[vaibhavsrv]

Summary

Fixes #8154.

Compose failure diagnostics now save reports under install directories containing square brackets, including fresh Docker client configuration, command working directories, and failed-image log discovery. The new controls exercise the outer SaveReport path, preserve caller state, and verify that a wildcard-matching neighbor remains untouched.

Release lane and changed surface

Mainline change targeting main; Windows installer/CLI diagnostics. Operational change with narrowly scoped native Windows validation. No full installer or fleet-green claim.

Validation

• Reviewed head e480eb0df84d8f8ca134e991d594afbf88e08862. git diff --check and changed production scripts passed the repository PSScriptAnalyzer rules.

• test-windows-runtime-recovery.ps1 passed on this Windows laptop under Windows PowerShell 5.1.26100.9711 and PowerShell 7. The expanded tests reproduced the remaining failure before the repair, then passed with it. Filesystem operations and path bindings are real; command/network/hardware doubles in the contract tests are explicit.

• Separate native runs used the real production entry path and real Docker CLI under both PowerShell versions, an isolated bracketed install fixture, an empty Docker config, and a deliberately unavailable named-pipe Docker endpoint. Reports were saved successfully; no running ODS installation or Docker service was changed. Fixture directories were removed after verification.

• GitHub CI for this head must finish before merge. Broader Portal/model-switch/fleet acceptance remains separate.

Risk and AI assistance

Scoped support-diagnostics repair. Shared path readers keep their existing selection behavior while treating filesystem names literally. AI assisted investigation, edits, and validation; Codex independently reviewed source and native execution evidence. This is not a claim of independent human review.

Current main refresh: d15c97ed550adb4f30d24db6776c3e61cff7b57c is included at head e480eb0df84d8f8ca134e991d594afbf88e08862. This merge changes only the Python 3.9 CI runner; the entire candidate ods/ tree is identical to its pre-refresh source. CI for this new head is pending.
The contract test now exits successfully after its deliberately failed Docker fixture; both PowerShell versions passed the GitHub Actions-style invocation. Production sources are unchanged by that follow-up.

[vaibhavsrv]

Integrated into main via #8165 with co-authorship. Closing as superseded.