[coneilen]

Summary

Repair W1's unsafe card targeting and false-negative native-form observer without changing the product or retrying the stopped action attempt. A posted target click now has an explicit source/target plan, a source-derived safe region, owned sheet/child observation, and diagnostic receipts that distinguish harness refusal from product behavior.

Changes

• Bind the planned source/target UUIDs, stable IDs, project, scene, safe title band and source hashes before any W1 stub/app launch. Reacquire immutable owned observations after arming and reject mode, identity, bounds, scale, overlap or runtime-ID drift.
• Convert physical screen coordinates and dispatch posted messages under restored PMv2 awareness; preserve screen/client coordinates, packed LPARAM, intended/native recipient, foreground, observed cursor and per-message results. Posted messages are not physical pointer hover.
• Observe the held process's owned GraphCodeSheetHost, its native-form child and the host's footer controls. Preserve numeric HWND/UIA censuses on timeout and the original action exception if cleanup also fails.
• Add 56 separately counted shared-helper contracts, expand window-binding contracts from 57 to 62, and retain the existing 18 import, 16 topology and 182/185 driver group inventories. Production no-authority DryRun records a clearly labeled model target/oracle preflight.

Test plan

RED: pwsh -NoProfile -File C:\w1r\baseline\Tools\windows\Tests\WireTargeting.Tests.ps1 -ScratchRoot C:\w1r\red-corrected -LegacyBehavior -> 2 executed, 2 expected failures: Top-level-only oracle missed the owned child content; Card midpoint hits Mark as entry before generic node selection.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\WireTargeting.Tests.ps1 -ScratchRoot C:\w1r\green-final -> 56 executed, 56 passed, 0 failed, 0 skipped on the clean committed source.
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> PASS; UiScenario 166/166, UiCaptureDriver 182/182, ActionWorkerImport 18/18, ActionWindowIdentity 62/62, ActionTopologyImport 16/16, WireTargeting 56/56; all reported suite skips 0.

The corrected RED uses the unchanged original driver exported from ec1ad74, Git blob 95e0f9820933c7ebbcbf369fda54cf828b70dc71. The initial RED was recorded before implementation, but its oracle fixture also had a STATIC/Static casing confound; only its midpoint failure was clean. The corrected two-case baseline run was obtained afterward. Both logs remain preserved, and the test-first checklist item is deliberately unchecked rather than overstating chronology.

Earlier failed implementation runs, a stopped partial runner, and the real-zmx stale-fixture source-hash refusal remain separate from passing output. The latter was a setup refusal, not evidence of product behavior.

Additional pinned real-zmx regression: 185 executed, 185 passed, 0 failed, 0 skipped, with newly generated, source-bound fixtures:

pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\w1r\real185-final -PrebuiltFixtureManifest C:\w1r\prebuilt-final\fixtures.json -PrebuiltFixtureManifestSha256 89CD8735CC6518A583C0B3D4CCDC83DC8AC90D3F31A78BD1490785EF81EFB946 -RequireRealSeed -RealSeedZmxPath C:\gcth\runtime\zmx.exe -RealSeedZmxSha256 447B8E94FE5A72D0B7D0F8C614BBEFDE597DFB864FD38278DB53AE98A921EC0B

pwsh -NoProfile -File Tools\windows\validate.ps1 -Task hardening passed all three deterministic repetitions; the optional product environment/hardware matrix was not run. pwsh -NoProfile -File Tools\windows\validate.ps1 -Task privacy, nine-file PowerShell parsing, git diff --check, and Tools\tdd\Test-TddEvidence.ps1 -BodyPath passed.

The native fixture is a harmless owned popup/child hierarchy, not GraphCode or a provider campaign. Production DryRun uses only the existing contained harmless pwsh child; its algorithm fixture is model-only. No W1-W6 product retry, screenshots, C8R captures, product source changes, or parity-ledger promotions.

The actual clean-head production entry DryRun passed at commit 6dd6556bb7cf85dcf8bf06d87cd1c1106144ad1c, tree 6f2a1354ecd848ca834bf28628bd48674d3de116: six source/window bindings, three imported helpers, five prepared topology plans, and the shared safe-target/owned-child model preflight, with zero GraphCode/provider campaign launch. Proof: C:\w1r\production-head\production-entry-evidence.json, SHA256 44C8F208D69BF8CA3DB88DD29068B2BB411F342821328C0657B41EBE3B05ABCF. This is not a live W1 action result or target-private EOF proof.

macOS make test / make check, live GraphCode behavior, and live W1-W6 parity were not run. Windows fixture tests and posted-message acceptance do not establish native physical input, glyphs, persistence, or parity. The stopped action attempt remains stopped and unreconstructed.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure