[coneilen]

Summary

Replace the independent captioned Windows modal implementations with one owner-bounded dark sheet framework that sizes from content, scrolls only overflowing content above a fixed footer, and preserves native input and automation behavior. Refs #768.

Changes

• Add SheetFramework.zig for rounded owner-client sheets, dimming scrims, DPI-aware content/footer geometry, overflow scrolling, measured multi-row footers, dark native painting, focus rings, default actions, and modal lifecycle cleanup.
• Migrate node/edge/update/promotion/settings/worktree forms, text prompts and confirmations, Product Settings, Workspace Manager, repository and Codespace ingress, and update offer/install dialogs to the shared host.
• Match the macOS Rename/Delete title, body, actions, selected initial value, and Return behavior; replace system confirmations with role-aware custom sheets while retaining the captured blue destructive-action treatment.
• Preserve dynamic validation, native control IDs, tab traversal, focused footer actions, async worker cancellation/results, policy persistence, owned values, Unicode, and post-modal identity revalidation.
• Update the UIA/ValidationRunner contracts for exact surface titles and semantic content without weakening PID, root, visibility, focus, or target-identity guards.
• Merge current main through Add DPI-parametric matched capture harness #907, Clean stale Windows update rollback backups #908, Keep Windows sidebar usable at narrow widths #909, and Finish Windows workspace chrome parity #910 with signed non-force merges. The App.zig delta remains limited to Rename, Delete Loop, recoverable workspace confirmation, and the existing confirmation test.

Test plan

RED: & $env:GRAPHCODE_ZIG0152 test src\NativeForms.zig -target x86_64-windows-msvc -lc -luser32 -lgdi32 "-I$env:GRAPHCODE_WINGHOSTTY_ROOT\include" --test-filter "dialog framework:" --cache-dir C:\gcs\df768\cache\native-red --global-cache-dir C:\gcs\df768\zig-global -> 5 executed, 5 failed: fixed promotion height, 92-unit policy extent, host-owned scrolling, enabled invalid primary, and transparent static brush.
GREEN: & $env:GRAPHCODE_ZIG0152 test src\NativeForms.zig -target x86_64-windows-msvc -lc -luser32 -lgdi32 "-I$env:GRAPHCODE_WINGHOSTTY_ROOT\include" --cache-dir C:\gcs\df768\cache\pr-final-native-focused --global-cache-dir C:\gcs\df768\zig-global -> All 342 tests passed on the latest-main merged source, including default/focused footer action routing.
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> PASS: Pester 14 executed, UI scenarios 166/166, UI capture driver 181/181 on the latest-main merged head.

Final pinned root	Result
SheetFramework.zig	31/31 passed
NativeForms.zig	342/342 passed
WindowsNativeDialogs.zig	58/58 passed
GraphContextMenu.zig	264/264 passed
WindowsProductSettings.zig	49/49 passed
WorkspaceManagerForm.zig --test-filter "workspace manager"	26/26 passed
WindowsRepositoryDialogs.zig	43/43 passed
WindowsCodespaceDialog.zig	49/49 passed
UpdateOfferDialog.zig	38/38 passed
UpdateInstallDialog.zig	66/66 passed

PowerShell parse checks passed for ValidationRunner.Tests.ps1, WindowsShell.Tests.ps1, and uia-live-gate.ps1. zig fmt --check passed for the changed Zig roots other than the pre-existing non-canonical full App.zig; its 11 diff hunks were checked directly against the approved functions. git diff --check origin/main...HEAD, signed-commit checks, clean-worktree checks, and committed-blob LF checks passed for all 16 changed files.

The full App test command initially could not run because the owned tool root did not contain the two prepared static libraries. A no-emit pinned App compile of App.zig, AccessibilityProvider.cpp, FilePicker.c, and FolderPicker.c with the production target/includes/link declarations and --test-filter "workspace delete confirmation" exited 0 after fixing the detected local-title shadowing. This is compile evidence, not an executed App test.

The hosted unit partition commands were also exercised locally after the CI fixes: shard 1 passed all 16 assigned sections and shard 2 passed all 22 assigned sections. Shard 0 was not rerun in the final owned environment because its prepared Winghostty static library was absent; the workflow prepares that artifact before exact-head execution.

The retained RED logs are under C:\gcs\df768\evidence\red; GREEN/regression and review-fix logs are under C:\gcs\df768\evidence\green, review-fixes, review-fixes-2, review-fixes-3, and pr-final. Initial standalone updater test invocations that omitted -lgdi32 failed at link time and are retained separately; corrected established commands passed.

Independent review found and verified fixes for title loss, nested Tab traversal, covered scrollbars, DPI/scrim drift, measured footer labels and return hints, async modal closure, field-read failure closure, updater default actions, stale DPI fonts, stale enabled states, narrow-owner footer clipping, NativeForms Enter/focused-button routing, owner-focus restoration, palette inventory, and fail-closed unknown control routing. The final review reported no significant remaining issues.

After a hosted integration job hung after repository ingress, cross-process WM_COMMAND sends were bounded with SendMessageTimeoutW (SMTO_BLOCK | SMTO_ABORTIFHUNG, 5000 ms) and the Clone/Add SSH transitions gained before/after attribution markers. Captionless NativeForms discovery now uses the same owned-sheet class/title path rather than desktop ControlType.Window enumeration. A session-owned production probe drove Clone, Add SSH, Create/Edit Edge, Project Settings, and Worktrees through real owned host discovery, UIA descendant enumeration, invalid validation where applicable, and clean close/transition; all five completed. ValidationRunner rejects dead-call and reordered-marker mutants, then passed its complete 181-case capture-driver suite.

The final stacked-sheet regression first failed behaviorally with expected 6192, found 2: IsDialogMessageW translated Escape into WM_COMMAND IDCANCEL, while Product Settings uses footer cancel ID 6192. The shared host now redirects only dialog-manager IDCANCEL commands with no control source to the configured nonstandard cancel-role action; standard ID 2, sheets without cancel actions, unrelated commands, and direct control activation remain unchanged. A focused real-product probe opened Product Settings above Update Offer, closed only Product Settings with Escape, re-enabled the shell owner, and preserved the same visible captionless GraphCodeUpdateOffer handle, owner, title, and content class. The final focused source mutants reject optional/missing underlying Update sheets and unconditional owned-sheet returns. Full ValidationRunner then passed Pester 14 and UiCaptureDriver 181/181.

Not verified: the complete live UIA gate after the repository scenes, real rendered 100/150/200% DPI, mixed-monitor hardware, physical keyboard input, screen-reader behavior, application/daemon/zmx persistence, or paired current Windows/macOS screenshots. No screenshot/capture lease was used. These remaining runtime and visual claims are explicitly unverified rather than inferred from hidden native-window tests.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure