. Finding A was withdrawn after that evidence; no speculative handle normalization was added.
• The private commit-message guard caught CRLF before staging/commit. Its raw beforeimage and failed console were retained; an explicit private UTF-8/no-BOM/LF-only correction preserved all words/trailers. Qualified source bytes/EOL were not normalized. This mechanical correction is not behavior RED.
• During disk recovery, the user deleted some old local gjp/gccp/gct/gc764 and lane evidence roots. Historical hashes remain in prior PR/comments; those deleted raw artifacts are not claimed locally available. Current source/Git objects, fixed inputs, failed-run records and final qualification proofs remain separately identified.

Review and evidence limits

The independent claude-sonnet-5.5 HIGH source review accepted the corrected R2 selector delta; its retained response SHA-256 is 4FE0235438E36FF88D02A0F32B4DAD81A3870F9AE18A23A1D9A82DBF7D7CD029. Its original agent 0e191349-204d-41e1-ad2c-04b383b90aea later lost context after the host-session restart. The old zero-source-delta root/metadata waiver remains historical, not a claim of continued reviewer context.

For this replay, the user-approved ONE replacement reviewer ran as claude-sonnet-5.5 HIGH in BACKGROUND, agent b72f127b-bdb2-4789-8998-978f202491a3, and accepted only the mechanical integration delta with no blocking issues. It is explicitly not same-agent continuation and did not freshly re-investigate the accepted feature. Its retained response SHA-256 is 474F0215BCE515C228B114A77F3D7945DD17D9FF0B53F708713A3DDAB9ACEB64. It confirmed old selector/worker preservation, seven journal functions exact to the merged base, all 51 base test functions preserved, count/conflict/registration reconciliation and the 88-name inventory. The accepted journal R3 source review remains 65F82F636CA2C837634138B5658C9D685115FDF05D92642B796FD56250ABAE51. Reviews were source-only; the coordinator separately directly read the frozen controller before the one full run.

• New tests use a synthetic query leaf with the actual worker Wait/deadline and Resolve, not real Find/native UIA. Only Current and ControlType getters are individually metered; other no-extra-read assertions also rely on source structure. Null-reference/pre-query binding seams are source-read only.
• Empty bounds use a synthetic canonical Rect.Empty numeric DTO, not a genuine WPF instance. Successful NaN/infinity reads are typed values, not getter errors.
• Stage counts scan the full candidate collection, not merely the 16-record sample. Terminal COM observation has no per-getter elapsed bound; only the outer job/lease bounds remain. A hung getter may extend failure handling/cleanup. A follow-up cap is a candidate only if a future separately admitted live run demonstrates latency; none was added here.
• lastPollUtc marks poll start and the retained references; property values are read later after definitive failure, not frozen at the poll. Stale/vanished properties are typed read errors. No new tree/window query, selector fallback/retry, ownership rule or timing budget was added.
• This work establishes no live B result, native UIA behavior, rendering, physical input, accessibility conformance, hardware behavior, cross-platform parity or ledger promotion. No images or backend turns were produced. D/helper/764 and any future live allowance remain separately held.
• Raw compiler-log EOF remains unproven; immutable compiler snapshots and the precompile host's EOF are different evidence. Injected unproven cleanup outcomes stay unproven.

Earlier PR #850 CI and mechanical replay history

• Original Windows 2022 job 117215107135 failed during fixture PREPARE Process.Start/Snapshot, in the #849 family. ONE same-head diagnostic job 117218863225 passed 82/82 plus ValidationRunner. It does not erase the first failure or prove its cause. Raw logs remain D:\gcs\coord2\850-win2022-job117215107135-ansi-raw.log and 850-win2022-diagnostic-job117218863225-ansi-raw.log.
• Original Windows 2025 job 117215107088 failed 82/79/3, including real journal unavailability. ONE diagnostic job 117223178057 also failed 82/79/3, including sequence 3 plus sequence 1 journal unavailability. Neither is a pass, and neither old-head job was rerun by this owner. Raw logs remain D:\gcs\coord2\850-win2025-job117215107088-ansi-raw.log and 850-win2025-diagnostic-job117223178057-ansi-raw.log.
• Merged #852 at 77ec2213 repaired the journal timing/durability policy and had first-attempt hosted 72/72 plus ValidationRunner green on BOTH Windows 2022 and Windows 2025. That is accepted base evidence, not retrospective proof of every old CI cause and not this replay's new-head CI. #851 remains OPEN for additional hosted confirmation; Offline real-zmx rehearsal fails acquiring a conhost identity: initial Snapshot receives null handle #849 remains tracked and is not fixed here. The separate production-observer-risk follow-up #853 is outside this patch.
• Private rebase tooling had two pre-test failures: an empty-array console-summary projection and an inline inspection-command parse error. They were reported before correction/retry and preserved; they are not compile failures or product behavioral RED. An unused post-run ranged view of empty official stderr was refused; its history remains separate from positive exit 0/PASS/88 evidence.
• The first mechanically published replay c0e8b01dac0f18465054d5f51f3f4bffdee63d46 had a harmless duplicate DCO sign-off appended by git commit -s. The strict raw-message guard refused that byte mismatch; the old input, raw commit and failed guard remain preserved. A separate redundant event-collection check then refused non-unique text matches before any amend; no product or lineage assertion failed there. Under explicit USER013n authorization, exactly ONE message-only amend used the already signed-off canonical message with -F and WITHOUT -s; its three trailers occur once each. Parent and tree stayed identical, with all qualified source/control bytes unchanged.

Historical old push dea7de2a374b6619e0a69f0b22ff16603a3311f6 had parent 95a12681d6d3a6bbc3e1c64992489dd4d04f2863. The current single replay commit is 5a37cd6e3b48b39633ada7a7ccaddb8ae1910efa, parent exactly 77ec22136a99f55e7d0be00ce37979525753a57f, tree 5760f25609f642a46fbc0ad05d2deb917a803b5f, containing exactly five changed files. The transferred fork ref was first pushed with the exact old dea7 lease, then the message-only replacement with the exact c0e8 lease; never plain force or another ref. The tree did not change across the authorized message-only amend, so the admitted focused/full evidence still binds the same qualified bytes.

This is a private operator packet for the EXISTING draft PR #850. The implementation owner has not edited its public body, created a new PR, marked Ready or merged. The old authoritative body remains separately frozen at SHA-256 E020626E7501678606DC6581B13A03097AF4D947439F8BA9CD562B52AF5D3BB8; the operator republishes this distinct canonical packet after independent verification.