Export source-bound offscreen canvas paint evidence

[coneilen]

Summary

Add an opt-in, source-bound way to export the real canvas paint path for local component review without launching a window or capturing the desktop. The evidence class is real paint path, offscreen component render, not whole-window or cross-platform parity acceptance. Refs #822, #826.

Changes

• Freeze exactly seven files: a private GraphCanvas memory-DIB export/test, gated GDI+ readiness evidence, one two-card/one-edge fixture, a BMP-to-PNG converter, eight grouped synthetic codec/provenance contracts, their counted WindowsShell registration with both GDI+ link flags, and the replayable README procedure.
• Bind the native run's seven before/after source hashes and post-command EXE/log/paint-receipt digests to conversion. Require the exact named positive 1/1 native result; reject stale sources, substituted native artifacts, failed/zero/skipped native summaries, and foreign or reparse output.
• Verify lossless decoded RGB and publish exactly one PNG plus manifest through a fresh staging directory. Preserve failed staging. Distinguish an observed real stream-write fault from a fault that was never observed, and retain a separate final-publication failure control.
• Keep image generation opt-in, local and outside visual CI. No image, golden baseline, screenshot, provider/toolchain update, capture-core edit or new product scene is committed.

Test plan

RED: pwsh -NoProfile -File C:\gcs\rp1\Invoke-PaintExport.ps1 -RunId red-setup3 -> exit 1; intended historical scaffold behavior failure, expected artifact 1, actual 0; 0 passed, 0 skipped, 1 failed. This predates the final seven-file source.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\CanvasPaintArtifact.Tests.ps1 -ScratchRoot C:\gcs\rp1\converter-postc-callback-v2 -> exit 0; exactly 8 unique ordered synthetic groups passed, 0 skipped, 0 failed; 12 explicit subcontrols also passed.
REGRESSION: pwsh -NoProfile -File C:\gcs\rp1\Invoke-PaintExport.ps1 -RunId postc2 -> exit 0; exact named native paint test 1/1 passed on the final frozen seven-file source; three RGB hashes match. This is focused producer evidence, not a completed broad regression run.

The separately authorized actual conversion also ran once and exited 0:

pwsh -NoProfile -File Tools\windows\Convert-CanvasPaintArtifact.ps1 -InputBmp C:\gcs\rp1\postc2\export\transport\project-paint-v1.bmp -ReceiptPath C:\gcs\rp1\postc2\export\transport\paint-receipt.json -RunReceiptPath C:\gcs\rp1\postc2\run-receipt.json -TestBinaryPath C:\gcs\rp1\postc2\canvas-paint-tests.exe -OutputDirectory C:\gcs\rp1\postc2\published

It published exactly the PNG and manifest, verified 1280x720 geometry and matching decoded RGB. The producer wrapper is an external scratch artifact, not part of this change; the README supplies the replayable repository procedure. Base HEAD 24209d2a70efee78be2a8214edf013e9b787ccd0 identifies the baseline, while the measured seven-file hashes identify the then-dirty feature source. It is not a claim that the feature was already committed at that HEAD, a complete clean-tree attestation of all imports, or cryptographic execution attestation.

Frozen evidence	SHA-256
Actual PNG, local only	4338a7f10ffbf18329f054b2340e5fcb59a8b5b2e97c17d45b195321be47aa23
Paint-only manifest	aaffa47bf9c75dd3db756e67c4b4810583671cfa93ed9ccd884657f6913759c3
Three native renders / decoded PNG RGB	735b84aae3da48b864b3235fe1a42c3b0f52c700f82d90e85576444c9350749a
Native run receipt	abb9f845e494b3ad466327a4f1c4231e07ea67502525a57ac39fd56c32a0f34a
Native test EXE	29bf1cde826f55e28a2442371c8bb53fa8e7d3a72796b6f2a21def7fdde37d3a
Canonical native log	3004e12848f45aebdf84534af2016629a1e1890146c737dbecc781e003fcf0d2
Paint receipt	dfa724bdb6a8cbb9b2052b8f4676137ae643dd09a791f9533a56d53461294b85
Converter contract console	7d3976482f1bad0c6ec098f4bbabe0f77a72ce91f398441ea9dce3446e4f3aaa
Producer wrapper used for postc2	e68840d65cc857dc96f7ce8ac9a28e36b0475ea742764202392e6dd4aa466c10

Preserved failures and execution boundaries: two initial compilation/setup failures were not behavioral RED. The first post-C converter run executed 8 groups with 7 passing and 1 failing: the injected write-failure case reached a post-Save NonOpaquePixel error instead of its intended fault assertion. The corrected run observed one real COM stream callback, 3,539 accepted partial bytes and an injected IOException with HRESULT 0x80131620, while Bitmap.Save returned normally. That is evidence for this runtime only, not a universal GDI+ behavior claim. Its staged partial PNG and the separate post-PNG publish-failure artifacts remain preserved.

Two later worker-improvised, ungranted validators failed: an ANSI-sensitive outer-console regex despite a clean passing canonical native log, and a syntactically invalid independent header check after successful conversion. The five-failure rule permanently stopped that executor. The operator authorized the coordinator to admit and mechanically publish the already-frozen deliverables without source changes or a replacement fix owner. All failed commands/logs remain retained; conversion success does not erase those process deviations. No additional native run, converter retry, local broad suite or source repair followed the stop.

The earlier readiness 1/1 and adjacent card 17/17 results are historical pre-final-edit evidence, not current-source validation. Current broad/native regression is the exact-head automatic PR CI gate and is pending at initial draft publication. No failed-job rerun is preauthorized by this body; only the separately controlled #826 exception may apply to a proven inherited capture-core flake because this diff excludes all four capture-core files.

Local image review: initial individual privacy inspection found only synthetic fixture content. One fresh Claude Sonnet 5.5/high reviewer viewed this exact PNG and the individually cleared macOS project-100% frame, returning ACCEPT with stated limitations. It confirmed two legible idle cards without clipping/overlap and only a short, low-contrast connector stub. The label is displaced from that stub; direction, routing, ports and same-state edge parity are not established. It recorded meaningful card, pill, typography, age/chip and edge differences from macOS; the fixtures and states differ. This accepts scoped offscreen paint evidence, not matching macOS or the whole #764 criteria. Provenance admission is recorded on #822.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure

Not verified

• The scene is two idle cards and one edge only; it hides the right panel. No whole-issue criterion or ledger row is promoted, and no sidebar/header/whole-window acceptance is inferred from incidental pixels.
• No whole-window composition, menus/popups, terminal glyphs/provider attachment, NativeForms, UIA/accessibility, input, physical behavior, persistence, per-monitor DPI, all states/types/ages/attention/ports, initial-fit or complete edge-routing proof.
• GDI+ readiness proves startup, not that every draw used GDI+ rather than the existing GDI fallback. Four selected font facts are samples; candidate font-file lookups do not prove the physical font file GDI selected.
• Three equal RGB hashes are same-host/build/fixture repeatability, not a cross-machine golden. Synthetic converter checkerboards are codec/provenance contracts, not product-scene images.
• No local full ValidationRunner, windows-shell unit/integration, product/provider/daemon launch, new tool installation, desktop capture, manual screenshot, image in the repository, visual CI or golden baseline. No local macOS make test or make check was run.

[coneilen]

Required CI stopped: original integration failure retained

Frozen head 3a36c0f27476d8945fecfedc60aaef222f0d68b9 failed the original Windows shell integration job, run 38756824857, in Verify shell build, pinned-provider smoke, and live UI Automation.

The actual exception at Tools/windows/uia-live-gate.ps1:4791 is MULTIPROJECT_IDENTITY: the requested workspace owner/node/summary roster and requested markers did not converge, so mandatory owned workspace provider chrome remains unproved. The diagnostic reports ready metadata and an unaccepted workspace match; this is not a journal Open failure and is not evidence for applying the #826 journal-flake rerun exception. Its cause relative to this diff is not established. The job records owned process/provider cleanup and retains its diagnostic artifact.

All three unit shards, packaging contracts, both deterministic hardening jobs and terminal/contracts had passed at this stop; remaining workflows were still running. Those passes do not override failed required integration or prove native/visual parity. The initial native producer, codec and local vision evidence remains as scoped in the body.

The PR stays draft. No source changes, fixes, reruns, readiness or merge are authorized. The original failure is escalated to the operator. rp1 remains permanently parked; no new fix owner or live capture lease follows. Retained original full job log SHA-256: 82CDD19988FD799190C8A4A0DB5D0B9DA756475AEF1B740A9B6F16CDA9611340.

[coneilen]

Operator-authorized identical-head diagnostic rerun

The operator classified this seven-file diff as production-behavior-inert from the source diff: canvas export changes are test-only, GDI+ readiness additions are test-only or unreferenced by production, and the remaining files are tooling/tests/fixture/documentation. This is a source-level ruling, not a measured byte-identical binary claim.

The original job 116497412447 still stands as failed workspace UIA convergence. The operator found no matching MULTIPROJECT_IDENTITY: requested=workspace occurrence in its limited scan of failed jobs from the last 25 failed Windows-port-validation runs. This is treated as first-seen nondeterministic live-UIA evidence, not the #826 journal error.

An explicit, issue-specific grant permits one diagnostic rerun of that integration job only on unchanged head 3a36c0f27476d8945fecfedc60aaef222f0d68b9. It is not a fix iteration, a general retry allowance or a use of the #826 exception. Original log SHA-256 82CDD19988FD799190C8A4A0DB5D0B9DA756475AEF1B740A9B6F16CDA9611340 remains unchanged; diagnostic artifact 11983564936 is referenced only and has not been downloaded.

If the single rerun passes, one follow-up issue will preserve the original failure and rerun evidence before normal required-check, Ready/fresh-DCO and exact-head merge admission. Any rerun failure, matching or different, stops for the operator with no further rerun, fix, rebase or rp1 wake.

[coneilen]

Identical-head diagnostic passed; normal merge gates resume

The single operator-authorized diagnostic integration job 116507566215, attempt 2 of run 38756824857, passed on unchanged frozen head 3a36c0f27476d8945fecfedc60aaef222f0d68b9. No fix, source edit, rebase, rp1 restart or additional rerun was performed. The original failed job/log and diagnostic artifact remain preserved.

The required follow-up is #831, recording the original workspace convergence refusal, log hash, artifact reference, diagnostic success and the operator's product-inert source classification. This does not establish root cause or extend the #826 rerun exception.

The current nonempty exact-head inventory has 24 completed contexts, 20 successful and four configured skips. Readiness, fresh Ready-event DCO and an exact-head check remain required before any merge. This is code/tooling admission only: the scoped offscreen image acceptance and all unverified whole-window/parity claims remain unchanged.

[coneilen]

Mechanical docs-only base update; frozen feature bytes unchanged

The protected merge refused the previous head because it was one docs-only commit behind main. Under the explicit operator grant, the single feature commit was rebased without conflict onto 4a30b79d259228cbce7d23b16a3a81a9f8ee9446 (#828), which changes only three investigation/*.md files and does not overlap this PR.

New head: e75fa381c63e7fdf43aa86a8ebc44240533db2e6. Previous head 3a36c0f27476d8945fecfedc60aaef222f0d68b9 and its failed/successful diagnostic CI history remain recorded. The coordinator verified zero content diff on all seven frozen feature paths, identical SHA-256s to the admitted manifest, unchanged DCO sign-off/Copilot trailers, clean worktree and the exact requested force-with-lease against the previous head. No product source repair, executor restart, re-review or recapture occurred.

The full-template PR body is unchanged (SHA-256 22BBD2764CF8478355D524267B6EC1ADD6B2A0A41F2EF42198E318C80ACDB6AB); its evidence check was rerun and passed. Historical render metadata still names its actual baseline and frozen bytes, not the new publication commit. The PR is draft again for full fresh exact-head CI, then Ready/fresh DCO and a standard protected exact-head squash merge.

For this new head the operator permits only the existing bounded #826 journal-flake rule (at most two classified failed-job reruns globally) and one diagnostic rerun for the recorded workspace-UIA-convergence signature. Any other failure stops for the operator. No admin bypass, source fix or further base change is authorized.

[coneilen]

Fresh up-to-date head passed without retries

Head e75fa381c63e7fdf43aa86a8ebc44240533db2e6 on docs-only base 4a30b79d259228cbce7d23b16a3a81a9f8ee9446 passed its fresh automatic workflows at attempt 1: Windows shell 38762422453, Windows port 38762422097, hardening 38762422367, TDD 38762422175 and DCO 38762422100; macOS/Linux had configured path-gated execution skips. The nonempty inventory has 24 completed contexts: 20 successful and four configured skips. No rerun allowance was consumed on this head.

Current-head raw logs positively record codec 8/8/0/0 and native readiness in unit job 116516980879; capture-core 49/49/0 and offline 166/166/0 in hardening job 116516980464; and the actual required real-zmx XCTest pass sentinel in Swift job 116516972434. The image producer remains opt-in and is not a visual CI gate. These facts do not upgrade the scoped image verdict into whole-window/parity acceptance.

The seven feature files, admitted artifact and body are unchanged. The previous head's original integration failure, its one successful identical-head diagnostic and the follow-up issue remain preserved. Ready was requested only after this fresh CI pass; a fresh Ready-event DCO and exact-head protected merge check are still required. No admin bypass, source fix, additional image run or rp1 executor restart is involved.