Wire orphaned Zig test files into WindowsShell.Tests.ps1 and add anti-drift guard

[coneilen]

Fixes #424.

Problem

Tools/windows/Tests/WindowsShell.Tests.ps1 hand-maintained a list of zig test invocations that missed a growing set of files. Since #421 landed (adding Accessibility.zig), the remaining orphaned set was 17 files, not 20/95 as originally scoped in the issue -- corrected counts confirmed against merged main (68eabe5). GraphContextMenu.zig and MainWindow.zig are reserved for in-flight #418 (PR #422) and intentionally not wired here.

What this PR does

1. Wires all 17 remaining orphaned files into the harness with per-file zig test invocations, flags verified against pinned Zig 0.15.2 (-target x86_64-windows-msvc -lc plus -luser32/-lgdi32/-lwinhttp/-loleaut32/-luiautomationcore and "-I$include" as each file's actual link requirements dictated -- copied from the nearest comparable existing entry, not guessed).
2. Adds a structural anti-drift guard: enumerates graphcode-windows\src\*.zig, regex-detects ^test " blocks, and throws if any such file is absent from the harness's $wiredTestFiles list. Runs as part of WindowsShell.Tests.ps1, which CI already invokes via validate.ps1 -Task windows-shell (.github/workflows/windows-shell.yml). Verified by actual mutation, not just asserted: removing WorktreeDialog.zig from the list reproduces the exact failure mode the guard exists to catch (Windows shell contract: ... not wired into any zig test invocation ...: WorktreeDialog.zig, exit 1). The guard also correctly reports GraphContextMenu.zig, MainWindow.zig as missing right now -- that is the guard doing its job pending Windows UIA gate cannot open or inspect native context menus (TrackPopupMenu) #418/Windows: inspect native context menus in the UIA live gate #422, not a bug here.
3. Does not touch Sidebar.zig or GraphCanvas.zig source. Sidebar.zig's existing 93 tests are wired in as-is.

Coordination

• GraphContextMenu.zig/MainWindow.zig: left to Windows UIA gate cannot open or inspect native context menus (TrackPopupMenu) #418/PR Windows: inspect native context menus in the UIA live gate #422 to avoid duplicate harness entries. Guard will pass once either PR lands.
• Accessibility.zig: not wired here -- Fix Windows UIA contract parity #421 already added zig test src\Accessibility.zig to this same harness on main. Rebased onto origin/main (68eabe5) and resolved the merge conflict by keeping Fix Windows UIA contract parity #421's invocation and folding it into $wiredTestFiles.
• Did not touch Accessibility.zig, AccessibilityProvider.cpp, uia-live-gate.ps1, or any parity ledger row (Fix Windows UIA contract parity #421, Correct overclaimed Show in Graph parity evidence #423 territory).
• Did not touch NativeForms.zig, App.zig production logic, or UpdateOfferPresentation.zig (Guard NativeForms modal reentrancy #420 territory) beyond the one stale-fixture test fix in App.zig described below.

First-run test failures and how each was handled

• WorktreeDialog.zig -- "multi-select requires explicit confirmation and fails closed": failed on first run. Root cause: the test used a dirty fixture entry to exercise the "unsafe selection" fail-closed path, but WorktreeStatus.sweepSelectable() intentionally permits dirty rows (confirmed by a sibling WorktreeDialog test and WorktreeStatus's own passing tests). The test encoded a stale expectation, not a real bug. Fixed the test: swapped the fixture to a locked entry, and forced .selected = true directly (bypassing toggle(), which already blocks unsafe rows from ever being selected) so the test independently proves armConfirmation()'s own defense-in-depth check. All 13 tests in the file now pass.
• App.zig -- "edge drop source remains valid across synchronous capture cancellation": failed to compile on first run -- the test's App struct literal predated three fields (sidebar_state, declared_entry_ids, kept_worktree_paths) added to App since the test last compiled. Fixed the test to initialize them the same way App.init() does, with matching deinit() defers. Not a product bug -- a stale test fixture.
• Sidebar.zig -- 3 real, pre-existing failures, quarantined (not fixed, not deleted, not weakened), all one root cause: when a project in recent_projects is also the currently-open project/graph, appendRows() correctly excludes it from rendered project rows (isProjectOpen filter), but Layout.projectSectionHeight() and dependent offset math (loopTop(), sharedGraphTop, maxScroll()) still count it, desyncing computed y-coordinates/scroll bounds from actual rendered rows:
  • "shared sidebar layout routes every loop row after project rows and scroll"
  • "sidebar scroll clamps overflow, shrink, and resize" (also surfaces a leaked inspection.entries because the test's early try bails before its own deinit() -- a side effect of the same failure, not independent)
  • "recent project rows exclude folders already open in the projects list"
    This is a real product bug in Sidebar.zig, filed as Sidebar: layoutFor counts open recent projects as rendered rows, corrupting section height, scroll clamp, and hit testing #428 (with the exact root-cause writeup, the 76px delta, and the hit-testing failure). Per explicit instruction, Sidebar.zig source is not modified in this PR -- these three are quarantined at the harness level (Invoke-NativeQuarantined), pointing its reason string at Sidebar: layoutFor counts open recent projects as rendered rows, corrupting section height, scroll clamp, and hit testing #428 rather than fixing it here.
  • App.zig transitively reruns these same 3 failures (it imports Sidebar.zig) and is quarantined identically.

90/93 Sidebar.zig tests and 228/231 App.zig tests pass; the only failures anywhere in the newly-wired set are the 3 (same-root-cause) Sidebar failures, surfacing twice.

What CI proves vs. what I verified locally

Verified locally against pinned Zig 0.15.2 (resolved via the bootstrap.ps1 SHA256 pin, not the ambient 0.16.0 toolchain, which is a different and misleading compiler): every individual newly-wired file compiles/runs standalone with the flags now in the harness, and the complete edited WindowsShell.Tests.ps1 runs end-to-end (all 37 zig test invocations in sequence, guard included) with the correct pass/quarantine outcome. I could not run the full uia-live-gate.ps1 locally (pinned zmx does not build against local Zig 0.16 here) -- CI is authoritative for any live-gate assertions; I am not implying local coverage of that path.

RED: WorktreeDialog/App.zig fixtures failed to compile pre-fix, 3 Sidebar tests failed pre-#430 -> stale fixtures fixed, 2 real defects (product + test oracle) identified and left to #428/#430 rather than fixed in this harness PR.
GREEN: post-#430 rebase, full harness run with pinned Zig 0.15.2 -> exit 0, 93/93 Sidebar.zig and 232/232 App.zig tests pass unconditionally, quarantine mechanism fully removed with no residual tolerate-list.
REGRESSION: mechanical set-difference against origin/main (ece5935) and guard-mutation replay rerun after every rebase -> main-minus-mine empty every time, guard still throws exit 1 with the exact expected message when a wired file is removed, UpdateOfferPresentation.zig and the NativeForms Assert-Contract block both confirmed intact post-rebase.

Run vs. verified: tautology skim (post-#421 guidance)

Per the review guidance from the #421 session (whose merged fix corrected the pre-existing Accessibility.zig test that asserted defaultContract() against itself -- producer and oracle were the same declaration -- and so would have passed regardless of correctness), I did a skeptical, per-test skim of all 17 newly-wired files, not just a "it ran green" check.

16 of 17 files: no tautology found. Every sampled test compares production output against a literal/independent expected value (numeric constants, hard-coded strings, fixtures built via a separate path, or cross-checks between two different code paths such as layout math vs. hit-testing). Sidebar.zig and App.zig were spot-checked across 15 representative tests each (out of 93 and ~231 respectively, the latter counting transitively pulled files) given their size, prioritizing tests whose names suggested a self-comparison risk; none were found.

2 tests flagged, in files that otherwise pass real assertions elsewhere:

• QuickChats.zig -- "quick chat operations are available through the daemon controller": Availability is a single-variant enum (available is its only member) and Controller.availability()/Controller.request() unconditionally return that one value. The test can only ever pass -- there is no code change to Controller that could make it fail without also failing to compile. Not the same producer/oracle pattern as Accessibility.zig (no shared in-memory object), but equally unable to catch a regression. Flagging, not touching -- out of scope for this PR per your "flag, don't fix" guidance.
• UpdateOfferDialog.zig -- "update offer keeps install unavailable while preserving explicit actions": literally expectEqual(Action.later, .later) for each of three enum values -- no production function is called at all. This one is a straightforward tautology. Flagging, not touching, for the same reason.

Both are pre-existing tests being newly wired into CI, not something introduced by this PR; I'm surfacing them per the explicit request to report tautological-looking passes rather than silently checking the box.

Post-rebase update: #422 landed, guard now passes clean; corrected quarantine attribution

Rebased onto origin/main after #422 (issue #418, GraphContextMenu.zig/MainWindow.zig) merged as 06e092e. Clean rebase, no conflicts (my 775d77b cherry-pick -- see below -- was recognized as already-applied and skipped). Mechanically re-verified rather than trusted by eye: main now has 22 wired files (20 + #422's 2), this branch has 39 (22 + this PR's 17), and the set difference (main minus this branch) is empty.

#422 wired the two files' zig test invocations and source-list entries, but never touched this PR's own $wiredTestFiles guard array -- that array didn't exist on main when #422 was authored, since it's this PR's own addition. Added "GraphContextMenu.zig" and "MainWindow.zig" to that list and updated the guard's explanatory comment (previously described them as reserved/not-yet-landed, now stale). The complete harness now runs end-to-end locally with pinned Zig 0.15.2 and exits 0 -- the guard no longer fires at all, including the new GraphContextMenu.zig (8/8) and MainWindow.zig (6/6, twice via App.zig's transitive import) invocations.

Corrected the Sidebar.zig quarantine attribution. An independent review determined only 2 of the 3 quarantined failures are the real layoutFor()/appendRows() product bug (#428, fix in flight as #430): "shared sidebar layout routes every loop row after project rows and scroll" and "recent project rows exclude folders already open in the projects list". The third, "sidebar scroll clamps overflow, shrink, and resize" (expected 334, found 410), is a separate, stale test expectation, not a product defect -- the 76px delta is exactly the Activity block height that contentBottom reserves and paint() renders, which the test's own oracle simply omitted. Left it quarantined alongside the other two (not fixed) since this PR must not modify Sidebar.zig source, including its test blocks -- but the quarantine reason string now attributes each failure accurately rather than lumping all three under one root cause.

The guard caught this drop live in CI, not just in my local simulation

Before I opened this section above, my branch (base 68eabe5) predated #420's merge (775d77b, "Guard native form modal reentrancy"), so NativeForms.zig's reentrancy-guard Assert-Contract, the UpdateOfferPresentation.zig source-list entry, and its zig test invocation were all absent here even though they existed on main -- caught by a reviewer diffing this branch's wired-file set against main. Restored via git cherry-pick 775d77b (clean).

The guard caught the resulting gap on its own, in the actual windows-shell CI run on that commit, without anyone asking it to look:

Windows shell contract: the following src\*.zig files contain test blocks but are not wired into any zig test
invocation in WindowsShell.Tests.ps1 (see issue #424): GraphContextMenu.zig, MainWindow.zig,
UpdateOfferPresentation.zig

That's real accidental data loss caught by the mechanism this PR exists to build, not a synthetic demonstration. Fixed by adding "UpdateOfferPresentation.zig" to $wiredTestFiles.

Stated limitation, precisely scoped: the guard caught the test-invocation drop (1 of the 3 things #420 added). It did not and structurally cannot catch the dropped Assert-Contract block for NativeForms.isModalActive()/UpdateOfferPresentation.decide(...) -- the guard only enumerates src\*.zig files with a test " block against $wiredTestFiles; it has no visibility into Assert-Contract calls elsewhere in this same script. A future merge that silently drops a contract assertion would not be caught by this guard. That boundary is intentional and out of scope to close here -- an accurately-scoped guard is worth more than an overclaimed one.

One more pre-existing-test repair, noted for completeness

The App.zig test-fixture fix described above (adding sidebar_state, declared_entry_ids, kept_worktree_paths to the test's App struct literal) turned out to be load-bearing beyond this PR: App.zig's test build does not compile on current main without it. The #430 session (fixing the real Sidebar.zig bug) hit the same compile failure independently and applied this same fix temporarily to verify its own work. Wiring App.zig into the harness required repairing a test fixture that had silently rotted while nothing compiled it -- itself further evidence for why this PR's guard needs to exist.

Final update: #430 merged (ece5935); quarantine removed entirely, Sidebar/App.zig gate unconditionally

Rebased onto origin/main at ece5935 (also includes #425). Re-verified the set difference mechanically against the new base -- main now has 22 wired files (unchanged from the #422 rebase), this branch has 39-40 (the guard's own $wiredTestFiles list carries one extra bookkeeping alias beyond the raw invocation count), and main minus this branch is still empty. UpdateOfferPresentation.zig's wiring and the NativeForms/decide(...) Assert-Contract block are both confirmed still present after this rebase.

#430 fixed the real Sidebar.zig bug structurally, not with a point patch: a single shared predicate, projectIsVisibleInSection (Sidebar.zig:669), now drives row emission (:507, :518), heading presence (:655, :662), and the count feeding layout geometry (:681). Counter and renderer are the same code path now and can no longer independently drift. Because that fix landed on main before this PR, I removed the quarantine mechanism from this PR entirely rather than landing it pre-fixed-and-obsolete:

• Deleted the Invoke-NativeQuarantined function and its Get-FailingZigTestNames helper outright -- the Sidebar.zig/App.zig call sites were their only consumers, so no dead quarantine machinery is left behind for a future change to quietly add a name to.
• Deleted the $sidebarLayoutOpenProjectKnownFailures/$sidebarLayoutOpenProjectReason variables.
• Converted both call sites ("Sidebar executable tests", "App shell executable tests") to plain Invoke-Native, identical script blocks, no tolerate-list.
• Ran the complete harness end-to-end locally with pinned Zig 0.15.2 post-rebase: exit 0, all 93 Sidebar.zig tests pass unconditionally, the full App.zig suite (232 tests, including the transitively-imported Sidebar tests) passes unconditionally, zero quarantine output anywhere in the run. All three previously-quarantined test names -- "shared sidebar layout routes every loop row after project rows and scroll", "recent project rows exclude folders already open in the projects list", and "sidebar scroll clamps overflow, shrink, and resize" -- now pass for real, confirmed by name in the harness output, not merely "no crash."

Corrected attribution, now final and past-tense (#428, closed): of the three, two were the real product bug above; the third ("sidebar scroll clamps overflow, shrink, and resize", old expectation 334 vs. actual 410) was never a product defect -- the 76px delta was exactly the Activity block height that contentBottom reserves and paint() renders, which that test's oracle had simply omitted. #430 also caught and fixed a second, subtler defect in that same test while correcting its oracle: the clamp loop drives 10 iterations x 40px = 400px, which happened to exceed the old wrong 334 expectation but not the corrected 410 -- so a naive retune to "just past 410" would have made the test pass while silently no longer exercising clamping at all. #430 fixed this by having the loop overshoot more generously rather than retuning to the boundary. That is a test that ran, passed, and proved nothing -- the same class of defect as a test that never ran, and a second concrete instance (beyond the QuickChats.zig/UpdateOfferDialog.zig tautologies flagged earlier in this PR) of why "wiring a test in" and "that test actually asserting something real" are two different claims.

This PR's central evidence, in full, three independent pieces:

1. ~91 tests across 20 files had never executed, ever, with no escape hatch: no zig build test step exists (build.zig declares none), no file uses addTest, and git grep refAllDecls -- graphcode-windows/src returns zero matches repo-wide -- so nothing transitively pulled these files' tests into any invocation that did run.
2. This PR's own guard caught a genuine, accidental drop live in CI, mid-review, with nobody hunting for it: UpdateOfferPresentation.zig, lost from this very branch during a rebase across the file this PR hardens, reported by name by the mechanism this PR exists to add.
3. First execution surfaced two defects of different kinds, not one: a real product bug (Sidebar.zig layout/row-count desync, Sidebar: layoutFor counts open recent projects as rendered rows, corrupting section height, scroll clamp, and hit testing #428, fixed by Windows: stop counting already-open recent projects as rendered sidebar rows #430) and a stale test oracle (Sidebar.zig scroll-clamp expectation, also corrected by Windows: stop counting already-open recent projects as rendered sidebar rows #430) -- plus, separately, the Windows: stop counting already-open recent projects as rendered sidebar rows #430 near-miss where retuning that same oracle would have left the test passing without testing anything.

Scope, stated plainly and unchanged from earlier in this PR: the guard checks test wiring -- whether a test "..." block in a src\*.zig file is reachable from some zig test invocation in this harness -- not Assert-Contract call sites elsewhere in the script. A future change that silently drops a contract assertion (as nearly happened with NativeForms/UpdateOfferPresentation.decide(...) above) stays invisible to this guard. That is an intentional, named boundary, not an oversight, and closing it is out of scope here.