scgopi · coneilen · Oct 5, 2026 · Oct 5, 2026
diff --git a/investigation/windows-preview-release-plan.md b/investigation/windows-preview-release-plan.md
@@ -10,52 +10,54 @@ The critical path is terminal correctness plus a packaged production-daemon
 flight, followed by fixes for any reproduced core bugs. It is not closing all
 36 Partial rows, and it is not just visual polish.
 
-### 2026-10-04 replacement Windows candidate
+### 2026-10-05 replacement Windows candidate
 
 The current replacement candidate is
-`2fede5a76eca6af508e3a2f2f6d356e1d0123573`, the merge commit for
-[#624](https://github.com/scgopi/GraphCode/pull/624), with parents
-`0d879efabbcf8ac699a48c2f6aa3dd7f61d2cbff` and
-`4f0660c11a8b52020b194739d8dc177a618361ba`. It replaces
-`0.1.78-windows.beta3`, which is failed/superseded and immutable after the
-attended Dev Box reproduced the production folder-picker crash despite #619.
-The crash occurred after the daemon registered the selected folder exactly once:
-the shell then terminated in USER32 with `0xc0000005` and a later `0xc000041d`.
-
-#624 fixes the remaining lifetime bug: #619 posted project registration as the
-next ordinary queued window message, which could run before USER32 had finished
-restoring the `IFileDialog` owner window. The new one-shot owner timer is
-low-priority and runs only after queued activation/focus work drains. Focused
-RED/GREEN coverage proves owner restoration precedes one completion; cancel,
-repeat accept, timer cleanup, and timer-ID separation are retained. Exact-head
-CI passed all Windows shell unit, integration, package, hardening, and Swift
-jobs. A new attended Dev Box Ctrl+O accept rerun is still required; this source
-and CI evidence does not claim that native-client result.
-
-The local annotated tag/version `0.1.78-windows.beta4` has tag object
-`579193806575bcbe859a53b551adcb47160ef2f4` and peels exactly to the source.
-It is local, unpushed, and unpublished. The unsigned ZIP is **48,215,413
+`445f6916208e148084c247789a7becae2d4e7148`, the merge commit for
+[#626](https://github.com/scgopi/GraphCode/pull/626), with parents
+`57fd33bb5e85c857c5e6ad5457c1abce78e6eda1` and
+`4ea70ed23434980ab8b59ca7e13b347f5e74529c`. It replaces
+`0.1.78-windows.beta4`, which is failed/superseded and immutable after the
+attended Dev Box process-scrubbed launch terminated with
+`event=fatal detail=EnvironmentVariableNotFound`. The exact missing variables
+were optional `USERNAME`, then fallback `USER`, in the workspace reservation
+identity path.
+
+#626 resolves the Windows account identity with `GetUserNameW`, preserves a
+bounded test-only identity hook for concurrent daemon handoff, names startup
+operations in fatal diagnostics without logging values, and adds a production
+process gate for the exact 11-key environment. The gate covers onboarding
+Escape, Skip, completion and an existing marker; each case requires a live
+shell, daemon and CLI endpoint with no developer-tool path. Exact-head CI run
+`37255770809` passed all Windows shell unit, integration, package, hardening and
+Swift jobs. The packaged beta5 shell also passed all four scrubbed cases
+locally. A new attended Dev Box startup and Ctrl+O rerun are still required;
+this source/CI evidence does not claim that native-client result.
+
+The local annotated tag/version `0.1.78-windows.beta5` has tag object
+`e4853761619c5cb0464d563c5880be2c48cb72b8` and peels exactly to the source.
+It is local, unpushed, and unpublished. The unsigned ZIP is **48,216,262
 bytes**, SHA-256
-`5b11221137e5406c371b01dcc220bd5dcb761a3064882091e0547c37fd9dc215`,
+`f3a1dd595d6c15c4295f9455bbb00ec44a12d3a057bd4d8d9f1988fd0607fc55`,
 with **50 files** and payload-manifest SHA-256
-`c3dea854f1e405d3bf0d0801547ab3af9a384a907709a51d6d6af4236171a8c0`.
+`a442d169215b47a3fbceda6dc04f5ea514fe302891a1d03d3cb5f1c6760e5d9e`.
 Repository and extracted setup verification each reported exactly one PASS.
 Executable SHA-256 values are shell
-`1bcd7fbfd11fae44238c495633d5da926e2bf349b7dbdae44b8db4101e29eeae`,
+`33563e60ce0edf0a423332c18d209b503656c6dbb5441a57f0984b6bc82ce002`,
 daemon `2eb05ba35c09e28fb5eed911cef27f3487553b0e5126d2ad254db524d0b4029c`,
 CLI `2e3d58081f6fb201ec7f78300776b9bd05f0ce91791397eb3ec308aa2d49ba1d`,
-and zmx `e746e57ddeab144a0c187e1875706687b05d4e7317c7f5b808f8918e935ec465`.
+and zmx `90169342eb908cf4bbccc631f801097f54ab002e8047a705fdf6e1b7a852635e`.
 
 The LFS-aware custody ZIP SHA-256 is
-`2e2481a9f46d04776c9e1127e34ce691e50a24256590b60799b7bfc075785130`.
+`05f356579bbe16b1997e1e09d2a99ee0c5ae431bcb5bfe7ea766a93c77e22046`.
 Verify and offline Restore passed with exact detached HEAD/tag, clean status,
 and **43 objects / 43 tracked files / 43 materialized files**. The versioned
-handoff `GraphCode-DevBox-Handoff-0.1.78-windows.beta4` has an eight-entry
+handoff `GraphCode-DevBox-Handoff-0.1.78-windows.beta5` has an eight-entry
 inventory whose `hashes.sha256` SHA-256 is
-`82321a40b389717e7d398d64a057d130bf08c9b98f46bde22b63b342ce9154f5`;
+`2e41b4fe94a944df26110882bac99860b6f8f96ac1578473c406d3826aef39d3`;
 all **8/8** entries verified.
 
-The verified active local qualification candidate is
+The historical Windows beta3 qualification candidate was
 `7459aa9f1dfc06f0478c55b897da5b226c34cd3a`, the normal merge commit for
 [#622](https://github.com/scgopi/GraphCode/pull/622), with parents
 `fc2a2bcbaaeb1cdd2d16d171f1c871786932cedd` and
@@ -626,14 +628,14 @@ lease or equivalent authorized hosted evidence. No desktop available means a
 proof gap, not PASS; hosted server evidence must not be relabelled client proof.
 
 - [x] **Exact artifact:** candidate source
-  `2fede5a76eca6af508e3a2f2f6d356e1d0123573`, version/tag
-  `0.1.78-windows.beta4`, annotated tag object
-  `579193806575bcbe859a53b551adcb47160ef2f4`, package SHA-256
-  `5b11221137e5406c371b01dcc220bd5dcb761a3064882091e0547c37fd9dc215`,
+  `445f6916208e148084c247789a7becae2d4e7148`, version/tag
+  `0.1.78-windows.beta5`, annotated tag object
+  `e4853761619c5cb0464d563c5880be2c48cb72b8`, package SHA-256
+  `f3a1dd595d6c15c4295f9455bbb00ec44a12d3a057bd4d8d9f1988fd0607fc55`,
   50-file payload manifest SHA-256
-  `c3dea854f1e405d3bf0d0801547ab3af9a384a907709a51d6d6af4236171a8c0`,
+  `a442d169215b47a3fbceda6dc04f5ea514fe302891a1d03d3cb5f1c6760e5d9e`,
   and provider provenance are recorded in
-  `GraphCode-DevBox-Handoff-0.1.78-windows.beta4`. Tag/source match. The
+  `GraphCode-DevBox-Handoff-0.1.78-windows.beta5`. Tag/source match. The
   repository ZIP verifier and extracted standalone setup each reported exactly
   one PASS; the
   package explicitly declares `UNSIGNED (not code signed)`, records
@@ -688,7 +690,7 @@ proof gap, not PASS; hosted server evidence must not be relabelled client proof.
   steps, recovery locations and a bug-report route. Never ask testers to bypass
   security policy. Invite only after the core gates have actual evidence.
 
-The **Exact artifact** gate is complete for `0.1.78-windows.beta4`. The other **six** gates
+The **Exact artifact** gate is complete for `0.1.78-windows.beta5`. The other **six** gates
 remain open and require evidence that source, hosted CI, and hidden-window
 tests cannot manufacture:
 
@@ -710,19 +712,19 @@ is manual-dispatch only, checks out an **existing tag**, and defaults
 and produces `graphcode-windows-x86_64.zip` plus its `.sha256` sidecar.
 Checksums detect corruption; they do not authenticate the publisher.
 
-The completed local exact-artifact record is the unpublished Windows beta4
-candidate: source/tag `2fede5a76eca6af508e3a2f2f6d356e1d0123573` /
-`0.1.78-windows.beta4`, ZIP SHA-256
-`5b11221137e5406c371b01dcc220bd5dcb761a3064882091e0547c37fd9dc215`,
+The completed local exact-artifact record is the unpublished Windows beta5
+candidate: source/tag `445f6916208e148084c247789a7becae2d4e7148` /
+`0.1.78-windows.beta5`, ZIP SHA-256
+`f3a1dd595d6c15c4295f9455bbb00ec44a12d3a057bd4d8d9f1988fd0607fc55`,
 source-custody ZIP SHA-256
-`2e2481a9f46d04776c9e1127e34ce691e50a24256590b60799b7bfc075785130`,
-and versioned handoff `GraphCode-DevBox-Handoff-0.1.78-windows.beta4`. The tag
+`05f356579bbe16b1997e1e09d2a99ee0c5ae431bcb5bfe7ea766a93c77e22046`,
+and versioned handoff `GraphCode-DevBox-Handoff-0.1.78-windows.beta5`. The tag
 is local and unpushed, there is no matching release, and publication is false.
 README-FIRST requires restoration through the included
 `Restore-GraphCodeSource.ps1`; it forbids GitHub cloning and bare-bundle
-cloning for this custody path. The superseded beta1 and beta2 tags, ZIPs, and
-original handoffs remain immutable historical evidence; do not transfer or
-qualify them and do not delete or rewrite their records. The local Windows
+cloning for this custody path. The superseded beta1, beta2, beta3 and beta4 tags, ZIPs, handoffs and retained
+failure evidence remain immutable; do not transfer or qualify them and do not
+delete or rewrite their records. The local Windows
 beta1 tag object remains retained unchanged, but its `0.1.78-beta1` name is
 permanently nonpublishable because the unrelated Nod/macOS prerelease owns that
 remote namespace. This plan authorizes no remediation or mutation of either
@@ -760,10 +762,10 @@ execute either side without relying on hidden session state:
   runs the production/native/backend/lifecycle evidence on a new corporate
   Dev Box, cleans up and returns a hashed evidence bundle. It never publishes.
 
-For `0.1.78-windows.beta4`, the versioned handoff binds the exact candidate source/tag, ZIP,
+For `0.1.78-windows.beta5`, the versioned handoff binds the exact candidate source/tag, ZIP,
 source-custody ZIP, provider/toolchain identities, Approval A, and the exact
 candidate Dev Box plan whose SHA-256 is
-`f250629ad6812049ec1beb5409cfa05afd09433ea5cd1a3818b3fccd9c0cb8b6`.
+`7693ff32e8b76ed99ed5094e8e2c7f3012c72d827b3eb6a374c7a812b8d7a1b6`.
 Use the included custody restore script before any Dev Box qualification; do
 not substitute GitHub or a bare Git bundle. Any identity change invalidates
 downstream evidence and restarts qualification from the local plan. The
@@ -806,10 +808,10 @@ The bounded source/tooling queue is complete. Remaining work is bottom-up and
 permission-bound; it should not start with another parity-row sweep:
 
 1. **Installed production-core and onboarding qualification - #556:** the
-   exact source-bound Windows beta4 candidate
-   `2fede5a76eca6af508e3a2f2f6d356e1d0123573` was built through
+   exact source-bound Windows beta5 candidate
+   `445f6916208e148084c247789a7becae2d4e7148` was built through
    [#578](https://github.com/scgopi/GraphCode/pull/578)'s supported route with
-   the #604 release-candidate guard. Its independently reverified
+   the #604 release-candidate guard and includes #624 and #626. Its independently reverified
    LFS-aware custody ZIP and versioned handoff now exist; transfer and Dev Box
    execution are still NotExecuted. After authorization, use the included
    restore script and the exact candidate Dev Box plan to run
@@ -830,7 +832,7 @@ permission-bound; it should not start with another parity-row sweep:
    future dump-backed diagnosis requires separate authorization and a new
    candidate if product code changes.
 3. **Keep the release gates honest:** **Exact artifact** is complete for
-   `0.1.78-windows.beta4`;
+   `0.1.78-windows.beta5`;
    the other **six** gates remain open. The installed production-core result,
    native input and destructive fixture permission, named authenticated backend
    authorization, handoff transfer and execution, Approval B, and publication