fix: keep ATELIER navigation reachable in short high-DPI windows

[lop-spec]

Hosted native investigation closed — 2026-09-17

• Hosted WebView2 startup experiments are paused in CI (12d0dec); no token, SDDL or native launch is repeated by that step. It emits an unconditional reason and fails the unpassed native gate rather than turning a missing result into green acceptance. The bounded display-capability inventory remains separate and is not UI acceptance. No more token/SDDL probes are planned.
• Final read-only artifact: run 35165918336, artifact 10475017264, SHA-256 4f30a25fff30f301eb8824e926d8bc68d2e1af11fb788dbbb7745d0b50066d73. Existing WinSta0 and Default both have Low mandatory labels, S:(ML;;NW;;;LW), not High. The high-label explanation is therefore rejected. There was no process launch or security change. This does not establish the remaining cause of the Medium wrapper's 0xC0000142, nor the original controller's 0x80070578.
• The runner was observed in session 2 / WinSta0, so a blanket claim that it was a non-interactive session is not supported by the recorded capability. Stopping this investigation is a scope/return-on-effort decision, not a claim that all hosted native rendering is structurally impossible.
• 125% is already accepted on the real peer desktop: DPI120/DPR1.25, 70 checks, zero failures, seven-page/long-list visual review, unchanged protected files, no remaining owned processes. Its earlier 150s no-report failure was resolved by adding the missing local stream-quality.js resource; the corrected 21-file resource graph and successful outputs are retained. Do not reopen that resolved failure as the current blocker.
• 100/150/175% still have no accepted native matrix. Continue only on already-available suitable real desktop/DPI environments; do not change system DPI/UAC/shared ACLs or activate user desktops to manufacture a pass. ATELIER UI resources remain unchanged from the accepted 47f8884 baseline. No installation, merge, release or deployment; PR remains draft.
• Work now prioritizes full-catalog SSE timing and honest accuracy coverage on stream-quality#3. None of these diagnostic/build results counts toward the <=60s and unchanged-accuracy gate.

Retained investigation and prior checkpoints

Controller initialization checkpoint — 2026-09-17

• 100% remains unaccepted. The 125% checkpoint below still applies; UI resources/config/package remain unchanged through 894f309. 150/175% and the full 173-node, unchanged-accuracy, <=60-second SSE gate remain unpassed.
• Run 35163056862 captured the original WebView2 controller completion result: 0x80070578 / ERROR_INVALID_WINDOW_HANDLE, null controller, at the image-signature-verified RVA 0x758f5, in both first- and second-chance exceptions. Neutralino 6.8 unconditionally calls controller->AddRef in this callback. This explains the secondary 0xC0000005; it does not yet establish why the parent HWND was rejected. The installed runtime is present. Debugger diagnostics never count as UI acceptance; no owned processes remained.
• The diagnostic-only path now skips window enumeration; the initial debugger run's semaphore timeout and prior startup failures remain retained. CI no longer enables the debugger for the real UI matrix.
• Run 35163790679 proved that Task Scheduler Limited still ran as administrator: the account SID ends in -500 (built-in Administrator), for which Microsoft documents that RunLevel is ignored. The owned task was XML-exported, SHA-256 read back and removed. This known-failing task path is not retried for that identity.
• Read-only token probe 35164527874 created a same-user LUA token with administrator=false and elevation=0, but integrity still High (12288); the caller was unchanged and no process was started. This was capability evidence only.
• First Medium launch attempt 35165192837 failed before launch because the cloned handle lacked ADJUST_DEFAULT access. The corrected handle rights follow CreateRestrictedToken's documented same-access-rights behavior; the original token is only read, while only the cloned token's label is lowered. Failures now include the Win32 error number. New private GUID desktop security is supplied only at object creation; no shared desktop/station ACL is changed.
• Latest exact-head run 35165468963: failure. Same-user reduced token: administrator=false, elevation=0, integrity RID=8192, session=2; parent unchanged=true; owned processes remaining=0. Error: "Owned Medium wrapper failed: 0xC0000142". Verified artifact 10474837106, SHA-256 c392f0adc1becc5619ca6fa11cc9f225b764ca9db5b149baed0dc9d22972d220. Source and failures remain retained: https://github.com/lop-spec/smart-proxy-client/actions/runs/35165468963.
• No UAC/system-DPI change, shared-ACL modification, desktop activation, sandbox exemption, account creation, production installation, merge or release. PR stays draft. The next action must follow the latest concrete failure, not repeat a known-failing launch or relax the native/accuracy gates.

Earlier checkpoints (retained; current status above)

Native DPI checkpoint — 2026-09-17

• 125% native fixture acceptance passed: existing Windows DPI 120, WebView DPR 1.25; seven pages × five states × two window sizes = 70 checks, zero failures. All seven page screenshots and the long node list were visually reviewed. No external page resources, no owned processes left, protected production files unchanged.
• Provenance is explicit: UI fixture assets at 47f8884; the unchanged Neutralino host came from cloud source 4534609, EXE SHA-256 be7b09932b4bf9b56cd8ee0315db2c08136f5e278fccd32bd9d6d18c15114491, running directory-mode fixture resources. This is not a claim that the host EXE was built from 47f8884. UI resources/config/package are unchanged through 97db463.
• The first peer attempt failed because the fixture bundle omitted the startup stream-quality script; that failure is retained. Startup resource-graph regression checks passed after the packaging fix. Both owned peer tasks were exported/hash-verified and unregistered; exports remain, no processes were killed during task cleanup.
• 100% is not accepted: capability run 35158880449 found an existing interactive WinSta0 session, DPI 96 and installed WebView2 152.0.4191.66. Initial native run 35159990605 failed before launch because its legacy PowerShell child lacked Get-FileHash; the replacement SHA-256 implementation matches Node with module discovery disabled. Run 35160510510 then launched the native host, but it exited with 0xC0000005 after 2973 ms, before the 70-row matrix. The observed window was DPI 96 / 640×480. Owned processes remaining: zero; station and thread DPI restored/unchanged. Both failures and artifact digests are retained. Cloud tests/build/portable verification passed; native UI failed: https://github.com/lop-spec/smart-proxy-client/actions/runs/35160510510.
• A separate local C# compile validation lacked subprocess privileges; it was not called a pass or worked around with elevation. Native interop did execute in the cloud run.
• Next action is scoped startup-crash evidence, not a sandbox/ACL/DPI workaround. No desktop switch, system-DPI/UAC/shared-ACL change, runtime installation, production installation, merge or release. PR stays draft. 100/150/175% and the 173-node, unchanged-accuracy, <=60-second SSE gate remain unpassed.

Earlier investigation (retained; the checkpoint above supersedes status counts)

Scope

• Retain ATELIER colors, offline fonts, seven real pages and live controls.
• Remove the oversized sidebar minimum height; add compact-height navigation and independent overflow fallback.
• Reset document scroll only on view change, not same-view refresh; no focus or proxy-state operations.
• Put node cards before quality settings in DOM/narrow layout; advance asset/build identity.

Validation

• Native 175% DPI baseline screenshots exposed clipped Settings navigation and inherited document scroll.
• Client suite: 99/99; final UI-specific tests: 10/10.
• Draft: candidate rendered/native visual revalidation remains pending. Official background browser tab is owned by another session; do not take it over. UIA navigation was found to activate the window, so it was discontinued and the original minimized state restored.
• No installed EXE replacement, core restart, node switch, proxy/TUN change, or credential/configuration publication. Cloud CI only for candidate assets.
• Performance work is separate and not included in this PR.

Latest validation — 2026-09-16

This supersedes the initial native-rendering blocker above, but not the remaining DPI gate.

• Native WebView2 now runs on an owned inactive desktop, without switching the user desktop or activating daily windows. Seven pages × five synthetic states × two physical sizes (1240×837 and 1040×680): 70/70 DOM gates pass, with genuine native screenshots, offline CJK font loading, no external resources, no remaining owned processes, and unchanged private files.
• The audit separately records intentionally clipped accessibility labels and the logo update badge, with geometry. Font tracing proved resize recreates the CSS-connected FontFace; the fresh face is now explicitly loaded after resize before measuring. Failed audit outputs remain preserved.
• Supporting text/placeholder contrast was fixed in 47f8884; four targeted tests pass and cloud CI 35141489341 succeeds. Native source validation reuses the previously verified cloud Neutralino shell with matching current frontend assets; it is not a new packaged-artifact acceptance claim.
• Actual Windows DPI is 134 (DPR ≈1.395833). Four requested Chromium scale flags were ignored by this WebView host, so 100/125/150/175% native Windows DPI acceptance remains unverified. No CSS-equivalent scale is counted as native DPI.
• Still draft; no candidate installation, merge, release, proxy/core changes, or source deployment.

Isolated native-host follow-up — 2026-09-16

• The previously passing 70/70 audit remains preserved at actual DPI 134; it is not four-scale Windows DPI acceptance.
• Read-only token inspection confirms the Limited scheduled-task setting still produced a high-integrity administrator token with UAC disabled. No UAC, system scaling, daily desktop ACL or privilege-escalation changes were made.
• An owned restricted child token was verified as Medium / not elevated. The initial PowerShell helper exited with 0xc0000142 before rendering. Directly starting the native candidate on its owned inactive desktop then created windows but did not finish WebView initialization within the 190-second bound. Repeating with normal inherited desktop security had the same outcome; the experimental desktop descriptor is therefore not established as the sole cause. No sandbox was disabled and no desktop switch was used.
• Both direct attempts report zero remaining owned processes and unchanged private files. All five temporary inspection/audit tasks were identity-checked, exported, physically backed up and removed; failures remain preserved. This path is paused rather than counted as scale success.
• No new frontend change, candidate installation, merge, release or daily proxy/core change. Four real Windows DPI scales and final native visual acceptance remain unverified; PR stays draft.