[coneilen]

Summary

Prevent the action runner's worker import from resetting its authorization path/hash and masking a caught setup failure. Add a no-product production-entry dry run before any separately authorized action attempt.

Changes

• Give the shared worker's entry authorization parameters private names while retaining the existing CLI aliases.
• Pin the action authorization against replacement/writes and bind it to the exact owned path, source, run, numbered journal, authority, hashes and deadline.
• Add Invoke-MatchedActionSupplement.ps1 -DryRun: a non-authorizing binding, real contained harmless launcher release, shared physical-work-area/DPI geometry preconditions, terminal journal and positive empty-job/launcher-EOF cleanup.
• Preserve the primary setup exception in manifest/release publication, including a consistent failures array.
• Add 18 separately counted import, authorization-negative and production-entry contracts, enforced by ValidationRunner in addition to the unchanged 182/185 baseline.
• No product changes, W1-W6 product launches, C8R, campaign or ledger promotion. The sealed prior W1 primary exception remains unknown; no product failure is inferred.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\ActionWorkerImport.Tests.ps1 -ScratchRoot C:\gcar\red -> Worker definitions import reset caller authorization: path='' hash=''.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\ActionWorkerImport.Tests.ps1 -ScratchRoot C:\gcar\focused-green -> 18/18 passed, zero skips; production-entry canary success and setup refusal both publish five numbered snapshots.
REGRESSION: pwsh -NoProfile -File Tools\windows\validate.ps1 -Task hardening -> repeated-runs PASS 3/3.

The focused suite uses a clean fixture repository containing byte-identical production entry scripts, not a session wrapper or an AST projection. It separately asserts the single target specification is harmless pwsh -Command 'exit 0' and the job journal contains only that PowerShell image and, when present, its owned system console host. No product/provider process is launched by the dry run. Actual product-window identity, native actions and parity are not claimed.

Final committed-source local checks:

pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -MatchedDpiContractOnly -ScratchRoot C:\gcar\dpi-green -> 4/4 passed
pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -PrepareFixturesOnly -ScratchRoot C:\gcar\prebuilt2 -> fixtures prepared; manifest SHA256 256F4FCFFA5A443D972D17D802C5C91B6CC2591255EBFFCC8CCD1AF978B583D2
pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\gcar\full4 -PrebuiltFixtureManifest C:\gcar\prebuilt2\fixtures.json -PrebuiltFixtureManifestSha256 256F4FCFFA5A443D972D17D802C5C91B6CC2591255EBFFCC8CCD1AF978B583D2 -> 182/182 passed, zero skips
pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -RequireRealSeed -RealSeedZmxPath C:\gcar\providers\zmx\zig-out\bin\zmx.exe -RealSeedZmxSha256 6827DBF9C069AEFCD35FDD8530D82BBA239AC784C44B9B05E4FFF14F157B528C -ScratchRoot C:\gcar\realzmx3 -PrebuiltFixtureManifest C:\gcar\prebuilt2\fixtures.json -PrebuiltFixtureManifestSha256 256F4FCFFA5A443D972D17D802C5C91B6CC2591255EBFFCC8CCD1AF978B583D2 -> 185/185 passed, zero skips
pwsh -NoProfile -File Tools\windows\validate.ps1 -Task hardening -> repeated-runs 3/3 passed
pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> PASS, including UiCaptureDriver182/182 zero skips, ActionWorkerImport18/18 zero skips and UiScenario166/166
PowerShell Parser.ParseFile over the four changed ps1 files -> 4/4 parsed
git ls-files --eol over all five changed files -> index LF and working LF
git diff --check -> passed; clean committed worktree
pwsh -NoProfile -File Tools\tdd\Test-TddEvidence.ps1 -BodyPath C:\Users\coneilen\.copilot\session-state\5874433b-7124-4764-bb9f-a20d2ede3216\files\pr-body.md -> passed

Original W1 refusal is preserved; no live W1 success is claimed. The committed production entry was run with the hash-verified original C:\o8\job.json (SHA256 A9F15A9499133CB8B686A8E909326772359634FE481AA91FF90D081BF94B8842, 7767 bytes) against current implementation head 2251361e4fa10b8e276a7cec1279ee2830854d25. The expired historical authority was not reused. The direct entry command executed was:

pwsh -NoProfile -File Tools\windows\Invoke-MatchedActionSupplement.ps1 -Repository D:\depot\copilot-worktrees\GraphCode\coneilen-reimagined-dollop -OwnedRoot C:\gcar\production-original-w1 -ActionPlanPath C:\gcar\production-original-w1\action-plan.json -ActionPlanSha256 00854DAFF7D284E3EFC520DE67E3783CC94DF4031E0AE14E1E2836B476922329 -DryRun

Result: bounded setup refusal, outer=2906x1910 work=1920x1032, preserved as the primary failure in manifest/release, five numbered snapshots, zero product/provider launches, and positive held-job-empty/launcher-EOF cleanup with zero survivors/failures. The path/hash survived import and the actual launcher release consumed sequence 2 in this exact action-owned journal.

Same-thread native before/during/after probes confirmed that the shared query already enters PMv2 awareness 2 and restores the original context. At that attempt, PMv2 reported DPI96, native monitor1920x1080/work1920x1032; a time-aligned coordinator probe agreed. This was an actual desktop change, not a missing-PMv2 workaround. Subsequently the user restored the desktop; coordinator admission at 2026-10-29T10:37:00.2253004-07:00 reports awareness2, DPI192, monitor3840x2160/work3840x2064. After fully green CI and merge, a distinct-root original-W1 production dry run will verify that restored geometry inside its own process. That admitted production-entry proof is still pending, and is not a W1 product retry. No OS/display changes or bypass were performed by this tooling session. Product-window identity/metrics and the sealed earlier W1 primary exception remain unproved/unknown; Phase 2 is not authorized by this PR.

Sealed refusal evidence:

• C:\gcar\production-original-w1\dry-run-output\action-manifest.json: SHA256 8244A9B6C31E58A25097E366E3E105C0F5B44EE727C7B417E6B1D5D7BFC758B5.
• C:\gcar\production-original-w1\dry-run-output\action-release.json: SHA256 6795F72279CDC29172EC52E48F66D04186CD445C1A1B310C0ABB309616DE3747, FAILED_ZERO_SURVIVORS, HELD_EXIT_AND_EOF_PROVEN.
• Terminal dry-run-runs\007fef62b6ba4b1ca9dae6c5b26743fc\process-journal\000005.json: SHA256 0CD220A38FD211F638805B37F926E53B03B4F02A04E5803EA5CDA073B308993E.
• Session artifact production-entry-evidence.json: SHA256 1A2D607724339A84167D4A0B0F5BBFD1E5E7BC728A9764E44BF27EE4B1BAB3AB; inventory verified without repeating the production attempt.

CI attempt history: Windows2025 hardening attempt 1 failed the existing contained-job timeout contract with a stdout.log sharing violation in unchanged UiCaptureDriver.psm1; the report gate then failed downstream (180/182), before the new18 suite ran. The failure log is retained, and only the failed job was rerun on unchanged head2251361e. No assertion was weakened or source changed to obtain a retry. Merge requires all latest exact-head required checks to be green, without bypass.

Other evidence corrections are retained separately: the first full-suite invocation refused missing prebuilt fixtures (PrebuiltFixtureRequired); a stale-fixture attempt correctly refused PrebuiltFixtureSource after a source spelling correction, so fresh source-bound fixtures were prepared. First complete baseline runs reported180/182 and183/185 because helper whitespace broke an existing literal source contract and its downstream preflight gate; exact expected spelling was restored. The obsolete first ValidationRunner attempt was stopped rather than called green. Initial zmx build without the canonical target failed; pinned -Dtarget=x86_64-windows-gnu build passed. An expanded negative assertion exposed the scalar failure shape, now corrected to an array. A launch-census assertion was corrected to admit only the held job's system conhost.exe, not arbitrary images. A session evidence inventory helper initially used terminal.path instead of terminal.name; reporting was corrected read-only without a production retry. Failed logs were preserved rather than overwritten.

macOS make test / make check are not run on this Windows host; no macOS/shared Swift/product files change.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure