[coneilen]

Summary

Fix the Windows live UIA gate so DPI-dependent sidebar virtualization does not require every owned row to expose visible bounds simultaneously.

Changes

• Scroll and reacquire the exact Graph, Quick Chats, section, and open-owner rows in a bounded six-target sequence.
• Freeze each UIA capture to point-in-time identity, process, name, order, and bounds values so later scrolling cannot mutate earlier evidence.
• Reject missing, foreign-process, duplicate, reordered, stale, or success-shaped empty evidence.
• Apply the same bounded proof to Needs-you rows, then restore the sidebar viewport before later gate phases.
• Keep product accessibility and context-menu behavior unchanged.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> RED: UIA live gate is missing its bounded sidebar scroll/reacquire proof
GREEN: pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> UiScenario 166/166 and UiCaptureDriver 182/182 passed
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\AccessibilityProvider.Native.Tests.ps1; pwsh -NoProfile -File Tools\windows\Tests\Hardening.Tests.ps1 -SkipTrayLive -> native UIA 224/224 and hardening 3/3 passed

• Final parser/source contracts passed with 13 sidebar fixtures: 7 positive and 6 negative.
• A final ValidationRunner rerun again passed UiScenario 166/166, then hit unrelated intermittent UiCapture worker/seed/rehearsal failures; the earlier complete run passed 182/182 with zero skips.
• DPI192 live evidence reported 7 frozen captures, 6/6 exact rows, 4/4 exact controls, no missing identities, and one bounded Needs-you row. Process-tree cleanup and default-profile isolation were verified.
• After the sidebar proof, the live run reached dynamic project card has empty bounds. A scratch copy of the unmodified HEAD gate with only the original sidebar row/control/Needs-you assertions bypassed reached the same cutoff, confirming it is pre-existing and unrelated.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure